@skein-code/cli 0.3.14 → 0.3.16

package/dist/cli.js

@@ -220,7 +220,7 @@ function isSqliteBusy(error) {
 // package.json
 var package_default = {
   name: "@skein-code/cli",
-  version: "0.3.14",
+  version: "0.3.16",
   description: "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   type: "module",
   license: "MIT",
@@ -236,6 +236,12 @@ var package_default = {
   },
   skein: {
     releaseNotes: [
+      "Duplication warnings now aggregate into the single completion receipt without changing verified status",
+      "Exact match ids support bounded, reason-coded suppression with audit and credential/code-block safeguards",
+      "Duplication audit tools are disclosed only when active warnings exist and repaired paths clear stale matches",
+      "Warning-only TS/JS duplication audit compares new functions with the pre-write index generation",
+      "Deterministic Type-1/2 and Type-3 receipts retain only hashes, locations, scores, and bounded counts",
+      "Ordinary edits, renames, moves, deletions, small functions, tests, generated paths, and failed writes stay quiet",
       "Warning-only Reuse Gate records content-free candidate evidence before the first substantive write",
       "Reuse receipts surface unresolved index/read failures instead of claiming a safe new implementation",
       "Prompt and timeline diagnostics expose the repository-first reuse ladder without blocking legitimate writes",
@@ -993,16 +999,16 @@ async function hashRegularFile(path) {
   try {
     const info = await handle.stat();
     if (!info.isFile()) throw new Error(`Namespace entry is not a regular file: ${path}`);
-    const hash3 = createHash2("sha256");
+    const hash4 = createHash2("sha256");
     const buffer = Buffer.allocUnsafe(64 * 1024);
     let position = 0;
     while (true) {
       const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
       if (!bytesRead) break;
-      hash3.update(buffer.subarray(0, bytesRead));
+      hash4.update(buffer.subarray(0, bytesRead));
       position += bytesRead;
     }
-    return { sha256: hash3.digest("hex"), size: position };
+    return { sha256: hash4.digest("hex"), size: position };
   } finally {
     await handle.close();
   }
@@ -1203,18 +1209,18 @@ var MemoryStore = class {
       input2.lastVerifiedAt ?? (explicit ? now : void 0),
       "Memory verification time"
     );
-    const hash3 = createHash3("sha256").update(`${input2.scope}\0${scopeKey2}\0${content.toLocaleLowerCase()}`).digest("hex");
+    const hash4 = createHash3("sha256").update(`${input2.scope}\0${scopeKey2}\0${content.toLocaleLowerCase()}`).digest("hex");
     database.exec("BEGIN IMMEDIATE");
     try {
       const existing = database.prepare(
         "SELECT * FROM memories WHERE content_hash = ?"
-      ).get(hash3);
+      ).get(hash4);
       const conflicting = conflictKey ? database.prepare(`
           SELECT * FROM memories
           WHERE scope = ? AND scope_key = ? AND conflict_key = ?
             AND status = 'active' AND content_hash <> ?
           ORDER BY updated_at DESC
-        `).all(input2.scope, scopeKey2, conflictKey, hash3) : [];
+        `).all(input2.scope, scopeKey2, conflictKey, hash4) : [];
       const supersedesId = normalizeOptional(input2.supersedesId, 80) ?? conflicting[0]?.id;
       let id;
       if (existing) {
@@ -1259,7 +1265,7 @@ var MemoryStore = class {
           importance,
           confidence,
           source,
-          hash3,
+          hash4,
           now,
           now,
           now,
@@ -1362,10 +1368,10 @@ var MemoryStore = class {
     const conflictKey = normalizeOptional(input2.conflictKey, 240);
     const candidateDefaultExpiry = !input2.expiresAt ? new Date(Date.now() + MEMORY_CANDIDATE_TTL_MS).toISOString() : void 0;
     const expiresAt = normalizeTimestamp(input2.expiresAt ?? candidateDefaultExpiry, "Memory expiration");
-    const hash3 = createHash3("sha256").update(`${input2.scope}\0${scopeKey2}\0${content.toLocaleLowerCase()}`).digest("hex");
+    const hash4 = createHash3("sha256").update(`${input2.scope}\0${scopeKey2}\0${content.toLocaleLowerCase()}`).digest("hex");
     const existing = database.prepare(
       "SELECT * FROM memory_candidates WHERE content_hash = ?"
-    ).get(hash3);
+    ).get(hash4);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     if (existing) {
       if (existing.status === "approved" && existing.approved_memory_id) {
@@ -1412,7 +1418,7 @@ var MemoryStore = class {
       confidence,
       source,
       rationale,
-      hash3,
+      hash4,
       now,
       now,
       revision ?? null,
@@ -1699,8 +1705,8 @@ async function rejectSymlink(path, allowMissing = false) {
     throw error;
   }
 }
-function clamp(value, minimum, maximum) {
-  return Math.min(maximum, Math.max(minimum, value));
+function clamp(value, minimum2, maximum) {
+  return Math.min(maximum, Math.max(minimum2, value));
 }
 
 // src/tools/write.ts
@@ -2594,9 +2600,9 @@ function countExplicitPaths(value) {
 }
 
 // src/context/local-index.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { lstat as lstat8, readFile as readFile3, stat as stat3 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname7, extname, isAbsolute as isAbsolute3, join as join7, relative as relative5, resolve as resolve8, sep as sep4 } from "node:path";
+import { basename as basename5, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute3, join as join7, relative as relative5, resolve as resolve8, sep as sep4 } from "node:path";
 import fg from "fast-glob";
 import { z as z3 } from "zod";
 
@@ -2765,6 +2771,269 @@ function isEmojiOrSupplementarySymbol(character, codePoint) {
   return codePoint > 65535 || new RegExp("\\p{Extended_Pictographic}", "u").test(character);
 }
 
+// src/context/function-fingerprint.ts
+import { createHash as createHash5 } from "node:crypto";
+import { extname } from "node:path";
+var SUPPORTED = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+var MIN_FUNCTION_TOKENS = 40;
+var SHINGLE_SIZE = 10;
+var WINDOW_SIZE = 6;
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "async",
+  "await",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "function",
+  "if",
+  "in",
+  "instanceof",
+  "let",
+  "new",
+  "null",
+  "of",
+  "return",
+  "static",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "typeof",
+  "undefined",
+  "var",
+  "while",
+  "yield"
+]);
+function supportsFunctionFingerprintPath(path) {
+  return SUPPORTED.has(extname(path).toLocaleLowerCase()) && !isNoisePath(path);
+}
+function extractFunctionFingerprints(path, content) {
+  return extractFunctionFingerprintReport(path, content).functions;
+}
+function extractFunctionFingerprintReport(path, content) {
+  if (!supportsFunctionFingerprintPath(path)) return { functions: [], skippedSmallFunctions: 0 };
+  const masked = maskCommentsAndStrings(content);
+  const lineOffsets = lineStartOffsets(content);
+  const declarations2 = findDeclarations(masked);
+  const functions = [];
+  let skippedSmallFunctions = 0;
+  for (const declaration of declarations2) {
+    const open3 = declaration.open;
+    const close = matchingBrace(masked, open3);
+    if (close < 0) continue;
+    const body = content.slice(open3 + 1, close);
+    const normalizedTokens = normalizeFunctionTokens(body);
+    if (normalizedTokens.length < MIN_FUNCTION_TOKENS) {
+      skippedSmallFunctions += 1;
+      continue;
+    }
+    const startLine = lineAtOffset(lineOffsets, declaration.start);
+    const endLine = lineAtOffset(lineOffsets, close);
+    functions.push({
+      path,
+      symbol: declaration.symbol,
+      startLine,
+      endLine,
+      tokenCount: normalizedTokens.length,
+      exactHash: hash(normalizedTokens.join(" ")),
+      fingerprints: winnow(normalizedTokens),
+      normalizedTokens
+    });
+  }
+  return { functions, skippedSmallFunctions };
+}
+function fingerprintSimilarity(left, right) {
+  if (left.exactHash === right.exactHash) return 1;
+  const a = new Set(left.fingerprints);
+  const b = new Set(right.fingerprints);
+  if (!a.size || !b.size) return 0;
+  let intersection = 0;
+  for (const value of a) if (b.has(value)) intersection += 1;
+  return intersection / (a.size + b.size - intersection);
+}
+function findDeclarations(masked) {
+  const output2 = [];
+  const classBodies = findClassBodies(masked);
+  const patterns = [
+    {
+      kind: "function",
+      pattern: /(?:^|\n)\s*(?:export\s+)?(?:default\s+)?(?:async\s+)?function\s*\*?\s+([A-Za-z_$][\w$]*)(?:\s*<[^>{}\n]+>)?\s*\([^)]*\)\s*(?::\s*[^{}\n=]+)?\s*\{/g
+    },
+    {
+      kind: "arrow",
+      pattern: /(?:^|\n)\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)(?:\s*:\s*[^=\n]+)?\s*=\s*(?:async\s*)?(?:<[^>{}\n]+>\s*)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*(?::\s*[^={}\n]+)?=>\s*\{/g
+    },
+    {
+      kind: "method",
+      pattern: /(?:^|\n)\s*(?:(?:public|private|protected|static|readonly|abstract|override|get|set|async)\s+)*\*?\s*([A-Za-z_$][\w$]*)(?:\s*<[^>{}\n]+>)?\s*\([^)]*\)\s*(?::\s*[^{}\n=]+)?\s*\{/g
+    }
+  ];
+  for (const { kind, pattern } of patterns) {
+    for (const match of masked.matchAll(pattern)) {
+      const symbol = match[1];
+      if (!symbol || match.index === void 0) continue;
+      if (KEYWORDS.has(symbol) || symbol === "constructor") continue;
+      const start = match.index + match[0].indexOf(symbol);
+      if (kind === "method" && !isDirectClassMember(masked, start, classBodies)) continue;
+      output2.push({
+        symbol,
+        start,
+        open: match.index + match[0].lastIndexOf("{")
+      });
+    }
+  }
+  return output2.sort((left, right) => left.start - right.start);
+}
+function findClassBodies(masked) {
+  const output2 = [];
+  const pattern = /(?:^|\n)\s*(?:export\s+)?(?:default\s+)?(?:abstract\s+)?class(?:\s+[A-Za-z_$][\w$]*)?[^\n{]*\{/g;
+  for (const match of masked.matchAll(pattern)) {
+    if (match.index === void 0) continue;
+    const open3 = match.index + match[0].lastIndexOf("{");
+    const close = matchingBrace(masked, open3);
+    if (close >= 0) output2.push({ open: open3, close });
+  }
+  return output2.sort((left, right) => left.close - left.open - (right.close - right.open));
+}
+function isDirectClassMember(masked, start, classBodies) {
+  for (const body of classBodies) {
+    if (start <= body.open || start >= body.close) continue;
+    let depth = 1;
+    for (let index = body.open + 1; index < start; index += 1) {
+      if (masked[index] === "{") depth += 1;
+      else if (masked[index] === "}") depth -= 1;
+    }
+    if (depth === 1) return true;
+  }
+  return false;
+}
+function normalizeFunctionTokens(content) {
+  const masked = maskCommentsAndStrings(content, true);
+  const raw = masked.match(/[A-Za-z_$][\w$]*|\d+(?:\.\d+)?|===|!==|=>|==|!=|<=|>=|&&|\|\||\+\+|--|\?\?|\?\.|[{}()[\].,;:+\-*/%<>=!?&|^~]/g) ?? [];
+  return raw.map((token) => {
+    if (token === "LIT") return token;
+    if (/^[A-Za-z_$]/.test(token)) return KEYWORDS.has(token) ? token : "ID";
+    if (/^\d/.test(token)) return "LIT";
+    return token;
+  });
+}
+function winnow(tokens2) {
+  if (tokens2.length < SHINGLE_SIZE) return [];
+  const shingles = Array.from({ length: tokens2.length - SHINGLE_SIZE + 1 }, (_, index) => hash(tokens2.slice(index, index + SHINGLE_SIZE).join(" ")).slice(0, 16));
+  if (shingles.length <= WINDOW_SIZE) return [minimum(shingles)];
+  const selected = /* @__PURE__ */ new Set();
+  for (let index = 0; index <= shingles.length - WINDOW_SIZE; index += 1) {
+    selected.add(minimum(shingles.slice(index, index + WINDOW_SIZE)));
+  }
+  return [...selected].sort();
+}
+function minimum(values) {
+  return values.reduce((smallest, value) => value < smallest ? value : smallest);
+}
+function maskCommentsAndStrings(content, preserveLiterals = false) {
+  let state = "code";
+  let escaped = false;
+  let output2 = "";
+  for (let index = 0; index < content.length; index += 1) {
+    const character = content[index] ?? "";
+    const next = content[index + 1] ?? "";
+    if (state === "code") {
+      if (character === "/" && next === "/") {
+        state = "line";
+        output2 += "  ";
+        index += 1;
+        continue;
+      }
+      if (character === "/" && next === "*") {
+        state = "block";
+        output2 += "  ";
+        index += 1;
+        continue;
+      }
+      if (character === "'") state = "single";
+      else if (character === '"') state = "double";
+      else if (character === "`") state = "template";
+      output2 += state === "code" ? character : preserveLiterals ? " LIT " : character === "\n" ? "\n" : " ";
+      escaped = false;
+      continue;
+    }
+    if (state === "line") {
+      if (character === "\n") {
+        state = "code";
+        output2 += "\n";
+      } else output2 += " ";
+      continue;
+    }
+    if (state === "block") {
+      if (character === "*" && next === "/") {
+        state = "code";
+        output2 += "  ";
+        index += 1;
+      } else output2 += character === "\n" ? "\n" : " ";
+      continue;
+    }
+    output2 += character === "\n" ? "\n" : " ";
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (state === "single" && character === "'" || state === "double" && character === '"' || state === "template" && character === "`") state = "code";
+  }
+  return output2;
+}
+function matchingBrace(masked, open3) {
+  let depth = 0;
+  for (let index = open3; index < masked.length; index += 1) {
+    if (masked[index] === "{") depth += 1;
+    else if (masked[index] === "}") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+  }
+  return -1;
+}
+function lineStartOffsets(content) {
+  const offsets = [0];
+  for (let index = 0; index < content.length; index += 1) {
+    if (content[index] === "\n") offsets.push(index + 1);
+  }
+  return offsets;
+}
+function lineAtOffset(offsets, offset) {
+  let low = 0;
+  let high = offsets.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if ((offsets[middle] ?? 0) <= offset) low = middle + 1;
+    else high = middle;
+  }
+  return Math.max(1, low);
+}
+function isNoisePath(path) {
+  const normalized = path.replaceAll("\\", "/").toLocaleLowerCase();
+  return /(^|\/)(test|tests|__tests__|fixtures|fixture|generated|vendor|dist|build)(\/|$)/.test(normalized) || /(?:\.d|\.generated|\.min)\.[cm]?[jt]sx?$/.test(normalized);
+}
+function hash(value) {
+  return createHash5("sha256").update(value).digest("hex");
+}
+
 // src/context/local-index.ts
 var contentHashSchema = z3.string().regex(/^[a-f\d]{64}$/u);
 var indexedChunkSchema = z3.object({
@@ -2835,6 +3104,7 @@ var LocalContextIndex = class {
   index;
   workspace;
   queryCache = /* @__PURE__ */ new Map();
+  fingerprintCache;
   dirtyPaths = /* @__PURE__ */ new Set();
   refreshState = "current";
   refreshError;
@@ -2868,6 +3138,7 @@ var LocalContextIndex = class {
       }
       this.index = { ...parsed, files };
       this.queryCache.clear();
+      this.fingerprintCache = void 0;
       this.refreshState = this.dirtyPaths.size ? "dirty" : "current";
       this.refreshError = void 0;
       return true;
@@ -2875,6 +3146,7 @@ var LocalContextIndex = class {
       if (error.code === "ENOENT") return false;
       delete this.index;
       this.queryCache.clear();
+      this.fingerprintCache = void 0;
       return false;
     }
   }
@@ -2984,6 +3256,7 @@ var LocalContextIndex = class {
           files: nextFiles
         };
         this.queryCache.clear();
+        this.fingerprintCache = void 0;
         await ensureWorkspaceStorageDirectory(workspace, dirname7(this.indexPath), {
           requireActiveNamespace: true
         });
@@ -3003,6 +3276,24 @@ var LocalContextIndex = class {
     const hits = await this.search(query, topK);
     return packContextHits(hits, this.roots, maxTokens, "local");
   }
+  async functionFingerprints() {
+    await this.flushDirty();
+    await this.ensureCurrentIndex();
+    const index = this.index;
+    if (!index) throw new Error("The local context index is unavailable.");
+    if (this.fingerprintCache?.generation === index.generation) {
+      return cloneDuplicationBaseline(this.fingerprintCache);
+    }
+    const functions = index.files.flatMap((file) => {
+      const content = reconstructIndexedContent(file.chunks);
+      if (hashContent(content) !== file.contentHash) {
+        throw new Error("The fingerprint baseline could not reconstruct current indexed files.");
+      }
+      return extractFunctionFingerprints(file.absolutePath, content).map(({ normalizedTokens: _tokens, ...fingerprint }) => fingerprint);
+    });
+    this.fingerprintCache = { generation: index.generation, functions };
+    return cloneDuplicationBaseline(this.fingerprintCache);
+  }
   status() {
     return {
       available: Boolean(this.index),
@@ -3104,6 +3395,7 @@ var LocalContextIndex = class {
       files
     };
     this.queryCache.clear();
+    this.fingerprintCache = void 0;
     onProgress?.({ phase: "write", completed: files.length, total: files.length });
     await ensureWorkspaceStorageDirectory(
       this.roots[0] ?? process.cwd(),
@@ -3365,7 +3657,7 @@ function isIncludedSourcePath(path) {
     ".proto",
     ".tf",
     ".hcl"
-  ])).has(extname(name).toLowerCase());
+  ])).has(extname2(name).toLowerCase());
 }
 function chunksMatch(expected, actual) {
   if (expected.length !== actual.length) return false;
@@ -3446,11 +3738,29 @@ ${hit.content}
 function cloneHits(hits) {
   return hits.map((hit) => ({ ...hit }));
 }
+function cloneDuplicationBaseline(baseline) {
+  return {
+    generation: baseline.generation,
+    functions: baseline.functions.map((item) => ({ ...item, fingerprints: [...item.fingerprints] }))
+  };
+}
+function reconstructIndexedContent(chunks) {
+  const ordered = chunks.slice().sort((left, right) => left.startLine - right.startLine);
+  const totalLines = ordered.reduce((maximum, chunk) => Math.max(maximum, chunk.endLine), 0);
+  const lines = Array.from({ length: totalLines });
+  for (const chunk of ordered) {
+    for (const [offset, line] of chunk.content.split("\n").entries()) {
+      const index = chunk.startLine - 1 + offset;
+      if (lines[index] === void 0) lines[index] = line;
+    }
+  }
+  return lines.map((line) => line ?? "").join("\n");
+}
 function hashContent(content) {
-  return createHash5("sha256").update(content, "utf8").digest("hex");
+  return createHash6("sha256").update(content, "utf8").digest("hex");
 }
 function createGeneration(files) {
-  return createHash5("sha256").update(files.slice().sort((left, right) => left.absolutePath.localeCompare(right.absolutePath)).map((file) => `${file.absolutePath}\0${file.contentHash}`).join("\n"), "utf8").digest("hex").slice(0, 16);
+  return createHash6("sha256").update(files.slice().sort((left, right) => left.absolutePath.localeCompare(right.absolutePath)).map((file) => `${file.absolutePath}\0${file.contentHash}`).join("\n"), "utf8").digest("hex").slice(0, 16);
 }
 function hasSubstantialOverlap(left, right) {
   if (left.path !== right.path) return false;
@@ -3497,7 +3807,7 @@ function appendChunkRange(chunks, file, lines, rangeStart, rangeEnd) {
   }
 }
 function structuralStarts(path, lines) {
-  const extension = extname(path).toLocaleLowerCase();
+  const extension = extname2(path).toLocaleLowerCase();
   return lines.flatMap((line, index) => isStructuralLine(line, extension) ? [index] : []);
 }
 function isStructuralLine(line, extension) {
@@ -3663,6 +3973,9 @@ var ContextEngine = class {
   lastDegradation() {
     return this.degradation ? { ...this.degradation } : void 0;
   }
+  async functionFingerprints() {
+    return this.local.functionFingerprints();
+  }
 };
 function formatContextHits(hits, roots) {
   return hits.map((hit) => {
@@ -4827,7 +5140,7 @@ function createProvider(config) {
 }
 
 // src/checkpoint/store.ts
-import { createHash as createHash6, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash7, randomUUID as randomUUID7 } from "node:crypto";
 import { lstat as lstat9, mkdir as mkdir7, readFile as readFile5, readdir as readdir2, unlink as unlink2 } from "node:fs/promises";
 import { basename as basename6, dirname as dirname8, join as join8, relative as relative6, resolve as resolve10 } from "node:path";
 import { z as z4 } from "zod";
@@ -4880,7 +5193,7 @@ var CheckpointStore = class {
         if (info.size > 25e6) {
           throw new Error(`File is too large to checkpoint (${info.size} bytes): ${input2}`);
         }
-        const blob = `${createHash6("sha256").update(path).digest("hex")}.bin`;
+        const blob = `${createHash7("sha256").update(path).digest("hex")}.bin`;
         await atomicWrite(join8(blobDirectory, blob), await readFile5(path), 384);
         entries.push({
           path,
@@ -5363,11 +5676,49 @@ var reuseReceiptSchema = z5.object({
   status: z5.enum(["warning", "skipped", "unresolved"]),
   warningOnly: z5.literal(true)
 }).strict();
+var duplicationMatchSchema = z5.object({
+  matchId: z5.string().regex(/^[a-f0-9]{24}$/u).optional(),
+  changedPath: z5.string(),
+  changedSymbol: z5.string(),
+  candidatePath: z5.string(),
+  candidateSymbol: z5.string(),
+  kind: z5.enum(["type-1-or-2", "type-3"]),
+  similarity: z5.number().min(0).max(1)
+}).strict();
+var duplicationAuditSchema = z5.object({
+  baselineGeneration: z5.string().min(1),
+  changeSequence: z5.number().int().nonnegative(),
+  status: z5.enum(["clear", "warning", "unresolved"]),
+  warningOnly: z5.literal(true),
+  checkedFunctions: z5.number().int().nonnegative(),
+  skippedSmallFunctions: z5.number().int().nonnegative(),
+  matches: z5.array(duplicationMatchSchema).max(8),
+  rationale: z5.string().max(500)
+}).strict();
+var duplicationSuppressionSchema = z5.object({
+  matchId: z5.string().regex(/^[a-f0-9]{24}$/u),
+  reasonCode: z5.enum(["separate-boundary", "protocol-required", "generated-contract", "false-positive", "other"]),
+  reason: z5.string().min(12).max(240),
+  createdAt: z5.string().datetime(),
+  toolCallId: z5.string().min(1).max(512)
+}).strict();
 var auditMetadataSchema = z5.record(z5.string(), z5.unknown()).superRefine((metadata, ctx) => {
   const receipt = metadata.reuseReceipt;
   if (receipt !== void 0 && !reuseReceiptSchema.safeParse(receipt).success) {
     ctx.addIssue({ code: "custom", message: "Invalid reuse receipt" });
   }
+  const duplication = metadata.duplicationAudit;
+  if (duplication !== void 0 && !duplicationAuditSchema.safeParse(duplication).success) {
+    ctx.addIssue({ code: "custom", message: "Invalid duplication audit receipt" });
+  }
+  const suppression = metadata.duplicationSuppression;
+  if (suppression !== void 0 && !duplicationSuppressionSchema.safeParse(suppression).success) {
+    ctx.addIssue({ code: "custom", message: "Invalid duplication suppression receipt" });
+  }
+  const activeMatches = metadata.activeDuplicationMatches;
+  if (activeMatches !== void 0 && !z5.array(z5.string().regex(/^[a-f0-9]{24}$/u)).max(8).safeParse(activeMatches).success) {
+    ctx.addIssue({ code: "custom", message: "Invalid active duplication matches" });
+  }
 });
 var auditSchema = z5.object({
   id: z5.string(),
@@ -5407,6 +5758,16 @@ var lastRunSchema = z5.object({
   checks: z5.array(verificationEvidenceSchema),
   detail: z5.string(),
   mutationTracking: z5.enum(["complete", "unknown"]).optional(),
+  duplication: z5.object({
+    enforcement: z5.literal("warning"),
+    status: z5.enum(["clear", "warning", "unresolved", "suppressed"]),
+    warningCount: z5.number().int().nonnegative(),
+    unresolvedCount: z5.number().int().nonnegative(),
+    suppressedCount: z5.number().int().nonnegative(),
+    matches: z5.array(duplicationMatchSchema.extend({
+      matchId: z5.string().regex(/^[a-f0-9]{24}$/u)
+    })).max(8)
+  }).strict().optional(),
   acceptance: z5.object({
     state: z5.enum(["draft", "active", "satisfied", "blocked"]),
     total: z5.number().int().nonnegative(),
@@ -5472,6 +5833,7 @@ var sessionSchema = z5.object({
   contextSources: z5.array(contextSourceSchema).max(64).optional(),
   toolArtifacts: z5.array(toolArtifactSchema).max(200).optional(),
   taskContract: taskContractSchema.optional(),
+  duplicationSuppressions: z5.array(duplicationSuppressionSchema).max(64).optional(),
   lastRun: lastRunSchema.optional(),
   usage: z5.object({
     inputTokens: z5.number().nonnegative(),
@@ -5779,7 +6141,7 @@ async function exists2(path) {
 }
 
 // src/session/tool-artifacts.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { lstat as lstat12, readFile as readFile7, readdir as readdir4, rm as rm2 } from "node:fs/promises";
 import { join as join11, resolve as resolve13 } from "node:path";
 import { z as z6 } from "zod";
@@ -5839,7 +6201,7 @@ var ToolArtifactStore = class {
       const artifacts = await this.loadArtifacts();
       await this.removeExpired(artifacts, now);
       const active = artifacts.filter((artifact2) => artifact2.expiresAt > now.toISOString());
-      const sha256 = hash(content);
+      const sha256 = hash2(content);
       const existing = active.find((artifact2) => artifact2.sessionId === sessionId && artifact2.toolCallId === toolCallId);
       if (existing) {
         if (existing.sha256 === sha256 && existing.bytes === bytes && existing.redacted === options.redacted) {
@@ -5954,7 +6316,7 @@ var ToolArtifactStore = class {
     if (artifact.sessionId !== sessionId || artifact.toolCallId !== toolCallId) {
       throw new Error("Retained tool output does not belong to this session.");
     }
-    if (artifact.bytes !== Buffer.byteLength(artifact.content) || artifact.sha256 !== hash(artifact.content)) {
+    if (artifact.bytes !== Buffer.byteLength(artifact.content) || artifact.sha256 !== hash2(artifact.content)) {
       throw new Error("Retained tool output failed its integrity check.");
     }
     return artifact;
@@ -5974,7 +6336,7 @@ var ToolArtifactStore = class {
         await this.assertRegularFile(path);
         try {
           const artifact = artifactSchema.parse(JSON.parse(await readFile7(path, "utf8")));
-          if (artifact.bytes !== Buffer.byteLength(artifact.content) || artifact.sha256 !== hash(artifact.content)) {
+          if (artifact.bytes !== Buffer.byteLength(artifact.content) || artifact.sha256 !== hash2(artifact.content)) {
             throw new Error("integrity");
           }
           if (sessionDirectory !== this.sessionDirectoryFor(artifact.sessionId) || path !== this.pathFor(artifact.sessionId, artifact.toolCallId)) {
@@ -5997,10 +6359,10 @@ var ToolArtifactStore = class {
     await rm2(this.pathFor(artifact.sessionId, artifact.toolCallId), { force: true });
   }
   pathFor(sessionId, toolCallId) {
-    return join11(this.sessionDirectoryFor(sessionId), `${hash(`call\0${toolCallId}`)}.json`);
+    return join11(this.sessionDirectoryFor(sessionId), `${hash2(`call\0${toolCallId}`)}.json`);
   }
   sessionDirectoryFor(sessionId) {
-    return join11(this.directory, hash(`session\0${sessionId}`));
+    return join11(this.directory, hash2(`session\0${sessionId}`));
   }
   async ensureDirectory() {
     await ensureWorkspaceStorageDirectory(this.workspace, this.directory, {
@@ -6057,8 +6419,8 @@ function reference(artifact) {
     redacted: artifact.redacted
   };
 }
-function hash(value) {
-  return createHash7("sha256").update(value).digest("hex");
+function hash2(value) {
+  return createHash8("sha256").update(value).digest("hex");
 }
 function storedBytes(artifact) {
   return Buffer.byteLength(JSON.stringify(artifact)) + 1;
@@ -6403,13 +6765,13 @@ ${preview}`);
   }
   return `${lines.join("\n")}${forceFinalNewline && lines.length ? "\n" : ""}`;
 }
-function findSequence(haystack, needle, hint, minimum) {
+function findSequence(haystack, needle, hint, minimum2) {
   const matchesAt = (start, relaxed) => needle.every((line, offset) => {
     const candidate = haystack[start + offset];
     return relaxed ? candidate?.trimEnd() === line.trimEnd() : candidate === line;
   });
   const starts = [];
-  for (let index = Math.max(0, minimum); index <= haystack.length - needle.length; index += 1) {
+  for (let index = Math.max(0, minimum2); index <= haystack.length - needle.length; index += 1) {
     starts.push(index);
   }
   starts.sort((a, b) => Math.abs(a - hint) - Math.abs(b - hint));
@@ -7380,7 +7742,7 @@ ${hit.content}`
 }
 
 // src/tools/shell.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { lstat as lstat15, readFile as readFile11, readdir as readdir5 } from "node:fs/promises";
 import { join as join13 } from "node:path";
 import { z as z13 } from "zod";
@@ -7426,10 +7788,10 @@ var shellTool = {
     validateEnvironment(input2.env);
     const cwd = await context.workspace.resolveDirectory(input2.cwd ?? ".");
     const candidates = appearsToModifyWorkspace(input2.command) ? await collectAffectedPaths(input2.command, input2.cwd ?? ".", context) : [];
-    const unresolved = appearsToModifyWorkspace(input2.command) && candidates.length === 0;
-    const roots = unresolved ? context.workspace.roots : [];
+    const unresolved2 = appearsToModifyWorkspace(input2.command) && candidates.length === 0;
+    const roots = unresolved2 ? context.workspace.roots : [];
     const before = await snapshotPaths(candidates);
-    const beforeWorkspace = unresolved ? await captureWorkspaceSnapshot(roots) : void 0;
+    const beforeWorkspace = unresolved2 ? await captureWorkspaceSnapshot(roots) : void 0;
     let result;
     try {
       result = await runShell(input2.command, cwd, {
@@ -7594,7 +7956,7 @@ async function captureWorkspaceSnapshot(roots) {
         files.set(path, {
           size: info.size,
           mtimeMs: info.mtimeMs,
-          hash: createHash8("sha256").update(content).digest("hex")
+          hash: createHash9("sha256").update(content).digest("hex")
         });
       } catch (error) {
         if (error.code !== "ENOENT") complete = false;
@@ -7797,14 +8159,14 @@ function compact(value, limit) {
 }
 
 // src/agent/completion-gate.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 
 // src/tools/permissions.ts
-import { createHash as createHash9, createHmac, randomBytes } from "node:crypto";
+import { createHash as createHash10, createHmac, randomBytes } from "node:crypto";
 var permissionScopeSecret = randomBytes(32);
 function permissionKey(call, category) {
   const categoryScope = category === "network" ? `\0network-request:${scopeFingerprint(normalizeRequestState(call.arguments))}` : "";
-  const digest = createHash9("sha256").update(`${category}\0${call.name}\0${permissionTarget(call)}${categoryScope}`).digest("hex").slice(0, 24);
+  const digest = createHash10("sha256").update(`${category}\0${call.name}\0${permissionTarget(call)}${categoryScope}`).digest("hex").slice(0, 24);
   return `${category}:${call.name}:${digest}`;
 }
 function permissionTarget(call) {
@@ -7998,10 +8360,10 @@ function captureVerification(call, result, changeSequence, configuredCommands) {
     kind,
     ok: result.ok,
     changeSequence,
-    commandKey: createHash10("sha256").update(normalized).digest("hex")
+    commandKey: createHash11("sha256").update(normalized).digest("hex")
   };
 }
-function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutationTracking = "complete", taskContract, audit = []) {
+function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutationTracking = "complete", taskContract, audit = [], duplication) {
   const files = [...new Set(changedFiles)];
   const acceptance = taskContract ? buildAcceptance(taskContract, audit, evidence, currentChangeSequence) : void 0;
   if (mutationTracking === "unknown") {
@@ -8011,6 +8373,7 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       checks: [],
       detail: files.length ? `Workspace changes were observed, but a dynamic shell command prevented complete mutation tracking for ${fileCount(files.length)}.` : "A dynamic shell command may have changed workspace files, but reliable mutation tracking was unavailable.",
       mutationTracking,
+      ...duplication ? { duplication } : {},
       ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {}
     };
   }
@@ -8021,7 +8384,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
         changedFiles: [],
         checks: [],
         detail: acceptanceDetail(acceptance),
-        acceptance: acceptanceForCompletion(acceptance, "unverified")
+        acceptance: acceptanceForCompletion(acceptance, "unverified"),
+        ...duplication ? { duplication } : {}
       };
     }
     return {
@@ -8029,7 +8393,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: [],
       checks: [],
       detail: "No workspace files changed in this run.",
-      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "no_changes") } : {}
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "no_changes") } : {},
+      ...duplication ? { duplication } : {}
     };
   }
   const latestByCommand = /* @__PURE__ */ new Map();
@@ -8045,7 +8410,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: files,
       checks,
       detail: `No successful verification was recorded after the last change to ${fileCount(files.length)}.`,
-      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {}
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {},
+      ...duplication ? { duplication } : {}
     };
   }
   const failures = checks.filter((check) => !check.ok);
@@ -8055,7 +8421,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: files,
       checks,
       detail: `${failures.length} of ${checks.length} current verification ${checks.length === 1 ? "check" : "checks"} failed.`,
-      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verification_failed") } : {}
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verification_failed") } : {},
+      ...duplication ? { duplication } : {}
     };
   }
   if (acceptance && acceptanceUnresolved(acceptance)) {
@@ -8064,7 +8431,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: files,
       checks,
       detail: acceptanceDetail(acceptance),
-      acceptance: acceptanceForCompletion(acceptance, "unverified")
+      acceptance: acceptanceForCompletion(acceptance, "unverified"),
+      ...duplication ? { duplication } : {}
     };
   }
   return {
@@ -8072,16 +8440,17 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
     changedFiles: files,
     checks,
     detail: `${checks.length} current verification ${checks.length === 1 ? "check" : "checks"} passed for ${fileCount(files.length)}.`,
-    ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verified") } : {}
+    ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verified") } : {},
+    ...duplication ? { duplication } : {}
   };
 }
 function completionRecoveryDirective(completion) {
   if (completion.acceptance && acceptanceUnresolved(completion.acceptance)) {
-    const unresolved = completion.acceptance.unresolved.map((item) => `- [${item.status}] ${item.id}: ${item.description}`).join("\n");
+    const unresolved2 = completion.acceptance.unresolved.map((item) => `- [${item.status}] ${item.id}: ${item.description}`).join("\n");
     const failed = completion.checks.filter((check) => !check.ok).map((check) => `- ${check.command} (tool call ${check.toolCallId})`).join("\n");
     return `<runtime-completion-gate status="acceptance_unresolved" authorization="none">
 The run cannot be marked complete while required Task Contract criteria remain unresolved:
-${unresolved || "- Acceptance criteria are satisfied."}${completion.acceptance.missingVerification.length ? `
+${unresolved2 || "- Acceptance criteria are satisfied."}${completion.acceptance.missingVerification.length ? `
 Missing required verification:
 ${completion.acceptance.missingVerification.map((item) => `- ${item}`).join("\n")}` : ""}${failed ? `
 Current failed checks:
@@ -8151,14 +8520,14 @@ function acceptanceDetail(acceptance) {
     acceptance.blocked ? `${acceptance.blocked} blocked` : "",
     acceptance.missingVerification.length ? `${acceptance.missingVerification.length} verification requirements missing` : ""
   ].filter(Boolean).join(" and ");
-  const unresolved = acceptance.pending + acceptance.blocked;
-  return `Task Contract acceptance is unresolved: ${parts} required ${unresolved === 1 ? "criterion" : "criteria"}.`;
+  const unresolved2 = acceptance.pending + acceptance.blocked;
+  return `Task Contract acceptance is unresolved: ${parts} required ${unresolved2 === 1 ? "criterion" : "criteria"}.`;
 }
 function verificationRequirementMet(requirement, checks) {
   const normalized = normalizeCommand2(requirement);
   const broad = normalized.match(/^Record at least one successful (.+) after the final mutation\.?$/iu);
   if (broad) return checks.length > 0;
-  const commandKey = createHash10("sha256").update(normalized).digest("hex");
+  const commandKey = createHash11("sha256").update(normalized).digest("hex");
   return checks.some((item) => item.commandKey === commandKey);
 }
 function acceptanceUnresolved(acceptance) {
@@ -8484,6 +8853,139 @@ function render(memory) {
   ].join("\n");
 }
 
+// src/tools/duplication.ts
+import { z as z17 } from "zod";
+
+// src/agent/duplication-state.ts
+function buildDuplicationCompletion(audit, suppressions = [], runStartedAt) {
+  const active = /* @__PURE__ */ new Map();
+  const unresolved2 = /* @__PURE__ */ new Map();
+  let sawCurrentReceipt = false;
+  for (const event of audit) {
+    if (runStartedAt && event.createdAt < runStartedAt) continue;
+    const receipt = duplicationReceipt(event.metadata?.duplicationAudit);
+    if (!receipt) continue;
+    if (receipt.status === "clear" || receipt.status === "unresolved" || receipt.matches.some((match) => typeof match.matchId === "string")) sawCurrentReceipt = true;
+    const changedPaths2 = changedPathsFor(event, receipt);
+    for (const path of changedPaths2) {
+      for (const [id, match] of active) if (match.changedPath === path) active.delete(id);
+      unresolved2.delete(path);
+    }
+    if (receipt.status === "unresolved") {
+      for (const path of changedPaths2) unresolved2.set(path, receipt.changeSequence);
+    }
+    for (const match of receipt.matches) {
+      if (typeof match.matchId === "string") {
+        active.set(match.matchId, match);
+      }
+    }
+  }
+  if (!active.size && !unresolved2.size && !sawCurrentReceipt) return void 0;
+  const activeIds = new Set(active.keys());
+  const suppressedIds = new Set(suppressions.filter((item) => activeIds.has(item.matchId)).map((item) => item.matchId));
+  const warnings = [...active.values()].filter((match) => !suppressedIds.has(match.matchId));
+  const suppressedCount = active.size - warnings.length;
+  return {
+    enforcement: "warning",
+    status: unresolved2.size ? "unresolved" : warnings.length ? "warning" : suppressedCount ? "suppressed" : "clear",
+    warningCount: warnings.length,
+    unresolvedCount: unresolved2.size,
+    suppressedCount,
+    matches: warnings.slice(0, 8)
+  };
+}
+function activeDuplicationMatchIds(audit, suppressions = []) {
+  const completion = buildDuplicationCompletion(audit, suppressions);
+  return new Set(completion?.matches.map((match) => match.matchId) ?? []);
+}
+function pruneDuplicationSuppressions(audit, suppressions = []) {
+  if (!suppressions.length) return [];
+  const active = new Set(buildDuplicationCompletion(audit, [])?.matches.map((match) => match.matchId) ?? []);
+  return suppressions.filter((item) => active.has(item.matchId)).slice(-64);
+}
+function findActiveDuplicationMatches(audit, suppressions = []) {
+  return buildDuplicationCompletion(audit, suppressions)?.matches ?? [];
+}
+function hasDuplicationActivity(audit, runStartedAt) {
+  return audit.some(
+    (event) => (!runStartedAt || event.createdAt >= runStartedAt) && (duplicationReceipt(event.metadata?.duplicationAudit) !== void 0 || event.metadata?.duplicationSuppression !== void 0 || event.metadata?.activeDuplicationMatches !== void 0)
+  );
+}
+function duplicationReceipt(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const receipt = value;
+  if (!Array.isArray(receipt.matches) || typeof receipt.changeSequence !== "number" || !["clear", "warning", "unresolved"].includes(String(receipt.status))) return void 0;
+  return receipt;
+}
+function changedPathsFor(event, receipt) {
+  const metadataPaths = event.metadata?.changedFiles;
+  const fromMetadata = Array.isArray(metadataPaths) ? metadataPaths.filter((path) => typeof path === "string") : [];
+  return [.../* @__PURE__ */ new Set([...fromMetadata, ...receipt.matches.map((match) => match.changedPath)])];
+}
+
+// src/tools/duplication.ts
+var inputSchema12 = z17.discriminatedUnion("action", [
+  z17.object({ action: z17.literal("show") }).strict(),
+  z17.object({
+    action: z17.literal("suppress"),
+    match_id: z17.string().regex(/^[a-f0-9]{24}$/u),
+    reason_code: z17.enum(["separate-boundary", "protocol-required", "generated-contract", "false-positive", "other"]),
+    reason: z17.string().trim().min(12).max(240)
+  }).strict()
+]);
+var duplicationTool = {
+  definition: {
+    name: "duplication_audit",
+    description: "Inspect active duplicate-function warnings or suppress one exact match with an auditable reason. Suppression does not bypass correctness, security, accessibility, concurrency, or verification requirements.",
+    category: "read",
+    inputSchema: jsonSchema({
+      action: { type: "string", enum: ["show", "suppress"] },
+      match_id: { type: "string", description: "Exact 24-character match id from the current audit." },
+      reason_code: { type: "string", enum: ["separate-boundary", "protocol-required", "generated-contract", "false-positive", "other"] },
+      reason: { type: "string", description: "Specific 12-240 character explanation; code blocks and credentials are rejected." }
+    }, ["action"])
+  },
+  async execute(arguments_, context) {
+    const input2 = inputSchema12.parse(arguments_);
+    const suppressions = pruneDuplicationSuppressions(
+      context.session.audit ?? [],
+      context.session.duplicationSuppressions ?? []
+    );
+    context.session.duplicationSuppressions = suppressions;
+    const active = activeDuplicationMatchIds(context.session.audit ?? [], suppressions);
+    if (input2.action === "suppress") {
+      if (!active.has(input2.match_id)) {
+        throw new Error(`Unknown, stale, or already suppressed duplication match: ${input2.match_id}`);
+      }
+      suppressions.push({
+        matchId: input2.match_id,
+        reasonCode: input2.reason_code,
+        reason: cleanReason(input2.reason),
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        toolCallId: context.toolCallId ?? "unavailable"
+      });
+      context.session.duplicationSuppressions = suppressions.slice(-64);
+      return {
+        content: `Suppressed duplication match ${input2.match_id}. This does not waive verification or safety requirements.`,
+        metadata: { duplicationSuppression: context.session.duplicationSuppressions.at(-1) }
+      };
+    }
+    const matches = findActiveDuplicationMatches(context.session.audit ?? [], suppressions);
+    return {
+      content: matches.length ? matches.map(
+        (match) => `- ${match.matchId}: ${match.changedPath}#${match.changedSymbol} -> ${match.candidatePath}#${match.candidateSymbol} (${match.kind}, ${match.similarity.toFixed(3)})`
+      ).join("\n") : "No unsuppressed duplication matches.",
+      metadata: { activeDuplicationMatches: matches.map((match) => match.matchId) }
+    };
+  }
+};
+function cleanReason(value) {
+  if (/```|~~~|\b(?:api[_-]?key|access[_-]?token|authorization|cookie|password|secret)\s*[:=]/iu.test(value) || /\b(?:sk-[A-Za-z0-9_-]{12,}|AIza[0-9A-Za-z_-]{20,})\b/u.test(value)) {
+    throw new Error("Suppression reasons cannot contain code blocks or credentials.");
+  }
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/gu, " ").replace(/\s+/gu, " ").trim();
+}
+
 // src/tools/index.ts
 function createDefaultToolRegistry(_options = {}) {
   return new ToolRegistry([
@@ -8497,6 +8999,7 @@ function createDefaultToolRegistry(_options = {}) {
     gitTool,
     taskTool,
     taskContractTool,
+    duplicationTool,
     workingMemoryTool
   ]);
 }
@@ -8617,7 +9120,7 @@ function escapeAttribute3(value) {
 }
 
 // src/agent/tool-recovery.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 var RETRY_BUDGET = {
   schema_input: 3,
   unknown_tool: 2,
@@ -8689,7 +9192,7 @@ var ToolRecoveryController = class {
   recordEvidence(call, result) {
     if (call.name !== "search_code" || !result.ok) return void 0;
     const callKey = callSignature(call);
-    const fingerprint = createHash11("sha256").update(`${result.content}\0${stableJson(result.metadata ?? {})}`).digest("hex");
+    const fingerprint = createHash12("sha256").update(`${result.content}\0${stableJson(result.metadata ?? {})}`).digest("hex");
     const count = typeof result.metadata?.count === "number" ? result.metadata.count : void 0;
     const current = this.evidence.get(callKey);
     const repeated = current?.fingerprint === fingerprint;
@@ -8699,7 +9202,7 @@ var ToolRecoveryController = class {
       status: count === 0 ? "empty" : repeated ? "repeated" : "new",
       repeatCount: repeats,
       stop: repeats >= 2,
-      signature: createHash11("sha256").update(`${callKey}\0${fingerprint}`).digest("hex")
+      signature: createHash12("sha256").update(`${callKey}\0${fingerprint}`).digest("hex")
     };
   }
   receipt(call, failureClass, attempt, circuitOpen) {
@@ -8735,10 +9238,10 @@ function isRetryable(failureClass) {
   return RETRY_BUDGET[failureClass] > 0;
 }
 function callSignature(call) {
-  return createHash11("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}`).digest("hex");
+  return createHash12("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}`).digest("hex");
 }
 function failureSignature(call, failureClass) {
-  return createHash11("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}\0${failureClass}`).digest("hex");
+  return createHash12("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}\0${failureClass}`).digest("hex");
 }
 function redact(value, key = "") {
   if (/api[_-]?key|authorization|cookie|password|secret|token/i.test(key)) return "[redacted]";
@@ -8905,8 +9408,8 @@ ${tail}`;
   }
   return best || sliceStartByTokens(value, budget);
 }
-function clamp2(value, minimum, maximum) {
-  return Math.max(minimum, Math.min(maximum, value));
+function clamp2(value, minimum2, maximum) {
+  return Math.max(minimum2, Math.min(maximum, value));
 }
 function boundedInlineByTokens(value, maxTokens) {
   const normalized = value.replace(/[\r\n\t]+/gu, " ").trim();
@@ -9086,9 +9589,9 @@ function escapeAttribute5(value) {
 }
 
 // src/agent/reuse-gate.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { readFile as readFile14, stat as stat10 } from "node:fs/promises";
-import { basename as basename8, extname as extname2 } from "node:path";
+import { basename as basename8, extname as extname3 } from "node:path";
 var MAX_CANDIDATES = 5;
 var SKIPPED_EXTENSIONS = /* @__PURE__ */ new Set([
   ".md",
@@ -9153,7 +9656,7 @@ async function evaluateReuseGate(input2) {
   if (preview.paths.every(isExemptPath)) return { triggered: false };
   const targetPaths = preview.paths.slice(0, MAX_CANDIDATES);
   const query = [input2.request, ...preview.symbols, ...targetPaths.map((path) => basename8(path))].join(" ").slice(0, 8e3);
-  const queryHash = hash2(query);
+  const queryHash = hash3(query);
   let refresh;
   try {
     refresh = input2.context.flushDirty ? await input2.context.flushDirty() : { status: "current", paths: 0 };
@@ -9276,7 +9779,7 @@ function isExemptPath(path) {
   const normalized = path.replaceAll("\\", "/").toLocaleLowerCase();
   if (/(^|\/)(test|tests|__tests__|fixtures|fixture|generated|vendor|dist|build)(\/|$)/.test(normalized)) return true;
   if (/(\.generated|\.min)\.[^.]+$/.test(normalized)) return true;
-  const extension = extname2(normalized);
+  const extension = extname3(normalized);
   if (SKIPPED_EXTENSIONS.has(extension)) return true;
   return !SOURCE_EXTENSIONS.has(extension);
 }
@@ -9294,13 +9797,192 @@ function unresolvedReceipt(input2, queryHash, targetPaths, trigger, detail) {
     warningOnly: true
   };
 }
-function hash2(value) {
-  return createHash12("sha256").update(value).digest("hex");
+function hash3(value) {
+  return createHash13("sha256").update(value).digest("hex");
 }
 function roundScore(value) {
   return Number.isFinite(value) ? Math.round(value * 1e3) / 1e3 : 0;
 }
 
+// src/agent/duplication-audit.ts
+import { createHash as createHash14 } from "node:crypto";
+import { readFile as readFile15 } from "node:fs/promises";
+var NEAR_CLONE_THRESHOLD = 0.55;
+var MAX_MATCHES = 8;
+async function auditChangedFunctions(input2) {
+  const auditableFiles = input2.changedFiles.filter(supportsFunctionFingerprintPath);
+  if (!auditableFiles.length) return void 0;
+  const reports = [];
+  let skippedSmallFunctions = 0;
+  try {
+    for (const path of auditableFiles) {
+      let content;
+      try {
+        content = await readFile15(path, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw error;
+      }
+      const report = extractFunctionFingerprintReport(path, content);
+      skippedSmallFunctions += report.skippedSmallFunctions;
+      reports.push(report);
+    }
+  } catch {
+    return unresolved(input2.changeSequence, input2.baseline?.generation);
+  }
+  const currentFunctions = reports.flatMap((report) => report.functions.map(withoutTokens));
+  if (!currentFunctions.length) {
+    return auditableFiles.some((path) => input2.recheckPaths?.has(path)) && input2.baseline ? clear(input2.baseline.generation, input2.changeSequence, skippedSmallFunctions) : void 0;
+  }
+  if (!input2.baseline) return unresolved(input2.changeSequence);
+  const lookup = createBaselineLookup(input2.baseline.functions);
+  const previousByCurrent = matchCurrentFunctions(input2.baseline.functions, currentFunctions);
+  const added = currentFunctions.flatMap((current) => {
+    const previous = previousByCurrent.get(locationIdentity(current));
+    const recheck = input2.recheckFunctions?.has(identity(current)) || previous !== void 0 && input2.recheckFunctions?.has(identity(previous));
+    return !previous || current.tokenCount >= previous.tokenCount * 1.5 || recheck ? [{ current, previous }] : [];
+  });
+  if (!added.length) return void 0;
+  const matches = [];
+  for (const { current: item, previous } of added) {
+    let best;
+    for (const candidate of findCandidateFunctions(lookup, item)) {
+      if (previous && locationIdentity(candidate) === locationIdentity(previous)) continue;
+      const similarity = fingerprintSimilarity(item, candidate);
+      if (similarity < NEAR_CLONE_THRESHOLD || best && best.similarity >= similarity) continue;
+      best = { candidate, similarity };
+    }
+    if (!best) continue;
+    matches.push({
+      matchId: matchId(input2.baseline.generation, input2.changeSequence, item, best.candidate, best.similarity),
+      changedPath: item.path,
+      changedSymbol: item.symbol,
+      candidatePath: best.candidate.path,
+      candidateSymbol: best.candidate.symbol,
+      kind: best.similarity === 1 ? "type-1-or-2" : "type-3",
+      similarity: round(best.similarity)
+    });
+  }
+  matches.sort((left, right) => right.similarity - left.similarity || left.changedPath.localeCompare(right.changedPath));
+  const bounded = matches.slice(0, MAX_MATCHES);
+  return {
+    baselineGeneration: input2.baseline.generation,
+    changeSequence: input2.changeSequence,
+    status: bounded.length ? "warning" : "clear",
+    warningOnly: true,
+    checkedFunctions: added.length,
+    skippedSmallFunctions,
+    matches: bounded,
+    rationale: bounded.length ? `${bounded.length} deterministic duplicate candidate${bounded.length === 1 ? "" : "s"} found; review for reuse.` : "No deterministic duplicate candidate exceeded the warning threshold."
+  };
+}
+function clear(baselineGeneration, changeSequence, skippedSmallFunctions) {
+  return {
+    baselineGeneration,
+    changeSequence,
+    status: "clear",
+    warningOnly: true,
+    checkedFunctions: 0,
+    skippedSmallFunctions,
+    matches: [],
+    rationale: "No active deterministic duplicate candidate remains on the rechecked path."
+  };
+}
+function withoutTokens(value) {
+  const { normalizedTokens: _tokens, ...fingerprint } = value;
+  return fingerprint;
+}
+function identity(value) {
+  return `${value.path}\0${value.symbol}`;
+}
+function locationIdentity(value) {
+  return `${identity(value)}\0${value.startLine}\0${value.endLine}`;
+}
+function createBaselineLookup(functions) {
+  const lookup = {
+    byIdentity: /* @__PURE__ */ new Map(),
+    byPath: /* @__PURE__ */ new Map(),
+    byExactHash: /* @__PURE__ */ new Map(),
+    byFingerprint: /* @__PURE__ */ new Map()
+  };
+  for (const item of functions) {
+    appendLookup(lookup.byIdentity, identity(item), item);
+    appendLookup(lookup.byPath, item.path, item);
+    appendLookup(lookup.byExactHash, item.exactHash, item);
+    for (const fingerprint of new Set(item.fingerprints)) {
+      appendLookup(lookup.byFingerprint, fingerprint, item);
+    }
+  }
+  return lookup;
+}
+function appendLookup(lookup, key, item) {
+  const values = lookup.get(key);
+  if (values) values.push(item);
+  else lookup.set(key, [item]);
+}
+function findCandidateFunctions(lookup, current) {
+  const exact = lookup.byExactHash.get(current.exactHash);
+  if (exact?.length) return exact;
+  const candidates = /* @__PURE__ */ new Map();
+  for (const fingerprint of new Set(current.fingerprints)) {
+    for (const candidate of lookup.byFingerprint.get(fingerprint) ?? []) {
+      candidates.set(locationIdentity(candidate), candidate);
+    }
+  }
+  return [...candidates.values()];
+}
+function matchCurrentFunctions(baseline, current) {
+  const matches = /* @__PURE__ */ new Map();
+  const available = new Map(baseline.map((item) => [locationIdentity(item), item]));
+  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => identity(candidate) === identity(item) && linesOverlap(candidate, item)), false);
+  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => identity(candidate) === identity(item)), true);
+  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => candidate.path === item.path && linesOverlap(candidate, item)), true);
+  return matches;
+}
+function assignMatches(current, matches, available, candidatesFor, requireSimilarity) {
+  for (const item of current) {
+    const currentId = locationIdentity(item);
+    if (matches.has(currentId)) continue;
+    let best;
+    for (const candidate of candidatesFor(item)) {
+      const similarity = fingerprintSimilarity(candidate, item);
+      if (!best || similarity > best.similarity) best = { candidate, similarity };
+    }
+    if (!best || requireSimilarity && best.similarity < NEAR_CLONE_THRESHOLD) continue;
+    matches.set(currentId, best.candidate);
+    available.delete(locationIdentity(best.candidate));
+  }
+}
+function linesOverlap(left, right) {
+  return Math.max(left.startLine, right.startLine) <= Math.min(left.endLine, right.endLine);
+}
+function unresolved(changeSequence, generation = "unavailable") {
+  return {
+    baselineGeneration: generation,
+    changeSequence,
+    status: "unresolved",
+    warningOnly: true,
+    checkedFunctions: 0,
+    skippedSmallFunctions: 0,
+    matches: [],
+    rationale: "Duplication evidence is incomplete; the write remains allowed in warning-only mode."
+  };
+}
+function round(value) {
+  return Math.round(value * 1e3) / 1e3;
+}
+function matchId(generation, changeSequence, changed, candidate, similarity) {
+  return createHash14("sha256").update([
+    generation,
+    String(changeSequence),
+    changed.path,
+    changed.symbol,
+    candidate.path,
+    candidate.symbol,
+    similarity === 1 ? "type-1-or-2" : "type-3"
+  ].join("\0")).digest("hex").slice(0, 24);
+}
+
 // src/agent/runner.ts
 var AgentRunner = class {
   config;
@@ -9371,6 +10053,7 @@ var AgentRunner = class {
       await options.onEvent?.(event);
     };
     const changeSequenceAtStart = this.changeSequence;
+    const runStartedAt = (/* @__PURE__ */ new Date()).toISOString();
     const runChangedFiles = /* @__PURE__ */ new Set();
     const verificationEvidence = [];
     const toolRecovery = new ToolRecoveryController();
@@ -9400,7 +10083,11 @@ var AgentRunner = class {
         this.changeSequence,
         mutationTracking,
         activeRunContract,
-        this.session.audit ?? []
+        this.session.audit ?? [],
+        hasDuplicationActivity(this.session.audit ?? [], runStartedAt) ? buildDuplicationCompletion(
+          this.session.audit ?? [],
+          this.session.duplicationSuppressions ?? []
+        ) : void 0
       );
       if (completion.acceptance && activeRunContract && activeRunContract.state !== "draft") {
         activeRunContract.state = completion.acceptance.state;
@@ -9526,7 +10213,11 @@ var AgentRunner = class {
           this.tools,
           options.askMode === true,
           contractEnabled,
-          this.hasReadableToolArtifact()
+          this.hasReadableToolArtifact(),
+          activeDuplicationMatchIds(
+            this.session.audit ?? [],
+            this.session.duplicationSuppressions ?? []
+          ).size > 0
         );
         const estimatedInputTokens = estimateMessages2(messages) + estimateToolDefinitions(visibleTools);
         if (availableTokens <= 0 || estimatedInputTokens >= availableTokens) {
@@ -9811,11 +10502,14 @@ ${input2}`
       contextEngine: this.contextEngine,
       toolArtifactStore: this.toolArtifactStore,
       emit,
-      ...options.signal ? { signal: options.signal } : {}
+      ...options.signal ? { signal: options.signal } : {},
+      toolCallId: call.id
     };
     try {
       let reuseReceipt;
       let reuseWarning;
+      let duplicationBaseline;
+      const duplicationAuditEnabled = categories.includes("write") && (call.name === "write_file" || call.name === "apply_patch") && Boolean(this.contextEngine.functionFingerprints);
       if (categories.includes("write") && this.activeReuseGate && !this.activeReuseGate.attempted && (call.name === "write_file" || call.name === "apply_patch")) {
         this.activeReuseGate.attempted = true;
         try {
@@ -9835,6 +10529,13 @@ ${input2}`
           reuseWarning = "Reuse check (warning-only) was inconclusive.";
         }
       }
+      if (duplicationAuditEnabled) {
+        try {
+          duplicationBaseline = await this.contextEngine.functionFingerprints?.();
+        } catch {
+          duplicationBaseline = void 0;
+        }
+      }
       let checkpointId;
       if (this.config.agent.checkpointBeforeWrite && categories.includes("write") && tool.affectedPaths) {
         const paths = await tool.affectedPaths(call.arguments, executionContext);
@@ -9852,6 +10553,22 @@ ${input2}`
       throwIfAborted(options.signal);
       const execution = await tool.execute(call.arguments, toolExecutionContext);
       const changedFiles = await this.acceptChangedFiles(execution.changedFiles ?? []);
+      const activeDuplicateFunctions = new Set(
+        buildDuplicationCompletion(
+          this.session.audit ?? [],
+          []
+        )?.matches.map((match) => `${match.changedPath}\0${match.changedSymbol}`) ?? []
+      );
+      const activeDuplicatePaths = new Set(
+        buildDuplicationCompletion(this.session.audit ?? [], [])?.matches.map((match) => match.changedPath) ?? []
+      );
+      const duplicationAudit = duplicationAuditEnabled ? await auditChangedFunctions({
+        ...duplicationBaseline ? { baseline: duplicationBaseline } : {},
+        changedFiles,
+        changeSequence: this.changeSequence,
+        recheckFunctions: activeDuplicateFunctions,
+        recheckPaths: activeDuplicatePaths
+      }) : void 0;
       const tasksBefore = JSON.stringify(this.session.tasks);
       let afterHookError;
       let afterHooks = [];
@@ -9870,11 +10587,17 @@ Tool succeeded, but afterTool hook failed: ${afterHookError.message}` : executio
       if (reuseWarning) completeContent = `${reuseWarning}
 
 ${completeContent}`;
+      if (duplicationAudit?.status === "warning" || duplicationAudit?.status === "unresolved") {
+        completeContent = `Duplication audit (warning-only): ${duplicationAudit.rationale}
+
+${completeContent}`;
+      }
       const metadata = {
         ...execution.metadata ?? {},
         ...changedFiles.length ? { changedFiles } : {},
         ...checkpointId ? { checkpointId } : {},
         ...reuseReceipt ? { reuseReceipt } : {},
+        ...duplicationAudit ? { duplicationAudit } : {},
         ...beforeHooks.length || afterHooks.length ? { hooks: { before: beforeHooks.length, after: afterHooks.length } } : {},
         ...afterHookError ? { toolSucceeded: true, hookError: afterHookError.message } : {}
       };
@@ -10324,9 +11047,9 @@ ${content}` : content,
     ...failure ? { metadata: { failure } } : {}
   };
 }
-function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable) {
+function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable) {
   return tools.definitions().filter(
-    (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact")
+    (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
   );
 }
 function formatToolError(error) {
@@ -10361,7 +11084,7 @@ async function safeEmit(emit, event) {
 }
 
 // src/agent/profiles.ts
-import { lstat as lstat17, readFile as readFile15, readdir as readdir6 } from "node:fs/promises";
+import { lstat as lstat17, readFile as readFile16, readdir as readdir6 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename9, join as join15 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
@@ -10489,7 +11212,7 @@ async function readProfile(path, source) {
   try {
     const info = await lstat17(path);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 1e5) return void 0;
-    const raw = await readFile15(path, "utf8");
+    const raw = await readFile16(path, "utf8");
     const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
     const frontmatter = match ? parseYaml2(match[1] ?? "") : {};
     const prompt = (match ? raw.slice(match[0].length) : raw).trim();
@@ -10518,7 +11241,7 @@ function integer(value, fallback, min, max) {
 // src/agent/delegation.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { join as join18 } from "node:path";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // src/agent/external-runtime.ts
 async function runExternalAgent(request) {
@@ -10645,86 +11368,86 @@ function numeric(...values) {
 }
 
 // src/agent/team-store.ts
-import { createHash as createHash13, randomUUID as randomUUID13 } from "node:crypto";
-import { lstat as lstat18, readFile as readFile16, readdir as readdir7, rm as rm3 } from "node:fs/promises";
+import { createHash as createHash15, randomUUID as randomUUID13 } from "node:crypto";
+import { lstat as lstat18, readFile as readFile17, readdir as readdir7, rm as rm3 } from "node:fs/promises";
 import { join as join16, resolve as resolve16 } from "node:path";
-import { z as z17 } from "zod";
-var runIdSchema = z17.string().uuid();
-var hashSchema = z17.string().regex(/^[a-f0-9]{64}$/u);
-var artifactSchema2 = z17.object({
+import { z as z18 } from "zod";
+var runIdSchema = z18.string().uuid();
+var hashSchema = z18.string().regex(/^[a-f0-9]{64}$/u);
+var artifactSchema2 = z18.object({
   sha256: hashSchema,
-  bytes: z17.number().int().nonnegative().max(5e5)
+  bytes: z18.number().int().nonnegative().max(5e5)
 }).strict();
-var phaseSchema = z17.enum(["work", "review", "revision", "write"]);
-var agentRecordSchema = z17.object({
-  id: z17.string().uuid(),
-  profile: z17.string(),
-  provider: z17.string(),
-  model: z17.string(),
+var phaseSchema = z18.enum(["work", "review", "revision", "write"]);
+var agentRecordSchema = z18.object({
+  id: z18.string().uuid(),
+  profile: z18.string(),
+  provider: z18.string(),
+  model: z18.string(),
   phase: phaseSchema,
-  ok: z17.boolean(),
-  createdAt: z17.string(),
-  startedAt: z17.string().optional(),
-  endedAt: z17.string().optional(),
-  durationMs: z17.number().int().nonnegative().optional(),
-  toolCalls: z17.number().int().nonnegative().optional(),
-  usage: z17.object({
-    inputTokens: z17.number().int().nonnegative(),
-    outputTokens: z17.number().int().nonnegative()
+  ok: z18.boolean(),
+  createdAt: z18.string(),
+  startedAt: z18.string().optional(),
+  endedAt: z18.string().optional(),
+  durationMs: z18.number().int().nonnegative().optional(),
+  toolCalls: z18.number().int().nonnegative().optional(),
+  usage: z18.object({
+    inputTokens: z18.number().int().nonnegative(),
+    outputTokens: z18.number().int().nonnegative()
   }).strict().optional(),
   report: artifactSchema2
 }).strict();
-var messageRecordSchema = z17.object({
-  id: z17.string().uuid(),
-  from: z17.string(),
-  to: z17.string(),
-  createdAt: z17.string(),
+var messageRecordSchema = z18.object({
+  id: z18.string().uuid(),
+  from: z18.string(),
+  to: z18.string(),
+  createdAt: z18.string(),
   content: artifactSchema2
 }).strict();
-var writerIntegrationSchema = z17.object({
-  status: z17.enum(["ready", "conflict", "integrated"]),
-  checkedAt: z17.string(),
-  detail: z17.string().max(2e4),
-  checkpoint: z17.object({
-    sessionId: z17.string(),
-    checkpointId: z17.string()
+var writerIntegrationSchema = z18.object({
+  status: z18.enum(["ready", "conflict", "integrated"]),
+  checkedAt: z18.string(),
+  detail: z18.string().max(2e4),
+  checkpoint: z18.object({
+    sessionId: z18.string(),
+    checkpointId: z18.string()
   }).strict().optional(),
-  integratedAt: z17.string().optional()
+  integratedAt: z18.string().optional()
 }).strict();
-var writerLaneSchema = z17.object({
-  profile: z17.string(),
-  reviewer: z17.string(),
-  baseCommit: z17.string().regex(/^[a-f0-9]{40,64}$/u),
-  outcome: z17.enum(["accepted", "rejected", "failed", "cancelled"]),
+var writerLaneSchema = z18.object({
+  profile: z18.string(),
+  reviewer: z18.string(),
+  baseCommit: z18.string().regex(/^[a-f0-9]{40,64}$/u),
+  outcome: z18.enum(["accepted", "rejected", "failed", "cancelled"]),
   patch: artifactSchema2,
-  files: z17.array(z17.string().min(1).max(4e3)).max(2e3),
-  worktreeCleaned: z17.boolean(),
+  files: z18.array(z18.string().min(1).max(4e3)).max(2e3),
+  worktreeCleaned: z18.boolean(),
   review: artifactSchema2.optional(),
   integration: writerIntegrationSchema.optional()
 }).strict();
 var manifestFields = {
   id: runIdSchema,
-  workspace: z17.string(),
-  objective: z17.string().max(3e4),
-  reviewer: z17.string(),
-  createdAt: z17.string(),
-  updatedAt: z17.string(),
-  status: z17.enum(["running", "accepted", "rejected", "failed"]),
-  maxReviewRounds: z17.number().int().min(0).max(3),
-  reviewRounds: z17.number().int().min(0).max(3),
-  agents: z17.array(agentRecordSchema).max(256),
-  messages: z17.array(messageRecordSchema).max(512)
+  workspace: z18.string(),
+  objective: z18.string().max(3e4),
+  reviewer: z18.string(),
+  createdAt: z18.string(),
+  updatedAt: z18.string(),
+  status: z18.enum(["running", "accepted", "rejected", "failed"]),
+  maxReviewRounds: z18.number().int().min(0).max(3),
+  reviewRounds: z18.number().int().min(0).max(3),
+  agents: z18.array(agentRecordSchema).max(256),
+  messages: z18.array(messageRecordSchema).max(512)
 };
-var manifestV1Schema = z17.object({
-  version: z17.literal(1),
+var manifestV1Schema = z18.object({
+  version: z18.literal(1),
   ...manifestFields
 }).strict();
-var manifestV2Schema = z17.object({
-  version: z17.literal(2),
+var manifestV2Schema = z18.object({
+  version: z18.literal(2),
   ...manifestFields,
   writer: writerLaneSchema.optional()
 }).strict();
-var manifestSchema2 = z17.discriminatedUnion("version", [manifestV1Schema, manifestV2Schema]);
+var manifestSchema2 = z18.discriminatedUnion("version", [manifestV1Schema, manifestV2Schema]);
 var TeamRunStore = class {
   workspace;
   directory;
@@ -10819,7 +11542,7 @@ var TeamRunStore = class {
     await this.assertRunDirectory(runId);
     const path = join16(this.runDirectory(runId), "manifest.json");
     await this.assertRegularFile(path);
-    const manifest = manifestSchema2.parse(JSON.parse(await readFile16(path, "utf8")));
+    const manifest = manifestSchema2.parse(JSON.parse(await readFile17(path, "utf8")));
     if (manifest.id !== runId || resolve16(manifest.workspace) !== this.workspace) {
       throw new Error("Team run manifest identity does not match its location.");
     }
@@ -10834,7 +11557,7 @@ var TeamRunStore = class {
   }
   async readArtifact(runId, artifact) {
     await this.verifyArtifact(runId, artifact);
-    return readFile16(this.artifactPath(runId, artifact.sha256), "utf8");
+    return readFile17(this.artifactPath(runId, artifact.sha256), "utf8");
   }
   async list() {
     await this.writes;
@@ -10890,7 +11613,7 @@ var TeamRunStore = class {
     await this.assertRunDirectory(runId);
     const path = join16(this.runDirectory(runId), "manifest.json");
     await this.assertRegularFile(path);
-    return manifestSchema2.parse(JSON.parse(await readFile16(path, "utf8")));
+    return manifestSchema2.parse(JSON.parse(await readFile17(path, "utf8")));
   }
   async writeManifest(manifest) {
     const directory = this.runDirectory(manifest.id);
@@ -10903,7 +11626,7 @@ var TeamRunStore = class {
   async writeArtifact(runId, content, truncate = true) {
     const data = boundedArtifactText(content, 5e5, truncate);
     const bytes = Buffer.byteLength(data);
-    const sha256 = createHash13("sha256").update(data).digest("hex");
+    const sha256 = createHash15("sha256").update(data).digest("hex");
     const directory = join16(this.runDirectory(runId), "blobs");
     await ensureWorkspaceStorageDirectory(this.workspace, directory, {
       requireActiveNamespace: this.managedDirectory
@@ -10911,8 +11634,8 @@ var TeamRunStore = class {
     const path = join16(directory, `${sha256}.txt`);
     try {
       await this.assertRegularFile(path);
-      const existing = await readFile16(path);
-      if (createHash13("sha256").update(existing).digest("hex") !== sha256) {
+      const existing = await readFile17(path);
+      if (createHash15("sha256").update(existing).digest("hex") !== sha256) {
         throw new Error(`Team artifact hash collision or corruption: ${sha256}`);
       }
     } catch (error) {
@@ -10932,9 +11655,9 @@ var TeamRunStore = class {
     hashSchema.parse(artifact.sha256);
     const path = this.artifactPath(runId, artifact.sha256);
     await this.assertRegularFile(path);
-    const data = await readFile16(path);
-    const hash3 = createHash13("sha256").update(data).digest("hex");
-    if (hash3 !== artifact.sha256 || data.byteLength !== artifact.bytes) {
+    const data = await readFile17(path);
+    const hash4 = createHash15("sha256").update(data).digest("hex");
+    if (hash4 !== artifact.sha256 || data.byteLength !== artifact.bytes) {
       throw new Error(`Team artifact integrity check failed: ${artifact.sha256}`);
     }
   }
@@ -10996,7 +11719,7 @@ function resolveAgentModelRoute(team, parent, profile) {
 }
 
 // src/agent/writer-lane.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { lstat as lstat19, mkdtemp, realpath as realpath7, rm as rm4 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { isAbsolute as isAbsolute6, join as join17, resolve as resolve17 } from "node:path";
@@ -11094,7 +11817,7 @@ var WriterLane = class {
     return {
       baseCommit,
       patch,
-      patchSha256: createHash14("sha256").update(patch).digest("hex"),
+      patchSha256: createHash16("sha256").update(patch).digest("hex"),
       files,
       worktreeCleaned,
       value
@@ -11324,14 +12047,14 @@ async function pathExists2(path) {
 }
 
 // src/agent/delegation.ts
-var writerRunInputSchema = z18.object({
-  task: z18.string().min(1).max(2e4),
-  profile: z18.string().max(64).optional(),
-  reviewer: z18.string().max(64).optional()
+var writerRunInputSchema = z19.object({
+  task: z19.string().min(1).max(2e4),
+  profile: z19.string().max(64).optional(),
+  reviewer: z19.string().max(64).optional()
 }).strict();
-var writerIntegrateInputSchema = z18.object({
-  run_id: z18.string().uuid(),
-  patch_sha256: z18.string().regex(/^[a-f0-9]{64}$/u)
+var writerIntegrateInputSchema = z19.object({
+  run_id: z19.string().uuid(),
+  patch_sha256: z19.string().regex(/^[a-f0-9]{64}$/u)
 }).strict();
 var DelegationManager = class {
   constructor(options) {
@@ -11392,10 +12115,10 @@ var DelegationManager = class {
       },
       async execute(arguments_, context) {
         if (!manager.team.enabled) return { ok: false, content: "Multi-agent delegation is disabled." };
-        const input2 = z18.object({
-          tasks: z18.array(z18.object({
-            profile: z18.string().max(64).optional(),
-            task: z18.string().min(1).max(2e4)
+        const input2 = z19.object({
+          tasks: z19.array(z19.object({
+            profile: z19.string().max(64).optional(),
+            task: z19.string().min(1).max(2e4)
           })).min(1).max(manager.team.maxDelegations)
         }).parse(arguments_);
         const tasks = input2.tasks.map((task) => ({
@@ -11441,13 +12164,13 @@ var DelegationManager = class {
       },
       async execute(arguments_, context) {
         if (!manager.team.enabled) return { ok: false, content: "Multi-agent teams are disabled." };
-        const input2 = z18.object({
-          objective: z18.string().min(1).max(3e4),
-          tasks: z18.array(z18.object({
-            profile: z18.string().max(64).optional(),
-            task: z18.string().min(1).max(2e4)
+        const input2 = z19.object({
+          objective: z19.string().min(1).max(3e4),
+          tasks: z19.array(z19.object({
+            profile: z19.string().max(64).optional(),
+            task: z19.string().min(1).max(2e4)
           })).min(1).max(manager.team.maxDelegations),
-          reviewer: z18.string().max(64).optional()
+          reviewer: z19.string().max(64).optional()
         }).parse(arguments_);
         const tasks = input2.tasks.map((task) => ({
           profile: task.profile ?? manager.team.defaultProfile,
@@ -12811,10 +13534,10 @@ function supportsNodeVersion(version) {
   const match = version.trim().replace(/^v/u, "").match(/^(\d+)\.(\d+)\.(\d+)/u);
   if (!match) return false;
   const current = match.slice(1).map(Number);
-  const minimum = MINIMUM_NODE_VERSION.split(".").map(Number);
-  for (let index = 0; index < minimum.length; index += 1) {
-    if ((current[index] ?? 0) > (minimum[index] ?? 0)) return true;
-    if ((current[index] ?? 0) < (minimum[index] ?? 0)) return false;
+  const minimum2 = MINIMUM_NODE_VERSION.split(".").map(Number);
+  for (let index = 0; index < minimum2.length; index += 1) {
+    if ((current[index] ?? 0) > (minimum2[index] ?? 0)) return true;
+    if ((current[index] ?? 0) < (minimum2[index] ?? 0)) return false;
   }
   return true;
 }
@@ -13095,22 +13818,24 @@ ${this.glyphs.meta} ${session.changedFiles.length} changed files ${this.glyphs.s
     if (!completion || completion.status === "no_changes") return;
     const checks = completion.checks.map((check) => check.command).join(", ");
     const suffix = checks ? ` ${this.glyphs.separator} ${checks}` : "";
+    const duplication = completion.duplication;
+    const duplicateSuffix = duplication ? ` ${this.glyphs.separator} duplication ${duplication.status} (${duplication.warningCount} warning, ${duplication.unresolvedCount} incomplete, ${duplication.suppressedCount} suppressed)` : "";
     if (completion.status === "verified") {
       process.stderr.write(this.paint.green(
-        `${this.glyphs.success} verified ${this.glyphs.separator} ${completion.detail}${suffix}
+        `${this.glyphs.success} verified ${this.glyphs.separator} ${completion.detail}${suffix}${duplicateSuffix}
 `
       ));
       return;
     }
     if (completion.status === "verification_failed") {
       process.stderr.write(this.paint.red(
-        `${this.glyphs.error} verification failed ${this.glyphs.separator} ${completion.detail}${suffix}
+        `${this.glyphs.error} verification failed ${this.glyphs.separator} ${completion.detail}${suffix}${duplicateSuffix}
 `
       ));
       return;
     }
     process.stderr.write(this.paint.yellow(
-      `${this.glyphs.warning} unverified ${this.glyphs.separator} ${completion.detail}
+      `${this.glyphs.warning} unverified ${this.glyphs.separator} ${completion.detail}${duplicateSuffix}
 `
     ));
   }
@@ -13454,7 +14179,7 @@ function graphemes(value) {
 }
 
 // src/ui/theme.ts
-import { lstat as lstat20, readdir as readdir8, readFile as readFile17 } from "node:fs/promises";
+import { lstat as lstat20, readdir as readdir8, readFile as readFile18 } from "node:fs/promises";
 import { basename as basename10, join as join19, resolve as resolve19 } from "node:path";
 import React, { createContext, useContext } from "react";
 function defineTheme(seed) {
@@ -13595,7 +14320,7 @@ async function reloadUserThemes(directory = userThemeDirectory()) {
       if (!info.isFile() || info.isSymbolicLink() || info.size > 64e3) {
         throw new Error("must be a regular JSON file smaller than 64 KB");
       }
-      const parsed = JSON.parse(await readFile17(path, "utf8"));
+      const parsed = JSON.parse(await readFile18(path, "utf8"));
       const name = themeName(parsed, basename10(entry, ".json"));
       if (builtInThemeNames.has(name)) throw new Error(`cannot replace built-in theme \`${name}\``);
       themes[name] = defineTheme(themeSeed(parsed, name));
@@ -13816,10 +14541,10 @@ function Header({ config, askMode, planMode = false, width = 80, glyphMode = "au
   const separator = ` ${glyphs.separator} `;
   const model = sanitizeInlineTerminalText(`${config.model.provider}/${config.model.model}`);
   const repository = sanitizeInlineTerminalText(basename11(root) || root);
-  const minimum = `${brand} ${modeLabel}`;
+  const minimum2 = `${brand} ${modeLabel}`;
   const withRepository = `${brand}${separator}${repository}${separator}${modeLabel}`;
   const showRepository = terminalWidth >= 32 && displayWidth(withRepository) <= terminalWidth;
-  const leftWidth = displayWidth(showRepository ? withRepository : minimum);
+  const leftWidth = displayWidth(showRepository ? withRepository : minimum2);
   const modelSpace = terminalWidth - leftWidth - 2;
   const showModel = terminalWidth >= 72 && modelSpace >= 12;
   return /* @__PURE__ */ jsxs(Box, { marginBottom: 1, height: 1, overflowY: "hidden", children: [
@@ -14837,7 +15562,7 @@ function safeWidth(width) {
 }
 
 // src/utils/update-check.ts
-import { mkdir as mkdir9, readFile as readFile18, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir9, readFile as readFile19, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join20 } from "node:path";
 import stripAnsi3 from "strip-ansi";
 var PACKAGE_NAME = "@skein-code/cli";
@@ -14935,7 +15660,7 @@ function noticeIfNewer(latest, current, highlights) {
 }
 async function readUpdateCache(env = process.env) {
   try {
-    const raw = await readFile18(updateCachePath(env), "utf8");
+    const raw = await readFile19(updateCachePath(env), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.checkedAt === "number" && Number.isFinite(parsed.checkedAt) && parsed.checkedAt >= 0 && (parsed.latest === null || typeof parsed.latest === "string" && parseVersion(parsed.latest))) {
       const latest = typeof parsed.latest === "string" ? parsed.latest : null;
@@ -15535,9 +16260,9 @@ function uniqueNewestFirst(history) {
   for (let index = history.length - 1; index >= 0; index -= 1) {
     const entry = history[index];
     if (!entry.trim()) continue;
-    const identity = entry.normalize("NFC");
-    if (seen.has(identity)) continue;
-    seen.add(identity);
+    const identity2 = entry.normalize("NFC");
+    if (seen.has(identity2)) continue;
+    seen.add(identity2);
     entries.push(entry);
   }
   return entries;
@@ -15722,6 +16447,18 @@ function toolMetaSummary(metadata) {
       parts.push(`reuse ${decision}${status === "unresolved" ? " (incomplete)" : " (warning)"}`);
     }
   }
+  const duplication = metadata.duplicationAudit;
+  if (duplication && typeof duplication === "object") {
+    const status = duplication.status;
+    const matches = Number(duplication.matches?.length ?? 0);
+    if (status === "warning") parts.push(`duplicates ${matches} (warning)`);
+    else if (status === "unresolved") parts.push("duplicates incomplete");
+  }
+  const suppression = metadata.duplicationSuppression;
+  if (suppression && typeof suppression === "object") {
+    const matchId2 = suppression.matchId;
+    if (typeof matchId2 === "string") parts.push(`duplicate ${matchId2.slice(0, 8)} suppressed`);
+  }
   const hooks = metadata.hooks;
   if (hooks && typeof hooks === "object") {
     const before = Number(hooks.before ?? 0);
@@ -16181,12 +16918,14 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
         refreshSession();
         if (event.completion && event.completion.status !== "no_changes") {
           const checks = event.completion.checks.map((check) => check.command).join(` ${separator} `);
+          const duplication = event.completion.duplication;
+          const duplicateDetail = duplication ? `${separator} duplication ${duplication.status} (${duplication.warningCount} warning, ${duplication.unresolvedCount} incomplete, ${duplication.suppressedCount} suppressed)` : "";
           append({
             id: nextId(),
             kind: "notice",
             wrapWidth: contentWidth,
             tone: event.completion.status === "verified" ? "success" : event.completion.status === "unverified" ? "warning" : "error",
-            text: event.completion.status === "verified" ? `Verified${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}` : event.completion.status === "verification_failed" ? `Verification failed${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}` : `Unverified${separator}${event.completion.detail}`
+            text: event.completion.status === "verified" ? `Verified${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}${duplicateDetail}` : event.completion.status === "verification_failed" ? `Verification failed${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}${duplicateDetail}` : `Unverified${separator}${event.completion.detail}${duplicateDetail}`
           });
         }
         if (event.reason !== "completed" && event.reason !== "unverified" && event.reason !== "verification_failed") {
@@ -18208,7 +18947,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import stripAnsi5 from "strip-ansi";
 
 // src/mcp/tool.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import stripAnsi4 from "strip-ansi";
 var MAX_ARGUMENT_BYTES = 256e3;
 var MAX_DESCRIPTION_LENGTH = 4e3;
@@ -18216,7 +18955,7 @@ var MAX_RESULT_BYTES = 5 * 1024 * 1024;
 var MAX_SCHEMA_BYTES = 1e5;
 function createMcpToolAdapter(options) {
   const { remoteTool } = options;
-  const inputSchema12 = copyInputSchema(remoteTool.inputSchema);
+  const inputSchema13 = copyInputSchema(remoteTool.inputSchema);
   return {
     definition: {
       name: options.exposedName,
@@ -18224,7 +18963,7 @@ function createMcpToolAdapter(options) {
       // MCP servers are an external trust boundary. Read-only annotations are
       // hints from that server and must not lower the local permission level.
       category: "network",
-      inputSchema: inputSchema12
+      inputSchema: inputSchema13
     },
     permissionCategories: () => ["network"],
     async execute(arguments_, context) {
@@ -18372,13 +19111,13 @@ function normalizeToolSegment(value, fallback) {
   if (!normalized) return fallback;
   return /^[a-z]/.test(normalized) ? normalized : `${fallback}_${normalized}`;
 }
-function fitToolName(name, identity) {
+function fitToolName(name, identity2) {
   if (name.length <= 64) return name;
-  const suffix = `_${shortHash(identity)}`;
+  const suffix = `_${shortHash(identity2)}`;
   return `${name.slice(0, 64 - suffix.length).replace(/_+$/g, "")}${suffix}`;
 }
 function shortHash(value) {
-  return createHash15("sha256").update(value).digest("hex").slice(0, 8);
+  return createHash17("sha256").update(value).digest("hex").slice(0, 8);
 }
 function sanitizeOutputText(value) {
   return stripAnsi4(value).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "");
@@ -18874,12 +19613,12 @@ var McpManager = class {
     );
     for (const remoteTool of remoteTools) {
       let exposedName = makeMcpToolName(namespace, remoteTool.name);
-      const identity = `${serverName}\0${remoteTool.name}`;
-      if (seen.has(exposedName) || this.isToolNameOwnedByAnother(exposedName, identity)) {
+      const identity2 = `${serverName}\0${remoteTool.name}`;
+      if (seen.has(exposedName) || this.isToolNameOwnedByAnother(exposedName, identity2)) {
         exposedName = disambiguateMcpToolName(exposedName, serverName, remoteTool.name);
       }
       let collision = 0;
-      while (seen.has(exposedName) || this.isToolNameOwnedByAnother(exposedName, identity)) {
+      while (seen.has(exposedName) || this.isToolNameOwnedByAnother(exposedName, identity2)) {
         collision += 1;
         exposedName = disambiguateMcpToolName(
           `${makeMcpToolName(namespace, remoteTool.name)}_${collision}`,
@@ -18895,7 +19634,7 @@ var McpManager = class {
         }
         return active.client.callTool(params, void 0, options);
       };
-      let adapter = this.stableAdapters.get(identity);
+      let adapter = this.stableAdapters.get(identity2);
       if (!adapter) {
         adapter = createMcpToolAdapter({
           serverName,
@@ -18904,17 +19643,17 @@ var McpManager = class {
           timeoutMs,
           callTool
         });
-        this.stableAdapters.set(identity, adapter);
+        this.stableAdapters.set(identity2, adapter);
       }
       result.set(exposedName, adapter);
       seen.add(exposedName);
-      this.toolOwners.set(exposedName, identity);
+      this.toolOwners.set(exposedName, identity2);
     }
     return result;
   }
-  isToolNameOwnedByAnother(toolName, identity) {
+  isToolNameOwnedByAnother(toolName, identity2) {
     const owner = this.toolOwners.get(toolName);
-    return owner !== void 0 && owner !== identity;
+    return owner !== void 0 && owner !== identity2;
   }
   handleUnexpectedClose(name) {
     const connection = this.connections.get(name);
@@ -19008,9 +19747,9 @@ async function closeTransportQuietly(transport) {
 }
 
 // src/memory/tools.ts
-import { z as z19 } from "zod";
-var scopeSchema = z19.enum(["user", "workspace", "session", "agent"]);
-var kindSchema = z19.enum(["semantic", "episodic", "procedural"]);
+import { z as z20 } from "zod";
+var scopeSchema = z20.enum(["user", "workspace", "session", "agent"]);
+var kindSchema = z20.enum(["semantic", "episodic", "procedural"]);
 function createMemoryTools(store) {
   return [
     {
@@ -19025,10 +19764,10 @@ function createMemoryTools(store) {
         }, ["query"])
       },
       async execute(arguments_, context) {
-        const input2 = z19.object({
-          query: z19.string().max(4e3),
+        const input2 = z20.object({
+          query: z20.string().max(4e3),
           scope: scopeSchema.optional(),
-          limit: z19.number().int().min(1).max(20).optional()
+          limit: z20.number().int().min(1).max(20).optional()
         }).parse(arguments_);
         const scopes = input2.scope ? [{ scope: input2.scope, scopeKey: scopeKey(input2.scope, context) }] : availableScopes(context);
         const records = store.search(input2.query, { scopes, limit: input2.limit ?? 8 });
@@ -19060,17 +19799,17 @@ ${record.content}`
         }, ["content", "rationale"])
       },
       async execute(arguments_, context) {
-        const input2 = z19.object({
-          content: z19.string().min(1).max(12e3),
-          rationale: z19.string().min(1).max(1e3),
+        const input2 = z20.object({
+          content: z20.string().min(1).max(12e3),
+          rationale: z20.string().min(1).max(1e3),
           scope: scopeSchema.optional(),
           kind: kindSchema.optional(),
-          tags: z19.array(z19.string()).max(24).optional(),
-          importance: z19.number().min(0).max(1).optional(),
-          confidence: z19.number().min(0).max(1).optional(),
-          agent: z19.string().max(64).optional(),
-          revision: z19.string().max(240).optional(),
-          conflictKey: z19.string().max(240).optional()
+          tags: z20.array(z20.string()).max(24).optional(),
+          importance: z20.number().min(0).max(1).optional(),
+          confidence: z20.number().min(0).max(1).optional(),
+          agent: z20.string().max(64).optional(),
+          revision: z20.string().max(240).optional(),
+          conflictKey: z20.string().max(240).optional()
         }).strict().parse(arguments_);
         const scope = input2.scope ?? "workspace";
         const candidate = store.propose({
@@ -19108,9 +19847,9 @@ ${record.content}`
         }, ["id"])
       },
       async execute(arguments_) {
-        const input2 = z19.object({
-          id: z19.string().uuid(),
-          permanent: z19.boolean().optional()
+        const input2 = z20.object({
+          id: z20.string().uuid(),
+          permanent: z20.boolean().optional()
         }).parse(arguments_);
         const changed = input2.permanent ? store.remove(input2.id) : store.archive(input2.id);
         return {
@@ -19137,7 +19876,7 @@ function scopeKey(scope, context) {
 }
 
 // src/skills/catalog.ts
-import { lstat as lstat21, readFile as readFile19, readdir as readdir9, realpath as realpath9 } from "node:fs/promises";
+import { lstat as lstat21, readFile as readFile20, readdir as readdir9, realpath as realpath9 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { basename as basename12, join as join21, resolve as resolve21 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
@@ -19269,7 +20008,7 @@ async function safeRead(path, maxBytes) {
     const resolvedParent = await realpath9(parent);
     const resolvedPath = await realpath9(path);
     if (!resolvedPath.startsWith(`${resolvedParent}/`)) return void 0;
-    return await readFile19(path, "utf8");
+    return await readFile20(path, "utf8");
   } catch {
     return void 0;
   }
@@ -19314,7 +20053,7 @@ function escapeAttribute6(value) {
 }
 
 // src/workflows/catalog.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var builtInWorkflows = [
   {
     name: "implement",
@@ -19405,7 +20144,7 @@ function createWorkflowTool(catalog) {
       }, ["name", "task"])
     },
     async execute(arguments_) {
-      const input2 = z20.object({ name: z20.string(), task: z20.string().min(1).max(2e4) }).parse(arguments_);
+      const input2 = z21.object({ name: z21.string(), task: z21.string().min(1).max(2e4) }).parse(arguments_);
       const workflow = catalog.get(input2.name);
       if (!workflow) return { ok: false, content: `Unknown workflow: ${input2.name}` };
       return {