@skein-code/cli 0.3.15 → 0.3.16

package/dist/cli.js

@@ -220,7 +220,7 @@ function isSqliteBusy(error) {
 // package.json
 var package_default = {
   name: "@skein-code/cli",
-  version: "0.3.15",
+  version: "0.3.16",
   description: "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   type: "module",
   license: "MIT",
@@ -236,6 +236,9 @@ var package_default = {
   },
   skein: {
     releaseNotes: [
+      "Duplication warnings now aggregate into the single completion receipt without changing verified status",
+      "Exact match ids support bounded, reason-coded suppression with audit and credential/code-block safeguards",
+      "Duplication audit tools are disclosed only when active warnings exist and repaired paths clear stale matches",
       "Warning-only TS/JS duplication audit compares new functions with the pre-write index generation",
       "Deterministic Type-1/2 and Type-3 receipts retain only hashes, locations, scores, and bounded counts",
       "Ordinary edits, renames, moves, deletions, small functions, tests, generated paths, and failed writes stay quiet",
@@ -5673,6 +5676,15 @@ var reuseReceiptSchema = z5.object({
   status: z5.enum(["warning", "skipped", "unresolved"]),
   warningOnly: z5.literal(true)
 }).strict();
+var duplicationMatchSchema = z5.object({
+  matchId: z5.string().regex(/^[a-f0-9]{24}$/u).optional(),
+  changedPath: z5.string(),
+  changedSymbol: z5.string(),
+  candidatePath: z5.string(),
+  candidateSymbol: z5.string(),
+  kind: z5.enum(["type-1-or-2", "type-3"]),
+  similarity: z5.number().min(0).max(1)
+}).strict();
 var duplicationAuditSchema = z5.object({
   baselineGeneration: z5.string().min(1),
   changeSequence: z5.number().int().nonnegative(),
@@ -5680,16 +5692,16 @@ var duplicationAuditSchema = z5.object({
   warningOnly: z5.literal(true),
   checkedFunctions: z5.number().int().nonnegative(),
   skippedSmallFunctions: z5.number().int().nonnegative(),
-  matches: z5.array(z5.object({
-    changedPath: z5.string(),
-    changedSymbol: z5.string(),
-    candidatePath: z5.string(),
-    candidateSymbol: z5.string(),
-    kind: z5.enum(["type-1-or-2", "type-3"]),
-    similarity: z5.number().min(0).max(1)
-  }).strict()).max(8),
+  matches: z5.array(duplicationMatchSchema).max(8),
   rationale: z5.string().max(500)
 }).strict();
+var duplicationSuppressionSchema = z5.object({
+  matchId: z5.string().regex(/^[a-f0-9]{24}$/u),
+  reasonCode: z5.enum(["separate-boundary", "protocol-required", "generated-contract", "false-positive", "other"]),
+  reason: z5.string().min(12).max(240),
+  createdAt: z5.string().datetime(),
+  toolCallId: z5.string().min(1).max(512)
+}).strict();
 var auditMetadataSchema = z5.record(z5.string(), z5.unknown()).superRefine((metadata, ctx) => {
   const receipt = metadata.reuseReceipt;
   if (receipt !== void 0 && !reuseReceiptSchema.safeParse(receipt).success) {
@@ -5699,6 +5711,14 @@ var auditMetadataSchema = z5.record(z5.string(), z5.unknown()).superRefine((meta
   if (duplication !== void 0 && !duplicationAuditSchema.safeParse(duplication).success) {
     ctx.addIssue({ code: "custom", message: "Invalid duplication audit receipt" });
   }
+  const suppression = metadata.duplicationSuppression;
+  if (suppression !== void 0 && !duplicationSuppressionSchema.safeParse(suppression).success) {
+    ctx.addIssue({ code: "custom", message: "Invalid duplication suppression receipt" });
+  }
+  const activeMatches = metadata.activeDuplicationMatches;
+  if (activeMatches !== void 0 && !z5.array(z5.string().regex(/^[a-f0-9]{24}$/u)).max(8).safeParse(activeMatches).success) {
+    ctx.addIssue({ code: "custom", message: "Invalid active duplication matches" });
+  }
 });
 var auditSchema = z5.object({
   id: z5.string(),
@@ -5738,6 +5758,16 @@ var lastRunSchema = z5.object({
   checks: z5.array(verificationEvidenceSchema),
   detail: z5.string(),
   mutationTracking: z5.enum(["complete", "unknown"]).optional(),
+  duplication: z5.object({
+    enforcement: z5.literal("warning"),
+    status: z5.enum(["clear", "warning", "unresolved", "suppressed"]),
+    warningCount: z5.number().int().nonnegative(),
+    unresolvedCount: z5.number().int().nonnegative(),
+    suppressedCount: z5.number().int().nonnegative(),
+    matches: z5.array(duplicationMatchSchema.extend({
+      matchId: z5.string().regex(/^[a-f0-9]{24}$/u)
+    })).max(8)
+  }).strict().optional(),
   acceptance: z5.object({
     state: z5.enum(["draft", "active", "satisfied", "blocked"]),
     total: z5.number().int().nonnegative(),
@@ -5803,6 +5833,7 @@ var sessionSchema = z5.object({
   contextSources: z5.array(contextSourceSchema).max(64).optional(),
   toolArtifacts: z5.array(toolArtifactSchema).max(200).optional(),
   taskContract: taskContractSchema.optional(),
+  duplicationSuppressions: z5.array(duplicationSuppressionSchema).max(64).optional(),
   lastRun: lastRunSchema.optional(),
   usage: z5.object({
     inputTokens: z5.number().nonnegative(),
@@ -8332,7 +8363,7 @@ function captureVerification(call, result, changeSequence, configuredCommands) {
     commandKey: createHash11("sha256").update(normalized).digest("hex")
   };
 }
-function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutationTracking = "complete", taskContract, audit = []) {
+function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutationTracking = "complete", taskContract, audit = [], duplication) {
   const files = [...new Set(changedFiles)];
   const acceptance = taskContract ? buildAcceptance(taskContract, audit, evidence, currentChangeSequence) : void 0;
   if (mutationTracking === "unknown") {
@@ -8342,6 +8373,7 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       checks: [],
       detail: files.length ? `Workspace changes were observed, but a dynamic shell command prevented complete mutation tracking for ${fileCount(files.length)}.` : "A dynamic shell command may have changed workspace files, but reliable mutation tracking was unavailable.",
       mutationTracking,
+      ...duplication ? { duplication } : {},
       ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {}
     };
   }
@@ -8352,7 +8384,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
         changedFiles: [],
         checks: [],
         detail: acceptanceDetail(acceptance),
-        acceptance: acceptanceForCompletion(acceptance, "unverified")
+        acceptance: acceptanceForCompletion(acceptance, "unverified"),
+        ...duplication ? { duplication } : {}
       };
     }
     return {
@@ -8360,7 +8393,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: [],
       checks: [],
       detail: "No workspace files changed in this run.",
-      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "no_changes") } : {}
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "no_changes") } : {},
+      ...duplication ? { duplication } : {}
     };
   }
   const latestByCommand = /* @__PURE__ */ new Map();
@@ -8376,7 +8410,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: files,
       checks,
       detail: `No successful verification was recorded after the last change to ${fileCount(files.length)}.`,
-      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {}
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {},
+      ...duplication ? { duplication } : {}
     };
   }
   const failures = checks.filter((check) => !check.ok);
@@ -8386,7 +8421,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: files,
       checks,
       detail: `${failures.length} of ${checks.length} current verification ${checks.length === 1 ? "check" : "checks"} failed.`,
-      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verification_failed") } : {}
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verification_failed") } : {},
+      ...duplication ? { duplication } : {}
     };
   }
   if (acceptance && acceptanceUnresolved(acceptance)) {
@@ -8395,7 +8431,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       changedFiles: files,
       checks,
       detail: acceptanceDetail(acceptance),
-      acceptance: acceptanceForCompletion(acceptance, "unverified")
+      acceptance: acceptanceForCompletion(acceptance, "unverified"),
+      ...duplication ? { duplication } : {}
     };
   }
   return {
@@ -8403,7 +8440,8 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
     changedFiles: files,
     checks,
     detail: `${checks.length} current verification ${checks.length === 1 ? "check" : "checks"} passed for ${fileCount(files.length)}.`,
-    ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verified") } : {}
+    ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "verified") } : {},
+    ...duplication ? { duplication } : {}
   };
 }
 function completionRecoveryDirective(completion) {
@@ -8815,6 +8853,139 @@ function render(memory) {
   ].join("\n");
 }
 
+// src/tools/duplication.ts
+import { z as z17 } from "zod";
+
+// src/agent/duplication-state.ts
+function buildDuplicationCompletion(audit, suppressions = [], runStartedAt) {
+  const active = /* @__PURE__ */ new Map();
+  const unresolved2 = /* @__PURE__ */ new Map();
+  let sawCurrentReceipt = false;
+  for (const event of audit) {
+    if (runStartedAt && event.createdAt < runStartedAt) continue;
+    const receipt = duplicationReceipt(event.metadata?.duplicationAudit);
+    if (!receipt) continue;
+    if (receipt.status === "clear" || receipt.status === "unresolved" || receipt.matches.some((match) => typeof match.matchId === "string")) sawCurrentReceipt = true;
+    const changedPaths2 = changedPathsFor(event, receipt);
+    for (const path of changedPaths2) {
+      for (const [id, match] of active) if (match.changedPath === path) active.delete(id);
+      unresolved2.delete(path);
+    }
+    if (receipt.status === "unresolved") {
+      for (const path of changedPaths2) unresolved2.set(path, receipt.changeSequence);
+    }
+    for (const match of receipt.matches) {
+      if (typeof match.matchId === "string") {
+        active.set(match.matchId, match);
+      }
+    }
+  }
+  if (!active.size && !unresolved2.size && !sawCurrentReceipt) return void 0;
+  const activeIds = new Set(active.keys());
+  const suppressedIds = new Set(suppressions.filter((item) => activeIds.has(item.matchId)).map((item) => item.matchId));
+  const warnings = [...active.values()].filter((match) => !suppressedIds.has(match.matchId));
+  const suppressedCount = active.size - warnings.length;
+  return {
+    enforcement: "warning",
+    status: unresolved2.size ? "unresolved" : warnings.length ? "warning" : suppressedCount ? "suppressed" : "clear",
+    warningCount: warnings.length,
+    unresolvedCount: unresolved2.size,
+    suppressedCount,
+    matches: warnings.slice(0, 8)
+  };
+}
+function activeDuplicationMatchIds(audit, suppressions = []) {
+  const completion = buildDuplicationCompletion(audit, suppressions);
+  return new Set(completion?.matches.map((match) => match.matchId) ?? []);
+}
+function pruneDuplicationSuppressions(audit, suppressions = []) {
+  if (!suppressions.length) return [];
+  const active = new Set(buildDuplicationCompletion(audit, [])?.matches.map((match) => match.matchId) ?? []);
+  return suppressions.filter((item) => active.has(item.matchId)).slice(-64);
+}
+function findActiveDuplicationMatches(audit, suppressions = []) {
+  return buildDuplicationCompletion(audit, suppressions)?.matches ?? [];
+}
+function hasDuplicationActivity(audit, runStartedAt) {
+  return audit.some(
+    (event) => (!runStartedAt || event.createdAt >= runStartedAt) && (duplicationReceipt(event.metadata?.duplicationAudit) !== void 0 || event.metadata?.duplicationSuppression !== void 0 || event.metadata?.activeDuplicationMatches !== void 0)
+  );
+}
+function duplicationReceipt(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const receipt = value;
+  if (!Array.isArray(receipt.matches) || typeof receipt.changeSequence !== "number" || !["clear", "warning", "unresolved"].includes(String(receipt.status))) return void 0;
+  return receipt;
+}
+function changedPathsFor(event, receipt) {
+  const metadataPaths = event.metadata?.changedFiles;
+  const fromMetadata = Array.isArray(metadataPaths) ? metadataPaths.filter((path) => typeof path === "string") : [];
+  return [.../* @__PURE__ */ new Set([...fromMetadata, ...receipt.matches.map((match) => match.changedPath)])];
+}
+
+// src/tools/duplication.ts
+var inputSchema12 = z17.discriminatedUnion("action", [
+  z17.object({ action: z17.literal("show") }).strict(),
+  z17.object({
+    action: z17.literal("suppress"),
+    match_id: z17.string().regex(/^[a-f0-9]{24}$/u),
+    reason_code: z17.enum(["separate-boundary", "protocol-required", "generated-contract", "false-positive", "other"]),
+    reason: z17.string().trim().min(12).max(240)
+  }).strict()
+]);
+var duplicationTool = {
+  definition: {
+    name: "duplication_audit",
+    description: "Inspect active duplicate-function warnings or suppress one exact match with an auditable reason. Suppression does not bypass correctness, security, accessibility, concurrency, or verification requirements.",
+    category: "read",
+    inputSchema: jsonSchema({
+      action: { type: "string", enum: ["show", "suppress"] },
+      match_id: { type: "string", description: "Exact 24-character match id from the current audit." },
+      reason_code: { type: "string", enum: ["separate-boundary", "protocol-required", "generated-contract", "false-positive", "other"] },
+      reason: { type: "string", description: "Specific 12-240 character explanation; code blocks and credentials are rejected." }
+    }, ["action"])
+  },
+  async execute(arguments_, context) {
+    const input2 = inputSchema12.parse(arguments_);
+    const suppressions = pruneDuplicationSuppressions(
+      context.session.audit ?? [],
+      context.session.duplicationSuppressions ?? []
+    );
+    context.session.duplicationSuppressions = suppressions;
+    const active = activeDuplicationMatchIds(context.session.audit ?? [], suppressions);
+    if (input2.action === "suppress") {
+      if (!active.has(input2.match_id)) {
+        throw new Error(`Unknown, stale, or already suppressed duplication match: ${input2.match_id}`);
+      }
+      suppressions.push({
+        matchId: input2.match_id,
+        reasonCode: input2.reason_code,
+        reason: cleanReason(input2.reason),
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        toolCallId: context.toolCallId ?? "unavailable"
+      });
+      context.session.duplicationSuppressions = suppressions.slice(-64);
+      return {
+        content: `Suppressed duplication match ${input2.match_id}. This does not waive verification or safety requirements.`,
+        metadata: { duplicationSuppression: context.session.duplicationSuppressions.at(-1) }
+      };
+    }
+    const matches = findActiveDuplicationMatches(context.session.audit ?? [], suppressions);
+    return {
+      content: matches.length ? matches.map(
+        (match) => `- ${match.matchId}: ${match.changedPath}#${match.changedSymbol} -> ${match.candidatePath}#${match.candidateSymbol} (${match.kind}, ${match.similarity.toFixed(3)})`
+      ).join("\n") : "No unsuppressed duplication matches.",
+      metadata: { activeDuplicationMatches: matches.map((match) => match.matchId) }
+    };
+  }
+};
+function cleanReason(value) {
+  if (/```|~~~|\b(?:api[_-]?key|access[_-]?token|authorization|cookie|password|secret)\s*[:=]/iu.test(value) || /\b(?:sk-[A-Za-z0-9_-]{12,}|AIza[0-9A-Za-z_-]{20,})\b/u.test(value)) {
+    throw new Error("Suppression reasons cannot contain code blocks or credentials.");
+  }
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/gu, " ").replace(/\s+/gu, " ").trim();
+}
+
 // src/tools/index.ts
 function createDefaultToolRegistry(_options = {}) {
   return new ToolRegistry([
@@ -8828,6 +8999,7 @@ function createDefaultToolRegistry(_options = {}) {
     gitTool,
     taskTool,
     taskContractTool,
+    duplicationTool,
     workingMemoryTool
   ]);
 }
@@ -9633,6 +9805,7 @@ function roundScore(value) {
 }
 
 // src/agent/duplication-audit.ts
+import { createHash as createHash14 } from "node:crypto";
 import { readFile as readFile15 } from "node:fs/promises";
 var NEAR_CLONE_THRESHOLD = 0.55;
 var MAX_MATCHES = 8;
@@ -9658,13 +9831,16 @@ async function auditChangedFunctions(input2) {
     return unresolved(input2.changeSequence, input2.baseline?.generation);
   }
   const currentFunctions = reports.flatMap((report) => report.functions.map(withoutTokens));
-  if (!currentFunctions.length) return void 0;
+  if (!currentFunctions.length) {
+    return auditableFiles.some((path) => input2.recheckPaths?.has(path)) && input2.baseline ? clear(input2.baseline.generation, input2.changeSequence, skippedSmallFunctions) : void 0;
+  }
   if (!input2.baseline) return unresolved(input2.changeSequence);
   const lookup = createBaselineLookup(input2.baseline.functions);
   const previousByCurrent = matchCurrentFunctions(input2.baseline.functions, currentFunctions);
   const added = currentFunctions.flatMap((current) => {
     const previous = previousByCurrent.get(locationIdentity(current));
-    return !previous || current.tokenCount >= previous.tokenCount * 1.5 ? [{ current, previous }] : [];
+    const recheck = input2.recheckFunctions?.has(identity(current)) || previous !== void 0 && input2.recheckFunctions?.has(identity(previous));
+    return !previous || current.tokenCount >= previous.tokenCount * 1.5 || recheck ? [{ current, previous }] : [];
   });
   if (!added.length) return void 0;
   const matches = [];
@@ -9678,6 +9854,7 @@ async function auditChangedFunctions(input2) {
     }
     if (!best) continue;
     matches.push({
+      matchId: matchId(input2.baseline.generation, input2.changeSequence, item, best.candidate, best.similarity),
       changedPath: item.path,
       changedSymbol: item.symbol,
       candidatePath: best.candidate.path,
@@ -9699,6 +9876,18 @@ async function auditChangedFunctions(input2) {
     rationale: bounded.length ? `${bounded.length} deterministic duplicate candidate${bounded.length === 1 ? "" : "s"} found; review for reuse.` : "No deterministic duplicate candidate exceeded the warning threshold."
   };
 }
+function clear(baselineGeneration, changeSequence, skippedSmallFunctions) {
+  return {
+    baselineGeneration,
+    changeSequence,
+    status: "clear",
+    warningOnly: true,
+    checkedFunctions: 0,
+    skippedSmallFunctions,
+    matches: [],
+    rationale: "No active deterministic duplicate candidate remains on the rechecked path."
+  };
+}
 function withoutTokens(value) {
   const { normalizedTokens: _tokens, ...fingerprint } = value;
   return fingerprint;
@@ -9782,6 +9971,17 @@ function unresolved(changeSequence, generation = "unavailable") {
 function round(value) {
   return Math.round(value * 1e3) / 1e3;
 }
+function matchId(generation, changeSequence, changed, candidate, similarity) {
+  return createHash14("sha256").update([
+    generation,
+    String(changeSequence),
+    changed.path,
+    changed.symbol,
+    candidate.path,
+    candidate.symbol,
+    similarity === 1 ? "type-1-or-2" : "type-3"
+  ].join("\0")).digest("hex").slice(0, 24);
+}
 
 // src/agent/runner.ts
 var AgentRunner = class {
@@ -9853,6 +10053,7 @@ var AgentRunner = class {
       await options.onEvent?.(event);
     };
     const changeSequenceAtStart = this.changeSequence;
+    const runStartedAt = (/* @__PURE__ */ new Date()).toISOString();
     const runChangedFiles = /* @__PURE__ */ new Set();
     const verificationEvidence = [];
     const toolRecovery = new ToolRecoveryController();
@@ -9882,7 +10083,11 @@ var AgentRunner = class {
         this.changeSequence,
         mutationTracking,
         activeRunContract,
-        this.session.audit ?? []
+        this.session.audit ?? [],
+        hasDuplicationActivity(this.session.audit ?? [], runStartedAt) ? buildDuplicationCompletion(
+          this.session.audit ?? [],
+          this.session.duplicationSuppressions ?? []
+        ) : void 0
       );
       if (completion.acceptance && activeRunContract && activeRunContract.state !== "draft") {
         activeRunContract.state = completion.acceptance.state;
@@ -10008,7 +10213,11 @@ var AgentRunner = class {
           this.tools,
           options.askMode === true,
           contractEnabled,
-          this.hasReadableToolArtifact()
+          this.hasReadableToolArtifact(),
+          activeDuplicationMatchIds(
+            this.session.audit ?? [],
+            this.session.duplicationSuppressions ?? []
+          ).size > 0
         );
         const estimatedInputTokens = estimateMessages2(messages) + estimateToolDefinitions(visibleTools);
         if (availableTokens <= 0 || estimatedInputTokens >= availableTokens) {
@@ -10293,7 +10502,8 @@ ${input2}`
       contextEngine: this.contextEngine,
       toolArtifactStore: this.toolArtifactStore,
       emit,
-      ...options.signal ? { signal: options.signal } : {}
+      ...options.signal ? { signal: options.signal } : {},
+      toolCallId: call.id
     };
     try {
       let reuseReceipt;
@@ -10343,10 +10553,21 @@ ${input2}`
       throwIfAborted(options.signal);
       const execution = await tool.execute(call.arguments, toolExecutionContext);
       const changedFiles = await this.acceptChangedFiles(execution.changedFiles ?? []);
+      const activeDuplicateFunctions = new Set(
+        buildDuplicationCompletion(
+          this.session.audit ?? [],
+          []
+        )?.matches.map((match) => `${match.changedPath}\0${match.changedSymbol}`) ?? []
+      );
+      const activeDuplicatePaths = new Set(
+        buildDuplicationCompletion(this.session.audit ?? [], [])?.matches.map((match) => match.changedPath) ?? []
+      );
       const duplicationAudit = duplicationAuditEnabled ? await auditChangedFunctions({
         ...duplicationBaseline ? { baseline: duplicationBaseline } : {},
         changedFiles,
-        changeSequence: this.changeSequence
+        changeSequence: this.changeSequence,
+        recheckFunctions: activeDuplicateFunctions,
+        recheckPaths: activeDuplicatePaths
       }) : void 0;
       const tasksBefore = JSON.stringify(this.session.tasks);
       let afterHookError;
@@ -10826,9 +11047,9 @@ ${content}` : content,
     ...failure ? { metadata: { failure } } : {}
   };
 }
-function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable) {
+function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable) {
   return tools.definitions().filter(
-    (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact")
+    (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
   );
 }
 function formatToolError(error) {
@@ -11020,7 +11241,7 @@ function integer(value, fallback, min, max) {
 // src/agent/delegation.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { join as join18 } from "node:path";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // src/agent/external-runtime.ts
 async function runExternalAgent(request) {
@@ -11147,86 +11368,86 @@ function numeric(...values) {
 }
 
 // src/agent/team-store.ts
-import { createHash as createHash14, randomUUID as randomUUID13 } from "node:crypto";
+import { createHash as createHash15, randomUUID as randomUUID13 } from "node:crypto";
 import { lstat as lstat18, readFile as readFile17, readdir as readdir7, rm as rm3 } from "node:fs/promises";
 import { join as join16, resolve as resolve16 } from "node:path";
-import { z as z17 } from "zod";
-var runIdSchema = z17.string().uuid();
-var hashSchema = z17.string().regex(/^[a-f0-9]{64}$/u);
-var artifactSchema2 = z17.object({
+import { z as z18 } from "zod";
+var runIdSchema = z18.string().uuid();
+var hashSchema = z18.string().regex(/^[a-f0-9]{64}$/u);
+var artifactSchema2 = z18.object({
   sha256: hashSchema,
-  bytes: z17.number().int().nonnegative().max(5e5)
+  bytes: z18.number().int().nonnegative().max(5e5)
 }).strict();
-var phaseSchema = z17.enum(["work", "review", "revision", "write"]);
-var agentRecordSchema = z17.object({
-  id: z17.string().uuid(),
-  profile: z17.string(),
-  provider: z17.string(),
-  model: z17.string(),
+var phaseSchema = z18.enum(["work", "review", "revision", "write"]);
+var agentRecordSchema = z18.object({
+  id: z18.string().uuid(),
+  profile: z18.string(),
+  provider: z18.string(),
+  model: z18.string(),
   phase: phaseSchema,
-  ok: z17.boolean(),
-  createdAt: z17.string(),
-  startedAt: z17.string().optional(),
-  endedAt: z17.string().optional(),
-  durationMs: z17.number().int().nonnegative().optional(),
-  toolCalls: z17.number().int().nonnegative().optional(),
-  usage: z17.object({
-    inputTokens: z17.number().int().nonnegative(),
-    outputTokens: z17.number().int().nonnegative()
+  ok: z18.boolean(),
+  createdAt: z18.string(),
+  startedAt: z18.string().optional(),
+  endedAt: z18.string().optional(),
+  durationMs: z18.number().int().nonnegative().optional(),
+  toolCalls: z18.number().int().nonnegative().optional(),
+  usage: z18.object({
+    inputTokens: z18.number().int().nonnegative(),
+    outputTokens: z18.number().int().nonnegative()
   }).strict().optional(),
   report: artifactSchema2
 }).strict();
-var messageRecordSchema = z17.object({
-  id: z17.string().uuid(),
-  from: z17.string(),
-  to: z17.string(),
-  createdAt: z17.string(),
+var messageRecordSchema = z18.object({
+  id: z18.string().uuid(),
+  from: z18.string(),
+  to: z18.string(),
+  createdAt: z18.string(),
   content: artifactSchema2
 }).strict();
-var writerIntegrationSchema = z17.object({
-  status: z17.enum(["ready", "conflict", "integrated"]),
-  checkedAt: z17.string(),
-  detail: z17.string().max(2e4),
-  checkpoint: z17.object({
-    sessionId: z17.string(),
-    checkpointId: z17.string()
+var writerIntegrationSchema = z18.object({
+  status: z18.enum(["ready", "conflict", "integrated"]),
+  checkedAt: z18.string(),
+  detail: z18.string().max(2e4),
+  checkpoint: z18.object({
+    sessionId: z18.string(),
+    checkpointId: z18.string()
   }).strict().optional(),
-  integratedAt: z17.string().optional()
+  integratedAt: z18.string().optional()
 }).strict();
-var writerLaneSchema = z17.object({
-  profile: z17.string(),
-  reviewer: z17.string(),
-  baseCommit: z17.string().regex(/^[a-f0-9]{40,64}$/u),
-  outcome: z17.enum(["accepted", "rejected", "failed", "cancelled"]),
+var writerLaneSchema = z18.object({
+  profile: z18.string(),
+  reviewer: z18.string(),
+  baseCommit: z18.string().regex(/^[a-f0-9]{40,64}$/u),
+  outcome: z18.enum(["accepted", "rejected", "failed", "cancelled"]),
   patch: artifactSchema2,
-  files: z17.array(z17.string().min(1).max(4e3)).max(2e3),
-  worktreeCleaned: z17.boolean(),
+  files: z18.array(z18.string().min(1).max(4e3)).max(2e3),
+  worktreeCleaned: z18.boolean(),
   review: artifactSchema2.optional(),
   integration: writerIntegrationSchema.optional()
 }).strict();
 var manifestFields = {
   id: runIdSchema,
-  workspace: z17.string(),
-  objective: z17.string().max(3e4),
-  reviewer: z17.string(),
-  createdAt: z17.string(),
-  updatedAt: z17.string(),
-  status: z17.enum(["running", "accepted", "rejected", "failed"]),
-  maxReviewRounds: z17.number().int().min(0).max(3),
-  reviewRounds: z17.number().int().min(0).max(3),
-  agents: z17.array(agentRecordSchema).max(256),
-  messages: z17.array(messageRecordSchema).max(512)
+  workspace: z18.string(),
+  objective: z18.string().max(3e4),
+  reviewer: z18.string(),
+  createdAt: z18.string(),
+  updatedAt: z18.string(),
+  status: z18.enum(["running", "accepted", "rejected", "failed"]),
+  maxReviewRounds: z18.number().int().min(0).max(3),
+  reviewRounds: z18.number().int().min(0).max(3),
+  agents: z18.array(agentRecordSchema).max(256),
+  messages: z18.array(messageRecordSchema).max(512)
 };
-var manifestV1Schema = z17.object({
-  version: z17.literal(1),
+var manifestV1Schema = z18.object({
+  version: z18.literal(1),
   ...manifestFields
 }).strict();
-var manifestV2Schema = z17.object({
-  version: z17.literal(2),
+var manifestV2Schema = z18.object({
+  version: z18.literal(2),
   ...manifestFields,
   writer: writerLaneSchema.optional()
 }).strict();
-var manifestSchema2 = z17.discriminatedUnion("version", [manifestV1Schema, manifestV2Schema]);
+var manifestSchema2 = z18.discriminatedUnion("version", [manifestV1Schema, manifestV2Schema]);
 var TeamRunStore = class {
   workspace;
   directory;
@@ -11405,7 +11626,7 @@ var TeamRunStore = class {
   async writeArtifact(runId, content, truncate = true) {
     const data = boundedArtifactText(content, 5e5, truncate);
     const bytes = Buffer.byteLength(data);
-    const sha256 = createHash14("sha256").update(data).digest("hex");
+    const sha256 = createHash15("sha256").update(data).digest("hex");
     const directory = join16(this.runDirectory(runId), "blobs");
     await ensureWorkspaceStorageDirectory(this.workspace, directory, {
       requireActiveNamespace: this.managedDirectory
@@ -11414,7 +11635,7 @@ var TeamRunStore = class {
     try {
       await this.assertRegularFile(path);
       const existing = await readFile17(path);
-      if (createHash14("sha256").update(existing).digest("hex") !== sha256) {
+      if (createHash15("sha256").update(existing).digest("hex") !== sha256) {
         throw new Error(`Team artifact hash collision or corruption: ${sha256}`);
       }
     } catch (error) {
@@ -11435,7 +11656,7 @@ var TeamRunStore = class {
     const path = this.artifactPath(runId, artifact.sha256);
     await this.assertRegularFile(path);
     const data = await readFile17(path);
-    const hash4 = createHash14("sha256").update(data).digest("hex");
+    const hash4 = createHash15("sha256").update(data).digest("hex");
     if (hash4 !== artifact.sha256 || data.byteLength !== artifact.bytes) {
       throw new Error(`Team artifact integrity check failed: ${artifact.sha256}`);
     }
@@ -11498,7 +11719,7 @@ function resolveAgentModelRoute(team, parent, profile) {
 }
 
 // src/agent/writer-lane.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 import { lstat as lstat19, mkdtemp, realpath as realpath7, rm as rm4 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { isAbsolute as isAbsolute6, join as join17, resolve as resolve17 } from "node:path";
@@ -11596,7 +11817,7 @@ var WriterLane = class {
     return {
       baseCommit,
       patch,
-      patchSha256: createHash15("sha256").update(patch).digest("hex"),
+      patchSha256: createHash16("sha256").update(patch).digest("hex"),
       files,
       worktreeCleaned,
       value
@@ -11826,14 +12047,14 @@ async function pathExists2(path) {
 }
 
 // src/agent/delegation.ts
-var writerRunInputSchema = z18.object({
-  task: z18.string().min(1).max(2e4),
-  profile: z18.string().max(64).optional(),
-  reviewer: z18.string().max(64).optional()
+var writerRunInputSchema = z19.object({
+  task: z19.string().min(1).max(2e4),
+  profile: z19.string().max(64).optional(),
+  reviewer: z19.string().max(64).optional()
 }).strict();
-var writerIntegrateInputSchema = z18.object({
-  run_id: z18.string().uuid(),
-  patch_sha256: z18.string().regex(/^[a-f0-9]{64}$/u)
+var writerIntegrateInputSchema = z19.object({
+  run_id: z19.string().uuid(),
+  patch_sha256: z19.string().regex(/^[a-f0-9]{64}$/u)
 }).strict();
 var DelegationManager = class {
   constructor(options) {
@@ -11894,10 +12115,10 @@ var DelegationManager = class {
       },
       async execute(arguments_, context) {
         if (!manager.team.enabled) return { ok: false, content: "Multi-agent delegation is disabled." };
-        const input2 = z18.object({
-          tasks: z18.array(z18.object({
-            profile: z18.string().max(64).optional(),
-            task: z18.string().min(1).max(2e4)
+        const input2 = z19.object({
+          tasks: z19.array(z19.object({
+            profile: z19.string().max(64).optional(),
+            task: z19.string().min(1).max(2e4)
           })).min(1).max(manager.team.maxDelegations)
         }).parse(arguments_);
         const tasks = input2.tasks.map((task) => ({
@@ -11943,13 +12164,13 @@ var DelegationManager = class {
       },
       async execute(arguments_, context) {
         if (!manager.team.enabled) return { ok: false, content: "Multi-agent teams are disabled." };
-        const input2 = z18.object({
-          objective: z18.string().min(1).max(3e4),
-          tasks: z18.array(z18.object({
-            profile: z18.string().max(64).optional(),
-            task: z18.string().min(1).max(2e4)
+        const input2 = z19.object({
+          objective: z19.string().min(1).max(3e4),
+          tasks: z19.array(z19.object({
+            profile: z19.string().max(64).optional(),
+            task: z19.string().min(1).max(2e4)
           })).min(1).max(manager.team.maxDelegations),
-          reviewer: z18.string().max(64).optional()
+          reviewer: z19.string().max(64).optional()
         }).parse(arguments_);
         const tasks = input2.tasks.map((task) => ({
           profile: task.profile ?? manager.team.defaultProfile,
@@ -13597,22 +13818,24 @@ ${this.glyphs.meta} ${session.changedFiles.length} changed files ${this.glyphs.s
     if (!completion || completion.status === "no_changes") return;
     const checks = completion.checks.map((check) => check.command).join(", ");
     const suffix = checks ? ` ${this.glyphs.separator} ${checks}` : "";
+    const duplication = completion.duplication;
+    const duplicateSuffix = duplication ? ` ${this.glyphs.separator} duplication ${duplication.status} (${duplication.warningCount} warning, ${duplication.unresolvedCount} incomplete, ${duplication.suppressedCount} suppressed)` : "";
     if (completion.status === "verified") {
       process.stderr.write(this.paint.green(
-        `${this.glyphs.success} verified ${this.glyphs.separator} ${completion.detail}${suffix}
+        `${this.glyphs.success} verified ${this.glyphs.separator} ${completion.detail}${suffix}${duplicateSuffix}
 `
       ));
       return;
     }
     if (completion.status === "verification_failed") {
       process.stderr.write(this.paint.red(
-        `${this.glyphs.error} verification failed ${this.glyphs.separator} ${completion.detail}${suffix}
+        `${this.glyphs.error} verification failed ${this.glyphs.separator} ${completion.detail}${suffix}${duplicateSuffix}
 `
       ));
       return;
     }
     process.stderr.write(this.paint.yellow(
-      `${this.glyphs.warning} unverified ${this.glyphs.separator} ${completion.detail}
+      `${this.glyphs.warning} unverified ${this.glyphs.separator} ${completion.detail}${duplicateSuffix}
 `
     ));
   }
@@ -16231,6 +16454,11 @@ function toolMetaSummary(metadata) {
     if (status === "warning") parts.push(`duplicates ${matches} (warning)`);
     else if (status === "unresolved") parts.push("duplicates incomplete");
   }
+  const suppression = metadata.duplicationSuppression;
+  if (suppression && typeof suppression === "object") {
+    const matchId2 = suppression.matchId;
+    if (typeof matchId2 === "string") parts.push(`duplicate ${matchId2.slice(0, 8)} suppressed`);
+  }
   const hooks = metadata.hooks;
   if (hooks && typeof hooks === "object") {
     const before = Number(hooks.before ?? 0);
@@ -16690,12 +16918,14 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
         refreshSession();
         if (event.completion && event.completion.status !== "no_changes") {
           const checks = event.completion.checks.map((check) => check.command).join(` ${separator} `);
+          const duplication = event.completion.duplication;
+          const duplicateDetail = duplication ? `${separator} duplication ${duplication.status} (${duplication.warningCount} warning, ${duplication.unresolvedCount} incomplete, ${duplication.suppressedCount} suppressed)` : "";
           append({
             id: nextId(),
             kind: "notice",
             wrapWidth: contentWidth,
             tone: event.completion.status === "verified" ? "success" : event.completion.status === "unverified" ? "warning" : "error",
-            text: event.completion.status === "verified" ? `Verified${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}` : event.completion.status === "verification_failed" ? `Verification failed${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}` : `Unverified${separator}${event.completion.detail}`
+            text: event.completion.status === "verified" ? `Verified${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}${duplicateDetail}` : event.completion.status === "verification_failed" ? `Verification failed${separator}${event.completion.detail}${checks ? `${separator}${checks}` : ""}${duplicateDetail}` : `Unverified${separator}${event.completion.detail}${duplicateDetail}`
           });
         }
         if (event.reason !== "completed" && event.reason !== "unverified" && event.reason !== "verification_failed") {
@@ -18717,7 +18947,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import stripAnsi5 from "strip-ansi";
 
 // src/mcp/tool.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import stripAnsi4 from "strip-ansi";
 var MAX_ARGUMENT_BYTES = 256e3;
 var MAX_DESCRIPTION_LENGTH = 4e3;
@@ -18725,7 +18955,7 @@ var MAX_RESULT_BYTES = 5 * 1024 * 1024;
 var MAX_SCHEMA_BYTES = 1e5;
 function createMcpToolAdapter(options) {
   const { remoteTool } = options;
-  const inputSchema12 = copyInputSchema(remoteTool.inputSchema);
+  const inputSchema13 = copyInputSchema(remoteTool.inputSchema);
   return {
     definition: {
       name: options.exposedName,
@@ -18733,7 +18963,7 @@ function createMcpToolAdapter(options) {
       // MCP servers are an external trust boundary. Read-only annotations are
       // hints from that server and must not lower the local permission level.
       category: "network",
-      inputSchema: inputSchema12
+      inputSchema: inputSchema13
     },
     permissionCategories: () => ["network"],
     async execute(arguments_, context) {
@@ -18887,7 +19117,7 @@ function fitToolName(name, identity2) {
   return `${name.slice(0, 64 - suffix.length).replace(/_+$/g, "")}${suffix}`;
 }
 function shortHash(value) {
-  return createHash16("sha256").update(value).digest("hex").slice(0, 8);
+  return createHash17("sha256").update(value).digest("hex").slice(0, 8);
 }
 function sanitizeOutputText(value) {
   return stripAnsi4(value).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "");
@@ -19517,9 +19747,9 @@ async function closeTransportQuietly(transport) {
 }
 
 // src/memory/tools.ts
-import { z as z19 } from "zod";
-var scopeSchema = z19.enum(["user", "workspace", "session", "agent"]);
-var kindSchema = z19.enum(["semantic", "episodic", "procedural"]);
+import { z as z20 } from "zod";
+var scopeSchema = z20.enum(["user", "workspace", "session", "agent"]);
+var kindSchema = z20.enum(["semantic", "episodic", "procedural"]);
 function createMemoryTools(store) {
   return [
     {
@@ -19534,10 +19764,10 @@ function createMemoryTools(store) {
         }, ["query"])
       },
       async execute(arguments_, context) {
-        const input2 = z19.object({
-          query: z19.string().max(4e3),
+        const input2 = z20.object({
+          query: z20.string().max(4e3),
           scope: scopeSchema.optional(),
-          limit: z19.number().int().min(1).max(20).optional()
+          limit: z20.number().int().min(1).max(20).optional()
         }).parse(arguments_);
         const scopes = input2.scope ? [{ scope: input2.scope, scopeKey: scopeKey(input2.scope, context) }] : availableScopes(context);
         const records = store.search(input2.query, { scopes, limit: input2.limit ?? 8 });
@@ -19569,17 +19799,17 @@ ${record.content}`
         }, ["content", "rationale"])
       },
       async execute(arguments_, context) {
-        const input2 = z19.object({
-          content: z19.string().min(1).max(12e3),
-          rationale: z19.string().min(1).max(1e3),
+        const input2 = z20.object({
+          content: z20.string().min(1).max(12e3),
+          rationale: z20.string().min(1).max(1e3),
           scope: scopeSchema.optional(),
           kind: kindSchema.optional(),
-          tags: z19.array(z19.string()).max(24).optional(),
-          importance: z19.number().min(0).max(1).optional(),
-          confidence: z19.number().min(0).max(1).optional(),
-          agent: z19.string().max(64).optional(),
-          revision: z19.string().max(240).optional(),
-          conflictKey: z19.string().max(240).optional()
+          tags: z20.array(z20.string()).max(24).optional(),
+          importance: z20.number().min(0).max(1).optional(),
+          confidence: z20.number().min(0).max(1).optional(),
+          agent: z20.string().max(64).optional(),
+          revision: z20.string().max(240).optional(),
+          conflictKey: z20.string().max(240).optional()
         }).strict().parse(arguments_);
         const scope = input2.scope ?? "workspace";
         const candidate = store.propose({
@@ -19617,9 +19847,9 @@ ${record.content}`
         }, ["id"])
       },
       async execute(arguments_) {
-        const input2 = z19.object({
-          id: z19.string().uuid(),
-          permanent: z19.boolean().optional()
+        const input2 = z20.object({
+          id: z20.string().uuid(),
+          permanent: z20.boolean().optional()
         }).parse(arguments_);
         const changed = input2.permanent ? store.remove(input2.id) : store.archive(input2.id);
         return {
@@ -19823,7 +20053,7 @@ function escapeAttribute6(value) {
 }
 
 // src/workflows/catalog.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var builtInWorkflows = [
   {
     name: "implement",
@@ -19914,7 +20144,7 @@ function createWorkflowTool(catalog) {
       }, ["name", "task"])
     },
     async execute(arguments_) {
-      const input2 = z20.object({ name: z20.string(), task: z20.string().min(1).max(2e4) }).parse(arguments_);
+      const input2 = z21.object({ name: z21.string(), task: z21.string().min(1).max(2e4) }).parse(arguments_);
       const workflow = catalog.get(input2.name);
       if (!workflow) return { ok: false, content: `Unknown workflow: ${input2.name}` };
       return {