@skein-code/cli 0.3.19 → 0.3.21

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { createInterface as createInterface2 } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename13, resolve as resolve23 } from "node:path";
+import { basename as basename13, resolve as resolve25 } from "node:path";
 import { Command, Option } from "commander";
 import chalk4 from "chalk";
 
@@ -220,7 +220,7 @@ function isSqliteBusy(error) {
 // package.json
 var package_default = {
   name: "@skein-code/cli",
-  version: "0.3.19",
+  version: "0.3.21",
   description: "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   type: "module",
   license: "MIT",
@@ -236,6 +236,10 @@ var package_default = {
   },
   skein: {
     releaseNotes: [
+      "Failed configured verification output yields bounded current-run diagnostic ranking without persisting paths",
+      "Diagnostic hints cannot create zero-relevance hits and are cleared on success or the next agent run",
+      "Python absolute and relative module imports now contribute deterministic offline graph adjacency",
+      "Context provenance exposes the diagnostic score alongside graph and isolated Git recency signals",
       "Local index v3 records TypeScript AST definitions, calls, and relative import adjacency for graph-assisted retrieval",
       "Context hits expose generation, content hash, matched terms, and bm25/path/symbol/phrase/graph score provenance",
       "Context benchmark v2 locks multilingual recall, MRR, useful-token, stale-hit, incremental-index, and warm-latency gates",
@@ -256,7 +260,8 @@ var package_default = {
       "Prompt and timeline diagnostics expose the repository-first reuse ladder without blocking legitimate writes",
       "Known tool changes refresh only their affected local-index paths before the next model turn",
       "File ctime closes same-size and restored-mtime zero-hit freshness gaps without full-content scans",
-      "Repeated empty or unchanged search calls stop through the existing recovery circuit"
+      "Repeated empty or unchanged search calls stop through the existing recovery circuit",
+      "Git recency is an isolated, bounded tie-break with exact HEAD-bound cache invalidation and non-Git degradation"
     ]
   },
   bin: {
@@ -2611,9 +2616,9 @@ function countExplicitPaths(value) {
 }
 
 // src/context/local-index.ts
-import { createHash as createHash6 } from "node:crypto";
-import { lstat as lstat8, readFile as readFile3, stat as stat3 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute3, join as join7, posix, relative as relative5, resolve as resolve8, sep as sep4 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { lstat as lstat9, readFile as readFile3, stat as stat3 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute4, join as join8, posix, relative as relative5, resolve as resolve10, sep as sep4 } from "node:path";
 import fg from "fast-glob";
 import ts from "typescript";
 import { z as z3 } from "zod";
@@ -3046,6 +3051,371 @@ function hash(value) {
   return createHash5("sha256").update(value).digest("hex");
 }
 
+// src/context/git-recency.ts
+import { createHash as createHash6 } from "node:crypto";
+import { resolve as resolve9 } from "node:path";
+
+// src/utils/process.ts
+import { spawn } from "node:child_process";
+import { constants as constants3 } from "node:fs";
+import { access as access2, lstat as lstat8, realpath as realpath6 } from "node:fs/promises";
+import { delimiter, isAbsolute as isAbsolute3, join as join7, resolve as resolve8 } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+async function resolveExecutableRuntime(command2, cwd, excludedRoots = []) {
+  const realRoots = await Promise.all(excludedRoots.map(async (root) => {
+    try {
+      return await realpath6(root);
+    } catch {
+      return resolve8(root);
+    }
+  }));
+  const pathEntries = (process.env.PATH ?? process.env.Path ?? "").split(delimiter).filter(Boolean);
+  const safeDirectories2 = [];
+  let executable2;
+  const explicit = isAbsolute3(command2) || command2.includes("/") || command2.includes("\\");
+  const explicitPath = explicit ? resolve8(cwd, command2) : void 0;
+  for (const entry of pathEntries) {
+    let directory;
+    try {
+      directory = await realpath6(resolve8(cwd, entry));
+      if (!(await lstat8(directory)).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    if (realRoots.some((root) => isInside(root, directory))) continue;
+    let contaminated = false;
+    if (!explicit) {
+      for (const name of executableNames(command2)) {
+        const candidate = join7(directory, name);
+        const resolvedCandidate = await usableExecutable(candidate);
+        if (!resolvedCandidate) continue;
+        if (realRoots.some((root) => isInside(root, resolvedCandidate))) {
+          contaminated = true;
+          continue;
+        }
+        executable2 ??= resolvedCandidate;
+      }
+    }
+    if (!contaminated && !safeDirectories2.includes(directory)) safeDirectories2.push(directory);
+  }
+  if (explicitPath) executable2 = await usableExecutable(explicitPath);
+  if (!executable2) return void 0;
+  return { executable: executable2, path: safeDirectories2.join(delimiter) };
+}
+async function usableExecutable(candidate) {
+  try {
+    await access2(candidate, process.platform === "win32" ? constants3.F_OK : constants3.X_OK);
+    const resolvedCandidate = await realpath6(candidate);
+    return (await lstat8(resolvedCandidate)).isFile() ? resolvedCandidate : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function executableNames(command2) {
+  if (process.platform !== "win32") return [command2];
+  const extensions = (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean);
+  return [command2, ...extensions.map((extension) => `${command2}${extension}`)];
+}
+function runProcess(command2, args, options) {
+  return new Promise((resolve26, reject) => {
+    const started = Date.now();
+    const environment = options.inheritEnv === false ? {} : { ...process.env };
+    for (const name of options.unsetEnv ?? []) delete environment[name];
+    for (const name of Object.keys(environment)) {
+      if (options.unsetEnvPrefixes?.some((prefix) => name.startsWith(prefix))) {
+        delete environment[name];
+      }
+    }
+    Object.assign(environment, options.env);
+    const child = spawn(command2, args, {
+      cwd: options.cwd,
+      env: environment,
+      stdio: ["pipe", "pipe", "pipe"],
+      signal: options.signal
+    });
+    const maxBytes = options.maxOutputBytes ?? 1e6;
+    let stdout = "";
+    let stderr = "";
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let stdoutObservedBytes = 0;
+    let stderrObservedBytes = 0;
+    let timedOut = false;
+    let outputLimitReached = false;
+    let callbackError;
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
+    const stdoutCallbackDecoder = new StringDecoder("utf8");
+    const stderrCallbackDecoder = new StringDecoder("utf8");
+    const append = (decoder, chunk, usedBytes) => {
+      if (usedBytes >= maxBytes) return { text: "", usedBytes };
+      const selected = chunk.subarray(0, maxBytes - usedBytes);
+      return { text: decoder.write(selected), usedBytes: usedBytes + selected.length };
+    };
+    const notify = (callback, decoder, chunk) => {
+      if (!callback || callbackError) return;
+      try {
+        const decoded = decoder.write(chunk);
+        if (decoded) callback(decoded);
+      } catch (error) {
+        callbackError = error;
+        child.kill("SIGTERM");
+      }
+    };
+    child.stdout.on("data", (chunk) => {
+      stdoutObservedBytes += chunk.length;
+      if (options.stopOnOutputLimit && stdoutObservedBytes > maxBytes && !outputLimitReached) {
+        outputLimitReached = true;
+        child.kill("SIGTERM");
+      }
+      const appended = append(stdoutDecoder, chunk, stdoutBytes);
+      stdout += appended.text;
+      stdoutBytes = appended.usedBytes;
+      notify(options.onStdout, stdoutCallbackDecoder, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderrObservedBytes += chunk.length;
+      if (options.stopOnOutputLimit && stderrObservedBytes > maxBytes && !outputLimitReached) {
+        outputLimitReached = true;
+        child.kill("SIGTERM");
+      }
+      const appended = append(stderrDecoder, chunk, stderrBytes);
+      stderr += appended.text;
+      stderrBytes = appended.usedBytes;
+      notify(options.onStderr, stderrCallbackDecoder, chunk);
+    });
+    child.on("error", reject);
+    const timeoutMs = options.timeoutMs ?? 12e4;
+    const timeout = timeoutMs > 0 ? setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
+    }, timeoutMs) : void 0;
+    child.on("close", (code) => {
+      if (timeout) clearTimeout(timeout);
+      const stdoutTail = stdoutDecoder.end();
+      const stderrTail = stderrDecoder.end();
+      if (Buffer.byteLength(stdout) + Buffer.byteLength(stdoutTail) <= maxBytes) stdout += stdoutTail;
+      if (Buffer.byteLength(stderr) + Buffer.byteLength(stderrTail) <= maxBytes) stderr += stderrTail;
+      try {
+        const stdoutCallbackTail = stdoutCallbackDecoder.end();
+        const stderrCallbackTail = stderrCallbackDecoder.end();
+        if (stdoutCallbackTail && options.onStdout && !callbackError) options.onStdout(stdoutCallbackTail);
+        if (stderrCallbackTail && options.onStderr && !callbackError) options.onStderr(stderrCallbackTail);
+      } catch (error) {
+        callbackError = error;
+      }
+      if (callbackError) {
+        reject(callbackError);
+        return;
+      }
+      resolve26({
+        command: [command2, ...args].join(" "),
+        exitCode: code ?? (timedOut ? 124 : 1),
+        stdout,
+        stderr,
+        timedOut,
+        durationMs: Date.now() - started,
+        stdoutBytes: stdoutObservedBytes,
+        stderrBytes: stderrObservedBytes,
+        stdoutTruncated: stdoutObservedBytes > stdoutBytes,
+        stderrTruncated: stderrObservedBytes > stderrBytes
+      });
+    });
+    if (options.stdin) child.stdin.end(options.stdin);
+    else child.stdin.end();
+  });
+}
+function runShell(command2, cwd, options = {}) {
+  const shell = process.platform === "win32" ? process.env.COMSPEC ?? "cmd.exe" : process.env.SHELL ?? "/bin/sh";
+  const args = process.platform === "win32" ? ["/d", "/s", "/c", command2] : ["-lc", command2];
+  return runProcess(shell, args, { ...options, cwd });
+}
+
+// src/utils/git.ts
+var unsafeInheritedGitEnvironment = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_COMMON_DIR",
+  "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_NAMESPACE",
+  "GIT_CEILING_DIRECTORIES",
+  "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+  "GIT_EXTERNAL_DIFF",
+  "GIT_DIFF_OPTS",
+  "GIT_SSH",
+  "GIT_SSH_COMMAND",
+  "GIT_PROXY_COMMAND",
+  "GIT_ASKPASS",
+  "SSH_ASKPASS",
+  "GIT_EXEC_PATH",
+  "GIT_TEMPLATE_DIR",
+  "GIT_CONFIG",
+  "GIT_CONFIG_PARAMETERS",
+  "GIT_QUARANTINE_PATH",
+  "Path"
+];
+var isolatedGitEnvironment = {
+  GIT_TERMINAL_PROMPT: "0",
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_CONFIG_GLOBAL: "/dev/null",
+  GIT_CONFIG_SYSTEM: "/dev/null",
+  GIT_NO_REPLACE_OBJECTS: "1",
+  GIT_PAGER: "cat",
+  GIT_EDITOR: "true",
+  GIT_SEQUENCE_EDITOR: "true",
+  GIT_CONFIG_COUNT: "4",
+  GIT_CONFIG_KEY_0: "core.hooksPath",
+  GIT_CONFIG_VALUE_0: "/dev/null",
+  GIT_CONFIG_KEY_1: "core.fsmonitor",
+  GIT_CONFIG_VALUE_1: "false",
+  GIT_CONFIG_KEY_2: "credential.helper",
+  GIT_CONFIG_VALUE_2: "",
+  GIT_CONFIG_KEY_3: "protocol.ext.allow",
+  GIT_CONFIG_VALUE_3: "never"
+};
+function runIsolatedGit(runtime, args, cwd, options = {}) {
+  return runProcess(runtime.executable, args, {
+    cwd,
+    timeoutMs: options.timeoutMs ?? 15e3,
+    maxOutputBytes: options.maxOutputBytes ?? 2e6,
+    ...options.stopOnOutputLimit !== void 0 ? { stopOnOutputLimit: options.stopOnOutputLimit } : {},
+    env: { ...isolatedGitEnvironment, PATH: runtime.path },
+    unsetEnv: unsafeInheritedGitEnvironment,
+    unsetEnvPrefixes: ["GIT_"],
+    ...options.stdin !== void 0 ? { stdin: options.stdin } : {},
+    ...options.signal ? { signal: options.signal } : {}
+  });
+}
+
+// src/context/git-recency.ts
+var MAX_COMMITS = 128;
+var MAX_OUTPUT_BYTES = 1e6;
+var TIMEOUT_MS = 2e3;
+var MAX_RECENCY_SCORE = 1e-3;
+var commitHashPattern = /^(?:[a-f\d]{40}|[a-f\d]{64})$/u;
+var GitRecencyCollector = class {
+  roots;
+  states = /* @__PURE__ */ new Map();
+  constructor(roots) {
+    this.roots = roots.map((root) => resolve9(root));
+  }
+  async collect() {
+    const snapshots = await Promise.all(this.roots.map((root) => this.collectRoot(root)));
+    const scores = /* @__PURE__ */ new Map();
+    for (const snapshot of snapshots) {
+      for (const [path, score] of snapshot.scores) {
+        scores.set(path, Math.max(score, scores.get(path) ?? 0));
+      }
+    }
+    return {
+      generation: digest(snapshots.map(({ root, generation }) => `${root}\0${generation}`).join("\n")),
+      scores
+    };
+  }
+  async collectRoot(root) {
+    const state = this.states.get(root) ?? {
+      runtime: void 0,
+      runtimeResolved: false,
+      head: void 0,
+      snapshot: void 0
+    };
+    this.states.set(root, state);
+    try {
+      if (!state.runtimeResolved) {
+        state.runtime = await resolveExecutableRuntime("git", root, this.roots);
+        state.runtimeResolved = true;
+      }
+      if (!state.runtime) return unavailableSnapshot(root, "missing");
+      const headResult = await runIsolatedGit(
+        state.runtime,
+        ["rev-parse", "--verify", "HEAD"],
+        root,
+        { timeoutMs: TIMEOUT_MS, maxOutputBytes: 256, stopOnOutputLimit: true }
+      );
+      const head = headResult.stdout.trim();
+      if (headResult.exitCode !== 0 || headResult.timedOut || headResult.stdoutTruncated || headResult.stderrTruncated || !commitHashPattern.test(head)) {
+        state.head = void 0;
+        state.snapshot = unavailableSnapshot(root, "no-head");
+        return state.snapshot;
+      }
+      if (state.head === head && state.snapshot) return state.snapshot;
+      state.head = head;
+      state.snapshot = await collectRootGitLog(root, state.runtime);
+      return state.snapshot;
+    } catch {
+      state.head = void 0;
+      state.snapshot = unavailableSnapshot(root, "error");
+      return state.snapshot;
+    }
+  }
+};
+async function collectRootGitLog(root, runtime) {
+  try {
+    const result = await runIsolatedGit(runtime, [
+      "--no-pager",
+      "log",
+      "--topo-order",
+      `--max-count=${MAX_COMMITS}`,
+      "--format=%x00%H",
+      "--name-only",
+      "-z",
+      "--no-renames",
+      "--no-ext-diff",
+      "--no-textconv",
+      "--relative",
+      "--",
+      "."
+    ], root, {
+      timeoutMs: TIMEOUT_MS,
+      maxOutputBytes: MAX_OUTPUT_BYTES,
+      stopOnOutputLimit: true
+    });
+    if (result.exitCode !== 0 || result.timedOut || result.stdoutTruncated || result.stderrTruncated) {
+      const reason = result.timedOut ? "timeout" : result.stdoutTruncated || result.stderrTruncated ? "output-limit" : `exit-${result.exitCode}`;
+      return unavailableSnapshot(root, reason);
+    }
+    return {
+      root,
+      generation: digest(result.stdout),
+      scores: parseGitLog(root, result.stdout)
+    };
+  } catch {
+    return unavailableSnapshot(root, "error");
+  }
+}
+function parseGitLog(root, output2) {
+  const scores = /* @__PURE__ */ new Map();
+  const records = output2.split("\0");
+  let commitRank = -1;
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index] ?? "";
+    if (!record) {
+      const commit = records[index + 1]?.trim() ?? "";
+      if (commitHashPattern.test(commit)) {
+        commitRank += 1;
+        index += 1;
+      }
+      continue;
+    }
+    if (commitRank < 0) continue;
+    const path = record.startsWith("\n") ? record.slice(1) : record;
+    if (!path) continue;
+    const absolutePath = resolve9(root, path);
+    if (!isInside(root, absolutePath) || scores.has(absolutePath)) continue;
+    scores.set(absolutePath, MAX_RECENCY_SCORE / (commitRank + 1));
+  }
+  return scores;
+}
+function unavailableSnapshot(root, reason) {
+  return { root, generation: digest(`unavailable\0${reason}`), scores: /* @__PURE__ */ new Map() };
+}
+function digest(value) {
+  return createHash6("sha256").update(value, "utf8").digest("hex").slice(0, 16);
+}
+
 // src/context/local-index.ts
 var contentHashSchema = z3.string().regex(/^[a-f\d]{64}$/u);
 var indexedChunkSchema = z3.object({
@@ -3108,17 +3478,23 @@ var MAX_QUERY_CACHE_ENTRIES = 64;
 var CHUNK_LINES = 100;
 var CHUNK_OVERLAP = 15;
 var MIN_STRUCTURAL_CHUNK_LINES = 12;
+var MAX_DIAGNOSTIC_SCORE = 0.05;
+var MAX_DIAGNOSTIC_HINTS_PER_COMMAND = 16;
 var LocalContextIndex = class {
   constructor(roots) {
     this.roots = roots;
-    this.roots = roots.map((root) => resolve8(root));
+    this.roots = roots.map((root) => resolve10(root));
     this.workspace = new WorkspaceAccess(this.roots);
-    this.indexPath = join7(resolveProjectNamespaceSync(this.roots[0] ?? process.cwd()).active, "index.json");
+    this.gitRecency = new GitRecencyCollector(this.roots);
+    this.indexPath = join8(resolveProjectNamespaceSync(this.roots[0] ?? process.cwd()).active, "index.json");
   }
   roots;
   index;
   workspace;
   queryCache = /* @__PURE__ */ new Map();
+  gitRecency;
+  diagnosticsByCommand = /* @__PURE__ */ new Map();
+  diagnosticScores = /* @__PURE__ */ new Map();
   queryCacheHits = 0;
   queryCacheMisses = 0;
   fingerprintCache;
@@ -3132,13 +3508,13 @@ var LocalContextIndex = class {
         this.roots[0] ?? process.cwd(),
         dirname7(this.indexPath)
       );
-      const info = await lstat8(this.indexPath);
+      const info = await lstat9(this.indexPath);
       if (!info.isFile() || info.isSymbolicLink()) return false;
       const parsed = localIndexSchema.parse(JSON.parse(await readFile3(this.indexPath, "utf8")));
       const files = [];
       for (const file of parsed.files) {
         try {
-          if (!this.roots.includes(file.root) || resolve8(file.root, file.path) !== file.absolutePath) continue;
+          if (!this.roots.includes(file.root) || resolve10(file.root, file.path) !== file.absolutePath) continue;
           const safe = await this.workspace.resolvePath(file.absolutePath, { expect: "file" });
           if (safe !== file.absolutePath) continue;
           const { ctimeMs, ...persistedFile } = file;
@@ -3215,19 +3591,21 @@ var LocalContextIndex = class {
     await this.flushDirty();
     await this.ensureCurrentIndex();
     const limit = Math.max(1, Math.floor(topK));
-    const cached = this.getCachedHits(query, limit);
-    let hits = cached ?? this.rank(query, limit);
+    let recency = await this.gitRecency.collect();
+    const cached = this.getCachedHits(query, limit, recency.generation);
+    let hits = cached ?? this.rank(query, limit, recency.scores);
     if (!await this.hitsAreCurrent(hits)) {
       await this.buildWithOptions(void 0, true);
-      hits = this.rank(query, limit);
+      recency = await this.gitRecency.collect();
+      hits = this.rank(query, limit, recency.scores);
       if (!await this.hitsAreCurrent(hits)) return [];
     }
-    this.cacheHits(query, limit, hits);
+    this.cacheHits(query, limit, recency.generation, hits);
     return cloneHits(hits);
   }
   invalidate(paths) {
     for (const path of paths) {
-      const absolutePath = isAbsolute3(path) ? resolve8(path) : resolve8(this.roots[0] ?? process.cwd(), path);
+      const absolutePath = isAbsolute4(path) ? resolve10(path) : resolve10(this.roots[0] ?? process.cwd(), path);
       if (this.roots.some((root) => isWithinRoot(root, absolutePath))) {
         this.dirtyPaths.add(absolutePath);
       }
@@ -3235,6 +3613,23 @@ var LocalContextIndex = class {
     if (paths.length) this.queryCache.clear();
     if (this.dirtyPaths.size) this.refreshState = "dirty";
   }
+  recordDiagnostics(update) {
+    const paths = /* @__PURE__ */ new Set();
+    for (const candidate of update.paths.slice(0, MAX_DIAGNOSTIC_HINTS_PER_COMMAND)) {
+      const path = this.resolveDiagnosticPath(candidate);
+      if (path) paths.add(path);
+    }
+    if (paths.size) this.diagnosticsByCommand.set(update.commandKey, paths);
+    else this.diagnosticsByCommand.delete(update.commandKey);
+    this.refreshDiagnosticScores();
+    this.queryCache.clear();
+  }
+  resetDiagnostics() {
+    if (!this.diagnosticsByCommand.size) return;
+    this.diagnosticsByCommand.clear();
+    this.diagnosticScores.clear();
+    this.queryCache.clear();
+  }
   async flushDirty() {
     if (!this.dirtyPaths.size) {
       return {
@@ -3320,6 +3715,7 @@ var LocalContextIndex = class {
       queryCacheEntries: this.queryCache.size,
       queryCacheHits: this.queryCacheHits,
       queryCacheMisses: this.queryCacheMisses,
+      diagnosticHints: this.diagnosticScores.size,
       refreshState: this.refreshState,
       dirtyPaths: this.dirtyPaths.size,
       ...this.refreshError ? { refreshError: this.refreshError } : {},
@@ -3424,6 +3820,7 @@ var LocalContextIndex = class {
     );
     await atomicWrite(this.indexPath, `${JSON.stringify(this.index)}
 `, 384);
+    await this.gitRecency.collect();
     onProgress?.({ phase: "done", completed: files.length, total: files.length });
     return {
       files: files.length,
@@ -3517,7 +3914,7 @@ var LocalContextIndex = class {
         followSymbolicLinks: false,
         ignore: ignorePatterns
       });
-      for (const path of paths) discovered.push({ root, path, absolutePath: resolve8(root, path) });
+      for (const path of paths) discovered.push({ root, path, absolutePath: resolve10(root, path) });
     }
     discovered.sort((left, right) => left.absolutePath.localeCompare(right.absolutePath));
     return discovered;
@@ -3537,7 +3934,7 @@ var LocalContextIndex = class {
     });
     return matches.length === 1 ? { root, path, absolutePath } : void 0;
   }
-  rank(query, topK) {
+  rank(query, topK, recencyScores) {
     const index = this.index;
     const files = index?.files ?? [];
     const chunks = files.flatMap((file) => file.chunks);
@@ -3567,11 +3964,13 @@ var LocalContextIndex = class {
         averageLength
       );
       const graph = graphBoosts.get(chunk.absolutePath)?.score ?? 0;
-      const score = lexical.bm25 + lexical.path + lexical.symbol + lexical.phrase + graph;
-      return { chunk, lexical, graph, score };
-    }).filter(({ score }) => score > 0).sort((left, right) => right.score - left.score || left.chunk.absolutePath.localeCompare(right.chunk.absolutePath));
+      const recency = recencyScores.get(chunk.absolutePath) ?? 0;
+      const diagnostic = this.diagnosticScores.get(chunk.absolutePath) ?? 0;
+      const score = lexical.bm25 + lexical.path + lexical.symbol + lexical.phrase + graph + recency + diagnostic;
+      return { chunk, lexical, graph, recency, diagnostic, score };
+    }).filter(({ lexical, graph }) => lexical.bm25 + lexical.path + lexical.symbol + lexical.phrase + graph > 0).sort((left, right) => right.score - left.score || left.chunk.absolutePath.localeCompare(right.chunk.absolutePath));
     const covered = scored.filter(({ lexical, graph }) => graph > 0 || hasSufficientQueryCoverage(lexical.matchedTerms, coverageTerms));
-    return (covered.length ? covered : scored).slice(0, topK).map(({ chunk, lexical, graph, score }) => {
+    return (covered.length ? covered : scored).slice(0, topK).map(({ chunk, lexical, graph, recency, diagnostic, score }) => {
       const file = filesByPath.get(chunk.absolutePath);
       const breakdown = {
         bm25: roundScore(lexical.bm25),
@@ -3579,6 +3978,8 @@ var LocalContextIndex = class {
         symbol: roundScore(lexical.symbol),
         phrase: roundScore(lexical.phrase),
         graph: roundScore(graph),
+        recency: roundScore(recency),
+        diagnostic: roundScore(diagnostic),
         total: roundScore(score)
       };
       const provenance = {
@@ -3594,7 +3995,7 @@ var LocalContextIndex = class {
         endLine: chunk.endLine,
         content: chunk.content,
         score,
-        source: "local-bm25+path+symbol+graph",
+        source: "local-bm25+path+symbol+graph+recency+diagnostic",
         ...chunk.symbol ? { symbol: chunk.symbol } : {},
         provenance
       };
@@ -3620,13 +4021,13 @@ var LocalContextIndex = class {
     }
     return true;
   }
-  getCachedHits(query, topK) {
+  getCachedHits(query, topK, rankingGeneration) {
     const generation = this.index?.generation;
     if (!generation) {
       this.queryCacheMisses += 1;
       return void 0;
     }
-    const key = `${generation}\0${topK}\0${query}`;
+    const key = `${generation}\0${rankingGeneration}\0${topK}\0${query}`;
     const cached = this.queryCache.get(key);
     if (!cached) {
       this.queryCacheMisses += 1;
@@ -3637,11 +4038,11 @@ var LocalContextIndex = class {
     this.queryCache.set(key, cached);
     return cloneHits(cached);
   }
-  cacheHits(query, topK, hits) {
+  cacheHits(query, topK, rankingGeneration, hits) {
     if (!hits.length) return;
     const generation = this.index?.generation;
     if (!generation) return;
-    const key = `${generation}\0${topK}\0${query}`;
+    const key = `${generation}\0${rankingGeneration}\0${topK}\0${query}`;
     this.queryCache.delete(key);
     this.queryCache.set(key, cloneHits(hits));
     while (this.queryCache.size > MAX_QUERY_CACHE_ENTRIES) {
@@ -3650,10 +4051,26 @@ var LocalContextIndex = class {
       this.queryCache.delete(oldest);
     }
   }
+  resolveDiagnosticPath(candidate) {
+    if (!candidate || candidate.includes("\0")) return void 0;
+    const absolute = isAbsolute4(candidate) ? resolve10(candidate) : void 0;
+    if (absolute && this.roots.some((root) => isWithinRoot(root, absolute))) return absolute;
+    for (const root of this.roots) {
+      const path = resolve10(root, candidate);
+      if (isWithinRoot(root, path)) return path;
+    }
+    return void 0;
+  }
+  refreshDiagnosticScores() {
+    this.diagnosticScores.clear();
+    for (const paths of this.diagnosticsByCommand.values()) {
+      for (const path of paths) this.diagnosticScores.set(path, MAX_DIAGNOSTIC_SCORE);
+    }
+  }
 };
 function isWithinRoot(root, path) {
   const offset = relative5(root, path);
-  return offset === "" || !offset.startsWith("..") && !isAbsolute3(offset);
+  return offset === "" || !offset.startsWith("..") && !isAbsolute4(offset);
 }
 function isIncludedSourcePath(path) {
   const name = basename5(path);
@@ -3785,7 +4202,7 @@ function packContextHits(hits, roots, maxTokens, engine) {
   const text = selected.map((hit) => {
     const shownPath = workspaceAliasPath(hit.path, roots);
     const symbol = hit.symbol ? ` symbol="${escapeAttribute(hit.symbol)}"` : "";
-    const provenance = hit.provenance ? ` source="${escapeAttribute(hit.source)}" hash="${hit.provenance.contentHash.slice(0, 12)}" graph-score="${hit.provenance.score.graph.toFixed(3)}"` : "";
+    const provenance = hit.provenance ? ` source="${escapeAttribute(hit.source)}" hash="${hit.provenance.contentHash.slice(0, 12)}" graph-score="${hit.provenance.score.graph.toFixed(3)}" recency-score="${hit.provenance.score.recency.toFixed(6)}" diagnostic-score="${hit.provenance.score.diagnostic.toFixed(3)}"` : "";
     return `<code path="${escapeAttribute(shownPath)}" lines="${hit.startLine}-${hit.endLine}" score="${hit.score.toFixed(3)}"${symbol}${provenance}>
 ${hit.content}
 </code>`;
@@ -3833,10 +4250,10 @@ function reconstructIndexedContent(chunks) {
   return lines.map((line) => line ?? "").join("\n");
 }
 function hashContent(content) {
-  return createHash6("sha256").update(content, "utf8").digest("hex");
+  return createHash7("sha256").update(content, "utf8").digest("hex");
 }
 function createGeneration(files) {
-  return createHash6("sha256").update(files.slice().sort((left, right) => left.absolutePath.localeCompare(right.absolutePath)).map((file) => `${file.absolutePath}\0${file.contentHash}`).join("\n"), "utf8").digest("hex").slice(0, 16);
+  return createHash7("sha256").update(files.slice().sort((left, right) => left.absolutePath.localeCompare(right.absolutePath)).map((file) => `${file.absolutePath}\0${file.contentHash}`).join("\n"), "utf8").digest("hex").slice(0, 16);
 }
 function hasSubstantialOverlap(left, right) {
   if (left.path !== right.path) return false;
@@ -4112,18 +4529,37 @@ function definitionMatchesQuery(definitionTerms, queryTerms) {
   return shared.length >= required;
 }
 function resolveImportTargets(importer, specifier, files) {
-  if (!specifier.startsWith(".")) return [];
-  const base = posix.normalize(posix.join(posix.dirname(importer.path), specifier));
-  const extensions = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
-  const importedExtension = posix.extname(base);
-  const extensionless = extensions.includes(importedExtension) ? base.slice(0, -importedExtension.length) : base;
-  const candidates = /* @__PURE__ */ new Set([
-    base,
-    ...extensions.map((extension) => `${extensionless}${extension}`),
-    ...extensions.map((extension) => posix.join(extensionless, `index${extension}`))
-  ]);
+  const candidates = /* @__PURE__ */ new Set();
+  const extension = extname2(importer.path).toLocaleLowerCase();
+  if (specifier.startsWith(".")) {
+    const base = posix.normalize(posix.join(posix.dirname(importer.path), specifier));
+    const extensions = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+    const importedExtension = posix.extname(base);
+    const extensionless = extensions.includes(importedExtension) ? base.slice(0, -importedExtension.length) : base;
+    candidates.add(base);
+    for (const candidateExtension of extensions) {
+      candidates.add(`${extensionless}${candidateExtension}`);
+      candidates.add(posix.join(extensionless, `index${candidateExtension}`));
+    }
+  }
+  if (extension === ".py") {
+    const modulePath = resolvePythonModulePath(importer.path, specifier);
+    if (modulePath) {
+      candidates.add(`${modulePath}.py`);
+      candidates.add(posix.join(modulePath, "__init__.py"));
+    }
+  }
   return files.filter((file) => file.root === importer.root && candidates.has(file.path)).map((file) => file.absolutePath);
 }
+function resolvePythonModulePath(importerPath, specifier) {
+  const match = specifier.match(/^(\.+)(.*)$/u);
+  if (!match) return specifier.split(".").filter(Boolean).join("/");
+  const [, dots, remainder] = match;
+  if (!dots || !remainder) return void 0;
+  let base = posix.dirname(importerPath);
+  for (let level = 1; level < dots.length; level += 1) base = posix.dirname(base);
+  return posix.normalize(posix.join(base, remainder.split(".").filter(Boolean).join("/")));
+}
 function scoreChunk(chunk, terms, rawQuery, documentFrequency, documentCount, averageLength) {
   const frequencies = /* @__PURE__ */ new Map();
   for (const token of chunk.tokens) frequencies.set(token, (frequencies.get(token) ?? 0) + 1);
@@ -4214,6 +4650,12 @@ var ContextEngine = class {
   invalidate(paths) {
     this.local.invalidate(paths);
   }
+  recordDiagnostics(update) {
+    this.local.recordDiagnostics(update);
+  }
+  resetDiagnostics() {
+    this.local.resetDiagnostics();
+  }
   async flushDirty() {
     try {
       const result = await this.local.flushDirty();
@@ -4260,7 +4702,7 @@ function formatContextHits(hits, roots) {
     const path = workspaceAliasPath(hit.path, roots);
     const symbol = hit.symbol ? ` ${hit.symbol}` : "";
     const score = hit.provenance?.score;
-    const breakdown = score ? ` bm25=${score.bm25.toFixed(2)} path=${score.path.toFixed(2)} symbol=${score.symbol.toFixed(2)} graph=${score.graph.toFixed(2)}` : "";
+    const breakdown = score ? ` bm25=${score.bm25.toFixed(2)} path=${score.path.toFixed(2)} symbol=${score.symbol.toFixed(2)} graph=${score.graph.toFixed(2)} recency=${score.recency.toFixed(6)} diagnostic=${score.diagnostic.toFixed(3)}` : "";
     const hash4 = hit.provenance?.contentHash.slice(0, 12);
     return `[${hit.source} ${hit.score.toFixed(3)}${breakdown}${hash4 ? ` hash=${hash4}` : ""}]${symbol} ${path}:${hit.startLine}-${hit.endLine}`;
   }).join("\n");
@@ -4501,7 +4943,7 @@ function toolTokens(messages) {
 
 // src/context/mentions.ts
 import { readFile as readFile4, stat as stat4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, resolve as resolve9 } from "node:path";
+import { isAbsolute as isAbsolute5, resolve as resolve11 } from "node:path";
 import fg2 from "fast-glob";
 var defaultMentionIgnores = [
   "**/.git/**",
@@ -4572,7 +5014,7 @@ async function resolveMentions(input2, roots, maxChars = 8e4) {
             ignore: ["**/.git/**", "**/node_modules/**", "**/dist/**", "**/.mosaic/**", "**/.skein/**", "**/.skein.migrating-*/**", "**/.skein.rollback-*/**"]
           });
           matched.push(...await safeMentionPaths(
-            children.slice(0, 25).map((path) => resolve9(aliased, path)),
+            children.slice(0, 25).map((path) => resolve11(aliased, path)),
             workspace
           ));
         }
@@ -4580,7 +5022,7 @@ async function resolveMentions(input2, roots, maxChars = 8e4) {
       }
     }
     for (const root of matched.length ? [] : roots) {
-      const direct = resolve9(root, clean2);
+      const direct = resolve11(root, clean2);
       try {
         const safeDirect = await workspace.resolvePath(direct);
         const info = await stat4(safeDirect);
@@ -4594,7 +5036,7 @@ async function resolveMentions(input2, roots, maxChars = 8e4) {
             ignore: ["**/.git/**", "**/node_modules/**", "**/dist/**", "**/.mosaic/**", "**/.skein/**", "**/.skein.migrating-*/**", "**/.skein.rollback-*/**"]
           });
           matched.push(...await safeMentionPaths(
-            children.slice(0, 25).map((path) => resolve9(safeDirect, path)),
+            children.slice(0, 25).map((path) => resolve11(safeDirect, path)),
             workspace
           ));
         }
@@ -4610,7 +5052,7 @@ async function resolveMentions(input2, roots, maxChars = 8e4) {
           ignore: ["**/.git/**", "**/node_modules/**", "**/dist/**", "**/.mosaic/**", "**/.skein/**", "**/.skein.migrating-*/**", "**/.skein.rollback-*/**"]
         });
         matched.push(...await safeMentionPaths(
-          globbed.slice(0, 25).map((path) => resolve9(root, path)),
+          globbed.slice(0, 25).map((path) => resolve11(root, path)),
           workspace
         ));
       }
@@ -4676,7 +5118,7 @@ async function buildMentionPathIndex(roots, options = {}) {
     })
   })));
   const paths = filesByRoot.flatMap(({ root, files }) => files.map(
-    (path) => workspaceAliasPath(resolve9(root, path), normalizedRoots)
+    (path) => workspaceAliasPath(resolve11(root, path), normalizedRoots)
   ));
   return new MentionPathIndex(normalizedRoots, paths);
 }
@@ -4710,22 +5152,22 @@ function mapMentionCandidatePath(path, roots) {
   const primary = normalizedRoots[0];
   if (!primary || !path || path.includes("\0")) return void 0;
   let candidate;
-  if (isAbsolute4(path)) {
-    candidate = resolve9(path);
+  if (isAbsolute5(path)) {
+    candidate = resolve11(path);
   } else {
     const normalized = path.replaceAll("\\", "/").replace(/^\.\//, "");
     const [first = "", ...rest] = normalized.split("/");
     const alias = first.toLocaleLowerCase();
     const workspace = alias.match(/^workspace(\d+)$/);
     if (alias === "main") {
-      candidate = resolve9(primary, ...rest);
+      candidate = resolve11(primary, ...rest);
     } else if (workspace) {
       const index = Number(workspace[1]) - 1;
       const root = Number.isSafeInteger(index) && index >= 1 ? normalizedRoots[index] : void 0;
       if (!root) return void 0;
-      candidate = resolve9(root, ...rest);
+      candidate = resolve11(root, ...rest);
     } else {
-      candidate = resolve9(primary, normalized);
+      candidate = resolve11(primary, normalized);
     }
   }
   if (!normalizedRoots.some((root) => isInside(root, candidate))) return void 0;
@@ -4755,7 +5197,7 @@ function rankMention(path, needle) {
 }
 function normalizeRoots(roots) {
   const values = typeof roots === "string" ? [roots] : roots;
-  return [...new Set(values.map((root) => resolve9(root)))];
+  return [...new Set(values.map((root) => resolve11(root)))];
 }
 function normalizeMentionCandidate(path) {
   const normalized = path.replaceAll("\\", "/").normalize("NFC");
@@ -5421,9 +5863,9 @@ function createProvider(config) {
 }
 
 // src/checkpoint/store.ts
-import { createHash as createHash7, randomUUID as randomUUID7 } from "node:crypto";
-import { lstat as lstat9, mkdir as mkdir7, readFile as readFile5, readdir as readdir2, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname8, join as join8, relative as relative6, resolve as resolve10 } from "node:path";
+import { createHash as createHash8, randomUUID as randomUUID7 } from "node:crypto";
+import { lstat as lstat10, mkdir as mkdir7, readFile as readFile5, readdir as readdir2, unlink as unlink2 } from "node:fs/promises";
+import { basename as basename6, dirname as dirname8, join as join9, relative as relative6, resolve as resolve12 } from "node:path";
 import { z as z4 } from "zod";
 var entrySchema = z4.object({
   path: z4.string(),
@@ -5448,7 +5890,7 @@ var CheckpointStore = class {
   constructor(workspace, directory) {
     this.workspace = typeof workspace === "string" ? new WorkspaceAccess([workspace]) : workspace;
     this.managedDirectory = directory === void 0;
-    this.directory = directory ? resolve10(directory) : join8(resolveProjectNamespaceSync(this.workspace.primaryRoot).active, "checkpoints");
+    this.directory = directory ? resolve12(directory) : join9(resolveProjectNamespaceSync(this.workspace.primaryRoot).active, "checkpoints");
   }
   async capture(sessionId, paths, options = {}) {
     validateIdentifier(sessionId, "session");
@@ -5458,8 +5900,8 @@ var CheckpointStore = class {
   }
   async captureUnlocked(sessionId, unique3, options) {
     const id = `${Date.now().toString(36)}-${randomUUID7()}`;
-    const target = join8(this.directory, sessionId, id);
-    const blobDirectory = join8(target, "blobs");
+    const target = join9(this.directory, sessionId, id);
+    const blobDirectory = join9(target, "blobs");
     await this.ensureDirectory();
     await this.assertManagedPath(target);
     await mkdir7(blobDirectory, { recursive: true });
@@ -5468,14 +5910,14 @@ var CheckpointStore = class {
     for (const input2 of unique3) {
       const path = await this.workspace.resolvePath(input2, { allowMissing: true });
       try {
-        const info = await lstat9(path);
+        const info = await lstat10(path);
         if (info.isSymbolicLink()) throw new Error(`Cannot checkpoint a symbolic link: ${input2}`);
         if (!info.isFile()) throw new Error(`Cannot checkpoint a non-file path: ${input2}`);
         if (info.size > 25e6) {
           throw new Error(`File is too large to checkpoint (${info.size} bytes): ${input2}`);
         }
-        const blob = `${createHash7("sha256").update(path).digest("hex")}.bin`;
-        await atomicWrite(join8(blobDirectory, blob), await readFile5(path), 384);
+        const blob = `${createHash8("sha256").update(path).digest("hex")}.bin`;
+        await atomicWrite(join9(blobDirectory, blob), await readFile5(path), 384);
         entries.push({
           path,
           relativePath: relative6(this.workspace.primaryRoot, path),
@@ -5502,7 +5944,7 @@ var CheckpointStore = class {
       entries
     };
     await atomicWrite(
-      join8(target, "manifest.json"),
+      join9(target, "manifest.json"),
       `${JSON.stringify(manifest, null, 2)}
 `,
       384
@@ -5515,9 +5957,9 @@ var CheckpointStore = class {
     if (!await this.directoryAvailable()) {
       throw new Error(`Checkpoint not found: ${checkpointId}`);
     }
-    const checkpointDirectory = join8(this.directory, sessionId, checkpointId);
+    const checkpointDirectory = join9(this.directory, sessionId, checkpointId);
     await this.assertManagedPath(checkpointDirectory);
-    const manifestPath = join8(checkpointDirectory, "manifest.json");
+    const manifestPath = join9(checkpointDirectory, "manifest.json");
     await this.assertManagedFile(manifestPath);
     const raw = await readFile5(manifestPath, "utf8");
     const manifest = manifestSchema.parse(JSON.parse(raw));
@@ -5528,7 +5970,7 @@ var CheckpointStore = class {
   }
   async restore(sessionId, checkpointId) {
     const manifest = await this.load(sessionId, checkpointId);
-    const blobDirectory = join8(this.directory, sessionId, checkpointId, "blobs");
+    const blobDirectory = join9(this.directory, sessionId, checkpointId, "blobs");
     await this.assertManagedPath(blobDirectory);
     const actions = [];
     for (const entry of manifest.entries) {
@@ -5543,8 +5985,8 @@ var CheckpointStore = class {
       if (!/^[a-f0-9]{64}\.bin$/.test(entry.blob) || basename6(entry.blob) !== entry.blob) {
         throw new Error(`Checkpoint blob name is invalid for ${entry.relativePath}.`);
       }
-      const blobPath = join8(blobDirectory, entry.blob);
-      const blobInfo = await lstat9(blobPath);
+      const blobPath = join9(blobDirectory, entry.blob);
+      const blobInfo = await lstat10(blobPath);
       if (!blobInfo.isFile() || blobInfo.isSymbolicLink()) {
         throw new Error(`Checkpoint blob is not a regular file for ${entry.relativePath}.`);
       }
@@ -5585,7 +6027,7 @@ var CheckpointStore = class {
   async list(sessionId) {
     validateIdentifier(sessionId, "session");
     if (!await this.directoryAvailable()) return [];
-    const directory = join8(this.directory, sessionId);
+    const directory = join9(this.directory, sessionId);
     let names;
     try {
       names = await readdir2(directory);
@@ -5624,7 +6066,7 @@ var CheckpointStore = class {
       await assertNoSymlinkPath(this.workspace.primaryRoot, this.directory);
     }
     try {
-      const info = await lstat9(this.directory);
+      const info = await lstat10(this.directory);
       if (info.isSymbolicLink() || !info.isDirectory()) {
         throw new Error(`Checkpoint storage is not a regular directory: ${this.directory}`);
       }
@@ -5643,7 +6085,7 @@ var CheckpointStore = class {
     await this.assertManagedPath(dirname8(path));
     if (!this.managedDirectory) return;
     try {
-      if ((await lstat9(path)).isSymbolicLink()) {
+      if ((await lstat10(path)).isSymbolicLink()) {
         throw new Error(`Checkpoint path cannot contain a symbolic link: ${path}`);
       }
     } catch (error) {
@@ -5653,7 +6095,7 @@ var CheckpointStore = class {
 };
 async function readSnapshot(path) {
   try {
-    const info = await lstat9(path);
+    const info = await lstat10(path);
     if (info.isSymbolicLink()) throw new Error(`Cannot restore over a symbolic link: ${path}`);
     if (!info.isFile()) throw new Error(`Cannot restore over a non-file path: ${path}`);
     return { content: await readFile5(path), mode: info.mode };
@@ -5678,174 +6120,6 @@ function validateIdentifier(value, kind) {
   }
 }
 
-// src/utils/process.ts
-import { spawn } from "node:child_process";
-import { constants as constants3 } from "node:fs";
-import { access as access2, lstat as lstat10, realpath as realpath6 } from "node:fs/promises";
-import { delimiter, isAbsolute as isAbsolute5, join as join9, resolve as resolve11 } from "node:path";
-import { StringDecoder } from "node:string_decoder";
-async function resolveExecutableRuntime(command2, cwd, excludedRoots = []) {
-  const realRoots = await Promise.all(excludedRoots.map(async (root) => {
-    try {
-      return await realpath6(root);
-    } catch {
-      return resolve11(root);
-    }
-  }));
-  const pathEntries = (process.env.PATH ?? process.env.Path ?? "").split(delimiter).filter(Boolean);
-  const safeDirectories2 = [];
-  let executable2;
-  const explicit = isAbsolute5(command2) || command2.includes("/") || command2.includes("\\");
-  const explicitPath = explicit ? resolve11(cwd, command2) : void 0;
-  for (const entry of pathEntries) {
-    let directory;
-    try {
-      directory = await realpath6(resolve11(cwd, entry));
-      if (!(await lstat10(directory)).isDirectory()) continue;
-    } catch {
-      continue;
-    }
-    if (realRoots.some((root) => isInside(root, directory))) continue;
-    let contaminated = false;
-    if (!explicit) {
-      for (const name of executableNames(command2)) {
-        const candidate = join9(directory, name);
-        const resolvedCandidate = await usableExecutable(candidate);
-        if (!resolvedCandidate) continue;
-        if (realRoots.some((root) => isInside(root, resolvedCandidate))) {
-          contaminated = true;
-          continue;
-        }
-        executable2 ??= resolvedCandidate;
-      }
-    }
-    if (!contaminated && !safeDirectories2.includes(directory)) safeDirectories2.push(directory);
-  }
-  if (explicitPath) executable2 = await usableExecutable(explicitPath);
-  if (!executable2) return void 0;
-  return { executable: executable2, path: safeDirectories2.join(delimiter) };
-}
-async function usableExecutable(candidate) {
-  try {
-    await access2(candidate, process.platform === "win32" ? constants3.F_OK : constants3.X_OK);
-    const resolvedCandidate = await realpath6(candidate);
-    return (await lstat10(resolvedCandidate)).isFile() ? resolvedCandidate : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function executableNames(command2) {
-  if (process.platform !== "win32") return [command2];
-  const extensions = (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean);
-  return [command2, ...extensions.map((extension) => `${command2}${extension}`)];
-}
-function runProcess(command2, args, options) {
-  return new Promise((resolve24, reject) => {
-    const started = Date.now();
-    const environment = options.inheritEnv === false ? {} : { ...process.env };
-    for (const name of options.unsetEnv ?? []) delete environment[name];
-    for (const name of Object.keys(environment)) {
-      if (options.unsetEnvPrefixes?.some((prefix) => name.startsWith(prefix))) {
-        delete environment[name];
-      }
-    }
-    Object.assign(environment, options.env);
-    const child = spawn(command2, args, {
-      cwd: options.cwd,
-      env: environment,
-      stdio: ["pipe", "pipe", "pipe"],
-      signal: options.signal
-    });
-    const maxBytes = options.maxOutputBytes ?? 1e6;
-    let stdout = "";
-    let stderr = "";
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    let stdoutObservedBytes = 0;
-    let stderrObservedBytes = 0;
-    let timedOut = false;
-    let callbackError;
-    const stdoutDecoder = new StringDecoder("utf8");
-    const stderrDecoder = new StringDecoder("utf8");
-    const stdoutCallbackDecoder = new StringDecoder("utf8");
-    const stderrCallbackDecoder = new StringDecoder("utf8");
-    const append = (decoder, chunk, usedBytes) => {
-      if (usedBytes >= maxBytes) return { text: "", usedBytes };
-      const selected = chunk.subarray(0, maxBytes - usedBytes);
-      return { text: decoder.write(selected), usedBytes: usedBytes + selected.length };
-    };
-    const notify = (callback, decoder, chunk) => {
-      if (!callback || callbackError) return;
-      try {
-        const decoded = decoder.write(chunk);
-        if (decoded) callback(decoded);
-      } catch (error) {
-        callbackError = error;
-        child.kill("SIGTERM");
-      }
-    };
-    child.stdout.on("data", (chunk) => {
-      stdoutObservedBytes += chunk.length;
-      const appended = append(stdoutDecoder, chunk, stdoutBytes);
-      stdout += appended.text;
-      stdoutBytes = appended.usedBytes;
-      notify(options.onStdout, stdoutCallbackDecoder, chunk);
-    });
-    child.stderr.on("data", (chunk) => {
-      stderrObservedBytes += chunk.length;
-      const appended = append(stderrDecoder, chunk, stderrBytes);
-      stderr += appended.text;
-      stderrBytes = appended.usedBytes;
-      notify(options.onStderr, stderrCallbackDecoder, chunk);
-    });
-    child.on("error", reject);
-    const timeoutMs = options.timeoutMs ?? 12e4;
-    const timeout = timeoutMs > 0 ? setTimeout(() => {
-      timedOut = true;
-      child.kill("SIGTERM");
-      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
-    }, timeoutMs) : void 0;
-    child.on("close", (code) => {
-      if (timeout) clearTimeout(timeout);
-      const stdoutTail = stdoutDecoder.end();
-      const stderrTail = stderrDecoder.end();
-      if (Buffer.byteLength(stdout) + Buffer.byteLength(stdoutTail) <= maxBytes) stdout += stdoutTail;
-      if (Buffer.byteLength(stderr) + Buffer.byteLength(stderrTail) <= maxBytes) stderr += stderrTail;
-      try {
-        const stdoutCallbackTail = stdoutCallbackDecoder.end();
-        const stderrCallbackTail = stderrCallbackDecoder.end();
-        if (stdoutCallbackTail && options.onStdout && !callbackError) options.onStdout(stdoutCallbackTail);
-        if (stderrCallbackTail && options.onStderr && !callbackError) options.onStderr(stderrCallbackTail);
-      } catch (error) {
-        callbackError = error;
-      }
-      if (callbackError) {
-        reject(callbackError);
-        return;
-      }
-      resolve24({
-        command: [command2, ...args].join(" "),
-        exitCode: code ?? (timedOut ? 124 : 1),
-        stdout,
-        stderr,
-        timedOut,
-        durationMs: Date.now() - started,
-        stdoutBytes: stdoutObservedBytes,
-        stderrBytes: stderrObservedBytes,
-        stdoutTruncated: stdoutObservedBytes > stdoutBytes,
-        stderrTruncated: stderrObservedBytes > stderrBytes
-      });
-    });
-    if (options.stdin) child.stdin.end(options.stdin);
-    else child.stdin.end();
-  });
-}
-function runShell(command2, cwd, options = {}) {
-  const shell = process.platform === "win32" ? process.env.COMSPEC ?? "cmd.exe" : process.env.SHELL ?? "/bin/sh";
-  const args = process.platform === "win32" ? ["/d", "/s", "/c", command2] : ["-lc", command2];
-  return runProcess(shell, args, { ...options, cwd });
-}
-
 // src/hooks/runner.ts
 var HookError = class extends Error {
   constructor(message2, result) {
@@ -5915,7 +6189,7 @@ import {
   stat as stat5,
   unlink as unlink3
 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname9, join as join10, resolve as resolve12 } from "node:path";
+import { basename as basename7, dirname as dirname9, join as join10, resolve as resolve13 } from "node:path";
 import { z as z5 } from "zod";
 var sessionIdSchema = z5.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/);
 var toolCallSchema = z5.object({
@@ -6174,9 +6448,9 @@ var SessionStore = class {
   managedDirectory;
   writes = Promise.resolve();
   constructor(workspace, directory) {
-    this.workspace = resolve12(workspace);
+    this.workspace = resolve13(workspace);
     this.managedDirectory = directory === void 0;
-    this.directory = directory ? resolve12(directory) : join10(resolveProjectNamespaceSync(this.workspace).active, "sessions");
+    this.directory = directory ? resolve13(directory) : join10(resolveProjectNamespaceSync(this.workspace).active, "sessions");
   }
   async create(options) {
     const session = createSession({ ...options, workspace: this.workspace });
@@ -6185,7 +6459,7 @@ var SessionStore = class {
   }
   async save(session) {
     validateId(session.id);
-    if (resolve12(session.workspace) !== this.workspace) {
+    if (resolve13(session.workspace) !== this.workspace) {
       throw new Error("Session workspace does not match this store.");
     }
     session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -6224,7 +6498,7 @@ var SessionStore = class {
     const summaries = await Promise.all(
       entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map(async (entry) => {
         const session = await tryReadSession(join10(this.directory, entry.name));
-        if (!session || resolve12(session.workspace) !== this.workspace) return;
+        if (!session || resolve13(session.workspace) !== this.workspace) return;
         return toSummary(session);
       })
     );
@@ -6295,7 +6569,7 @@ var SessionStore = class {
     for (const candidate of candidates) {
       await this.assertManagedFile(candidate.path);
       const session = await tryReadSession(candidate.path);
-      if (session?.id === id && resolve12(session.workspace) === this.workspace) return session;
+      if (session?.id === id && resolve13(session.workspace) === this.workspace) return session;
     }
     return void 0;
   }
@@ -6309,7 +6583,7 @@ var SessionStore = class {
     }
   }
   assertWorkspace(session) {
-    if (resolve12(session.workspace) !== this.workspace) {
+    if (resolve13(session.workspace) !== this.workspace) {
       throw new Error("Stored session belongs to a different workspace.");
     }
     return session;
@@ -6368,7 +6642,7 @@ function createSession(options) {
   return {
     id,
     title: cleanTitle(options.title ?? "New session"),
-    workspace: resolve12(options.workspace),
+    workspace: resolve13(options.workspace),
     createdAt: now,
     updatedAt: now,
     model: options.model,
@@ -6423,9 +6697,9 @@ async function exists2(path) {
 }
 
 // src/session/tool-artifacts.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { lstat as lstat12, readFile as readFile7, readdir as readdir4, rm as rm2 } from "node:fs/promises";
-import { join as join11, resolve as resolve13 } from "node:path";
+import { join as join11, resolve as resolve14 } from "node:path";
 import { z as z6 } from "zod";
 var MAX_ARTIFACT_BYTES = 5 * 1024 * 1024;
 var MAX_TOTAL_BYTES = 20 * 1024 * 1024;
@@ -6455,9 +6729,9 @@ var ToolArtifactStore = class {
   retentionMs;
   writes = Promise.resolve();
   constructor(workspace, options = {}) {
-    this.workspace = resolve13(workspace);
+    this.workspace = resolve14(workspace);
     this.managedDirectory = options.directory === void 0;
-    this.directory = options.directory ? resolve13(options.directory) : join11(resolveProjectNamespaceSync(this.workspace).active, "tool-artifacts");
+    this.directory = options.directory ? resolve14(options.directory) : join11(resolveProjectNamespaceSync(this.workspace).active, "tool-artifacts");
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.maxArtifactBytes = options.maxArtifactBytes ?? MAX_ARTIFACT_BYTES;
     this.maxTotalBytes = options.maxTotalBytes ?? MAX_TOTAL_BYTES;
@@ -6514,7 +6788,7 @@ var ToolArtifactStore = class {
       }
       if (retainedBytes + storageBytes > this.maxTotalBytes) return { stored: false, reason: "total_limit" };
       const path = this.pathFor(sessionId, toolCallId);
-      await ensureWorkspaceStorageDirectory(this.workspace, resolve13(path, ".."), {
+      await ensureWorkspaceStorageDirectory(this.workspace, resolve14(path, ".."), {
         requireActiveNamespace: this.managedDirectory
       });
       await atomicWrite(path, `${JSON.stringify(artifact)}
@@ -6665,7 +6939,7 @@ var ToolArtifactStore = class {
     }
   }
   async assertRegularFile(path) {
-    await assertNoSymlinkPath(this.workspace, resolve13(path, ".."));
+    await assertNoSymlinkPath(this.workspace, resolve14(path, ".."));
     try {
       const info = await lstat12(path);
       if (info.isSymbolicLink() || !info.isFile()) {
@@ -6702,7 +6976,7 @@ function reference(artifact) {
   };
 }
 function hash2(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
 function storedBytes(artifact) {
   return Buffer.byteLength(JSON.stringify(artifact)) + 1;
@@ -7249,48 +7523,6 @@ var knownCommands = /* @__PURE__ */ new Set([
   ...networkCommands,
   ...workspaceMutationCommands
 ]);
-var unsafeInheritedGitEnvironment = [
-  "GIT_DIR",
-  "GIT_WORK_TREE",
-  "GIT_COMMON_DIR",
-  "GIT_INDEX_FILE",
-  "GIT_OBJECT_DIRECTORY",
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-  "GIT_NAMESPACE",
-  "GIT_CEILING_DIRECTORIES",
-  "GIT_DISCOVERY_ACROSS_FILESYSTEM",
-  "GIT_EXTERNAL_DIFF",
-  "GIT_DIFF_OPTS",
-  "GIT_SSH",
-  "GIT_SSH_COMMAND",
-  "GIT_PROXY_COMMAND",
-  "GIT_ASKPASS",
-  "SSH_ASKPASS",
-  "GIT_EXEC_PATH",
-  "GIT_TEMPLATE_DIR",
-  "GIT_CONFIG",
-  "GIT_CONFIG_PARAMETERS",
-  "GIT_QUARANTINE_PATH",
-  "Path"
-];
-var isolatedGitEnvironment = {
-  GIT_TERMINAL_PROMPT: "0",
-  GIT_CONFIG_NOSYSTEM: "1",
-  GIT_CONFIG_GLOBAL: "/dev/null",
-  GIT_CONFIG_SYSTEM: "/dev/null",
-  GIT_PAGER: "cat",
-  GIT_EDITOR: "true",
-  GIT_SEQUENCE_EDITOR: "true",
-  GIT_CONFIG_COUNT: "4",
-  GIT_CONFIG_KEY_0: "core.hooksPath",
-  GIT_CONFIG_VALUE_0: "/dev/null",
-  GIT_CONFIG_KEY_1: "core.fsmonitor",
-  GIT_CONFIG_VALUE_1: "false",
-  GIT_CONFIG_KEY_2: "credential.helper",
-  GIT_CONFIG_VALUE_2: "",
-  GIT_CONFIG_KEY_3: "protocol.ext.allow",
-  GIT_CONFIG_VALUE_3: "never"
-};
 var diffCommands = /* @__PURE__ */ new Set(["diff", "log", "show", "whatchanged"]);
 var gitTool = {
   definition: {
@@ -7338,13 +7570,9 @@ var gitTool = {
     }
     const runtime = await resolveExecutableRuntime("git", cwd, context.workspace.roots);
     if (!runtime) throw new Error("Git executable was not found outside the configured workspace roots.");
-    const status = await runProcess(runtime.executable, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], {
-      cwd,
+    const status = await runIsolatedGit(runtime, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], cwd, {
       timeoutMs: 15e3,
-      maxOutputBytes: 2e6,
-      env: { ...isolatedGitEnvironment, PATH: runtime.path },
-      unsetEnv: unsafeInheritedGitEnvironment,
-      unsetEnvPrefixes: ["GIT_"]
+      maxOutputBytes: 2e6
     });
     if (status.exitCode === 0) {
       for (const record of status.stdout.split("\0")) {
@@ -7371,15 +7599,11 @@ var gitTool = {
     const runtime = await resolveExecutableRuntime("git", cwd, context.workspace.roots);
     if (!runtime) throw new Error("Git executable was not found outside the configured workspace roots.");
     const before = worktreeTrackingCommands.has(command2) ? await captureGitState(runtime, cwd) : void 0;
-    const result = await runProcess(runtime.executable, protectedGitArguments(input2.args, command2), {
-      cwd,
+    const result = await runIsolatedGit(runtime, protectedGitArguments(input2.args, command2), cwd, {
       timeoutMs: input2.timeout_ms ?? 12e4,
       maxOutputBytes: 2e6,
       ...input2.stdin !== void 0 ? { stdin: input2.stdin } : {},
-      ...context.signal ? { signal: context.signal } : {},
-      env: { ...isolatedGitEnvironment, PATH: runtime.path },
-      unsetEnv: unsafeInheritedGitEnvironment,
-      unsetEnvPrefixes: ["GIT_"]
+      ...context.signal ? { signal: context.signal } : {}
     });
     const changedFiles = before ? await collectGitChanges(before, await captureGitState(runtime, cwd), runtime, cwd, context) : [];
     return {
@@ -7457,18 +7681,6 @@ function parsePorcelainStatus(output2) {
   }
   return status;
 }
-function runIsolatedGit(runtime, args, cwd, options = {}) {
-  return runProcess(runtime.executable, args, {
-    cwd,
-    timeoutMs: options.timeoutMs ?? 15e3,
-    maxOutputBytes: options.maxOutputBytes ?? 2e6,
-    env: { ...isolatedGitEnvironment, PATH: runtime.path },
-    unsetEnv: unsafeInheritedGitEnvironment,
-    unsetEnvPrefixes: ["GIT_"],
-    ...options.stdin !== void 0 ? { stdin: options.stdin } : {},
-    ...options.signal ? { signal: options.signal } : {}
-  });
-}
 function validateGitArguments(args) {
   for (const argument of args) {
     if (argument.includes("\0") || argument.includes("\n") || argument.includes("\r")) {
@@ -7604,7 +7816,7 @@ function positionalArguments(args, command2) {
 
 // src/tools/list.ts
 import { lstat as lstat14 } from "node:fs/promises";
-import { relative as relative7, resolve as resolve14 } from "node:path";
+import { relative as relative7, resolve as resolve15 } from "node:path";
 import fg3 from "fast-glob";
 import { z as z9 } from "zod";
 var inputSchema4 = z9.object({
@@ -7662,7 +7874,7 @@ var listFilesTool = {
     for (const path of selected) {
       let safePath;
       try {
-        safePath = await context.workspace.resolvePath(resolve14(directory, path), { expect: "any" });
+        safePath = await context.workspace.resolvePath(resolve15(directory, path), { expect: "any" });
       } catch {
         continue;
       }
@@ -7872,7 +8084,7 @@ function assertToolName(name) {
 
 // src/tools/search.ts
 import { readFile as readFile10, stat as stat8 } from "node:fs/promises";
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 import fg4 from "fast-glob";
 import { z as z12 } from "zod";
 var inputSchema7 = z12.object({
@@ -7942,7 +8154,7 @@ var searchCodeTool = {
       if (results.length >= maxResults) break;
       let path;
       try {
-        path = await context.workspace.resolvePath(resolve15(directory, file), { expect: "file" });
+        path = await context.workspace.resolvePath(resolve16(directory, file), { expect: "file" });
       } catch {
         skipped += 1;
         continue;
@@ -8024,7 +8236,7 @@ ${hit.content}`
 }
 
 // src/tools/shell.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { lstat as lstat15, readFile as readFile11, readdir as readdir5 } from "node:fs/promises";
 import { join as join13 } from "node:path";
 import { z as z13 } from "zod";
@@ -8238,7 +8450,7 @@ async function captureWorkspaceSnapshot(roots) {
         files.set(path, {
           size: info.size,
           mtimeMs: info.mtimeMs,
-          hash: createHash9("sha256").update(content).digest("hex")
+          hash: createHash10("sha256").update(content).digest("hex")
         });
       } catch (error) {
         if (error.code !== "ENOENT") complete = false;
@@ -8441,15 +8653,16 @@ function compact(value, limit) {
 }
 
 // src/agent/completion-gate.ts
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
+import { isAbsolute as isAbsolute6, resolve as resolve17 } from "node:path";
 
 // src/tools/permissions.ts
-import { createHash as createHash10, createHmac, randomBytes } from "node:crypto";
+import { createHash as createHash11, createHmac, randomBytes } from "node:crypto";
 var permissionScopeSecret = randomBytes(32);
 function permissionKey(call, category) {
   const categoryScope = category === "network" ? `\0network-request:${scopeFingerprint(normalizeRequestState(call.arguments))}` : "";
-  const digest = createHash10("sha256").update(`${category}\0${call.name}\0${permissionTarget(call)}${categoryScope}`).digest("hex").slice(0, 24);
-  return `${category}:${call.name}:${digest}`;
+  const digest2 = createHash11("sha256").update(`${category}\0${call.name}\0${permissionTarget(call)}${categoryScope}`).digest("hex").slice(0, 24);
+  return `${category}:${call.name}:${digest2}`;
 }
 function permissionTarget(call) {
   const command2 = commandForCall(call);
@@ -8642,9 +8855,40 @@ function captureVerification(call, result, changeSequence, configuredCommands) {
     kind,
     ok: result.ok,
     changeSequence,
-    commandKey: createHash11("sha256").update(normalized).digest("hex")
+    commandKey: createHash12("sha256").update(normalized).digest("hex")
   };
 }
+function verificationDiagnosticPaths(result, workspaceRoots) {
+  if (result.ok || result.metadata?.sourceTruncated === true || typeof result.metadata?.exitCode !== "number" || result.metadata.exitCode === 0) return [];
+  const roots = workspaceRoots.map((root) => resolve17(root));
+  const cwd = typeof result.metadata.cwd === "string" ? resolve17(result.metadata.cwd) : void 0;
+  const bases = cwd ? [cwd, ...roots] : roots;
+  const candidates = /* @__PURE__ */ new Set();
+  const pathPattern = String.raw`((?:[./][^\s():]+|[^\s():]+)\.[A-Za-z0-9]{1,10})`;
+  const patterns = [
+    new RegExp(`${pathPattern}\\(\\d+,\\d+\\):\\s*(?:error|warning|fatal)\\b`, "gimu"),
+    new RegExp(`${pathPattern}:\\d+:\\d+:\\s*(?:error|warning|fatal)\\b`, "gimu"),
+    new RegExp(`^\\s*(?:FAIL|ERROR)\\s+${pathPattern}`, "gimu")
+  ];
+  const output2 = result.content.slice(0, 2e5).split(/\r?\n/u).filter((line) => !/^\s*Command:/u.test(line)).join("\n");
+  for (const pattern of patterns) {
+    for (const match of output2.matchAll(pattern)) {
+      const candidate = match[1];
+      if (!candidate) continue;
+      const path = resolveDiagnosticPath(candidate, bases, roots);
+      if (path) candidates.add(path);
+      if (candidates.size >= 16) return [...candidates];
+    }
+  }
+  return [...candidates];
+}
+function resolveDiagnosticPath(candidate, bases, roots) {
+  for (const base of bases) {
+    const path = isAbsolute6(candidate) ? resolve17(candidate) : resolve17(base, candidate);
+    if (roots.some((root) => isInside(root, path))) return path;
+  }
+  return void 0;
+}
 function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutationTracking = "complete", taskContract, audit = [], duplication) {
   const files = [...new Set(changedFiles)];
   const acceptance = taskContract ? buildAcceptance(taskContract, audit, evidence, currentChangeSequence) : void 0;
@@ -8826,7 +9070,7 @@ function verificationRequirementMet(requirement, checks) {
   const normalized = normalizeCommand2(requirement);
   const broad = normalized.match(/^Record at least one successful (.+) after the final mutation\.?$/iu);
   if (broad) return checks.length > 0;
-  const commandKey = createHash11("sha256").update(normalized).digest("hex");
+  const commandKey = createHash12("sha256").update(normalized).digest("hex");
   return checks.some((item) => item.commandKey === commandKey);
 }
 function acceptanceUnresolved(acceptance) {
@@ -9420,7 +9664,7 @@ function escapeAttribute3(value) {
 }
 
 // src/agent/tool-recovery.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 var RETRY_BUDGET = {
   schema_input: 3,
   unknown_tool: 2,
@@ -9492,7 +9736,7 @@ var ToolRecoveryController = class {
   recordEvidence(call, result) {
     if (call.name !== "search_code" || !result.ok) return void 0;
     const callKey = callSignature(call);
-    const fingerprint = createHash12("sha256").update(`${result.content}\0${stableJson(result.metadata ?? {})}`).digest("hex");
+    const fingerprint = createHash13("sha256").update(`${result.content}\0${stableJson(result.metadata ?? {})}`).digest("hex");
     const count = typeof result.metadata?.count === "number" ? result.metadata.count : void 0;
     const current = this.evidence.get(callKey);
     const repeated = current?.fingerprint === fingerprint;
@@ -9502,7 +9746,7 @@ var ToolRecoveryController = class {
       status: count === 0 ? "empty" : repeated ? "repeated" : "new",
       repeatCount: repeats,
       stop: repeats >= 2,
-      signature: createHash12("sha256").update(`${callKey}\0${fingerprint}`).digest("hex")
+      signature: createHash13("sha256").update(`${callKey}\0${fingerprint}`).digest("hex")
     };
   }
   receipt(call, failureClass, attempt, circuitOpen) {
@@ -9538,10 +9782,10 @@ function isRetryable(failureClass) {
   return RETRY_BUDGET[failureClass] > 0;
 }
 function callSignature(call) {
-  return createHash12("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}`).digest("hex");
+  return createHash13("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}`).digest("hex");
 }
 function failureSignature(call, failureClass) {
-  return createHash12("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}\0${failureClass}`).digest("hex");
+  return createHash13("sha256").update(`${call.name}\0${stableJson(redact(call.arguments))}\0${failureClass}`).digest("hex");
 }
 function redact(value, key = "") {
   if (/api[_-]?key|authorization|cookie|password|secret|token/i.test(key)) return "[redacted]";
@@ -9889,7 +10133,7 @@ function escapeAttribute5(value) {
 }
 
 // src/agent/reuse-gate.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { readFile as readFile14, stat as stat10 } from "node:fs/promises";
 import { basename as basename8, extname as extname3 } from "node:path";
 var MAX_CANDIDATES = 5;
@@ -10098,14 +10342,14 @@ function unresolvedReceipt(input2, queryHash, targetPaths, trigger, detail) {
   };
 }
 function hash3(value) {
-  return createHash13("sha256").update(value).digest("hex");
+  return createHash14("sha256").update(value).digest("hex");
 }
 function roundScore2(value) {
   return Number.isFinite(value) ? Math.round(value * 1e3) / 1e3 : 0;
 }
 
 // src/agent/duplication-audit.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 import { readFile as readFile15 } from "node:fs/promises";
 var DEFAULT_NEAR_CLONE_THRESHOLD = 0.55;
 var MAX_MATCHES = 8;
@@ -10280,7 +10524,7 @@ function round(value) {
   return Math.round(value * 1e3) / 1e3;
 }
 function matchId(generation, changeSequence, changed, candidate, similarity) {
-  return createHash14("sha256").update([
+  return createHash15("sha256").update([
     generation,
     String(changeSequence),
     changed.path,
@@ -10357,6 +10601,7 @@ var AgentRunner = class {
       throw new Error("User input is too large; pass a focused request or attach files with @path.");
     }
     this.running = true;
+    this.contextEngine.resetDiagnostics?.();
     const emit = async (event) => {
       await options.onEvent?.(event);
     };
@@ -10383,7 +10628,13 @@ var AgentRunner = class {
         this.changeSequence,
         this.config.agent.verifyCommands
       );
-      if (evidence) verificationEvidence.push(evidence);
+      if (evidence) {
+        verificationEvidence.push(evidence);
+        this.contextEngine.recordDiagnostics?.({
+          commandKey: evidence.commandKey,
+          paths: verificationDiagnosticPaths(result, this.workspace.roots)
+        });
+      }
     };
     const completionReport = () => {
       const completion = buildRunCompletion(
@@ -11698,9 +11949,9 @@ function numeric(...values) {
 }
 
 // src/agent/team-store.ts
-import { createHash as createHash15, randomUUID as randomUUID13 } from "node:crypto";
+import { createHash as createHash16, randomUUID as randomUUID13 } from "node:crypto";
 import { lstat as lstat18, readFile as readFile17, readdir as readdir7, rm as rm3 } from "node:fs/promises";
-import { join as join16, resolve as resolve16 } from "node:path";
+import { join as join16, resolve as resolve18 } from "node:path";
 import { z as z18 } from "zod";
 var runIdSchema = z18.string().uuid();
 var hashSchema = z18.string().regex(/^[a-f0-9]{64}$/u);
@@ -11784,9 +12035,9 @@ var TeamRunStore = class {
   managedDirectory;
   writes = Promise.resolve();
   constructor(workspace, directory) {
-    this.workspace = resolve16(workspace);
+    this.workspace = resolve18(workspace);
     this.managedDirectory = directory === void 0;
-    this.directory = directory ? resolve16(directory) : join16(resolveProjectNamespaceSync(this.workspace).active, "team-runs");
+    this.directory = directory ? resolve18(directory) : join16(resolveProjectNamespaceSync(this.workspace).active, "team-runs");
   }
   async create(input2) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -11873,7 +12124,7 @@ var TeamRunStore = class {
     const path = join16(this.runDirectory(runId), "manifest.json");
     await this.assertRegularFile(path);
     const manifest = manifestSchema2.parse(JSON.parse(await readFile17(path, "utf8")));
-    if (manifest.id !== runId || resolve16(manifest.workspace) !== this.workspace) {
+    if (manifest.id !== runId || resolve18(manifest.workspace) !== this.workspace) {
       throw new Error("Team run manifest identity does not match its location.");
     }
     if (verify) {
@@ -11956,7 +12207,7 @@ var TeamRunStore = class {
   async writeArtifact(runId, content, truncate = true) {
     const data = boundedArtifactText(content, 5e5, truncate);
     const bytes = Buffer.byteLength(data);
-    const sha256 = createHash15("sha256").update(data).digest("hex");
+    const sha256 = createHash16("sha256").update(data).digest("hex");
     const directory = join16(this.runDirectory(runId), "blobs");
     await ensureWorkspaceStorageDirectory(this.workspace, directory, {
       requireActiveNamespace: this.managedDirectory
@@ -11965,7 +12216,7 @@ var TeamRunStore = class {
     try {
       await this.assertRegularFile(path);
       const existing = await readFile17(path);
-      if (createHash15("sha256").update(existing).digest("hex") !== sha256) {
+      if (createHash16("sha256").update(existing).digest("hex") !== sha256) {
         throw new Error(`Team artifact hash collision or corruption: ${sha256}`);
       }
     } catch (error) {
@@ -11986,7 +12237,7 @@ var TeamRunStore = class {
     const path = this.artifactPath(runId, artifact.sha256);
     await this.assertRegularFile(path);
     const data = await readFile17(path);
-    const hash4 = createHash15("sha256").update(data).digest("hex");
+    const hash4 = createHash16("sha256").update(data).digest("hex");
     if (hash4 !== artifact.sha256 || data.byteLength !== artifact.bytes) {
       throw new Error(`Team artifact integrity check failed: ${artifact.sha256}`);
     }
@@ -12004,7 +12255,7 @@ var TeamRunStore = class {
     if (!info.isDirectory() || info.isSymbolicLink()) throw new Error("Team run storage is not a regular directory.");
   }
   async assertRegularFile(path) {
-    await assertNoSymlinkPath(this.workspace, resolve16(path, ".."));
+    await assertNoSymlinkPath(this.workspace, resolve18(path, ".."));
     const info = await lstat18(path);
     if (!info.isFile() || info.isSymbolicLink()) throw new Error(`Team run file is not a regular file: ${path}`);
   }
@@ -12049,10 +12300,10 @@ function resolveAgentModelRoute(team, parent, profile) {
 }
 
 // src/agent/writer-lane.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import { lstat as lstat19, mkdtemp, realpath as realpath7, rm as rm4 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { isAbsolute as isAbsolute6, join as join17, resolve as resolve17 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join17, resolve as resolve19 } from "node:path";
 var WriterLaneApplyError = class extends Error {
   constructor(message2, attempted, cause) {
     super(message2, cause === void 0 ? void 0 : { cause });
@@ -12065,8 +12316,8 @@ var WriterLane = class {
   workspace;
   constructor(workspace, workspaceRoots) {
     this.workspace = new WorkspaceAccess([
-      resolve17(workspace),
-      ...workspaceRoots.map((root) => resolve17(root))
+      resolve19(workspace),
+      ...workspaceRoots.map((root) => resolve19(root))
     ]);
   }
   async createDraft(maxPatchBytes, operation, signal) {
@@ -12147,7 +12398,7 @@ var WriterLane = class {
     return {
       baseCommit,
       patch,
-      patchSha256: createHash16("sha256").update(patch).digest("hex"),
+      patchSha256: createHash17("sha256").update(patch).digest("hex"),
       files,
       worktreeCleaned,
       value
@@ -12271,7 +12522,7 @@ var WriterLane = class {
     const files = unique2(parseNumstatPaths(numstat.stdout));
     if (!files.length) throw new Error("Writer patch contains no file changes.");
     for (const file of files) {
-      if (isAbsolute6(file) || file === ".git" || file.startsWith(".git/") || file.includes("\0")) {
+      if (isAbsolute7(file) || file === ".git" || file.startsWith(".git/") || file.includes("\0")) {
         throw new Error(`Writer patch contains an unsafe path: ${file}`);
       }
       await this.workspace.resolvePath(join17(repository.root, file), { allowMissing: true });
@@ -12289,7 +12540,7 @@ var WriterLane = class {
     if (topLevel.exitCode !== 0 || !topLevel.stdout.trim()) {
       throw new Error("The primary workspace must be a Git repository root for writer lanes.");
     }
-    const discoveredRoot = resolve17(topLevel.stdout.trim());
+    const discoveredRoot = resolve19(topLevel.stdout.trim());
     if (await realpath7(discoveredRoot) !== await realpath7(root)) {
       throw new Error("The primary workspace must be the Git repository root for writer lanes.");
     }
@@ -12298,7 +12549,7 @@ var WriterLane = class {
     if (common.exitCode !== 0 || !common.stdout.trim()) {
       throw new Error(`Unable to resolve the Git common directory: ${processDetail(common)}`);
     }
-    const commonDirectory = await realpath7(isAbsolute6(common.stdout.trim()) ? common.stdout.trim() : resolve17(repositoryRoot, common.stdout.trim()));
+    const commonDirectory = await realpath7(isAbsolute7(common.stdout.trim()) ? common.stdout.trim() : resolve19(repositoryRoot, common.stdout.trim()));
     return { root: repositoryRoot, commonDirectory, runtime };
   }
   async head(repository) {
@@ -12310,7 +12561,7 @@ var WriterLane = class {
     return value;
   }
   async cleanupWorktree(repository, worktree, added) {
-    const physicalWorktree = await realpath7(worktree).catch(() => resolve17(worktree));
+    const physicalWorktree = await realpath7(worktree).catch(() => resolve19(worktree));
     if (added) {
       await runIsolatedGit(repository.runtime, [
         "worktree",
@@ -14236,7 +14487,7 @@ function formatResultDetail(result, paint = chalk2, glyphs = resolveCliGlyphs())
 }
 
 // src/cli/namespace-leases.ts
-import { resolve as resolve18 } from "node:path";
+import { resolve as resolve20 } from "node:path";
 function cliNamespaceLeaseScopes(actionCommand) {
   const names = commandNames(actionCommand);
   const topLevel = names[1];
@@ -14258,7 +14509,7 @@ async function acquireCliNamespaceLeases(actionCommand) {
   const scopes = cliNamespaceLeaseScopes(actionCommand);
   const localOptions = actionCommand.opts();
   const globalOptions = actionCommand.optsWithGlobals();
-  const workspace = resolve18(localOptions.workspace ?? globalOptions.workspace ?? process.cwd());
+  const workspace = resolve20(localOptions.workspace ?? globalOptions.workspace ?? process.cwd());
   const targets = scopes.map((scope) => scope === "project" ? projectNamespacePaths(workspace).canonical : homeNamespacePaths().canonical);
   const leases = [];
   try {
@@ -14510,7 +14761,7 @@ function graphemes(value) {
 
 // src/ui/theme.ts
 import { lstat as lstat20, readdir as readdir8, readFile as readFile18 } from "node:fs/promises";
-import { basename as basename10, join as join19, resolve as resolve19 } from "node:path";
+import { basename as basename10, join as join19, resolve as resolve21 } from "node:path";
 import React, { createContext, useContext } from "react";
 function defineTheme(seed) {
   return {
@@ -14632,7 +14883,7 @@ async function reloadUserThemes(directory = userThemeDirectory()) {
   userThemeNames.clear();
   const loaded = [];
   const errors = [];
-  const resolvedDirectory = resolve19(directory);
+  const resolvedDirectory = resolve21(directory);
   let entries;
   try {
     entries = await readdir8(resolvedDirectory, { encoding: "utf8" });
@@ -17096,7 +17347,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
     return () => clearInterval(timer);
   }, [busy]);
   const requestPermission = useCallback((call, category) => {
-    return new Promise((resolve24) => setPermission({ call, category, resolve: resolve24 }));
+    return new Promise((resolve26) => setPermission({ call, category, resolve: resolve26 }));
   }, []);
   const onEvent = useCallback((event) => {
     switch (event.type) {
@@ -17932,8 +18183,8 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
   }, [append]);
   function settlePermission(grant, stop = false) {
     if (!permission) return;
-    const { call, category, resolve: resolve24 } = permission;
-    resolve24(grant);
+    const { call, category, resolve: resolve26 } = permission;
+    resolve26(grant);
     setPermission(void 0);
     if (grant === "session") {
       append({
@@ -19268,7 +19519,7 @@ async function runFirstRunOnboarding(initialConfig, options = {}) {
 }
 
 // src/runtime/extensions.ts
-import { resolve as resolve22 } from "node:path";
+import { resolve as resolve24 } from "node:path";
 
 // src/mcp/manager.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -19277,7 +19528,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import stripAnsi5 from "strip-ansi";
 
 // src/mcp/tool.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 import stripAnsi4 from "strip-ansi";
 var MAX_ARGUMENT_BYTES = 256e3;
 var MAX_DESCRIPTION_LENGTH = 4e3;
@@ -19448,7 +19699,7 @@ function fitToolName(name, identity2) {
   return `${name.slice(0, 64 - suffix.length).replace(/_+$/g, "")}${suffix}`;
 }
 function shortHash(value) {
-  return createHash17("sha256").update(value).digest("hex").slice(0, 8);
+  return createHash18("sha256").update(value).digest("hex").slice(0, 8);
 }
 function sanitizeOutputText(value) {
   return stripAnsi4(value).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "");
@@ -19481,7 +19732,7 @@ function isRecord2(value) {
 
 // src/mcp/validation.ts
 import { stat as stat11, realpath as realpath8 } from "node:fs/promises";
-import { isAbsolute as isAbsolute7, resolve as resolve20 } from "node:path";
+import { isAbsolute as isAbsolute8, resolve as resolve22 } from "node:path";
 var SERVER_NAME = /^[a-z][a-z0-9_-]{0,63}$/;
 var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
@@ -19553,9 +19804,9 @@ async function validateCwd(configured, options) {
   if (configured !== void 0 && (configured.length > 4e3 || CONTROL_CHARACTERS.test(configured))) {
     throw new Error("MCP working directory is invalid or too long");
   }
-  const defaultCwd = resolve20(options.cwd ?? process.cwd());
-  const candidate = configured ? isAbsolute7(configured) ? resolve20(configured) : resolve20(defaultCwd, configured) : defaultCwd;
-  const roots = options.workspaceRoots?.length ? options.workspaceRoots.map((root) => resolve20(root)) : [defaultCwd];
+  const defaultCwd = resolve22(options.cwd ?? process.cwd());
+  const candidate = configured ? isAbsolute8(configured) ? resolve22(configured) : resolve22(defaultCwd, configured) : defaultCwd;
+  const roots = options.workspaceRoots?.length ? options.workspaceRoots.map((root) => resolve22(root)) : [defaultCwd];
   const resolvedCandidate = await realpath8(candidate).catch(() => {
     throw new Error(`MCP working directory does not exist: ${candidate}`);
   });
@@ -20209,7 +20460,7 @@ function scopeKey(scope, context) {
 // src/skills/catalog.ts
 import { lstat as lstat21, readFile as readFile20, readdir as readdir9, realpath as realpath9 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { basename as basename12, join as join21, resolve as resolve21 } from "node:path";
+import { basename as basename12, join as join21, resolve as resolve23 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 var SkillCatalog = class {
   constructor(workspace, config) {
@@ -20278,14 +20529,14 @@ ${skill.content}
 }
 function discoveryLocations(workspace, configured) {
   const home = homedir4();
-  const workspaceRoot = resolve21(workspace);
+  const workspaceRoot = resolve23(workspace);
   return [
     { path: join21(home, ".agents", "skills"), scope: "user", trusted: true },
     { path: join21(home, ".claude", "skills"), scope: "user", trusted: true },
     { path: join21(home, ".augment", "skills"), scope: "user", trusted: true },
     { path: join21(resolveHomeNamespace(), "skills"), scope: "user", trusted: true },
     ...configured.map((path) => {
-      const resolved = resolve21(workspaceRoot, path);
+      const resolved = resolve23(workspaceRoot, path);
       return {
         path: resolved,
         scope: "configured",
@@ -20314,7 +20565,7 @@ async function readMetadata(path) {
   const { frontmatter } = splitFrontmatter(raw);
   if (!frontmatter) return void 0;
   const parsed = parseYaml3(frontmatter);
-  const name = typeof parsed?.name === "string" ? parsed.name.trim() : basename12(resolve21(path, ".."));
+  const name = typeof parsed?.name === "string" ? parsed.name.trim() : basename12(resolve23(path, ".."));
   const description = typeof parsed?.description === "string" ? parsed.description.trim() : "";
   if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || !description || description.length > 1e3) {
     return void 0;
@@ -20335,7 +20586,7 @@ async function safeRead(path, maxBytes) {
   try {
     const info = await lstat21(path);
     if (!info.isFile() || info.isSymbolicLink() || info.size > maxBytes) return void 0;
-    const parent = resolve21(path, "..");
+    const parent = resolve23(path, "..");
     const resolvedParent = await realpath9(parent);
     const resolvedPath = await realpath9(path);
     if (!resolvedPath.startsWith(`${resolvedParent}/`)) return void 0;
@@ -20520,7 +20771,7 @@ var ExtensionRuntime = class _ExtensionRuntime {
   delegation;
   initialized = false;
   static async create(config, registry, options = {}) {
-    const runtime = new _ExtensionRuntime(config, resolve22(config.workspaceRoots[0] ?? process.cwd()), options);
+    const runtime = new _ExtensionRuntime(config, resolve24(config.workspaceRoots[0] ?? process.cwd()), options);
     try {
       await runtime.initialize(registry, options.signal);
       return runtime;
@@ -20725,15 +20976,15 @@ function upgradeCommandOverride(env = process.env) {
   return trimmed ? trimmed : void 0;
 }
 function runUpgrade(plan) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve26) => {
     const child = spawn2(plan.command, plan.args, {
       stdio: "inherit",
       shell: plan.shell ?? false
     });
-    child.on("error", () => resolve24({ ok: false, exitCode: 127, display: plan.display }));
+    child.on("error", () => resolve26({ ok: false, exitCode: 127, display: plan.display }));
     child.on("close", (code) => {
       const exitCode = code ?? 1;
-      resolve24({ ok: exitCode === 0, exitCode, display: plan.display });
+      resolve26({ ok: exitCode === 0, exitCode, display: plan.display });
     });
   });
 }
@@ -20995,7 +21246,7 @@ sessionCommand.command("export <id>").description("Export a session as Markdown"
   const store = new SessionStore(workspaceOption(options.workspace));
   const session = await requireSessionSelector(store, id);
   const markdown = sessionMarkdown(session);
-  if (options.output) await writeFile3(resolve23(options.output), markdown, "utf8");
+  if (options.output) await writeFile3(resolve25(options.output), markdown, "utf8");
   else process.stdout.write(markdown);
 });
 var checkpointCommand = program.command("checkpoint").description("Inspect and restore pre-mutation snapshots");
@@ -21372,7 +21623,7 @@ async function runChat(prompts, options) {
   const stdinPrompt = !process.stdin.isTTY ? await readStdin() : "";
   const firstPrompt = [...prompts, stdinPrompt].filter(Boolean).join("\n\n").trim();
   if (shouldPrint && !firstPrompt) throw new Error("Provide a prompt argument or pipe input on stdin.");
-  const workspace = resolve23(options.workspace);
+  const workspace = resolve25(options.workspace);
   let config = await runtimeConfig(workspace, options);
   let completedOnboarding = false;
   if (!shouldPrint && needsFirstRunOnboarding(config)) {
@@ -21597,14 +21848,14 @@ async function runAgentSetup(options) {
 `);
 }
 async function runtimeConfig(workspaceInput, options) {
-  const workspace = resolve23(workspaceInput);
+  const workspace = resolve25(workspaceInput);
   const loaded = await loadConfig(workspace, options.config, {
     trustProjectConfig: options.trustProjectConfig === true
   });
   const roots = [
     workspace,
     ...loaded.workspaceRoots,
-    ...(options.addWorkspace ?? []).map((root) => resolve23(workspace, root))
+    ...(options.addWorkspace ?? []).map((root) => resolve25(workspace, root))
   ];
   const provider = options.provider ? validateProvider(options.provider) : loaded.model.provider;
   return {
@@ -21760,7 +22011,7 @@ function collect(value, previous) {
 }
 function workspaceOption(value) {
   const rootOptions = program.opts();
-  return resolve23(value ?? rootOptions.workspace ?? process.cwd());
+  return resolve25(value ?? rootOptions.workspace ?? process.cwd());
 }
 function runtimeOptions(options) {
   const root = program.opts();