@skill-map/cli 0.23.0 → 0.24.0

package/dist/cli.js

@@ -2512,7 +2512,7 @@ function readSidecarFor(mdAbsolutePath) {
   }
   let parsedYaml;
   try {
-    parsedYaml = yaml.load(raw);
+    parsedYaml = yaml.load(raw, { schema: yaml.JSON_SCHEMA });
   } catch (err) {
     return {
       parsed: null,
@@ -5747,7 +5747,7 @@ var UPDATE_CHECK_TEXTS = {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.23.0",
+  version: "0.24.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -5814,7 +5814,7 @@ var package_default = {
   },
   dependencies: {
     "@hono/node-server": "2.0.1",
-    "@skill-map/spec": "0.23.0",
+    "@skill-map/spec": "0.24.0",
     ajv: "8.18.0",
     "ajv-formats": "3.0.1",
     chokidar: "5.0.0",
@@ -6317,7 +6317,9 @@ var ExitCode = {
   Ok: 0,
   Issues: 1,
   Error: 2,
+  // TODO Step 10: emitted by RecordCommand once the job callback ships.
   Duplicate: 3,
+  // TODO Step 10: emitted by RecordCommand once the job callback ships.
   NonceMismatch: 4,
   NotFound: 5
 };
@@ -6636,7 +6638,7 @@ function isPlainObject4(value) {
 function readSidecarObject(sidecarAbsPath) {
   if (!existsSync9(sidecarAbsPath)) return {};
   const raw = readFileSync8(sidecarAbsPath, "utf8");
-  const parsed = yaml2.load(raw);
+  const parsed = yaml2.load(raw, { schema: yaml2.JSON_SCHEMA });
   if (parsed === null || parsed === void 0) return {};
   if (!isPlainObject4(parsed)) {
     throw new Error(
@@ -6910,6 +6912,22 @@ var SmCommand = class extends Command {
     const level = this.verbose >= 3 ? "trace" : this.verbose === 2 ? "debug" : "info";
     configureLogger(new Logger({ level, stream: process.stderr }));
   }
+  /**
+   * Resolve the ANSI helper for either output stream. Reads `--no-color`
+   * from this command and the target stream's `isTTY` from the
+   * Clipanion-injected context. Centralises what was previously a
+   * 67-occurrence boilerplate sprinkled across every verb.
+   *
+   * Pass `'stdout'` for the result stream, `'stderr'` for banners /
+   * advisories / errors. The two streams may have different TTY status
+   * (e.g. piping stdout but keeping stderr interactive), so the channel
+   * matters.
+   */
+  ansiFor(stream) {
+    const target = stream === "stdout" ? this.context.stdout : this.context.stderr;
+    const isTTY = target.isTTY === true;
+    return ansiFor({ isTTY, noColorFlag: this.noColor });
+  }
 };
 
 // cli/commands/bump-plan.ts
@@ -7028,8 +7046,7 @@ var BumpCommand = class extends SmCommand {
     description: "Confirm writing .sm sidecar files in this project (sets allowEditSmFiles=true on first run)."
   });
   async run() {
-    const stderr = this.context.stderr;
-    const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stderr");
     const flagError = this.#validateFlagCombo(ansi);
     if (flagError !== null) return flagError;
     const ctx = defaultRuntimeContext();
@@ -8908,8 +8925,7 @@ var CheckCommand = class extends SmCommand {
       if (analyzerFilter !== void 0) {
         issues = issues.filter((i) => matchesAnalyzerFilter(i.analyzerId, analyzerFilter));
       }
-      const stdout = this.context.stdout;
-      const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stdout");
       if (this.json) {
         this.printer.data(JSON.stringify(issues) + "\n");
       } else if (issues.length === 0) {
@@ -9210,8 +9226,7 @@ var ConfigListCommand = class extends SmCommand {
       this.printer.data(JSON.stringify(effective, null, 2) + "\n");
       return ExitCode.Ok;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(renderConfigSections(Array.from(iterDotPaths(effective)), ansi));
     return ExitCode.Ok;
   }
@@ -9323,8 +9338,7 @@ var ConfigGetCommand = class extends SmCommand {
     if (!lookup.ok) return lookup.exitCode;
     const { value } = lookup;
     if (value === void 0) {
-      const stderr = this.context.stderr;
-      const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stderr");
       this.printer.info(
         tx(CONFIG_TEXTS.unknownKey, { glyph: ansi.red("\u2715"), key: this.key })
       );
@@ -9369,8 +9383,7 @@ var ConfigShowCommand = class extends SmCommand {
     if (!result.ok) return result.exitCode;
     const { effective, sources, warnings } = result.loaded;
     for (const w of warnings) this.printer.info(w + "\n");
-    const stderrShow = this.context.stderr;
-    const ansiShow = ansiFor({ isTTY: stderrShow.isTTY === true, noColorFlag: this.noColor });
+    const ansiShow = this.ansiFor("stderr");
     const errGlyphShow = ansiShow.red("\u2715");
     let value;
     try {
@@ -9400,8 +9413,7 @@ var ConfigShowCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     if (this.source) {
-      const stdout = this.context.stdout;
-      const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stdout");
       this.printer.data(
         tx(CONFIG_TEXTS.valueWithLayer, {
           value: formatValueHuman(value),
@@ -9468,8 +9480,7 @@ var ConfigSetCommand = class extends SmCommand {
     const ctx = defaultRuntimeContext();
     const target = resolveWriteTarget(this.key, this.global);
     const path = targetSettingsPath2(target, ctx.cwd, ctx.homedir);
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     const value = parseCliValue(this.value);
     if (PRIVACY_SENSITIVE_KEYS.has(this.key)) {
@@ -9546,8 +9557,7 @@ var ConfigSetCommand = class extends SmCommand {
       }
       throw err;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(
       tx(CONFIG_TEXTS.setWritten, {
         glyph: ansi.green("\u2713"),
@@ -9582,8 +9592,7 @@ var ConfigResetCommand = class extends SmCommand {
     const ctx = defaultRuntimeContext();
     const target = resolveWriteTarget(this.key, this.global);
     const path = targetSettingsPath2(target, ctx.cwd, ctx.homedir);
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const okGlyph = ansi.green("\u2713");
     if (!existsSync13(path)) {
       this.printer.data(
@@ -10182,8 +10191,7 @@ var ConformanceRunCommand = class extends SmCommand {
   // per-result render branches + global pass/fail decision.
   // eslint-disable-next-line complexity
   async run() {
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     let scopes;
     try {
@@ -10223,7 +10231,7 @@ var ConformanceRunCommand = class extends SmCommand {
       const cases = listCaseFiles(scope);
       if (cases.length === 0) {
         if (!this.json) {
-          this.printer.data(
+          this.printer.info(
             tx(CONFORMANCE_TEXTS.scopeEmpty, { label: scope.label })
           );
         }
@@ -10231,7 +10239,7 @@ var ConformanceRunCommand = class extends SmCommand {
         continue;
       }
       if (!this.json) {
-        this.printer.data(
+        this.printer.info(
           tx(CONFORMANCE_TEXTS.scopeHeader, {
             label: scope.label,
             caseCount: cases.length
@@ -10251,7 +10259,7 @@ var ConformanceRunCommand = class extends SmCommand {
           });
           if (result.passed) {
             if (!this.json) {
-              this.printer.data(
+              this.printer.info(
                 tx(CONFORMANCE_TEXTS.caseOk, { caseId: result.caseId })
               );
             }
@@ -10261,7 +10269,7 @@ var ConformanceRunCommand = class extends SmCommand {
             anyFailure = true;
             const failures = projectAssertionFailures(result.assertions);
             if (!this.json) {
-              this.printer.data(
+              this.printer.info(
                 tx(CONFORMANCE_TEXTS.caseFail, { caseId: result.caseId })
               );
               for (const a of result.assertions) {
@@ -10290,7 +10298,7 @@ var ConformanceRunCommand = class extends SmCommand {
             this.printer.error(
               tx(CONFORMANCE_TEXTS.runtimeError, { glyph: errGlyph, message })
             );
-            this.printer.data(tx(CONFORMANCE_TEXTS.caseFail, { caseId }));
+            this.printer.info(tx(CONFORMANCE_TEXTS.caseFail, { caseId }));
           }
           caseReports.push({
             id: caseId,
@@ -10303,7 +10311,7 @@ var ConformanceRunCommand = class extends SmCommand {
         }
       }
       if (!this.json) {
-        this.printer.data(
+        this.printer.info(
           tx(CONFORMANCE_TEXTS.scopeSummary, {
             label: scope.label,
             passCount: scopePass,
@@ -10480,8 +10488,7 @@ var DbBackupCommand = class extends SmCommand {
     await withSqlite({ databasePath: path, autoMigrate: false }, async (storage) => {
       storage.migrations.writeBackup(outPath);
     });
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(
       tx(DB_TEXTS.backupWritten, {
         glyph: ansi.green("\u2713"),
@@ -10545,8 +10552,7 @@ var DbRestoreCommand = class extends SmCommand {
   async run() {
     const target = resolveDbPath({ global: this.global, db: this.db, ...defaultRuntimeContext() });
     const sourcePath = resolve23(this.source);
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const sourceStat = await statOrNull(sourcePath);
     if (!sourceStat) {
       this.printer.error(
@@ -10584,8 +10590,7 @@ var DbRestoreCommand = class extends SmCommand {
     for (const sidecar of [`${target}-wal`, `${target}-shm`]) {
       if (await pathExists(sidecar)) await rm(sidecar);
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const cwd = defaultRuntimeContext().cwd;
     this.printer.data(
       tx(DB_TEXTS.restoreDone, {
@@ -10640,11 +10645,7 @@ var DbResetCommand = class extends SmCommand {
   // distance the validations from their guards.
   // eslint-disable-next-line complexity
   async run() {
-    const stderrReset = this.context.stderr;
-    const stderrAnsiReset = ansiFor({
-      isTTY: stderrReset.isTTY === true,
-      noColorFlag: this.noColor
-    });
+    const stderrAnsiReset = this.ansiFor("stderr");
     if (this.state && this.hard) {
       this.printer.error(
         tx(DB_TEXTS.resetStateAndHardMutex, { glyph: stderrAnsiReset.red("\u2715") })
@@ -10676,8 +10677,7 @@ var DbResetCommand = class extends SmCommand {
         const p = `${path}${suffix}`;
         if (await pathExists(p)) await rm2(p);
       }
-      const stdoutHard = this.context.stdout;
-      const ansiHard = ansiFor({ isTTY: stdoutHard.isTTY === true, noColorFlag: this.noColor });
+      const ansiHard = this.ansiFor("stdout");
       this.printer.data(
         tx(DB_TEXTS.resetHardDeleted, {
           glyph: ansiHard.green("\u2713"),
@@ -10730,8 +10730,7 @@ var DbResetCommand = class extends SmCommand {
         db.exec(`DELETE FROM "${name}"`);
       }
       db.exec("COMMIT");
-      const stdoutReset = this.context.stdout;
-      const ansiReset = ansiFor({ isTTY: stdoutReset.isTTY === true, noColorFlag: this.noColor });
+      const ansiReset = this.ansiFor("stdout");
       this.printer.data(
         rows.length === 0 ? tx(DB_TEXTS.resetClearedNone, { glyph: ansiReset.green("\u2713") }) : tx(DB_TEXTS.resetCleared, {
           glyph: ansiReset.green("\u2713"),
@@ -10770,8 +10769,7 @@ var DbShellCommand = class extends SmCommand {
     if (exit !== null) return exit;
     const result = spawnSync3("sqlite3", [path], { stdio: "inherit" });
     if (result.error && result.error.code === "ENOENT") {
-      const stderr = this.context.stderr;
-      const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stderr");
       this.printer.error(
         tx(DB_TEXTS.shellSqlite3NotFound, {
           glyph: ansi.red("\u2715"),
@@ -10827,11 +10825,7 @@ var DbBrowserCommand = class extends SmCommand {
     }
     const probe = spawnSync4("sqlitebrowser", ["--version"], { stdio: "ignore" });
     if (probe.error || probe.status !== 0) {
-      const stderrBrowser = this.context.stderr;
-      const ansiBrowser = ansiFor({
-        isTTY: stderrBrowser.isTTY === true,
-        noColorFlag: this.noColor
-      });
+      const ansiBrowser = this.ansiFor("stderr");
       this.printer.error(tx(DB_TEXTS.browserNotFound, { glyph: ansiBrowser.red("\u2715") }));
       return ExitCode.Error;
     }
@@ -10861,8 +10855,7 @@ var DbDumpCommand = class extends SmCommand {
     const path = resolveDbPath({ global: this.global, db: this.db, ...defaultRuntimeContext() });
     const exit = requireDbOrExit(path, this.context.stderr);
     if (exit !== null) return exit;
-    const stderr = this.context.stderr;
-    const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stderr");
     const errGlyph = ansi.red("\u2715");
     if (this.tables && this.tables.length > 0) {
       for (const t of this.tables) {
@@ -11018,11 +11011,7 @@ var DbMigrateCommand = class extends SmCommand {
   // the verb easier to follow.
   // eslint-disable-next-line complexity
   async run() {
-    const stderrMig = this.context.stderr;
-    const stderrAnsiMig = ansiFor({
-      isTTY: stderrMig.isTTY === true,
-      noColorFlag: this.noColor
-    });
+    const stderrAnsiMig = this.ansiFor("stderr");
     const errGlyphMig = stderrAnsiMig.red("\u2715");
     if (this.kernelOnly && this.pluginId !== void 0) {
       this.printer.error(
@@ -11106,8 +11095,7 @@ var DbMigrateCommand = class extends SmCommand {
         }
         toValue = parsed;
       }
-      const stdoutMig = this.context.stdout;
-      const ansiMig = ansiFor({ isTTY: stdoutMig.isTTY === true, noColorFlag: this.noColor });
+      const ansiMig = this.ansiFor("stdout");
       const okGlyph = ansiMig.green("\u2713");
       const cwdMig = defaultRuntimeContext().cwd;
       let kernelApplied;
@@ -11470,7 +11458,37 @@ function serialiseSubset(subset) {
     issues: subset.issues
   };
 }
+function buildSanitizedRows(subset) {
+  const nodes = subset.nodes.map((node) => {
+    const title = pickTitle2(node);
+    return {
+      pathRaw: node.path,
+      path: sanitizeForTerminal(node.path),
+      kindRaw: node.kind,
+      kind: sanitizeForTerminal(node.kind),
+      title: title === null ? null : sanitizeForTerminal(title)
+    };
+  });
+  const links = subset.links.map((link2) => ({
+    // Sort key uses raw bytes to preserve today's deterministic order
+    // (sanitisation strips control chars; comparing on raw fields keeps
+    // the output byte-identical with the legacy inline pattern).
+    sortKey: `${link2.source}\0${link2.kind}\0${link2.target}`,
+    source: sanitizeForTerminal(link2.source),
+    kind: sanitizeForTerminal(link2.kind),
+    target: sanitizeForTerminal(link2.target),
+    confidence: link2.confidence
+  }));
+  const issues = subset.issues.map((issue) => ({
+    severity: issue.severity,
+    analyzerId: sanitizeForTerminal(issue.analyzerId),
+    message: sanitizeForTerminal(issue.message)
+  }));
+  const issuesPerNode = countIssuesPerNode(subset.issues);
+  return { nodes, links, issues, issuesPerNode };
+}
 function renderMarkdown(subset) {
+  const rows = buildSanitizedRows(subset);
   const out = [];
   out.push(EXPORT_TEXTS.mdTitle);
   out.push("");
@@ -11481,43 +11499,38 @@ function renderMarkdown(subset) {
   );
   out.push(
     tx(EXPORT_TEXTS.mdCounts, {
-      nodes: subset.nodes.length,
-      links: subset.links.length,
-      issues: subset.issues.length
+      nodes: rows.nodes.length,
+      links: rows.links.length,
+      issues: rows.issues.length
     })
   );
   out.push("");
-  const issuesPerNode = countIssuesPerNode(subset.issues);
-  out.push(...renderNodesByKindSection(subset.nodes, issuesPerNode));
-  if (subset.links.length > 0) {
-    out.push(tx(EXPORT_TEXTS.mdLinksSectionHeader, { count: subset.links.length }));
+  out.push(...renderNodesByKindSection(rows.nodes, rows.issuesPerNode));
+  if (rows.links.length > 0) {
+    out.push(tx(EXPORT_TEXTS.mdLinksSectionHeader, { count: rows.links.length }));
     out.push("");
-    const sorted = [...subset.links].sort((a, b) => {
-      const aKey = `${a.source}\0${a.kind}\0${a.target}`;
-      const bKey = `${b.source}\0${b.kind}\0${b.target}`;
-      return aKey.localeCompare(bKey);
-    });
+    const sorted = [...rows.links].sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     for (const link2 of sorted) {
       out.push(
         tx(EXPORT_TEXTS.mdLinkBullet, {
-          source: sanitizeForTerminal(link2.source),
-          kind: sanitizeForTerminal(link2.kind),
-          target: sanitizeForTerminal(link2.target),
+          source: link2.source,
+          kind: link2.kind,
+          target: link2.target,
           confidence: link2.confidence
         })
       );
     }
     out.push("");
   }
-  if (subset.issues.length > 0) {
-    out.push(tx(EXPORT_TEXTS.mdIssuesSectionHeader, { count: subset.issues.length }));
+  if (rows.issues.length > 0) {
+    out.push(tx(EXPORT_TEXTS.mdIssuesSectionHeader, { count: rows.issues.length }));
     out.push("");
-    for (const issue of subset.issues) {
+    for (const issue of rows.issues) {
       out.push(
         tx(EXPORT_TEXTS.mdIssueBullet, {
           severity: issue.severity,
-          analyzerId: sanitizeForTerminal(issue.analyzerId),
-          message: sanitizeForTerminal(issue.message)
+          analyzerId: issue.analyzerId,
+          message: issue.message
         })
       );
     }
@@ -11537,8 +11550,8 @@ function countIssuesPerNode(issues) {
 function renderNodesByKindSection(nodes, issuesPerNode) {
   const byKind = /* @__PURE__ */ new Map();
   for (const node of nodes) {
-    if (!byKind.has(node.kind)) byKind.set(node.kind, []);
-    byKind.get(node.kind).push(node);
+    if (!byKind.has(node.kindRaw)) byKind.set(node.kindRaw, []);
+    byKind.get(node.kindRaw).push(node);
   }
   const lines = [];
   const renderedKinds = /* @__PURE__ */ new Set();
@@ -11550,16 +11563,16 @@ function renderNodesByKindSection(nodes, issuesPerNode) {
     if (renderedKinds.has(kind)) continue;
     const group = byKind.get(kind);
     if (!group || group.length === 0) continue;
-    appendKindSection(lines, kind, group, issuesPerNode);
+    appendKindSection(lines, group, issuesPerNode);
     renderedKinds.add(kind);
   }
   return lines;
 }
-function appendKindSection(lines, kind, group, issuesPerNode) {
-  const sorted = [...group].sort((a, b) => a.path.localeCompare(b.path));
+function appendKindSection(lines, group, issuesPerNode) {
+  const sorted = [...group].sort((a, b) => a.pathRaw.localeCompare(b.pathRaw));
   lines.push(
     tx(EXPORT_TEXTS.mdKindSectionHeader, {
-      kind: sanitizeForTerminal(kind),
+      kind: sorted[0].kind,
       count: sorted.length
     })
   );
@@ -11568,15 +11581,14 @@ function appendKindSection(lines, kind, group, issuesPerNode) {
   lines.push("");
 }
 function renderNodeBullet(node, issuesPerNode) {
-  const title = pickTitle2(node);
-  const issueCount = issuesPerNode.get(node.path) ?? 0;
-  const titleSegment = title ? tx(EXPORT_TEXTS.mdNodeTitleSuffix, { title: sanitizeForTerminal(title) }) : "";
+  const issueCount = issuesPerNode.get(node.pathRaw) ?? 0;
+  const titleSegment = node.title !== null ? tx(EXPORT_TEXTS.mdNodeTitleSuffix, { title: node.title }) : "";
   const issuesSegment = issueCount > 0 ? tx(EXPORT_TEXTS.mdNodeIssueSuffix, {
     count: issueCount,
     label: issueCount === 1 ? EXPORT_TEXTS.mdNodeIssueLabelSingular : EXPORT_TEXTS.mdNodeIssueLabelPlural
   }) : "";
   return tx(EXPORT_TEXTS.mdNodeBullet, {
-    path: sanitizeForTerminal(node.path),
+    path: node.path,
     title: titleSegment,
     issues: issuesSegment
   });
@@ -11632,8 +11644,7 @@ var GraphCommand = class extends SmCommand {
     const formatter = formatters.find((f) => f.formatId === this.format);
     if (!formatter) {
       const available = formatters.map((f) => f.formatId).sort().join(", ");
-      const stderr = this.context.stderr;
-      const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stderr");
       this.printer.error(
         tx(GRAPH_TEXTS.noFormatterRegistered, {
           glyph: ansi.red("\u2715"),
@@ -11766,8 +11777,7 @@ var HelpCommand = class extends Command15 {
       this.context.stderr.write(tx(HELP_TEXTS.invalidFormat, { format: this.format }));
       return ExitCode.Error;
     }
-    const rawDefs = this.cli.definitions();
-    const verbs = rawDefs.filter((d) => !isBuiltin(d)).map(normalizeDefinition).sort(byPath);
+    const verbs = buildVerbCatalog(this.cli);
     const verb = this.verbParts.join(" ").trim();
     if (verb) {
       const target = verbs.find((v) => v.name === verb);
@@ -11802,6 +11812,10 @@ function normalizeFormat(raw) {
   if (raw === "human" || raw === "md" || raw === "json") return raw;
   return null;
 }
+function buildVerbCatalog(cli2) {
+  const rawDefs = cli2.definitions();
+  return rawDefs.filter((d) => !isBuiltin(d)).map(normalizeDefinition).sort(byPath);
+}
 function isBuiltin(def) {
   const path = (def.path ?? "").trim();
   return path === "sm -h" || path === "sm --help" || path === "sm --version";
@@ -12080,8 +12094,7 @@ function renderCompactOverview(verbs) {
 var RootHelpCommand = class extends Command15 {
   static paths = [["-h"], ["--help"]];
   async execute() {
-    const rawDefs = this.cli.definitions();
-    const verbs = rawDefs.filter((d) => !isBuiltin(d)).map(normalizeDefinition).sort(byPath);
+    const verbs = buildVerbCatalog(this.cli);
     this.context.stdout.write(renderCompactOverview(verbs));
     return ExitCode.Ok;
   }
@@ -12209,8 +12222,7 @@ var HooksInstallCommand = class extends SmCommand {
   // in `computePlannedHookContent` and `findGitRepoRoot`.
   // eslint-disable-next-line complexity
   async run() {
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const okGlyph = ansi.green("\u2713");
     const errGlyph = ansi.red("\u2715");
     if (this.flavour !== "pre-commit-bump") {
@@ -14297,8 +14309,7 @@ var InitCommand = class extends SmCommand {
     const ignorePath = defaultIgnoreFilePath(scopeRoot);
     const dbPath = defaultDbPath(scopeRoot);
     if (await pathExists(settingsPath) && !this.force) {
-      const stderr = this.context.stderr;
-      const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+      const stderrAnsi = this.ansiFor("stderr");
       this.printer.error(
         tx(INIT_TEXTS.alreadyInitialised, {
           glyph: stderrAnsi.red("\u2715"),
@@ -14328,15 +14339,14 @@ var InitCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     await mkdir3(skillMapDir, { recursive: true });
-    await writeFile(settingsPath, JSON.stringify({ schemaVersion: 1 }, null, 2) + "\n");
+    writeFileAtomicExclusive(settingsPath, JSON.stringify({ schemaVersion: 1 }, null, 2) + "\n");
     if (!await pathExists(localPath) || this.force) {
-      await writeFile(localPath, "{}\n");
+      writeFileAtomicExclusive(localPath, "{}\n");
     }
     if (!await pathExists(ignorePath) || this.force) {
-      await writeFile(ignorePath, loadBundledIgnoreText());
+      writeFileAtomicExclusive(ignorePath, loadBundledIgnoreText());
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const okGlyph = ansi.green("\u2713");
     if (!this.global) {
       const updated = await ensureGitignoreEntries(scopeRoot, GITIGNORE_ENTRIES);
@@ -14625,8 +14635,7 @@ var HistoryCommand = class extends SmCommand {
   // validations from the filter they shape.
   // eslint-disable-next-line complexity
   async run() {
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const filter = {};
     if (this.node !== void 0) filter.nodePath = this.node;
     if (this.action !== void 0) filter.actionId = this.action;
@@ -14660,8 +14669,7 @@ var HistoryCommand = class extends SmCommand {
       } else if (rows.length === 0) {
         this.printer.data(HISTORY_TEXTS.noExecutionsFound);
       } else {
-        const stdout = this.context.stdout;
-        const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+        const ansi = this.ansiFor("stdout");
         this.printer.data(renderTable(rows, ansi));
       }
       return ExitCode.Ok;
@@ -14698,8 +14706,7 @@ var HistoryStatsCommand = class extends SmCommand {
   // eslint-disable-next-line complexity
   async run() {
     const elapsed = this.elapsed;
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     let sinceMs = null;
     let untilMs = Date.now();
@@ -14772,8 +14779,7 @@ var HistoryStatsCommand = class extends SmCommand {
         }
         this.printer.data(JSON.stringify(stats) + "\n");
       } else {
-        const stdout = this.context.stdout;
-        const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+        const ansi = this.ansiFor("stdout");
         this.printer.data(renderStats(stats, ansi));
       }
       return ExitCode.Ok;
@@ -15054,12 +15060,11 @@ var JobPruneCommand = class extends SmCommand {
   });
   async run() {
     const ctx = defaultRuntimeContext();
-    const dbPath = defaultProjectDbPath(ctx);
+    const dbPath = resolveDbPath({ global: this.global, db: this.db, ...ctx });
     const jobsDir = defaultProjectJobsDir(ctx);
     const exit = requireDbOrExit(dbPath, this.context.stderr);
     if (exit !== null) return exit;
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     let cfg;
     try {
@@ -15258,8 +15263,7 @@ var ListCommand = class extends SmCommand {
   tag = Option19.String("--tag", { required: false });
   tagSource = Option19.String("--tag-source", { required: false });
   async run() {
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const flags = this.#parseFlags(stderrAnsi);
     if (!flags.ok) return flags.exit;
     const dbPath = resolveDbPath({ global: this.global, db: this.db, ...defaultRuntimeContext() });
@@ -15336,8 +15340,7 @@ var ListCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     if (nodes.length === 0) return this.#renderEmpty();
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(renderTable2(nodes, issuesByNode, ansi));
     return ExitCode.Ok;
   }
@@ -15551,8 +15554,7 @@ var OrphansCommand = class extends SmCommand {
   });
   kind = Option20.String("--kind", { required: false });
   async run() {
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     let analyzerFilter = null;
     if (this.kind !== void 0) {
       const map = {
@@ -15581,8 +15583,7 @@ var OrphansCommand = class extends SmCommand {
         if (analyzerFilter !== null) return issue.analyzerId === analyzerFilter;
         return true;
       });
-      const stdout = this.context.stdout;
-      const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stdout");
       if (this.json) {
         this.printer.data(
           JSON.stringify(found.map((f) => f.issue)) + "\n"
@@ -15623,8 +15624,7 @@ var OrphansReconcileCommand = class extends SmCommand {
     const dbPath = resolveDbPath({ global: this.global, db: this.db, ...defaultRuntimeContext() });
     const exit = requireDbOrExit(dbPath, this.context.stderr);
     if (exit !== null) return exit;
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     return withSqlite({ databasePath: dbPath, autoBackup: false }, async (adapter) => {
       const target = await adapter.scans.findNode(this.to);
@@ -15669,8 +15669,7 @@ var OrphansReconcileCommand = class extends SmCommand {
         },
         dryRun
       );
-      const stdout = this.context.stdout;
-      const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stdout");
       const totalRows = summaryTotal(summary);
       const breakdown = tx(ORPHANS_TEXTS.reconcileBreakdown, {
         rows: totalRows,
@@ -15749,8 +15748,7 @@ var OrphansUndoRenameCommand = class extends SmCommand {
     const dbPath = resolveDbPath({ global: this.global, db: this.db, ...defaultRuntimeContext() });
     const exit = requireDbOrExit(dbPath, this.context.stderr);
     if (exit !== null) return exit;
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     return withSqlite({ databasePath: dbPath, autoBackup: false }, async (adapter) => {
       const candidates = await findActiveOrphanIssues(adapter, (issue2) => {
@@ -15820,8 +15818,7 @@ var OrphansUndoRenameCommand = class extends SmCommand {
         },
         dryRun
       );
-      const stdout = this.context.stdout;
-      const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stdout");
       const rows = summaryTotal(summary);
       if (dryRun) {
         this.printer.data(
@@ -15869,8 +15866,7 @@ var OrphansUndoRenameCommand = class extends SmCommand {
     return this.#resolveFromAmbiguous(issue);
   }
   #resolveFromMedium(issue) {
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     const dataFrom = issue.data ? issue.data["from"] : void 0;
     if (typeof dataFrom !== "string") {
@@ -15895,8 +15891,7 @@ var OrphansUndoRenameCommand = class extends SmCommand {
     return { ok: true, from: dataFrom };
   }
   #resolveFromAmbiguous(issue) {
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     if (this.from === void 0) {
       this.printer.error(
@@ -16227,8 +16222,7 @@ var PluginsListCommand = class extends SmCommand {
       this.printer.data(PLUGINS_TEXTS.listEmpty);
       return ExitCode.Ok;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(renderListHuman(builtIns2, plugins, ansi));
     return ExitCode.Ok;
   }
@@ -16330,8 +16324,7 @@ var PluginsShowCommand = class extends SmCommand {
     const plugins = await loadAll({ global: this.global, pluginDir: this.pluginDir });
     const resolveEnabled = await buildResolver(this.global);
     const builtIns2 = builtInRows(resolveEnabled);
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const lookupResult = resolveShowLookupId(this.id, builtIns2, plugins, stderrAnsi);
     if ("error" in lookupResult) {
       this.printer.error(lookupResult.error);
@@ -16355,8 +16348,7 @@ var PluginsShowCommand = class extends SmCommand {
       this.printer.data(JSON.stringify(payload, omitModule, 2) + "\n");
       return ExitCode.Ok;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const text = builtIn ? renderBuiltInDetail(builtIn, ansi) : renderPluginDetail(match, ansi);
     this.printer.data(text);
     return ExitCode.Ok;
@@ -16569,8 +16561,7 @@ var PluginsDoctorCommand = class extends SmCommand {
       this.printer.data(JSON.stringify(envelope) + "\n");
       return bad.length > 0 ? ExitCode.Issues : ExitCode.Ok;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.#renderSummaryHeader(counts.enabled, bad.length, totalWarnings);
     this.#renderSourceBreakdown(builtIns2.length, plugins.length);
     this.#renderStatusBreakdown(counts, ansi);
@@ -16890,8 +16881,7 @@ var TogglePluginsBase = class extends SmCommand {
   id = Option24.String({ required: false });
   async toggle(enabled) {
     const verb = enabled ? "enable" : "disable";
-    const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const argError = this.#validateArgs(stderrAnsi);
     if (argError !== null) return argError;
     const plugins = await loadAll({ global: this.global, pluginDir: void 0 });
@@ -17155,8 +17145,7 @@ var PluginsCreateCommand = class extends SmCommand {
   at = Option25.String("--at", { required: false });
   force = Option25.Boolean("--force", false);
   async run() {
-    const stderr = this.context.stderr;
-    const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stderr");
     const errGlyph = ansi.red("\u2715");
     if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(this.pluginId)) {
       this.printer.error(
@@ -17342,8 +17331,7 @@ var PluginsSlotsListCommand = class extends SmCommand {
       );
       return ExitCode.Ok;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const idWidth = Math.max(
       ...VIEW_SLOTS_CATALOG.map((c) => c.id.length),
       ...INPUT_TYPES_CATALOG.map((t) => t.id.length)
@@ -17489,8 +17477,7 @@ var RefreshCommand = class extends SmCommand {
   // `#resolveTargetNodes` and `#runExtractorsAcrossNodes`.
   // eslint-disable-next-line complexity
   async run() {
-    const stderrEarly = this.context.stderr;
-    const ansiEarly = ansiFor({ isTTY: stderrEarly.isTTY === true, noColorFlag: this.noColor });
+    const ansiEarly = this.ansiFor("stderr");
     const errGlyph = ansiEarly.red("\u2715");
     if (this.stale && this.nodePath !== void 0) {
       this.printer.info(tx(REFRESH_TEXTS.nodeAndStaleMutex, { glyph: errGlyph }));
@@ -17501,7 +17488,7 @@ var RefreshCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const ctx = defaultRuntimeContext();
-    const dbPath = defaultProjectDbPath(ctx);
+    const dbPath = resolveDbPath({ global: this.global, db: this.db, ...ctx });
     const pluginRuntime = this.noPlugins ? emptyPluginRuntime() : await loadPluginRuntime({ scope: "project" });
     pluginRuntime.emitWarnings(this.printer);
     listBuiltIns();
@@ -17511,8 +17498,7 @@ var RefreshCommand = class extends SmCommand {
       killSwitches: readConformanceKillSwitches()
     });
     const allExtractors = composed?.extractors ?? [];
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const persisted = await tryWithSqlite(
       { databasePath: dbPath, autoBackup: false },
       async (adapter) => {
@@ -17697,8 +17683,7 @@ var RefreshCommand = class extends SmCommand {
         body = stripFrontmatterFence(raw);
       } catch (err) {
         if (!this.json) {
-          const stderr = this.context.stderr;
-          const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+          const ansi = this.ansiFor("stderr");
           this.printer.info(
             tx(REFRESH_TEXTS.refreshFailed, {
               glyph: ansi.red("\u2715"),
@@ -17749,7 +17734,21 @@ import { Command as Command31, Option as Option29 } from "clipanion";
 // cli/i18n/scan.texts.ts
 var SCAN_TEXTS = {
   // --- scan command ----------------------------------------------------
-  watchCannotCombine: "{{glyph}}  --watch cannot be combined with --no-built-ins, --dry-run, --changed, or --allow-empty.\n",
+  /**
+   * Per-flag rejection messages for `sm scan --watch` combos. The
+   * watcher is incremental-only and always persists, so flags that
+   * change those invariants are mutually exclusive with `--watch`.
+   * Each entry follows the §3.1b two-line block (headline + dim hint)
+   * so the user can act without re-reading `--help`.
+   */
+  watchVsNoBuiltIns: "{{glyph}}  --watch cannot be combined with --no-built-ins.\n   {{hint}}\n",
+  watchVsNoBuiltInsHint: "Drop --no-built-ins or use --watch alone. The watcher always persists, an empty pipeline has nothing to persist.",
+  watchVsDryRun: "{{glyph}}  --watch cannot be combined with --dry-run.\n   {{hint}}\n",
+  watchVsDryRunHint: "Drop --dry-run or use --watch alone. The watcher always persists each incremental batch.",
+  watchVsChanged: "{{glyph}}  --watch cannot be combined with --changed.\n   {{hint}}\n",
+  watchVsChangedHint: "Drop --changed or use --watch alone. The watcher is incremental by definition.",
+  watchVsAllowEmpty: "{{glyph}}  --watch cannot be combined with --allow-empty.\n   {{hint}}\n",
+  watchVsAllowEmptyHint: "Drop --allow-empty or use --watch alone. The watcher never produces a zero-result wipe.",
   changedWithoutBuiltIns: "{{glyph}}  --changed and --no-built-ins cannot be combined.\n   {{hint}}\n",
   changedWithoutBuiltInsHint: "--no-built-ins yields a zero-filled ScanResult, leaving nothing to merge against.",
   /**
@@ -18154,12 +18153,12 @@ async function runWatchLoop(opts) {
     stderr: context.stderr
   });
   const runtimeCtx = defaultRuntimeContext();
-  const dbPath = defaultProjectDbPath(runtimeCtx);
+  const dbPath = resolveDbPath({ global: opts.global, db: opts.db, ...runtimeCtx });
   const breakerLimit = opts.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
   const stdoutTty = context.stdout;
-  const ansi = ansiFor({ isTTY: stdoutTty.isTTY === true, noColorFlag: false });
+  const ansi = ansiFor({ isTTY: stdoutTty.isTTY === true, noColorFlag: opts.noColor });
   const stderrTty = context.stderr;
-  const stderrAnsi = ansiFor({ isTTY: stderrTty.isTTY === true, noColorFlag: false });
+  const stderrAnsi = ansiFor({ isTTY: stderrTty.isTTY === true, noColorFlag: opts.noColor });
   const errGlyph = stderrAnsi.red("\u2715");
   let initialDone = false;
   const renderBatch = (result) => {
@@ -18324,13 +18323,16 @@ var WatchCommand = class extends SmCommand {
   emitElapsed = false;
   async run() {
     const roots = this.roots.length > 0 ? this.roots : ["."];
-    const breaker = parseBreakerLimit(this.maxConsecutiveFailures, this.context.stderr);
+    const breaker = parseBreakerLimit(this.maxConsecutiveFailures, this.context.stderr, this.noColor);
     if (breaker === null) return ExitCode.Error;
     const watchOpts = {
       roots,
       json: this.json,
       noTokens: this.noTokens,
       strict: this.strict,
+      noColor: this.noColor,
+      global: this.global,
+      db: this.db,
       noPlugins: this.noPlugins,
       context: this.context,
       printer: this.printer
@@ -18339,12 +18341,12 @@ var WatchCommand = class extends SmCommand {
     return runWatchLoop(watchOpts);
   }
 };
-function parseBreakerLimit(raw, stderr) {
+function parseBreakerLimit(raw, stderr, noColor) {
   if (raw === void 0) return void 0;
   const parsed = tryParseNonNegativeInt(raw);
   if (parsed === null) {
     const stderrTty = stderr;
-    const ansi = ansiFor({ isTTY: stderrTty.isTTY === true, noColorFlag: false });
+    const ansi = ansiFor({ isTTY: stderrTty.isTTY === true, noColorFlag: noColor });
     stderr.write(
       tx(WATCH_TEXTS.maxConsecutiveFailuresInvalid, { glyph: ansi.red("\u2715"), raw })
     );
@@ -18423,8 +18425,7 @@ var ScanCommand = class extends SmCommand {
   async run() {
     if (this.watch) return this.runWatchAlias();
     if (this.changed && this.noBuiltIns) {
-      const stderr = this.context.stderr;
-      const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stderr");
       this.printer.info(
         tx(SCAN_TEXTS.changedWithoutBuiltIns, {
           glyph: ansi.red("\u2715"),
@@ -18434,8 +18435,7 @@ var ScanCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     if (this.global === true) {
-      const stderr = this.context.stderr;
-      const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stderr");
       this.printer.info(
         tx(SCAN_TEXTS.globalNotSupported, { glyph: ansi.red("\u2715") })
       );
@@ -18466,10 +18466,15 @@ var ScanCommand = class extends SmCommand {
    * always persists incrementally over the prior snapshot.
    */
   async runWatchAlias() {
-    if (this.noBuiltIns || this.dryRun || this.changed || this.allowEmpty) {
-      const stderr = this.context.stderr;
-      const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
-      this.printer.info(tx(SCAN_TEXTS.watchCannotCombine, { glyph: ansi.red("\u2715") }));
+    const conflict = this.#firstWatchConflict();
+    if (conflict !== null) {
+      const ansi = this.ansiFor("stderr");
+      this.printer.info(
+        tx(conflict.template, {
+          glyph: ansi.red("\u2715"),
+          hint: ansi.dim(conflict.hint)
+        })
+      );
       return ExitCode.Error;
     }
     this.emitElapsed = false;
@@ -18479,15 +18484,39 @@ var ScanCommand = class extends SmCommand {
       json: this.json,
       noTokens: this.noTokens,
       strict: this.strict,
+      noColor: this.noColor,
+      global: this.global,
+      db: this.db,
       noPlugins: this.noPlugins,
       context: this.context,
       printer: this.printer
     });
   }
+  /**
+   * Detect the first `--watch` combo conflict in flag-declaration order
+   * and return the catalog entries (full template + dim hint) that
+   * `runWatchAlias` renders for it. Returns `null` when no conflict
+   * is active. Order matches the historic message so reading the
+   * branch top-down still tells the user which flag fired first.
+   */
+  #firstWatchConflict() {
+    if (this.noBuiltIns) {
+      return { template: SCAN_TEXTS.watchVsNoBuiltIns, hint: SCAN_TEXTS.watchVsNoBuiltInsHint };
+    }
+    if (this.dryRun) {
+      return { template: SCAN_TEXTS.watchVsDryRun, hint: SCAN_TEXTS.watchVsDryRunHint };
+    }
+    if (this.changed) {
+      return { template: SCAN_TEXTS.watchVsChanged, hint: SCAN_TEXTS.watchVsChangedHint };
+    }
+    if (this.allowEmpty) {
+      return { template: SCAN_TEXTS.watchVsAllowEmpty, hint: SCAN_TEXTS.watchVsAllowEmptyHint };
+    }
+    return null;
+  }
   /** Render the failure branch of `IScanRunResult` to stderr. */
   renderFailure(outcome) {
-    const stderr = this.context.stderr;
-    const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stderr");
     const errGlyph = ansi.red("\u2715");
     if (outcome.kind === "guard-trip") {
       this.printer.info(
@@ -18514,8 +18543,7 @@ var ScanCommand = class extends SmCommand {
     if (this.json) {
       return this.#renderJsonOutcome(result, exitCode2, strict);
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const cwd = defaultRuntimeContext().cwd;
     const hasErrors = exitCode2 === ExitCode.Issues;
     const issuesCount = result.stats.issuesCount;
@@ -18557,8 +18585,7 @@ var ScanCommand = class extends SmCommand {
       const validators = loadSchemaValidators();
       const validation = validators.validate("scan-result", result);
       if (!validation.ok) {
-        const stderr = this.context.stderr;
-        const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+        const ansi = this.ansiFor("stderr");
         this.printer.info(
           tx(SCAN_TEXTS.jsonSelfValidationFailed, {
             glyph: ansi.red("\u2715"),
@@ -18690,8 +18717,7 @@ var ScanCompareCommand = class extends SmCommand {
       this.printer.data(JSON.stringify(delta) + "\n");
       return exitCode2;
     }
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(renderDeltaHuman(delta, ansi));
     return exitCode2;
   }
@@ -19169,6 +19195,19 @@ function originGuarded(path) {
   return false;
 }
 
+// server/security-headers.ts
+var DEFAULT_CSP = "frame-ancestors 'none'; base-uri 'self'; form-action 'self'";
+function createSecurityHeaders() {
+  return async (c, next) => {
+    await next();
+    const h = c.res.headers;
+    if (!h.has("content-security-policy")) h.set("content-security-policy", DEFAULT_CSP);
+    if (!h.has("x-frame-options")) h.set("x-frame-options", "DENY");
+    if (!h.has("x-content-type-options")) h.set("x-content-type-options", "nosniff");
+    if (!h.has("referrer-policy")) h.set("referrer-policy", "no-referrer");
+  };
+}
+
 // server/routes/annotations.ts
 var ENVELOPE_KIND = "annotations.registered";
 function registerAnnotationsRoute(app, deps) {
@@ -20482,6 +20521,16 @@ var ScanBusyError = class extends Error {
   }
 };
 
+// server/util/noop-writable.ts
+import { Writable } from "stream";
+function noopWritable() {
+  return new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+}
+
 // server/events.ts
 function buildWatcherStartedEvent(data) {
   return {
@@ -20604,7 +20653,7 @@ async function runPersistedScan(c, deps) {
         changed: false,
         allowEmpty: true,
         strict: false,
-        stderr: process.stderr,
+        stderr: noopWritable(),
         ctx: deps.runtimeContext,
         pluginRuntime: deps.pluginRuntime,
         resolveEnabledOverride,
@@ -20696,7 +20745,7 @@ async function runFreshScan(deps) {
     changed: false,
     allowEmpty: true,
     strict: false,
-    stderr: process.stderr,
+    stderr: noopWritable(),
     ctx: deps.runtimeContext,
     // M3: reuse the boot-cached pluginRuntime so a fresh scan over
     // the BFF doesn't re-walk `.skill-map/plugins/` per request. A
@@ -20855,7 +20904,7 @@ async function loadNode(deps, nodePath) {
   const node = persisted?.nodes.find((n) => n.path === nodePath);
   if (!node) {
     throw new HTTPException12(404, {
-      message: tx(SERVER_TEXTS.nodeNotFound, { path: nodePath })
+      message: tx(SERVER_TEXTS.nodeNotFound, { path: sanitizeForTerminal(nodePath) })
     });
   }
   return node;
@@ -21080,6 +21129,7 @@ function createApp(deps) {
     homedir: deps.runtimeContext.homedir
   });
   app.use("*", createLoopbackGate({ port: deps.options.port }));
+  app.use("*", createSecurityHeaders());
   app.use(
     "/api/*",
     bodyLimit({
@@ -22330,8 +22380,7 @@ var ShowCommand = class extends SmCommand {
         this.printer.data(JSON.stringify(doc) + "\n");
         return ExitCode.Ok;
       }
-      const stdout = this.context.stdout;
-      const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+      const ansi = this.ansiFor("stdout");
       this.printer.data(renderHuman2(doc, ansi));
       return ExitCode.Ok;
     });
@@ -22653,8 +22702,7 @@ var SidecarRefreshCommand = class extends SmCommand {
   async run() {
     const ctx = defaultRuntimeContext();
     const dbPath = resolveDbPath({ global: this.global, db: this.db, ...ctx });
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const okGlyph = ansi.green("\u2713");
     const errGlyph = ansi.red("\u2715");
     return runWithSidecarConsent(
@@ -22801,8 +22849,7 @@ var SidecarPruneCommand = class extends SmCommand {
   async run() {
     const ctx = defaultRuntimeContext();
     const orphans = discoverOrphanSidecars([ctx.cwd]);
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const okGlyph = ansi.green("\u2713");
     const warnGlyph = ansi.yellow("\u26A0");
     const infoGlyph = ansi.cyan("\u2139");
@@ -22937,8 +22984,7 @@ var SidecarAnnotateCommand = class extends SmCommand {
   async run() {
     const ctx = defaultRuntimeContext();
     const dbPath = resolveDbPath({ global: this.global, db: this.db, ...ctx });
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const errGlyph = ansi.red("\u2715");
     return runWithSidecarConsent(
       {
@@ -23082,8 +23128,7 @@ function planned(description) {
 var StubCommand = class extends SmCommand {
   emitElapsed = false;
   async run() {
-    const stderr = this.context.stderr;
-    const ansi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stderr");
     this.printer.error(
       tx(STUBS_TEXTS.notImplemented, {
         glyph: ansi.yellow("\u22EF"),
@@ -23301,7 +23346,7 @@ var TutorialCommand = class extends SmCommand {
     const ctx = defaultRuntimeContext();
     const target = join17(ctx.cwd, SM_TUTORIAL_FILENAME);
     const stderr = this.context.stderr;
-    const stderrAnsi = ansiFor({ isTTY: stderr.isTTY === true, noColorFlag: this.noColor });
+    const stderrAnsi = this.ansiFor("stderr");
     const errGlyph = stderrAnsi.red("\u2715");
     if (await pathExists(target) && !this.force) {
       this.printer.error(
@@ -23342,8 +23387,7 @@ var TutorialCommand = class extends SmCommand {
       env: process.env
     });
     this.printer.info(renderLogoBlock({ version: VERSION, colorEnabled }));
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     this.printer.data(
       tx(TUTORIAL_TEXTS.written, {
         glyph: ansi.green("\u2713"),
@@ -23429,8 +23473,7 @@ var VersionCommand = class extends SmCommand {
       ["runtime", runtime],
       ["db-schema", dbSchema]
     ];
-    const stdout = this.context.stdout;
-    const ansi = ansiFor({ isTTY: stdout.isTTY === true, noColorFlag: this.noColor });
+    const ansi = this.ansiFor("stdout");
     const pad = Math.max(...lines.map(([k]) => k.length));
     for (const [k, v] of lines) {
       this.printer.data(
@@ -23458,7 +23501,8 @@ async function resolveDbSchemaVersion() {
     );
     if (v === null || v === void 0) return "-";
     return String(v);
-  } catch {
+  } catch (error) {
+    log.debug(`sm version: dbSchema read failed: ${error instanceof Error ? error.message : String(error)}`);
     return "-";
   }
 }