@skill-map/cli 0.37.0 → 0.38.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 // cli/entry.ts
-import { existsSync as existsSync33 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 import { Builtins, Cli as Cli2 } from "clipanion";
 
 // kernel/adapters/in-memory-progress.ts
@@ -61,7 +61,7 @@ var DuplicateExtensionError = class extends Error {
   }
 };
 var Registry = class {
-  /** kind → qualifiedId → Extension. */
+  /** kind → qualifiedId → IExtension. */
   #byKind;
   constructor() {
     this.#byKind = new Map(
@@ -429,10 +429,17 @@ var command_schema_default = {
   properties: {}
 };
 
+// plugins/ids.ts
+var CORE_PLUGIN_ID = "core";
+var CLAUDE_PLUGIN_ID = "claude";
+var OPENAI_PLUGIN_ID = "openai";
+var ANTIGRAVITY_PLUGIN_ID = "antigravity";
+var AGENT_SKILLS_PLUGIN_ID = "agent-skills";
+
 // plugins/claude/providers/claude/index.ts
 var claudeProvider = {
   id: "claude",
-  pluginId: "claude",
+  pluginId: CLAUDE_PLUGIN_ID,
   kind: "provider",
   version: "1.0.0",
   description: "Walks Claude Code scope conventions (.claude/{agents,commands,skills}).",
@@ -657,9 +664,9 @@ function stripFences(input) {
       }
       continue;
     }
-    const open = FENCE_RE.exec(line);
-    if (open?.groups) {
-      openFence = open.groups["fence"];
+    const open2 = FENCE_RE.exec(line);
+    if (open2?.groups) {
+      openFence = open2.groups["fence"];
       out.push(blank(line));
       continue;
     }
@@ -717,7 +724,7 @@ var AT_RE = /(?:^|[^A-Za-z0-9_@])(@(?:\.{1,2}\/|\/)?[a-z0-9](?:[a-z0-9_\-./]*[a-
 var FILE_EXT_RE = /\.(md|mdx|js|jsx|ts|tsx|json|yml|yaml|toml|txt|html|css|scss|less|py|rb|go|rs|java|c|cpp|h|hpp|sh|sql|svg|png|jpg|jpeg|gif|webp|pdf)$/i;
 var atDirectiveExtractor = {
   id: ID,
-  pluginId: "claude",
+  pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Detects `@<token>` directives in a node's body using Claude Code interpretation rules. A bare handle (e.g. `@team`) becomes a `mentions` link; a file-flavoured token (e.g. `@docs/api.md`, `@./readme.md`) becomes a `references` link. Gated by `precondition.provider: ['claude']` so Antigravity / Cursor / Codex apply their own at-directive flavours via their own extractors.",
@@ -806,7 +813,7 @@ var ID2 = "slash";
 var SLASH_RE = /(?<![A-Za-z0-9_/.:?#=&])(\/[a-z0-9][a-z0-9_-]*(?::[a-z0-9][a-z0-9_-]*)?)/gi;
 var slashExtractor = {
   id: ID2,
-  pluginId: "claude",
+  pluginId: CLAUDE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Detects `/command` invocations in a node's body using Claude Code routing rules and turns each one into an arrow between nodes in the graph. Gated by `precondition.provider: ['claude']` so Antigravity / Cursor / Codex apply their own slash flavours (Antigravity ships subagent and skill panels, Codex deprecated user slash commands, etc.) via their own extractors.",
@@ -856,7 +863,7 @@ var slashExtractor = {
 // plugins/antigravity/providers/antigravity/index.ts
 var antigravityProvider = {
   id: "antigravity",
-  pluginId: "antigravity",
+  pluginId: ANTIGRAVITY_PLUGIN_ID,
   kind: "provider",
   version: "1.0.0",
   description: "Google Antigravity CLI. Replaces the retired Gemini CLI; skills route through the neutral `agent-skills` Provider via `.agents/skills/`. This Provider contributes lens identity and a reserved-name seed catalog.",
@@ -1005,7 +1012,7 @@ var agent_schema_default2 = {
 // plugins/openai/providers/openai/index.ts
 var openaiProvider = {
   id: "openai",
-  pluginId: "openai",
+  pluginId: OPENAI_PLUGIN_ID,
   kind: "provider",
   version: "1.0.0",
   description: "Walks OpenAI Codex CLI scope conventions (.codex/agents/*.toml).",
@@ -1063,7 +1070,7 @@ var skill_schema_default2 = {
 // plugins/agent-skills/providers/agent-skills/index.ts
 var agentSkillsProvider = {
   id: "agent-skills",
-  pluginId: "agent-skills",
+  pluginId: AGENT_SKILLS_PLUGIN_ID,
   kind: "provider",
   version: "1.0.0",
   description: "Agent Skills open standard. Vendor-neutral path `.agents/skills/<name>/SKILL.md` (Anthropic, OpenAI, Google). See agentskills.io.",
@@ -1111,7 +1118,7 @@ var markdown_schema_default = {
 // plugins/core/providers/core-markdown/index.ts
 var coreMarkdownProvider = {
   id: "markdown",
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "provider",
   version: "1.0.0",
   description: "Universal `.md` fallback. Claims any markdown file no vendor-specific Provider classifies.",
@@ -1162,7 +1169,7 @@ var coreMarkdownProvider = {
 var ID3 = "annotations";
 var annotationsExtractor = {
   id: ID3,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Turns the `supersedes` and `supersededBy` entries you write in a node's `.sm` sidecar into the arrows (edges) shown between nodes in the graph.",
@@ -1224,7 +1231,7 @@ var URL_RE = /https?:\/\/[^\s<>"'`)\]]+/g;
 var TRAILING_PUNCT = /[.,;:!?]+$/;
 var externalUrlCounterExtractor = {
   id: ID4,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Counts the distinct external URLs in a node's body and shows the total on the card.",
@@ -1313,7 +1320,7 @@ var LINK_RE = /(?<!!)\[([^\]]*)\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g;
 var URL_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
 var markdownLinkExtractor = {
   id: ID5,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Detects markdown links (`[text](path)`) in a node's body and turns each one into an arrow between nodes in the graph.",
@@ -1375,7 +1382,7 @@ var ID6 = "mcp-tools";
 var MCP_PATTERN = /^mcp__([a-z0-9][a-z0-9_-]*)__[a-z0-9_-]+$/i;
 var mcpToolsExtractor = {
   id: ID6,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Detects `tools: [mcp__<server>__<tool>]` entries in a node's frontmatter and turns each unique server into an MCP node + a reference edge from the source.",
@@ -1437,7 +1444,7 @@ var ID7 = "tools-count";
 var TOOLTIP_MAX = 255;
 var toolsCountExtractor = {
   id: ID7,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "extractor",
   version: "1.0.0",
   description: "Counts the tools an agent declares in its frontmatter and shows the total on the agent card.",
@@ -1482,7 +1489,7 @@ var ANNOTATION_ORPHAN_TEXTS = {
 var ID8 = "annotation-orphan";
 var annotationOrphanAnalyzer = {
   id: ID8,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and flags sidecars (`.sm`) whose `.md` no longer exists.",
@@ -1534,7 +1541,7 @@ var ANNOTATION_STALE_TEXTS = {
 var ID9 = "annotation-stale";
 var annotationStaleAnalyzer = {
   id: ID9,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and marks sidecars (`.sm`) out of date of their `.md`.",
@@ -1617,7 +1624,7 @@ var BROKEN_REF_TEXTS = {
 var ID10 = "broken-ref";
 var brokenRefAnalyzer = {
   id: ID10,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and flags arrows pointing at a node not part of the current scan.",
@@ -1782,7 +1789,7 @@ function isPathStyleLink(link) {
 var ID11 = "contribution-orphan";
 var contributionOrphanAnalyzer = {
   id: ID11,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "0.0.0",
   description: "Detects and warns about plugin data referencing nodes renamed or deleted in the latest scan.",
@@ -1805,7 +1812,7 @@ var JOB_ORPHAN_FILE_TEXTS = {
 var ID12 = "job-orphan-file";
 var jobOrphanFileAnalyzer = {
   id: ID12,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and flags leftover job result files (no live job references them). Cleanup via `sm job prune --orphan-files`.",
@@ -1954,7 +1961,7 @@ function resolveLinkTargetToPath(link, nameIndex) {
 var ID14 = "link-counts";
 var linkCountsAnalyzer = {
   id: ID14,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Counts incoming and outgoing links per node.",
@@ -2037,7 +2044,7 @@ var REDUNDANT_TARGET_REFERENCE_TEXTS = {
 var ID15 = "redundant-target-reference";
 var redundantTargetReferenceAnalyzer = {
   id: ID15,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Flags when one node references the same resolved target via two or more syntactic surfaces (cross-extractor multi-form OR cross-kind multi-edge). Emits a warn on the source listing every occurrence (kind + trigger + line). Helps consolidate authorial redundancy and avoid duplicate runtime inlining.",
@@ -2288,7 +2295,7 @@ var RESERVED_NAME_TEXTS = {
 var ID16 = "reserved-name";
 var reservedNameAnalyzer = {
   id: ID16,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Flags reserved-name collisions on two surfaces. Target side: a user file whose name collides with a Provider runtime's built-in invocable (the runtime shadows the file silently). Source side: a link that resolves to a reserved name, which the post-walk lift transform downgrades to the sentinel `RESERVED_TARGET_CONFIDENCE` (0.1). The two findings share the analyzer id so consumers can group by root cause; the source-side issue carries `data.target` matching the link so UIs can correlate per-row.",
@@ -2397,7 +2404,7 @@ var SELF_LOOP_TEXTS = {
 var ID17 = "self-loop";
 var selfLoopAnalyzer = {
   id: ID17,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Flags links whose source is its own resolved target (a body heading like `# /deploy` inside the file that defines `/deploy`). One warn per self-looping link, attached to the source. UI consumers hide self-loops by default; this analyzer is the authoritative detector.",
@@ -2474,7 +2481,7 @@ var SIGNAL_COLLISION_TEXTS = {
 var ID18 = "signal-collision";
 var signalCollisionAnalyzer = {
   id: ID18,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Surfaces Signal IR resolver rejections (range-overlap losers, disabled extractors, below-floor candidates) as warn issues attached to the Signal's source node.",
@@ -2576,7 +2583,7 @@ var EXPERIMENTAL_TOOLTIP = "Experimental: API may change";
 var DEPRECATED_TOOLTIP = "Deprecated: avoid in new code";
 var stabilityAnalyzer = {
   id: ID19,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Reports node lifecycle stage (`experimental`, `deprecated`) on the card.",
@@ -2657,7 +2664,7 @@ var SUPERSEDED_TEXTS = {
 var ID20 = "superseded";
 var supersededAnalyzer = {
   id: ID20,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and marks nodes replaced by a newer one via `supersededBy`.",
@@ -2725,7 +2732,7 @@ var ADVERTISING_KINDS = /* @__PURE__ */ new Set([
 ]);
 var triggerCollisionAnalyzer = {
   id: ID21,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   mode: "deterministic",
   version: "1.0.0",
@@ -2867,7 +2874,7 @@ var ID22 = "unknown-field";
 var RESERVED_ROOT_BLOCKS = /* @__PURE__ */ new Set(["identity", "annotations", "settings", "audit"]);
 var unknownFieldAnalyzer = {
   id: ID22,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and flags typos or unrecognized keys in sidecars (`.sm`).",
@@ -3263,7 +3270,7 @@ var VALIDATE_ALL_TEXTS = {
 var ID23 = "validate-all";
 var validateAllAnalyzer = {
   id: ID23,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "analyzer",
   version: "1.0.0",
   description: "Detects and flags nodes or links violating the project schemas.",
@@ -3438,7 +3445,7 @@ var ID24 = "ascii";
 var KIND_ORDER = ["agent", "command", "skill", "markdown"];
 var asciiFormatter = {
   id: ID24,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
   formatId: ID24,
   version: "1.0.0",
@@ -3538,7 +3545,7 @@ function renderSection(out, kind, group) {
 var ID25 = "json";
 var jsonFormatter = {
   id: ID25,
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "formatter",
   version: "1.0.0",
   description: "Renders the persisted scan as JSON (conforms to `scan-result.schema.json` when the full ScanResult is available). Used by `sm graph --format json` and `GET /api/graph?format=json`.",
@@ -3682,10 +3689,9 @@ function resolveSpecRoot2() {
 
 // plugins/core/actions/bump/index.ts
 var ID26 = "bump";
-var PLUGIN_ID = "core";
 var bumpAction = {
   id: ID26,
-  pluginId: PLUGIN_ID,
+  pluginId: CORE_PLUGIN_ID,
   kind: "action",
   version: "1.0.0",
   description: "Marks a node as updated: bumps version, refreshes sidecar hashes, records the timestamp.",
@@ -3744,10 +3750,9 @@ function pickCurrentVersion(overlay) {
 
 // plugins/core/actions/mark-superseded/index.ts
 var ID27 = "mark-superseded";
-var PLUGIN_ID2 = "core";
 var markSupersededAction = {
   id: ID27,
-  pluginId: PLUGIN_ID2,
+  pluginId: CORE_PLUGIN_ID,
   kind: "action",
   version: "0.0.0",
   description: "Declares the current node as superseded by another (writes `supersededBy` to the sidecar). Paired with the `core/superseded` analyzer.",
@@ -3856,7 +3861,7 @@ var UPDATE_CHECK_TEXTS = {
 // package.json
 var package_default = {
   name: "@skill-map/cli",
-  version: "0.37.0",
+  version: "0.38.0",
   description: "skill-map reference implementation \u2014 kernel + CLI + adapters.",
   license: "MIT",
   type: "module",
@@ -3939,7 +3944,7 @@ var package_default = {
     semver: "7.7.4",
     "smol-toml": "1.6.1",
     typanion: "3.14.0",
-    ws: "8.20.0"
+    ws: "8.21.0"
   },
   devDependencies: {
     "@eslint/js": "10.0.1",
@@ -4006,10 +4011,67 @@ function ansiFor(opts) {
 }
 
 // cli/util/user-settings-store.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5 } from "fs";
 import { homedir } from "os";
 import { join as join2 } from "path";
 
+// core/config/atomic-write.ts
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync as existsSync2,
+  mkdirSync,
+  openSync,
+  readFileSync as readFileSync4,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { dirname as dirname4 } from "path";
+function readJsonObjectOrEmpty(path) {
+  if (!existsSync2(path)) return {};
+  try {
+    const raw = JSON.parse(readFileSync4(path, "utf8"));
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+      return raw;
+    }
+  } catch {
+  }
+  return {};
+}
+function writeFileAtomicExclusive(path, content, mode = 384) {
+  const tmp = `${path}.tmp.${process.pid}.${randomBytes(8).toString("hex")}`;
+  let fd = null;
+  try {
+    fd = openSync(
+      tmp,
+      fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW,
+      mode
+    );
+    writeSync(fd, content);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, path);
+  } catch (err) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function writeJsonAtomic(path, content) {
+  mkdirSync(dirname4(path), { recursive: true });
+  writeFileAtomicExclusive(path, JSON.stringify(content, null, 2) + "\n");
+}
+
 // core/paths/db-path.ts
 import { join, resolve as resolve6 } from "path";
 var SKILL_MAP_DIR = ".skill-map";
@@ -4067,9 +4129,9 @@ function readUserSettings() {
 }
 function readParsedFile() {
   const path = userSettingsFilePath();
-  if (!existsSync2(path)) return null;
+  if (!existsSync3(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return null;
     }
@@ -4102,8 +4164,8 @@ function writeUserSettings(patch) {
       const result = validators.validate("user-settings", merged);
       if (!result.ok) return;
     }
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(path, JSON.stringify(merged, null, 2) + "\n");
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    writeFileAtomicExclusive(path, JSON.stringify(merged, null, 2) + "\n");
   } catch {
   }
 }
@@ -4214,7 +4276,7 @@ ${footer}
 // plugins/core/hooks/update-check/index.ts
 var updateCheckHook = {
   id: "update-check",
-  pluginId: "core",
+  pluginId: CORE_PLUGIN_ID,
   kind: "hook",
   version: "1.0.0",
   description: "Checks daily for a newer skill-map version on npm. Shows an `update available` banner when one is found.",
@@ -4546,7 +4608,7 @@ function extractLogLevelFlag(argv) {
 var LOGGER_ENV_VAR = ENV_VAR;
 
 // cli/util/db-path.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 
 // cli/i18n/util.texts.ts
 var UTIL_TEXTS = {
@@ -4589,7 +4651,7 @@ var ExitCode = {
 
 // cli/util/db-path.ts
 function assertDbExists(path, stderr) {
-  if (path === ":memory:" || existsSync3(path)) return true;
+  if (path === ":memory:" || existsSync4(path)) return true;
   const stderrTty = stderr;
   const ansi = ansiFor({ isTTY: stderrTty.isTTY === true, noColorFlag: false });
   stderr.write(
@@ -4784,10 +4846,10 @@ import { Command as Command2, Option as Option2 } from "clipanion";
 
 // core/config/helper.ts
 import { homedir as osHomedir } from "os";
-import { isAbsolute, join as join4, resolve as resolve7 } from "path";
+import { isAbsolute, join as join4, resolve as resolve7, sep } from "path";
 
 // kernel/config/loader.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
 
 // kernel/i18n/config-loader.texts.ts
 var CONFIG_LOADER_TEXTS = {
@@ -4869,7 +4931,7 @@ function loadConfig(opts) {
     { path: kernelLocalSettingsPath(cwd), layer: "project-local" }
   ];
   for (const { path, layer } of filePairs) {
-    if (!existsSync4(path)) continue;
+    if (!existsSync5(path)) continue;
     const partial = readJsonSafe(path, layer, warnings, strict);
     if (partial === null) continue;
     const cleaned = validateAndStrip(validators, partial, layer, warnings, strict);
@@ -4890,7 +4952,7 @@ function loadConfig(opts) {
 function readJsonSafe(path, layer, warnings, strict) {
   let text;
   try {
-    text = readFileSync5(path, "utf8");
+    text = readFileSync6(path, "utf8");
   } catch (err) {
     return reportAndSkip(
       tx(CONFIG_LOADER_TEXTS.readFailure, { layer, path, message: formatErrorMessage(err) }),
@@ -5132,63 +5194,6 @@ function enumerateConfigPaths(obj, prefix = "") {
   return out;
 }
 
-// core/config/atomic-write.ts
-import {
-  closeSync,
-  constants as fsConstants,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
-  openSync,
-  readFileSync as readFileSync6,
-  renameSync,
-  unlinkSync,
-  writeSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { dirname as dirname4 } from "path";
-function readJsonObjectOrEmpty(path) {
-  if (!existsSync5(path)) return {};
-  try {
-    const raw = JSON.parse(readFileSync6(path, "utf8"));
-    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-      return raw;
-    }
-  } catch {
-  }
-  return {};
-}
-function writeFileAtomicExclusive(path, content, mode = 384) {
-  const tmp = `${path}.tmp.${process.pid}.${randomBytes(8).toString("hex")}`;
-  let fd = null;
-  try {
-    fd = openSync(
-      tmp,
-      fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW,
-      mode
-    );
-    writeSync(fd, content);
-    closeSync(fd);
-    fd = null;
-    renameSync(tmp, path);
-  } catch (err) {
-    if (fd !== null) {
-      try {
-        closeSync(fd);
-      } catch {
-      }
-    }
-    try {
-      unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
-  }
-}
-function writeJsonAtomic(path, content) {
-  mkdirSync2(dirname4(path), { recursive: true });
-  writeFileAtomicExclusive(path, JSON.stringify(content, null, 2) + "\n");
-}
-
 // core/config/helper.ts
 var PRIVACY_SENSITIVE_KEYS = /* @__PURE__ */ new Set([
   "scan.referencePaths"
@@ -5282,7 +5287,7 @@ function resolveScanPathForExposure(raw, cwd) {
 }
 function isUnderProject(absPath, cwd) {
   const projectRoot = resolve7(cwd);
-  return absPath === projectRoot || absPath.startsWith(`${projectRoot}/`);
+  return absPath === projectRoot || absPath.startsWith(`${projectRoot}${sep}`);
 }
 
 // core/config/sidecar-consent.ts
@@ -5674,7 +5679,11 @@ var SmCommand = class extends Command {
     this.printer = createPrinter({
       stdout: this.context.stdout,
       stderr: this.context.stderr,
-      quietInfo: this.quiet
+      // `--json` suppresses info banners even on stderr: users piping
+      // JSON through `jq` (or asserting machine output in tests) don't
+      // want decorative lines polluting either channel. Aligns CLI
+      // behaviour with the printer docstring.
+      quietInfo: this.quiet || this.json
     });
     try {
       return await this.run();
@@ -7237,9 +7246,9 @@ async function sweepPerTupleContributions(trx, contributions, freshlyRunTuples)
   const bufferKeys = buildContributionsBufferKeys(contributions);
   const tuplesByPluginExt = groupFreshlyRunTuplesByPluginExt(freshlyRunTuples);
   for (const [pe, nodes] of tuplesByPluginExt) {
-    const sep6 = pe.indexOf("\0");
-    if (sep6 < 0) continue;
-    await deleteStaleTupleRows(trx, pe.slice(0, sep6), pe.slice(sep6 + 1), [...nodes], bufferKeys);
+    const sep7 = pe.indexOf("\0");
+    if (sep7 < 0) continue;
+    await deleteStaleTupleRows(trx, pe.slice(0, sep7), pe.slice(sep7 + 1), [...nodes], bufferKeys);
   }
 }
 function buildContributionsBufferKeys(contributions) {
@@ -8018,8 +8027,24 @@ function applyIssueFilters(query, filter) {
       )
     );
   }
+  if (filter.nodePaths !== void 0) {
+    q = applyNodePathsFilter(q, filter.nodePaths);
+  }
   return q;
 }
+function applyNodePathsFilter(query, nodePaths) {
+  if (nodePaths.length === 0) {
+    return query.where(sql3`0`, "=", 1);
+  }
+  const targets = [...nodePaths];
+  return query.where(
+    ({ exists, selectFrom }) => exists(
+      selectFrom(
+        sql3`json_each(scan_issues.node_ids_json)`.as("je")
+      ).select(sql3`1`.as("one")).where(sql3.ref("je.value"), "in", targets)
+    )
+  );
+}
 async function findActiveIssues(db, predicate) {
   const rows = await db.selectFrom("scan_issues").selectAll().execute();
   const out = [];
@@ -8308,15 +8333,32 @@ async function tryWithSqlite(options, fn) {
 import { resolve as resolve14 } from "path";
 
 // core/paths/path-guard.ts
-import { isAbsolute as isAbsolute2, resolve as resolve13, sep } from "path";
+import { lstatSync } from "fs";
+import { isAbsolute as isAbsolute2, resolve as resolve13, sep as sep2 } from "path";
 function assertContained(cwd, rel) {
   if (isAbsolute2(rel)) {
     throw new Error(`node path is absolute, refusing to read: ${rel}`);
   }
   const abs = resolve13(cwd, rel);
-  if (abs !== cwd && !abs.startsWith(cwd + sep)) {
+  if (abs !== cwd && !abs.startsWith(cwd + sep2)) {
     throw new Error(`node path escapes repo root: ${rel}`);
   }
+  let isSymlink;
+  try {
+    isSymlink = lstatSync(abs).isSymbolicLink();
+  } catch (err) {
+    if (isAllowedLstatError(err)) return;
+    throw err;
+  }
+  if (isSymlink) {
+    throw new Error(`node path is a symlink, refusing to dereference: ${rel}`);
+  }
+}
+var ALLOWED_LSTAT_ERROR_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+function isAllowedLstatError(err) {
+  if (err === null || typeof err !== "object") return false;
+  const code = err.code;
+  return typeof code === "string" && ALLOWED_LSTAT_ERROR_CODES.has(code);
 }
 
 // cli/commands/bump-plan.ts
@@ -9259,9 +9301,9 @@ function providerKindFailure(opts, status, fileName, errDescription) {
     }
   };
 }
-function isDirectorySafe(path, statSync13) {
+function isDirectorySafe(path, statSync12) {
   try {
-    return statSync13(path).isDirectory();
+    return statSync12(path).isDirectory();
   } catch {
     return false;
   }
@@ -9855,7 +9897,7 @@ async function buildEnabledResolver(ctx) {
 
 // kernel/scan/walk-content.ts
 import { readFile, readdir, lstat } from "fs/promises";
-import { join as join9, relative as relative2, sep as sep2 } from "path";
+import { join as join9, relative as relative2, sep as sep3 } from "path";
 
 // kernel/scan/ignore.ts
 import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
@@ -10036,7 +10078,7 @@ async function* walkContent(roots, options) {
   const extensions = options.extensions;
   for (const root of roots) {
     for await (const file of walkRoot(root, root, filter, extensions)) {
-      const relPath = relative2(root, file).split(sep2).join("/");
+      const relPath = relative2(root, file).split(sep3).join("/");
       let raw;
       try {
         raw = await readFile(file, "utf8");
@@ -10068,7 +10110,7 @@ async function* walkRoot(root, current, filter, extensions) {
   for (const entry of entries) {
     const name = entry.name;
     const full = join9(current, name);
-    const rel = relative2(root, full).split(sep2).join("/");
+    const rel = relative2(root, full).split(sep3).join("/");
     if (filter.ignores(rel)) continue;
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
@@ -11489,6 +11531,52 @@ function disableEnv(setup) {
   if (setup?.disableAllAnalyzers) env["SKILL_MAP_DISABLE_ALL_ANALYZERS"] = "1";
   return env;
 }
+var SAFE_CONFORMANCE_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "USERPROFILE",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "SystemRoot",
+  "SystemDrive",
+  "OS",
+  "COMSPEC",
+  "PATHEXT",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "NODE_NO_WARNINGS",
+  "NODE_DEBUG",
+  "LANG",
+  "TERM",
+  "COLORTERM",
+  "NO_COLOR",
+  "FORCE_COLOR",
+  "CI"
+];
+var SAFE_CONFORMANCE_ENV_PREFIXES = [
+  "LC_",
+  "SKILL_MAP_",
+  "SM_"
+];
+function pickSafeEnv(source) {
+  const out = {};
+  for (const key of SAFE_CONFORMANCE_ENV_KEYS) {
+    const value = source[key];
+    if (value !== void 0) out[key] = value;
+  }
+  for (const key of Object.keys(source)) {
+    if (out[key] !== void 0) continue;
+    for (const prefix of SAFE_CONFORMANCE_ENV_PREFIXES) {
+      if (key.startsWith(prefix)) {
+        const value = source[key];
+        if (value !== void 0) out[key] = value;
+        break;
+      }
+    }
+  }
+  return out;
+}
 function runConformanceCase(options) {
   const raw = readFileSync14(options.casePath, "utf8");
   const c = JSON.parse(raw);
@@ -11508,7 +11596,7 @@ function runConformanceCase(options) {
     if (c.invoke.flags) argv.push(...c.invoke.flags);
     const child = spawnSync2(process.execPath, [options.binary, ...argv], {
       cwd: scope,
-      env: { ...process.env, ...options.env, ...setupEnv },
+      env: { ...pickSafeEnv(process.env), ...options.env, ...setupEnv },
       encoding: "utf8"
     });
     const stdout = child.stdout ?? "";
@@ -11536,7 +11624,7 @@ function runPriorScansSetup(c, options, scope, fixturesRoot, setupEnv) {
     const stepArgv = ["scan", ...step.flags ?? []];
     const stepChild = spawnSync2(process.execPath, [options.binary, ...stepArgv], {
       cwd: scope,
-      env: { ...process.env, ...options.env, ...setupEnv },
+      env: { ...pickSafeEnv(process.env), ...options.env, ...setupEnv },
       encoding: "utf8"
     });
     if ((stepChild.status ?? 0) !== 0) {
@@ -14035,14 +14123,7 @@ function registeredVerbPaths(cli2) {
 }
 
 // cli/commands/hooks.ts
-import {
-  chmodSync,
-  existsSync as existsSync19,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync17,
-  statSync as statSync5,
-  writeFileSync as writeFileSync2
-} from "fs";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, stat as stat2, writeFile } from "fs/promises";
 import { dirname as dirname16, resolve as resolve27 } from "path";
 import { Command as Command16, Option as Option15 } from "clipanion";
 
@@ -14136,7 +14217,7 @@ var HooksInstallCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const ctx = defaultRuntimeContext();
-    const repoRoot = findGitRepoRoot(ctx.cwd);
+    const repoRoot = await findGitRepoRoot(ctx.cwd);
     if (repoRoot === null) {
       this.printer.error(
         tx(HOOKS_TEXTS.notInGitRepo, {
@@ -14148,7 +14229,7 @@ var HooksInstallCommand = class extends SmCommand {
     }
     const hooksDir = resolve27(repoRoot, ".git", "hooks");
     const hookPath = resolve27(hooksDir, "pre-commit");
-    const existing = existsSync19(hookPath) ? readFileSync17(hookPath, "utf8") : null;
+    const existing = await pathExists(hookPath) ? await readFile2(hookPath, "utf8") : null;
     const planned2 = computePlannedHookContent(existing);
     if (planned2.kind === "already-installed") {
       this.printer.info(tx(HOOKS_TEXTS.alreadyInstalled, { glyph: okGlyph, hookPath }));
@@ -14174,9 +14255,9 @@ var HooksInstallCommand = class extends SmCommand {
       return ExitCode.Ok;
     }
     try {
-      if (!existsSync19(hooksDir)) mkdirSync5(hooksDir, { recursive: true });
-      writeFileSync2(hookPath, planned2.content, { encoding: "utf8" });
-      ensureExecutableBit(hookPath);
+      if (!await pathExists(hooksDir)) await mkdir3(hooksDir, { recursive: true });
+      await writeFile(hookPath, planned2.content, { encoding: "utf8" });
+      await ensureExecutableBit(hookPath);
     } catch (err) {
       this.printer.error(
         tx(HOOKS_TEXTS.installFailed, { glyph: errGlyph, message: formatErrorMessage(err) })
@@ -14202,10 +14283,10 @@ var HooksInstallCommand = class extends SmCommand {
     return ExitCode.Ok;
   }
 };
-function findGitRepoRoot(cwd) {
+async function findGitRepoRoot(cwd) {
   let current = cwd;
   while (true) {
-    if (existsSync19(resolve27(current, ".git"))) return current;
+    if (await pathExists(resolve27(current, ".git"))) return current;
     const parent = dirname16(current);
     if (parent === current) return null;
     current = parent;
@@ -14216,22 +14297,22 @@ function computePlannedHookContent(existing) {
   if (existing.includes(SKILL_MAP_MARKER)) {
     return { kind: "already-installed", content: existing };
   }
-  const sep6 = existing.endsWith("\n") ? "" : "\n";
-  return { kind: "chained", content: existing + sep6 + "\n" + SKILL_MAP_BLOCK };
+  const sep7 = existing.endsWith("\n") ? "" : "\n";
+  return { kind: "chained", content: existing + sep7 + "\n" + SKILL_MAP_BLOCK };
 }
-function ensureExecutableBit(path) {
-  const mode = statSync5(path).mode;
-  chmodSync(path, mode | 73);
+async function ensureExecutableBit(path) {
+  const mode = (await stat2(path)).mode;
+  await chmod2(path, mode | 73);
 }
 var HOOKS_COMMANDS = [HooksInstallCommand];
 
 // cli/commands/init.ts
-import { mkdir as mkdir3, readFile as readFile2, unlink, writeFile } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile3, unlink, writeFile as writeFile2 } from "fs/promises";
 import { join as join17 } from "path";
 import { Command as Command17, Option as Option16 } from "clipanion";
 
 // kernel/orchestrator/index.ts
-import { existsSync as existsSync22, statSync as statSync7 } from "fs";
+import { existsSync as existsSync21, statSync as statSync6 } from "fs";
 import { isAbsolute as isAbsolute7, resolve as resolve28 } from "path";
 import { Tiktoken as Tiktoken2 } from "js-tiktoken/lite";
 import cl100k_base from "js-tiktoken/ranks/cl100k_base";
@@ -15265,8 +15346,8 @@ function computeDriftStatus(args2) {
 }
 
 // kernel/sidecar/discover-orphans.ts
-import { existsSync as existsSync20, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
-import { join as join13, relative as relative4, sep as sep3 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
+import { join as join13, relative as relative4, sep as sep4 } from "path";
 function discoverOrphanSidecars(roots, shouldSkip) {
   const out = [];
   for (const root of roots) {
@@ -15283,7 +15364,7 @@ function walk(root, current, shouldSkip, out) {
   }
   for (const entry of entries) {
     const full = join13(current, entry.name);
-    const rel = relative4(root, full).split(sep3).join("/");
+    const rel = relative4(root, full).split(sep4).join("/");
     if (shouldSkip(rel)) continue;
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
@@ -15293,13 +15374,13 @@ function walk(root, current, shouldSkip, out) {
     if (!entry.isFile()) continue;
     if (!entry.name.endsWith(".sm")) continue;
     const expectedMd = `${full.slice(0, -".sm".length)}.md`;
-    if (existsSync20(expectedMd) && safeIsFile(expectedMd)) continue;
+    if (existsSync19(expectedMd) && safeIsFile(expectedMd)) continue;
     out.push({ sidecarPath: full, relativePath: rel, expectedMdPath: expectedMd });
   }
 }
 function safeIsFile(path) {
   try {
-    return statSync6(path).isFile();
+    return statSync5(path).isFile();
   } catch {
     return false;
   }
@@ -15307,7 +15388,7 @@ function safeIsFile(path) {
 
 // kernel/orchestrator/node-build.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { isAbsolute as isAbsolute6, resolve as resolvePath } from "path";
 import "js-tiktoken/lite";
 import yaml4 from "js-yaml";
@@ -15471,11 +15552,11 @@ function resolveSidecarOverlay(relativePath2, nodePathForIssue, roots, liveBodyH
 }
 function resolveAbsoluteMdPath(relativePath2, roots) {
   if (isAbsolute6(relativePath2)) {
-    return existsSync21(relativePath2) ? relativePath2 : null;
+    return existsSync20(relativePath2) ? relativePath2 : null;
   }
   for (const root of roots) {
     const candidate = resolvePath(root, relativePath2);
-    if (existsSync21(candidate)) return candidate;
+    if (existsSync20(candidate)) return candidate;
   }
   return null;
 }
@@ -16016,7 +16097,7 @@ function validateRoots(roots) {
     throw new Error(ORCHESTRATOR_TEXTS.runScanRootEmptyArray);
   }
   for (const root of roots) {
-    if (!existsSync22(root) || !statSync7(root).isDirectory()) {
+    if (!existsSync21(root) || !statSync6(root).isDirectory()) {
       throw new Error(tx(ORCHESTRATOR_TEXTS.runScanRootMissing, { root }));
     }
   }
@@ -16025,7 +16106,7 @@ function resolveActiveProviderOption(optionValue, roots) {
   if (optionValue !== void 0) return optionValue;
   for (const root of roots) {
     const absRoot = isAbsolute7(root) ? root : resolve28(root);
-    if (!existsSync22(absRoot)) continue;
+    if (!existsSync21(absRoot)) continue;
     const detected = resolveActiveProvider(absRoot).resolved;
     if (detected !== null) return detected;
   }
@@ -16033,7 +16114,7 @@ function resolveActiveProviderOption(optionValue, roots) {
 }
 
 // kernel/scan/watcher.ts
-import { resolve as resolve29, relative as relative5, sep as sep4 } from "path";
+import { resolve as resolve29, relative as relative5, sep as sep5 } from "path";
 import chokidar from "chokidar";
 function createChokidarWatcher(opts) {
   const absRoots = opts.roots.map((r) => resolve29(opts.cwd, r));
@@ -16131,8 +16212,8 @@ function relativePathFromRoots2(absolute, absRoots) {
   for (const root of absRoots) {
     const rel = relative5(root, absolute);
     if (rel === "" || rel === ".") return "";
-    if (!rel.startsWith("..") && !rel.startsWith(`..${sep4}`)) {
-      return rel.split(sep4).join("/");
+    if (!rel.startsWith("..") && !rel.startsWith(`..${sep5}`)) {
+      return rel.split(sep5).join("/");
     }
   }
   return null;
@@ -16254,13 +16335,13 @@ function createKernel() {
 }
 
 // kernel/jobs/orphan-files.ts
-import { readdirSync as readdirSync8, statSync as statSync8 } from "fs";
+import { readdirSync as readdirSync8, statSync as statSync7 } from "fs";
 import { join as join14, resolve as resolve30 } from "path";
 function findOrphanJobFiles(jobsDir, referencedPaths) {
   let entries;
   try {
-    const stat2 = statSync8(jobsDir);
-    if (!stat2.isDirectory()) {
+    const stat3 = statSync7(jobsDir);
+    if (!stat3.isDirectory()) {
       return { orphanFilePaths: [], referencedCount: referencedPaths.size };
     }
     entries = readdirSync8(jobsDir, { withFileTypes: true });
@@ -16422,7 +16503,7 @@ function resolveScanRoots(inputs) {
 }
 
 // core/runtime/reference-paths-walker.ts
-import { readdirSync as readdirSync9, statSync as statSync9 } from "fs";
+import { readdirSync as readdirSync9, statSync as statSync8 } from "fs";
 import { homedir as osHomedir2 } from "os";
 import { isAbsolute as isAbsolute8, join as join15, resolve as resolve31 } from "path";
 var REFERENCE_WALK_MAX_FILES = 5e4;
@@ -16444,8 +16525,8 @@ function walkReferencePaths(rawRoots, cwd) {
   for (const raw of rawRoots) {
     if (truncated) break;
     const root = resolveScanPath(raw, cwd);
-    const stat2 = safeStat(root);
-    if (!stat2 || !stat2.isDirectory()) {
+    const stat3 = safeStat(root);
+    if (!stat3 || !stat3.isDirectory()) {
       missingRoots.push(root);
       continue;
     }
@@ -16476,7 +16557,7 @@ function walkInto(dir, out) {
 }
 function safeStat(path) {
   try {
-    return statSync9(path);
+    return statSync8(path);
   } catch {
     return null;
   }
@@ -16979,7 +17060,7 @@ var InitCommand = class extends SmCommand {
     const printer = this.printer ?? createPrinter({
       stdout: this.context.stdout,
       stderr: this.context.stderr,
-      quietInfo: this.quiet
+      quietInfo: this.quiet || this.json
     });
     if (this.dryRun) {
       await writeDryRunPlan(printer, {
@@ -16994,7 +17075,7 @@ var InitCommand = class extends SmCommand {
       });
       return ExitCode.Ok;
     }
-    await mkdir3(skillMapDir, { recursive: true });
+    await mkdir4(skillMapDir, { recursive: true });
     writeFileAtomicExclusive(settingsPath, JSON.stringify({ schemaVersion: 1 }, null, 2) + "\n");
     if (!await pathExists(localPath) || this.force) {
       writeFileAtomicExclusive(localPath, "{}\n");
@@ -17168,7 +17249,7 @@ async function runFirstScan(scopeRoot, strict, printer, stderr, stdin, ansi) {
 }
 async function previewGitignoreEntries(scopeRoot, entries) {
   const path = join17(scopeRoot, ".gitignore");
-  const body = await pathExists(path) ? await readFile2(path, "utf8") : "";
+  const body = await pathExists(path) ? await readFile3(path, "utf8") : "";
   const present = new Set(
     body.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"))
   );
@@ -17178,7 +17259,7 @@ async function ensureGitignoreEntries(scopeRoot, entries) {
   const path = join17(scopeRoot, ".gitignore");
   let body = "";
   if (await pathExists(path)) {
-    body = await readFile2(path, "utf8");
+    body = await readFile3(path, "utf8");
   }
   const present = new Set(
     body.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"))
@@ -17192,7 +17273,7 @@ async function ensureGitignoreEntries(scopeRoot, entries) {
     present.add(entry);
     changed = true;
   }
-  if (changed) await writeFile(path, body);
+  if (changed) await writeFile2(path, body);
   return changed;
 }
 
@@ -19058,10 +19139,10 @@ function pluginToListRow(p) {
 }
 function wrapNames(names, indent, maxWidth) {
   const out = [];
-  const sep6 = ", ";
+  const sep7 = ", ";
   let current = "";
   for (const name of names) {
-    const candidate = current === "" ? name : `${current}${sep6}${name}`;
+    const candidate = current === "" ? name : `${current}${sep7}${name}`;
     if (indent.length + candidate.length > maxWidth && current !== "") {
       out.push(`${current},`);
       current = name;
@@ -20066,7 +20147,7 @@ function resolveBareToggle(id, catalogue, verb, ansi) {
 }
 
 // cli/commands/plugins/create.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync6, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync5, writeFileSync } from "fs";
 import { join as join18, resolve as resolve33 } from "path";
 import { Command as Command26, Option as Option25 } from "clipanion";
 var PluginsCreateCommand = class extends SmCommand {
@@ -20095,7 +20176,7 @@ var PluginsCreateCommand = class extends SmCommand {
     const ctx = defaultRuntimeContext();
     const baseDir = defaultProjectPluginsDir(ctx);
     const targetDir = this.at ? resolve33(this.at) : join18(baseDir, this.pluginId);
-    if (existsSync23(targetDir) && !this.force) {
+    if (existsSync22(targetDir) && !this.force) {
       this.printer.error(
         tx(PLUGINS_TEXTS.createRefuseOverwrite, {
           glyph: errGlyph,
@@ -20106,7 +20187,7 @@ var PluginsCreateCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const extractorName = `${this.pluginId}-extractor`;
-    mkdirSync6(join18(targetDir, "extractors", extractorName), { recursive: true });
+    mkdirSync5(join18(targetDir, "extractors", extractorName), { recursive: true });
     const specVersion = installedSpecVersion();
     const manifest = {
       id: this.pluginId,
@@ -20125,15 +20206,15 @@ var PluginsCreateCommand = class extends SmCommand {
         }
       }
     };
-    writeFileSync3(
+    writeFileSync(
       join18(targetDir, "plugin.json"),
       JSON.stringify(manifest, null, 2) + "\n"
     );
-    writeFileSync3(
+    writeFileSync(
       join18(targetDir, "extractors", extractorName, "index.js"),
       scaffolderExtractorStub(extractorName)
     );
-    writeFileSync3(join18(targetDir, "README.md"), scaffolderReadme(this.pluginId));
+    writeFileSync(join18(targetDir, "README.md"), scaffolderReadme(this.pluginId));
     this.printer.data(
       tx(PLUGINS_TEXTS.createSuccess, {
         targetDir: sanitizeForTerminal(targetDir),
@@ -20335,7 +20416,7 @@ var PLUGIN_COMMANDS = [
 ];
 
 // cli/commands/refresh.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import { resolve as resolve34 } from "path";
 import { Command as Command29, Option as Option27 } from "clipanion";
 
@@ -20642,7 +20723,7 @@ var RefreshCommand = class extends SmCommand {
       let body;
       try {
         assertContained(cwd, node.path);
-        const raw = await readFile3(resolve34(cwd, node.path), "utf8");
+        const raw = await readFile4(resolve34(cwd, node.path), "utf8");
         body = stripFrontmatterFence(raw);
       } catch (err) {
         if (!this.json) {
@@ -21491,7 +21572,7 @@ var ScanCommand = class extends SmCommand {
     }
     return null;
   }
-  /** Render the failure branch of `IScanRunResult` to stderr. */
+  /** Render the failure branch of `TScanRunResult` to stderr. */
   renderFailure(outcome) {
     const ansi = this.ansiFor("stderr");
     const errGlyph = ansi.red("\u2715");
@@ -21570,7 +21651,7 @@ var ScanCommand = class extends SmCommand {
         this.printer.info(
           tx(SCAN_TEXTS.jsonSelfValidationFailed, {
             glyph: ansi.red("\u2715"),
-            errors: validation.errors
+            errors: JSON.stringify(validation.errors, null, 2)
           })
         );
         return ExitCode.Error;
@@ -21591,7 +21672,7 @@ function plural(count, word) {
 }
 
 // cli/commands/scan-compare.ts
-import { existsSync as existsSync24, readFileSync as readFileSync18 } from "fs";
+import { access, readFile as readFile5 } from "fs/promises";
 import { Command as Command32, Option as Option30 } from "clipanion";
 var ScanCompareCommand = class extends SmCommand {
   static paths = [["scan", "compare-with"]];
@@ -21644,7 +21725,7 @@ var ScanCompareCommand = class extends SmCommand {
     const roots = this.roots.length > 0 ? this.roots : ["."];
     let prior;
     try {
-      prior = loadAndValidateDump(this.dump);
+      prior = await loadAndValidateDump(this.dump);
     } catch (err) {
       const message = formatErrorMessage(err);
       this.printer.info(tx(SCAN_TEXTS.compareErrorPrefix, { message }));
@@ -21702,13 +21783,15 @@ var ScanCompareCommand = class extends SmCommand {
     return exitCode2;
   }
 };
-function loadAndValidateDump(path) {
-  if (!existsSync24(path)) {
+async function loadAndValidateDump(path) {
+  try {
+    await access(path);
+  } catch {
     throw new Error(tx(SCAN_TEXTS.compareDumpNotFound, { path }));
   }
   let raw;
   try {
-    raw = readFileSync18(path, "utf8");
+    raw = await readFile5(path, "utf8");
   } catch (err) {
     const message = formatErrorMessage(err);
     throw new Error(tx(SCAN_TEXTS.compareDumpReadFailed, { path, message }), { cause: err });
@@ -21833,7 +21916,7 @@ function renderDeltaIssues(issues) {
 
 // cli/commands/serve.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { Command as Command33, Option as Option31 } from "clipanion";
 
 // cli/util/browser-launch.ts
@@ -22459,7 +22542,7 @@ function registerFavoritesRoutes(app, deps) {
     );
     if (!result || !result.found) {
       throw new HTTPException4(404, {
-        message: tx(SERVER_TEXTS.nodeNotFound, { path: nodePath })
+        message: tx(SERVER_TEXTS.nodeNotFound, { path: sanitizeForTerminal(nodePath) })
       });
     }
     return c.body(null, 204);
@@ -22546,7 +22629,7 @@ function contentTypeFor(format) {
 }
 
 // server/health.ts
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 var FALLBACK_SCHEMA_VERSION = "1";
 function buildHealth(deps) {
   return {
@@ -22554,7 +22637,7 @@ function buildHealth(deps) {
     schemaVersion: FALLBACK_SCHEMA_VERSION,
     specVersion: deps.specVersion,
     implVersion: VERSION,
-    db: existsSync25(deps.dbPath) ? "present" : "missing",
+    db: existsSync23(deps.dbPath) ? "present" : "missing",
     cwd: deps.cwd,
     dbPath: deps.dbPath
   };
@@ -22586,47 +22669,60 @@ function registerHealthRoute(app, deps) {
   });
 }
 
-// server/routes/issues.ts
+// server/limits.ts
 var DEFAULT_LIMIT = 100;
 var MAX_LIMIT = 1e3;
+var BFF_MAX_BULK_CONTRIBUTIONS = 200;
+
+// server/routes/issues.ts
 function registerIssuesRoute(app, deps) {
   app.get("/api/issues", async (c) => {
-    const severityFilter = parseCsv(c.req.query("severity"));
-    const analyzerFilter = parseCsv(c.req.query("analyzerId"));
-    const nodePath = c.req.query("node") ?? null;
-    const { offset, limit } = parsePagination(c.req.query(), {
-      limit: DEFAULT_LIMIT,
-      max: MAX_LIMIT
-    });
+    const inputs = parseIssuesQuery(c.req.query());
     const result = await tryWithSqlite(
       { databasePath: deps.options.dbPath, autoBackup: false },
-      (adapter) => adapter.issues.list({
-        severities: severityFilter,
-        analyzerIds: analyzerFilter,
-        nodePath,
-        offset,
-        limit
-      })
+      (adapter) => adapter.issues.list(inputs.filter)
     );
-    const items = result?.items ?? [];
-    const total = result?.total ?? 0;
     return c.json(
       buildListEnvelope({
         kind: "issues",
-        items,
-        filters: {
-          severity: severityFilter.length > 0 ? severityFilter : null,
-          analyzerId: analyzerFilter.length > 0 ? analyzerFilter : null,
-          node: nodePath
-        },
-        total,
-        page: { offset, limit },
+        items: result?.items ?? [],
+        filters: inputs.echo,
+        total: result?.total ?? 0,
+        page: { offset: inputs.filter.offset, limit: inputs.filter.limit },
         kindRegistry: deps.kindRegistry,
         contributionsRegistry: deps.contributionsRegistry
       })
     );
   });
 }
+function parseIssuesQuery(query) {
+  const severityFilter = parseCsv(query["severity"]);
+  const analyzerFilter = parseCsv(query["analyzerId"]);
+  const nodePath = query["node"] ?? null;
+  const nodesRaw = parseCsv(query["nodes"]);
+  const nodesFilter = nodesRaw.length > 0 ? nodesRaw : null;
+  const { offset, limit } = parsePagination(query, {
+    limit: DEFAULT_LIMIT,
+    max: MAX_LIMIT
+  });
+  const filter = {
+    severities: severityFilter,
+    analyzerIds: analyzerFilter,
+    nodePath,
+    offset,
+    limit
+  };
+  if (nodesFilter) filter.nodePaths = nodesFilter;
+  return {
+    filter,
+    echo: {
+      severity: severityFilter.length > 0 ? severityFilter : null,
+      analyzerId: analyzerFilter.length > 0 ? analyzerFilter : null,
+      node: nodePath,
+      nodes: nodesFilter
+    }
+  };
+}
 
 // server/routes/links.ts
 function registerLinksRoute(app, deps) {
@@ -22666,22 +22762,30 @@ function registerLinksRoute(app, deps) {
 import { HTTPException as HTTPException6 } from "hono/http-exception";
 
 // server/node-body.ts
-import { readFile as readFile4 } from "fs/promises";
-import { isAbsolute as isAbsolute10, resolve as resolvePath2, relative as relativePath, sep as sep5 } from "path";
+import { constants as fsConstants2 } from "fs";
+import { open } from "fs/promises";
+import { isAbsolute as isAbsolute10, resolve as resolvePath2, relative as relativePath, sep as sep6 } from "path";
 async function readNodeBody(cwd, relPath) {
   if (isAbsolute10(relPath)) return null;
   const absRoot = resolvePath2(cwd);
   const absFile = resolvePath2(absRoot, relPath);
   const rel = relativePath(absRoot, absFile);
-  if (rel.startsWith("..") || rel.startsWith(sep5) || rel.length === 0) {
+  if (rel.startsWith("..") || rel.startsWith(sep6) || rel.length === 0) {
     return null;
   }
   let raw;
+  let handle = null;
   try {
-    raw = await readFile4(absFile, "utf-8");
+    handle = await open(absFile, fsConstants2.O_RDONLY | fsConstants2.O_NOFOLLOW);
+    raw = await handle.readFile("utf-8");
   } catch (err) {
     if (isExpectedFsError(err)) return null;
     throw err;
+  } finally {
+    if (handle !== null) {
+      await handle.close().catch(() => {
+      });
+    }
   }
   return stripFrontmatter(raw);
 }
@@ -22691,7 +22795,16 @@ function stripFrontmatter(raw) {
   if (!match) return raw;
   return raw.slice(match[0].length);
 }
-var EXPECTED_FS_ERROR_CODES = /* @__PURE__ */ new Set(["ENOENT", "EACCES", "EISDIR", "ENOTDIR"]);
+var EXPECTED_FS_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ENOENT",
+  "EACCES",
+  "EISDIR",
+  "ENOTDIR",
+  // `O_NOFOLLOW` opens fail with `ELOOP` on Linux / macOS when the
+  // leaf is a symlink. Treat the same as "body unavailable" so the
+  // BFF returns null, not a 500.
+  "ELOOP"
+]);
 function isExpectedFsError(err) {
   if (err === null || typeof err !== "object") return false;
   const code = err.code;
@@ -22749,9 +22862,6 @@ function splitCsv(raw) {
 }
 
 // server/routes/nodes.ts
-var DEFAULT_LIMIT2 = 100;
-var MAX_LIMIT2 = 1e3;
-var BFF_MAX_BULK_CONTRIBUTIONS = 200;
 function registerNodesRoutes(app, deps) {
   app.get("/api/nodes/:pathB64", async (c) => {
     const pathB64 = c.req.param("pathB64");
@@ -22813,8 +22923,8 @@ function registerNodesRoutes(app, deps) {
     const params = new URL(c.req.url).searchParams;
     const { query, filters } = urlParamsToExportQuery(params);
     const { offset, limit } = parsePagination(c.req.query(), {
-      limit: DEFAULT_LIMIT2,
-      max: MAX_LIMIT2
+      limit: DEFAULT_LIMIT,
+      max: MAX_LIMIT
     });
     const opened = await tryWithSqlite(
       { databasePath: deps.options.dbPath, autoBackup: false },
@@ -23389,15 +23499,15 @@ var parsePatchBody2 = makeBodyValidator(PATCH_BODY_SCHEMA, {
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 
 // server/util/skillmapignore-io.ts
-import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync17, writeFileSync as writeFileSync2 } from "fs";
 import { resolve as resolve35 } from "path";
 var IGNORE_FILENAME2 = ".skillmapignore";
 function readPatterns(cwd) {
   const path = resolve35(cwd, IGNORE_FILENAME2);
-  if (!existsSync26(path)) return [];
+  if (!existsSync24(path)) return [];
   let raw;
   try {
-    raw = readFileSync19(path, "utf8");
+    raw = readFileSync17(path, "utf8");
   } catch {
     return [];
   }
@@ -23405,13 +23515,13 @@ function readPatterns(cwd) {
 }
 function writePatterns(cwd, nextPatterns) {
   const path = resolve35(cwd, IGNORE_FILENAME2);
-  const prior = existsSync26(path) ? safeRead(path) : "";
+  const prior = existsSync24(path) ? safeRead(path) : "";
   const content = buildContent(prior, nextPatterns);
-  writeFileSync4(path, content, "utf8");
+  writeFileSync2(path, content, "utf8");
 }
 function safeRead(path) {
   try {
-    return readFileSync19(path, "utf8");
+    return readFileSync17(path, "utf8");
   } catch {
     return "";
   }
@@ -23566,7 +23676,7 @@ var parsePatchBody3 = makeBodyValidator(PATCH_BODY_SCHEMA2, {
 });
 
 // server/routes/project-preferences.ts
-import { statSync as statSync10 } from "fs";
+import { statSync as statSync9 } from "fs";
 import { HTTPException as HTTPException11 } from "hono/http-exception";
 function registerProjectPreferencesRoute(app, deps) {
   app.get("/api/project-preferences", (c) => {
@@ -23715,7 +23825,7 @@ function formatPathDetail(path, cwd) {
 function isExistingDirectory(entry, cwd) {
   const abs = resolveScanPath(entry, cwd);
   try {
-    return statSync10(abs).isDirectory();
+    return statSync9(abs).isDirectory();
   } catch {
     return false;
   }
@@ -23755,7 +23865,7 @@ var parsePatchBody4 = makeBodyValidator(PATCH_BODY_SCHEMA3, {
 });
 
 // server/routes/active-provider.ts
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync25 } from "fs";
 import { HTTPException as HTTPException12 } from "hono/http-exception";
 function registerActiveProviderRoute(app, deps) {
   app.get("/api/active-provider", (c) => {
@@ -23788,7 +23898,7 @@ function applyLensSwitch(deps, newValue) {
     });
   }
   const dbPath = resolveDbPath({ db: void 0, cwd });
-  if (!existsSync27(dbPath)) return { dropped: null };
+  if (!existsSync25(dbPath)) return { dropped: null };
   const dropResult = dropScanZone(dbPath);
   return {
     dropped: {
@@ -24180,7 +24290,7 @@ function registerSidecarRoutes(app, deps) {
       assertContained(deps.runtimeContext.cwd, node.path);
       absPath = resolve36(deps.runtimeContext.cwd, node.path);
     } catch (err) {
-      throw new HTTPException14(500, { message: formatErrorMessage(err) });
+      throw new HTTPException14(400, { message: formatErrorMessage(err) });
     }
     const result = invokeBump2(node, absPath, body);
     if (result.report.ok === false && result.report.reason === "fresh") {
@@ -24302,8 +24412,8 @@ function registerUpdateStatusRoute(app, deps) {
 }
 
 // server/static.ts
-import { existsSync as existsSync28 } from "fs";
-import { readFile as readFile5 } from "fs/promises";
+import { existsSync as existsSync26 } from "fs";
+import { readFile as readFile6 } from "fs/promises";
 import { extname, join as join19 } from "path";
 import { serveStatic } from "@hono/node-server/serve-static";
 var INDEX_HTML = "index.html";
@@ -24357,7 +24467,7 @@ function createSpaFallback(opts) {
     if (c.req.method !== "GET" && c.req.method !== "HEAD") return c.notFound();
     if (opts.uiDist === null) return htmlResponse(c, placeholder);
     const indexPath = join19(opts.uiDist, INDEX_HTML);
-    if (!existsSync28(indexPath)) return htmlResponse(c, placeholder);
+    if (!existsSync26(indexPath)) return htmlResponse(c, placeholder);
     return fileResponse(c, indexPath);
   };
 }
@@ -24399,7 +24509,7 @@ function htmlResponse(c, html) {
   return c.body(html, 200, { "content-type": "text/html; charset=UTF-8" });
 }
 async function fileResponse(c, absPath) {
-  const buf = await readFile5(absPath);
+  const buf = await readFile6(absPath);
   return c.body(buf, 200, { "content-type": mimeFor(absPath) });
 }
 
@@ -24929,7 +25039,7 @@ function validateNoUi(noUi, uiDist) {
 }
 
 // server/paths.ts
-import { existsSync as existsSync29, statSync as statSync11 } from "fs";
+import { existsSync as existsSync27, statSync as statSync10 } from "fs";
 import { dirname as dirname18, isAbsolute as isAbsolute11, join as join20, resolve as resolve37 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var DEFAULT_UI_REL = join20("ui", "dist", "ui", "browser");
@@ -24944,10 +25054,10 @@ function resolveExplicitUiDist(ctx, raw) {
   return isAbsolute11(raw) ? raw : resolve37(ctx.cwd, raw);
 }
 function isUiBundleDir(path) {
-  if (!existsSync29(path)) return false;
+  if (!existsSync27(path)) return false;
   try {
-    if (!statSync11(path).isDirectory()) return false;
-    return existsSync29(join20(path, INDEX_HTML2));
+    if (!statSync10(path).isDirectory()) return false;
+    return existsSync27(join20(path, INDEX_HTML2));
   } catch {
     return false;
   }
@@ -25478,7 +25588,7 @@ var ServeCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const dbPath = resolveDbPath({ db: this.db, ...runtimeCtx });
-    if (this.db !== void 0 && !existsSync30(dbPath)) {
+    if (this.db !== void 0 && !existsSync28(dbPath)) {
       this.printer.info(
         tx(SERVE_TEXTS.dbNotFound, {
           glyph: errGlyph,
@@ -26028,7 +26138,7 @@ function rankConfidenceForGrouping(c) {
 }
 
 // cli/commands/sidecar.ts
-import { existsSync as existsSync31, unlinkSync as unlinkSync2 } from "fs";
+import { unlink as unlink3 } from "fs/promises";
 import { resolve as resolve38 } from "path";
 import { Command as Command35, Option as Option33 } from "clipanion";
 
@@ -26320,7 +26430,7 @@ var SidecarPruneCommand = class extends SmCommand {
         continue;
       }
       try {
-        unlinkSync2(orphan.sidecarPath);
+        await unlink3(orphan.sidecarPath);
         items.push({
           sidecarPath: orphan.sidecarPath,
           expectedMd: orphan.expectedMdPath,
@@ -26477,7 +26587,8 @@ var SidecarAnnotateCommand = class extends SmCommand {
       return ExitCode.Error;
     }
     const sidecarAbsPath = sidecarPathFor(absPath);
-    if (existsSync31(sidecarAbsPath) && this.force !== true) {
+    const sidecarExists = await pathExists(sidecarAbsPath);
+    if (sidecarExists && this.force !== true) {
       this.printer.error(
         tx(SIDECAR_TEXTS.annotateExists, {
           glyph: errGlyph,
@@ -26487,9 +26598,9 @@ var SidecarAnnotateCommand = class extends SmCommand {
       );
       return ExitCode.Error;
     }
-    if (existsSync31(sidecarAbsPath) && this.force === true) {
+    if (sidecarExists && this.force === true) {
       try {
-        unlinkSync2(sidecarAbsPath);
+        await unlink3(sidecarAbsPath);
       } catch (err) {
         this.printer.error(
           tx(SIDECAR_TEXTS.annotateFailed, { glyph: errGlyph, message: formatErrorMessage(err) })
@@ -26717,7 +26828,7 @@ var STUB_COMMANDS = [
 ];
 
 // cli/commands/tutorial.ts
-import { cpSync as cpSync2, existsSync as existsSync32, mkdirSync as mkdirSync7, rmSync as rmSync2, statSync as statSync12 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync29, mkdirSync as mkdirSync6, rmSync as rmSync2, statSync as statSync11 } from "fs";
 import { dirname as dirname19, join as join21, resolve as resolve39 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command37, Option as Option35 } from "clipanion";
@@ -26816,7 +26927,7 @@ var TutorialCommand = class extends SmCommand {
     const spec = VARIANT_SPECS[variant];
     const targetDir = join21(ctx.cwd, ".claude", "skills", spec.slug);
     const targetDisplay = `.claude/skills/${spec.slug}/`;
-    if (existsSync32(targetDir) && !this.force) {
+    if (existsSync29(targetDir) && !this.force) {
       this.printer.error(
         tx(TUTORIAL_TEXTS.alreadyExists, {
           glyph: errGlyph,
@@ -26842,7 +26953,7 @@ var TutorialCommand = class extends SmCommand {
     }
     try {
       rmSync2(targetDir, { recursive: true, force: true });
-      mkdirSync7(dirname19(targetDir), { recursive: true });
+      mkdirSync6(dirname19(targetDir), { recursive: true });
       cpSync2(sourceDir, targetDir, { recursive: true });
     } catch (err) {
       this.printer.error(
@@ -26899,7 +27010,7 @@ function resolveSkillSourceDir(variant) {
     resolve39(here, "../cli/tutorial", spec.slug)
   ];
   for (const candidate of candidates) {
-    if (existsSync32(candidate) && statSync12(candidate).isDirectory()) {
+    if (existsSync29(candidate) && statSync11(candidate).isDirectory()) {
       cachedSourceDirs.set(variant, candidate);
       return candidate;
     }
@@ -27076,7 +27187,7 @@ await lifecycleDispatcher.dispatch(
 process.exit(exitCode);
 function resolveBareDefault() {
   const ctx = defaultRuntimeContext();
-  if (existsSync33(defaultProjectDbPath(ctx))) {
+  if (existsSync30(defaultProjectDbPath(ctx))) {
     return ["serve"];
   }
   const stderr = process.stderr;