@staff0rd/assist 0.315.1 → 0.317.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.315.1",
+  version: "0.317.0",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -300,6 +300,13 @@ var assistConfigSchema = z2.strictObject({
       message: z2.string()
     })
   ).optional(),
+  forbiddenStrings: z2.array(
+    z2.strictObject({
+      file: z2.string(),
+      paths: z2.array(z2.string()),
+      disallowed: z2.string()
+    })
+  ).optional(),
   sync: z2.strictObject({
     autoConfirm: z2.boolean().default(false)
   }).default({ autoConfirm: false }),
@@ -771,8 +778,7 @@ import * as path5 from "path";
 import chalk13 from "chalk";
 
 // src/commands/lint/init.ts
-import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
 import chalk12 from "chalk";
 
 // src/shared/promptConfirm.ts
@@ -927,8 +933,6 @@ var oxlintrc_template_default = {
 async function init() {
   removeEslint();
   await writeOxlintConfig();
-  removeBiomeConfig();
-  uninstallBiome();
 }
 async function writeOxlintConfig() {
   const newContent = `${JSON.stringify(oxlintrc_template_default, null, "	")}
@@ -955,29 +959,6 @@ async function writeOxlintConfig() {
   writeFileSync5(configPath, newContent);
   console.log("Updated .oxlintrc.json with baseline linter config");
 }
-function removeBiomeConfig() {
-  for (const file of ["biome.json", "biome.jsonc"]) {
-    if (existsSync7(file)) {
-      rmSync(file);
-      console.log(`Removed ${file}`);
-    }
-  }
-}
-function uninstallBiome() {
-  const packageJsonPath = "package.json";
-  if (!existsSync7(packageJsonPath)) {
-    return;
-  }
-  const pkg = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
-  const hasBiome = Boolean(
-    pkg.devDependencies?.["@biomejs/biome"] || pkg.dependencies?.["@biomejs/biome"]
-  );
-  if (!hasBiome) {
-    return;
-  }
-  console.log("Uninstalling @biomejs/biome...");
-  execSync6("npm uninstall @biomejs/biome", { stdio: "inherit" });
-}
 
 // src/commands/verify/setup/setupLint.ts
 async function setupLint(packageJsonPath, writer) {
@@ -1275,17 +1256,12 @@ function createLaunchJson(type) {
 // src/commands/vscode/init/detectVscodeSetup.ts
 import * as fs3 from "fs";
 import * as path9 from "path";
-function fileContainsBiome(filePath) {
-  if (!fs3.existsSync(filePath)) return false;
-  return fs3.readFileSync(filePath, "utf8").includes("biome");
-}
 function detectVscodeSetup(pkg) {
   const vscodeDir = path9.join(process.cwd(), ".vscode");
   return {
     hasVscodeFolder: fs3.existsSync(vscodeDir),
     hasLaunchJson: fs3.existsSync(path9.join(vscodeDir, "launch.json")),
     hasSettingsJson: fs3.existsSync(path9.join(vscodeDir, "settings.json")),
-    hasBiomeConfig: fileContainsBiome(path9.join(vscodeDir, "settings.json")) || fileContainsBiome(path9.join(vscodeDir, "extensions.json")),
     hasVite: !!pkg.devDependencies?.vite || !!pkg.dependencies?.vite,
     hasTsup: !!pkg.devDependencies?.tsup || !!pkg.dependencies?.tsup
   };
@@ -1307,7 +1283,7 @@ function getAvailableOptions2(setup2) {
       value: "launch",
       description: launchDescription
     });
-  if (!setup2.hasSettingsJson || setup2.hasBiomeConfig)
+  if (!setup2.hasSettingsJson)
     options2.push({
       name: "settings",
       value: "settings",
@@ -1341,7 +1317,7 @@ function createSettingsJson() {
     "editor.defaultFormatter": "oxc.oxc-vscode",
     "editor.formatOnSave": true,
     "editor.codeActionsOnSave": {
-      ...withoutBiomeCodeActions(existing["editor.codeActionsOnSave"]),
+      ...existingCodeActions(existing["editor.codeActionsOnSave"]),
       "source.fixAll.oxc": "explicit",
       "source.organizeImports.oxc": "explicit"
     }
@@ -1350,13 +1326,9 @@ function createSettingsJson() {
 `);
   console.log(chalk19.green("Created .vscode/settings.json"));
 }
-function withoutBiomeCodeActions(actions) {
+function existingCodeActions(actions) {
   if (!actions || typeof actions !== "object") return {};
-  return Object.fromEntries(
-    Object.entries(actions).filter(
-      ([key]) => !key.includes("biome")
-    )
-  );
+  return actions;
 }
 
 // src/commands/vscode/init/createExtensionsJson.ts
@@ -1366,9 +1338,7 @@ import chalk20 from "chalk";
 function createExtensionsJson() {
   const extensionsPath = path11.join(process.cwd(), ".vscode", "extensions.json");
   const existing = readVscodeJson(extensionsPath);
-  const previous = Array.isArray(existing.recommendations) ? existing.recommendations.filter(
-    (r) => r !== "biomejs.biome"
-  ) : [];
+  const previous = Array.isArray(existing.recommendations) ? existing.recommendations : [];
   const recommendations = previous.includes("oxc.oxc-vscode") ? previous : [...previous, "oxc.oxc-vscode"];
   const extensions = { ...existing, recommendations };
   fs6.writeFileSync(
@@ -1741,11 +1711,11 @@ function lint(options2 = {}) {
 }
 
 // src/commands/new/registerNew/newCli/index.ts
-import { execSync as execSync13 } from "child_process";
+import { execSync as execSync12 } from "child_process";
 import { basename, resolve as resolve5 } from "path";
 
 // src/commands/verify/commentPolicy/findAddedComments.ts
-import { execSync as execSync7 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import fs13 from "fs";
 import { minimatch } from "minimatch";
 import { Project as Project2 } from "ts-morph";
@@ -1772,7 +1742,6 @@ function collectComments(sourceFile) {
 
 // src/commands/verify/commentPolicy/isCommentExempt.ts
 var MACHINE_DIRECTIVES = [
-  "biome-ignore",
   "oxlint-disable",
   "oxlint-enable",
   "@ts-expect-error",
@@ -1839,7 +1808,7 @@ function shouldScan(file, ignoreGlobs) {
   return fs13.existsSync(file);
 }
 function findAddedComments(options2) {
-  const diff2 = execSync7("git diff HEAD", {
+  const diff2 = execSync6("git diff HEAD", {
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
   });
@@ -1890,21 +1859,94 @@ Total: ${findings.length} comment(s)`);
   process.exit(1);
 }
 
-// src/commands/verify/hardcodedColors.ts
-import { execSync as execSync8 } from "child_process";
+// src/commands/verify/forbiddenStrings/index.ts
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+
+// src/commands/verify/forbiddenStrings/findForbiddenStrings.ts
 import { minimatch as minimatch2 } from "minimatch";
+function resolveStringsAtPath(data, path57) {
+  let current = data;
+  for (const segment of path57.split(".")) {
+    if (current === null || typeof current !== "object") return [];
+    current = current[segment];
+  }
+  if (typeof current === "string") return [current];
+  if (Array.isArray(current))
+    return current.filter(
+      (value) => typeof value === "string"
+    );
+  return [];
+}
+function findRuleViolations(data, rule) {
+  const violations = [];
+  for (const path57 of rule.paths) {
+    for (const value of resolveStringsAtPath(data, path57)) {
+      if (minimatch2(value, rule.disallowed))
+        violations.push({ file: rule.file, path: path57, value });
+    }
+  }
+  return violations;
+}
+function findForbiddenStrings(rules, readJson) {
+  return rules.flatMap((rule) => findRuleViolations(readJson(rule.file), rule));
+}
+
+// src/commands/verify/forbiddenStrings/index.ts
+function forbiddenStrings() {
+  const rules = loadConfig().forbiddenStrings ?? [];
+  if (rules.length === 0) {
+    console.log("No forbidden-strings rules configured.");
+    process.exit(0);
+  }
+  const cache = /* @__PURE__ */ new Map();
+  const readJson = (file) => {
+    if (cache.has(file)) return cache.get(file);
+    if (!existsSync11(file)) {
+      console.log(`Forbidden-strings file not found: ${file}`);
+      process.exit(1);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync8(file, "utf8"));
+    } catch (error) {
+      console.log(`Could not parse ${file}: ${error.message}`);
+      process.exit(1);
+    }
+    cache.set(file, parsed);
+    return parsed;
+  };
+  const violations = findForbiddenStrings(rules, readJson);
+  if (violations.length === 0) {
+    console.log("No forbidden strings found.");
+    process.exit(0);
+  }
+  console.log("Forbidden strings found:\n");
+  for (const { file, path: path57, value } of violations) {
+    console.log(`  ${file} ${path57}: ${value}`);
+  }
+  console.log(`
+Total: ${violations.length} forbidden string(s).`);
+  console.log(
+    "\nRemove each flagged value, or adjust the matching forbiddenStrings rule in assist.yml."
+  );
+  process.exit(1);
+}
+
+// src/commands/verify/hardcodedColors.ts
+import { execSync as execSync7 } from "child_process";
+import { minimatch as minimatch3 } from "minimatch";
 var pattern = "0x[0-9a-fA-F]{6}|#[0-9a-fA-F]{3,6}";
 function hardcodedColors() {
   const ignoreGlobs = loadConfig().hardcodedColors?.ignore ?? [];
   try {
-    const output = execSync8(`grep -rEnH '${pattern}' src/`, {
+    const output = execSync7(`grep -rEnH '${pattern}' src/`, {
       encoding: "utf8"
     });
     const lines = output.trim().split("\n").filter((line) => {
       const match = line.match(/^(.+?):\d+:/);
       if (!match) return true;
       const file = match[1];
-      return !ignoreGlobs.some((glob) => minimatch2(file, glob));
+      return !ignoreGlobs.some((glob) => minimatch3(file, glob));
     });
     if (lines.length === 0) {
       console.log("No hardcoded colors found.");
@@ -1960,14 +2002,14 @@ function assertNoDuplicateRunNames(configs) {
 }
 
 // src/shared/findLinkedConfigPath.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { join as join8, resolve } from "path";
 function findLinkedConfigPath(linkPath, fromDir) {
   const resolved = resolve(fromDir, linkPath);
   const claudePath = join8(resolved, ".claude", "assist.yml");
-  if (existsSync11(claudePath)) return claudePath;
+  if (existsSync12(claudePath)) return claudePath;
   const rootPath = join8(resolved, "assist.yml");
-  if (existsSync11(rootPath)) return rootPath;
+  if (existsSync12(rootPath)) return rootPath;
   throw new Error(`No assist.yml found in linked project: ${resolved}`);
 }
 
@@ -2078,10 +2120,10 @@ function list() {
 }
 
 // src/commands/verify/noVenv.ts
-import { execSync as execSync9 } from "child_process";
+import { execSync as execSync8 } from "child_process";
 function noVenv() {
   try {
-    const output = execSync9(
+    const output = execSync8(
       "find . -type d -name venv -not -path '*/node_modules/*'",
       {
         encoding: "utf8"
@@ -2110,12 +2152,12 @@ Total: ${folders.length} venv folder(s)`);
 }
 
 // src/commands/verify/run/filterByChangedFiles.ts
-import { minimatch as minimatch3 } from "minimatch";
+import { minimatch as minimatch4 } from "minimatch";
 
 // src/commands/verify/run/getChangedFiles.ts
-import { execSync as execSync10 } from "child_process";
+import { execSync as execSync9 } from "child_process";
 function getChangedFiles() {
-  const output = execSync10("git diff --name-only HEAD", {
+  const output = execSync9("git diff --name-only HEAD", {
     encoding: "utf8"
   }).trim();
   if (output === "") return [];
@@ -2131,7 +2173,7 @@ function filterByChangedFiles(entries) {
     const { filter } = entry;
     if (!filter) return true;
     if (changedFiles.length === 0) return false;
-    return changedFiles.some((file) => minimatch3(file, filter));
+    return changedFiles.some((file) => minimatch4(file, filter));
   });
 }
 
@@ -2286,81 +2328,26 @@ async function run(options2 = {}) {
   handleResults(results, entries.length);
 }
 
-// src/commands/verify/settingsGuard.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-
-// src/commands/verify/findAssistReferences.ts
-function offendingEntries(list4) {
-  if (!Array.isArray(list4)) return [];
-  return list4.filter(
-    (entry) => typeof entry === "string" && /\bassist\b/.test(entry)
-  );
-}
-function findAssistReferences(settings) {
-  const permissions = settings?.permissions ?? {};
-  return [
-    ...offendingEntries(permissions.allow).map(
-      (entry) => ({ list: "allow", entry })
-    ),
-    ...offendingEntries(permissions.deny).map(
-      (entry) => ({ list: "deny", entry })
-    )
-  ];
-}
-
-// src/commands/verify/settingsGuard.ts
-var SETTINGS_PATH = "claude/settings.json";
-function settingsGuard() {
-  if (!existsSync12(SETTINGS_PATH)) {
-    console.log(`No ${SETTINGS_PATH}; nothing to guard.`);
-    process.exit(0);
-  }
-  let settings;
-  try {
-    settings = JSON.parse(readFileSync9(SETTINGS_PATH, "utf8"));
-  } catch (error) {
-    console.log(
-      `Could not parse ${SETTINGS_PATH}: ${error.message}`
-    );
-    process.exit(1);
-  }
-  const offenders = findAssistReferences(settings);
-  if (offenders.length === 0) {
-    console.log(`No assist references in ${SETTINGS_PATH} permissions.`);
-    process.exit(0);
-  }
-  console.log(`assist references found in ${SETTINGS_PATH} permissions:
-`);
-  for (const { list: list4, entry } of offenders) {
-    console.log(`  permissions.${list4}: ${entry}`);
-  }
-  console.log(
-    `
-Total: ${offenders.length} entry(ies). Remove every assist reference from the permission lists.`
-  );
-  process.exit(1);
-}
-
 // src/commands/new/registerNew/initGit.ts
-import { execSync as execSync11 } from "child_process";
+import { execSync as execSync10 } from "child_process";
 import { writeFileSync as writeFileSync9 } from "fs";
 function initGit() {
   console.log("Initializing git repository...");
-  execSync11("git init", { stdio: "inherit" });
+  execSync10("git init", { stdio: "inherit" });
   writeFileSync9(".gitignore", "dist\nnode_modules\n");
 }
 
 // src/commands/new/registerNew/newCli/initPackageJson.ts
-import { execSync as execSync12 } from "child_process";
+import { execSync as execSync11 } from "child_process";
 function initPackageJson(name) {
   console.log("Initializing package.json...");
-  execSync12("npm init -y", { stdio: "inherit" });
+  execSync11("npm init -y", { stdio: "inherit" });
   console.log("Configuring package.json...");
-  execSync12("npm pkg delete main", { stdio: "inherit" });
-  execSync12("npm pkg set type=module", { stdio: "inherit" });
-  execSync12(`npm pkg set bin.${name}=./dist/index.js`, { stdio: "inherit" });
-  execSync12("npm pkg set scripts.build=tsup", { stdio: "inherit" });
-  execSync12('npm pkg set scripts.start="node dist/index.js"', {
+  execSync11("npm pkg delete main", { stdio: "inherit" });
+  execSync11("npm pkg set type=module", { stdio: "inherit" });
+  execSync11(`npm pkg set bin.${name}=./dist/index.js`, { stdio: "inherit" });
+  execSync11("npm pkg set scripts.build=tsup", { stdio: "inherit" });
+  execSync11('npm pkg set scripts.start="node dist/index.js"', {
     stdio: "inherit"
   });
 }
@@ -2425,8 +2412,8 @@ async function newCli() {
   initGit();
   initPackageJson(name);
   console.log("Installing dependencies...");
-  execSync13("npm install commander", { stdio: "inherit" });
-  execSync13("npm install -D tsup typescript @types/node", {
+  execSync12("npm install commander", { stdio: "inherit" });
+  execSync12("npm install -D tsup typescript @types/node", {
     stdio: "inherit"
   });
   writeCliTemplate(name);
@@ -2435,16 +2422,16 @@ async function newCli() {
 }
 
 // src/commands/new/registerNew/newProject.ts
-import { execSync as execSync15 } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync11, writeFileSync as writeFileSync12 } from "fs";
+import { execSync as execSync14 } from "child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync10, writeFileSync as writeFileSync12 } from "fs";
 
 // src/commands/deploy/init/index.ts
-import { execSync as execSync14 } from "child_process";
+import { execSync as execSync13 } from "child_process";
 import chalk26 from "chalk";
 import enquirer3 from "enquirer";
 
 // src/commands/deploy/init/updateWorkflow.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname11, join as join9 } from "path";
 import { fileURLToPath } from "url";
 import chalk25 from "chalk";
@@ -2454,13 +2441,13 @@ function getExistingSiteId() {
   if (!existsSync13(WORKFLOW_PATH)) {
     return null;
   }
-  const content = readFileSync10(WORKFLOW_PATH, "utf8");
+  const content = readFileSync9(WORKFLOW_PATH, "utf8");
   const match = content.match(/-s\s+([a-f0-9-]{36})/);
   return match ? match[1] : null;
 }
 function getTemplateContent(siteId) {
   const templatePath = join9(__dirname2, "commands/deploy/build.yml");
-  const template = readFileSync10(templatePath, "utf8");
+  const template = readFileSync9(templatePath, "utf8");
   return template.replace("{{NETLIFY_SITE_ID}}", siteId);
 }
 async function updateWorkflow(siteId) {
@@ -2470,7 +2457,7 @@ async function updateWorkflow(siteId) {
     mkdirSync3(workflowDir, { recursive: true });
   }
   if (existsSync13(WORKFLOW_PATH)) {
-    const oldContent = readFileSync10(WORKFLOW_PATH, "utf8");
+    const oldContent = readFileSync9(WORKFLOW_PATH, "utf8");
     if (oldContent === newContent) {
       console.log(chalk25.green("build.yml is already up to date"));
       return;
@@ -2492,7 +2479,7 @@ Created ${WORKFLOW_PATH}`));
 // src/commands/deploy/init/index.ts
 async function ensureNetlifyCli() {
   try {
-    execSync14("netlify sites:create --disable-linking", { stdio: "inherit" });
+    execSync13("netlify sites:create --disable-linking", { stdio: "inherit" });
   } catch (error) {
     if (!(error instanceof Error) || !error.message.includes("command not found"))
       throw error;
@@ -2507,9 +2494,9 @@ async function ensureNetlifyCli() {
       process.exit(1);
     }
     console.log(chalk26.dim("\nInstalling netlify-cli...\n"));
-    execSync14("npm install -g netlify-cli", { stdio: "inherit" });
+    execSync13("npm install -g netlify-cli", { stdio: "inherit" });
     console.log();
-    execSync14("netlify sites:create --disable-linking", { stdio: "inherit" });
+    execSync13("netlify sites:create --disable-linking", { stdio: "inherit" });
   }
 }
 function printSetupInstructions() {
@@ -2552,7 +2539,7 @@ async function init5() {
 // src/commands/new/registerNew/newProject.ts
 async function newProject() {
   console.log("Initializing Vite with react-ts template...");
-  execSync15("npm create vite@latest . -- --template react-ts", {
+  execSync14("npm create vite@latest . -- --template react-ts", {
     stdio: "inherit"
   });
   initGit();
@@ -2568,7 +2555,7 @@ function addViteBaseConfig() {
     console.log("No vite.config.ts found, skipping base config");
     return;
   }
-  const content = readFileSync11(viteConfigPath, "utf8");
+  const content = readFileSync10(viteConfigPath, "utf8");
   if (content.includes("base:")) {
     console.log("vite.config.ts already has base config");
     return;
@@ -2744,11 +2731,11 @@ function activityChart(data, range) {
 }
 
 // src/commands/activity/fetchCommitsPerDay.ts
-import { execSync as execSync16 } from "child_process";
+import { execSync as execSync15 } from "child_process";
 function fetchContributions(from, to) {
   const query = `{ viewer { contributionsCollection(from: "${from}T00:00:00Z", to: "${to}T23:59:59Z") { contributionCalendar { weeks { contributionDays { date contributionCount } } } } } }`;
   const jq = ".data.viewer.contributionsCollection.contributionCalendar.weeks[].contributionDays[]";
-  const raw = execSync16(`gh api graphql -f query='${query}' --jq '${jq}'`, {
+  const raw = execSync15(`gh api graphql -f query='${query}' --jq '${jq}'`, {
     encoding: "utf8"
   }).trim();
   if (!raw) return [];
@@ -3210,10 +3197,10 @@ import { join as join10 } from "path";
 import chalk28 from "chalk";
 
 // src/commands/backup/readCrontab.ts
-import { execSync as execSync17 } from "child_process";
+import { execSync as execSync16 } from "child_process";
 function readCrontab() {
   try {
-    return execSync17("crontab -l", {
+    return execSync16("crontab -l", {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -3223,7 +3210,7 @@ function readCrontab() {
 }
 function writeCrontab(content) {
   try {
-    execSync17("crontab -", {
+    execSync16("crontab -", {
       input: content,
       stdio: ["pipe", "ignore", "pipe"]
     });
@@ -3391,40 +3378,17 @@ import chalk29 from "chalk";
 // src/commands/backlog/dump/DumpTable.ts
 var DUMP_FORMAT = "assist-backlog-dump";
 var DUMP_VERSION = 1;
-var DUMP_TABLES = [
-  {
-    name: "items",
-    columns: [
-      "id",
-      "origin",
-      "type",
-      "name",
-      "description",
-      "acceptance_criteria",
-      "status",
-      "current_phase"
-    ]
-  },
-  {
-    name: "comments",
-    columns: ["id", "item_id", "idx", "text", "phase", "timestamp", "type"]
-  },
-  { name: "links", columns: ["item_id", "type", "target_id"] },
-  { name: "plan_phases", columns: ["item_id", "idx", "name", "manual_checks"] },
-  { name: "plan_tasks", columns: ["item_id", "phase_idx", "idx", "task"] },
-  { name: "metadata", columns: ["key", "value"] }
-];
 
 // src/commands/backlog/dump/buildDump.ts
-async function buildDump(copyOut) {
+async function buildDump(tables, copyOut) {
   const header = JSON.stringify({
     format: DUMP_FORMAT,
     version: DUMP_VERSION,
-    tables: DUMP_TABLES.map(({ name, columns }) => ({ name, columns }))
+    tables: tables.map(({ name, columns }) => ({ name, columns }))
   });
   const parts = [Buffer.from(`${header}
 `, "utf8")];
-  for (const table of DUMP_TABLES) {
+  for (const table of tables) {
     const data = await copyOut(table);
     parts.push(Buffer.from(`@table ${table.name} ${data.length}
 `, "utf8"));
@@ -3445,11 +3409,95 @@ async function copyTableOut(client, table) {
   return Buffer.concat(chunks);
 }
 
+// src/commands/backlog/dump/groupColumns.ts
+function groupColumns(rows) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const { table_name, quoted_table, quoted_column } of rows) {
+    let entry = byName.get(table_name);
+    if (!entry) {
+      entry = { raw: table_name, table: { name: quoted_table, columns: [] } };
+      byName.set(table_name, entry);
+    }
+    entry.table.columns.push(quoted_column);
+  }
+  return [...byName.values()];
+}
+
+// src/commands/backlog/dump/orderDumpTables.ts
+function buildGraph(names, edges) {
+  const present = new Set(names);
+  const indegree = new Map(names.map((n) => [n, 0]));
+  const children = /* @__PURE__ */ new Map();
+  for (const { child, parent } of edges) {
+    if (!present.has(child) || !present.has(parent)) continue;
+    indegree.set(child, (indegree.get(child) ?? 0) + 1);
+    children.set(parent, [...children.get(parent) ?? [], child]);
+  }
+  return { indegree, children };
+}
+function nextReady(names, emitted, indegree) {
+  return names.find((n) => !emitted.has(n) && (indegree.get(n) ?? 0) === 0);
+}
+function topoSort(entries, edges) {
+  const names = entries.map((e) => e.raw);
+  const { indegree, children } = buildGraph(names, edges);
+  const byRaw = new Map(entries.map((e) => [e.raw, e.table]));
+  const ordered = [];
+  const emitted = /* @__PURE__ */ new Set();
+  while (ordered.length < entries.length) {
+    const next3 = nextReady(names, emitted, indegree);
+    if (!next3)
+      throw new Error("Cannot dump: foreign-key cycle between tables.");
+    emitted.add(next3);
+    ordered.push(byRaw.get(next3));
+    for (const child of children.get(next3) ?? []) {
+      indegree.set(child, (indegree.get(child) ?? 0) - 1);
+    }
+  }
+  return ordered;
+}
+function orderDumpTables(columnRows, fkRows) {
+  return topoSort(groupColumns(columnRows), fkRows);
+}
+
+// src/commands/backlog/dump/introspectDumpTables.ts
+var COLUMNS_SQL = `
+	SELECT
+		c.table_name AS table_name,
+		quote_ident(c.table_name) AS quoted_table,
+		quote_ident(c.column_name) AS quoted_column
+	FROM information_schema.columns c
+	JOIN information_schema.tables t
+		ON t.table_schema = c.table_schema
+		AND t.table_name = c.table_name
+	WHERE c.table_schema = 'public'
+		AND t.table_type = 'BASE TABLE'
+	ORDER BY c.table_name, c.ordinal_position
+`;
+var FK_SQL = `
+	SELECT child.relname AS child, parent.relname AS parent
+	FROM pg_constraint con
+	JOIN pg_class child ON child.oid = con.conrelid
+	JOIN pg_class parent ON parent.oid = con.confrelid
+	JOIN pg_namespace n ON n.oid = con.connamespace
+	WHERE con.contype = 'f'
+		AND n.nspname = 'public'
+		AND con.conrelid <> con.confrelid
+`;
+async function introspectDumpTables(client) {
+  const [{ rows: columnRows }, { rows: fkRows }] = await Promise.all([
+    client.query(COLUMNS_SQL),
+    client.query(FK_SQL)
+  ]);
+  return orderDumpTables(columnRows, fkRows);
+}
+
 // src/commands/backlog/export/index.ts
 async function exportBacklog(file) {
-  const dump = await withDbClient(
-    (client) => buildDump((table) => copyTableOut(client, table))
-  );
+  const dump = await withDbClient(async (client) => {
+    const tables = await introspectDumpTables(client);
+    return buildDump(tables, (table) => copyTableOut(client, table));
+  });
   if (file) {
     await writeFile(file, dump);
     console.error(
@@ -3496,7 +3544,7 @@ import chalk42 from "chalk";
 import enquirer5 from "enquirer";
 
 // src/shared/pullIfConfigured.ts
-import { execSync as execSync18 } from "child_process";
+import { execSync as execSync17 } from "child_process";
 import chalk31 from "chalk";
 function pullIfConfigured() {
   const config = loadConfig();
@@ -3510,7 +3558,7 @@ function pullIfConfigured() {
     return;
   }
   try {
-    execSync18("git pull --ff-only", { stdio: "inherit" });
+    execSync17("git pull --ff-only", { stdio: "inherit" });
   } catch {
     console.error(chalk31.red("git pull --ff-only failed; aborting."));
     process.exit(1);
@@ -3518,7 +3566,7 @@ function pullIfConfigured() {
 }
 function hasLocalChanges() {
   try {
-    const status2 = execSync18("git status --porcelain", {
+    const status2 = execSync17("git status --porcelain", {
       encoding: "utf8"
     });
     return status2.trim().length > 0;
@@ -3531,7 +3579,7 @@ function hasLocalChanges() {
 import {
   existsSync as existsSync15,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync11,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync13
 } from "fs";
@@ -3555,7 +3603,7 @@ function isLockedByOther(itemId) {
   const lockPath = getLockPath(itemId);
   if (!existsSync15(lockPath)) return false;
   try {
-    const lock = JSON.parse(readFileSync12(lockPath, "utf8"));
+    const lock = JSON.parse(readFileSync11(lockPath, "utf8"));
     if (lock.pid === process.pid) return false;
     return isProcessAlive(lock.pid);
   } catch {
@@ -3767,11 +3815,11 @@ function backupLocalBacklogFiles(dir) {
 }
 
 // src/commands/backlog/gitPullBacklog.ts
-import { execSync as execSync19 } from "child_process";
+import { execSync as execSync18 } from "child_process";
 import chalk34 from "chalk";
 function gitPullBacklog(dir) {
   try {
-    execSync19("git pull --ff-only", {
+    execSync18("git pull --ff-only", {
       cwd: dir,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -4008,7 +4056,7 @@ async function loadAllItems(orm, origin) {
 }
 
 // src/commands/backlog/parseBacklogJsonl.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 
 // src/commands/backlog/types.ts
 import { z as z3 } from "zod";
@@ -4053,7 +4101,7 @@ var backlogFileSchema = z3.array(backlogItemSchema);
 
 // src/commands/backlog/parseBacklogJsonl.ts
 function parseBacklogJsonl(path57) {
-  const content = readFileSync13(path57, "utf8").trim();
+  const content = readFileSync12(path57, "utf8").trim();
   if (content.length === 0) return [];
   return content.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => backlogItemSchema.parse(JSON.parse(line)));
 }
@@ -4399,7 +4447,7 @@ Failed to launch Claude for ${context}: ${message}`)
 }
 
 // src/shared/emitActivity.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync14, rmSync as rmSync2, writeFileSync as writeFileSync16 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync13, rmSync, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir7 } from "os";
 import { dirname as dirname14, join as join18 } from "path";
 import { z as z4 } from "zod";
@@ -4425,7 +4473,7 @@ function emitActivity(activity2) {
 }
 function readActivity(path57) {
   try {
-    return JSON.parse(readFileSync14(path57, "utf8"));
+    return JSON.parse(readFileSync13(path57, "utf8"));
   } catch {
     return void 0;
   }
@@ -4441,7 +4489,7 @@ function reconcileActivity(sessionId, activity2) {
 }
 function removeActivity(sessionId) {
   try {
-    rmSync2(activityPath(sessionId));
+    rmSync(activityPath(sessionId));
   } catch {
   }
 }
@@ -4576,7 +4624,7 @@ async function handleIncompletePhase() {
 }
 
 // src/commands/backlog/readSignal.ts
-import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync14 } from "fs";
 
 // src/commands/backlog/writeSignal.ts
 import { writeFileSync as writeFileSync17 } from "fs";
@@ -4597,7 +4645,7 @@ function readSignal() {
   const path57 = getSignalPath();
   if (!existsSync20(path57)) return void 0;
   try {
-    return JSON.parse(readFileSync15(path57, "utf8"));
+    return JSON.parse(readFileSync14(path57, "utf8"));
   } catch {
     return void 0;
   }
@@ -5056,7 +5104,7 @@ function printComments(item) {
 import { WebSocketServer } from "ws";
 
 // src/shared/getInstallDir.ts
-import { execSync as execSync20 } from "child_process";
+import { execSync as execSync19 } from "child_process";
 import { dirname as dirname15, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __filename2 = fileURLToPath2(import.meta.url);
@@ -5066,7 +5114,7 @@ function getInstallDir() {
 }
 function isGitRepo(dir) {
   try {
-    const result = execSync20("git rev-parse --show-toplevel", {
+    const result = execSync19("git rev-parse --show-toplevel", {
       cwd: dir,
       stdio: "pipe"
     }).toString().trim();
@@ -5083,11 +5131,11 @@ import {
 import chalk49 from "chalk";
 
 // src/lib/openBrowser.ts
-import { execSync as execSync21 } from "child_process";
+import { execSync as execSync20 } from "child_process";
 function tryExec(commands) {
   for (const cmd of commands) {
     try {
-      execSync21(cmd, { stdio: "ignore" });
+      execSync20(cmd, { stdio: "ignore" });
       return true;
     } catch {
     }
@@ -5300,12 +5348,12 @@ function delay(ms) {
 
 // src/commands/sessions/web/handleRequest.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { createRequire as createRequire2 } from "module";
 
 // src/shared/createBundleHandler.ts
 import { createHash } from "crypto";
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { dirname as dirname16, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function createBundleHandler(importMetaUrl, bundlePath) {
@@ -5313,7 +5361,7 @@ function createBundleHandler(importMetaUrl, bundlePath) {
   let cache;
   return (req, res) => {
     if (!cache) {
-      const body = readFileSync16(join20(dir, bundlePath), "utf8");
+      const body = readFileSync15(join20(dir, bundlePath), "utf8");
       const etag = `"${createHash("sha256").update(body).digest("hex").slice(0, 16)}"`;
       cache = { body, etag };
     }
@@ -5662,7 +5710,7 @@ function getHtml() {
 }
 
 // src/commands/prs/getPreferredRemoteRepo.ts
-import { execSync as execSync22 } from "child_process";
+import { execSync as execSync21 } from "child_process";
 var GITHUB_URL_PATTERN = /(?:git@github\.com:|https:\/\/github\.com\/)([^/]+)\/([^/]+?)(?:\.git)?\/?$/;
 function parseGitHubUrl(url) {
   const match = url.match(GITHUB_URL_PATTERN);
@@ -5671,7 +5719,7 @@ function parseGitHubUrl(url) {
 }
 function tryGetRemoteUrl(remote, cwd) {
   try {
-    return execSync22(`git remote get-url ${remote}`, {
+    return execSync21(`git remote get-url ${remote}`, {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       cwd
@@ -5682,7 +5730,7 @@ function tryGetRemoteUrl(remote, cwd) {
 }
 function getCurrentBranchRemote(cwd) {
   try {
-    const ref = execSync22(
+    const ref = execSync21(
       "git rev-parse --abbrev-ref --symbolic-full-name @{u}",
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], cwd }
     ).trim();
@@ -5694,7 +5742,7 @@ function getCurrentBranchRemote(cwd) {
 }
 function listRemotes(cwd) {
   try {
-    return execSync22("git remote", {
+    return execSync21("git remote", {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       cwd
@@ -6060,7 +6108,7 @@ function createCssHandler(packageEntry) {
   return (req, res) => {
     if (!cache) {
       const resolved = require3.resolve(packageEntry);
-      const body = readFileSync17(resolved, "utf8");
+      const body = readFileSync16(resolved, "utf8");
       const etag = `"${createHash2("sha256").update(body).digest("hex").slice(0, 16)}"`;
       cache = { body, etag };
     }
@@ -6573,7 +6621,7 @@ function registerCommentCommands(cmd) {
 // src/commands/backlog/registerExportCommand.ts
 function registerExportCommand(cmd) {
   cmd.command("export [file]").description(
-    "Export the entire backlog database to a file, or stdout if omitted"
+    "Export every table in the backlog database (discovered by introspection) to a file, or stdout if omitted"
   ).action(exportBacklog);
 }
 
@@ -6631,11 +6679,9 @@ function parseDump(dump) {
 }
 
 // src/commands/backlog/dump/validateDump.ts
-function tableShape(tables) {
-  return JSON.stringify(tables.map(({ name, columns }) => ({ name, columns })));
-}
 function validateDump({ header, sections }) {
-  const missing = DUMP_TABLES.find(({ name }) => !sections.has(name))?.name;
+  const tables = header.tables ?? [];
+  const missing = tables.find(({ name }) => !sections.has(name))?.name;
   const checks = [
     [
       header.format === DUMP_FORMAT,
@@ -6645,10 +6691,7 @@ function validateDump({ header, sections }) {
       header.version === DUMP_VERSION,
       `Unsupported dump version ${header.version} (this build restores version ${DUMP_VERSION}).`
     ],
-    [
-      tableShape(header.tables ?? []) === tableShape(DUMP_TABLES),
-      "Dump table set does not match this build's backlog schema; cannot restore."
-    ],
+    [tables.length > 0, "Dump header lists no tables; cannot restore."],
     [!missing, `Invalid dump: missing data section for "${missing}".`]
   ];
   const failure = checks.find(([ok]) => !ok);
@@ -6663,24 +6706,24 @@ async function countRows(client, table) {
   );
   return rows[0].n;
 }
-function printSummary(current, incoming) {
-  const lines = DUMP_TABLES.map(
+function printSummary(tables, current, incoming) {
+  const lines = tables.map(
     (t, i) => `  ${t.name}: ${current[i]} \u2192 ${incoming[i]} rows`
   );
   console.error(chalk57.bold("\nThis will REPLACE all backlog data:"));
   console.error(`${lines.join("\n")}
 `);
 }
-async function confirmReplace(client, incoming, fromStdin) {
+async function confirmReplace(client, tables, incoming, fromStdin) {
   if (fromStdin) {
     throw new Error(
       "Reading a dump from stdin requires --yes (stdin is consumed by the dump)."
     );
   }
   const current = await Promise.all(
-    DUMP_TABLES.map((t) => countRows(client, t.name))
+    tables.map((t) => countRows(client, t.name))
   );
-  printSummary(current, incoming);
+  printSummary(tables, current, incoming);
   return promptConfirm("Replace all backlog data with this dump?", false);
 }
 
@@ -6703,23 +6746,48 @@ async function copyTableIn(client, table, data) {
   await finished(stream);
 }
 
-// src/commands/backlog/import/restore.ts
-var IDENTITY_TABLES = ["items", "comments"];
-function resyncIdentitySql(table) {
-  return `SELECT setval(pg_get_serial_sequence('${table}', 'id'),
-		GREATEST(COALESCE((SELECT max(id) FROM ${table}), 0), 1),
-		(SELECT count(*) FROM ${table}) > 0)`;
+// src/commands/backlog/dump/introspectIdentityColumns.ts
+var IDENTITY_SQL = `
+	SELECT
+		quote_ident(table_name) AS table,
+		quote_ident(column_name) AS column,
+		column_name AS raw_column
+	FROM information_schema.columns
+	WHERE table_schema = 'public'
+		AND is_identity = 'YES'
+	ORDER BY table_name, ordinal_position
+`;
+async function introspectIdentityColumns(client) {
+  const { rows } = await client.query(IDENTITY_SQL);
+  return rows.map((row) => ({
+    table: row.table,
+    column: row.column,
+    rawColumn: row.raw_column
+  }));
 }
+function resyncIdentitySql(col) {
+  return {
+    text: `SELECT setval(
+			pg_get_serial_sequence($1, $2),
+			GREATEST(COALESCE((SELECT max(${col.column}) FROM ${col.table}), 0), 1),
+			(SELECT count(*) FROM ${col.table}) > 0)`,
+    values: [col.table, col.rawColumn]
+  };
+}
+
+// src/commands/backlog/import/restore.ts
 async function replaceData(client, parsed) {
-  const tables = DUMP_TABLES.map((t) => t.name).join(", ");
+  const { tables } = parsed.header;
+  const tableList = tables.map((t) => t.name).join(", ");
   await client.query(SCHEMA);
-  await client.query(`TRUNCATE ${tables} RESTART IDENTITY CASCADE`);
-  for (const table of DUMP_TABLES) {
+  await client.query(`TRUNCATE ${tableList} RESTART IDENTITY CASCADE`);
+  for (const table of tables) {
     const data = parsed.sections.get(table.name) ?? Buffer.alloc(0);
     await copyTableIn(client, table, data);
   }
-  for (const table of IDENTITY_TABLES) {
-    await client.query(resyncIdentitySql(table));
+  for (const col of await introspectIdentityColumns(client)) {
+    const { text: text6, values } = resyncIdentitySql(col);
+    await client.query(text6, values);
   }
 }
 async function restore(client, parsed) {
@@ -6738,11 +6806,12 @@ async function importBacklog(file, options2 = {}) {
   const raw = file ? await readFile(file) : await readStdinBuffer();
   const parsed = parseDump(raw);
   validateDump(parsed);
-  const incoming = DUMP_TABLES.map(
+  const { tables } = parsed.header;
+  const incoming = tables.map(
     (t) => countCopyRows(parsed.sections.get(t.name) ?? Buffer.alloc(0))
   );
   await withDbClient(async (client) => {
-    if (!options2.yes && !await confirmReplace(client, incoming, !file)) {
+    if (!options2.yes && !await confirmReplace(client, tables, incoming, !file)) {
       console.error(chalk58.yellow("Import cancelled; no changes made."));
       return;
     }
@@ -6750,7 +6819,7 @@ async function importBacklog(file, options2 = {}) {
     const total = incoming.reduce((sum, n) => sum + n, 0);
     console.error(
       chalk58.green(
-        `Imported backlog: ${total} rows restored across ${DUMP_TABLES.length} tables.`
+        `Imported backlog: ${total} rows restored across ${tables.length} tables.`
       )
     );
   });
@@ -6759,7 +6828,7 @@ async function importBacklog(file, options2 = {}) {
 // src/commands/backlog/registerImportCommand.ts
 function registerImportCommand(cmd) {
   cmd.command("import [file]").description(
-    "Restore the entire backlog database from a dump file, or stdin if omitted (destructive)"
+    "Restore every table in a dump back into the backlog database, in foreign-key-safe order, from a file or stdin if omitted (destructive)"
   ).option("-y, --yes", "Skip the confirmation prompt").action(
     (file, options2) => importBacklog(file, options2)
   );
@@ -6770,7 +6839,7 @@ import chalk59 from "chalk";
 
 // src/commands/backlog/add/shared.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync18, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync17, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18 } from "fs";
 import { tmpdir } from "os";
 import { join as join21 } from "path";
 import enquirer6 from "enquirer";
@@ -6820,7 +6889,7 @@ function openEditor() {
     unlinkSync6(filePath);
     return void 0;
   }
-  const content = readFileSync18(filePath, "utf8").trim();
+  const content = readFileSync17(filePath, "utf8").trim();
   unlinkSync6(filePath);
   return content || void 0;
 }
@@ -8291,7 +8360,7 @@ function extractGraphqlQuery(args) {
 }
 
 // src/shared/loadCliReads.ts
-import { existsSync as existsSync23, readFileSync as readFileSync19, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname17, resolve as resolve8 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var __filename3 = fileURLToPath4(import.meta.url);
@@ -8301,7 +8370,7 @@ function packageRoot() {
 }
 function readLines(path57) {
   if (!existsSync23(path57)) return [];
-  return readFileSync19(path57, "utf8").split("\n").filter((line) => line.trim() !== "");
+  return readFileSync18(path57, "utf8").split("\n").filter((line) => line.trim() !== "");
 }
 var cachedReads;
 var cachedWrites;
@@ -8347,7 +8416,7 @@ function findCliWrite(command) {
 }
 
 // src/shared/readSettingsPerms.ts
-import { existsSync as existsSync24, readFileSync as readFileSync20 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync19 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join23 } from "path";
 function readSettingsPerms(key) {
@@ -8365,7 +8434,7 @@ function readSettingsPerms(key) {
 function readPermissionArray(filePath, key) {
   if (!existsSync24(filePath)) return [];
   try {
-    const data = JSON.parse(readFileSync20(filePath, "utf8"));
+    const data = JSON.parse(readFileSync19(filePath, "utf8"));
     const arr = data?.permissions?.[key];
     return Array.isArray(arr) ? arr.filter((e) => typeof e === "string") : [];
   } catch {
@@ -8627,12 +8696,12 @@ ${reasons.join("\n")}`);
 }
 
 // src/commands/permitCliReads/index.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync21, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync20, writeFileSync as writeFileSync20 } from "fs";
 import { homedir as homedir10 } from "os";
 import { join as join24 } from "path";
 
 // src/shared/checkCliAvailable.ts
-import { execSync as execSync23 } from "child_process";
+import { execSync as execSync22 } from "child_process";
 function checkCliAvailable(cli) {
   const binary = cli.split(/\s+/)[0];
   const opts = {
@@ -8640,11 +8709,11 @@ function checkCliAvailable(cli) {
     stdio: ["ignore", "pipe", "pipe"]
   };
   try {
-    execSync23(`command -v ${binary}`, opts);
+    execSync22(`command -v ${binary}`, opts);
     return true;
   } catch {
     try {
-      execSync23(`where ${binary}`, opts);
+      execSync22(`where ${binary}`, opts);
       return true;
     } catch {
       return false;
@@ -8923,7 +8992,7 @@ function logPath(cli) {
 function readCache(cli) {
   const path57 = logPath(cli);
   if (!existsSync25(path57)) return void 0;
-  return readFileSync21(path57, "utf8");
+  return readFileSync20(path57, "utf8");
 }
 function writeCache(cli, output) {
   const dir = join24(homedir10(), ".assist");
@@ -9069,11 +9138,11 @@ import ts5 from "typescript";
 // src/commands/complexity/findSourceFiles.ts
 import fs15 from "fs";
 import path20 from "path";
-import { minimatch as minimatch4 } from "minimatch";
+import { minimatch as minimatch5 } from "minimatch";
 function applyIgnoreGlobs(files, extraIgnore = []) {
   const { complexity } = loadConfig();
   const ignore2 = [...complexity.ignore, ...extraIgnore];
-  return files.filter((f) => !ignore2.some((glob) => minimatch4(f, glob)));
+  return files.filter((f) => !ignore2.some((glob) => minimatch5(f, glob)));
 }
 function walk(dir, results) {
   if (!fs15.existsSync(dir)) {
@@ -9097,7 +9166,7 @@ function findSourceFiles2(pattern2, baseDir = ".", extraIgnore = []) {
   if (pattern2.includes("*")) {
     walk(baseDir, results);
     return applyIgnoreGlobs(
-      results.filter((f) => minimatch4(f, pattern2)),
+      results.filter((f) => minimatch5(f, pattern2)),
       extraIgnore
     );
   }
@@ -9110,7 +9179,7 @@ function findSourceFiles2(pattern2, baseDir = ".", extraIgnore = []) {
   }
   walk(baseDir, results);
   return applyIgnoreGlobs(
-    results.filter((f) => minimatch4(f, pattern2)),
+    results.filter((f) => minimatch5(f, pattern2)),
     extraIgnore
   );
 }
@@ -9735,7 +9804,7 @@ function registerConfig(program2) {
 }
 
 // src/commands/deploy/redirect.ts
-import { existsSync as existsSync26, readFileSync as readFileSync22, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync21 } from "fs";
 import chalk99 from "chalk";
 var TRAILING_SLASH_SCRIPT = `    <script>
       if (!window.location.pathname.endsWith('/')) {
@@ -9748,7 +9817,7 @@ function redirect() {
     console.log(chalk99.yellow("No index.html found"));
     return;
   }
-  const content = readFileSync22(indexPath, "utf8");
+  const content = readFileSync21(indexPath, "utf8");
   if (content.includes("window.location.pathname.endsWith('/')")) {
     console.log(chalk99.dim("Trailing slash script already present"));
     return;
@@ -9787,11 +9856,11 @@ function loadBlogSkipDays(repoName) {
 }
 
 // src/commands/devlog/shared.ts
-import { execSync as execSync24 } from "child_process";
+import { execSync as execSync23 } from "child_process";
 import chalk100 from "chalk";
 
 // src/shared/getRepoName.ts
-import { existsSync as existsSync27, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync22 } from "fs";
 import { basename as basename3, join as join26 } from "path";
 function getRepoName() {
   const config = loadConfig();
@@ -9801,7 +9870,7 @@ function getRepoName() {
   const packageJsonPath = join26(process.cwd(), "package.json");
   if (existsSync27(packageJsonPath)) {
     try {
-      const content = readFileSync23(packageJsonPath, "utf8");
+      const content = readFileSync22(packageJsonPath, "utf8");
       const pkg = JSON.parse(content);
       if (pkg.name) {
         return pkg.name;
@@ -9813,7 +9882,7 @@ function getRepoName() {
 }
 
 // src/commands/devlog/loadDevlogEntries.ts
-import { readdirSync, readFileSync as readFileSync24 } from "fs";
+import { readdirSync, readFileSync as readFileSync23 } from "fs";
 import { join as join27 } from "path";
 var DEVLOG_DIR = join27(BLOG_REPO_ROOT, "src/content/devlog");
 function extractFrontmatter(content) {
@@ -9843,7 +9912,7 @@ function readDevlogFiles(callback) {
   try {
     const files = readdirSync(DEVLOG_DIR).filter((f) => f.endsWith(".md"));
     for (const file of files) {
-      const content = readFileSync24(join27(DEVLOG_DIR, file), "utf8");
+      const content = readFileSync23(join27(DEVLOG_DIR, file), "utf8");
       const parsed = parseFrontmatter(content, file);
       if (parsed) callback(parsed);
     }
@@ -9879,7 +9948,7 @@ function loadAllDevlogLatestDates() {
 // src/commands/devlog/shared.ts
 function getCommitFiles(hash) {
   try {
-    const output = execSync24(`git show --name-only --format="" ${hash}`, {
+    const output = execSync23(`git show --name-only --format="" ${hash}`, {
       encoding: "utf8"
     });
     return output.trim().split("\n").filter(Boolean);
@@ -9975,11 +10044,11 @@ function list3(options2) {
 }
 
 // src/commands/devlog/getLastVersionInfo.ts
-import { execFileSync as execFileSync3, execSync as execSync25 } from "child_process";
+import { execFileSync as execFileSync3, execSync as execSync24 } from "child_process";
 import semver from "semver";
 function getVersionAtCommit(hash) {
   try {
-    const content = execSync25(`git show ${hash}:package.json`, {
+    const content = execSync24(`git show ${hash}:package.json`, {
       encoding: "utf8"
     });
     const pkg = JSON.parse(content);
@@ -10152,7 +10221,7 @@ function next2(options2) {
 }
 
 // src/commands/devlog/repos/index.ts
-import { execSync as execSync26 } from "child_process";
+import { execSync as execSync25 } from "child_process";
 
 // src/commands/devlog/repos/printReposTable.ts
 import chalk104 from "chalk";
@@ -10187,7 +10256,7 @@ function getStatus(lastPush, lastDevlog) {
   return lastDevlog < lastPush ? "outdated" : "ok";
 }
 function fetchRepos(days, all) {
-  const json = execSync26(
+  const json = execSync25(
     "gh repo list staff0rd --json name,pushedAt,isArchived --limit 200",
     { encoding: "utf8" }
   );
@@ -10371,11 +10440,11 @@ async function checkBuildLocksCommand() {
 }
 
 // src/commands/dotnet/buildTree.ts
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync24 } from "fs";
 import path23 from "path";
 var PROJECT_REF_RE = /<ProjectReference\s+Include="([^"]+)"/g;
 function getProjectRefs(csprojPath) {
-  const content = readFileSync25(csprojPath, "utf8");
+  const content = readFileSync24(csprojPath, "utf8");
   const refs = [];
   for (const match of content.matchAll(PROJECT_REF_RE)) {
     refs.push(match[1].replace(/\\/g, "/"));
@@ -10392,7 +10461,7 @@ function buildTree(csprojPath, repoRoot, visited = /* @__PURE__ */ new Set()) {
   for (const ref of getProjectRefs(abs)) {
     const childAbs = path23.resolve(dir, ref);
     try {
-      readFileSync25(childAbs);
+      readFileSync24(childAbs);
       node.children.push(buildTree(childAbs, repoRoot, visited));
     } catch {
       node.children.push({
@@ -10417,7 +10486,7 @@ function collectAllDeps(node) {
 }
 
 // src/commands/dotnet/findContainingSolutions.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync26, statSync as statSync2 } from "fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync25, statSync as statSync2 } from "fs";
 import path24 from "path";
 function findSlnFiles(dir, maxDepth, depth = 0) {
   if (depth > maxDepth) return [];
@@ -10452,7 +10521,7 @@ function findContainingSolutions(csprojPath, repoRoot) {
   const pattern2 = new RegExp(`[\\\\"/]${escapeRegex(csprojBasename)}"`);
   for (const sln of slnFiles) {
     try {
-      const content = readFileSync26(sln, "utf8");
+      const content = readFileSync25(sln, "utf8");
       if (pattern2.test(content)) {
         matches.push(path24.relative(repoRoot, sln));
       }
@@ -10547,7 +10616,7 @@ async function deps(csprojPath, options2) {
 }
 
 // src/commands/dotnet/getChangedCsFiles.ts
-import { execSync as execSync27 } from "child_process";
+import { execSync as execSync26 } from "child_process";
 var SCOPE_ALL = "all";
 var SCOPE_BASE = "base:";
 var SCOPE_COMMIT = "commit:";
@@ -10571,7 +10640,7 @@ function getChangedCsFiles(scope) {
   } else {
     cmd = "git diff --name-only HEAD";
   }
-  const output = execSync27(cmd, { encoding: "utf8" }).trim();
+  const output = execSync26(cmd, { encoding: "utf8" }).trim();
   if (output === "") return [];
   return output.split("\n").filter((f) => f.toLowerCase().endsWith(".cs"));
 }
@@ -10769,14 +10838,14 @@ function parseInspectReport(json) {
 }
 
 // src/commands/dotnet/runInspectCode.ts
-import { execSync as execSync28 } from "child_process";
-import { existsSync as existsSync31, readFileSync as readFileSync27, unlinkSync as unlinkSync7 } from "fs";
+import { execSync as execSync27 } from "child_process";
+import { existsSync as existsSync31, readFileSync as readFileSync26, unlinkSync as unlinkSync7 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import path27 from "path";
 import chalk114 from "chalk";
 function assertJbInstalled() {
   try {
-    execSync28("jb inspectcode --version", { stdio: "pipe" });
+    execSync27("jb inspectcode --version", { stdio: "pipe" });
   } catch {
     console.error(chalk114.red("jb is not installed. Install with:"));
     console.error(
@@ -10790,7 +10859,7 @@ function runInspectCode(slnPath, include, swea) {
   const includeFlag = include ? ` --include="${include}"` : "";
   const sweaFlag = swea ? " --swea" : "";
   try {
-    execSync28(
+    execSync27(
       `jb inspectcode "${slnPath}" -o="${reportPath}"${includeFlag}${sweaFlag} --verbosity=OFF`,
       { stdio: "pipe" }
     );
@@ -10805,13 +10874,13 @@ function runInspectCode(slnPath, include, swea) {
     console.error(chalk114.red("Report file not generated"));
     process.exit(1);
   }
-  const xml = readFileSync27(reportPath, "utf8");
+  const xml = readFileSync26(reportPath, "utf8");
   unlinkSync7(reportPath);
   return xml;
 }
 
 // src/commands/dotnet/runRoslynInspect.ts
-import { execSync as execSync29 } from "child_process";
+import { execSync as execSync28 } from "child_process";
 import chalk115 from "chalk";
 function resolveMsbuildPath() {
   const { run: run4 } = loadConfig();
@@ -10822,7 +10891,7 @@ function resolveMsbuildPath() {
 function assertMsbuildInstalled() {
   const msbuild = resolveMsbuildPath();
   try {
-    execSync29(`"${msbuild}" -version`, { stdio: "pipe" });
+    execSync28(`"${msbuild}" -version`, { stdio: "pipe" });
   } catch {
     console.error(chalk115.red(`msbuild not found at: ${msbuild}`));
     console.error(
@@ -10848,7 +10917,7 @@ function runRoslynInspect(slnPath) {
   const msbuild = resolveMsbuildPath();
   let output;
   try {
-    output = execSync29(
+    output = execSync28(
       `"${msbuild}" "${slnPath}" -t:Build -v:minimal -maxcpucount -p:EnforceCodeStyleInBuild=true -p:RunAnalyzersDuringBuild=true 2>&1`,
       { encoding: "utf8", stdio: "pipe", maxBuffer: 50 * 1024 * 1024 }
     );
@@ -11148,8 +11217,8 @@ async function countPendingHandovers(orm, origin) {
 import {
   existsSync as existsSync32,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync28,
-  rmSync as rmSync3,
+  readFileSync as readFileSync27,
+  rmSync as rmSync2,
   statSync as statSync3
 } from "fs";
 import { basename as basename5, join as join34 } from "path";
@@ -11211,14 +11280,14 @@ function collectMarkdown(dir) {
   return out;
 }
 async function migrateFile(orm, origin, file, createdAt) {
-  const content = readFileSync28(file, "utf8");
+  const content = readFileSync27(file, "utf8");
   await saveHandover(orm, {
     origin,
     summary: summariseHandoverContent(content),
     content,
     createdAt
   });
-  rmSync3(file);
+  rmSync2(file);
 }
 async function migrateDiskHandovers(orm, origin, cwd = process.cwd()) {
   let migrated = 0;
@@ -11419,12 +11488,12 @@ function adfToText(doc) {
 }
 
 // src/commands/jira/fetchIssue.ts
-import { execSync as execSync30 } from "child_process";
+import { execSync as execSync29 } from "child_process";
 import chalk119 from "chalk";
 function fetchIssue(issueKey, fields) {
   let result;
   try {
-    result = execSync30(
+    result = execSync29(
       `acli jira workitem view ${issueKey} -f ${fields} --json`,
       { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
     );
@@ -11470,10 +11539,10 @@ function acceptanceCriteria(issueKey) {
 }
 
 // src/commands/jira/jiraAuth.ts
-import { execSync as execSync31 } from "child_process";
+import { execSync as execSync30 } from "child_process";
 
 // src/shared/loadJson.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync11, readFileSync as readFileSync29, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync11, readFileSync as readFileSync28, writeFileSync as writeFileSync24 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join35 } from "path";
 function getStoreDir() {
@@ -11486,7 +11555,7 @@ function loadJson(filename) {
   const path57 = getStorePath(filename);
   if (existsSync33(path57)) {
     try {
-      return JSON.parse(readFileSync29(path57, "utf8"));
+      return JSON.parse(readFileSync28(path57, "utf8"));
     } catch {
       return {};
     }
@@ -11534,7 +11603,7 @@ async function jiraAuth() {
       console.error("All fields are required.");
       process.exit(1);
     }
-    execSync31(`acli jira auth login --site ${site} --email "${email}" --token`, {
+    execSync30(`acli jira auth login --site ${site} --email "${email}" --token`, {
       encoding: "utf8",
       input: token,
       stdio: ["pipe", "inherit", "inherit"]
@@ -11642,7 +11711,7 @@ import { resolve as resolve11 } from "path";
 import chalk125 from "chalk";
 
 // src/commands/mermaid/exportFile.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync25 } from "fs";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync25 } from "fs";
 import { basename as basename6, extname, resolve as resolve10 } from "path";
 import chalk124 from "chalk";
 
@@ -11668,7 +11737,7 @@ async function renderBlock(krokiUrl, source) {
 
 // src/commands/mermaid/exportFile.ts
 async function exportFile(file, outDir, krokiUrl, onlyIndex) {
-  const content = readFileSync30(file, "utf8");
+  const content = readFileSync29(file, "utf8");
   const blocks = extractMermaidBlocks(content);
   const stem = basename6(file, extname(file));
   if (onlyIndex !== void 0) {
@@ -11952,7 +12021,7 @@ import { join as join40 } from "path";
 import chalk128 from "chalk";
 
 // src/commands/netcap/extractPostsFromCapture.ts
-import { readFileSync as readFileSync31 } from "fs";
+import { readFileSync as readFileSync30 } from "fs";
 
 // src/commands/netcap/parseRscRows.ts
 var isRscRef = (v) => typeof v === "string" && /^\$[0-9a-fL@]/.test(v);
@@ -12348,7 +12417,7 @@ function extractVoyagerPosts(body) {
 
 // src/commands/netcap/extractPostsFromCapture.ts
 function captureEntries(captureFile) {
-  const lines = readFileSync31(captureFile, "utf8").split("\n").filter(Boolean);
+  const lines = readFileSync30(captureFile, "utf8").split("\n").filter(Boolean);
   const entries = [];
   for (const line of lines) {
     let entry;
@@ -12508,7 +12577,7 @@ function registerPrompts(program2) {
 }
 
 // src/commands/prs/shared.ts
-import { execSync as execSync32 } from "child_process";
+import { execSync as execSync31 } from "child_process";
 function isGhNotInstalled(error) {
   if (error instanceof Error) {
     const msg = error.message.toLowerCase();
@@ -12526,12 +12595,12 @@ function getRepoInfo() {
   const preferred = getPreferredRemoteRepo();
   if (preferred) return preferred;
   const repoInfo = JSON.parse(
-    execSync32("gh repo view --json owner,name", { encoding: "utf8" })
+    execSync31("gh repo view --json owner,name", { encoding: "utf8" })
   );
   return { org: repoInfo.owner.login, repo: repoInfo.name };
 }
 function getCurrentBranch() {
-  return execSync32("git rev-parse --abbrev-ref HEAD", {
+  return execSync31("git rev-parse --abbrev-ref HEAD", {
     encoding: "utf8"
   }).trim();
 }
@@ -12539,7 +12608,7 @@ function viewCurrentPr(fields) {
   const { org, repo } = getRepoInfo();
   const branch = getCurrentBranch();
   return JSON.parse(
-    execSync32(`gh pr view ${branch} --json ${fields} -R ${org}/${repo}`, {
+    execSync31(`gh pr view ${branch} --json ${fields} -R ${org}/${repo}`, {
       encoding: "utf8"
     })
   );
@@ -12643,7 +12712,7 @@ function comment2(path57, line, body, startLine) {
 }
 
 // src/commands/prs/edit.ts
-import { execSync as execSync33 } from "child_process";
+import { execSync as execSync32 } from "child_process";
 
 // src/commands/prs/buildPrBody.ts
 function jiraBrowseUrl(key) {
@@ -12816,23 +12885,23 @@ function edit(options2) {
   if (options2.title) args.push(`--title ${shellQuote(options2.title)}`);
   args.push(`--body ${shellQuote(newBody)}`);
   try {
-    execSync33(args.join(" "), { stdio: "inherit" });
+    execSync32(args.join(" "), { stdio: "inherit" });
   } catch {
     process.exit(1);
   }
 }
 
 // src/commands/prs/fixed.ts
-import { execSync as execSync36 } from "child_process";
+import { execSync as execSync35 } from "child_process";
 
 // src/commands/prs/resolveCommentWithReply.ts
-import { execSync as execSync35 } from "child_process";
+import { execSync as execSync34 } from "child_process";
 import { unlinkSync as unlinkSync10, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join42 } from "path";
 
 // src/commands/prs/loadCommentsCache.ts
-import { existsSync as existsSync34, readFileSync as readFileSync32, unlinkSync as unlinkSync9 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync31, unlinkSync as unlinkSync9 } from "fs";
 import { join as join41 } from "path";
 import { parse as parse2 } from "yaml";
 function getCachePath(prNumber) {
@@ -12843,7 +12912,7 @@ function loadCommentsCache(prNumber) {
   if (!existsSync34(cachePath)) {
     return null;
   }
-  const content = readFileSync32(cachePath, "utf8");
+  const content = readFileSync31(cachePath, "utf8");
   return parse2(content);
 }
 function deleteCommentsCache(prNumber) {
@@ -12855,9 +12924,9 @@ function deleteCommentsCache(prNumber) {
 }
 
 // src/commands/prs/replyToComment.ts
-import { execSync as execSync34 } from "child_process";
+import { execSync as execSync33 } from "child_process";
 function replyToComment(org, repo, prNumber, commentId, message) {
-  execSync34(
+  execSync33(
     `gh api repos/${org}/${repo}/pulls/${prNumber}/comments -f body="${message.replace(/"/g, String.raw`\"`)}" -F in_reply_to=${commentId}`,
     { stdio: ["inherit", "pipe", "inherit"] }
   );
@@ -12869,7 +12938,7 @@ function resolveThread(threadId) {
   const queryFile = join42(tmpdir5(), `gh-mutation-${Date.now()}.graphql`);
   writeFileSync27(queryFile, mutation);
   try {
-    execSync35(
+    execSync34(
       `gh api graphql -F query=@${queryFile} -f threadId="${threadId}"`,
       { stdio: ["inherit", "pipe", "inherit"] }
     );
@@ -12921,7 +12990,7 @@ function resolveCommentWithReply(commentId, message) {
 // src/commands/prs/fixed.ts
 function verifySha(sha) {
   try {
-    return execSync36(`git rev-parse --verify ${sha}`, {
+    return execSync35(`git rev-parse --verify ${sha}`, {
       encoding: "utf8"
     }).trim();
   } catch {
@@ -12935,7 +13004,7 @@ function fixed(commentId, sha) {
     const { org, repo } = getRepoInfo();
     const repoUrl = `https://github.com/${org}/${repo}`;
     const message = `Fixed in [${fullSha}](${repoUrl}/commit/${fullSha})`;
-    execSync36("git push", { stdio: "inherit" });
+    execSync35("git push", { stdio: "inherit" });
     resolveCommentWithReply(commentId, message);
   } catch (error) {
     if (isGhNotInstalled(error)) {
@@ -12953,7 +13022,7 @@ import { join as join44 } from "path";
 import { stringify } from "yaml";
 
 // src/commands/prs/fetchThreadIds.ts
-import { execSync as execSync37 } from "child_process";
+import { execSync as execSync36 } from "child_process";
 import { unlinkSync as unlinkSync11, writeFileSync as writeFileSync28 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join43 } from "path";
@@ -12962,7 +13031,7 @@ function fetchThreadIds(org, repo, prNumber) {
   const queryFile = join43(tmpdir6(), `gh-query-${Date.now()}.graphql`);
   writeFileSync28(queryFile, THREAD_QUERY);
   try {
-    const result = execSync37(
+    const result = execSync36(
       `gh api graphql -F query=@${queryFile} -F owner="${org}" -F repo="${repo}" -F prNumber=${prNumber}`,
       { encoding: "utf8" }
     );
@@ -12984,9 +13053,9 @@ function fetchThreadIds(org, repo, prNumber) {
 }
 
 // src/commands/prs/listComments/fetchReviewComments.ts
-import { execSync as execSync38 } from "child_process";
+import { execSync as execSync37 } from "child_process";
 function fetchJson(endpoint) {
-  const result = execSync38(`gh api --paginate ${endpoint}`, {
+  const result = execSync37(`gh api --paginate ${endpoint}`, {
     encoding: "utf8"
   });
   if (!result.trim()) return [];
@@ -13125,7 +13194,7 @@ async function listComments() {
 }
 
 // src/commands/prs/prs/index.ts
-import { execSync as execSync39 } from "child_process";
+import { execSync as execSync38 } from "child_process";
 
 // src/commands/prs/prs/displayPaginated/index.ts
 import enquirer9 from "enquirer";
@@ -13232,7 +13301,7 @@ async function prs(options2) {
   const state = options2.open ? "open" : options2.closed ? "closed" : "all";
   try {
     const { org, repo } = getRepoInfo();
-    const result = execSync39(
+    const result = execSync38(
       `gh pr list --state ${state} --json number,title,url,author,createdAt,mergedAt,closedAt,state,changedFiles --limit 100 -R ${org}/${repo}`,
       { encoding: "utf8" }
     );
@@ -13255,7 +13324,7 @@ async function prs(options2) {
 }
 
 // src/commands/prs/raise.ts
-import { execSync as execSync40 } from "child_process";
+import { execSync as execSync39 } from "child_process";
 
 // src/commands/prs/buildCreateArgs.ts
 function buildCreateArgs(title, body, options2) {
@@ -13315,7 +13384,7 @@ function raise(options2) {
     `--body ${shellQuote(body)}`
   ] : buildCreateArgs(options2.title, body, options2);
   try {
-    execSync40(args.join(" "), { stdio: "inherit" });
+    execSync39(args.join(" "), { stdio: "inherit" });
   } catch {
     process.exit(1);
   }
@@ -13347,7 +13416,7 @@ function reply(commentId, body) {
 }
 
 // src/commands/prs/wontfix.ts
-import { execSync as execSync41 } from "child_process";
+import { execSync as execSync40 } from "child_process";
 function validateReason(reason) {
   const lowerReason = reason.toLowerCase();
   if (lowerReason.includes("claude") || lowerReason.includes("opus")) {
@@ -13364,7 +13433,7 @@ function validateShaReferences(reason) {
   const invalidShas = [];
   for (const sha of shas) {
     try {
-      execSync41(`git cat-file -t ${sha}`, { stdio: "pipe" });
+      execSync40(`git cat-file -t ${sha}`, { stdio: "pipe" });
     } catch {
       invalidShas.push(sha);
     }
@@ -13526,10 +13595,10 @@ import chalk135 from "chalk";
 import Enquirer2 from "enquirer";
 
 // src/commands/ravendb/searchItems.ts
-import { execSync as execSync42 } from "child_process";
+import { execSync as execSync41 } from "child_process";
 import chalk134 from "chalk";
 function opExec(args) {
-  return execSync42(`op ${args}`, {
+  return execSync41(`op ${args}`, {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"]
   }).trim();
@@ -13681,7 +13750,7 @@ ${errorText}`
 }
 
 // src/commands/ravendb/resolveOpSecret.ts
-import { execSync as execSync43 } from "child_process";
+import { execSync as execSync42 } from "child_process";
 import chalk139 from "chalk";
 function resolveOpSecret(reference) {
   if (!reference.startsWith("op://")) {
@@ -13689,7 +13758,7 @@ function resolveOpSecret(reference) {
     process.exit(1);
   }
   try {
-    return execSync43(`op read "${reference}"`, {
+    return execSync42(`op read "${reference}"`, {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -13938,9 +14007,9 @@ Refactor check failed:
 }
 
 // src/commands/refactor/check/getViolations/index.ts
-import { execSync as execSync44 } from "child_process";
+import { execSync as execSync43 } from "child_process";
 import fs20 from "fs";
-import { minimatch as minimatch5 } from "minimatch";
+import { minimatch as minimatch6 } from "minimatch";
 
 // src/commands/refactor/check/getViolations/getIgnoredFiles.ts
 import fs19 from "fs";
@@ -13988,7 +14057,7 @@ function getGitFiles(options2) {
   }
   const files = /* @__PURE__ */ new Set();
   if (options2.staged || options2.modified) {
-    const staged = execSync44("git diff --cached --name-only", {
+    const staged = execSync43("git diff --cached --name-only", {
       encoding: "utf8"
     });
     for (const file of staged.trim().split("\n").filter(Boolean)) {
@@ -13996,7 +14065,7 @@ function getGitFiles(options2) {
     }
   }
   if (options2.unstaged || options2.modified) {
-    const unstaged = execSync44("git diff --name-only", { encoding: "utf8" });
+    const unstaged = execSync43("git diff --name-only", { encoding: "utf8" });
     for (const file of unstaged.trim().split("\n").filter(Boolean)) {
       files.add(file);
     }
@@ -14008,7 +14077,7 @@ function getViolations(pattern2, options2 = {}, maxLines = DEFAULT_MAX_LINES) {
   const ignoredFiles = getIgnoredFiles();
   const gitFiles = getGitFiles(options2);
   if (pattern2) {
-    sourceFiles = sourceFiles.filter((f) => minimatch5(f, pattern2));
+    sourceFiles = sourceFiles.filter((f) => minimatch6(f, pattern2));
   }
   if (gitFiles) {
     sourceFiles = sourceFiles.filter((f) => gitFiles.has(f));
@@ -14093,7 +14162,7 @@ import { SyntaxKind as SyntaxKind4 } from "ts-morph";
 import {
   SyntaxKind as SyntaxKind2
 } from "ts-morph";
-var suppressionPattern = /^\s*(\/\/|\/\*)\s*(biome-ignore(-all)?|oxlint-disable)\b/;
+var suppressionPattern = /^\s*(\/\/|\/\*)\s*oxlint-disable\b/;
 function countLeadingSuppressions(sourceFile) {
   let count6 = 0;
   for (const stmt of sourceFile.getStatementsWithComments()) {
@@ -15640,9 +15709,9 @@ function buildReviewPaths(repoRoot, key) {
 }
 
 // src/commands/review/fetchExistingComments.ts
-import { execSync as execSync45 } from "child_process";
+import { execSync as execSync44 } from "child_process";
 function fetchRawComments(org, repo, prNumber) {
-  const out = execSync45(
+  const out = execSync44(
     `gh api --paginate repos/${org}/${repo}/pulls/${prNumber}/comments`,
     { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
   );
@@ -15673,14 +15742,14 @@ function fetchExistingComments() {
 }
 
 // src/commands/review/gatherContext.ts
-import { execSync as execSync48 } from "child_process";
+import { execSync as execSync47 } from "child_process";
 
 // src/commands/review/fetchPrDiff.ts
-import { execSync as execSync46 } from "child_process";
+import { execSync as execSync45 } from "child_process";
 function fetchPrDiff(prNumber, baseSha, headSha) {
   const { org, repo } = getRepoInfo();
   try {
-    return execSync46(`gh pr diff ${prNumber} -R ${org}/${repo}`, {
+    return execSync45(`gh pr diff ${prNumber} -R ${org}/${repo}`, {
       encoding: "utf8",
       maxBuffer: 256 * 1024 * 1024,
       stdio: ["ignore", "pipe", "pipe"]
@@ -15695,19 +15764,19 @@ function isDiffTooLarge(error) {
 }
 function fetchDiffViaGit(baseSha, headSha) {
   try {
-    execSync46(`git fetch origin ${baseSha} ${headSha}`, { stdio: "ignore" });
+    execSync45(`git fetch origin ${baseSha} ${headSha}`, { stdio: "ignore" });
   } catch {
   }
-  return execSync46(`git diff ${baseSha}...${headSha}`, {
+  return execSync45(`git diff ${baseSha}...${headSha}`, {
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024
   });
 }
 
 // src/commands/review/fetchPrDiffInfo.ts
-import { execSync as execSync47 } from "child_process";
+import { execSync as execSync46 } from "child_process";
 function getCurrentBranch2() {
-  return execSync47("git rev-parse --abbrev-ref HEAD", {
+  return execSync46("git rev-parse --abbrev-ref HEAD", {
     encoding: "utf8"
   }).trim();
 }
@@ -15717,7 +15786,7 @@ function fetchPrDiffInfo() {
   const fields = "number,baseRefName,baseRefOid,headRefName,headRefOid";
   let raw;
   try {
-    raw = execSync47(`gh pr view ${branch} --json ${fields} -R ${org}/${repo}`, {
+    raw = execSync46(`gh pr view ${branch} --json ${fields} -R ${org}/${repo}`, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -15741,7 +15810,7 @@ function fetchPrDiffInfo() {
 }
 function fetchPrChangedFiles(prNumber) {
   const { org, repo } = getRepoInfo();
-  const out = execSync47(
+  const out = execSync46(
     `gh api repos/${org}/${repo}/pulls/${prNumber}/files --paginate --jq ".[].filename"`,
     {
       encoding: "utf8",
@@ -15753,11 +15822,11 @@ function fetchPrChangedFiles(prNumber) {
 
 // src/commands/review/gatherContext.ts
 function gatherContext() {
-  const branch = execSync48("git rev-parse --abbrev-ref HEAD", {
+  const branch = execSync47("git rev-parse --abbrev-ref HEAD", {
     encoding: "utf8"
   }).trim();
-  const sha = execSync48("git rev-parse HEAD", { encoding: "utf8" }).trim();
-  const shortSha = execSync48("git rev-parse --short=7 HEAD", {
+  const sha = execSync47("git rev-parse HEAD", { encoding: "utf8" }).trim();
+  const shortSha = execSync47("git rev-parse --short=7 HEAD", {
     encoding: "utf8"
   }).trim();
   const prInfo = fetchPrDiffInfo();
@@ -15778,7 +15847,7 @@ function gatherContext() {
 }
 
 // src/commands/review/postReviewToPr.ts
-import { readFileSync as readFileSync33 } from "fs";
+import { readFileSync as readFileSync32 } from "fs";
 
 // src/commands/review/parseFindings.ts
 var SEVERITIES = ["blocker", "major", "minor", "nit"];
@@ -16088,7 +16157,7 @@ async function confirmPost(prNumber, count6, options2) {
 async function postReviewToPr(synthesisPath, options2) {
   const prInfo = fetchPrDiffInfo();
   const prNumber = prInfo.prNumber;
-  const markdown = readFileSync33(synthesisPath, "utf8");
+  const markdown = readFileSync32(synthesisPath, "utf8");
   const findings = parseFindings(markdown);
   if (findings.length === 0) {
     console.log("Synthesis contains no findings; nothing to post.");
@@ -16972,7 +17041,7 @@ async function runReviewers(reviewDir, claudePath, codexPath, stdinPrompt, optio
 }
 
 // src/commands/review/synthesise.ts
-import { readFileSync as readFileSync34 } from "fs";
+import { readFileSync as readFileSync33 } from "fs";
 
 // src/commands/review/buildSynthesisStdin.ts
 var SYNTHESIS_PROMPT = `You are consolidating two independent code reviews of the same change. The original review request is in request.md. The two reviews are in claude.md and codex.md in the current working directory.
@@ -17028,7 +17097,7 @@ Files:
 
 // src/commands/review/synthesise.ts
 function printSummary2(synthesisPath) {
-  const markdown = readFileSync34(synthesisPath, "utf8");
+  const markdown = readFileSync33(synthesisPath, "utf8");
   console.log("");
   console.log(buildReviewSummary(markdown));
   console.log("");
@@ -18042,7 +18111,7 @@ async function fixInvalidDatePrefixes(vttFiles) {
 }
 
 // src/commands/transcript/format/processVttFile/index.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync15, readFileSync as readFileSync35, writeFileSync as writeFileSync32 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync15, readFileSync as readFileSync34, writeFileSync as writeFileSync32 } from "fs";
 import { basename as basename9, dirname as dirname23, join as join49 } from "path";
 
 // src/commands/transcript/cleanText.ts
@@ -18290,7 +18359,7 @@ function logReduction(cueCount, messageCount) {
 }
 function readAndParseCues(inputPath) {
   console.log(`Reading: ${inputPath}`);
-  return processCues(readFileSync35(inputPath, "utf8"));
+  return processCues(readFileSync34(inputPath, "utf8"));
 }
 function writeFormatted(outputPath, content) {
   writeFileSync32(outputPath, content, "utf8");
@@ -18368,9 +18437,9 @@ import { basename as basename10, dirname as dirname25, join as join51, relative
 import {
   existsSync as existsSync42,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync36,
+  readFileSync as readFileSync35,
   renameSync as renameSync3,
-  rmSync as rmSync4
+  rmSync as rmSync3
 } from "fs";
 import { dirname as dirname24, join as join50 } from "path";
 
@@ -18412,7 +18481,7 @@ function processStagedFile() {
   }
   const { transcriptsDir, summaryDir } = getTranscriptConfig();
   const stagedFile = stagedFiles[0];
-  const content = readFileSync36(stagedFile.absolutePath, "utf8");
+  const content = readFileSync35(stagedFile.absolutePath, "utf8");
   validateStagedContent(stagedFile.filename, content);
   const stagedBaseName = getTranscriptBaseName(stagedFile.filename);
   const transcriptFiles = findMdFilesRecursive(transcriptsDir);
@@ -18433,7 +18502,7 @@ function processStagedFile() {
   renameSync3(stagedFile.absolutePath, destPath);
   const remaining = findMdFilesRecursive(STAGING_DIR);
   if (remaining.length === 0) {
-    rmSync4(STAGING_DIR, { recursive: true });
+    rmSync3(STAGING_DIR, { recursive: true });
   }
   return true;
 }
@@ -18524,9 +18593,9 @@ function registerVerify(program2) {
   verifyCommand.command("hardcoded-colors").description("Check for hardcoded hex colors in src/").action(hardcodedColors);
   verifyCommand.command("comment-policy").description("Check for undocumented comments added on changed lines").action(commentPolicy);
   verifyCommand.command("no-venv").description("Check that no venv folders exist in the repo").action(noVenv);
-  verifyCommand.command("settings-guard").description(
-    "Check that claude/settings.json permission lists contain no assist references"
-  ).action(settingsGuard);
+  verifyCommand.command("forbidden-strings").description(
+    "Check configured JSON files for values matching forbiddenStrings rules"
+  ).action(forbiddenStrings);
 }
 
 // src/commands/voice/devices.ts
@@ -18567,14 +18636,14 @@ function devices() {
 }
 
 // src/commands/voice/logs.ts
-import { existsSync as existsSync44, readFileSync as readFileSync37 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync36 } from "fs";
 function logs(options2) {
   if (!existsSync44(voicePaths.log)) {
     console.log("No voice log file found");
     return;
   }
   const count6 = Number.parseInt(options2.lines ?? "150", 10);
-  const content = readFileSync37(voicePaths.log, "utf8").trim();
+  const content = readFileSync36(voicePaths.log, "utf8").trim();
   if (!content) {
     console.log("Voice log is empty");
     return;
@@ -18600,8 +18669,8 @@ import { mkdirSync as mkdirSync18 } from "fs";
 import { join as join55 } from "path";
 
 // src/commands/voice/checkLockFile.ts
-import { execSync as execSync49 } from "child_process";
-import { existsSync as existsSync45, mkdirSync as mkdirSync17, readFileSync as readFileSync38, writeFileSync as writeFileSync33 } from "fs";
+import { execSync as execSync48 } from "child_process";
+import { existsSync as existsSync45, mkdirSync as mkdirSync17, readFileSync as readFileSync37, writeFileSync as writeFileSync33 } from "fs";
 import { join as join54 } from "path";
 function isProcessAlive2(pid) {
   try {
@@ -18615,7 +18684,7 @@ function checkLockFile() {
   const lockFile = getLockFile();
   if (!existsSync45(lockFile)) return;
   try {
-    const lock = JSON.parse(readFileSync38(lockFile, "utf8"));
+    const lock = JSON.parse(readFileSync37(lockFile, "utf8"));
     if (lock.pid && isProcessAlive2(lock.pid)) {
       console.error(
         `Voice daemon already running (PID ${lock.pid}, env: ${lock.env}). Stop it first with: assist voice stop`
@@ -18629,7 +18698,7 @@ function bootstrapVenv() {
   if (existsSync45(getVenvPython())) return;
   console.log("Setting up Python environment...");
   const pythonDir = getPythonDir();
-  execSync49(
+  execSync48(
     `uv sync --project "${pythonDir}" --extra runtime --no-install-project`,
     {
       stdio: "inherit",
@@ -18717,7 +18786,7 @@ function start2(options2) {
 }
 
 // src/commands/voice/status.ts
-import { existsSync as existsSync46, readFileSync as readFileSync39 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync38 } from "fs";
 function isProcessAlive3(pid) {
   try {
     process.kill(pid, 0);
@@ -18728,7 +18797,7 @@ function isProcessAlive3(pid) {
 }
 function readRecentLogs(count6) {
   if (!existsSync46(voicePaths.log)) return [];
-  const lines = readFileSync39(voicePaths.log, "utf8").trim().split("\n");
+  const lines = readFileSync38(voicePaths.log, "utf8").trim().split("\n");
   return lines.slice(-count6);
 }
 function status() {
@@ -18736,7 +18805,7 @@ function status() {
     console.log("Voice daemon: not running (no PID file)");
     return;
   }
-  const pid = Number.parseInt(readFileSync39(voicePaths.pid, "utf8").trim(), 10);
+  const pid = Number.parseInt(readFileSync38(voicePaths.pid, "utf8").trim(), 10);
   const alive = isProcessAlive3(pid);
   console.log(`Voice daemon: ${alive ? "running" : "dead"} (PID ${pid})`);
   const recent = readRecentLogs(5);
@@ -18755,13 +18824,13 @@ function status() {
 }
 
 // src/commands/voice/stop.ts
-import { existsSync as existsSync47, readFileSync as readFileSync40, unlinkSync as unlinkSync15 } from "fs";
+import { existsSync as existsSync47, readFileSync as readFileSync39, unlinkSync as unlinkSync15 } from "fs";
 function stop2() {
   if (!existsSync47(voicePaths.pid)) {
     console.log("Voice daemon is not running (no PID file)");
     return;
   }
-  const pid = Number.parseInt(readFileSync40(voicePaths.pid, "utf8").trim(), 10);
+  const pid = Number.parseInt(readFileSync39(voicePaths.pid, "utf8").trim(), 10);
   try {
     process.kill(pid, "SIGTERM");
     console.log(`Sent SIGTERM to voice daemon (PID ${pid})`);
@@ -18952,7 +19021,7 @@ async function auth() {
 
 // src/commands/roam/postRoamActivity.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { readdirSync as readdirSync8, readFileSync as readFileSync41, statSync as statSync6 } from "fs";
+import { readdirSync as readdirSync8, readFileSync as readFileSync40, statSync as statSync6 } from "fs";
 import { join as join57 } from "path";
 function findPortFile(roamDir) {
   let entries;
@@ -18978,7 +19047,7 @@ function postRoamActivity(app, event) {
   if (!portFile) return;
   let port;
   try {
-    port = readFileSync41(portFile, "utf8").trim();
+    port = readFileSync40(portFile, "utf8").trim();
   } catch {
     return;
   }
@@ -19106,11 +19175,11 @@ function resolveParams(params, cliArgs) {
 }
 
 // src/commands/run/runPreCommands.ts
-import { execSync as execSync50 } from "child_process";
+import { execSync as execSync49 } from "child_process";
 function runPreCommands(pre, cwd) {
   for (const cmd of pre) {
     try {
-      execSync50(cmd, { stdio: "inherit", cwd });
+      execSync49(cmd, { stdio: "inherit", cwd });
     } catch (error) {
       const code = error && typeof error === "object" && "status" in error ? error.status : 1;
       process.exit(code);
@@ -19394,7 +19463,7 @@ function registerRun(program2) {
 }
 
 // src/commands/screenshot/index.ts
-import { execSync as execSync51 } from "child_process";
+import { execSync as execSync50 } from "child_process";
 import { existsSync as existsSync50, mkdirSync as mkdirSync21, unlinkSync as unlinkSync17, writeFileSync as writeFileSync36 } from "fs";
 import { tmpdir as tmpdir7 } from "os";
 import { join as join61, resolve as resolve15 } from "path";
@@ -19537,7 +19606,7 @@ function runPowerShellScript(processName, outputPath) {
   const scriptPath = join61(tmpdir7(), `assist-screenshot-${Date.now()}.ps1`);
   writeFileSync36(scriptPath, captureWindowPs1, "utf8");
   try {
-    execSync51(
+    execSync50(
       `powershell -NoProfile -ExecutionPolicy Bypass -File "${scriptPath}" -ProcessName "${processName}" -OutputPath "${outputPath}"`,
       { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
     );
@@ -19611,7 +19680,7 @@ function applyLine(result, pending, line) {
 }
 
 // src/commands/sessions/daemon/reportStolenSocket.ts
-import { readFileSync as readFileSync42 } from "fs";
+import { readFileSync as readFileSync41 } from "fs";
 function reportStolenSocket(socketPid) {
   if (!socketPid) return;
   const filePid = readPidFile();
@@ -19623,7 +19692,7 @@ function reportStolenSocket(socketPid) {
 function readPidFile() {
   try {
     const pid = Number.parseInt(
-      readFileSync42(daemonPaths.pid, "utf8").trim(),
+      readFileSync41(daemonPaths.pid, "utf8").trim(),
       10
     );
     return Number.isInteger(pid) ? pid : void 0;
@@ -21484,7 +21553,7 @@ function handleConnection(socket, manager) {
 import { unlinkSync as unlinkSync18, writeFileSync as writeFileSync37 } from "fs";
 
 // src/commands/sessions/daemon/startPidFileWatchdog.ts
-import { readFileSync as readFileSync43 } from "fs";
+import { readFileSync as readFileSync42 } from "fs";
 var WATCHDOG_INTERVAL_MS = 5e3;
 function startPidFileWatchdog(onLost, intervalMs = WATCHDOG_INTERVAL_MS) {
   const timer = setInterval(() => {
@@ -21495,7 +21564,7 @@ function startPidFileWatchdog(onLost, intervalMs = WATCHDOG_INTERVAL_MS) {
 }
 function ownsPidFile() {
   try {
-    return readFileSync43(daemonPaths.pid, "utf8").trim() === String(process.pid);
+    return readFileSync42(daemonPaths.pid, "utf8").trim() === String(process.pid);
   } catch {
     return false;
   }
@@ -22052,7 +22121,7 @@ function syncCommands(claudeDir, targetBase) {
 }
 
 // src/commands/update.ts
-import { execSync as execSync52 } from "child_process";
+import { execSync as execSync51 } from "child_process";
 import * as path56 from "path";
 
 // src/commands/restartDaemonAfterUpdate.ts
@@ -22076,7 +22145,7 @@ function isGlobalNpmInstall(dir) {
     if (resolved.split(path56.sep).includes("node_modules")) {
       return true;
     }
-    const globalPrefix = execSync52("npm prefix -g", { stdio: "pipe" }).toString().trim();
+    const globalPrefix = execSync51("npm prefix -g", { stdio: "pipe" }).toString().trim();
     return resolved.toLowerCase().startsWith(path56.resolve(globalPrefix).toLowerCase());
   } catch {
     return false;
@@ -22087,18 +22156,18 @@ async function update2() {
   console.log(`Assist is installed at: ${installDir}`);
   if (isGitRepo(installDir)) {
     console.log("Detected git repo installation, pulling latest...");
-    execSync52("git pull", { cwd: installDir, stdio: "inherit" });
+    execSync51("git pull", { cwd: installDir, stdio: "inherit" });
     console.log("Installing dependencies...");
-    execSync52("npm i", { cwd: installDir, stdio: "inherit" });
+    execSync51("npm i", { cwd: installDir, stdio: "inherit" });
     console.log("Building...");
-    execSync52("npm run build", { cwd: installDir, stdio: "inherit" });
+    execSync51("npm run build", { cwd: installDir, stdio: "inherit" });
     console.log("Syncing commands...");
-    execSync52("assist sync", { stdio: "inherit" });
+    execSync51("assist sync", { stdio: "inherit" });
   } else if (isGlobalNpmInstall(installDir)) {
     console.log("Detected global npm installation, updating...");
-    execSync52("npm i -g @staff0rd/assist@latest", { stdio: "inherit" });
+    execSync51("npm i -g @staff0rd/assist@latest", { stdio: "inherit" });
     console.log("Syncing commands...");
-    execSync52("assist sync", { stdio: "inherit" });
+    execSync51("assist sync", { stdio: "inherit" });
   } else {
     console.error(
       "Could not determine installation method. Expected a git repo or global npm install."