@staff0rd/assist 0.95.0 → 0.96.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.95.0",
+  version: "0.96.0",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -15,7 +15,8 @@ var package_default = {
   },
   files: [
     "dist",
-    "claude"
+    "claude",
+    "assist.cli-reads"
   ],
   publishConfig: {
     access: "public"
@@ -23,7 +24,8 @@ var package_default = {
   scripts: {
     build: "tsup",
     start: "node dist/index.js",
-    "check:types": "tsc --noEmit"
+    "check:types": "tsc --noEmit",
+    test: "vitest run"
   },
   keywords: [],
   author: "",
@@ -65,7 +67,8 @@ var package_default = {
     react: "^19.2.4",
     "react-dom": "^19.2.4",
     "semantic-release": "^25.0.2",
-    tsup: "^8.5.1"
+    tsup: "^8.5.1",
+    vitest: "^4.0.18"
   }
 };
 
@@ -73,11 +76,24 @@ var package_default = {
 import { execSync } from "child_process";
 
 // src/shared/loadConfig.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir } from "os";
 import { basename, join } from "path";
 import chalk from "chalk";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { stringify as stringifyYaml } from "yaml";
+
+// src/shared/loadRawYaml.ts
+import { existsSync, readFileSync } from "fs";
+import { parse as parseYaml } from "yaml";
+function loadRawYaml(path31) {
+  if (!existsSync(path31)) return {};
+  try {
+    const content = readFileSync(path31, "utf-8");
+    return parseYaml(content) || {};
+  } catch {
+    return {};
+  }
+}
 
 // src/shared/types.ts
 import { z } from "zod";
@@ -151,7 +167,7 @@ var assistConfigSchema = z.strictObject({
 // src/shared/loadConfig.ts
 function getConfigPath() {
   const claudeConfigPath = join(process.cwd(), ".claude", "assist.yml");
-  if (existsSync(claudeConfigPath)) {
+  if (existsSync2(claudeConfigPath)) {
     return claudeConfigPath;
   }
   return join(process.cwd(), "assist.yml");
@@ -159,26 +175,17 @@ function getConfigPath() {
 function getGlobalConfigPath() {
   return join(homedir(), ".assist.yml");
 }
-function loadRawConfig(path31) {
-  if (!existsSync(path31)) return {};
-  try {
-    const content = readFileSync(path31, "utf-8");
-    return parseYaml(content) || {};
-  } catch {
-    return {};
-  }
-}
 function loadConfig() {
-  const globalRaw = loadRawConfig(getGlobalConfigPath());
-  const projectRaw = loadRawConfig(getConfigPath());
+  const globalRaw = loadRawYaml(getGlobalConfigPath());
+  const projectRaw = loadRawYaml(getConfigPath());
   const merged = { ...globalRaw, ...projectRaw };
   return assistConfigSchema.parse(merged);
 }
 function loadProjectConfig() {
-  return loadRawConfig(getConfigPath());
+  return loadRawYaml(getConfigPath());
 }
 function loadGlobalConfigRaw() {
-  return loadRawConfig(getGlobalConfigPath());
+  return loadRawYaml(getGlobalConfigPath());
 }
 function saveGlobalConfig(config) {
   writeFileSync(getGlobalConfigPath(), stringifyYaml(config, { lineWidth: 0 }));
@@ -193,9 +200,9 @@ function getRepoName() {
     return config.devlog.name;
   }
   const packageJsonPath = join(process.cwd(), "package.json");
-  if (existsSync(packageJsonPath)) {
+  if (existsSync2(packageJsonPath)) {
     try {
-      const content = readFileSync(packageJsonPath, "utf-8");
+      const content = readFileSync2(packageJsonPath, "utf-8");
       const pkg = JSON.parse(content);
       if (pkg.name) {
         return pkg.name;
@@ -647,7 +654,7 @@ import chalk12 from "chalk";
 
 // src/commands/lint/init.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import chalk11 from "chalk";
@@ -671,10 +678,10 @@ async function promptConfirm(message, initial = true) {
 
 // src/shared/removeEslint/index.ts
 import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
 
 // src/shared/removeEslint/removeEslintConfigFiles.ts
-import { existsSync as existsSync4, unlinkSync } from "fs";
+import { existsSync as existsSync5, unlinkSync } from "fs";
 var ESLINT_CONFIG_FILES = [
   "eslint.config.js",
   "eslint.config.mjs",
@@ -690,7 +697,7 @@ var ESLINT_CONFIG_FILES = [
 function removeEslintConfigFiles() {
   let removed = false;
   for (const configFile of ESLINT_CONFIG_FILES) {
-    if (existsSync4(configFile)) {
+    if (existsSync5(configFile)) {
       unlinkSync(configFile);
       console.log(`Removed ${configFile}`);
       removed = true;
@@ -712,10 +719,10 @@ function removeEslint(options2 = {}) {
 }
 function removeEslintFromPackageJson(options2) {
   const packageJsonPath = "package.json";
-  if (!existsSync5(packageJsonPath)) {
+  if (!existsSync6(packageJsonPath)) {
     return false;
   }
-  const packageJson = JSON.parse(readFileSync4(packageJsonPath, "utf-8"));
+  const packageJson = JSON.parse(readFileSync5(packageJsonPath, "utf-8"));
   let modified = false;
   modified = removeEslintDeps(packageJson.dependencies) || modified;
   modified = removeEslintDeps(packageJson.devDependencies) || modified;
@@ -785,17 +792,17 @@ var __dirname2 = dirname5(fileURLToPath(import.meta.url));
 async function init() {
   removeEslint();
   const biomeConfigPath = "biome.json";
-  if (!existsSync6(biomeConfigPath)) {
+  if (!existsSync7(biomeConfigPath)) {
     console.log("Initializing Biome...");
     execSync4("npx @biomejs/biome init", { stdio: "inherit" });
   }
-  if (!existsSync6(biomeConfigPath)) {
+  if (!existsSync7(biomeConfigPath)) {
     console.log("No biome.json found, skipping linter config");
     return;
   }
   const linterConfigPath = join4(__dirname2, "commands/lint/biome.linter.json");
-  const linterConfig = JSON.parse(readFileSync5(linterConfigPath, "utf-8"));
-  const biomeConfig = JSON.parse(readFileSync5(biomeConfigPath, "utf-8"));
+  const linterConfig = JSON.parse(readFileSync6(linterConfigPath, "utf-8"));
+  const biomeConfig = JSON.parse(readFileSync6(biomeConfigPath, "utf-8"));
   const oldContent = `${JSON.stringify(biomeConfig, null, 2)}
 `;
   biomeConfig.linter = linterConfig.linter;
@@ -1099,8 +1106,8 @@ function createSettingsJson() {
       "source.organizeImports.biome": "explicit"
     }
   };
-  const settingsPath2 = path9.join(process.cwd(), ".vscode", "settings.json");
-  fs3.writeFileSync(settingsPath2, `${JSON.stringify(settings, null, "	")}
+  const settingsPath = path9.join(process.cwd(), ".vscode", "settings.json");
+  fs3.writeFileSync(settingsPath, `${JSON.stringify(settings, null, "	")}
 `);
   console.log(chalk16.green("Created .vscode/settings.json"));
 }
@@ -1618,14 +1625,14 @@ function flushIfFailed(exitCode, chunks) {
 
 // src/commands/verify/run/runAllEntries.ts
 function runEntry(entry, onComplete) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const child = spawnCommand(entry.fullCommand, entry.cwd, entry.env);
     const chunks = collectOutput(child);
     child.on("close", (code) => {
       const exitCode = code ?? 1;
       flushIfFailed(exitCode, chunks);
       onComplete?.(exitCode);
-      resolve3({ script: entry.name, code: exitCode });
+      resolve5({ script: entry.name, code: exitCode });
     });
   });
 }
@@ -1770,7 +1777,7 @@ async function newCli() {
 
 // src/commands/new/registerNew/newProject.ts
 import { execSync as execSync12 } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "fs";
 
 // src/commands/deploy/init/index.ts
 import { execSync as execSync11 } from "child_process";
@@ -1778,33 +1785,33 @@ import chalk21 from "chalk";
 import enquirer3 from "enquirer";
 
 // src/commands/deploy/init/updateWorkflow.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname10, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import chalk20 from "chalk";
 var WORKFLOW_PATH = ".github/workflows/build.yml";
 var __dirname3 = dirname10(fileURLToPath2(import.meta.url));
 function getExistingSiteId() {
-  if (!existsSync9(WORKFLOW_PATH)) {
+  if (!existsSync10(WORKFLOW_PATH)) {
     return null;
   }
-  const content = readFileSync7(WORKFLOW_PATH, "utf-8");
+  const content = readFileSync8(WORKFLOW_PATH, "utf-8");
   const match = content.match(/-s\s+([a-f0-9-]{36})/);
   return match ? match[1] : null;
 }
 function getTemplateContent(siteId) {
   const templatePath = join7(__dirname3, "commands/deploy/build.yml");
-  const template = readFileSync7(templatePath, "utf-8");
+  const template = readFileSync8(templatePath, "utf-8");
   return template.replace("{{NETLIFY_SITE_ID}}", siteId);
 }
 async function updateWorkflow(siteId) {
   const newContent = getTemplateContent(siteId);
   const workflowDir = ".github/workflows";
-  if (!existsSync9(workflowDir)) {
+  if (!existsSync10(workflowDir)) {
     mkdirSync3(workflowDir, { recursive: true });
   }
-  if (existsSync9(WORKFLOW_PATH)) {
-    const oldContent = readFileSync7(WORKFLOW_PATH, "utf-8");
+  if (existsSync10(WORKFLOW_PATH)) {
+    const oldContent = readFileSync8(WORKFLOW_PATH, "utf-8");
     if (oldContent === newContent) {
       console.log(chalk20.green("build.yml is already up to date"));
       return;
@@ -1898,11 +1905,11 @@ async function newProject() {
 }
 function addViteBaseConfig() {
   const viteConfigPath = "vite.config.ts";
-  if (!existsSync10(viteConfigPath)) {
+  if (!existsSync11(viteConfigPath)) {
     console.log("No vite.config.ts found, skipping base config");
     return;
   }
-  const content = readFileSync8(viteConfigPath, "utf-8");
+  const content = readFileSync9(viteConfigPath, "utf-8");
   if (content.includes("base:")) {
     console.log("vite.config.ts already has base config");
     return;
@@ -2045,11 +2052,11 @@ async function notify() {
 }
 
 // src/commands/backlog/add/index.ts
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import chalk23 from "chalk";
 
 // src/commands/backlog/shared.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "fs";
 import { join as join8 } from "path";
 import chalk22 from "chalk";
 import { parse as parseYaml2, stringify as stringifyYaml3 } from "yaml";
@@ -2074,11 +2081,11 @@ function getBacklogPath() {
 }
 function loadBacklog() {
   const backlogPath = getBacklogPath();
-  if (!existsSync11(backlogPath)) {
+  if (!existsSync12(backlogPath)) {
     return [];
   }
   try {
-    const content = readFileSync9(backlogPath, "utf-8");
+    const content = readFileSync10(backlogPath, "utf-8");
     const raw = parseYaml2(content) || [];
     return backlogFileSchema.parse(raw);
   } catch {
@@ -2093,7 +2100,7 @@ function findItem(items, id) {
   return items.find((item) => item.id === id);
 }
 function loadAndFindItem(id) {
-  if (!existsSync11(getBacklogPath())) {
+  if (!existsSync12(getBacklogPath())) {
     console.log(
       chalk22.yellow(
         "No backlog found. Run 'assist backlog init' to create one."
@@ -2129,7 +2136,7 @@ function getNextId(items) {
 
 // src/commands/backlog/add/shared.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync11, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
 import { tmpdir } from "os";
 import { join as join9 } from "path";
 import enquirer4 from "enquirer";
@@ -2179,7 +2186,7 @@ function openEditor() {
     unlinkSync2(filePath);
     return void 0;
   }
-  const content = readFileSync10(filePath, "utf-8").trim();
+  const content = readFileSync11(filePath, "utf-8").trim();
   unlinkSync2(filePath);
   return content || void 0;
 }
@@ -2200,7 +2207,7 @@ async function promptAcceptanceCriteria() {
 // src/commands/backlog/add/index.ts
 async function add() {
   const backlogPath = getBacklogPath();
-  if (!existsSync12(backlogPath)) {
+  if (!existsSync13(backlogPath)) {
     console.log(
       chalk23.yellow(
         "No backlog found. Run 'assist backlog init' to create one."
@@ -2245,11 +2252,11 @@ async function done(id) {
 }
 
 // src/commands/backlog/init/index.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import chalk26 from "chalk";
 async function init6() {
   const backlogPath = getBacklogPath();
-  if (existsSync13(backlogPath)) {
+  if (existsSync14(backlogPath)) {
     console.log(chalk26.yellow("assist.backlog.yml already exists."));
     return;
   }
@@ -2258,7 +2265,7 @@ async function init6() {
 }
 
 // src/commands/backlog/list/index.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import chalk27 from "chalk";
 function statusIcon(status2) {
   switch (status2) {
@@ -2297,7 +2304,7 @@ function filterItems(items, options2) {
 }
 async function list2(options2) {
   const backlogPath = getBacklogPath();
-  if (!existsSync14(backlogPath)) {
+  if (!existsSync15(backlogPath)) {
     console.log(
       chalk27.yellow(
         "No backlog found. Run 'assist backlog init' to create one."
@@ -2335,7 +2342,7 @@ import { createServer } from "http";
 import chalk29 from "chalk";
 
 // src/commands/backlog/web/handleRequest.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { dirname as dirname11, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -2368,12 +2375,12 @@ function respondJson(res, status2, data) {
   res.end(JSON.stringify(data));
 }
 function readBody(req) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve5, reject) => {
     let body = "";
     req.on("data", (chunk) => {
       body += chunk.toString();
     });
-    req.on("end", () => resolve3(body));
+    req.on("end", () => resolve5(body));
     req.on("error", reject);
   });
 }
@@ -2438,7 +2445,7 @@ var __dirname4 = dirname11(fileURLToPath3(import.meta.url));
 var bundleCache;
 function serveBundle(_req, res) {
   if (!bundleCache) {
-    bundleCache = readFileSync11(
+    bundleCache = readFileSync12(
       join10(__dirname4, "commands/backlog/web/bundle.js"),
       "utf-8"
     );
@@ -2510,466 +2517,221 @@ function registerBacklog(program2) {
   backlogCommand.command("web").description("Start a web view of the backlog").option("-p, --port <number>", "Port to listen on", "3000").action(web);
 }
 
-// src/commands/cliDiscover/index.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync13 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join12 } from "path";
-
-// src/commands/cliDiscover/assertCliExists.ts
-import { execSync as execSync13 } from "child_process";
-function assertCliExists(cli) {
-  const binary = cli.split(/\s+/)[0];
-  const opts = {
-    encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"]
-  };
-  try {
-    execSync13(`command -v ${binary}`, opts);
-  } catch {
-    try {
-      execSync13(`where ${binary}`, opts);
-    } catch {
-      console.error(`CLI "${cli}" not found in PATH`);
-      process.exit(1);
+// src/shared/tokenize.ts
+function tokenize(command) {
+  const tokens = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      current += ch;
+    } else if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+      current += ch;
+    } else if (ch === "\\" && inDouble && i + 1 < command.length) {
+      current += ch + command[++i];
+    } else if (/\s/.test(ch) && !inSingle && !inDouble) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+    } else {
+      current += ch;
     }
   }
+  if (current) tokens.push(current);
+  return tokens;
 }
 
-// src/commands/cliDiscover/colorize.ts
-import chalk30 from "chalk";
-function colorize(plainOutput) {
-  return plainOutput.split("\n").map((line) => {
-    if (line.startsWith(" R  ")) return chalk30.green(line);
-    if (line.startsWith(" W  ")) return chalk30.red(line);
-    return line;
-  }).join("\n");
+// src/shared/isGhApiRead.ts
+var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var BODY_FLAGS = /* @__PURE__ */ new Set(["-f", "-F", "--field", "--raw-field", "--input"]);
+var FIELD_FLAGS = /* @__PURE__ */ new Set(["-f", "--field", "-F"]);
+function isGhApiRead(command) {
+  const tokens = tokenize(command);
+  if (tokens.length < 2 || tokens[0] !== "gh" || tokens[1] !== "api") {
+    return false;
+  }
+  const args = tokens.slice(2);
+  if (args.includes("graphql")) {
+    return isGraphqlRead(args);
+  }
+  const method = extractMethod(args);
+  if (method) return READ_METHODS.has(method.toUpperCase());
+  if (args.some((t) => BODY_FLAGS.has(t))) return false;
+  return true;
 }
-
-// src/lib/isClaudeCode.ts
-function isClaudeCode() {
-  return process.env.CLAUDECODE !== void 0;
+function extractMethod(args) {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--method=")) return arg.slice("--method=".length);
+    if (arg.startsWith("-X=")) return arg.slice("-X=".length);
+    if ((arg === "--method" || arg === "-X") && i + 1 < args.length) {
+      return args[i + 1];
+    }
+  }
+  return void 0;
 }
-
-// src/commands/cliDiscover/mapAsync.ts
-async function mapAsync(items, concurrency, fn) {
-  const results = new Array(items.length);
-  let next2 = 0;
-  async function worker() {
-    while (next2 < items.length) {
-      const idx = next2++;
-      results[idx] = await fn(items[idx]);
+function isGraphqlRead(args) {
+  const method = extractMethod(args);
+  if (method) return READ_METHODS.has(method.toUpperCase());
+  const queryBody = extractGraphqlQuery(args);
+  if (!queryBody) return false;
+  const trimmed = queryBody.replace(/^['"]|['"]$/g, "").trimStart();
+  if (trimmed.startsWith("mutation")) return false;
+  if (trimmed.startsWith("query") || trimmed.startsWith("{")) return true;
+  return false;
+}
+function extractGraphqlQuery(args) {
+  for (let i = 0; i < args.length; i++) {
+    if (FIELD_FLAGS.has(args[i]) && i + 1 < args.length) {
+      const match = args[i + 1].match(/^query=(.*)/s);
+      if (match) return match[1];
     }
   }
-  const workers = Array.from(
-    { length: Math.min(concurrency, items.length) },
-    () => worker()
-  );
-  await Promise.all(workers);
-  return results;
+  return void 0;
 }
 
-// src/commands/cliDiscover/parseCommands.ts
-var COMMAND_SECTION_RE = /^((?:core |general |available |additional |other |management |targeted |alias |github actions )?(?:commands|subgroups)):?$/i;
-function isSkippable(name) {
-  return name.startsWith("-") || name.startsWith("<") || name.startsWith("[");
+// src/shared/loadCliReads.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname12, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var __filename2 = fileURLToPath4(import.meta.url);
+var __dirname5 = dirname12(__filename2);
+function getCliReadsPath() {
+  return resolve2(__dirname5, "..", "assist.cli-reads");
+}
+function loadCliReads() {
+  const path31 = getCliReadsPath();
+  if (!existsSync16(path31)) return [];
+  return readFileSync13(path31, "utf-8").split("\n").filter((line) => line.trim() !== "");
+}
+function saveCliReads(commands) {
+  writeFileSync12(getCliReadsPath(), `${commands.join("\n")}
+`);
 }
-function parseCommandLine(trimmed) {
-  const azMatch = trimmed.match(/^(\S+)\s+(?:\[.*?]\s+)?:\s*(.+)/);
-  if (azMatch && !isSkippable(azMatch[1])) {
-    return { name: azMatch[1], description: azMatch[2].trim() };
+function findCliRead(command) {
+  const filePath = getCliReadsPath();
+  if (!existsSync16(filePath)) return void 0;
+  const words = command.split(/\s+/);
+  if (words.length < 2) return void 0;
+  const prefix2 = `${words[0]} ${words[1]}`;
+  let candidates;
+  try {
+    const output = execFileSync("grep", ["-E", `^${prefix2}( |$)`, filePath], {
+      encoding: "utf-8"
+    });
+    candidates = output.split("\n").filter((l) => l !== "");
+  } catch {
+    return void 0;
   }
-  const colonMatch = trimmed.match(/^(\S+?):\s{2,}(.+)/);
-  if (colonMatch && !isSkippable(colonMatch[1])) {
-    return { name: colonMatch[1], description: colonMatch[2].trim() };
+  return candidates.sort((a, b) => b.length - a.length).find((rc) => command === rc || command.startsWith(`${rc} `));
+}
+
+// src/commands/cliHook/index.ts
+async function cliHook() {
+  const inputData = await readStdin();
+  let data;
+  try {
+    data = JSON.parse(inputData);
+  } catch {
+    return;
   }
-  const spaceMatch = trimmed.match(/^(\S+)(?:,\s*\S+)?\s{2,}(.+)/);
-  if (spaceMatch && !isSkippable(spaceMatch[1])) {
-    return { name: spaceMatch[1], description: spaceMatch[2].trim() };
+  if (data.tool_name !== "Bash" || !data.tool_input?.command) {
+    return;
   }
-  if (/^\S+$/.test(trimmed) && !isSkippable(trimmed)) {
-    return { name: trimmed, description: "" };
+  const command = data.tool_input.command.trim();
+  const matched = findCliRead(command);
+  if (matched) {
+    console.log(
+      JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "allow",
+          permissionDecisionReason: `Read-only CLI command: ${matched}`
+        }
+      })
+    );
+    return;
   }
-  return void 0;
-}
-function parseCommands(helpText) {
-  const commands = [];
-  let inCommandSection = false;
-  for (const line of helpText.split("\n")) {
-    const trimmed = line.trim();
-    if (COMMAND_SECTION_RE.test(trimmed)) {
-      inCommandSection = true;
-      continue;
-    }
-    if (inCommandSection && trimmed && !line.startsWith(" ") && !line.startsWith("	")) {
-      inCommandSection = false;
-      continue;
-    }
-    if (!inCommandSection || !trimmed) continue;
-    if (trimmed.startsWith("-") || trimmed.startsWith("=")) continue;
-    const parsed = parseCommandLine(trimmed);
-    if (parsed) commands.push(parsed);
+  if (isGhApiRead(command)) {
+    console.log(
+      JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "allow",
+          permissionDecisionReason: "Read-only gh api command"
+        }
+      })
+    );
   }
-  return commands;
-}
-var COMMAND_SECTION_MULTILINE_RE = new RegExp(
-  COMMAND_SECTION_RE.source,
-  "im"
-);
-function hasSubcommands(helpText) {
-  return COMMAND_SECTION_MULTILINE_RE.test(helpText);
 }
 
-// src/commands/cliDiscover/runHelp.ts
-import { exec as exec2 } from "child_process";
-function runHelp(args) {
-  return new Promise((resolve3) => {
-    exec2(
-      `${args.join(" ")} --help`,
-      { encoding: "utf-8", timeout: 3e4 },
-      (_err, stdout, stderr) => {
-        resolve3(stdout || stderr || "");
-      }
-    );
+// src/commands/registerCliHook.ts
+function registerCliHook(program2) {
+  program2.command("cli-hook").description("PreToolUse hook for auto-approving read-only CLI commands").action(() => {
+    cliHook();
   });
 }
 
-// src/commands/cliDiscover/discoverAll.ts
-var SAFETY_DEPTH = 10;
-var CONCURRENCY = 8;
-var interactive = !isClaudeCode();
-function showProgress(p, label2) {
-  if (!interactive) return;
-  const pct = Math.round(p.done / p.total * 100);
-  process.stderr.write(`\r\x1B[K[${pct}%] Scanning ${label2}...`);
+// src/commands/complexity/analyze.ts
+import chalk35 from "chalk";
+
+// src/commands/complexity/cyclomatic.ts
+import chalk31 from "chalk";
+
+// src/commands/complexity/shared/index.ts
+import fs11 from "fs";
+import path16 from "path";
+import chalk30 from "chalk";
+import ts5 from "typescript";
+
+// src/commands/complexity/findSourceFiles.ts
+import fs10 from "fs";
+import path15 from "path";
+import { minimatch as minimatch3 } from "minimatch";
+function applyIgnoreGlobs(files) {
+  const { complexity } = loadConfig();
+  return files.filter(
+    (f) => !complexity.ignore.some((glob) => minimatch3(f, glob))
+  );
 }
-async function resolveCommand(cli, path31, description, depth, p) {
-  showProgress(p, path31.join(" "));
-  const subHelp = await runHelp([cli, ...path31]);
-  if (!subHelp || !hasSubcommands(subHelp)) {
-    return [{ path: path31, description }];
+function walk(dir, results) {
+  if (!fs10.existsSync(dir)) {
+    return;
+  }
+  const extensions = [".ts", ".tsx"];
+  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path15.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name !== "node_modules" && entry.name !== ".git") {
+        walk(fullPath, results);
+      }
+    } else if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
+      results.push(fullPath);
+    }
   }
-  const children = await discoverAt(cli, path31, depth + 1, p);
-  return children.length > 0 ? children : [{ path: path31, description }];
 }
-async function discoverAt(cli, parentPath, depth, p) {
-  if (depth > SAFETY_DEPTH) return [];
-  const helpText = await runHelp([cli, ...parentPath]);
-  if (!helpText) return [];
-  const cmds = parseCommands(helpText);
-  const results = await mapAsync(
-    cmds,
-    CONCURRENCY,
-    (cmd) => resolveCommand(cli, [...parentPath, cmd.name], cmd.description, depth, p)
-  );
-  return results.flat();
-}
-async function discoverAll(cli) {
-  const topLevel = parseCommands(await runHelp([cli]));
-  const p = { done: 0, total: topLevel.length };
-  const results = await mapAsync(topLevel, CONCURRENCY, async (cmd) => {
-    showProgress(p, cmd.name);
-    const resolved = await resolveCommand(
-      cli,
-      [cmd.name],
-      cmd.description,
-      1,
-      p
-    );
-    p.done++;
-    showProgress(p, cmd.name);
-    return resolved;
-  });
-  if (interactive) process.stderr.write("\r\x1B[K");
-  return results.flat();
-}
-
-// src/commands/cliDiscover/classifyVerb.ts
-var READ_VERBS = /* @__PURE__ */ new Set([
-  "list",
-  "show",
-  "view",
-  "export",
-  "get",
-  "diff",
-  "status",
-  "search",
-  "checks",
-  "describe",
-  "inspect",
-  "logs",
-  "cat",
-  "top",
-  "explain",
-  "exists",
-  "browse",
-  "watch"
-]);
-var WRITE_VERBS = /* @__PURE__ */ new Set([
-  "create",
-  "delete",
-  "import",
-  "set",
-  "update",
-  "merge",
-  "close",
-  "reopen",
-  "edit",
-  "apply",
-  "patch",
-  "drain",
-  "cordon",
-  "taint",
-  "push",
-  "deploy",
-  "add",
-  "remove",
-  "assign",
-  "unassign",
-  "lock",
-  "unlock",
-  "start",
-  "stop",
-  "restart",
-  "enable",
-  "disable",
-  "revoke",
-  "rotate"
-]);
-function classifyVerb(verb) {
-  if (READ_VERBS.has(verb)) return "r";
-  if (WRITE_VERBS.has(verb)) return "w";
-  return "?";
-}
-
-// src/commands/cliDiscover/formatHuman.ts
-function prefix(kind) {
-  if (kind === "r") return " R  ";
-  if (kind === "w") return " W  ";
-  return " ?  ";
-}
-function formatHuman(cli, commands) {
-  const sorted = [...commands].sort(
-    (a, b) => a.path.join(" ").localeCompare(b.path.join(" "))
-  );
-  const lines = [`Discovered ${commands.length} commands for "${cli}":
-`];
-  for (const cmd of sorted) {
-    const verb = cmd.path[cmd.path.length - 1];
-    const full = `${cli} ${cmd.path.join(" ")}`;
-    const text = cmd.description ? `${full} \u2014 ${cmd.description}` : full;
-    lines.push(`${prefix(classifyVerb(verb))}${text}`);
-  }
-  return lines.join("\n");
-}
-
-// src/commands/cliDiscover/parseCached.ts
-function parseCached(cli, cached) {
-  const prefix2 = `${cli} `;
-  const commands = [];
-  for (const line of cached.split("\n")) {
-    const trimmed = line.replace(/^ [RW?] {2}/, "").trim();
-    if (!trimmed.startsWith(prefix2)) continue;
-    const rest = trimmed.slice(prefix2.length);
-    const dashIdx = rest.indexOf(" \u2014 ");
-    const pathStr = dashIdx >= 0 ? rest.slice(0, dashIdx) : rest;
-    const description = dashIdx >= 0 ? rest.slice(dashIdx + 3) : "";
-    commands.push({ path: pathStr.split(" "), description });
-  }
-  return commands;
-}
-
-// src/commands/cliDiscover/updateSettings.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
-import { join as join11 } from "path";
-function settingsPath() {
-  return join11(process.cwd(), "claude", "settings.json");
-}
-function updateSettings(cli, commands) {
-  const path31 = settingsPath();
-  if (!existsSync15(path31)) return;
-  const settings = JSON.parse(readFileSync12(path31, "utf-8"));
-  const allow = settings.permissions?.allow ?? [];
-  const readCommands = commands.filter(
-    (cmd) => classifyVerb(cmd.path[cmd.path.length - 1]) === "r"
-  );
-  const newEntries = readCommands.map(
-    (cmd) => `Bash(${cli} ${cmd.path.join(" ")}:*)`
-  );
-  const existing = new Set(allow);
-  const added = newEntries.filter((e) => !existing.has(e));
-  if (added.length === 0) return;
-  settings.permissions = settings.permissions ?? {};
-  settings.permissions.allow = [...allow, ...added];
-  writeFileSync12(path31, `${JSON.stringify(settings, null, "	")}
-`);
-}
-
-// src/commands/cliDiscover/index.ts
-function logPath(cli) {
-  const safeName = cli.replace(/\s+/g, "-");
-  return join12(homedir3(), ".assist", `cli-discover-${safeName}.log`);
-}
-function readCache(cli) {
-  const path31 = logPath(cli);
-  if (!existsSync16(path31)) return void 0;
-  return readFileSync13(path31, "utf-8");
-}
-function writeCache(cli, output) {
-  const dir = join12(homedir3(), ".assist");
-  mkdirSync4(dir, { recursive: true });
-  writeFileSync13(logPath(cli), output);
-}
-async function cliDiscover(cli, options2 = { noCache: false }) {
-  if (!cli) {
-    console.error("Usage: assist cli-discover <cli>");
-    process.exit(1);
-  }
-  if (!options2.noCache) {
-    const cached = readCache(cli);
-    if (cached) {
-      console.log(colorize(cached));
-      updateSettings(cli, parseCached(cli, cached));
-      return;
-    }
-  }
-  assertCliExists(cli);
-  const commands = await discoverAll(cli);
-  const output = formatHuman(cli, commands);
-  console.log(colorize(output));
-  writeCache(cli, output);
-  updateSettings(cli, commands);
-}
-
-// src/commands/registerCliDiscover.ts
-function registerCliDiscover(program2) {
-  program2.command("cli-discover").description("Discover a CLI's command tree via recursive --help parsing").argument(
-    "<cli...>",
-    "CLI binary and optional subcommand (e.g. gh, az, acli jira)"
-  ).option("--no-cache", "Force fresh discovery, ignoring cached results").action((cli, options2) => {
-    cliDiscover(cli.join(" "), { noCache: !options2.cache });
-  });
-}
-
-// src/commands/cliHook/extractVerb.ts
-var SHELL_OPERATORS = /* @__PURE__ */ new Set(["|", ">", ">>", ";", "&&", "||"]);
-function isShellBreak(token) {
-  return token.startsWith("-") || SHELL_OPERATORS.has(token);
-}
-function looksLikeArgument(token) {
-  return /[/=.]/.test(token) || /^\d+$/.test(token);
-}
-function extractVerb(command, readVerbs) {
-  const tokens = command.split(/\s+/);
-  for (let i = 1; i < tokens.length; i++) {
-    if (isShellBreak(tokens[i])) break;
-    if (readVerbs.includes(tokens[i])) return tokens[i];
-  }
-  for (let i = tokens.length - 1; i >= 1; i--) {
-    const token = tokens[i];
-    if (isShellBreak(token) || looksLikeArgument(token)) continue;
-    return token;
-  }
-  return void 0;
-}
-
-// src/commands/cliHook/index.ts
-async function cliHook() {
-  const inputData = await readStdin();
-  let data;
-  try {
-    data = JSON.parse(inputData);
-  } catch {
-    return;
-  }
-  if (data.tool_name !== "Bash" || !data.tool_input?.command) {
-    return;
-  }
-  const command = data.tool_input.command.trim();
-  const config = loadConfig();
-  const cliReadVerbs = config.cliReadVerbs;
-  if (!cliReadVerbs) return;
-  const cliKeys = Object.keys(cliReadVerbs).sort((a, b) => b.length - a.length);
-  const cli = cliKeys.find(
-    (key) => command === key || command.startsWith(`${key} `)
-  );
-  if (!cli) return;
-  const readVerbs = cliReadVerbs[cli];
-  if (!readVerbs || readVerbs.length === 0) return;
-  const verb = extractVerb(command, readVerbs);
-  if (verb && readVerbs.includes(verb)) {
-    console.log(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "allow",
-          permissionDecisionReason: `Read-only ${cli} command: ${verb}`
-        }
-      })
-    );
-  }
-}
-
-// src/commands/registerCliHook.ts
-function registerCliHook(program2) {
-  program2.command("cli-hook").description("PreToolUse hook for auto-approving read-only CLI commands").action(() => {
-    cliHook();
-  });
-}
-
-// src/commands/complexity/analyze.ts
-import chalk36 from "chalk";
-
-// src/commands/complexity/cyclomatic.ts
-import chalk32 from "chalk";
-
-// src/commands/complexity/shared/index.ts
-import fs11 from "fs";
-import path16 from "path";
-import chalk31 from "chalk";
-import ts5 from "typescript";
-
-// src/commands/complexity/findSourceFiles.ts
-import fs10 from "fs";
-import path15 from "path";
-import { minimatch as minimatch3 } from "minimatch";
-function applyIgnoreGlobs(files) {
-  const { complexity } = loadConfig();
-  return files.filter(
-    (f) => !complexity.ignore.some((glob) => minimatch3(f, glob))
-  );
-}
-function walk(dir, results) {
-  if (!fs10.existsSync(dir)) {
-    return;
-  }
-  const extensions = [".ts", ".tsx"];
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = path15.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (entry.name !== "node_modules" && entry.name !== ".git") {
-        walk(fullPath, results);
-      }
-    } else if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
-      results.push(fullPath);
-    }
-  }
-}
-function findSourceFiles2(pattern2, baseDir = ".") {
-  const results = [];
-  if (pattern2.includes("*")) {
-    walk(baseDir, results);
-    return applyIgnoreGlobs(results.filter((f) => minimatch3(f, pattern2)));
-  }
-  if (fs10.existsSync(pattern2) && fs10.statSync(pattern2).isFile()) {
-    return [pattern2];
-  }
-  if (fs10.existsSync(pattern2) && fs10.statSync(pattern2).isDirectory()) {
-    walk(pattern2, results);
-    return applyIgnoreGlobs(results);
-  }
-  walk(baseDir, results);
-  return applyIgnoreGlobs(results.filter((f) => minimatch3(f, pattern2)));
+function findSourceFiles2(pattern2, baseDir = ".") {
+  const results = [];
+  if (pattern2.includes("*")) {
+    walk(baseDir, results);
+    return applyIgnoreGlobs(results.filter((f) => minimatch3(f, pattern2)));
+  }
+  if (fs10.existsSync(pattern2) && fs10.statSync(pattern2).isFile()) {
+    return [pattern2];
+  }
+  if (fs10.existsSync(pattern2) && fs10.statSync(pattern2).isDirectory()) {
+    walk(pattern2, results);
+    return applyIgnoreGlobs(results);
+  }
+  walk(baseDir, results);
+  return applyIgnoreGlobs(results.filter((f) => minimatch3(f, pattern2)));
 }
 
 // src/commands/complexity/shared/getNodeName.ts
@@ -3171,7 +2933,7 @@ function createSourceFromFile(filePath) {
 function withSourceFiles(pattern2, callback) {
   const files = findSourceFiles2(pattern2);
   if (files.length === 0) {
-    console.log(chalk31.yellow("No files found matching pattern"));
+    console.log(chalk30.yellow("No files found matching pattern"));
     return void 0;
   }
   return callback(files);
@@ -3204,11 +2966,11 @@ async function cyclomatic(pattern2 = "**/*.ts", options2 = {}) {
     results.sort((a, b) => b.complexity - a.complexity);
     for (const { file, name, complexity } of results) {
       const exceedsThreshold = options2.threshold !== void 0 && complexity > options2.threshold;
-      const color = exceedsThreshold ? chalk32.red : chalk32.white;
-      console.log(`${color(`${file}:${name}`)} \u2192 ${chalk32.cyan(complexity)}`);
+      const color = exceedsThreshold ? chalk31.red : chalk31.white;
+      console.log(`${color(`${file}:${name}`)} \u2192 ${chalk31.cyan(complexity)}`);
     }
     console.log(
-      chalk32.dim(
+      chalk31.dim(
         `
 Analyzed ${results.length} functions across ${files.length} files`
       )
@@ -3220,7 +2982,7 @@ Analyzed ${results.length} functions across ${files.length} files`
 }
 
 // src/commands/complexity/halstead.ts
-import chalk33 from "chalk";
+import chalk32 from "chalk";
 async function halstead(pattern2 = "**/*.ts", options2 = {}) {
   withSourceFiles(pattern2, (files) => {
     const results = [];
@@ -3235,13 +2997,13 @@ async function halstead(pattern2 = "**/*.ts", options2 = {}) {
     results.sort((a, b) => b.metrics.effort - a.metrics.effort);
     for (const { file, name, metrics } of results) {
       const exceedsThreshold = options2.threshold !== void 0 && metrics.volume > options2.threshold;
-      const color = exceedsThreshold ? chalk33.red : chalk33.white;
+      const color = exceedsThreshold ? chalk32.red : chalk32.white;
       console.log(
-        `${color(`${file}:${name}`)} \u2192 volume: ${chalk33.cyan(metrics.volume.toFixed(1))}, difficulty: ${chalk33.yellow(metrics.difficulty.toFixed(1))}, effort: ${chalk33.magenta(metrics.effort.toFixed(1))}`
+        `${color(`${file}:${name}`)} \u2192 volume: ${chalk32.cyan(metrics.volume.toFixed(1))}, difficulty: ${chalk32.yellow(metrics.difficulty.toFixed(1))}, effort: ${chalk32.magenta(metrics.effort.toFixed(1))}`
       );
     }
     console.log(
-      chalk33.dim(
+      chalk32.dim(
         `
 Analyzed ${results.length} functions across ${files.length} files`
       )
@@ -3256,28 +3018,28 @@ Analyzed ${results.length} functions across ${files.length} files`
 import fs12 from "fs";
 
 // src/commands/complexity/maintainability/displayMaintainabilityResults.ts
-import chalk34 from "chalk";
+import chalk33 from "chalk";
 function displayMaintainabilityResults(results, threshold) {
   const filtered = threshold !== void 0 ? results.filter((r) => r.minMaintainability < threshold) : results;
   if (threshold !== void 0 && filtered.length === 0) {
-    console.log(chalk34.green("All files pass maintainability threshold"));
+    console.log(chalk33.green("All files pass maintainability threshold"));
   } else {
     for (const { file, avgMaintainability, minMaintainability } of filtered) {
-      const color = threshold !== void 0 ? chalk34.red : chalk34.white;
+      const color = threshold !== void 0 ? chalk33.red : chalk33.white;
       console.log(
-        `${color(file)} \u2192 avg: ${chalk34.cyan(avgMaintainability.toFixed(1))}, min: ${chalk34.yellow(minMaintainability.toFixed(1))}`
+        `${color(file)} \u2192 avg: ${chalk33.cyan(avgMaintainability.toFixed(1))}, min: ${chalk33.yellow(minMaintainability.toFixed(1))}`
       );
     }
   }
-  console.log(chalk34.dim(`
+  console.log(chalk33.dim(`
 Analyzed ${results.length} files`));
   if (filtered.length > 0 && threshold !== void 0) {
     console.error(
-      chalk34.red(
+      chalk33.red(
         `
 Fail: ${filtered.length} file(s) below threshold ${threshold}. Maintainability index (0\u2013100) is derived from Halstead volume, cyclomatic complexity, and lines of code.
 
-\u26A0\uFE0F  ${chalk34.bold("Diagnose and fix one file at a time")} \u2014 do not investigate or fix multiple files in parallel. Run 'assist complexity <file>' to see all metrics. For larger files, start by extracting responsibilities into smaller files.`
+\u26A0\uFE0F  ${chalk33.bold("Diagnose and fix one file at a time")} \u2014 do not investigate or fix multiple files in parallel. Run 'assist complexity <file>' to see all metrics. For larger files, start by extracting responsibilities into smaller files.`
       )
     );
     process.exit(1);
@@ -3334,7 +3096,7 @@ async function maintainability(pattern2 = "**/*.ts", options2 = {}) {
 
 // src/commands/complexity/sloc.ts
 import fs13 from "fs";
-import chalk35 from "chalk";
+import chalk34 from "chalk";
 async function sloc(pattern2 = "**/*.ts", options2 = {}) {
   withSourceFiles(pattern2, (files) => {
     const results = [];
@@ -3350,12 +3112,12 @@ async function sloc(pattern2 = "**/*.ts", options2 = {}) {
     results.sort((a, b) => b.lines - a.lines);
     for (const { file, lines } of results) {
       const exceedsThreshold = options2.threshold !== void 0 && lines > options2.threshold;
-      const color = exceedsThreshold ? chalk35.red : chalk35.white;
-      console.log(`${color(file)} \u2192 ${chalk35.cyan(lines)} lines`);
+      const color = exceedsThreshold ? chalk34.red : chalk34.white;
+      console.log(`${color(file)} \u2192 ${chalk34.cyan(lines)} lines`);
     }
     const total = results.reduce((sum, r) => sum + r.lines, 0);
     console.log(
-      chalk35.dim(`
+      chalk34.dim(`
 Total: ${total} lines across ${files.length} files`)
     );
     if (hasViolation) {
@@ -3369,21 +3131,21 @@ async function analyze(pattern2) {
   const searchPattern = pattern2.includes("*") || pattern2.includes("/") ? pattern2 : `**/${pattern2}`;
   const files = findSourceFiles2(searchPattern);
   if (files.length === 0) {
-    console.log(chalk36.yellow("No files found matching pattern"));
+    console.log(chalk35.yellow("No files found matching pattern"));
     return;
   }
   if (files.length === 1) {
     const file = files[0];
-    console.log(chalk36.bold.underline("SLOC"));
+    console.log(chalk35.bold.underline("SLOC"));
     await sloc(file);
     console.log();
-    console.log(chalk36.bold.underline("Cyclomatic Complexity"));
+    console.log(chalk35.bold.underline("Cyclomatic Complexity"));
     await cyclomatic(file);
     console.log();
-    console.log(chalk36.bold.underline("Halstead Metrics"));
+    console.log(chalk35.bold.underline("Halstead Metrics"));
     await halstead(file);
     console.log();
-    console.log(chalk36.bold.underline("Maintainability Index"));
+    console.log(chalk35.bold.underline("Maintainability Index"));
     await maintainability(file);
     return;
   }
@@ -3410,8 +3172,8 @@ function registerComplexity(program2) {
 }
 
 // src/commands/deploy/redirect.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14, writeFileSync as writeFileSync14 } from "fs";
-import chalk37 from "chalk";
+import { existsSync as existsSync17, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "fs";
+import chalk36 from "chalk";
 var TRAILING_SLASH_SCRIPT = `    <script>
       if (!window.location.pathname.endsWith('/')) {
         window.location.href = \`\${window.location.pathname}/\${window.location.search}\${window.location.hash}\`;
@@ -3420,22 +3182,22 @@ var TRAILING_SLASH_SCRIPT = `    <script>
 function redirect() {
   const indexPath = "index.html";
   if (!existsSync17(indexPath)) {
-    console.log(chalk37.yellow("No index.html found"));
+    console.log(chalk36.yellow("No index.html found"));
     return;
   }
   const content = readFileSync14(indexPath, "utf-8");
   if (content.includes("window.location.pathname.endsWith('/')")) {
-    console.log(chalk37.dim("Trailing slash script already present"));
+    console.log(chalk36.dim("Trailing slash script already present"));
     return;
   }
   const headCloseIndex = content.indexOf("</head>");
   if (headCloseIndex === -1) {
-    console.log(chalk37.red("Could not find </head> tag in index.html"));
+    console.log(chalk36.red("Could not find </head> tag in index.html"));
     return;
   }
   const newContent = content.slice(0, headCloseIndex) + TRAILING_SLASH_SCRIPT + "\n  " + content.slice(headCloseIndex);
-  writeFileSync14(indexPath, newContent);
-  console.log(chalk37.green("Added trailing slash redirect to index.html"));
+  writeFileSync13(indexPath, newContent);
+  console.log(chalk36.green("Added trailing slash redirect to index.html"));
 }
 
 // src/commands/registerDeploy.ts
@@ -3446,24 +3208,24 @@ function registerDeploy(program2) {
 }
 
 // src/commands/devlog/list/index.ts
-import { execSync as execSync15 } from "child_process";
+import { execSync as execSync14 } from "child_process";
 import { basename as basename3 } from "path";
 
 // src/commands/devlog/shared.ts
-import { execSync as execSync14 } from "child_process";
-import chalk38 from "chalk";
+import { execSync as execSync13 } from "child_process";
+import chalk37 from "chalk";
 
 // src/commands/devlog/loadDevlogEntries.ts
 import { readdirSync, readFileSync as readFileSync15 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join13 } from "path";
-var DEVLOG_DIR = join13(homedir4(), "git/blog/src/content/devlog");
+import { homedir as homedir3 } from "os";
+import { join as join11 } from "path";
+var DEVLOG_DIR = join11(homedir3(), "git/blog/src/content/devlog");
 function loadDevlogEntries(repoName) {
   const entries = /* @__PURE__ */ new Map();
   try {
     const files = readdirSync(DEVLOG_DIR).filter((f) => f.endsWith(".md"));
     for (const file of files) {
-      const content = readFileSync15(join13(DEVLOG_DIR, file), "utf-8");
+      const content = readFileSync15(join11(DEVLOG_DIR, file), "utf-8");
       const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
       if (frontmatterMatch) {
         const frontmatter = frontmatterMatch[1];
@@ -3494,7 +3256,7 @@ function loadDevlogEntries(repoName) {
 // src/commands/devlog/shared.ts
 function getCommitFiles(hash) {
   try {
-    const output = execSync14(`git show --name-only --format="" ${hash}`, {
+    const output = execSync13(`git show --name-only --format="" ${hash}`, {
       encoding: "utf-8"
     });
     return output.trim().split("\n").filter(Boolean);
@@ -3512,13 +3274,13 @@ function shouldIgnoreCommit(files, ignorePaths) {
 }
 function printCommitsWithFiles(commits, ignore2, verbose) {
   for (const commit2 of commits) {
-    console.log(`  ${chalk38.yellow(commit2.hash)} ${commit2.message}`);
+    console.log(`  ${chalk37.yellow(commit2.hash)} ${commit2.message}`);
     if (verbose) {
       const visibleFiles = commit2.files.filter(
         (file) => !ignore2.some((p) => file.startsWith(p))
       );
       for (const file of visibleFiles) {
-        console.log(`    ${chalk38.dim(file)}`);
+        console.log(`    ${chalk37.dim(file)}`);
       }
     }
   }
@@ -3543,15 +3305,15 @@ function parseGitLogCommits(output, ignore2, afterDate) {
 }
 
 // src/commands/devlog/list/printDateHeader.ts
-import chalk39 from "chalk";
+import chalk38 from "chalk";
 function printDateHeader(date, isSkipped, entries) {
   if (isSkipped) {
-    console.log(`${chalk39.bold.blue(date)} ${chalk39.dim("skipped")}`);
+    console.log(`${chalk38.bold.blue(date)} ${chalk38.dim("skipped")}`);
   } else if (entries && entries.length > 0) {
-    const entryInfo = entries.map((e) => `${chalk39.green(e.version)} ${e.title}`).join(" | ");
-    console.log(`${chalk39.bold.blue(date)} ${entryInfo}`);
+    const entryInfo = entries.map((e) => `${chalk38.green(e.version)} ${e.title}`).join(" | ");
+    console.log(`${chalk38.bold.blue(date)} ${entryInfo}`);
   } else {
-    console.log(`${chalk39.bold.blue(date)} ${chalk39.red("\u26A0 devlog missing")}`);
+    console.log(`${chalk38.bold.blue(date)} ${chalk38.red("\u26A0 devlog missing")}`);
   }
 }
 
@@ -3565,7 +3327,7 @@ function list3(options2) {
   const devlogEntries = loadDevlogEntries(repoName);
   const reverseFlag = options2.reverse ? "--reverse " : "";
   const limitFlag = options2.reverse ? "" : "-n 500 ";
-  const output = execSync15(
+  const output = execSync14(
     `git log ${reverseFlag}${limitFlag}--pretty=format:'%ad|%h|%s' --date=short`,
     { encoding: "utf-8" }
   );
@@ -3591,11 +3353,11 @@ function list3(options2) {
 }
 
 // src/commands/devlog/getLastVersionInfo.ts
-import { execSync as execSync16 } from "child_process";
+import { execSync as execSync15 } from "child_process";
 import semver from "semver";
 function getVersionAtCommit(hash) {
   try {
-    const content = execSync16(`git show ${hash}:package.json`, {
+    const content = execSync15(`git show ${hash}:package.json`, {
       encoding: "utf-8"
     });
     const pkg = JSON.parse(content);
@@ -3610,7 +3372,7 @@ function stripToMinor(version2) {
 }
 function getLastVersionInfoFromGit() {
   try {
-    const output = execSync16(
+    const output = execSync15(
       "git log -1 --pretty=format:'%ad|%h' --date=short",
       {
         encoding: "utf-8"
@@ -3653,172 +3415,524 @@ function bumpVersion(version2, type) {
 }
 
 // src/commands/devlog/next/displayNextEntry/index.ts
-import { execSync as execSync17 } from "child_process";
-import chalk41 from "chalk";
+import { execSync as execSync16 } from "child_process";
+import chalk40 from "chalk";
 
 // src/commands/devlog/next/displayNextEntry/displayVersion.ts
-import chalk40 from "chalk";
+import chalk39 from "chalk";
 function displayVersion(conventional, firstHash, patchVersion, minorVersion) {
   if (conventional && firstHash) {
     const version2 = getVersionAtCommit(firstHash);
     if (version2) {
-      console.log(`${chalk40.bold("version:")} ${stripToMinor(version2)}`);
+      console.log(`${chalk39.bold("version:")} ${stripToMinor(version2)}`);
     } else {
-      console.log(`${chalk40.bold("version:")} ${chalk40.red("unknown")}`);
+      console.log(`${chalk39.bold("version:")} ${chalk39.red("unknown")}`);
     }
   } else if (patchVersion && minorVersion) {
     console.log(
-      `${chalk40.bold("version:")} ${patchVersion} (patch) or ${minorVersion} (minor)`
+      `${chalk39.bold("version:")} ${patchVersion} (patch) or ${minorVersion} (minor)`
     );
   } else {
-    console.log(`${chalk40.bold("version:")} v0.1 (initial)`);
+    console.log(`${chalk39.bold("version:")} v0.1 (initial)`);
+  }
+}
+
+// src/commands/devlog/next/displayNextEntry/index.ts
+function computeVersions(lastInfo) {
+  if (!lastInfo) return { patch: null, minor: null };
+  return {
+    patch: bumpVersion(lastInfo.version, "patch"),
+    minor: bumpVersion(lastInfo.version, "minor")
+  };
+}
+function findTargetDate(commitsByDate, skipDays) {
+  return Array.from(commitsByDate.keys()).filter((d) => !skipDays.has(d)).sort()[0];
+}
+function fetchCommitsByDate(ignore2, lastDate) {
+  const output = execSync16(
+    "git log --pretty=format:'%ad|%h|%s' --date=short -n 500",
+    { encoding: "utf-8" }
+  );
+  return parseGitLogCommits(output, ignore2, lastDate);
+}
+function printVersionInfo(config, lastInfo, firstHash) {
+  const versions = computeVersions(lastInfo);
+  displayVersion(
+    !!config.commit?.conventional,
+    firstHash,
+    versions.patch,
+    versions.minor
+  );
+}
+function resolveIgnoreList(options2, config) {
+  return options2.ignore ?? config.devlog?.ignore ?? [];
+}
+function resolveSkipDays(config) {
+  return new Set(config.devlog?.skip?.days ?? []);
+}
+function getLastDate(lastInfo) {
+  return lastInfo?.date ?? null;
+}
+function getCommitsForDate(commitsByDate, date) {
+  return commitsByDate.get(date) ?? [];
+}
+function noCommitsMessage(hasLastInfo) {
+  return hasLastInfo ? "No commits after last versioned entry" : "No commits found";
+}
+function logName(repoName) {
+  console.log(`${chalk40.bold("name:")} ${repoName}`);
+}
+function displayNextEntry(ctx, targetDate, commits) {
+  logName(ctx.repoName);
+  printVersionInfo(ctx.config, ctx.lastInfo, commits[0]?.hash);
+  console.log(chalk40.bold.blue(targetDate));
+  printCommitsWithFiles(commits, ctx.ignore, ctx.verbose);
+}
+function logNoCommits(lastInfo) {
+  console.log(chalk40.dim(noCommitsMessage(!!lastInfo)));
+}
+
+// src/commands/devlog/next/index.ts
+function resolveContextData(config, options2) {
+  const repoName = getRepoName();
+  const lastInfo = getLastVersionInfo(repoName, config);
+  return { repoName, lastInfo, ignore: resolveIgnoreList(options2, config) };
+}
+function buildContext(options2) {
+  const config = loadConfig();
+  const data = resolveContextData(config, options2);
+  return { config, ...data, verbose: options2.verbose ?? false };
+}
+function fetchNextCommits(ctx) {
+  const commitsByDate = fetchCommitsByDate(
+    ctx.ignore,
+    getLastDate(ctx.lastInfo)
+  );
+  const targetDate = findTargetDate(commitsByDate, resolveSkipDays(ctx.config));
+  return targetDate ? { targetDate, commits: getCommitsForDate(commitsByDate, targetDate) } : null;
+}
+function showResult(ctx, found) {
+  if (!found) {
+    logNoCommits(ctx.lastInfo);
+    return;
+  }
+  displayNextEntry(ctx, found.targetDate, found.commits);
+}
+function next(options2) {
+  const ctx = buildContext(options2);
+  showResult(ctx, fetchNextCommits(ctx));
+}
+
+// src/commands/devlog/skip.ts
+import chalk41 from "chalk";
+function skip(date) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+    console.log(chalk41.red("Invalid date format. Use YYYY-MM-DD"));
+    process.exit(1);
+  }
+  const config = loadProjectConfig();
+  const devlog = config.devlog ?? {};
+  const skip2 = devlog.skip ?? {};
+  const skipDays = skip2.days ?? [];
+  if (skipDays.includes(date)) {
+    console.log(chalk41.yellow(`${date} is already in skip list`));
+    return;
+  }
+  skipDays.push(date);
+  skipDays.sort();
+  skip2.days = skipDays;
+  devlog.skip = skip2;
+  config.devlog = devlog;
+  saveConfig(config);
+  console.log(chalk41.green(`Added ${date} to skip list`));
+}
+
+// src/commands/devlog/version.ts
+import chalk42 from "chalk";
+function version() {
+  const config = loadConfig();
+  const name = getRepoName();
+  const lastInfo = getLastVersionInfo(name, config);
+  const lastVersion = lastInfo?.version ?? null;
+  const nextVersion = lastVersion ? bumpVersion(lastVersion, "patch") : null;
+  console.log(`${chalk42.bold("name:")} ${name}`);
+  console.log(`${chalk42.bold("last:")} ${lastVersion ?? chalk42.dim("none")}`);
+  console.log(`${chalk42.bold("next:")} ${nextVersion ?? chalk42.dim("none")}`);
+}
+
+// src/commands/registerDevlog.ts
+function registerDevlog(program2) {
+  const devlogCommand = program2.command("devlog").description("Development log utilities");
+  devlogCommand.command("list").description("Group git commits by date").option(
+    "--days <number>",
+    "Number of days to show (default: 30)",
+    Number.parseInt
+  ).option("--since <date>", "Only show commits since this date (YYYY-MM-DD)").option("-r, --reverse", "Show earliest commits first").option("-v, --verbose", "Show file names for each commit").action(list3);
+  devlogCommand.command("version").description("Show current repo name and version info").action(version);
+  devlogCommand.command("next").description("Show commits for the day after the last versioned entry").option("-v, --verbose", "Show file names for each commit").action(next);
+  devlogCommand.command("skip <date>").description("Add a date (YYYY-MM-DD) to the skip list").action(skip);
+}
+
+// src/commands/permitCliReads/index.ts
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync14 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join12 } from "path";
+
+// src/shared/getInstallDir.ts
+import { execSync as execSync17 } from "child_process";
+import { dirname as dirname13, resolve as resolve3 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var __filename3 = fileURLToPath5(import.meta.url);
+var __dirname6 = dirname13(__filename3);
+function getInstallDir() {
+  return resolve3(__dirname6, "..");
+}
+function isGitRepo(dir) {
+  try {
+    const result = execSync17("git rev-parse --show-toplevel", {
+      cwd: dir,
+      stdio: "pipe"
+    }).toString().trim();
+    return resolve3(result) === resolve3(dir);
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/permitCliReads/assertCliExists.ts
+import { execSync as execSync18 } from "child_process";
+function assertCliExists(cli) {
+  const binary = cli.split(/\s+/)[0];
+  const opts = {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"]
+  };
+  try {
+    execSync18(`command -v ${binary}`, opts);
+  } catch {
+    try {
+      execSync18(`where ${binary}`, opts);
+    } catch {
+      console.error(`CLI "${cli}" not found in PATH`);
+      process.exit(1);
+    }
   }
 }
 
-// src/commands/devlog/next/displayNextEntry/index.ts
-function computeVersions(lastInfo) {
-  if (!lastInfo) return { patch: null, minor: null };
-  return {
-    patch: bumpVersion(lastInfo.version, "patch"),
-    minor: bumpVersion(lastInfo.version, "minor")
-  };
-}
-function findTargetDate(commitsByDate, skipDays) {
-  return Array.from(commitsByDate.keys()).filter((d) => !skipDays.has(d)).sort()[0];
-}
-function fetchCommitsByDate(ignore2, lastDate) {
-  const output = execSync17(
-    "git log --pretty=format:'%ad|%h|%s' --date=short -n 500",
-    { encoding: "utf-8" }
-  );
-  return parseGitLogCommits(output, ignore2, lastDate);
+// src/commands/permitCliReads/colorize.ts
+import chalk43 from "chalk";
+function colorize(plainOutput) {
+  return plainOutput.split("\n").map((line) => {
+    if (line.startsWith(" R  ")) return chalk43.green(line);
+    if (line.startsWith(" W  ")) return chalk43.red(line);
+    return line;
+  }).join("\n");
+}
+
+// src/lib/isClaudeCode.ts
+function isClaudeCode() {
+  return process.env.CLAUDECODE !== void 0;
+}
+
+// src/commands/permitCliReads/mapAsync.ts
+async function mapAsync(items, concurrency, fn) {
+  const results = new Array(items.length);
+  let next2 = 0;
+  async function worker() {
+    while (next2 < items.length) {
+      const idx = next2++;
+      results[idx] = await fn(items[idx]);
+    }
+  }
+  const workers = Array.from(
+    { length: Math.min(concurrency, items.length) },
+    () => worker()
+  );
+  await Promise.all(workers);
+  return results;
+}
+
+// src/commands/permitCliReads/parseCommands.ts
+var COMMAND_SECTION_RE = /^((?:core |general |available |additional |other |management |targeted |alias |github actions )?(?:commands|subgroups)):?$/i;
+function isSkippable(name) {
+  return name.startsWith("-") || name.startsWith("<") || name.startsWith("[");
+}
+function parseCommandLine(trimmed) {
+  const azMatch = trimmed.match(/^(\S+)\s+(?:\[.*?]\s+)?:\s*(.+)/);
+  if (azMatch && !isSkippable(azMatch[1])) {
+    return { name: azMatch[1], description: azMatch[2].trim() };
+  }
+  const colonMatch = trimmed.match(/^(\S+?):\s{2,}(.+)/);
+  if (colonMatch && !isSkippable(colonMatch[1])) {
+    return { name: colonMatch[1], description: colonMatch[2].trim() };
+  }
+  const spaceMatch = trimmed.match(/^(\S+)(?:,\s*\S+)?\s{2,}(.+)/);
+  if (spaceMatch && !isSkippable(spaceMatch[1])) {
+    return { name: spaceMatch[1], description: spaceMatch[2].trim() };
+  }
+  if (/^\S+$/.test(trimmed) && !isSkippable(trimmed)) {
+    return { name: trimmed, description: "" };
+  }
+  return void 0;
+}
+function parseCommands(helpText) {
+  const commands = [];
+  let inCommandSection = false;
+  for (const line of helpText.split("\n")) {
+    const trimmed = line.trim();
+    if (COMMAND_SECTION_RE.test(trimmed)) {
+      inCommandSection = true;
+      continue;
+    }
+    if (inCommandSection && trimmed && !line.startsWith(" ") && !line.startsWith("	")) {
+      inCommandSection = false;
+      continue;
+    }
+    if (!inCommandSection || !trimmed) continue;
+    if (trimmed.startsWith("-") || trimmed.startsWith("=")) continue;
+    const parsed = parseCommandLine(trimmed);
+    if (parsed) commands.push(parsed);
+  }
+  return commands;
+}
+var COMMAND_SECTION_MULTILINE_RE = new RegExp(
+  COMMAND_SECTION_RE.source,
+  "im"
+);
+function hasSubcommands(helpText) {
+  return COMMAND_SECTION_MULTILINE_RE.test(helpText);
+}
+
+// src/commands/permitCliReads/runHelp.ts
+import { exec as exec2 } from "child_process";
+function runHelp(args) {
+  return new Promise((resolve5) => {
+    exec2(
+      `${args.join(" ")} --help`,
+      { encoding: "utf-8", timeout: 3e4 },
+      (_err, stdout, stderr) => {
+        resolve5(stdout || stderr || "");
+      }
+    );
+  });
+}
+
+// src/commands/permitCliReads/discoverAll.ts
+var SAFETY_DEPTH = 10;
+var CONCURRENCY = 8;
+var interactive = !isClaudeCode();
+function showProgress(p, label2) {
+  if (!interactive) return;
+  const pct = Math.round(p.done / p.total * 100);
+  process.stderr.write(`\r\x1B[K[${pct}%] Scanning ${label2}...`);
+}
+async function resolveCommand(cli, path31, description, depth, p) {
+  showProgress(p, path31.join(" "));
+  const subHelp = await runHelp([cli, ...path31]);
+  if (!subHelp || !hasSubcommands(subHelp)) {
+    return [{ path: path31, description }];
+  }
+  const children = await discoverAt(cli, path31, depth + 1, p);
+  return children.length > 0 ? children : [{ path: path31, description }];
+}
+async function discoverAt(cli, parentPath, depth, p) {
+  if (depth > SAFETY_DEPTH) return [];
+  const helpText = await runHelp([cli, ...parentPath]);
+  if (!helpText) return [];
+  const cmds = parseCommands(helpText);
+  const results = await mapAsync(
+    cmds,
+    CONCURRENCY,
+    (cmd) => resolveCommand(cli, [...parentPath, cmd.name], cmd.description, depth, p)
+  );
+  return results.flat();
+}
+async function discoverAll(cli) {
+  const topLevel = parseCommands(await runHelp([cli]));
+  const p = { done: 0, total: topLevel.length };
+  const results = await mapAsync(topLevel, CONCURRENCY, async (cmd) => {
+    showProgress(p, cmd.name);
+    const resolved = await resolveCommand(
+      cli,
+      [cmd.name],
+      cmd.description,
+      1,
+      p
+    );
+    p.done++;
+    showProgress(p, cmd.name);
+    return resolved;
+  });
+  if (interactive) process.stderr.write("\r\x1B[K");
+  return results.flat();
+}
+
+// src/commands/permitCliReads/classifyVerb.ts
+var READ_VERBS = /* @__PURE__ */ new Set([
+  "list",
+  "show",
+  "view",
+  "export",
+  "get",
+  "diff",
+  "status",
+  "search",
+  "checks",
+  "describe",
+  "inspect",
+  "logs",
+  "cat",
+  "top",
+  "explain",
+  "exists",
+  "browse",
+  "watch"
+]);
+var WRITE_VERBS = /* @__PURE__ */ new Set([
+  "create",
+  "delete",
+  "import",
+  "set",
+  "update",
+  "merge",
+  "close",
+  "reopen",
+  "edit",
+  "apply",
+  "patch",
+  "drain",
+  "cordon",
+  "taint",
+  "push",
+  "deploy",
+  "add",
+  "remove",
+  "assign",
+  "unassign",
+  "lock",
+  "unlock",
+  "start",
+  "stop",
+  "restart",
+  "enable",
+  "disable",
+  "revoke",
+  "rotate"
+]);
+function classifyVerb(verb) {
+  if (READ_VERBS.has(verb)) return "r";
+  if (WRITE_VERBS.has(verb)) return "w";
+  return "?";
+}
+
+// src/commands/permitCliReads/formatHuman.ts
+function prefix(kind) {
+  if (kind === "r") return " R  ";
+  if (kind === "w") return " W  ";
+  return " ?  ";
 }
-function printVersionInfo(config, lastInfo, firstHash) {
-  const versions = computeVersions(lastInfo);
-  displayVersion(
-    !!config.commit?.conventional,
-    firstHash,
-    versions.patch,
-    versions.minor
+function formatHuman(cli, commands) {
+  const sorted = [...commands].sort(
+    (a, b) => a.path.join(" ").localeCompare(b.path.join(" "))
   );
+  const lines = [`Discovered ${commands.length} commands for "${cli}":
+`];
+  for (const cmd of sorted) {
+    const verb = cmd.path[cmd.path.length - 1];
+    const full = `${cli} ${cmd.path.join(" ")}`;
+    const text = cmd.description ? `${full} \u2014 ${cmd.description}` : full;
+    lines.push(`${prefix(classifyVerb(verb))}${text}`);
+  }
+  return lines.join("\n");
 }
-function resolveIgnoreList(options2, config) {
-  return options2.ignore ?? config.devlog?.ignore ?? [];
-}
-function resolveSkipDays(config) {
-  return new Set(config.devlog?.skip?.days ?? []);
-}
-function getLastDate(lastInfo) {
-  return lastInfo?.date ?? null;
-}
-function getCommitsForDate(commitsByDate, date) {
-  return commitsByDate.get(date) ?? [];
-}
-function noCommitsMessage(hasLastInfo) {
-  return hasLastInfo ? "No commits after last versioned entry" : "No commits found";
-}
-function logName(repoName) {
-  console.log(`${chalk41.bold("name:")} ${repoName}`);
-}
-function displayNextEntry(ctx, targetDate, commits) {
-  logName(ctx.repoName);
-  printVersionInfo(ctx.config, ctx.lastInfo, commits[0]?.hash);
-  console.log(chalk41.bold.blue(targetDate));
-  printCommitsWithFiles(commits, ctx.ignore, ctx.verbose);
+
+// src/commands/permitCliReads/parseCached.ts
+function parseCached(cli, cached) {
+  const prefix2 = `${cli} `;
+  const commands = [];
+  for (const line of cached.split("\n")) {
+    const trimmed = line.replace(/^ [RW?] {2}/, "").trim();
+    if (!trimmed.startsWith(prefix2)) continue;
+    const rest = trimmed.slice(prefix2.length);
+    const dashIdx = rest.indexOf(" \u2014 ");
+    const pathStr = dashIdx >= 0 ? rest.slice(0, dashIdx) : rest;
+    const description = dashIdx >= 0 ? rest.slice(dashIdx + 3) : "";
+    commands.push({ path: pathStr.split(" "), description });
+  }
+  return commands;
 }
-function logNoCommits(lastInfo) {
-  console.log(chalk41.dim(noCommitsMessage(!!lastInfo)));
+
+// src/commands/permitCliReads/updateSettings.ts
+function updateSettings(cli, commands) {
+  const existing = loadCliReads();
+  const readEntries = commands.filter((cmd) => classifyVerb(cmd.path[cmd.path.length - 1]) === "r").map((cmd) => `${cli} ${cmd.path.join(" ")}`);
+  const merged = [.../* @__PURE__ */ new Set([...existing, ...readEntries])].sort();
+  if (merged.length === existing.length && merged.every((e, i) => e === existing[i]))
+    return;
+  saveCliReads(merged);
 }
 
-// src/commands/devlog/next/index.ts
-function resolveContextData(config, options2) {
-  const repoName = getRepoName();
-  const lastInfo = getLastVersionInfo(repoName, config);
-  return { repoName, lastInfo, ignore: resolveIgnoreList(options2, config) };
+// src/commands/permitCliReads/index.ts
+function logPath(cli) {
+  const safeName = cli.replace(/\s+/g, "-");
+  return join12(homedir4(), ".assist", `cli-discover-${safeName}.log`);
 }
-function buildContext(options2) {
-  const config = loadConfig();
-  const data = resolveContextData(config, options2);
-  return { config, ...data, verbose: options2.verbose ?? false };
+function readCache(cli) {
+  const path31 = logPath(cli);
+  if (!existsSync18(path31)) return void 0;
+  return readFileSync16(path31, "utf-8");
 }
-function fetchNextCommits(ctx) {
-  const commitsByDate = fetchCommitsByDate(
-    ctx.ignore,
-    getLastDate(ctx.lastInfo)
-  );
-  const targetDate = findTargetDate(commitsByDate, resolveSkipDays(ctx.config));
-  return targetDate ? { targetDate, commits: getCommitsForDate(commitsByDate, targetDate) } : null;
+function writeCache(cli, output) {
+  const dir = join12(homedir4(), ".assist");
+  mkdirSync4(dir, { recursive: true });
+  writeFileSync14(logPath(cli), output);
 }
-function showResult(ctx, found) {
-  if (!found) {
-    logNoCommits(ctx.lastInfo);
-    return;
+async function permitCliReads(cli, options2 = { noCache: false }) {
+  if (!cli) {
+    console.error("Usage: assist permit-cli-reads <cli>");
+    process.exit(1);
   }
-  displayNextEntry(ctx, found.targetDate, found.commits);
-}
-function next(options2) {
-  const ctx = buildContext(options2);
-  showResult(ctx, fetchNextCommits(ctx));
-}
-
-// src/commands/devlog/skip.ts
-import chalk42 from "chalk";
-function skip(date) {
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) {
-    console.log(chalk42.red("Invalid date format. Use YYYY-MM-DD"));
+  const installDir = getInstallDir();
+  if (!isGitRepo(installDir)) {
+    console.error(
+      "permit-cli-reads must be run from the assist git repo, not a global install."
+    );
     process.exit(1);
   }
-  const config = loadProjectConfig();
-  const devlog = config.devlog ?? {};
-  const skip2 = devlog.skip ?? {};
-  const skipDays = skip2.days ?? [];
-  if (skipDays.includes(date)) {
-    console.log(chalk42.yellow(`${date} is already in skip list`));
-    return;
+  if (!options2.noCache) {
+    const cached = readCache(cli);
+    if (cached) {
+      console.log(colorize(cached));
+      updateSettings(cli, parseCached(cli, cached));
+      return;
+    }
   }
-  skipDays.push(date);
-  skipDays.sort();
-  skip2.days = skipDays;
-  devlog.skip = skip2;
-  config.devlog = devlog;
-  saveConfig(config);
-  console.log(chalk42.green(`Added ${date} to skip list`));
-}
-
-// src/commands/devlog/version.ts
-import chalk43 from "chalk";
-function version() {
-  const config = loadConfig();
-  const name = getRepoName();
-  const lastInfo = getLastVersionInfo(name, config);
-  const lastVersion = lastInfo?.version ?? null;
-  const nextVersion = lastVersion ? bumpVersion(lastVersion, "patch") : null;
-  console.log(`${chalk43.bold("name:")} ${name}`);
-  console.log(`${chalk43.bold("last:")} ${lastVersion ?? chalk43.dim("none")}`);
-  console.log(`${chalk43.bold("next:")} ${nextVersion ?? chalk43.dim("none")}`);
+  assertCliExists(cli);
+  const commands = await discoverAll(cli);
+  const output = formatHuman(cli, commands);
+  console.log(colorize(output));
+  writeCache(cli, output);
+  updateSettings(cli, commands);
 }
 
-// src/commands/registerDevlog.ts
-function registerDevlog(program2) {
-  const devlogCommand = program2.command("devlog").description("Development log utilities");
-  devlogCommand.command("list").description("Group git commits by date").option(
-    "--days <number>",
-    "Number of days to show (default: 30)",
-    Number.parseInt
-  ).option("--since <date>", "Only show commits since this date (YYYY-MM-DD)").option("-r, --reverse", "Show earliest commits first").option("-v, --verbose", "Show file names for each commit").action(list3);
-  devlogCommand.command("version").description("Show current repo name and version info").action(version);
-  devlogCommand.command("next").description("Show commits for the day after the last versioned entry").option("-v, --verbose", "Show file names for each commit").action(next);
-  devlogCommand.command("skip <date>").description("Add a date (YYYY-MM-DD) to the skip list").action(skip);
+// src/commands/registerPermitCliReads.ts
+function registerPermitCliReads(program2) {
+  program2.command("permit-cli-reads").description("Discover a CLI's commands and auto-permit read-only ones").argument(
+    "<cli...>",
+    "CLI binary and optional subcommand (e.g. gh, az, acli jira)"
+  ).option("--no-cache", "Force fresh discovery, ignoring cached results").action((cli, options2) => {
+    permitCliReads(cli.join(" "), { noCache: !options2.cache });
+  });
 }
 
 // src/commands/prs/comment.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { unlinkSync as unlinkSync3, writeFileSync as writeFileSync15 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 
 // src/commands/prs/shared.ts
-import { execSync as execSync18 } from "child_process";
+import { execSync as execSync19 } from "child_process";
 function isGhNotInstalled(error) {
   if (error instanceof Error) {
     const msg = error.message.toLowerCase();
@@ -3834,14 +3948,14 @@ function isNotFound(error) {
 }
 function getRepoInfo() {
   const repoInfo = JSON.parse(
-    execSync18("gh repo view --json owner,name", { encoding: "utf-8" })
+    execSync19("gh repo view --json owner,name", { encoding: "utf-8" })
   );
   return { org: repoInfo.owner.login, repo: repoInfo.name };
 }
 function getCurrentPrNumber() {
   try {
     const prInfo = JSON.parse(
-      execSync18("gh pr view --json number", { encoding: "utf-8" })
+      execSync19("gh pr view --json number", { encoding: "utf-8" })
     );
     return prInfo.number;
   } catch (error) {
@@ -3855,7 +3969,7 @@ function getCurrentPrNumber() {
 function getCurrentPrNodeId() {
   try {
     const prInfo = JSON.parse(
-      execSync18("gh pr view --json id", { encoding: "utf-8" })
+      execSync19("gh pr view --json id", { encoding: "utf-8" })
     );
     return prInfo.id;
   } catch (error) {
@@ -3887,7 +4001,7 @@ function comment(path31, line, body) {
   validateLine(line);
   try {
     const prId = getCurrentPrNodeId();
-    const queryFile = join14(tmpdir2(), `gh-query-${Date.now()}.graphql`);
+    const queryFile = join13(tmpdir2(), `gh-query-${Date.now()}.graphql`);
     writeFileSync15(queryFile, MUTATION);
     try {
       const result = spawnSync2(
@@ -3926,32 +4040,32 @@ function comment(path31, line, body) {
 }
 
 // src/commands/prs/fixed.ts
-import { execSync as execSync20 } from "child_process";
+import { execSync as execSync21 } from "child_process";
 
 // src/commands/prs/resolveCommentWithReply.ts
-import { execSync as execSync19 } from "child_process";
+import { execSync as execSync20 } from "child_process";
 import { unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 
 // src/commands/prs/loadCommentsCache.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16, unlinkSync as unlinkSync4 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync17, unlinkSync as unlinkSync4 } from "fs";
+import { join as join14 } from "path";
 import { parse } from "yaml";
 function getCachePath(prNumber) {
-  return join15(process.cwd(), ".assist", `pr-${prNumber}-comments.yaml`);
+  return join14(process.cwd(), ".assist", `pr-${prNumber}-comments.yaml`);
 }
 function loadCommentsCache(prNumber) {
   const cachePath = getCachePath(prNumber);
-  if (!existsSync18(cachePath)) {
+  if (!existsSync19(cachePath)) {
     return null;
   }
-  const content = readFileSync16(cachePath, "utf-8");
+  const content = readFileSync17(cachePath, "utf-8");
   return parse(content);
 }
 function deleteCommentsCache(prNumber) {
   const cachePath = getCachePath(prNumber);
-  if (existsSync18(cachePath)) {
+  if (existsSync19(cachePath)) {
     unlinkSync4(cachePath);
     console.log("No more unresolved line comments. Cache dropped.");
   }
@@ -3959,17 +4073,17 @@ function deleteCommentsCache(prNumber) {
 
 // src/commands/prs/resolveCommentWithReply.ts
 function replyToComment(org, repo, prNumber, commentId, message) {
-  execSync19(
+  execSync20(
     `gh api repos/${org}/${repo}/pulls/${prNumber}/comments -f body="${message.replace(/"/g, '\\"')}" -F in_reply_to=${commentId}`,
     { stdio: "inherit" }
   );
 }
 function resolveThread(threadId) {
   const mutation = `mutation($threadId: ID!) { resolveReviewThread(input: {threadId: $threadId}) { thread { isResolved } } }`;
-  const queryFile = join16(tmpdir3(), `gh-mutation-${Date.now()}.graphql`);
+  const queryFile = join15(tmpdir3(), `gh-mutation-${Date.now()}.graphql`);
   writeFileSync16(queryFile, mutation);
   try {
-    execSync19(
+    execSync20(
       `gh api graphql -F query=@${queryFile} -f threadId="${threadId}"`,
       { stdio: "inherit" }
     );
@@ -4021,7 +4135,7 @@ function resolveCommentWithReply(commentId, message) {
 // src/commands/prs/fixed.ts
 function verifySha(sha) {
   try {
-    return execSync20(`git rev-parse --verify ${sha}`, {
+    return execSync21(`git rev-parse --verify ${sha}`, {
       encoding: "utf-8"
     }).trim();
   } catch {
@@ -4047,21 +4161,21 @@ function fixed(commentId, sha) {
 }
 
 // src/commands/prs/listComments/index.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
+import { join as join17 } from "path";
 import { stringify } from "yaml";
 
 // src/commands/prs/fetchThreadIds.ts
-import { execSync as execSync21 } from "child_process";
+import { execSync as execSync22 } from "child_process";
 import { unlinkSync as unlinkSync6, writeFileSync as writeFileSync17 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join17 } from "path";
+import { join as join16 } from "path";
 var THREAD_QUERY = `query($owner: String!, $repo: String!, $prNumber: Int!) { repository(owner: $owner, name: $repo) { pullRequest(number: $prNumber) { reviewThreads(first: 100) { nodes { id isResolved comments(first: 100) { nodes { databaseId } } } } } } }`;
 function fetchThreadIds(org, repo, prNumber) {
-  const queryFile = join17(tmpdir4(), `gh-query-${Date.now()}.graphql`);
+  const queryFile = join16(tmpdir4(), `gh-query-${Date.now()}.graphql`);
   writeFileSync17(queryFile, THREAD_QUERY);
   try {
-    const result = execSync21(
+    const result = execSync22(
       `gh api graphql -F query=@${queryFile} -F owner="${org}" -F repo="${repo}" -F prNumber=${prNumber}`,
       { encoding: "utf-8" }
     );
@@ -4083,9 +4197,9 @@ function fetchThreadIds(org, repo, prNumber) {
 }
 
 // src/commands/prs/listComments/fetchReviewComments.ts
-import { execSync as execSync22 } from "child_process";
+import { execSync as execSync23 } from "child_process";
 function fetchJson(endpoint) {
-  const result = execSync22(`gh api --paginate ${endpoint}`, {
+  const result = execSync23(`gh api --paginate ${endpoint}`, {
     encoding: "utf-8"
   });
   if (!result.trim()) return [];
@@ -4163,8 +4277,8 @@ function printComments(comments) {
   }
 }
 function writeCommentsCache(prNumber, comments) {
-  const assistDir = join18(process.cwd(), ".assist");
-  if (!existsSync19(assistDir)) {
+  const assistDir = join17(process.cwd(), ".assist");
+  if (!existsSync20(assistDir)) {
     mkdirSync5(assistDir, { recursive: true });
   }
   const cacheData = {
@@ -4172,7 +4286,7 @@ function writeCommentsCache(prNumber, comments) {
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
     comments
   };
-  const cachePath = join18(assistDir, `pr-${prNumber}-comments.yaml`);
+  const cachePath = join17(assistDir, `pr-${prNumber}-comments.yaml`);
   writeFileSync18(cachePath, stringify(cacheData));
 }
 function handleKnownErrors(error) {
@@ -4213,7 +4327,7 @@ async function listComments() {
 }
 
 // src/commands/prs/prs/index.ts
-import { execSync as execSync23 } from "child_process";
+import { execSync as execSync24 } from "child_process";
 
 // src/commands/prs/prs/displayPaginated/index.ts
 import enquirer5 from "enquirer";
@@ -4319,7 +4433,7 @@ async function displayPaginated(pullRequests) {
 async function prs(options2) {
   const state = options2.open ? "open" : options2.closed ? "closed" : "all";
   try {
-    const result = execSync23(
+    const result = execSync24(
       `gh pr list --state ${state} --json number,title,url,author,createdAt,mergedAt,closedAt,state,changedFiles --limit 100`,
       { encoding: "utf-8" }
     );
@@ -4342,7 +4456,7 @@ async function prs(options2) {
 }
 
 // src/commands/prs/wontfix.ts
-import { execSync as execSync24 } from "child_process";
+import { execSync as execSync25 } from "child_process";
 function validateReason(reason) {
   const lowerReason = reason.toLowerCase();
   if (lowerReason.includes("claude") || lowerReason.includes("opus")) {
@@ -4359,7 +4473,7 @@ function validateShaReferences(reason) {
   const invalidShas = [];
   for (const sha of shas) {
     try {
-      execSync24(`git cat-file -t ${sha}`, { stdio: "pipe" });
+      execSync25(`git cat-file -t ${sha}`, { stdio: "pipe" });
     } catch {
       invalidShas.push(sha);
     }
@@ -4463,7 +4577,7 @@ Refactor check failed:
 }
 
 // src/commands/refactor/check/getViolations/index.ts
-import { execSync as execSync25 } from "child_process";
+import { execSync as execSync26 } from "child_process";
 import fs15 from "fs";
 import { minimatch as minimatch4 } from "minimatch";
 
@@ -4513,7 +4627,7 @@ function getGitFiles(options2) {
   }
   const files = /* @__PURE__ */ new Set();
   if (options2.staged || options2.modified) {
-    const staged = execSync25("git diff --cached --name-only", {
+    const staged = execSync26("git diff --cached --name-only", {
       encoding: "utf-8"
     });
     for (const file of staged.trim().split("\n").filter(Boolean)) {
@@ -4521,7 +4635,7 @@ function getGitFiles(options2) {
     }
   }
   if (options2.unstaged || options2.modified) {
-    const unstaged = execSync25("git diff --name-only", { encoding: "utf-8" });
+    const unstaged = execSync26("git diff --name-only", { encoding: "utf-8" });
     for (const file of unstaged.trim().split("\n").filter(Boolean)) {
       files.add(file);
     }
@@ -4551,7 +4665,7 @@ function getViolations(pattern2, options2 = {}, maxLines = DEFAULT_MAX_LINES) {
 
 // src/commands/refactor/check/index.ts
 function runScript(script, cwd) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const child = spawn3("npm", ["run", script], {
       stdio: "pipe",
       shell: true,
@@ -4565,7 +4679,7 @@ function runScript(script, cwd) {
       output += data.toString();
     });
     child.on("close", (code) => {
-      resolve3({ script, code: code ?? 1, output });
+      resolve5({ script, code: code ?? 1, output });
     });
   });
 }
@@ -5137,8 +5251,8 @@ function registerRefactor(program2) {
 }
 
 // src/commands/transcript/shared.ts
-import { existsSync as existsSync20, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename4, join as join19, relative } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync2, statSync } from "fs";
+import { basename as basename4, join as join18, relative } from "path";
 import * as readline2 from "readline";
 var DATE_PREFIX_REGEX = /^\d{4}-\d{2}-\d{2}/;
 function getDatePrefix(daysOffset = 0) {
@@ -5153,10 +5267,10 @@ function isValidDatePrefix(filename) {
   return DATE_PREFIX_REGEX.test(filename);
 }
 function collectFiles(dir, extension) {
-  if (!existsSync20(dir)) return [];
+  if (!existsSync21(dir)) return [];
   const results = [];
   for (const entry of readdirSync2(dir)) {
-    const fullPath = join19(dir, entry);
+    const fullPath = join18(dir, entry);
     if (statSync(fullPath).isDirectory()) {
       results.push(...collectFiles(fullPath, extension));
     } else if (entry.endsWith(extension)) {
@@ -5188,9 +5302,9 @@ function createReadlineInterface() {
   });
 }
 function askQuestion(rl, question) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     rl.question(question, (answer) => {
-      resolve3(answer.trim());
+      resolve5(answer.trim());
     });
   });
 }
@@ -5250,14 +5364,14 @@ async function configure() {
 }
 
 // src/commands/transcript/format/index.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 
 // src/commands/transcript/format/fixInvalidDatePrefixes/index.ts
-import { dirname as dirname13, join as join21 } from "path";
+import { dirname as dirname15, join as join20 } from "path";
 
 // src/commands/transcript/format/fixInvalidDatePrefixes/promptForDateFix.ts
 import { renameSync } from "fs";
-import { join as join20 } from "path";
+import { join as join19 } from "path";
 async function resolveDate(rl, choice) {
   if (choice === "1") return getDatePrefix(0);
   if (choice === "2") return getDatePrefix(-1);
@@ -5272,7 +5386,7 @@ async function resolveDate(rl, choice) {
 }
 function renameWithPrefix(vttDir, vttFile, prefix2) {
   const newFilename = `${prefix2}.${vttFile}`;
-  renameSync(join20(vttDir, vttFile), join20(vttDir, newFilename));
+  renameSync(join19(vttDir, vttFile), join19(vttDir, newFilename));
   console.log(`Renamed to: ${newFilename}`);
   return newFilename;
 }
@@ -5303,15 +5417,15 @@ async function fixInvalidDatePrefixes(vttFiles) {
   for (let i = 0; i < vttFiles.length; i++) {
     const vttFile = vttFiles[i];
     if (!isValidDatePrefix(vttFile.filename)) {
-      const vttFileDir = dirname13(vttFile.absolutePath);
+      const vttFileDir = dirname15(vttFile.absolutePath);
       const newFilename = await promptForDateFix(vttFile.filename, vttFileDir);
       if (newFilename) {
-        const newRelativePath = join21(
-          dirname13(vttFile.relativePath),
+        const newRelativePath = join20(
+          dirname15(vttFile.relativePath),
           newFilename
         );
         vttFiles[i] = {
-          absolutePath: join21(vttFileDir, newFilename),
+          absolutePath: join20(vttFileDir, newFilename),
           relativePath: newRelativePath,
           filename: newFilename
         };
@@ -5324,8 +5438,8 @@ async function fixInvalidDatePrefixes(vttFiles) {
 }
 
 // src/commands/transcript/format/processVttFile/index.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, readFileSync as readFileSync17, writeFileSync as writeFileSync19 } from "fs";
-import { basename as basename5, dirname as dirname14, join as join22 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync19 } from "fs";
+import { basename as basename5, dirname as dirname16, join as join21 } from "path";
 
 // src/commands/transcript/cleanText.ts
 function cleanText(text) {
@@ -5535,21 +5649,21 @@ function toMdFilename(vttFilename) {
   return `${basename5(vttFilename, ".vtt").replace(/\s*Transcription\s*/g, " ").trim()}.md`;
 }
 function resolveOutputDir(relativeDir, transcriptsDir) {
-  return relativeDir === "." ? transcriptsDir : join22(transcriptsDir, relativeDir);
+  return relativeDir === "." ? transcriptsDir : join21(transcriptsDir, relativeDir);
 }
 function buildOutputPaths(vttFile, transcriptsDir) {
   const mdFile = toMdFilename(vttFile.filename);
-  const relativeDir = dirname14(vttFile.relativePath);
+  const relativeDir = dirname16(vttFile.relativePath);
   const outputDir = resolveOutputDir(relativeDir, transcriptsDir);
-  const outputPath = join22(outputDir, mdFile);
+  const outputPath = join21(outputDir, mdFile);
   return { outputDir, outputPath, mdFile, relativeDir };
 }
 function logSkipped(relativeDir, mdFile) {
-  console.log(`Skipping (already exists): ${join22(relativeDir, mdFile)}`);
+  console.log(`Skipping (already exists): ${join21(relativeDir, mdFile)}`);
   return "skipped";
 }
 function ensureDirectory(dir, label2) {
-  if (!existsSync21(dir)) {
+  if (!existsSync22(dir)) {
     mkdirSync6(dir, { recursive: true });
     console.log(`Created ${label2}: ${dir}`);
   }
@@ -5572,7 +5686,7 @@ function logReduction(cueCount, messageCount) {
 }
 function readAndParseCues(inputPath) {
   console.log(`Reading: ${inputPath}`);
-  return processCues(readFileSync17(inputPath, "utf-8"));
+  return processCues(readFileSync18(inputPath, "utf-8"));
 }
 function writeFormatted(outputPath, content) {
   writeFileSync19(outputPath, content, "utf-8");
@@ -5585,7 +5699,7 @@ function convertVttToMarkdown(inputPath, outputPath) {
   logReduction(cues.length, chatMessages.length);
 }
 function tryProcessVtt(vttFile, paths) {
-  if (existsSync21(paths.outputPath))
+  if (existsSync22(paths.outputPath))
     return logSkipped(paths.relativeDir, paths.mdFile);
   convertVttToMarkdown(vttFile.absolutePath, paths.outputPath);
   return "processed";
@@ -5611,7 +5725,7 @@ function processAllFiles(vttFiles, transcriptsDir) {
   logSummary(counts);
 }
 function requireVttDir(vttDir) {
-  if (!existsSync22(vttDir)) {
+  if (!existsSync23(vttDir)) {
     console.error(`VTT directory not found: ${vttDir}`);
     process.exit(1);
   }
@@ -5643,18 +5757,18 @@ async function format() {
 }
 
 // src/commands/transcript/summarise/index.ts
-import { existsSync as existsSync24 } from "fs";
-import { basename as basename6, dirname as dirname16, join as join24, relative as relative2 } from "path";
+import { existsSync as existsSync25 } from "fs";
+import { basename as basename6, dirname as dirname18, join as join23, relative as relative2 } from "path";
 
 // src/commands/transcript/summarise/processStagedFile/index.ts
 import {
-  existsSync as existsSync23,
+  existsSync as existsSync24,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   renameSync as renameSync2,
   rmSync
 } from "fs";
-import { dirname as dirname15, join as join23 } from "path";
+import { dirname as dirname17, join as join22 } from "path";
 
 // src/commands/transcript/summarise/processStagedFile/validateStagedContent.ts
 import chalk51 from "chalk";
@@ -5683,9 +5797,9 @@ function validateStagedContent(filename, content) {
 }
 
 // src/commands/transcript/summarise/processStagedFile/index.ts
-var STAGING_DIR = join23(process.cwd(), ".assist", "transcript");
+var STAGING_DIR = join22(process.cwd(), ".assist", "transcript");
 function processStagedFile() {
-  if (!existsSync23(STAGING_DIR)) {
+  if (!existsSync24(STAGING_DIR)) {
     return false;
   }
   const stagedFiles = findMdFilesRecursive(STAGING_DIR);
@@ -5694,7 +5808,7 @@ function processStagedFile() {
   }
   const { transcriptsDir, summaryDir } = getTranscriptConfig();
   const stagedFile = stagedFiles[0];
-  const content = readFileSync18(stagedFile.absolutePath, "utf-8");
+  const content = readFileSync19(stagedFile.absolutePath, "utf-8");
   validateStagedContent(stagedFile.filename, content);
   const stagedBaseName = getTranscriptBaseName(stagedFile.filename);
   const transcriptFiles = findMdFilesRecursive(transcriptsDir);
@@ -5707,9 +5821,9 @@ function processStagedFile() {
     );
     process.exit(1);
   }
-  const destPath = join23(summaryDir, matchingTranscript.relativePath);
-  const destDir = dirname15(destPath);
-  if (!existsSync23(destDir)) {
+  const destPath = join22(summaryDir, matchingTranscript.relativePath);
+  const destDir = dirname17(destPath);
+  if (!existsSync24(destDir)) {
     mkdirSync7(destDir, { recursive: true });
   }
   renameSync2(stagedFile.absolutePath, destPath);
@@ -5722,8 +5836,8 @@ function processStagedFile() {
 
 // src/commands/transcript/summarise/index.ts
 function buildRelativeKey(relativePath, baseName) {
-  const relDir = dirname16(relativePath);
-  return relDir === "." ? baseName : join24(relDir, baseName);
+  const relDir = dirname18(relativePath);
+  return relDir === "." ? baseName : join23(relDir, baseName);
 }
 function buildSummaryIndex(summaryDir) {
   const summaryFiles = findMdFilesRecursive(summaryDir);
@@ -5736,7 +5850,7 @@ function buildSummaryIndex(summaryDir) {
 function summarise() {
   processStagedFile();
   const { transcriptsDir, summaryDir } = getTranscriptConfig();
-  if (!existsSync24(transcriptsDir)) {
+  if (!existsSync25(transcriptsDir)) {
     console.log("No transcripts directory found.");
     return;
   }
@@ -5757,8 +5871,8 @@ function summarise() {
   }
   const next2 = missing[0];
   const outputFilename = `${getTranscriptBaseName(next2.filename)}.md`;
-  const outputPath = join24(STAGING_DIR, outputFilename);
-  const summaryFileDir = join24(summaryDir, dirname16(next2.relativePath));
+  const outputPath = join23(STAGING_DIR, outputFilename);
+  const summaryFileDir = join23(summaryDir, dirname18(next2.relativePath));
   const relativeTranscriptPath = encodeURI(
     relative2(summaryFileDir, next2.absolutePath).replace(/\\/g, "/")
   );
@@ -5804,50 +5918,50 @@ function registerVerify(program2) {
 
 // src/commands/voice/devices.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { join as join26 } from "path";
+import { join as join25 } from "path";
 
 // src/commands/voice/shared.ts
 import { homedir as homedir5 } from "os";
-import { dirname as dirname17, join as join25 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-var __dirname5 = dirname17(fileURLToPath4(import.meta.url));
-var VOICE_DIR = join25(homedir5(), ".assist", "voice");
+import { dirname as dirname19, join as join24 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+var __dirname7 = dirname19(fileURLToPath6(import.meta.url));
+var VOICE_DIR = join24(homedir5(), ".assist", "voice");
 var voicePaths = {
   dir: VOICE_DIR,
-  pid: join25(VOICE_DIR, "voice.pid"),
-  log: join25(VOICE_DIR, "voice.log"),
-  venv: join25(VOICE_DIR, ".venv"),
-  lock: join25(VOICE_DIR, "voice.lock")
+  pid: join24(VOICE_DIR, "voice.pid"),
+  log: join24(VOICE_DIR, "voice.log"),
+  venv: join24(VOICE_DIR, ".venv"),
+  lock: join24(VOICE_DIR, "voice.lock")
 };
 function getPythonDir() {
-  return join25(__dirname5, "commands", "voice", "python");
+  return join24(__dirname7, "commands", "voice", "python");
 }
 function getVenvPython() {
-  return process.platform === "win32" ? join25(voicePaths.venv, "Scripts", "python.exe") : join25(voicePaths.venv, "bin", "python");
+  return process.platform === "win32" ? join24(voicePaths.venv, "Scripts", "python.exe") : join24(voicePaths.venv, "bin", "python");
 }
 function getLockDir() {
   const config = loadConfig();
   return config.voice?.lockDir ?? VOICE_DIR;
 }
 function getLockFile() {
-  return join25(getLockDir(), "voice.lock");
+  return join24(getLockDir(), "voice.lock");
 }
 
 // src/commands/voice/devices.ts
 function devices() {
-  const script = join26(getPythonDir(), "list_devices.py");
+  const script = join25(getPythonDir(), "list_devices.py");
   spawnSync3(getVenvPython(), [script], { stdio: "inherit" });
 }
 
 // src/commands/voice/logs.ts
-import { existsSync as existsSync25, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync20 } from "fs";
 function logs(options2) {
-  if (!existsSync25(voicePaths.log)) {
+  if (!existsSync26(voicePaths.log)) {
     console.log("No voice log file found");
     return;
   }
   const count = Number.parseInt(options2.lines ?? "150", 10);
-  const content = readFileSync19(voicePaths.log, "utf-8").trim();
+  const content = readFileSync20(voicePaths.log, "utf-8").trim();
   if (!content) {
     console.log("Voice log is empty");
     return;
@@ -5870,12 +5984,12 @@ function logs(options2) {
 // src/commands/voice/setup.ts
 import { spawnSync as spawnSync4 } from "child_process";
 import { mkdirSync as mkdirSync9 } from "fs";
-import { join as join28 } from "path";
+import { join as join27 } from "path";
 
 // src/commands/voice/checkLockFile.ts
-import { execSync as execSync26 } from "child_process";
-import { existsSync as existsSync26, mkdirSync as mkdirSync8, readFileSync as readFileSync20, writeFileSync as writeFileSync20 } from "fs";
-import { join as join27 } from "path";
+import { execSync as execSync27 } from "child_process";
+import { existsSync as existsSync27, mkdirSync as mkdirSync8, readFileSync as readFileSync21, writeFileSync as writeFileSync20 } from "fs";
+import { join as join26 } from "path";
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -5886,9 +6000,9 @@ function isProcessAlive(pid) {
 }
 function checkLockFile() {
   const lockFile = getLockFile();
-  if (!existsSync26(lockFile)) return;
+  if (!existsSync27(lockFile)) return;
   try {
-    const lock = JSON.parse(readFileSync20(lockFile, "utf-8"));
+    const lock = JSON.parse(readFileSync21(lockFile, "utf-8"));
     if (lock.pid && isProcessAlive(lock.pid)) {
       console.error(
         `Voice daemon already running (PID ${lock.pid}, env: ${lock.env}). Stop it first with: assist voice stop`
@@ -5899,10 +6013,10 @@ function checkLockFile() {
   }
 }
 function bootstrapVenv() {
-  if (existsSync26(getVenvPython())) return;
+  if (existsSync27(getVenvPython())) return;
   console.log("Setting up Python environment...");
   const pythonDir = getPythonDir();
-  execSync26(
+  execSync27(
     `uv sync --project "${pythonDir}" --extra runtime --no-install-project`,
     {
       stdio: "inherit",
@@ -5912,7 +6026,7 @@ function bootstrapVenv() {
 }
 function writeLockFile(pid) {
   const lockFile = getLockFile();
-  mkdirSync8(join27(lockFile, ".."), { recursive: true });
+  mkdirSync8(join26(lockFile, ".."), { recursive: true });
   writeFileSync20(
     lockFile,
     JSON.stringify({
@@ -5928,7 +6042,7 @@ function setup() {
   mkdirSync9(voicePaths.dir, { recursive: true });
   bootstrapVenv();
   console.log("\nDownloading models...\n");
-  const script = join28(getPythonDir(), "setup_models.py");
+  const script = join27(getPythonDir(), "setup_models.py");
   const result = spawnSync4(getVenvPython(), [script], {
     stdio: "inherit",
     env: { ...process.env, VOICE_LOG_FILE: voicePaths.log }
@@ -5942,7 +6056,7 @@ function setup() {
 // src/commands/voice/start.ts
 import { spawn as spawn4 } from "child_process";
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync21 } from "fs";
-import { join as join29 } from "path";
+import { join as join28 } from "path";
 
 // src/commands/voice/buildDaemonEnv.ts
 function buildDaemonEnv(options2) {
@@ -5980,7 +6094,7 @@ function start2(options2) {
   bootstrapVenv();
   const debug = options2.debug || options2.foreground || process.platform === "win32";
   const env = buildDaemonEnv({ debug });
-  const script = join29(getPythonDir(), "voice_daemon.py");
+  const script = join28(getPythonDir(), "voice_daemon.py");
   const python = getVenvPython();
   if (options2.foreground) {
     spawnForeground(python, script, env);
@@ -5990,7 +6104,7 @@ function start2(options2) {
 }
 
 // src/commands/voice/status.ts
-import { existsSync as existsSync27, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync22 } from "fs";
 function isProcessAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -6000,16 +6114,16 @@ function isProcessAlive2(pid) {
   }
 }
 function readRecentLogs(count) {
-  if (!existsSync27(voicePaths.log)) return [];
-  const lines = readFileSync21(voicePaths.log, "utf-8").trim().split("\n");
+  if (!existsSync28(voicePaths.log)) return [];
+  const lines = readFileSync22(voicePaths.log, "utf-8").trim().split("\n");
   return lines.slice(-count);
 }
 function status() {
-  if (!existsSync27(voicePaths.pid)) {
+  if (!existsSync28(voicePaths.pid)) {
     console.log("Voice daemon: not running (no PID file)");
     return;
   }
-  const pid = Number.parseInt(readFileSync21(voicePaths.pid, "utf-8").trim(), 10);
+  const pid = Number.parseInt(readFileSync22(voicePaths.pid, "utf-8").trim(), 10);
   const alive = isProcessAlive2(pid);
   console.log(`Voice daemon: ${alive ? "running" : "dead"} (PID ${pid})`);
   const recent = readRecentLogs(5);
@@ -6028,13 +6142,13 @@ function status() {
 }
 
 // src/commands/voice/stop.ts
-import { existsSync as existsSync28, readFileSync as readFileSync22, unlinkSync as unlinkSync7 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync23, unlinkSync as unlinkSync7 } from "fs";
 function stop() {
-  if (!existsSync28(voicePaths.pid)) {
+  if (!existsSync29(voicePaths.pid)) {
     console.log("Voice daemon is not running (no PID file)");
     return;
   }
-  const pid = Number.parseInt(readFileSync22(voicePaths.pid, "utf-8").trim(), 10);
+  const pid = Number.parseInt(readFileSync23(voicePaths.pid, "utf-8").trim(), 10);
   try {
     process.kill(pid, "SIGTERM");
     console.log(`Sent SIGTERM to voice daemon (PID ${pid})`);
@@ -6047,7 +6161,7 @@ function stop() {
   }
   try {
     const lockFile = getLockFile();
-    if (existsSync28(lockFile)) unlinkSync7(lockFile);
+    if (existsSync29(lockFile)) unlinkSync7(lockFile);
   } catch {
   }
   console.log("Voice daemon stopped");
@@ -6069,11 +6183,11 @@ import { randomBytes } from "crypto";
 import chalk52 from "chalk";
 
 // src/lib/openBrowser.ts
-import { execSync as execSync27 } from "child_process";
+import { execSync as execSync28 } from "child_process";
 function tryExec(commands) {
   for (const cmd of commands) {
     try {
-      execSync27(cmd);
+      execSync28(cmd);
       return true;
     } catch {
     }
@@ -6131,7 +6245,7 @@ function extractCode(url, expectedState) {
   return code;
 }
 function waitForCallback(port, expectedState) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve5, reject) => {
     const timeout = setTimeout(() => {
       server.close();
       reject(new Error("Authorization timed out after 120 seconds"));
@@ -6148,7 +6262,7 @@ function waitForCallback(port, expectedState) {
         const code = extractCode(url, expectedState);
         respondHtml(res, 200, "Authorization successful!");
         server.close();
-        resolve3(code);
+        resolve5(code);
       } catch (err) {
         respondHtml(res, 400, err.message);
         server.close();
@@ -6278,7 +6392,7 @@ import { spawn as spawn5 } from "child_process";
 
 // src/commands/run/add.ts
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync22 } from "fs";
-import { join as join30 } from "path";
+import { join as join29 } from "path";
 function findAddIndex() {
   const addIndex = process.argv.indexOf("add");
   if (addIndex === -1 || addIndex + 2 >= process.argv.length) return -1;
@@ -6332,7 +6446,7 @@ function saveNewRunConfig(name, command, args) {
   saveConfig(config);
 }
 function createCommandFile(name) {
-  const dir = join30(".claude", "commands");
+  const dir = join29(".claude", "commands");
   mkdirSync11(dir, { recursive: true });
   const content = `---
 description: Run ${name}
@@ -6340,7 +6454,7 @@ description: Run ${name}
 
 Run \`assist run ${name} $ARGUMENTS 2>&1\`.
 `;
-  const filePath = join30(dir, `${name}.md`);
+  const filePath = join29(dir, `${name}.md`);
   writeFileSync22(filePath, content);
   console.log(`Created command file: ${filePath}`);
 }
@@ -6439,7 +6553,7 @@ async function statusLine() {
 import * as fs23 from "fs";
 import * as os from "os";
 import * as path29 from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/commands/sync/syncClaudeMd.ts
 import * as fs21 from "fs";
@@ -6479,11 +6593,15 @@ async function syncSettings(claudeDir, targetBase, options2) {
   const source = path28.join(claudeDir, "settings.json");
   const target = path28.join(targetBase, "settings.json");
   const sourceContent = fs22.readFileSync(source, "utf-8");
-  const normalizedSource = JSON.stringify(JSON.parse(sourceContent), null, 2);
+  const mergedContent = JSON.stringify(JSON.parse(sourceContent), null, "	");
   if (fs22.existsSync(target)) {
     const targetContent = fs22.readFileSync(target, "utf-8");
-    const normalizedTarget = JSON.stringify(JSON.parse(targetContent), null, 2);
-    if (normalizedSource !== normalizedTarget) {
+    const normalizedTarget = JSON.stringify(
+      JSON.parse(targetContent),
+      null,
+      "	"
+    );
+    if (mergedContent !== normalizedTarget) {
       if (!options2?.yes) {
         console.log(
           chalk55.yellow(
@@ -6491,7 +6609,7 @@ async function syncSettings(claudeDir, targetBase, options2) {
           )
         );
         console.log();
-        printDiff(targetContent, sourceContent);
+        printDiff(targetContent, mergedContent);
         const confirm = await promptConfirm(
           chalk55.red("Overwrite existing settings.json?"),
           false
@@ -6503,15 +6621,15 @@ async function syncSettings(claudeDir, targetBase, options2) {
       }
     }
   }
-  fs22.copyFileSync(source, target);
+  fs22.writeFileSync(target, mergedContent);
   console.log("Copied settings.json to ~/.claude/settings.json");
 }
 
 // src/commands/sync.ts
-var __filename2 = fileURLToPath5(import.meta.url);
-var __dirname6 = path29.dirname(__filename2);
+var __filename4 = fileURLToPath7(import.meta.url);
+var __dirname8 = path29.dirname(__filename4);
 async function sync(options2) {
-  const claudeDir = path29.join(__dirname6, "..", "claude");
+  const claudeDir = path29.join(__dirname8, "..", "claude");
   const targetBase = path29.join(os.homedir(), ".claude");
   syncCommands(claudeDir, targetBase);
   await syncSettings(claudeDir, targetBase, { yes: options2?.yes });
@@ -6530,28 +6648,11 @@ function syncCommands(claudeDir, targetBase) {
 }
 
 // src/commands/update.ts
-import { execSync as execSync28 } from "child_process";
+import { execSync as execSync29 } from "child_process";
 import * as path30 from "path";
-import { fileURLToPath as fileURLToPath6 } from "url";
-var __filename3 = fileURLToPath6(import.meta.url);
-var __dirname7 = path30.dirname(__filename3);
-function getInstallDir() {
-  return path30.resolve(__dirname7, "..");
-}
-function isGitRepo(dir) {
-  try {
-    const result = execSync28("git rev-parse --show-toplevel", {
-      cwd: dir,
-      stdio: "pipe"
-    }).toString().trim();
-    return path30.resolve(result) === path30.resolve(dir);
-  } catch {
-    return false;
-  }
-}
 function isGlobalNpmInstall(dir) {
   try {
-    const globalPrefix = execSync28("npm prefix -g", { stdio: "pipe" }).toString().trim();
+    const globalPrefix = execSync29("npm prefix -g", { stdio: "pipe" }).toString().trim();
     return path30.resolve(dir).toLowerCase().startsWith(path30.resolve(globalPrefix).toLowerCase());
   } catch {
     return false;
@@ -6562,16 +6663,16 @@ async function update() {
   console.log(`Assist is installed at: ${installDir}`);
   if (isGitRepo(installDir)) {
     console.log("Detected git repo installation, pulling latest...");
-    execSync28("git pull", { cwd: installDir, stdio: "inherit" });
+    execSync29("git pull", { cwd: installDir, stdio: "inherit" });
     console.log("Building...");
-    execSync28("npm run build", { cwd: installDir, stdio: "inherit" });
+    execSync29("npm run build", { cwd: installDir, stdio: "inherit" });
     console.log("Syncing commands...");
-    execSync28("assist sync", { stdio: "inherit" });
+    execSync29("assist sync", { stdio: "inherit" });
   } else if (isGlobalNpmInstall(installDir)) {
     console.log("Detected global npm installation, updating...");
-    execSync28("npm i -g @staff0rd/assist@latest", { stdio: "inherit" });
+    execSync29("npm i -g @staff0rd/assist@latest", { stdio: "inherit" });
     console.log("Syncing commands...");
-    execSync28("assist sync", { stdio: "inherit" });
+    execSync29("assist sync", { stdio: "inherit" });
   } else {
     console.error(
       "Could not determine installation method. Expected a git repo or global npm install."
@@ -6605,7 +6706,7 @@ program.command("notify").description(
   "Show notification from Claude Code hook (reads JSON from stdin)"
 ).action(notify);
 program.command("update").description("Update assist to the latest version and sync commands").action(update);
-registerCliDiscover(program);
+registerPermitCliReads(program);
 registerCliHook(program);
 registerPrs(program);
 registerRoam(program);