@viberaven/cli 1.2.0 → 1.2.1

package/dist/cli.js

@@ -394,8 +394,6 @@ var init_backendClient = __esm({
         this.status = status;
         this.upgradeUrl = upgradeUrl;
       }
-      status;
-      upgradeUrl;
     };
   }
 });
@@ -2222,20 +2220,20 @@ function mapEvidenceSourceToLegacyEvidenceClass(source, status) {
   }
   return "mcp-verifier";
 }
-function isProviderLayerCheck(check2) {
-  return check2.evidenceSource === "provider" || check2.evidenceSource === "mcp";
+function isProviderLayerCheck(check) {
+  return check.evidenceSource === "provider" || check.evidenceSource === "mcp";
 }
-function isRepoLayerCheck(check2) {
-  return check2.evidenceSource === "repo";
+function isRepoLayerCheck(check) {
+  return check.evidenceSource === "repo";
 }
 function computeLayerReadinessPercent(checks, layer) {
   const filtered = checks.filter(
-    (check2) => layer === "repo" ? isRepoLayerCheck(check2) : isProviderLayerCheck(check2)
+    (check) => layer === "repo" ? isRepoLayerCheck(check) : isProviderLayerCheck(check)
   );
   if (filtered.length === 0) {
     return 100;
   }
-  const verified = filtered.filter((check2) => check2.status === "verified").length;
+  const verified = filtered.filter((check) => check.status === "verified").length;
   return Math.round(verified / filtered.length * 100);
 }
 function aggregateReadinessPercents(providerResults) {
@@ -2274,7 +2272,7 @@ function mergeVerificationIntoMissionGraph(graph, layer) {
     if (!mission) {
       continue;
     }
-    if (mission.checks.some((check2) => check2.verificationCheckId === layerCheck.id || check2.id === missionRowId(layerCheck.id))) {
+    if (mission.checks.some((check) => check.verificationCheckId === layerCheck.id || check.id === missionRowId(layerCheck.id))) {
       continue;
     }
     mission.checks.push(verificationCheckToMissionCheck(layerCheck, mission));
@@ -2365,7 +2363,7 @@ function readinessPercentForRepoChecks(checks) {
   if (repoChecks.length === 0) {
     return 100;
   }
-  const verified = repoChecks.filter((check2) => isVerifiedMissionCheck(check2)).length;
+  const verified = repoChecks.filter((check) => isVerifiedMissionCheck(check)).length;
   return Math.round(verified / repoChecks.length * 100);
 }
 function readinessPercentForProviderChecks(checks) {
@@ -2373,29 +2371,29 @@ function readinessPercentForProviderChecks(checks) {
   if (providerChecks.length === 0) {
     return 100;
   }
-  const verified = providerChecks.filter((check2) => isVerifiedMissionCheck(check2)).length;
+  const verified = providerChecks.filter((check) => isVerifiedMissionCheck(check)).length;
   return Math.round(verified / providerChecks.length * 100);
 }
-function isRepoLayerMissionCheck(check2) {
-  if (check2.evidenceSource === "provider" || check2.evidenceSource === "mcp" || check2.evidenceSource === "manual") {
+function isRepoLayerMissionCheck(check) {
+  if (check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.evidenceSource === "manual") {
     return false;
   }
-  if (check2.evidenceSource === "repo") {
+  if (check.evidenceSource === "repo") {
     return true;
   }
-  return check2.evidenceClass === "repo-verified" || check2.evidenceClass === "missing-repo-fix";
+  return check.evidenceClass === "repo-verified" || check.evidenceClass === "missing-repo-fix";
 }
-function isProviderLayerMissionCheck(check2) {
-  if (check2.evidenceSource === "provider" || check2.evidenceSource === "mcp") {
+function isProviderLayerMissionCheck(check) {
+  if (check.evidenceSource === "provider" || check.evidenceSource === "mcp") {
     return true;
   }
-  return check2.evidenceClass === "mcp-verifier";
+  return check.evidenceClass === "mcp-verifier";
 }
-function isVerifiedMissionCheck(check2) {
-  if (check2.verificationStatus) {
-    return check2.verificationStatus === "verified";
+function isVerifiedMissionCheck(check) {
+  if (check.verificationStatus) {
+    return check.verificationStatus === "verified";
   }
-  return check2.status === "passed" || check2.status === "user-confirmed";
+  return check.status === "passed" || check.status === "user-confirmed";
 }
 function rebuildAreas(providerMissions) {
   const byArea = /* @__PURE__ */ new Map();
@@ -2424,7 +2422,7 @@ function rebuildAreas(providerMissions) {
     const repoReadinessPercent = percentVerified(repoChecks);
     const providerReadinessPercent = percentVerified(providerChecks);
     const criticalCount = missions.flatMap((m2) => m2.checks).filter(
-      (check2) => isProviderLayerMissionCheck(check2) && (check2.verificationStatus === "missing" || check2.status === "missing" || check2.status === "failed")
+      (check) => isProviderLayerMissionCheck(check) && (check.verificationStatus === "missing" || check.status === "missing" || check.status === "failed")
     ).length;
     return {
       key,
@@ -2441,7 +2439,7 @@ function percentVerified(checks) {
   if (checks.length === 0) {
     return 100;
   }
-  const verified = checks.filter((check2) => isVerifiedMissionCheck(check2)).length;
+  const verified = checks.filter((check) => isVerifiedMissionCheck(check)).length;
   return Math.round(verified / checks.length * 100);
 }
 var PROVIDER_WIRING_KEY;
@@ -2504,7 +2502,7 @@ function toProviderMission(summary) {
     promptSubject: summary.promptSubject,
     readinessPercent: summary.readinessPercent,
     repoReadinessPercent: summary.readinessPercent,
-    providerReadinessPercent: checks.some((check2) => check2.evidenceClass === "mcp-verifier") ? 0 : 100,
+    providerReadinessPercent: checks.some((check) => check.evidenceClass === "mcp-verifier") ? 0 : 100,
     checks
   };
 }
@@ -2549,7 +2547,7 @@ function overlaySifgLeaks(providerMissions, graph) {
   const providerCheckIds = new Map(
     providerMissions.map((mission) => [
       mission.key,
-      new Set(mission.checks.map((check2) => check2.id))
+      new Set(mission.checks.map((check) => check.id))
     ])
   );
   for (const leak of graph.leaks) {
@@ -2568,9 +2566,9 @@ function overlaySifgLeaks(providerMissions, graph) {
       continue;
     }
     const usedCheckIds = providerCheckIds.get(mission.key) ?? /* @__PURE__ */ new Set();
-    const check2 = toSifgMissionCheck(mission, pipeline, pipelineId, leaks, usedCheckIds);
-    mission.checks.push(check2);
-    usedCheckIds.add(check2.id);
+    const check = toSifgMissionCheck(mission, pipeline, pipelineId, leaks, usedCheckIds);
+    mission.checks.push(check);
+    usedCheckIds.add(check.id);
     providerCheckIds.set(mission.key, usedCheckIds);
   }
   for (const mission of providerMissions) {
@@ -2621,11 +2619,11 @@ function stableSifgSuffix(id) {
 }
 function readinessPercentForChecks(checks) {
   const actionableChecks = checks.filter(isActionableCheck);
-  const passed = actionableChecks.filter((check2) => check2.status === "passed").length;
+  const passed = actionableChecks.filter((check) => check.status === "passed").length;
   return Math.round(passed / Math.max(actionableChecks.length, 1) * 100);
 }
-function isActionableCheck(check2) {
-  return check2.evidenceClass !== "manual-dashboard" && check2.evidenceClass !== "mcp-verifier";
+function isActionableCheck(check) {
+  return check.evidenceClass !== "manual-dashboard" && check.evidenceClass !== "mcp-verifier";
 }
 function buildAreas(providerMissions) {
   const byArea = /* @__PURE__ */ new Map();
@@ -2636,15 +2634,15 @@ function buildAreas(providerMissions) {
   }
   return [...byArea.entries()].map(([key, missions]) => {
     const actionableChecks = missions.flatMap((mission) => mission.checks).filter(isActionableCheck);
-    const passed = actionableChecks.filter((check2) => check2.status === "passed").length;
-    const missing = actionableChecks.filter((check2) => check2.status === "missing" || check2.status === "failed").length;
+    const passed = actionableChecks.filter((check) => check.status === "passed").length;
+    const missing = actionableChecks.filter((check) => check.status === "missing" || check.status === "failed").length;
     return {
       key,
       label: AREA_LABELS[key],
       readinessPercent: Math.round(passed / Math.max(actionableChecks.length, 1) * 100),
       repoReadinessPercent: Math.round(passed / Math.max(actionableChecks.length, 1) * 100),
       providerReadinessPercent: missions.some(
-        (mission) => mission.checks.some((check2) => check2.evidenceClass === "mcp-verifier")
+        (mission) => mission.checks.some((check) => check.evidenceClass === "mcp-verifier")
       ) ? 0 : 100,
       criticalCount: missing,
       providerMissions: missions
@@ -7784,9 +7782,9 @@ function runVerifier(verifier, ctx) {
   }
   const connectionState = verifier.connectStatus(ctx);
   const rawChecks = verifier.runChecks(ctx);
-  const checks = rawChecks.map((check2) => ({
-    ...check2,
-    status: coerceProviderVerificationStatus(check2.status, connectionState)
+  const checks = rawChecks.map((check) => ({
+    ...check,
+    status: coerceProviderVerificationStatus(check.status, connectionState)
   }));
   const diffs = verifier.buildDiffs(ctx);
   return {
@@ -8639,24 +8637,24 @@ var init_planLimits = __esm({
 });
 
 // src/playbooks/checkMap.ts
-function mapCheckToPlaybook(check2) {
-  if (CHECK_TO_PLAYBOOK[check2.id]) {
-    return CHECK_TO_PLAYBOOK[check2.id];
+function mapCheckToPlaybook(check) {
+  if (CHECK_TO_PLAYBOOK[check.id]) {
+    return CHECK_TO_PLAYBOOK[check.id];
   }
-  const providerKey = check2.providerKey.toLowerCase();
-  if (providerKey.includes("vercel") || check2.area === "deployment") {
+  const providerKey = check.providerKey.toLowerCase();
+  if (providerKey.includes("vercel") || check.area === "deployment") {
     return "vercel";
   }
-  if (providerKey.includes("stripe") || check2.area === "payments") {
+  if (providerKey.includes("stripe") || check.area === "payments") {
     return "stripe";
   }
-  if (providerKey.includes("supabase") && check2.area === "auth") {
+  if (providerKey.includes("supabase") && check.area === "auth") {
     return "auth-supabase";
   }
-  if (providerKey.includes("supabase") || check2.area === "database") {
+  if (providerKey.includes("supabase") || check.area === "database") {
     return "supabase";
   }
-  if (check2.area === "auth") {
+  if (check.area === "auth") {
     return "auth-supabase";
   }
   return "vercel";
@@ -8836,21 +8834,21 @@ var init_loadPlaybook = __esm({
 });
 
 // src/playbooks/manualChecks.ts
-function isManualProviderCheck(check2) {
-  return check2.evidenceClass === "manual-dashboard" || check2.evidenceClass === "mcp-verifier" || check2.evidenceSource === "provider" || check2.evidenceSource === "mcp" || check2.status === "needs-connection" || check2.status === "unknown";
+function isManualProviderCheck(check) {
+  return check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown";
 }
 function collectManualChecks(artifact) {
   const refs = [];
   for (const area of artifact.missionGraph.areas ?? []) {
     for (const mission of area.providerMissions) {
-      for (const check2 of mission.checks) {
-        if (!isManualProviderCheck(check2)) {
+      for (const check of mission.checks) {
+        if (!isManualProviderCheck(check)) {
           continue;
         }
         refs.push({
           areaLabel: area.label,
           providerLabel: mission.providerLabel,
-          check: check2,
+          check,
           mapCategory: area.key
         });
       }
@@ -9125,8 +9123,8 @@ function generateAgentSummary(artifact) {
   const manualChecks = (artifact.missionGraph.areas ?? []).flatMap(
     (area) => area.providerMissions.flatMap(
       (mission) => mission.checks.filter(
-        (check2) => check2.evidenceClass === "manual-dashboard" || check2.evidenceClass === "mcp-verifier" || check2.evidenceSource === "provider" || check2.evidenceSource === "mcp" || check2.status === "needs-connection" || check2.status === "unknown"
-      ).map((check2) => ({ area: area.label, provider: mission.providerLabel, check: check2 }))
+        (check) => check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown"
+      ).map((check) => ({ area: area.label, provider: mission.providerLabel, check }))
     )
   );
   lines.push("");
@@ -10469,9 +10467,9 @@ var init_clipboard = __esm({
   }
 });
 
-// ../../node_modules/picocolors/picocolors.js
+// node_modules/picocolors/picocolors.js
 var require_picocolors = __commonJS({
-  "../../node_modules/picocolors/picocolors.js"(exports2, module2) {
+  "node_modules/picocolors/picocolors.js"(exports2, module2) {
     var p2 = process || {};
     var argv = p2.argv || [];
     var env = p2.env || {};
@@ -10550,9 +10548,9 @@ function missionMatchesProvider(mission, provider2) {
   return normalizeProviderToken2(mission.provider || mission.providerLabel || mission.key) === current || normalizeProviderToken2(mission.providerLabel || mission.provider || mission.key) === current;
 }
 function missionEvidenceScore(mission) {
-  const repoVerified = mission.checks.filter((check2) => check2.evidenceClass === "repo-verified" || check2.status === "passed").length;
+  const repoVerified = mission.checks.filter((check) => check.evidenceClass === "repo-verified" || check.status === "passed").length;
   const missing = mission.checks.filter(
-    (check2) => check2.evidenceClass === "missing-repo-fix" || check2.status === "missing" || check2.status === "failed"
+    (check) => check.evidenceClass === "missing-repo-fix" || check.status === "missing" || check.status === "failed"
   ).length;
   return repoVerified * 100 + (mission.readinessPercent ?? 0) - missing;
 }
@@ -10572,7 +10570,7 @@ function openChecksForMission(mission) {
     return 0;
   }
   return mission.checks.filter(
-    (check2) => check2.status === "missing" || check2.status === "failed" || check2.status === "needs-connection"
+    (check) => check.status === "missing" || check.status === "failed" || check.status === "needs-connection"
   ).length;
 }
 var init_missionSelection = __esm({
@@ -10609,7 +10607,7 @@ function manualActionCheckCount(artifact) {
   return (artifact.missionGraph.areas ?? []).reduce((areaTotal, area) => {
     return areaTotal + area.providerMissions.reduce((missionTotal, mission) => {
       return missionTotal + mission.checks.filter(
-        (check2) => check2.evidenceClass === "manual-dashboard" || check2.evidenceClass === "mcp-verifier" || check2.evidenceSource === "provider" || check2.evidenceSource === "mcp" || check2.status === "needs-connection" || check2.status === "unknown"
+        (check) => check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown"
       ).length;
     }, 0);
   }, 0);
@@ -11647,9 +11645,9 @@ var init_runnerConnect = __esm({
   }
 });
 
-// ../../node_modules/sisteransi/src/index.js
+// node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
-  "../../node_modules/sisteransi/src/index.js"(exports2, module2) {
+  "node_modules/sisteransi/src/index.js"(exports2, module2) {
     "use strict";
     var ESC = "\x1B";
     var CSI = `${ESC}[`;
@@ -11703,7 +11701,7 @@ var require_src = __commonJS({
   }
 });
 
-// ../../node_modules/@clack/core/dist/index.mjs
+// node_modules/@clack/core/dist/index.mjs
 function DD({ onlyFirst: e2 = false } = {}) {
   const t = ["[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?(?:\\u0007|\\u001B\\u005C|\\u009C))", "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
   return new RegExp(t, e2 ? void 0 : "g");
@@ -11815,7 +11813,7 @@ function fD({ input: e2 = import_node_process.stdin, output: u2 = import_node_pr
 }
 var import_sisteransi, import_node_process, g, import_node_readline, import_node_stream, uD, W, tD, eD, FD, sD, w, N, I, R, C, iD, rD, ED, d, oD, y, V, nD, G, _, z, K, aD, k, hD, lD, xD, B, AD, S, gD, vD, h, x, A, OD, PD, J, LD;
 var init_dist = __esm({
-  "../../node_modules/@clack/core/dist/index.mjs"() {
+  "node_modules/@clack/core/dist/index.mjs"() {
     import_sisteransi = __toESM(require_src(), 1);
     import_node_process = require("node:process");
     g = __toESM(require("node:readline"), 1);
@@ -11941,7 +11939,7 @@ var init_dist = __esm({
     xD = ["up", "down", "left", "right", "space", "enter", "cancel"];
     B = { actions: new Set(xD), aliases: /* @__PURE__ */ new Map([["k", "up"], ["j", "down"], ["h", "left"], ["l", "right"], ["", "cancel"], ["escape", "cancel"]]) };
     AD = globalThis.process.platform.startsWith("win");
-    S = /* @__PURE__ */ Symbol("clack:cancel");
+    S = Symbol("clack:cancel");
     gD = Object.defineProperty;
     vD = (e2, u2, t) => u2 in e2 ? gD(e2, u2, { enumerable: true, configurable: true, writable: true, value: t }) : e2[u2] = t;
     h = (e2, u2, t) => (vD(e2, typeof u2 != "symbol" ? u2 + "" : u2, t), t);
@@ -12065,13 +12063,13 @@ var init_dist = __esm({
   }
 });
 
-// ../../node_modules/@clack/prompts/dist/index.mjs
+// node_modules/@clack/prompts/dist/index.mjs
 function ce() {
   return import_node_process2.default.platform !== "win32" ? import_node_process2.default.env.TERM !== "linux" : !!import_node_process2.default.env.CI || !!import_node_process2.default.env.WT_SESSION || !!import_node_process2.default.env.TERMINUS_SUBLIME || import_node_process2.default.env.ConEmuTask === "{cmd::Cmder}" || import_node_process2.default.env.TERM_PROGRAM === "Terminus-Sublime" || import_node_process2.default.env.TERM_PROGRAM === "vscode" || import_node_process2.default.env.TERM === "xterm-256color" || import_node_process2.default.env.TERM === "alacritty" || import_node_process2.default.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 var import_node_process2, import_picocolors2, import_sisteransi2, V2, u, le, L2, W2, C2, ue, o, d2, k2, P2, A2, T, F, $e, _2, me, de, pe, q, D, U, K2, b2, G2, ve, xe, Ie, Se, M2, J2, Y2;
 var init_dist2 = __esm({
-  "../../node_modules/@clack/prompts/dist/index.mjs"() {
+  "node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist();
     init_dist();
     import_node_process2 = __toESM(require("node:process"), 1);
@@ -12306,7 +12304,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.2.0";
+    VERSION = "1.2.1";
   }
 });
 
@@ -12631,7 +12629,7 @@ function buildVercelSupabaseAudit(input) {
     buildPoolerCheck(input.files),
     buildServiceRoleCheck(input.files)
   ];
-  const status = checks.every((check2) => check2.status === "pass") ? "pass" : "needs_work";
+  const status = checks.every((check) => check.status === "pass") ? "pass" : "needs_work";
   return {
     status,
     summary: status === "pass" ? "Repo evidence passes the local Vercel/Supabase audit checks." : "Repo evidence needs work before claiming Vercel/Supabase production readiness.",
@@ -12718,13 +12716,13 @@ function renderVercelSupabaseAudit(result) {
     "Boundary: this audit uses local repo evidence only. Provider dashboard settings still need manual verification or read-only provider MCP confirmation.",
     ""
   ];
-  for (const check2 of result.checks) {
-    lines.push(`${check2.status === "pass" ? "PASS" : "NEEDS_WORK"} ${check2.id}`);
-    lines.push(`  ${check2.summary}`);
-    for (const evidence of check2.evidence.slice(0, 5)) {
+  for (const check of result.checks) {
+    lines.push(`${check.status === "pass" ? "PASS" : "NEEDS_WORK"} ${check.id}`);
+    lines.push(`  ${check.summary}`);
+    for (const evidence of check.evidence.slice(0, 5)) {
       lines.push(`  - ${evidence}`);
     }
-    if (check2.evidence.length === 0) {
+    if (check.evidence.length === 0) {
       lines.push("  - No local evidence found.");
     }
     lines.push("");
@@ -15167,15 +15165,15 @@ async function checkAgentInjection(cwd) {
     }
   }
   return {
-    ok: checks.every((check2) => check2.status === "pass"),
+    ok: checks.every((check) => check.status === "pass"),
     checks
   };
 }
 function formatDoctorAgentsReport(report) {
   const lines = ["VibeRaven agent injection doctor", ""];
-  for (const check2 of report.checks) {
-    const icon = check2.status === "pass" ? "\u2713" : "\u2717";
-    lines.push(`${icon} ${check2.message}`);
+  for (const check of report.checks) {
+    const icon = check.status === "pass" ? "\u2713" : "\u2717";
+    lines.push(`${icon} ${check.message}`);
   }
   lines.push("");
   lines.push(report.ok ? "All agent injection checks passed." : "Agent injection checks failed.");
@@ -15641,288 +15639,106 @@ var init_verifyAction = __esm({
   }
 });
 
-// src/output/nextActionBlock.ts
-function buildNextActionBlock(tasks, loopState, plan) {
-  const batchSize = plan === "pro" ? 10 : 3;
-  const batchApplied = loopState.batchApplied;
-  const remainingInBatch = batchSize - batchApplied;
-  const scanNow = batchApplied >= batchSize;
-  const stalled = loopState.stalledScans >= 2;
-  const stalledScans = loopState.stalledScans;
-  const base = { batchSize, batchApplied, remainingInBatch, scanNow, stalled, stalledScans };
-  if (stalled) {
-    const stallReason = resolveStallReason(tasks);
-    return {
-      ...base,
-      type: "stalled",
-      title: "Loop stalled - no gap reduction after 2+ consecutive scans",
-      agentInstruction: "Stop the scan loop. Explain the blocker plainly, then either guide the provider/user action or report that no safe repo-code recipe is available.",
-      executionPlan: [
-        { kind: "stop", note: "Do not keep spending scans while the loop is stalled." }
-      ],
-      requiresUserAction: true,
-      stallReason
-    };
-  }
-  if (scanNow) {
-    return {
-      ...base,
-      type: "verify",
-      title: "Batch complete - run verify to rescan before next batch",
-      agentInstruction: "Run verify now, read the refreshed VibeRaven artifacts, then continue with the next safe repo fix or provider step. Do not stop at a summary.",
-      executionPlan: [
-        { kind: "verify", command: "viberaven_verify" },
-        { kind: "continue-loop", note: "After verify, continue until the gate is clear or a provider/user blocker remains." }
-      ],
-      mcpTool: "viberaven_verify",
-      mcpArgs: {},
-      requiresUserAction: false
-    };
-  }
-  const repoCodeTask = tasks.find((task) => task.fixType === "repo-code" && !task.requiresUserAction);
-  if (repoCodeTask) {
-    const fallbackCommand = repoCodeTask.mcpArgs ? `npx -y viberaven --heal --apply --gap ${repoCodeTask.gapId} --yes` : void 0;
-    return {
-      ...base,
-      type: "repo-code",
-      gapId: repoCodeTask.gapId,
-      title: repoCodeTask.title,
-      agentInstruction: "Apply this repo-code fix now using the MCP tool or fallback command, then continue the local VibeRaven loop. Do not stop at a summary.",
-      executionPlan: [
-        {
-          kind: "apply-repo-fix",
-          command: repoCodeTask.mcpTool ?? fallbackCommand,
-          note: "Patch only this gap and preserve unrelated user changes."
-        },
-        { kind: "continue-loop", note: "Apply remaining safe repo fixes until the batch is full, then verify once." }
-      ],
-      mcpTool: repoCodeTask.mcpTool,
-      mcpArgs: repoCodeTask.mcpArgs,
-      fallbackCommand,
-      requiresUserAction: false
-    };
-  }
-  const providerTask = tasks.find((task) => task.fixType === "provider-action");
-  if (providerTask) {
-    return {
-      ...base,
-      type: "provider-action",
-      gapId: providerTask.gapId,
-      title: providerTask.title,
-      agentInstruction: "Open or present the provider step now. If browser/tool access is available, open the dashboard link for the user; otherwise show the exact step and copy values. Do not keep telling the user to verify until the provider step is done.",
-      executionPlan: [
-        { kind: "open-provider-step", note: "Use VIBERAVEN_PROVIDER_ACTION for the exact dashboard step and URL." },
-        { kind: "wait-for-user", note: "Wait for confirmation or read-only MCP evidence before verifying." }
-      ],
-      requiresUserAction: true
-    };
-  }
-  const upgradeTask = tasks.find((task) => task.fixType === "upgrade-required");
-  if (upgradeTask) {
-    return {
-      ...base,
-      type: "upgrade-required",
-      gapId: upgradeTask.gapId,
-      title: upgradeTask.title,
-      agentInstruction: "Explain that this production lane needs an upgrade or connected provider evidence. Continue with any remaining unlocked repo-code fixes if present; otherwise stop cleanly.",
-      executionPlan: [
-        { kind: "upgrade", command: "https://viberaven.dev/pricing" },
-        { kind: "stop", note: "Do not pretend locked lanes or provider state were fixed locally." }
-      ],
-      requiresUserAction: true,
-      upgradeUrl: "https://viberaven.dev/pricing"
-    };
-  }
-  return {
-    ...base,
-    type: "done",
-    title: "All gaps resolved - production gate is clear",
-    agentInstruction: "The repo-code gate is clear. Run strict before deploy and still verify provider dashboard state through MCP or the provider dashboard.",
-    executionPlan: [
-      { kind: "verify", command: "npx -y viberaven --strict" },
-      { kind: "stop", note: "Do not deploy until provider dashboard state is verified where applicable." }
-    ],
-    requiresUserAction: false
-  };
-}
-function resolveStallReason(tasks) {
-  if (tasks.length === 0) return "no-recipes";
-  const allUpgradeOrEmpty = tasks.every((task) => task.fixType === "upgrade-required");
-  if (allUpgradeOrEmpty) return "no-recipes";
-  const allProviderAction = tasks.every((task) => task.fixType === "provider-action");
-  if (allProviderAction) return "provider-action-required";
-  return "unknown";
-}
-function buildProviderActionBlock(task) {
-  if (task.fixType !== "provider-action" || !task.providerAction) {
-    return void 0;
-  }
-  const pa = task.providerAction;
-  return {
-    VIBERAVEN_PROVIDER_ACTION: {
-      gap: task.gapId,
-      provider: pa.provider,
-      dashboardUrl: pa.dashboardUrl,
-      exactStep: pa.exactStep,
-      envKeyName: pa.envKeyName ?? null,
-      envKeyExample: pa.envKeyExample ?? null,
-      doneSignal: pa.doneSignal,
-      verifyCommand: task.verifyCommand,
-      mcpAlternative: task.mcpTool ?? pa.mcpAlternative ?? null
-    }
-  };
-}
-function printProviderActionBlock(tasks) {
-  const task = tasks.find(
-    (entry) => entry.fixType === "provider-action" && entry.requiresUserAction === true
-  );
-  if (!task) return;
-  const block = buildProviderActionBlock(task);
-  if (!block) return;
-  console.log(PROVIDER_ACTION_START);
-  console.log(JSON.stringify(block, null, 2));
-  console.log(PROVIDER_ACTION_END);
-}
-function printNextActionBlock(block) {
-  console.log(NEXT_ACTION_START);
-  console.log(JSON.stringify(block, null, 2));
-  console.log(NEXT_ACTION_END);
-}
-var NEXT_ACTION_START, NEXT_ACTION_END, PROVIDER_ACTION_START, PROVIDER_ACTION_END;
-var init_nextActionBlock = __esm({
-  "src/output/nextActionBlock.ts"() {
-    "use strict";
-    NEXT_ACTION_START = "VIBERAVEN_NEXT_ACTION_START";
-    NEXT_ACTION_END = "VIBERAVEN_NEXT_ACTION_END";
-    PROVIDER_ACTION_START = "VIBERAVEN_PROVIDER_ACTION_START";
-    PROVIDER_ACTION_END = "VIBERAVEN_PROVIDER_ACTION_END";
-  }
-});
-
 // src/commands/preview.ts
-function previewArtifact(cwd) {
+function buildPreviewManifest() {
   return {
     version: 1,
-    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    workspacePath: cwd,
-    score: 42,
-    scoreLabel: "Blocked",
-    summary: "Vercel, Supabase, and Stripe are detected, but launch-critical provider setup is not proven yet.",
-    archetype: "ai-built-saas",
-    plan: "free",
-    productionCorePercent: 40,
-    usage: {
-      plan: "free",
-      remainingPrompts: 0,
-      used: 0,
-      limit: 0,
-      period: "lifetime",
-      unlockedMapCategoryKeys: ["appFlow", "frontend", "backend", "auth", "database", "payments"]
-    },
-    gaps: [
+    generatedAt: "2026-06-16T00:00:00.000Z",
+    workspaceRoot: ".",
+    gateStatus: "not_clear",
+    actions: [
       {
-        id: "auth_secret_missing",
-        category: "SECURITY & AUTH",
+        id: "VR-A1",
+        actionKey: "provider-action:stripe:stripe-webhook:/api/stripe/webhook:checkout.session.completed,customer.subscription.deleted,customer.subscription.updated",
+        revision: 1,
+        kind: "provider-action",
+        provider: "stripe",
+        title: "Connect Stripe Webhook",
+        status: "waiting-on-provider",
         severity: "critical",
-        title: "Create production auth secret",
-        detail: "The app needs a production session secret before real users sign in.",
-        copyPrompt: "Generate and document NEXTAUTH_SECRET or the equivalent auth secret for this stack.",
-        toolSuggestions: [],
-        mcpSuggestion: null,
-        primaryMapCategory: "auth",
-        affectedMapCategories: []
+        gapId: "stripe_webhook_secret_missing",
+        readiness: ["Webhook endpoint path detected", "Required events prepared"],
+        target: {
+          type: "provider",
+          provider: "stripe",
+          label: "Create Stripe webhook endpoint for /api/stripe/webhook."
+        },
+        copyPayloads: [
+          {
+            label: "Required webhook events",
+            format: "text",
+            value: [
+              "checkout.session.completed",
+              "customer.subscription.updated",
+              "customer.subscription.deleted"
+            ]
+          }
+        ],
+        verifyCommand: `${PUBLIC_COMMAND} verify --action VR-A1`,
+        resumeInstruction: "Stripe webhook is configured. Continue VibeRaven from VR-A1."
       },
       {
-        id: "rls_disabled",
-        category: "DATABASE & DATA",
+        id: "VR-A2",
+        actionKey: "repo-code:supabase:rls:supabase/migrations/20260615_rls.sql:user-owned-tables",
+        revision: 1,
+        kind: "repo-code",
+        provider: "supabase",
+        title: "Apply Supabase RLS",
+        status: "waiting-on-database-proof",
         severity: "critical",
-        title: "Verify Supabase RLS before launch",
-        detail: "Database access must be protected by Row Level Security or equivalent server-side controls.",
-        copyPrompt: "Open Supabase and verify RLS policies for user-owned tables.",
-        toolSuggestions: [],
-        mcpSuggestion: null,
-        primaryMapCategory: "database",
-        affectedMapCategories: []
+        gapId: "supabase_rls_policy_proof",
+        readiness: ["Affected tables detected", "Migration file target prepared"],
+        target: {
+          type: "file",
+          label: "RLS migration",
+          path: "supabase/migrations/20260615_rls.sql"
+        },
+        copyPayloads: [
+          {
+            label: "Tiny SQL shape",
+            format: "sql",
+            value: 'alter table public.example enable row level security;\ncreate policy "Users manage own rows" on public.example for all using (auth.uid() = user_id);'
+          }
+        ],
+        verifyCommand: `${PUBLIC_COMMAND} verify --action VR-A2`,
+        resumeInstruction: "Supabase RLS is applied. Continue VibeRaven from VR-A2."
       },
       {
-        id: "stripe_webhook_secret_missing",
-        category: "PAYMENTS",
-        severity: "critical",
-        title: "Connect Stripe webhook secret",
-        detail: "Stripe webhook signature verification needs STRIPE_WEBHOOK_SECRET before live payments.",
-        copyPrompt: "Create a Stripe webhook endpoint and add STRIPE_WEBHOOK_SECRET to the deployment environment.",
-        toolSuggestions: [],
-        mcpSuggestion: null,
-        primaryMapCategory: "payments",
-        affectedMapCategories: []
+        id: "VR-A3",
+        actionKey: "verify:gate:final:npx-y-viberaven-strict",
+        revision: 1,
+        kind: "verify",
+        title: "Run Final Verification",
+        status: "blocked",
+        severity: "warning",
+        readiness: ["Run after repo-code and provider actions are complete"],
+        target: {
+          type: "command",
+          label: "Strict gate",
+          command: `${PUBLIC_COMMAND} --strict`
+        },
+        resumeInstruction: "Final verification finished. Continue VibeRaven from VR-A3."
       }
-    ],
-    missionGraph: {
-      areas: [],
-      byArea: {},
-      byProvider: {},
-      repositoryEvidence: { env: [], security: [] }
-    },
-    stackWiring: { items: [], byKey: {} },
-    providerRegistry: {
-      version: 1,
-      source: "bundled",
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      status: "fresh",
-      staleAfterDays: 14,
-      providers: []
-    }
+    ]
   };
 }
-function check(done, text) {
-  const mark = done ? import_picocolors5.default.green("[x]") : import_picocolors5.default.yellow("[ ]");
-  return `  ${mark} ${text}`;
-}
 async function runPreviewCommand(options) {
-  const artifact = previewArtifact(options.cwd);
-  const tasks = buildTaskList(artifact);
-  const next = buildNextActionBlock(tasks, {
-    batchApplied: 1,
-    appliedGapIdsSinceScan: ["auth_secret_missing"],
-    lastGapCount: artifact.gaps.length,
-    stalledScans: 0
-  }, "free");
+  const manifest = buildPreviewManifest();
   if (options.json) {
-    console.log(JSON.stringify({ artifact, tasks, next }, null, 2));
+    console.log(JSON.stringify({ manifest }, null, 2));
     return 0;
   }
   console.log(import_picocolors5.default.dim(`VibeRaven ${VERSION} preview - local rehearsal, no login or API spend.`));
-  console.log(import_picocolors5.default.bold("VibeRaven"));
-  console.log("Taking this app from demo to production.");
-  console.log("");
-  console.log(`${import_picocolors5.default.bold("Status:")} ${import_picocolors5.default.red("BLOCKED")} | vercel + supabase + stripe | 3 launch gaps`);
+  console.log(import_picocolors5.default.dim("This is sample renderer data, not a production verdict for this repository."));
   console.log("");
-  console.log(import_picocolors5.default.bold("Progress"));
-  console.log(check(true, "Understand the stack and launch gaps"));
-  console.log(check(true, "Patch the first repo-owned secret gap"));
-  console.log(check(false, "Open Supabase and verify RLS policies"));
-  console.log(check(false, "Connect Stripe webhook signing secret"));
-  console.log(check(false, "Verify again before launch"));
-  console.log("");
-  console.log(import_picocolors5.default.bold("I can do now"));
-  console.log("  1. Add missing env names and agent rules.");
-  console.log("  2. Prepare focused repo fixes the coding agent can apply.");
-  console.log("  3. Keep the launch loop moving until provider proof is needed.");
-  console.log("");
-  console.log(import_picocolors5.default.bold("I need you for"));
-  console.log("  1. Supabase: open the project and confirm RLS policies.");
-  console.log("  2. Stripe: create or open the webhook endpoint.");
-  console.log("  3. Deployment: paste provider secrets into Vercel or your host.");
-  console.log("");
-  console.log(import_picocolors5.default.bold("Open"));
-  console.log(`  supabase: ${import_picocolors5.default.cyan("https://supabase.com/dashboard")}`);
-  console.log(`  stripe:   ${import_picocolors5.default.cyan("https://dashboard.stripe.com/")}`);
-  console.log("");
-  console.log(`${import_picocolors5.default.bold("Copy env names:")} NEXTAUTH_SECRET, STRIPE_WEBHOOK_SECRET`);
-  console.log(`${import_picocolors5.default.bold("Next:")} I will guide the blocked provider setup, then verify when you confirm it is done.`);
+  console.log(renderActionSurface(manifest, { limit: 3 }).trimEnd());
   if (options.agentMode) {
     console.log("");
-    console.log(import_picocolors5.default.dim("Agent note: render the checklist above as the live timeline; update [ ] to [x] as work completes."));
+    console.log(
+      import_picocolors5.default.dim(
+        "Agent note: treat each visible action as the next production action surface. Do not mark provider actions resolved until provider proof exists."
+      )
+    );
   }
   return 0;
 }
@@ -15931,8 +15747,8 @@ var init_preview = __esm({
   "src/commands/preview.ts"() {
     "use strict";
     import_picocolors5 = __toESM(require_picocolors());
-    init_buildTaskList();
-    init_nextActionBlock();
+    init_commands();
+    init_render();
     init_version();
   }
 });
@@ -17148,6 +16964,7 @@ const demo = {
   activeModal: null,
   activeStudioTab: 'chat',
   selectedCliId: 'codex',
+  agentPermissionMode: 'ask',
   cliConnected: false,
   cliSetupComplete: false,
   cliConnectTargetId: null,
@@ -17184,6 +17001,23 @@ const demo = {
   releaseChangelog: { entries: [], from: '', to: '', fromLabel: '', toLabel: '', loading: false, error: '' },
 };
 
+function readPermissionMode() {
+  try {
+    const raw = localStorage.getItem('viberaven:agentChatPermissionMode');
+    return raw === 'full-access' ? 'full-access' : 'ask';
+  } catch {
+    return 'ask';
+  }
+}
+
+function savePermissionMode(mode) {
+  try {
+    localStorage.setItem('viberaven:agentChatPermissionMode', mode);
+  } catch {
+    // Ignore storage failures in preview shells.
+  }
+}
+
 function readCliSessionReady() {
   try {
     let raw = localStorage.getItem('viberaven-cli-ready');
@@ -17206,6 +17040,7 @@ function writeCliSessionReady(value) {
 }
 
 demo.cliSessionReady = readCliSessionReady();
+demo.agentPermissionMode = readPermissionMode();
 
 function cliAgentInstalled(agent) {
   if (!agent) return false;
@@ -18563,6 +18398,7 @@ function runChatTask(kind, promptOverride) {
       prompt,
       displayPrompt: label,
       taskKind: kind,
+      permissionMode: demo.agentPermissionMode,
       provider: { area: provider.area, name: provider.name },
       release: release ? { label: release.label } : undefined
     })
@@ -19523,6 +19359,7 @@ function ModelPicker(index) {
     '<button type="button" data-action="toggle-reasoning" data-chat-index="' + String(index) + '"><span>Reasoning</span><strong>' + escapeHtml(chat.reasoning) + '</strong><i></i></button>' +
     '<button type="button" data-action="toggle-models" data-chat-index="' + String(index) + '"><span>Model</span><strong>' + escapeHtml(selectedModel) + '</strong><i></i></button>' +
     '<button type="button" data-action="toggle-context" data-chat-index="' + String(index) + '"><span>Context</span><strong>' + escapeHtml(chat.context) + '</strong><i></i></button>' +
+    PermissionModeToggle(index) +
     (scoped && demo.reasoningMenuOpen ? '<div class="vr-model-menu is-reasoning" role="menu"><p>Reasoning</p>' + reasoningLevels.map((level) =>
       '<button type="button" data-reasoning="' + escapeHtml(level) + '" data-chat-index="' + String(index) + '">' + escapeHtml(level) + (chat.reasoning === level ? '<b></b>' : '') + '</button>'
     ).join('') + '</div>' : '') +
@@ -19535,6 +19372,14 @@ function ModelPicker(index) {
     '</div>';
 }
 
+function PermissionModeToggle(index) {
+  const isFullAccess = demo.agentPermissionMode === 'full-access';
+  return '<div class="vr-permission-toggle" role="group" aria-label="Agent permission mode">' +
+    '<button type="button" class="vr-permission-btn' + (!isFullAccess ? ' is-active' : '') + '" data-permission-mode="ask" data-chat-index="' + String(index) + '" aria-pressed="' + String(!isFullAccess) + '" title="Ask for approval before each risky action">Ask each change</button>' +
+    '<button type="button" class="vr-permission-btn is-danger' + (isFullAccess ? ' is-active' : '') + '" data-permission-mode="full-access" data-chat-index="' + String(index) + '" aria-pressed="' + String(isFullAccess) + '" title="Run without per-action approval prompts \u2014 use with care">Full access</button>' +
+    '</div>';
+}
+
 function ChatBlockersSummary(cards) {
   const blockers = Array.isArray(cards.blockers) ? cards.blockers : [];
   const count = typeof cards.blockerCount === 'number' ? cards.blockerCount : blockers.length;
@@ -20561,6 +20406,24 @@ app.addEventListener('click', async (event) => {
     return;
   }
 
+  const permissionButton = event.target.closest('[data-permission-mode]');
+  if (permissionButton) {
+    event.preventDefault();
+    const mode = permissionButton.getAttribute('data-permission-mode');
+    demo.agentPermissionMode = mode === 'full-access' ? 'full-access' : 'ask';
+    savePermissionMode(demo.agentPermissionMode);
+    const chatIndex = Number(permissionButton.getAttribute('data-chat-index') || String(demo.pickerChatIndex || 0));
+    demo.pickerChatIndex = chatIndex;
+    demo.modelMenuOpen = false;
+    demo.reasoningMenuOpen = false;
+    demo.contextMenuOpen = false;
+    demo.notice = demo.agentPermissionMode === 'full-access'
+      ? 'Full access mode: agent runs without per-action approval prompts.'
+      : 'Ask mode: agent will request approval before each risky action.';
+    render();
+    return;
+  }
+
   const stageButton = event.target.closest('[data-stage-step]');
   if (stageButton) {
     const stage = stageButton.getAttribute('data-stage-step');
@@ -28190,6 +28053,46 @@ body:has(.vr-app.is-dragging) {
     display: none;
   }
 }
+.vr-permission-toggle {
+  display: inline-flex;
+  align-items: center;
+  gap: 0;
+  border: 1px solid rgba(148, 163, 184, 0.18);
+  border-radius: 8px;
+  overflow: hidden;
+  background: rgba(39, 40, 44, 0.92);
+}
+.vr-permission-btn {
+  min-height: 28px;
+  padding: 0 10px;
+  font-size: 11px;
+  font-weight: 640;
+  color: #94a3b8;
+  background: transparent;
+  border: none;
+  border-radius: 0;
+  cursor: pointer;
+  transition: background 0.12s, color 0.12s;
+  white-space: nowrap;
+}
+.vr-permission-btn + .vr-permission-btn {
+  border-left: 1px solid rgba(148, 163, 184, 0.14);
+}
+.vr-permission-btn.is-active {
+  background: rgba(100, 116, 139, 0.28);
+  color: #f1f5f9;
+}
+.vr-permission-btn.is-danger {
+  color: #f59e0b;
+}
+.vr-permission-btn.is-danger.is-active {
+  background: rgba(245, 158, 11, 0.18);
+  color: #fbbf24;
+}
+.vr-permission-btn:hover:not(.is-active) {
+  background: rgba(148, 163, 184, 0.1);
+  color: #e2e8f0;
+}
 `;
   }
 });
@@ -28801,6 +28704,8 @@ function parseAgentChatRequest(value) {
   if (!prompt) return { error: "Agent chat prompt is required" };
   const provider2 = isRecord7(value.provider) ? { area: stringField(value.provider.area, 120), name: stringField(value.provider.name, 120) } : void 0;
   const release = isRecord7(value.release) ? { label: stringField(value.release.label, 120) } : void 0;
+  const rawPermMode = stringField(value.permissionMode, 20);
+  const permissionMode = rawPermMode === "full-access" ? "full-access" : "ask";
   return {
     cliId: rawCliId,
     modelId: stringField(value.modelId, 120),
@@ -28809,6 +28714,7 @@ function parseAgentChatRequest(value) {
     prompt,
     displayPrompt: stringField(value.displayPrompt, 240),
     taskKind: stringField(value.taskKind, 40),
+    permissionMode,
     provider: provider2,
     release
   };
@@ -28900,13 +28806,24 @@ function insertCodexExecOptions(codexArgs, pairs) {
   const insertAt = execIndex >= 0 ? execIndex + 1 : codexArgs.length;
   codexArgs.splice(insertAt, 0, ...pairs);
 }
-function commandForAgentChat(request, prompt, cwd, outputPath) {
-  const command = process.platform === "win32" ? `${request.cliId}.cmd` : request.cliId;
+function resolveCodexSandboxArgs(permissionMode, platform) {
+  if (permissionMode === "full-access") {
+    return ["--sandbox", "danger-full-access", "--ask-for-approval", "never"];
+  }
+  if (platform === "win32") {
+    return ["--sandbox", "danger-full-access", "--ask-for-approval", "on-request"];
+  }
+  return ["--sandbox", "workspace-write", "--ask-for-approval", "on-request"];
+}
+function commandForAgentChat(request, prompt, cwd, outputPath, platform = process.platform) {
+  const command = platform === "win32" ? `${request.cliId}.cmd` : request.cliId;
   const promptArg = prompt.replace(/\s*\r?\n\s*/g, " ");
   const model = normalizeCliModelId(request.modelId);
   const effort = resolveCliReasoningEffort(request.cliId, request.reasoning);
+  const permissionMode = request.permissionMode ?? "ask";
   if (request.cliId === "gemini") {
-    const geminiArgs = ["-p", promptArg, "--output-format", "text", "--skip-trust"];
+    const geminiArgs = ["-p", promptArg, "--output-format", "text"];
+    if (permissionMode === "full-access") geminiArgs.push("--skip-trust");
     if (model) geminiArgs.splice(0, 0, "-m", model);
     return { command, args: geminiArgs };
   }
@@ -28914,12 +28831,13 @@ function commandForAgentChat(request, prompt, cwd, outputPath) {
     const claudeArgs = ["-p", promptArg];
     if (model) claudeArgs.unshift("--model", model);
     if (effort) claudeArgs.unshift("--effort", effort);
-    if (request.taskKind === "fix" || request.taskKind === "plan" || request.taskKind === "provider") {
+    if (permissionMode === "full-access") {
       claudeArgs.push("--dangerously-skip-permissions");
     }
     return { command, args: claudeArgs };
   }
-  const codexArgs = ["--cd", cwd, "--sandbox", "workspace-write", "--ask-for-approval", "never", "exec", "--color", "never"];
+  const sandboxArgs = resolveCodexSandboxArgs(permissionMode, platform);
+  const codexArgs = ["--cd", cwd, ...sandboxArgs, "exec", "--color", "never"];
   const codexExecOptions = [];
   if (model) codexExecOptions.push("-m", model);
   if (effort) codexExecOptions.push("-c", `model_reasoning_effort="${effort}"`);
@@ -29709,6 +29627,164 @@ var init_server = __esm({
   }
 });
 
+// src/output/nextActionBlock.ts
+function buildNextActionBlock(tasks, loopState, plan) {
+  const batchSize = plan === "pro" ? 10 : 3;
+  const batchApplied = loopState.batchApplied;
+  const remainingInBatch = batchSize - batchApplied;
+  const scanNow = batchApplied >= batchSize;
+  const stalled = loopState.stalledScans >= 2;
+  const stalledScans = loopState.stalledScans;
+  const base = { batchSize, batchApplied, remainingInBatch, scanNow, stalled, stalledScans };
+  if (stalled) {
+    const stallReason = resolveStallReason(tasks);
+    return {
+      ...base,
+      type: "stalled",
+      title: "Loop stalled - no gap reduction after 2+ consecutive scans",
+      agentInstruction: "Stop the scan loop. Explain the blocker plainly, then either guide the provider/user action or report that no safe repo-code recipe is available.",
+      executionPlan: [
+        { kind: "stop", note: "Do not keep spending scans while the loop is stalled." }
+      ],
+      requiresUserAction: true,
+      stallReason
+    };
+  }
+  if (scanNow) {
+    return {
+      ...base,
+      type: "verify",
+      title: "Batch complete - run verify to rescan before next batch",
+      agentInstruction: "Run verify now, read the refreshed VibeRaven artifacts, then continue with the next safe repo fix or provider step. Do not stop at a summary.",
+      executionPlan: [
+        { kind: "verify", command: "viberaven_verify" },
+        { kind: "continue-loop", note: "After verify, continue until the gate is clear or a provider/user blocker remains." }
+      ],
+      mcpTool: "viberaven_verify",
+      mcpArgs: {},
+      requiresUserAction: false
+    };
+  }
+  const repoCodeTask = tasks.find((task) => task.fixType === "repo-code" && !task.requiresUserAction);
+  if (repoCodeTask) {
+    const fallbackCommand = repoCodeTask.mcpArgs ? `npx -y viberaven --heal --apply --gap ${repoCodeTask.gapId} --yes` : void 0;
+    return {
+      ...base,
+      type: "repo-code",
+      gapId: repoCodeTask.gapId,
+      title: repoCodeTask.title,
+      agentInstruction: "Apply this repo-code fix now using the MCP tool or fallback command, then continue the local VibeRaven loop. Do not stop at a summary.",
+      executionPlan: [
+        {
+          kind: "apply-repo-fix",
+          command: repoCodeTask.mcpTool ?? fallbackCommand,
+          note: "Patch only this gap and preserve unrelated user changes."
+        },
+        { kind: "continue-loop", note: "Apply remaining safe repo fixes until the batch is full, then verify once." }
+      ],
+      mcpTool: repoCodeTask.mcpTool,
+      mcpArgs: repoCodeTask.mcpArgs,
+      fallbackCommand,
+      requiresUserAction: false
+    };
+  }
+  const providerTask = tasks.find((task) => task.fixType === "provider-action");
+  if (providerTask) {
+    return {
+      ...base,
+      type: "provider-action",
+      gapId: providerTask.gapId,
+      title: providerTask.title,
+      agentInstruction: "Open or present the provider step now. If browser/tool access is available, open the dashboard link for the user; otherwise show the exact step and copy values. Do not keep telling the user to verify until the provider step is done.",
+      executionPlan: [
+        { kind: "open-provider-step", note: "Use VIBERAVEN_PROVIDER_ACTION for the exact dashboard step and URL." },
+        { kind: "wait-for-user", note: "Wait for confirmation or read-only MCP evidence before verifying." }
+      ],
+      requiresUserAction: true
+    };
+  }
+  const upgradeTask = tasks.find((task) => task.fixType === "upgrade-required");
+  if (upgradeTask) {
+    return {
+      ...base,
+      type: "upgrade-required",
+      gapId: upgradeTask.gapId,
+      title: upgradeTask.title,
+      agentInstruction: "Explain that this production lane needs an upgrade or connected provider evidence. Continue with any remaining unlocked repo-code fixes if present; otherwise stop cleanly.",
+      executionPlan: [
+        { kind: "upgrade", command: "https://viberaven.dev/pricing" },
+        { kind: "stop", note: "Do not pretend locked lanes or provider state were fixed locally." }
+      ],
+      requiresUserAction: true,
+      upgradeUrl: "https://viberaven.dev/pricing"
+    };
+  }
+  return {
+    ...base,
+    type: "done",
+    title: "All gaps resolved - production gate is clear",
+    agentInstruction: "The repo-code gate is clear. Run strict before deploy and still verify provider dashboard state through MCP or the provider dashboard.",
+    executionPlan: [
+      { kind: "verify", command: "npx -y viberaven --strict" },
+      { kind: "stop", note: "Do not deploy until provider dashboard state is verified where applicable." }
+    ],
+    requiresUserAction: false
+  };
+}
+function resolveStallReason(tasks) {
+  if (tasks.length === 0) return "no-recipes";
+  const allUpgradeOrEmpty = tasks.every((task) => task.fixType === "upgrade-required");
+  if (allUpgradeOrEmpty) return "no-recipes";
+  const allProviderAction = tasks.every((task) => task.fixType === "provider-action");
+  if (allProviderAction) return "provider-action-required";
+  return "unknown";
+}
+function buildProviderActionBlock(task) {
+  if (task.fixType !== "provider-action" || !task.providerAction) {
+    return void 0;
+  }
+  const pa = task.providerAction;
+  return {
+    VIBERAVEN_PROVIDER_ACTION: {
+      gap: task.gapId,
+      provider: pa.provider,
+      dashboardUrl: pa.dashboardUrl,
+      exactStep: pa.exactStep,
+      envKeyName: pa.envKeyName ?? null,
+      envKeyExample: pa.envKeyExample ?? null,
+      doneSignal: pa.doneSignal,
+      verifyCommand: task.verifyCommand,
+      mcpAlternative: task.mcpTool ?? pa.mcpAlternative ?? null
+    }
+  };
+}
+function printProviderActionBlock(tasks) {
+  const task = tasks.find(
+    (entry) => entry.fixType === "provider-action" && entry.requiresUserAction === true
+  );
+  if (!task) return;
+  const block = buildProviderActionBlock(task);
+  if (!block) return;
+  console.log(PROVIDER_ACTION_START);
+  console.log(JSON.stringify(block, null, 2));
+  console.log(PROVIDER_ACTION_END);
+}
+function printNextActionBlock(block) {
+  console.log(NEXT_ACTION_START);
+  console.log(JSON.stringify(block, null, 2));
+  console.log(NEXT_ACTION_END);
+}
+var NEXT_ACTION_START, NEXT_ACTION_END, PROVIDER_ACTION_START, PROVIDER_ACTION_END;
+var init_nextActionBlock = __esm({
+  "src/output/nextActionBlock.ts"() {
+    "use strict";
+    NEXT_ACTION_START = "VIBERAVEN_NEXT_ACTION_START";
+    NEXT_ACTION_END = "VIBERAVEN_NEXT_ACTION_END";
+    PROVIDER_ACTION_START = "VIBERAVEN_PROVIDER_ACTION_START";
+    PROVIDER_ACTION_END = "VIBERAVEN_PROVIDER_ACTION_END";
+  }
+});
+
 // src/providerMcpBridge.ts
 function defaultMcpConfigPaths() {
   const home = (0, import_node_os2.homedir)();
@@ -30055,8 +30131,8 @@ async function cmdLogout() {
 }
 async function cmdProviderVerify(flags, positional) {
   const provider2 = typeof flags.provider === "string" ? flags.provider : positional[0];
-  const check2 = typeof flags.check === "string" ? flags.check : positional[1];
-  if (!provider2 || !check2) {
+  const check = typeof flags.check === "string" ? flags.check : positional[1];
+  if (!provider2 || !check) {
     console.error("Usage: viberaven provider-verify --provider <supabase|vercel> --check <id> [--plan free|pro]");
     return 1;
   }
@@ -30069,7 +30145,7 @@ async function cmdProviderVerify(flags, positional) {
   }
   const result = await verifyProviderGap({
     provider: provider2,
-    check: check2,
+    check,
     cwd: process.cwd(),
     plan
   });