@viberaven/cli 1.5.2 → 1.5.3

package/dist/cli.js

@@ -10605,6 +10605,25 @@ function assessStripeWebhooks(files) {
   }
   return { verified: verified.sort(), unverified: unverified.sort((a, b3) => a.path < b3.path ? -1 : 1) };
 }
+function stripeUsageEvidence(scan, files) {
+  const dependency = (scan.packageDeps ?? []).find((dep) => {
+    const name = dep.toLowerCase();
+    return name === "stripe" || name.startsWith("@stripe/");
+  });
+  if (dependency) return { kind: "dependency", dependency };
+  const sorted = [...files].sort((a, b3) => a.path < b3.path ? -1 : 1);
+  for (const file of sorted) {
+    const path = file.path.replace(/\\/g, "/");
+    if (!CODE_FILE.test(path) || TEST_FILE.test(path)) continue;
+    const match = stripComments2(file.content).match(STRIPE_CODE_USE);
+    if (match) return { kind: "code", path, signal: match[0] };
+  }
+  return void 0;
+}
+function stripeCodeOnlyInEdgeFunctions(files) {
+  const users = files.map((file) => ({ path: file.path.replace(/\\/g, "/"), content: file.content })).filter((file) => CODE_FILE.test(file.path) && !TEST_FILE.test(file.path) && STRIPE_CODE_USE.test(stripComments2(file.content)));
+  return users.length > 0 && users.every((file) => /(^|\/)supabase\/functions\//.test(file.path));
+}
 function codeFilesFor(scan, fullCopies = []) {
   const full = new Map(fullCopies.map((f) => [f.path.replace(/\\/g, "/"), f.content]));
   const merged = /* @__PURE__ */ new Map();
@@ -10891,7 +10910,8 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
     });
   }
   if (signals.hasStripe) {
-    const webhooks = assessStripeWebhooks(codeFilesFor(scan, extra.codeFiles));
+    const stripeFiles = codeFilesFor(scan, extra.codeFiles);
+    const webhooks = assessStripeWebhooks(stripeFiles);
     if (webhooks.unverified.length > 0) {
       const lines = webhooks.unverified.map((u2) => `${u2.path} (${u2.missing.join(", ")})`);
       seeds.push({
@@ -10904,15 +10924,20 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
         primaryMapCategory: "payments"
       });
     } else if (webhooks.verified.length === 0) {
-      seeds.push({
-        id: "missing_stripe_webhook",
-        category: "MISSING FEATURES",
-        severity: "warning",
-        title: "Stripe installed but no webhook handler",
-        detail: "Stripe is a dependency but no webhook route or signature verification (constructEvent) was found. Payment state will silently drift from app state.",
-        copyPrompt: "Add a Stripe webhook route (e.g. app/api/webhooks/stripe/route.ts) that verifies the signature with stripe.webhooks.constructEvent and handles checkout.session.completed plus subscription lifecycle events.",
-        primaryMapCategory: "payments"
-      });
+      const usage = stripeUsageEvidence(scan, stripeFiles);
+      if (usage) {
+        const seen = usage.kind === "dependency" ? `package.json lists ${usage.dependency}` : `${usage.path} uses Stripe (${usage.signal}) and package.json does not list stripe`;
+        seeds.push({
+          id: "missing_stripe_webhook",
+          category: "MISSING FEATURES",
+          severity: "warning",
+          title: usage.kind === "dependency" ? "Stripe installed but no webhook handler" : "Stripe used but no webhook handler",
+          detail: `${seen}, but no webhook route or signature verification (constructEvent) was found. Payment state will silently drift from app state.`,
+          // Stripe code that only runs in Supabase Edge Functions is verified there, on Deno, not in a Next.js route.
+          copyPrompt: stripeCodeOnlyInEdgeFunctions(stripeFiles) ? STRIPE_EDGE_WEBHOOK_PROMPT : (usage.kind === "code" ? "Add the stripe package, then add" : "Add") + " a Stripe webhook route (e.g. app/api/webhooks/stripe/route.ts) that verifies the signature with stripe.webhooks.constructEvent and handles checkout.session.completed plus subscription lifecycle events.",
+          primaryMapCategory: "payments"
+        });
+      }
     }
   }
   {
@@ -11112,7 +11137,7 @@ async function buildLocalStationOutput(input) {
     productionChecklist: checklistFrom(seeds)
   };
 }
-var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
+var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, STRIPE_CODE_USE, STRIPE_EDGE_WEBHOOK_PROMPT, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
 var init_localStation = __esm({
   "src/localStation.ts"() {
     "use strict";
@@ -11204,6 +11229,8 @@ var init_localStation = __esm({
     STRIPE_EVENT_TYPE = /['"`](?:checkout\.session|customer\.subscription|invoice|payment_intent|charge)\.[a-z_.]+['"`]/;
     REQUEST_HANDLER = /export\s+(?:async\s+)?function\s+POST\b|export\s+const\s+POST\b|export\s+default\s+(?:async\s+)?function\s*[\w$]*\s*\(\s*(?:req|request)\b|export\s+(?:async\s+function|function|const)\s+handler\b|\b[A-Za-z_$][\w$]*\.post\s*\(|Deno\.serve\s*\(|\bserve\s*\(|addEventListener\(\s*['"]fetch|export\s+default\s*\{\s*(?:async\s+)?fetch\b/;
     TEST_FILE = /(^|\/)(?:__tests__|__mocks__)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/i;
+    STRIPE_CODE_USE = /\bSTRIPE_(?:SECRET_KEY|WEBHOOK_SECRET)\b|\bapi\.stripe\.com\b|\bfrom\s*['"](?:npm:)?stripe(?:@[^'"]*)?['"]|\brequire\(\s*['"]stripe['"]\s*\)|\bimport\(\s*['"](?:npm:)?stripe(?:@[^'"]*)?['"]\s*\)/;
+    STRIPE_EDGE_WEBHOOK_PROMPT = "In the Supabase Edge Function that receives Stripe events (add one under supabase/functions/ if there is none, e.g. supabase/functions/stripe-webhook/index.ts), read the raw body with await req.text(), read the Stripe-Signature header, and verify both with await stripe.webhooks.constructEventAsync(body, signature, Deno.env.get('STRIPE_WEBHOOK_SECRET'), undefined, Stripe.createSubtleCryptoProvider()) before trusting event.type. Return 400 when verification throws, and handle checkout.session.completed plus subscription lifecycle events.";
     AUDIT_FINDING_GAPS = {
       rls_policy_allows_all_write: {
         title: "A policy lets anyone write every row",
@@ -12391,7 +12418,81 @@ var init_agentSummary = __esm({
   }
 });
 
+// src/heal/rlsMigrationTarget.ts
+function rlsEnableStatements(tables) {
+  return [...new Set(tables)].map((table) => `alter table ${table} enable row level security;`);
+}
+function migrationStamp(now) {
+  return now.toISOString().replace(/\D/g, "").slice(0, 14);
+}
+function rlsMigrationTarget(cwd, evidence, now = /* @__PURE__ */ new Date()) {
+  if (evidence.length === 0) return { ok: false, reason: "No table without row level security was found in the repo SQL." };
+  const statementList = rlsEnableStatements(evidence.map((entry) => entry.table)).join(" ");
+  const turnedOff = evidence.filter((entry) => entry.turnedOff);
+  if (turnedOff.length > 0) {
+    const where = turnedOff.map((entry) => `${entry.table} (${entry.file.replace(/\\/g, "/")})`).join(", ");
+    return {
+      ok: false,
+      reason: `The latest migration that touches ${where} turns row level security off on purpose, so VibeRaven will not turn it back on automatically. If the user wants it on, add these statements by hand in a new migration, with the policies the app needs: ${statementList}`
+    };
+  }
+  const source = evidence[0].file.replace(/\\/g, "/");
+  const dir = import_node_path11.posix.dirname(source);
+  if (import_node_path11.posix.basename(dir) !== "migrations") {
+    return {
+      ok: false,
+      reason: `The tables come from ${source}, which is not in a migrations folder, so VibeRaven will not guess where a migration goes. Add these statements by hand where this project keeps its schema: ${statementList}`
+    };
+  }
+  let existing;
+  try {
+    existing = (0, import_node_fs6.readdirSync)((0, import_node_path11.join)(cwd, dir)).filter((file) => file.endsWith(".sql")).sort();
+  } catch {
+    return { ok: false, reason: `VibeRaven could not read ${dir}. Add these statements by hand in a new migration: ${statementList}` };
+  }
+  const otherNaming = existing.find((file) => !TIMESTAMPED_MIGRATION.test(file));
+  if (otherNaming) {
+    return {
+      ok: false,
+      reason: `The migrations in ${dir} are not named <14-digit timestamp>_name.sql (for example ${otherNaming}), so a timestamped file from VibeRaven could run in the wrong order next to them. Add these statements by hand in a new migration that follows this project's naming: ${statementList}`
+    };
+  }
+  const name = `${migrationStamp(now)}_viberaven_enable_rls.sql`;
+  const last = existing[existing.length - 1];
+  if (last && name <= last) {
+    return {
+      ok: false,
+      reason: `A new migration named ${name} would not run after ${last} in ${dir}, so VibeRaven will not write it. Add these statements by hand in a migration that runs last: ${statementList}`
+    };
+  }
+  return { ok: true, file: `${dir}/${name}` };
+}
+var import_node_fs6, import_node_path11, RLS_TURNED_OFF_PHRASE, RLS_ASK_FIRST, RLS_NO_POLICIES_WARNING, TIMESTAMPED_MIGRATION;
+var init_rlsMigrationTarget = __esm({
+  "src/heal/rlsMigrationTarget.ts"() {
+    "use strict";
+    import_node_fs6 = require("node:fs");
+    import_node_path11 = require("node:path");
+    RLS_TURNED_OFF_PHRASE = "has row level security turned off at";
+    RLS_ASK_FIRST = "Ask the user first: enabling RLS without policies makes browser reads return no rows until policies exist.";
+    RLS_NO_POLICIES_WARNING = "This migration enables row level security with no policies. Until you add policies, the anon and authenticated roles get no rows from these tables through the Data API, so browser reads return nothing and browser writes fail. `check` then reports the tables only as info (rls_no_policies), not as a blocker. Add the policies the app needs before you apply the migration to the database.";
+    TIMESTAMPED_MIGRATION = /^\d{14}_.+\.sql$/;
+  }
+});
+
 // src/buildTaskList.ts
+function rlsMigrationFile(gap) {
+  if (gap.id !== "rls_disabled" || typeof gap.detail !== "string") return void 0;
+  const evidence = gap.detail.split(/\r?\nEvidence:\r?\n/)[1];
+  if (!evidence) return void 0;
+  return evidence.match(/^- ([^\s:][^:\n]*\.sql):\d+: /m)?.[1];
+}
+function rlsEvidence2(detail) {
+  const evidence = detail.split(/\r?\nEvidence:\r?\n/)[1] ?? "";
+  return [...evidence.matchAll(/^- ([^\s:][^:\n]*\.sql):\d+: (\S+) (is created at|has row level security turned off at|is moved into public)/gm)].map(
+    (match) => ({ file: match[1], table: match[2], turnedOff: match[3] === RLS_TURNED_OFF_PHRASE })
+  );
+}
 function hasRecipe(gapId) {
   if (KNOWN_RECIPE_GAP_IDS.has(gapId)) return true;
   const lower = gapId.toLowerCase();
@@ -12445,7 +12546,8 @@ function buildTaskList(artifact) {
   return sorted.map((gap, index) => {
     const id = `TASK-${String(index + 1).padStart(3, "0")}`;
     let fixType;
-    if (hasRecipe(gap.id)) {
+    const migrationFile = rlsMigrationFile(gap);
+    if (hasRecipe(gap.id) || migrationFile) {
       fixType = "repo-code";
     } else if (hasPlaybook(gap)) {
       fixType = "provider-action";
@@ -12461,7 +12563,21 @@ function buildTaskList(artifact) {
       verifyCommand: PUBLIC_VERIFY_COMMAND,
       requiresUserAction: fixType !== "repo-code"
     };
-    if (fixType === "repo-code") {
+    if (fixType === "repo-code" && !hasRecipe(gap.id) && migrationFile) {
+      base.requiresUserAction = true;
+      base.file = migrationFile;
+      const target = rlsMigrationTarget(artifact.workspacePath, rlsEvidence2(gap.detail));
+      if (target.ok) {
+        base.mcpTool = "viberaven_heal_apply";
+        base.mcpArgs = { gap: gap.id };
+        base.action = `${RLS_ASK_FIRST} If they agree, \`npx -y viberaven fix --gap rls_disabled\` writes it: a new migration next to this one that enables row level security on each table listed in the gap detail. It adds no policies: add the ones the app needs, then apply the migration to the database the way this project applies migrations.`;
+      } else {
+        base.action = `${RLS_ASK_FIRST} ${target.reason} Add the policies the app needs too, then apply the change to the database the way this project applies schema changes.`;
+      }
+      if (gap.copyPrompt) {
+        base.exactFix = gap.copyPrompt.trim();
+      }
+    } else if (fixType === "repo-code") {
       base.mcpTool = "viberaven_heal_apply";
       base.mcpArgs = { gap: gap.id, yes: true };
       base.requiresUserAction = false;
@@ -12534,6 +12650,7 @@ var init_buildTaskList = __esm({
   "src/buildTaskList.ts"() {
     "use strict";
     init_commands();
+    init_rlsMigrationTarget();
     init_loadPlaybook();
     init_types2();
     init_menu();
@@ -12555,8 +12672,9 @@ var init_buildTaskList = __esm({
       "missing_csp_header",
       "missing_rate_limit",
       "eslint_restricted_imports"
-      // NOTE: 'rls_disabled' is intentionally NOT here — it is provider-action only,
-      // canAutoApply=false, and should be classified as 'provider-action' by buildTaskList.
+      // NOTE: 'rls_disabled' is intentionally NOT here. When the finding comes from repo SQL it is a repo action whose
+      // recipe writes a new migration (see rlsMigrationFile and heal/recipes/supabaseRls.ts); without SQL evidence it
+      // stays a provider action and heal refuses.
     ]);
   }
 });
@@ -12933,25 +13051,25 @@ var init_reportHtml = __esm({
 function getBundledReportAssetsDir() {
   const base = __dirname;
   const candidates = [
-    (0, import_node_path11.join)(base, "report"),
-    (0, import_node_path11.join)(base, "..", "assets", "report"),
-    (0, import_node_path11.join)(base, "..", "..", "assets", "report"),
-    (0, import_node_path11.join)(process.cwd(), "packages", "cli", "assets", "report"),
-    (0, import_node_path11.join)(process.cwd(), "assets", "report")
+    (0, import_node_path12.join)(base, "report"),
+    (0, import_node_path12.join)(base, "..", "assets", "report"),
+    (0, import_node_path12.join)(base, "..", "..", "assets", "report"),
+    (0, import_node_path12.join)(process.cwd(), "packages", "cli", "assets", "report"),
+    (0, import_node_path12.join)(process.cwd(), "assets", "report")
   ];
   for (const dir of candidates) {
-    if ((0, import_node_fs6.existsSync)((0, import_node_path11.join)(dir, "station.css"))) {
+    if ((0, import_node_fs7.existsSync)((0, import_node_path12.join)(dir, "station.css"))) {
       return dir;
     }
   }
   throw new Error("Report assets missing. Run `npm run sync-report-assets` and `npm run build` in packages/cli.");
 }
-var import_node_fs6, import_node_path11, REPORT_ASSET_FILES;
+var import_node_fs7, import_node_path12, REPORT_ASSET_FILES;
 var init_reportAssets = __esm({
   "src/report/reportAssets.ts"() {
     "use strict";
-    import_node_fs6 = require("node:fs");
-    import_node_path11 = require("node:path");
+    import_node_fs7 = require("node:fs");
+    import_node_path12 = require("node:path");
     REPORT_ASSET_FILES = [
       "station.css",
       "station.js",
@@ -13067,7 +13185,7 @@ var init_canonical = __esm({
 
 // src/actions/derive.ts
 function verifyActionCommand(id) {
-  return `${PUBLIC_COMMAND} verify --action ${id}`;
+  return `${PUBLIC_COMMAND} --verify --action ${id}`;
 }
 function providerTitle(task) {
   const provider2 = task.providerAction?.provider.toLowerCase();
@@ -13113,7 +13231,11 @@ function deriveProviderAction(task) {
     resumeInstruction: `${title} is complete. Continue VibeRaven from pending.`
   };
 }
+function askFirstSentence(task) {
+  return task.requiresUserAction ? task.action?.match(/^Ask the user first: [^.]+\./)?.[0] : void 0;
+}
 function deriveRepoCodeAction(task) {
+  const askFirst = askFirstSentence(task);
   const targetSource = task.file ?? task.gapId;
   const canonicalFile = normalizeActionPath(targetSource);
   const displayFile = displayRepoPath(targetSource);
@@ -13133,14 +13255,17 @@ function deriveRepoCodeAction(task) {
     status: "active",
     severity: task.severity,
     gapId: task.gapId,
-    readiness: [task.exactFix ?? "Repo-code fix is available"],
+    readiness: [...askFirst ? [askFirst] : [], task.exactFix ?? "Repo-code fix is available"],
     target: task.file ? { type: "file", label: "Repo target", path: displayFile } : { type: "command", label: "Apply repo fix", command: task.mcpTool ?? `${PUBLIC_COMMAND} prompt --gap ${task.gapId}` },
     fileTargets: task.file ? [{ path: displayFile, reason: task.exactFix }] : void 0,
     verifyCommand: verifyActionCommand("pending"),
     resumeInstruction: `${task.title} is complete. Continue VibeRaven from pending.`,
     mcpTool: task.mcpTool,
     mcpArgs: task.mcpArgs,
-    fallbackCommand: `${PUBLIC_COMMAND} --heal --apply --gap ${task.gapId} --yes`
+    // Only a gap with an automatic recipe has a heal-apply fallback, and a task that needs the user's yes keeps it
+    // only alongside that signal.
+    fallbackCommand: task.mcpTool === "viberaven_heal_apply" && (!task.requiresUserAction || askFirst) ? `${PUBLIC_COMMAND} --heal --apply --gap ${task.gapId} --yes` : void 0,
+    ...task.requiresUserAction ? { requiresUserAction: true } : {}
   };
 }
 function deriveVerifyAction() {
@@ -13179,7 +13304,7 @@ function emptyActionRegistry() {
   return { version: 1, nextId: 1, actions: {} };
 }
 function actionRegistryPath(cwd) {
-  return (0, import_node_path12.join)(getProjectArtifactsDir(cwd), "action-registry.json");
+  return (0, import_node_path13.join)(getProjectArtifactsDir(cwd), "action-registry.json");
 }
 async function loadActionRegistry(cwd) {
   try {
@@ -13287,12 +13412,12 @@ async function resolveActionById(cwd, id) {
   const registry = await loadActionRegistry(cwd);
   return Object.values(registry.actions).find((entry) => entry.id === id);
 }
-var import_promises9, import_node_path12;
+var import_promises9, import_node_path13;
 var init_registry2 = __esm({
   "src/actions/registry.ts"() {
     "use strict";
     import_promises9 = require("node:fs/promises");
-    import_node_path12 = require("node:path");
+    import_node_path13 = require("node:path");
     init_config();
     init_canonical();
   }
@@ -13324,7 +13449,7 @@ async function writeActionArtifacts(input) {
     gateStatus: gateStatus2(input.artifact),
     actions: assigned.actions
   };
-  const actionsPath = (0, import_node_path13.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path14.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   await (0, import_promises10.writeFile)(actionsPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   return {
@@ -13333,12 +13458,12 @@ async function writeActionArtifacts(input) {
     manifest
   };
 }
-var import_promises10, import_node_path13;
+var import_promises10, import_node_path14;
 var init_artifacts = __esm({
   "src/actions/artifacts.ts"() {
     "use strict";
     import_promises10 = require("node:fs/promises");
-    import_node_path13 = require("node:path");
+    import_node_path14 = require("node:path");
     init_config();
     init_derive();
     init_registry2();
@@ -13348,24 +13473,24 @@ var init_artifacts = __esm({
 // src/artifacts.ts
 async function copyReportAssets(reportAssetsDir) {
   const sourceDir = getBundledReportAssetsDir();
-  await (0, import_promises11.mkdir)((0, import_node_path14.join)(reportAssetsDir, "assets"), { recursive: true });
+  await (0, import_promises11.mkdir)((0, import_node_path15.join)(reportAssetsDir, "assets"), { recursive: true });
   for (const rel of REPORT_ASSET_FILES) {
-    await (0, import_promises11.copyFile)((0, import_node_path14.join)(sourceDir, rel), (0, import_node_path14.join)(reportAssetsDir, rel));
+    await (0, import_promises11.copyFile)((0, import_node_path15.join)(sourceDir, rel), (0, import_node_path15.join)(reportAssetsDir, rel));
   }
 }
 async function writeScanArtifacts(options) {
   const cwd = options.cwd ?? options.artifact.workspacePath;
   const dir = getProjectArtifactsDir(cwd);
   await (0, import_promises11.mkdir)(dir, { recursive: true });
-  const jsonPath = (0, import_node_path14.join)(dir, "last-scan.json");
-  const gateResultPath = (0, import_node_path14.join)(dir, "gate-result.json");
-  const contextMapPath = (0, import_node_path14.join)(dir, "context-map.json");
-  const gapsDir = (0, import_node_path14.join)(dir, "gaps");
-  const tasklistPath = (0, import_node_path14.join)(dir, "agent-tasklist.md");
-  const summaryPath = (0, import_node_path14.join)(dir, "agent-summary.md");
-  const playbookPath = (0, import_node_path14.join)(dir, "launch-playbook.md");
-  const reportPath = (0, import_node_path14.join)(dir, "report.html");
-  const reportAssetsDir = (0, import_node_path14.join)(dir, "report");
+  const jsonPath = (0, import_node_path15.join)(dir, "last-scan.json");
+  const gateResultPath = (0, import_node_path15.join)(dir, "gate-result.json");
+  const contextMapPath = (0, import_node_path15.join)(dir, "context-map.json");
+  const gapsDir = (0, import_node_path15.join)(dir, "gaps");
+  const tasklistPath = (0, import_node_path15.join)(dir, "agent-tasklist.md");
+  const summaryPath = (0, import_node_path15.join)(dir, "agent-summary.md");
+  const playbookPath = (0, import_node_path15.join)(dir, "launch-playbook.md");
+  const reportPath = (0, import_node_path15.join)(dir, "report.html");
+  const reportAssetsDir = (0, import_node_path15.join)(dir, "report");
   await (0, import_promises11.mkdir)(gapsDir, { recursive: true });
   const safe2 = sanitizeArtifactForDisk(options.artifact);
   const json = `${JSON.stringify(safe2, null, 2)}
@@ -13384,17 +13509,17 @@ async function writeScanArtifacts(options) {
   await (0, import_promises11.writeFile)(gateResultPath, gateResult, "utf-8");
   await (0, import_promises11.writeFile)(contextMapPath, contextMap, "utf-8");
   for (const gap of gapEvidenceFiles) {
-    await (0, import_promises11.writeFile)((0, import_node_path14.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path15.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
 `, "utf-8");
   }
   await (0, import_promises11.writeFile)(tasklistPath, tasklist, "utf-8");
   let architectureMapPath;
   if (typeof safe2.architectureMap === "string" && safe2.architectureMap.length > 0) {
-    architectureMapPath = (0, import_node_path14.join)(dir, "architecture-map.md");
+    architectureMapPath = (0, import_node_path15.join)(dir, "architecture-map.md");
     await (0, import_promises11.writeFile)(architectureMapPath, safe2.architectureMap, "utf-8");
   }
   if (safe2.architectureData) {
-    await (0, import_promises11.writeFile)((0, import_node_path14.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path15.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
 `, "utf-8");
   }
   await (0, import_promises11.writeFile)(jsonPath, json, "utf-8");
@@ -13423,12 +13548,12 @@ async function writeScanArtifacts(options) {
     ...architectureMapPath ? { architectureMapPath } : {}
   };
 }
-var import_promises11, import_node_path14;
+var import_promises11, import_node_path15;
 var init_artifacts2 = __esm({
   "src/artifacts.ts"() {
     "use strict";
     import_promises11 = require("node:fs/promises");
-    import_node_path14 = require("node:path");
+    import_node_path15 = require("node:path");
     init_contextMap();
     init_gateResult();
     init_gapEvidence();
@@ -13537,12 +13662,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
   ];
   if (platform === "win32") {
     const candidates = [
-      env.LOCALAPPDATA ? (0, import_node_path15.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path15.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path15.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.LOCALAPPDATA ? (0, import_node_path15.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path15.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path15.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path16.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path16.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path16.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path16.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path16.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path16.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
       "chrome",
       "msedge"
     ].filter(Boolean);
@@ -13576,7 +13701,7 @@ async function openWithSystemDefault(target) {
   });
 }
 async function spawnDetached(command) {
-  if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs7.existsSync)(command.command)) {
+  if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs8.existsSync)(command.command)) {
     throw new Error(`Browser not found: ${command.command}`);
   }
   await new Promise((resolve9, reject) => {
@@ -13619,13 +13744,13 @@ async function openUrlInBrowser(url) {
   }
   await openWithSystemDefault(trimmed);
 }
-var import_node_child_process4, import_node_fs7, import_node_path15;
+var import_node_child_process4, import_node_fs8, import_node_path16;
 var init_openBrowser = __esm({
   "src/openBrowser.ts"() {
     "use strict";
     import_node_child_process4 = require("node:child_process");
-    import_node_fs7 = require("node:fs");
-    import_node_path15 = require("node:path");
+    import_node_fs8 = require("node:fs");
+    import_node_path16 = require("node:path");
   }
 });
 
@@ -14530,15 +14655,13 @@ function buildAgentFixPrompt(artifact, gap) {
     "",
     "Required workflow:",
     "1. Read `.viberaven/agent-summary.md` and `.viberaven/launch-playbook.md` before changing code.",
-    '2. If VibeRaven prints LOGIN_URL_READY, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets.',
-    "3. If the browser cannot open automatically, use the printed LOGIN_URL_READY URL. Keep the terminal process alive while the user approves.",
-    "4. Inspect the real implementation files. Do not assume framework/provider wiring from package names alone.",
-    "5. Make the smallest durable repo-code change that addresses this specific gap.",
-    "6. Keep provider dashboard work separate. Open provider dashboards only when VibeRaven asks for a provider/manual action, and explain why you opened them.",
-    `7. For Vercel + Supabase apps, run \`${PUBLIC_AUDIT_COMMAND}\` before claiming production readiness.`,
-    "8. Treat that audit as local repo evidence only; do not claim provider dashboard settings are fixed unless the user verifies them or read-only provider MCP confirms them.",
-    "9. Do not claim provider dashboard or read-only MCP checks as repo-code fixes.",
-    `10. VibeRaven cleanup is non-destructive. You may run \`${PUBLIC_CLEAN_PLAN_COMMAND}\` only to create a reviewable context cleanup plan, not to delete code.`,
+    "2. Inspect the real implementation files. Do not assume framework/provider wiring from package names alone.",
+    "3. Make the smallest durable repo-code change that addresses this specific gap.",
+    "4. Keep provider dashboard work separate. Open provider dashboards only when VibeRaven asks for a provider/manual action, and explain why you opened them.",
+    `5. For Vercel + Supabase apps, run \`${PUBLIC_AUDIT_COMMAND}\` before claiming production readiness.`,
+    "6. Treat that audit as local repo evidence only; do not claim provider dashboard settings are fixed unless the user verifies them or read-only provider MCP confirms them.",
+    "7. Do not claim provider dashboard or read-only MCP checks as repo-code fixes.",
+    `8. VibeRaven cleanup is non-destructive. You may run \`${PUBLIC_CLEAN_PLAN_COMMAND}\` only to create a reviewable context cleanup plan, not to delete code.`,
     "",
     "Implementation constraints:",
     "- Prefer the existing stack and local patterns already in the repo.",
@@ -14567,7 +14690,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.5.2";
+    VERSION = "1.5.3";
   }
 });
 
@@ -14648,7 +14771,7 @@ var init_guide = __esm({
 function buildAgentRulesBlock() {
   return wrapViberavenBlock(`${AGENT_RULES_BODY}
 
-${ANCHOR_FOOTER}`);
+${WHAT_CLEAR_MEANS}`);
 }
 function buildAgentContextBlock() {
   return wrapViberavenBlock(AGENT_CONTEXT_BODY);
@@ -14768,7 +14891,7 @@ function normalizeLineEndings(value) {
 function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-var VIBERAVEN_BLOCK_START, VIBERAVEN_BLOCK_END, VIBERAVEN_LEGACY_BLOCK_START, VIBERAVEN_LEGACY_BLOCK_END, HEAL_PLAN_GAP_COMMAND, PROMPT_GAP_COMMAND, HEAL_APPLY_GAP_COMMAND, AGENT_RULES_PREAMBLE, STACK_FRAMING, AGENT_NEGATIVE_CONSTRAINTS, ANCHOR_FOOTER, AGENT_RULES_BODY, AGENT_CONTEXT_BODY, MISSION_MAP_BODY, BLOCK_MARKER_PAIRS;
+var VIBERAVEN_BLOCK_START, VIBERAVEN_BLOCK_END, VIBERAVEN_LEGACY_BLOCK_START, VIBERAVEN_LEGACY_BLOCK_END, HEAL_PLAN_GAP_COMMAND, PROMPT_GAP_COMMAND, HEAL_APPLY_GAP_COMMAND, AGENT_RULES_PREAMBLE, STACK_FRAMING, AGENT_NEGATIVE_CONSTRAINTS, WHAT_CLEAR_MEANS, AGENT_RULES_BODY, AGENT_CONTEXT_BODY, MISSION_MAP_BODY, BLOCK_MARKER_PAIRS;
 var init_agentRulesBlock = __esm({
   "src/commands/agentRulesBlock.ts"() {
     "use strict";
@@ -14780,84 +14903,59 @@ var init_agentRulesBlock = __esm({
     HEAL_PLAN_GAP_COMMAND = healPlanGapCommand("<id>");
     PROMPT_GAP_COMMAND = promptGapCommand("<id>");
     HEAL_APPLY_GAP_COMMAND = `${PUBLIC_COMMAND} --heal --apply --gap <id> --yes`;
-    AGENT_RULES_PREAMBLE = `VibeRaven is the control layer for AI-built products. It runs fully locally: no login, no API key, no telemetry.
+    AGENT_RULES_PREAMBLE = `VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. It runs fully locally: no login, no API key, no telemetry.
 
 Canonical commands: \`${PUBLIC_CHECK_COMMAND}\` for a terminal verdict, \`${PUBLIC_COMMAND}\` for the Studio.
 
-Use VibeRaven before launch, deployment, real users, auth, billing, database, RLS, env vars, webhooks, monitoring, or tests \u2014 and whenever you need product context (stack, providers, releases, danger zones) before patching.
-
-Agent loop: run \`${PUBLIC_CHECK_COMMAND}\`, read \`.viberaven/agent-tasklist.md\`, fix one launch gap, re-run \`${PUBLIC_CHECK_COMMAND}\`.`;
-    STACK_FRAMING = `Stack context for this repo: Next.js, Supabase, Vercel, VibeRaven.
-Do NOT deploy to Vercel or ship to production users without running \`${PUBLIC_CHECK_COMMAND}\`.
-Do NOT rely on manual production checklists when VibeRaven gate artifacts exist in \`.viberaven/\`.`;
-    AGENT_NEGATIVE_CONSTRAINTS = `## Event-Triggered Production Verification
-
-Trigger: modifications to \`package.json\`, \`vercel.json\`, \`supabase/migrations/**/*\`, \`.env.example\`, auth/billing/webhook paths, or deploy workflow files.
-
-1. Do NOT claim "production ready" or close a deploy checklist until \`gate.status === "clear"\` in \`.viberaven/gate-result.json\`.
-2. Do NOT run verify after every file patch. Batch fixes, then \`${PUBLIC_CHECK_COMMAND}\` once per loop.
-3. Do NOT \`git push\` or deploy after auth, RLS, billing, or webhook changes without \`${PUBLIC_CHECK_COMMAND}\`.
-4. If anomalies appear, read \`.viberaven/agent-tasklist.md\` fully before writing new repo logic.
-5. Do NOT mark production-ready because the local dev server starts successfully; INSTEAD run \`${PUBLIC_CHECK_COMMAND}\` and read \`.viberaven/gate-result.json\`.
-6. Do NOT treat the Supabase dashboard UI as proof of RLS; INSTEAD fix repo evidence gaps from \`.viberaven/agent-tasklist.md\`.
-7. Do NOT add or change npm dependencies without calling \`viberaven_validate_npm_package\` (MCP) or verifying the package exists on the public npm registry; INSTEAD run \`${PUBLIC_CHECK_COMMAND}\` after dependency changes.
-8. Do NOT refactor or edit files unrelated to the current TASK-001 gap; INSTEAD make minimal, targeted changes.
-9. Do NOT install new dependencies unless TASK-001 or the user explicitly requires them.
-10. Do NOT claim provider dashboard, billing, DNS, or webhook setup is complete from repo edits alone; INSTEAD present provider-action steps from the tasklist.
-
-Prefer \`viberaven_check_readiness\` when MCP is configured; otherwise \`${PUBLIC_CHECK_COMMAND}\`.`;
-    ANCHOR_FOOTER = `## Anchor (mandatory)
-
-Before ending any deploy, auth, RLS, webhook, or dependency task, run:
-\`${PUBLIC_CHECK_COMMAND}\`
-Gate is not clear until \`gate.status === "clear"\` in \`.viberaven/gate-result.json\`.`;
+Suggest one \`${PUBLIC_CHECK_COMMAND}\` pass before a Vercel + Supabase app launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook. It is not needed for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.
+
+This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test: it cannot show which RLS policies are live in production, and a clear result is not a security audit.
+
+Agent loop: run \`${PUBLIC_CHECK_COMMAND}\`, read \`.viberaven/agent-tasklist.md\`, fix one launch gap, re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch of fixes.`;
+    STACK_FRAMING = `Supported stack: AI-built apps that deploy on Vercel and use Supabase, typically from Lovable, Bolt, Cursor, Claude Code or Codex.
+Prefer \`viberaven_check_readiness\` when the VibeRaven MCP server is configured; otherwise \`${PUBLIC_CHECK_COMMAND}\`.`;
+    AGENT_NEGATIVE_CONSTRAINTS = `## Working with VibeRaven results
+
+1. Do not call the app "production ready" or "secure" because \`gate.status\` is \`clear\`; it covers the repo checks only.
+2. Do not run the check after every file patch. Batch fixes, then run \`${PUBLIC_CHECK_COMMAND}\` once per batch.
+3. Read \`.viberaven/agent-tasklist.md\` fully before writing new repo logic for a listed gap.
+4. Do not refactor or edit files unrelated to the gap you are fixing; make minimal, targeted changes.
+5. Do not install new dependencies for a fix unless the task or the user asks for them. \`viberaven_validate_npm_package\` (MCP) can look a new package name up on the public npm registry first.
+6. Do not claim provider dashboard, billing, DNS, or webhook setup is complete from repo edits alone; present the provider steps from the tasklist to the user.
+7. The Supabase dashboard, not the repo, shows which RLS policies are live. Repo migrations are what VibeRaven reads.`;
+    WHAT_CLEAR_MEANS = `## What a clear result means
+
+\`gate.status === "clear"\` in \`.viberaven/gate-result.json\` means the repo checks found no blockers. It is not a security audit and does not show what is live in Supabase or Vercel. The user decides when to ship.`;
     AGENT_RULES_BODY = `${AGENT_RULES_PREAMBLE}
 
 ${STACK_FRAMING}
 
 ${AGENT_NEGATIVE_CONSTRAINTS}
 
-## VibeRaven Production Gate
+## VibeRaven commands
 
-- Before running build, compile, cleanup, deployment, vercel, or supabase commands, run \`${PUBLIC_CHECK_COMMAND}\` first from the project root.
-- Treat VibeRaven as the control layer for AI-built products, especially apps using Vercel, Supabase, auth, database, payments, webhooks, monitoring, rate limits, or environment variables.
-- Read \`.viberaven/agent-tasklist.md\` first. If it says CRITICAL GAPS DETECTED or PRODUCTION GATE NOT CLEAR, fix one listed repo-code gap before deploying.
-- Read \`.viberaven/gate-result.json\` for the machine verdict.
-- Read \`.viberaven/context-map.json\` for compact agent context.
-- Read \`.viberaven/agent-summary.md\` second for scan context.
-- Read \`.viberaven/launch-playbook.md\` third for the full checklist.
+- Read \`.viberaven/agent-tasklist.md\` first, \`.viberaven/gate-result.json\` for the verdict (\`clear\`, \`warning\` or \`not_clear\`), and \`.viberaven/context-map.json\` for compact agent context.
+- \`.viberaven/agent-summary.md\` holds scan context and \`.viberaven/launch-playbook.md\` the full checklist.
 - Use \`${PUBLIC_NEXT_JSON_COMMAND}\` or \`${PROMPT_GAP_COMMAND}\` for one focused repo-code fix at a time.
-- Use \`${PUBLIC_FIX_COMMAND}\` to list gaps with safe automatic recipes; apply one with \`${PUBLIC_FIX_COMMAND} --gap <id>\`.
-- For Vercel + Supabase launch checks, run \`${PUBLIC_AUDIT_COMMAND}\`.
-- Run \`${PUBLIC_CHECK_COMMAND}\` after a batch of fixes.
-- Run \`${PUBLIC_STRICT_COMMAND}\` before deploy or CI pass.
-- Use \`${HEAL_PLAN_GAP_COMMAND}\` before any heal apply.
-- Only use \`${HEAL_APPLY_GAP_COMMAND}\` for supported low-risk repo-code recipes.
-- Preview local rule installation with \`${PUBLIC_INIT_ALL_COMMAND} --dry-run\`.
-- Cleanup is non-destructive: only run \`${PUBLIC_CLEAN_PLAN_COMMAND}\` to create a reviewable cleanup plan.
-- Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider MCP evidence.
-- Do not claim provider dashboard work is fixed by repo-code edits.
-- VibeRaven runs fully locally: no login, no API key, no scan quota.
+- \`${PUBLIC_FIX_COMMAND}\` lists gaps with safe automatic recipes; preview one with \`${PUBLIC_FIX_COMMAND} --gap <id> --dry-run\`, apply it with \`${PUBLIC_FIX_COMMAND} --gap <id>\`.
+- \`${HEAL_PLAN_GAP_COMMAND}\` writes a non-destructive plan; \`${HEAL_APPLY_GAP_COMMAND}\` applies supported repo-code recipes; the rls_disabled one enables RLS without policies, so it waits for the user's yes.
+- For the Vercel + Supabase repo evidence (RLS in migrations, pooler port, service role key), run \`${PUBLIC_AUDIT_COMMAND}\`.
+- \`${PUBLIC_STRICT_COMMAND}\` returns the verdict as an exit code for CI when the user wants one (exit 1 when \`gate.status\` is \`not_clear\`).
+- Preview these rules with \`${PUBLIC_INIT_ALL_COMMAND} --dry-run\`.
+- Cleanup is non-destructive: \`${PUBLIC_CLEAN_PLAN_COMMAND}\` writes a reviewable cleanup plan.
+- Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification happen in the provider dashboard or through read-only provider MCP evidence.
 
 ## VibeRaven Fix Loop
 
-After every check, read \`.viberaven/agent-tasklist.md\` for the prioritized task list.
-
-The loop is:
+After a check, read \`.viberaven/agent-tasklist.md\` for the prioritized task list.
 
 1. Run \`${PUBLIC_CHECK_COMMAND}\`. Exit code 1 means blockers exist.
 2. For each repo-code task where \`requiresUserAction: false\`:
-   - Call MCP: \`viberaven_heal_apply { gap: "<gapId>", yes: true }\`
-   - Or run \`${PUBLIC_FIX_COMMAND} --gap <gapId>\`
-   - Or patch the gap directly using \`${PROMPT_GAP_COMMAND}\` guidance.
-3. After a full batch of fixes, run \`${PUBLIC_CHECK_COMMAND}\` once \u2014 do NOT verify after every single fix.
-4. Repeat until \`gate.status === 'clear'\` in \`.viberaven/gate-result.json\`.
-5. If \`requiresUserAction: true\`:
-   - Read \`VIBERAVEN_PROVIDER_ACTION\` from terminal output.
-   - Present \`dashboardUrl\` and \`exactStep\` to the user.
-   - Wait for user confirmation, then re-run \`${PUBLIC_CHECK_COMMAND}\`.
-
-Do not stop at "scan complete." The loop is not done until \`gate.status === 'clear'\`.`;
+   - If the task has an MCP line, call \`viberaven_heal_apply { gap: "<gapId>", yes: true }\` or run \`${PUBLIC_FIX_COMMAND} --gap <gapId>\`
+   - Otherwise, patch the gap directly using \`${PROMPT_GAP_COMMAND}\` guidance.
+3. After a full batch of fixes, run \`${PUBLIC_CHECK_COMMAND}\` once, not after every single fix.
+4. For a task where \`requiresUserAction: true\`, show the user the task's action from the tasklist (a provider step with its dashboard, or a repo change that needs their yes, such as enabling RLS without policies), and wait for their answer. Apply a repo change only after they agree. The task's MCP line leaves out \`yes: true\`; add it once they agree.
+5. Stop when \`gate.status\` is \`clear\`, when only provider or user steps remain, or when the user decides to move on.`;
     AGENT_CONTEXT_BODY = `${AGENT_RULES_PREAMBLE}
 
 After \`${PUBLIC_CHECK_COMMAND}\`, read these artifacts in order:
@@ -14873,7 +14971,7 @@ After \`${PUBLIC_CHECK_COMMAND}\`, read these artifacts in order:
 1. Run \`${PUBLIC_CHECK_COMMAND}\` from the project root.
 2. Read \`.viberaven/agent-tasklist.md\` and \`.viberaven/gate-result.json\`.
 3. Fix one launch gap.
-4. Re-run \`${PUBLIC_CHECK_COMMAND}\` until \`gate.status === 'clear'\`.`;
+4. Re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch of fixes. A clear \`gate.status\` covers the repo checks only; the user decides when to ship.`;
     BLOCK_MARKER_PAIRS = [
       [VIBERAVEN_BLOCK_START, VIBERAVEN_BLOCK_END],
       [VIBERAVEN_LEGACY_BLOCK_START, VIBERAVEN_LEGACY_BLOCK_END]
@@ -14888,20 +14986,22 @@ function buildCursorRulesPack() {
       filename: "viberaven-core.mdc",
       content: [
         "---",
-        "description: VibeRaven production gate \u2014 canonical agent commands and gate loop",
+        "description: VibeRaven launch check for AI-built apps on Vercel + Supabase (advice, not a gate)",
         "alwaysApply: true",
         "---",
         "",
-        `Run \`${PUBLIC_CHECK_COMMAND}\` before deploy, auth, RLS, webhooks, or dependency changes.`,
+        `For an AI-built app on Vercel and Supabase, suggest \`${PUBLIC_CHECK_COMMAND}\` before it launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook.`,
+        "",
+        "This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test.",
         "",
         "Read `.viberaven/agent-tasklist.md` first, then `.viberaven/gate-result.json` and `.viberaven/mission-map.md`.",
-        `Fix one gap, then re-run \`${PUBLIC_CHECK_COMMAND}\`. Before CI or production promote: \`${PUBLIC_STRICT_COMMAND}\`.`,
+        `Fix one gap, then re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch. For a CI verdict: \`${PUBLIC_STRICT_COMMAND}\`.`,
         "",
-        'Gate is not clear until `gate.status === "clear"`.',
+        "A clear `gate.status` covers the repo checks only; it is not a security audit.",
         "",
         DOMAIN_PATH_POINTER,
         "",
-        "Full production rules: `AGENTS.md` / `CLAUDE.md` (installed by `npx -y viberaven init --agents all`)."
+        "Full rules: `AGENTS.md` / `CLAUDE.md` (installed by `npx -y viberaven init --agents all`)."
       ].join("\n")
     },
     {
@@ -14949,7 +15049,7 @@ function buildCursorRulesPack() {
         "",
         DOMAIN_PATH_POINTER,
         "",
-        "Do NOT ship webhook handlers without signature verification; INSTEAD run `npx -y viberaven check` after webhook edits."
+        "A payment webhook handler should verify the provider signature over the raw request body before trusting the event. After webhook edits, `npx -y viberaven check` shows whether a Stripe handler does."
       ].join("\n")
     }
   ];
@@ -14962,17 +15062,17 @@ async function initCursorRulesPack(options) {
   const pack = buildCursorRulesPack();
   for (const rule of pack) {
     const file = `${CURSOR_RULES_DIR}/${rule.filename}`;
-    const path = (0, import_node_path16.join)(options.cwd, file);
+    const path = (0, import_node_path17.join)(options.cwd, file);
     const existing = await readExistingFile(path);
     const changed = !existing.exists || existing.content !== rule.content;
     const action = !existing.exists ? "created" : changed ? "updated" : "unchanged";
     if (!options.dryRun && changed) {
-      await (0, import_promises12.mkdir)((0, import_node_path16.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
+      await (0, import_promises12.mkdir)((0, import_node_path17.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
       await (0, import_promises12.writeFile)(path, rule.content, "utf-8");
     }
     results.push({ target: "cursor", file, path, action });
   }
-  const legacyPath = (0, import_node_path16.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
+  const legacyPath = (0, import_node_path17.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
   if (!options.dryRun && await fileExists(legacyPath)) {
     await (0, import_promises12.rm)(legacyPath, { force: true });
   }
@@ -14999,12 +15099,12 @@ async function fileExists(path) {
 function isFileNotFoundError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises12, import_node_path16, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
+var import_promises12, import_node_path17, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
 var init_cursorRulesPack = __esm({
   "src/commands/cursorRulesPack.ts"() {
     "use strict";
     import_promises12 = require("node:fs/promises");
-    import_node_path16 = require("node:path");
+    import_node_path17 = require("node:path");
     init_commands();
     CURSOR_RULES_DIR = ".cursor/rules";
     LEGACY_CURSOR_RULE_FILE = `${CURSOR_RULES_DIR}/viberaven.mdc`;
@@ -15104,8 +15204,8 @@ var init_agentTargets = __esm({
 
 // src/commands/seedPackageJsonScripts.ts
 async function seedPackageJsonScripts(options) {
-  const packageJsonPath = (0, import_node_path17.join)(options.cwd, "package.json");
-  if (!(0, import_node_fs8.existsSync)(packageJsonPath)) {
+  const packageJsonPath = (0, import_node_path18.join)(options.cwd, "package.json");
+  if (!(0, import_node_fs9.existsSync)(packageJsonPath)) {
     return null;
   }
   const raw = await (0, import_promises13.readFile)(packageJsonPath, "utf-8");
@@ -15142,13 +15242,13 @@ async function seedPackageJsonScripts(options) {
   }
   return { action: "updated", added, skipped, changed: true };
 }
-var import_node_fs8, import_promises13, import_node_path17, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
+var import_node_fs9, import_promises13, import_node_path18, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
 var init_seedPackageJsonScripts = __esm({
   "src/commands/seedPackageJsonScripts.ts"() {
     "use strict";
-    import_node_fs8 = require("node:fs");
+    import_node_fs9 = require("node:fs");
     import_promises13 = require("node:fs/promises");
-    import_node_path17 = require("node:path");
+    import_node_path18 = require("node:path");
     init_commands();
     VIBERAVEN_PACKAGE_JSON_SCRIPTS = {
       "viberaven:gate": PUBLIC_AGENT_MODE_COMMAND,
@@ -15168,12 +15268,12 @@ async function initAgentRules(options) {
       continue;
     }
     const file = AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path18.join)(options.cwd, file);
+    const path = (0, import_node_path19.join)(options.cwd, file);
     const existing = await readExistingFile2(path);
     const injected = injectAgentRulesBlock(existing.content, renderAgentRulesForTarget(target));
     const action = !existing.exists ? "created" : injected.changed ? "updated" : "unchanged";
     if (!options.dryRun && injected.changed) {
-      await (0, import_promises14.mkdir)((0, import_node_path18.dirname)(path), { recursive: true });
+      await (0, import_promises14.mkdir)((0, import_node_path19.dirname)(path), { recursive: true });
       await (0, import_promises14.writeFile)(path, injected.content, "utf-8");
     }
     results.push({ target, file, path, action });
@@ -15253,12 +15353,12 @@ async function readExistingFile2(path) {
 function isFileNotFoundError2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises14, import_node_path18;
+var import_promises14, import_node_path19;
 var init_initRules = __esm({
   "src/commands/initRules.ts"() {
     "use strict";
     import_promises14 = require("node:fs/promises");
-    import_node_path18 = require("node:path");
+    import_node_path19 = require("node:path");
     init_agentRulesBlock();
     init_agentTargets();
     init_cursorRulesPack();
@@ -15521,7 +15621,7 @@ async function runInteractiveSession(startDir = process.cwd()) {
   Ie(`${import_picocolors4.default.bold("VibeRaven")} ${import_picocolors4.default.dim(VERSION)}`);
   const cwd = await resolveWorkspaceRoot(startDir);
   const artifactsAt = await findArtifactsWorkspace(startDir);
-  if (artifactsAt && (0, import_node_path19.resolve)(artifactsAt) !== (0, import_node_path19.resolve)(startDir)) {
+  if (artifactsAt && (0, import_node_path20.resolve)(artifactsAt) !== (0, import_node_path20.resolve)(startDir)) {
     M2.message(import_picocolors4.default.dim(`Using scan from: ${artifactsAt}`));
   } else {
     M2.message(import_picocolors4.default.dim(`Project folder: ${cwd}`));
@@ -15580,11 +15680,11 @@ async function runInteractiveSession(startDir = process.cwd()) {
   }
   Se(import_picocolors4.default.dim("Run viberaven anytime for the interactive menu."));
 }
-var import_node_path19, import_picocolors4;
+var import_node_path20, import_picocolors4;
 var init_runInteractive = __esm({
   "src/tui/runInteractive.ts"() {
     "use strict";
-    import_node_path19 = require("node:path");
+    import_node_path20 = require("node:path");
     init_dist2();
     import_picocolors4 = __toESM(require_picocolors());
     init_config();
@@ -15609,18 +15709,18 @@ var init_runInteractive = __esm({
 // src/commands/condense.ts
 async function runCondenseCommand(options) {
   const dir = getProjectArtifactsDir(options.cwd);
-  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path20.join)(dir, "last-scan.json"), "utf8"));
-  const contextMapPath = (0, import_node_path20.join)(dir, "context-map.json");
+  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path21.join)(dir, "last-scan.json"), "utf8"));
+  const contextMapPath = (0, import_node_path21.join)(dir, "context-map.json");
   await (0, import_promises15.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact), null, 2)}
 `, "utf8");
   return { contextMapPath };
 }
-var import_promises15, import_node_path20;
+var import_promises15, import_node_path21;
 var init_condense = __esm({
   "src/commands/condense.ts"() {
     "use strict";
     import_promises15 = require("node:fs/promises");
-    import_node_path20 = require("node:path");
+    import_node_path21 = require("node:path");
     init_config();
     init_contextMap();
   }
@@ -15628,9 +15728,9 @@ var init_condense = __esm({
 
 // src/heal/pathSafety.ts
 function assertSafeHealTarget(cwd, target) {
-  const root = (0, import_node_path21.resolve)(cwd);
-  const absolute = (0, import_node_path21.resolve)(root, target);
-  const rel = (0, import_node_path21.relative)(root, absolute);
+  const root = (0, import_node_path22.resolve)(cwd);
+  const absolute = (0, import_node_path22.resolve)(root, target);
+  const rel = (0, import_node_path22.relative)(root, absolute);
   if (rel.startsWith("..") || rel === "" || /^[A-Za-z]:/.test(rel)) {
     throw new Error("Heal target must stay inside the workspace");
   }
@@ -15640,11 +15740,11 @@ function assertSafeHealTarget(cwd, target) {
   }
   return absolute;
 }
-var import_node_path21, BLOCKED_SEGMENTS;
+var import_node_path22, BLOCKED_SEGMENTS;
 var init_pathSafety = __esm({
   "src/heal/pathSafety.ts"() {
     "use strict";
-    import_node_path21 = require("node:path");
+    import_node_path22 = require("node:path");
     BLOCKED_SEGMENTS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".viberaven"]);
   }
 });
@@ -15665,6 +15765,35 @@ var init_emptyCatch = __esm({
   }
 });
 
+// src/heal/healId.ts
+function newHealId(now = /* @__PURE__ */ new Date()) {
+  return `heal_${now.toISOString().replace(/\D/g, "").slice(0, 17)}_${(0, import_node_crypto.randomBytes)(3).toString("hex")}`;
+}
+async function createHealDir(cwd, makeId = () => newHealId()) {
+  const parent = (0, import_node_path23.join)(cwd, ".viberaven", "heal");
+  await (0, import_promises16.mkdir)(parent, { recursive: true });
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const id = makeId();
+    const dir = (0, import_node_path23.join)(parent, id);
+    try {
+      await (0, import_promises16.mkdir)(dir);
+      return { id, dir };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+  }
+  throw new Error("Could not create a new heal directory under .viberaven/heal.");
+}
+var import_node_crypto, import_promises16, import_node_path23;
+var init_healId = __esm({
+  "src/heal/healId.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    import_promises16 = require("node:fs/promises");
+    import_node_path23 = require("node:path");
+  }
+});
+
 // src/heal/recipes/envAuthSecret.ts
 function applyAuthSecretRecipe(source) {
   if (/^\s*(AUTH_SECRET|NEXTAUTH_SECRET)\s*=/m.test(source)) {
@@ -15907,24 +16036,46 @@ export default function NotFound() {
 });
 
 // src/heal/recipes/supabaseRls.ts
-function applyRlsRecipe(_source) {
-  return {
-    changed: false,
-    output: _source,
-    canAutoApply: false,
-    reason: "dashboard-only",
-    providerAction: {
-      provider: "supabase",
-      dashboardUrl: "https://supabase.com/dashboard/project/{{PROJECT_REF}}/auth/policies",
-      exactStep: 'Enable Row Level Security (RLS) on each table under the "Table Editor" or "Auth > Policies" section.',
-      doneSignal: "RLS toggle is green for all public tables",
-      verifyCommand: "npx -y viberaven audit --vercel-supabase --json"
+async function planRlsMigration(cwd, now = /* @__PURE__ */ new Date()) {
+  const audit = buildVercelSupabaseAudit(await collectVercelSupabaseAuditInput(cwd));
+  const check = audit.checks.find((entry) => entry.id === "supabase-rls-policy-proof");
+  const missing = (check?.findings ?? []).filter((finding) => finding.id === "rls_disabled" && finding.table && finding.file);
+  if (missing.length === 0) {
+    if (check?.status === "needs_work") {
+      return {
+        kind: "refused",
+        reason: "No SQL evidence in the repo: no migration here creates the tables or enables row level security, so there is nothing in the repo to patch. Add migrations that create your tables with row level security enabled, or check RLS in the Supabase dashboard."
+      };
     }
+    return { kind: "nothing-to-do" };
+  }
+  const tables = [...new Set(missing.map((finding) => finding.table))];
+  const evidence = missing.map((finding) => ({
+    file: finding.file,
+    table: finding.table,
+    turnedOff: finding.message.includes(RLS_TURNED_OFF_PHRASE)
+  }));
+  const target = rlsMigrationTarget(cwd, evidence, now);
+  if (!target.ok) return { kind: "refused", reason: target.reason };
+  return {
+    kind: "migration",
+    file: target.file,
+    sql: [RLS_MIGRATION_NOTE, "", ...rlsEnableStatements(tables), ""].join("\n"),
+    tables
   };
 }
+var RLS_MIGRATION_NOTE;
 var init_supabaseRls2 = __esm({
   "src/heal/recipes/supabaseRls.ts"() {
     "use strict";
+    init_audit();
+    init_rlsMigrationTarget();
+    RLS_MIGRATION_NOTE = [
+      "-- Added by VibeRaven (heal rls_disabled). Enables row level security on the public tables that the migrations in",
+      "-- this repo create without it. It adds no policies: until you add them, the anon and authenticated roles get no",
+      "-- rows from these tables through the Data API, and only the service role can read or write them. Add the policies",
+      "-- the app needs, then apply this migration the way this project applies migrations."
+    ].join("\n");
   }
 });
 
@@ -16106,7 +16257,7 @@ export const config = {
 // src/heal/recipes/eslintRestrictedImports.ts
 function detectEslintConfigFile(cwd) {
   for (const candidate of ESLINT_CONFIG_CANDIDATES) {
-    if ((0, import_node_fs9.existsSync)((0, import_node_path22.join)(cwd, candidate))) {
+    if ((0, import_node_fs10.existsSync)((0, import_node_path24.join)(cwd, candidate))) {
       return candidate;
     }
   }
@@ -16261,12 +16412,12 @@ function applyEslintRestrictedImportsRecipe(source, configFile) {
   }
   return applyLegacyModuleRecipe(source);
 }
-var import_node_fs9, import_node_path22, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
+var import_node_fs10, import_node_path24, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
 var init_eslintRestrictedImports = __esm({
   "src/heal/recipes/eslintRestrictedImports.ts"() {
     "use strict";
-    import_node_fs9 = require("node:fs");
-    import_node_path22 = require("node:path");
+    import_node_fs10 = require("node:fs");
+    import_node_path24 = require("node:path");
     init_commands();
     VIBERAVEN_ESLINT_MARKER = "VibeRaven heal: eslint_restricted_imports";
     RESTRICTED_IMPORTS_MESSAGE = `Restricted import. Run ${PUBLIC_AGENT_MODE_COMMAND} before substituting packages.`;
@@ -16309,7 +16460,7 @@ function defaultTargetFile(gapId) {
     missing_loading_state: "app/loading.tsx",
     missing_404_page: "app/not-found.tsx",
     rls_disabled: "",
-    // no file — provider-action
+    // a new migration, named by planRlsMigration
     missing_csp_header: "next.config.js",
     missing_rate_limit: "middleware.ts",
     eslint_restricted_imports: ""
@@ -16317,14 +16468,14 @@ function defaultTargetFile(gapId) {
   return map[gapId];
 }
 async function readSourceOrEmpty(absolutePath) {
-  if (!(0, import_node_fs10.existsSync)(absolutePath)) return "";
-  return (0, import_promises16.readFile)(absolutePath, "utf8");
+  if (!(0, import_node_fs11.existsSync)(absolutePath)) return "";
+  return (0, import_promises17.readFile)(absolutePath, "utf8");
 }
 async function detectUpstash(cwd) {
   try {
-    const pkgPath = (0, import_node_path23.join)(cwd, "package.json");
-    if (!(0, import_node_fs10.existsSync)(pkgPath)) return false;
-    const raw = await (0, import_promises16.readFile)(pkgPath, "utf8");
+    const pkgPath = (0, import_node_path25.join)(cwd, "package.json");
+    if (!(0, import_node_fs11.existsSync)(pkgPath)) return false;
+    const raw = await (0, import_promises17.readFile)(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const deps = {
       ...pkg["dependencies"] ?? {},
@@ -16339,7 +16490,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   const targetFile = explicitTarget ?? defaultTargetFile(gapId);
   if (targetFile === void 0) return null;
   if (gapId === "auth_secret_missing" || gapId === "node_env_not_set" || gapId === "database_url_missing") {
-    const absolutePath = (0, import_node_path23.join)(cwd, targetFile);
+    const absolutePath = (0, import_node_path25.join)(cwd, targetFile);
     const source = await readSourceOrEmpty(absolutePath);
     let result;
     if (gapId === "auth_secret_missing") result = applyAuthSecretRecipe(source);
@@ -16353,46 +16504,45 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
     };
   }
   if (gapId === "missing_error_boundary") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/error.tsx");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/error.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyErrorBoundaryRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_health_route") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/api/health/route.ts");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/api/health/route.ts");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyHealthRouteRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_loading_state") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/loading.tsx");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/loading.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyLoadingStateRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_404_page") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/not-found.tsx");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/not-found.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyNotFoundRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "rls_disabled") {
-    const result = applyRlsRecipe("");
-    return {
-      changed: false,
-      output: "",
-      targetFile: "",
-      canAutoApply: false,
-      reason: result.reason,
-      recipeName: gapId
-    };
+    const plan = await planRlsMigration(cwd);
+    if (plan.kind === "migration") {
+      return { changed: true, output: plan.sql, targetFile: plan.file, canAutoApply: true, recipeName: gapId, warnings: [RLS_NO_POLICIES_WARNING] };
+    }
+    if (plan.kind === "nothing-to-do") {
+      return { changed: false, output: "", targetFile: "", canAutoApply: true, recipeName: gapId };
+    }
+    return { changed: false, output: "", targetFile: "", canAutoApply: false, reason: plan.reason, recipeName: gapId };
   }
   if (gapId === "missing_csp_header") {
     let configFile = "next.config.js";
-    let absolutePath = (0, import_node_path23.join)(cwd, configFile);
-    if (!(0, import_node_fs10.existsSync)(absolutePath)) {
+    let absolutePath = (0, import_node_path25.join)(cwd, configFile);
+    if (!(0, import_node_fs11.existsSync)(absolutePath)) {
       configFile = "next.config.mjs";
-      absolutePath = (0, import_node_path23.join)(cwd, configFile);
+      absolutePath = (0, import_node_path25.join)(cwd, configFile);
     }
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyCspHeaderRecipe(source);
@@ -16404,7 +16554,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_rate_limit") {
     const hasUpstash = await detectUpstash(cwd);
-    const middlewarePath = (0, import_node_path23.join)(cwd, "middleware.ts");
+    const middlewarePath = (0, import_node_path25.join)(cwd, "middleware.ts");
     const source = await readSourceOrEmpty(middlewarePath);
     const result = applyRateLimitRecipe(source, hasUpstash);
     return {
@@ -16426,7 +16576,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
         recipeName: gapId
       };
     }
-    const absolutePath = (0, import_node_path23.join)(cwd, configFile);
+    const absolutePath = (0, import_node_path25.join)(cwd, configFile);
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyEslintRestrictedImportsRecipe(source, configFile);
     return {
@@ -16440,13 +16590,13 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   return null;
 }
-var import_node_fs10, import_promises16, import_node_path23;
+var import_node_fs11, import_promises17, import_node_path25;
 var init_recipes = __esm({
   "src/heal/recipes/index.ts"() {
     "use strict";
-    import_node_fs10 = require("node:fs");
-    import_promises16 = require("node:fs/promises");
-    import_node_path23 = require("node:path");
+    import_node_fs11 = require("node:fs");
+    import_promises17 = require("node:fs/promises");
+    import_node_path25 = require("node:path");
     init_envAuthSecret();
     init_envNodeEnv();
     init_envDatabaseUrl();
@@ -16455,6 +16605,7 @@ var init_recipes = __esm({
     init_nextjsLoadingState();
     init_nextjsNotFound();
     init_supabaseRls2();
+    init_rlsMigrationTarget();
     init_nextjsCspHeader();
     init_nextjsRateLimit();
     init_eslintRestrictedImports();
@@ -16462,11 +16613,12 @@ var init_recipes = __esm({
 });
 
 // src/heal/apply.ts
-function healId() {
-  return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
+function rollbackInstructions(id, file, existedBefore) {
+  if (!existedBefore) return `Delete ${file}: it did not exist before this heal.`;
+  return `Copy .viberaven/heal/${id}/before/target.txt back over ${file}, or apply the reverse of .viberaven/heal/${id}/patch.diff.`;
 }
 async function applyHeal(options) {
-  const id = healId();
+  let id = newHealId();
   if (!options.yes) {
     return {
       $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
@@ -16521,14 +16673,17 @@ async function applyHeal(options) {
           rollback: { available: false, instructions: "Recipe matched but no change was needed (already applied or file already exists)." }
         };
       }
-      const absoluteTarget = (0, import_node_path24.join)(options.cwd, dispatched.targetFile);
+      const absoluteTarget = (0, import_node_path26.join)(options.cwd, dispatched.targetFile);
       assertSafeHealTarget(options.cwd, dispatched.targetFile);
-      await (0, import_promises17.mkdir)((0, import_node_path24.dirname)(absoluteTarget), { recursive: true });
-      const healDir2 = (0, import_node_path24.join)(options.cwd, ".viberaven", "heal", id);
-      await (0, import_promises17.mkdir)((0, import_node_path24.join)(healDir2, "before"), { recursive: true });
-      const beforeContent = (0, import_node_fs11.existsSync)(absoluteTarget) ? await (0, import_promises17.readFile)(absoluteTarget, "utf8") : "";
-      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
-      await (0, import_promises17.writeFile)(absoluteTarget, dispatched.output, "utf8");
+      await (0, import_promises18.mkdir)((0, import_node_path26.dirname)(absoluteTarget), { recursive: true });
+      const created2 = await createHealDir(options.cwd);
+      id = created2.id;
+      const healDir2 = created2.dir;
+      await (0, import_promises18.mkdir)((0, import_node_path26.join)(healDir2, "before"));
+      const existedBefore = (0, import_node_fs12.existsSync)(absoluteTarget);
+      const beforeContent = existedBefore ? await (0, import_promises18.readFile)(absoluteTarget, "utf8") : "";
+      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
+      await (0, import_promises18.writeFile)(absoluteTarget, dispatched.output, "utf8");
       const patch2 = [
         `--- ${dispatched.targetFile}`,
         `+++ ${dispatched.targetFile}`,
@@ -16538,7 +16693,7 @@ async function applyHeal(options) {
         dispatched.output,
         ""
       ].join("\n");
-      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "patch.diff"), patch2, "utf8");
+      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "patch.diff"), patch2, "utf8");
       const result2 = {
         $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
         schemaVersion: "v1",
@@ -16548,18 +16703,19 @@ async function applyHeal(options) {
         status: "applied_verify_not_run",
         gapId: options.gapId,
         recipe: dispatched.recipeName,
+        ...dispatched.warnings?.length ? { warnings: dispatched.warnings } : {},
         target: dispatched.targetFile,
-        changedFiles: [(0, import_node_path24.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
+        changedFiles: [(0, import_node_path26.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
         artifacts: {
           patch: `.viberaven/heal/${id}/patch.diff`,
           result: `.viberaven/heal/${id}/result.json`
         },
         rollback: {
           available: true,
-          instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
+          instructions: rollbackInstructions(id, (0, import_node_path26.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/"), existedBefore)
         }
       };
-      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
+      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
 `, "utf8");
       return result2;
     }
@@ -16579,7 +16735,7 @@ async function applyHeal(options) {
     };
   }
   const absolute = assertSafeHealTarget(options.cwd, options.target);
-  const before = await (0, import_promises17.readFile)(absolute, "utf8");
+  const before = await (0, import_promises18.readFile)(absolute, "utf8");
   const recipe = applyEmptyCatchRecipe(before);
   if (!recipe.changed) {
     return {
@@ -16596,10 +16752,12 @@ async function applyHeal(options) {
       rollback: { available: false, instructions: "No supported heal recipe matched this file." }
     };
   }
-  const healDir = (0, import_node_path24.join)(options.cwd, ".viberaven", "heal", id);
-  await (0, import_promises17.mkdir)((0, import_node_path24.join)(healDir, "before"), { recursive: true });
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "before", "target.txt"), before, "utf8");
-  await (0, import_promises17.writeFile)(absolute, recipe.output, "utf8");
+  const created = await createHealDir(options.cwd);
+  id = created.id;
+  const healDir = created.dir;
+  await (0, import_promises18.mkdir)((0, import_node_path26.join)(healDir, "before"));
+  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "before", "target.txt"), before, "utf8");
+  await (0, import_promises18.writeFile)(absolute, recipe.output, "utf8");
   const patch = [
     `--- ${options.target}`,
     `+++ ${options.target}`,
@@ -16609,7 +16767,7 @@ async function applyHeal(options) {
     recipe.output,
     ""
   ].join("\n");
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "patch.diff"), patch, "utf8");
+  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "patch.diff"), patch, "utf8");
   const result = {
     $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
     schemaVersion: "v1",
@@ -16620,42 +16778,65 @@ async function applyHeal(options) {
     gapId: options.gapId,
     recipe: "empty-catch-safe-response",
     target: options.target,
-    changedFiles: [(0, import_node_path24.relative)(options.cwd, absolute).replace(/\\/g, "/")],
+    changedFiles: [(0, import_node_path26.relative)(options.cwd, absolute).replace(/\\/g, "/")],
     artifacts: {
       patch: `.viberaven/heal/${id}/patch.diff`,
       result: `.viberaven/heal/${id}/result.json`
     },
     rollback: {
       available: true,
-      instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
+      // The empty-catch recipe only edits a file that already exists.
+      instructions: rollbackInstructions(id, (0, import_node_path26.relative)(options.cwd, absolute).replace(/\\/g, "/"), true)
     }
   };
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises17, import_node_fs11, import_node_path24;
+var import_promises18, import_node_fs12, import_node_path26;
 var init_apply = __esm({
   "src/heal/apply.ts"() {
     "use strict";
-    import_promises17 = require("node:fs/promises");
-    import_node_fs11 = require("node:fs");
-    import_node_path24 = require("node:path");
+    import_promises18 = require("node:fs/promises");
+    import_node_fs12 = require("node:fs");
+    import_node_path26 = require("node:path");
     init_pathSafety();
     init_emptyCatch();
+    init_healId();
     init_recipes();
   }
 });
 
 // src/heal/plan.ts
-function healId2() {
-  return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
-}
 async function writeHealPlan(options) {
-  const dir = (0, import_node_path25.join)(options.cwd, ".viberaven");
-  await (0, import_promises18.mkdir)(dir, { recursive: true });
-  const id = healId2();
+  const dir = (0, import_node_path27.join)(options.cwd, ".viberaven");
+  await (0, import_promises19.mkdir)(dir, { recursive: true });
+  const id = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
+  const proposal = [];
+  let proposedFile;
+  if (!options.target && options.gapId === "rls_disabled") {
+    const rls = await planRlsMigration(options.cwd);
+    if (rls.kind === "migration") {
+      proposedFile = rls.file;
+      proposal.push(
+        "## Proposed change",
+        "",
+        `New migration: \`${rls.file}\``,
+        "",
+        "```sql",
+        rls.sql.trimEnd(),
+        "```",
+        "",
+        "It adds no policies. Apply it with `npx -y viberaven fix --gap rls_disabled`, add the policies the app needs, then apply the migration to the database the way this project applies migrations.",
+        ""
+      );
+    } else if (rls.kind === "refused") {
+      proposal.push("## No automatic recipe", "", rls.reason, "");
+    } else {
+      proposal.push("## Nothing to change", "", "Every public table the migrations create already has row level security.", "");
+    }
+  }
   const markdown = [
     "# VibeRaven Heal Plan",
     "",
@@ -16664,6 +16845,7 @@ async function writeHealPlan(options) {
     "",
     "This plan is non-destructive. It does not edit source files.",
     "",
+    ...proposal,
     `Verify after manual fix: \`${PUBLIC_VERIFY_COMMAND}\``,
     ""
   ].join("\n");
@@ -16675,34 +16857,33 @@ async function writeHealPlan(options) {
     mode: "plan",
     status: "planned",
     gapId: options.gapId,
-    target: options.target,
+    target: options.target ?? proposedFile,
     changedFiles: [],
     artifacts: { plan: ".viberaven/heal-plan.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-plan.md"), markdown, "utf8");
-  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises19.writeFile)((0, import_node_path27.join)(dir, "heal-plan.md"), markdown, "utf8");
+  await (0, import_promises19.writeFile)((0, import_node_path27.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises18, import_node_path25;
+var import_promises19, import_node_path27;
 var init_plan = __esm({
   "src/heal/plan.ts"() {
     "use strict";
-    import_promises18 = require("node:fs/promises");
-    import_node_path25 = require("node:path");
+    import_promises19 = require("node:fs/promises");
+    init_healId();
+    import_node_path27 = require("node:path");
     init_commands();
+    init_supabaseRls2();
   }
 });
 
 // src/heal/prompt.ts
-function healId3() {
-  return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
-}
 async function writeHealPrompt(options) {
-  const dir = (0, import_node_path26.join)(options.cwd, ".viberaven");
-  await (0, import_promises19.mkdir)(dir, { recursive: true });
-  const id = healId3();
+  const dir = (0, import_node_path28.join)(options.cwd, ".viberaven");
+  await (0, import_promises20.mkdir)(dir, { recursive: true });
+  const id = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
   const prompt = [
     "# VibeRaven Heal Prompt",
@@ -16728,15 +16909,16 @@ async function writeHealPrompt(options) {
     artifacts: { prompt: ".viberaven/heal-prompt.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises19.writeFile)((0, import_node_path26.join)(dir, "heal-prompt.md"), prompt, "utf8");
+  await (0, import_promises20.writeFile)((0, import_node_path28.join)(dir, "heal-prompt.md"), prompt, "utf8");
   return result;
 }
-var import_promises19, import_node_path26;
+var import_promises20, import_node_path28;
 var init_prompt = __esm({
   "src/heal/prompt.ts"() {
     "use strict";
-    import_promises19 = require("node:fs/promises");
-    import_node_path26 = require("node:path");
+    import_promises20 = require("node:fs/promises");
+    init_healId();
+    import_node_path28 = require("node:path");
     init_commands();
   }
 });
@@ -16747,7 +16929,7 @@ function loopStatePath(workspaceRoot) {
 }
 async function loadLoopState(workspaceRoot) {
   try {
-    const raw = await (0, import_promises20.readFile)(loopStatePath(workspaceRoot), "utf8");
+    const raw = await (0, import_promises21.readFile)(loopStatePath(workspaceRoot), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.batchApplied === "number" && typeof parsed.lastGapCount === "number" && typeof parsed.stalledScans === "number") {
       const p2 = parsed;
@@ -16767,8 +16949,8 @@ async function loadLoopState(workspaceRoot) {
 async function saveLoopState(workspaceRoot, state) {
   try {
     const dir = (0, import_path.join)(workspaceRoot, ".viberaven");
-    await (0, import_promises20.mkdir)(dir, { recursive: true });
-    await (0, import_promises20.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
+    await (0, import_promises21.mkdir)(dir, { recursive: true });
+    await (0, import_promises21.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
   } catch (err) {
     console.warn("[VibeRaven] Could not save loop-state.json:", err instanceof Error ? err.message : String(err));
   }
@@ -16794,11 +16976,11 @@ function resetBatch(state, newGapCount) {
     appliedGapIdsSinceScan: []
   };
 }
-var import_promises20, import_path, DEFAULT_LOOP_STATE;
+var import_promises21, import_path, DEFAULT_LOOP_STATE;
 var init_loopState = __esm({
   "src/loopState.ts"() {
     "use strict";
-    import_promises20 = require("fs/promises");
+    import_promises21 = require("fs/promises");
     import_path = require("path");
     DEFAULT_LOOP_STATE = {
       batchApplied: 0,
@@ -16839,11 +17021,11 @@ var init_heal = __esm({
 
 // src/stackRecommend.ts
 async function recommendStack(cwd = process.cwd()) {
-  const pkgPath = (0, import_node_path27.join)(cwd, "package.json");
-  if (!(0, import_node_fs12.existsSync)(pkgPath)) {
+  const pkgPath = (0, import_node_path29.join)(cwd, "package.json");
+  if (!(0, import_node_fs13.existsSync)(pkgPath)) {
     return DEFAULT_STACK;
   }
-  const pkg = JSON.parse(await (0, import_promises21.readFile)(pkgPath, "utf-8"));
+  const pkg = JSON.parse(await (0, import_promises22.readFile)(pkgPath, "utf-8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   const names = Object.keys(deps).join(" ").toLowerCase();
   const rec = {
@@ -16871,13 +17053,13 @@ async function recommendStack(cwd = process.cwd()) {
   }
   return rec;
 }
-var import_promises21, import_node_fs12, import_node_path27, DEFAULT_STACK;
+var import_promises22, import_node_fs13, import_node_path29, DEFAULT_STACK;
 var init_stackRecommend = __esm({
   "src/stackRecommend.ts"() {
     "use strict";
-    import_promises21 = require("node:fs/promises");
-    import_node_fs12 = require("node:fs");
-    import_node_path27 = require("node:path");
+    import_promises22 = require("node:fs/promises");
+    import_node_fs13 = require("node:fs");
+    import_node_path29 = require("node:path");
     DEFAULT_STACK = {
       frontend: "react",
       ui: "tailwind + shadcn/ui",
@@ -16919,10 +17101,14 @@ var init_runInit = __esm({
 });
 
 // src/commands/doctorAgents.ts
+function managedBlocks(content) {
+  const blocks = content.match(/<!-- (?:VIBERAVEN:START|viberaven:agent-rules:start) -->[\s\S]*?<!-- (?:VIBERAVEN:END|viberaven:agent-rules:end) -->/g);
+  return (blocks ?? []).join("\n");
+}
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item4 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists = await fileExists2((0, import_node_path28.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path30.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
@@ -16930,17 +17116,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item4 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists = await fileExists2((0, import_node_path28.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path30.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
       message: exists ? `${item4.file} exists` : `Missing ${item4.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path28.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path30.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
-    const legacyContent = await (0, import_promises22.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path28.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const legacyContent = await (0, import_promises23.readFile)(legacyCursorPath, "utf-8");
+    const hasCoreSplit = await fileExists2((0, import_node_path30.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -16951,7 +17137,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path28.join)(cwd, file);
+    const path = (0, import_node_path30.join)(cwd, file);
     const exists = await fileExists2(path);
     if (!exists) {
       checks.push({
@@ -16961,7 +17147,7 @@ async function checkAgentInjection(cwd) {
       });
       continue;
     }
-    const content = await (0, import_promises22.readFile)(path, "utf-8");
+    const content = await (0, import_promises23.readFile)(path, "utf-8");
     const hasCommand = content.includes(PUBLIC_CHECK_COMMAND);
     checks.push({
       id: `canonical-${target}`,
@@ -16977,6 +17163,15 @@ async function checkAgentInjection(cwd) {
         });
       }
     }
+    const managed = target === "cursor" ? content : managedBlocks(content);
+    const gatePhrase = GATE_RULE_PHRASES_1_5_2.find((phrase) => managed.includes(phrase));
+    if (gatePhrase) {
+      checks.push({
+        id: `stale-gate-rules-${target}`,
+        status: "fail",
+        message: `${file} still has the 1.5.2 gate rules ("${gatePhrase} ..."). Run npx -y viberaven init --agents all to replace them with the current advice block.`
+      });
+    }
   }
   return {
     ok: checks.every((check) => check.status === "pass"),
@@ -16995,18 +17190,18 @@ function formatDoctorAgentsReport(report) {
 }
 async function fileExists2(path) {
   try {
-    await (0, import_promises22.access)(path);
+    await (0, import_promises23.access)(path);
     return true;
   } catch {
     return false;
   }
 }
-var import_promises22, import_node_path28, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS;
+var import_promises23, import_node_path30, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
 var init_doctorAgents = __esm({
   "src/commands/doctorAgents.ts"() {
     "use strict";
-    import_promises22 = require("node:fs/promises");
-    import_node_path28 = require("node:path");
+    import_promises23 = require("node:fs/promises");
+    import_node_path30 = require("node:path");
     init_commands();
     init_agentTargets();
     REQUIRED_EXISTENCE_CHECKS = [
@@ -17025,6 +17220,12 @@ var init_doctorAgents = __esm({
       { id: "stale-viberaven-station", pattern: "viberaven-station" },
       { id: "stale-viberice", pattern: "viberice" }
     ];
+    GATE_RULE_PHRASES_1_5_2 = [
+      "The loop is not done until",
+      "Gate is not clear until",
+      "Do NOT rely on manual production checklists",
+      "Use VibeRaven before launch, deployment, real users"
+    ];
   }
 });
 
@@ -17271,7 +17472,7 @@ function buildContextCleanupPlan(input) {
   const items = [];
   const seen = /* @__PURE__ */ new Set();
   for (const file of input.files) {
-    const path = normalizePath5((0, import_node_path29.relative)(input.projectRoot, file.path) || file.path);
+    const path = normalizePath5((0, import_node_path31.relative)(input.projectRoot, file.path) || file.path);
     const fullPath = normalizePath5(file.path);
     const category = categorizeCleanupFile(path, fullPath, file);
     if (!category || seen.has(path)) {
@@ -17297,10 +17498,10 @@ async function collectCleanupFiles(projectRoot) {
   return files;
 }
 async function writeCleanupPlan(projectRoot, plan) {
-  const outputDir = (0, import_node_path29.join)(projectRoot, ".viberaven");
-  const outputPath = (0, import_node_path29.join)(outputDir, "context-cleanup.md");
-  await (0, import_promises23.mkdir)(outputDir, { recursive: true });
-  await (0, import_promises23.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
+  const outputDir = (0, import_node_path31.join)(projectRoot, ".viberaven");
+  const outputPath = (0, import_node_path31.join)(outputDir, "context-cleanup.md");
+  await (0, import_promises24.mkdir)(outputDir, { recursive: true });
+  await (0, import_promises24.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
   return outputPath;
 }
 function categorizeCleanupFile(relativePath, fullPath, file) {
@@ -17348,7 +17549,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
   }
   let entries;
   try {
-    entries = await (0, import_promises23.readdir)(dir, { withFileTypes: true });
+    entries = await (0, import_promises24.readdir)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -17356,9 +17557,9 @@ async function walkCleanupFiles(root, dir, result, depth) {
     if (SKIP_DIRECTORIES.has(entry.name)) {
       continue;
     }
-    const absolute = (0, import_node_path29.join)(dir, entry.name);
+    const absolute = (0, import_node_path31.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (isCachePath(normalizePath5((0, import_node_path29.relative)(root, absolute)))) {
+      if (isCachePath(normalizePath5((0, import_node_path31.relative)(root, absolute)))) {
         result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
         continue;
       }
@@ -17369,7 +17570,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
       continue;
     }
     try {
-      const fileStat = await (0, import_promises23.stat)(absolute);
+      const fileStat = await (0, import_promises24.stat)(absolute);
       result.push({ path: absolute, sizeBytes: fileStat.size, kind: "file" });
     } catch {
       continue;
@@ -17379,12 +17580,12 @@ async function walkCleanupFiles(root, dir, result, depth) {
 function normalizePath5(path) {
   return path.replace(/\\/g, "/");
 }
-var import_promises23, import_node_path29, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
+var import_promises24, import_node_path31, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
 var init_cleanPlan = __esm({
   "src/commands/cleanPlan.ts"() {
     "use strict";
-    import_promises23 = require("node:fs/promises");
-    import_node_path29 = require("node:path");
+    import_promises24 = require("node:fs/promises");
+    import_node_path31 = require("node:path");
     MAX_WALK_DEPTH = 5;
     LARGE_LOG_BYTES = 8192;
     SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -17432,6 +17633,10 @@ function renderTarget(target) {
   return ["Verify:", "```bash", redact(target.command), "```"];
 }
 function renderReadiness(action) {
+  if (action.requiresUserAction && action.readiness?.[0]) {
+    const rest = action.readiness.slice(1, 3).map(redact).filter(Boolean);
+    return [redact(action.readiness[0]), rest.length ? `Ready: ${rest.join(", ")}` : void 0].filter(Boolean).join("\n");
+  }
   const readiness = action.readiness?.slice(0, 2).map(redact).filter(Boolean);
   if (!readiness || readiness.length === 0) {
     return void 0;
@@ -17493,10 +17698,10 @@ var init_render = __esm({
 
 // src/commands/actions.ts
 async function runActionsCommand(input) {
-  const actionsPath = (0, import_node_path30.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path32.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   let raw;
   try {
-    raw = await (0, import_promises24.readFile)(actionsPath, "utf8");
+    raw = await (0, import_promises25.readFile)(actionsPath, "utf8");
   } catch {
     process.stderr.write("No VibeRaven actions found. Run `npx -y viberaven --agent-mode` first.\n");
     return 1;
@@ -17510,12 +17715,12 @@ async function runActionsCommand(input) {
   process.stdout.write(renderActionSurface(manifest));
   return 0;
 }
-var import_promises24, import_node_path30;
+var import_promises25, import_node_path32;
 var init_actions = __esm({
   "src/commands/actions.ts"() {
     "use strict";
-    import_promises24 = require("node:fs/promises");
-    import_node_path30 = require("node:path");
+    import_promises25 = require("node:fs/promises");
+    import_node_path32 = require("node:path");
     init_render();
     init_config();
   }
@@ -17524,7 +17729,7 @@ var init_actions = __esm({
 // src/commands/verifyAction.ts
 async function currentActionExists(cwd, actionId) {
   try {
-    const raw = await (0, import_promises25.readFile)((0, import_node_path31.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
+    const raw = await (0, import_promises26.readFile)((0, import_node_path33.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
     const manifest = JSON.parse(raw);
     return manifest.actions.some((action) => action.id === actionId);
   } catch {
@@ -17563,17 +17768,17 @@ async function runVerifyActionCommand(input) {
   }
   process.stdout.write(
     `Verifying ${entry.id} (${entry.title ?? "untitled action"}).
-Run \`npx -y viberaven --verify\` to refresh the production gate for this action.
+This only looks the action up. Run \`npx -y viberaven --verify\` to scan the repo again and see whether the gap is gone.
 `
   );
   return 0;
 }
-var import_promises25, import_node_path31;
+var import_promises26, import_node_path33;
 var init_verifyAction = __esm({
   "src/commands/verifyAction.ts"() {
     "use strict";
-    import_promises25 = require("node:fs/promises");
-    import_node_path31 = require("node:path");
+    import_promises26 = require("node:fs/promises");
+    import_node_path33 = require("node:path");
     init_registry2();
     init_config();
   }
@@ -17614,7 +17819,7 @@ function buildPreviewManifest() {
             ]
           }
         ],
-        verifyCommand: `${PUBLIC_COMMAND} verify --action VR-A1`,
+        verifyCommand: `${PUBLIC_COMMAND} --verify --action VR-A1`,
         resumeInstruction: "Stripe webhook is configured. Continue VibeRaven from VR-A1."
       },
       {
@@ -17640,7 +17845,7 @@ function buildPreviewManifest() {
             value: 'alter table public.example enable row level security;\ncreate policy "Users manage own rows" on public.example for all using (auth.uid() = user_id);'
           }
         ],
-        verifyCommand: `${PUBLIC_COMMAND} verify --action VR-A2`,
+        verifyCommand: `${PUBLIC_COMMAND} --verify --action VR-A2`,
         resumeInstruction: "Supabase RLS is applied. Continue VibeRaven from VR-A2."
       },
       {
@@ -17772,7 +17977,7 @@ var init_check = __esm({
 
 // src/rls/permissionsMatrix.ts
 function sha256(data) {
-  return (0, import_node_crypto.createHash)("sha256").update(data).digest("hex");
+  return (0, import_node_crypto2.createHash)("sha256").update(data).digest("hex");
 }
 function parsePermissionsMatrix(text) {
   let raw;
@@ -17920,11 +18125,11 @@ function parseTable(key, value, problems) {
   const [schema, name] = parts.length === 2 ? parts : ["public", parts[0]];
   return { key, schema, name, ownerColumn, expect, serviceRoleExcluded, seed, ...updateColumn ? { updateColumn } : {} };
 }
-var import_node_crypto, MATRIX_ACTORS, TESTED_ACTORS, MATRIX_ACTIONS, OPTIONAL_ACTIONS, ALL_ACTIONS, CELL_VALUES, DEFAULT_GRANT_MODES, DEFAULT_MATRIX_FILE, MatrixError, IDENT, TOP_KEYS, TABLE_KEYS, OWNER_KEYS, isObject2, show, quoteList;
+var import_node_crypto2, MATRIX_ACTORS, TESTED_ACTORS, MATRIX_ACTIONS, OPTIONAL_ACTIONS, ALL_ACTIONS, CELL_VALUES, DEFAULT_GRANT_MODES, DEFAULT_MATRIX_FILE, MatrixError, IDENT, TOP_KEYS, TABLE_KEYS, OWNER_KEYS, isObject2, show, quoteList;
 var init_permissionsMatrix = __esm({
   "src/rls/permissionsMatrix.ts"() {
     "use strict";
-    import_node_crypto = require("node:crypto");
+    import_node_crypto2 = require("node:crypto");
     MATRIX_ACTORS = ["owner", "other_user", "anon", "service_role"];
     TESTED_ACTORS = ["owner", "other_user", "anon"];
     MATRIX_ACTIONS = ["select", "insert", "update", "delete"];
@@ -18201,8 +18406,8 @@ function isSqlError(error) {
 }
 function displayPath(projectDir, path) {
   for (const base of [projectDir, process.cwd()]) {
-    const rel = (0, import_node_path32.relative)(base, path);
-    if (rel && !rel.startsWith("..") && !(0, import_node_path32.isAbsolute)(rel)) return rel.split("\\").join("/");
+    const rel = (0, import_node_path34.relative)(base, path);
+    if (rel && !rel.startsWith("..") && !(0, import_node_path34.isAbsolute)(rel)) return rel.split("\\").join("/");
   }
   return path;
 }
@@ -18256,7 +18461,7 @@ function valueCandidates(column, label) {
   const u2 = label === "u";
   switch (column.typname) {
     case "uuid":
-      return [(0, import_node_crypto2.randomUUID)()];
+      return [(0, import_node_crypto3.randomUUID)()];
     case "json":
     case "jsonb":
       return u2 ? ['{"vr":"u"}', "{}"] : ["{}"];
@@ -18806,26 +19011,26 @@ function verdictFor(summary) {
 }
 async function listMigrations(dir) {
   try {
-    const entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
+    const entries = await (0, import_promises27.readdir)(dir, { withFileTypes: true });
     return entries.filter((e2) => e2.isFile() && /\.sql$/i.test(e2.name) && !e2.name.startsWith(".")).map((e2) => e2.name).sort((a, b3) => a < b3 ? -1 : a > b3 ? 1 : 0);
   } catch {
     return [];
   }
 }
 async function runRlsTest(options) {
-  const projectDir = (0, import_node_path32.resolve)(options.projectDir);
-  const matrixPath = (0, import_node_path32.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
-  const migrationsDir = (0, import_node_path32.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path32.join)("supabase", "migrations"));
+  const projectDir = (0, import_node_path34.resolve)(options.projectDir);
+  const matrixPath = (0, import_node_path34.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
+  const migrationsDir = (0, import_node_path34.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path34.join)("supabase", "migrations"));
   const timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
-  if ((0, import_node_path32.basename)(matrixPath).toLowerCase().startsWith(".env")) {
-    throw new RlsInputError(`Refusing to read ${(0, import_node_path32.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
+  if ((0, import_node_path34.basename)(matrixPath).toLowerCase().startsWith(".env")) {
+    throw new RlsInputError(`Refusing to read ${(0, import_node_path34.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
   }
   const filesRead = [];
   let matrixText;
   try {
-    const info = await (0, import_promises26.stat)(matrixPath);
+    const info = await (0, import_promises27.stat)(matrixPath);
     if (!info.isFile()) throw new Error("not a file");
-    matrixText = normalise(await (0, import_promises26.readFile)(matrixPath, "utf8"));
+    matrixText = normalise(await (0, import_promises27.readFile)(matrixPath, "utf8"));
   } catch {
     throw new RlsInputError(
       `No permissions matrix at ${matrixPath}. Write one by hand (schema: schemas/permissions-matrix.schema.json in the @viberaven/cli package); rls-test never infers it from your policies.`
@@ -18836,8 +19041,8 @@ async function runRlsTest(options) {
   const names = await listMigrations(migrationsDir);
   const migrationFiles = [];
   for (const name of names) {
-    const sql = normalise(await (0, import_promises26.readFile)((0, import_node_path32.join)(migrationsDir, name), "utf8"));
-    filesRead.push(displayPath(projectDir, (0, import_node_path32.join)(migrationsDir, name)));
+    const sql = normalise(await (0, import_promises27.readFile)((0, import_node_path34.join)(migrationsDir, name), "utf8"));
+    filesRead.push(displayPath(projectDir, (0, import_node_path34.join)(migrationsDir, name)));
     migrationFiles.push({ name, sha256: sha256(sql), sql });
   }
   const migrationsHash = sha256(migrationFiles.map((f) => `${f.name}\0${f.sha256}`).join("\n"));
@@ -19037,15 +19242,15 @@ async function runTable(db, table, badRoles, roleChecks) {
     cells
   };
 }
-var import_node_child_process6, import_node_crypto2, import_promises26, import_node_net, import_node_path32, import_node_util4, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine, plural2, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
+var import_node_child_process6, import_node_crypto3, import_promises27, import_node_net, import_node_path34, import_node_util4, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine, plural2, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
 var init_rlsRunner = __esm({
   "src/rls/rlsRunner.ts"() {
     "use strict";
     import_node_child_process6 = require("node:child_process");
-    import_node_crypto2 = require("node:crypto");
-    import_promises26 = require("node:fs/promises");
+    import_node_crypto3 = require("node:crypto");
+    import_promises27 = require("node:fs/promises");
     import_node_net = __toESM(require("node:net"));
-    import_node_path32 = require("node:path");
+    import_node_path34 = require("node:path");
     import_node_util4 = require("node:util");
     init_safeGit();
     init_permissionsMatrix();
@@ -19829,7 +20034,19 @@ function buildConnectProviders(providers) {
     dashboardUrl: providerDashboardUrls[provider2.id]
   }));
 }
+function asksFirstByGap(artifact) {
+  const asks = /* @__PURE__ */ new Map();
+  try {
+    for (const task of buildTaskList(artifact)) {
+      const sentence = task.fixType === "repo-code" && task.requiresUserAction ? task.action?.match(/^Ask the user first: [^.]+\./)?.[0] : void 0;
+      if (sentence) asks.set(task.gapId, sentence);
+    }
+  } catch {
+  }
+  return asks;
+}
 function buildMissionCards(artifact, providers) {
+  const asksFirst = asksFirstByGap(artifact);
   const blockers = artifact.gaps.map((gap) => ({
     id: gap.id,
     title: gap.title,
@@ -19838,13 +20055,15 @@ function buildMissionCards(artifact, providers) {
     category: blockerCategoryLabel(gap),
     tone: blockerTone(gap.severity),
     prompt: gap.copyPrompt || void 0,
-    requiresUserAction: gapRequiresUserAction(gap)
+    requiresUserAction: gapRequiresUserAction(gap),
+    ...asksFirst.has(gap.id) ? { asksFirst: asksFirst.get(gap.id) } : {}
   }));
   const planSteps = artifact.gaps.map((gap) => ({
     id: gap.id,
     title: gap.title,
     category: planStepCategoryLabel(gap),
-    requiresUserAction: gapRequiresUserAction(gap)
+    requiresUserAction: gapRequiresUserAction(gap),
+    ...asksFirst.has(gap.id) ? { asksFirst: asksFirst.get(gap.id) } : {}
   }));
   const connectProviders = buildConnectProviders(providers);
   const blockerCount = blockers.length;
@@ -19859,7 +20078,7 @@ function buildMissionCards(artifact, providers) {
   };
 }
 function projectNameFromPath(pathValue) {
-  return (0, import_node_path33.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
+  return (0, import_node_path35.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
 }
 function gapSearchText(gap) {
   return [
@@ -19927,15 +20146,7 @@ function providerStatusText(state) {
       return "Missing";
   }
 }
-function verifyActionForGap(gap) {
-  if (gap?.id) {
-    return {
-      label: "Verify",
-      commandPreview: `npx -y viberaven verify --action ${gap.id}`,
-      intent: "verify_action",
-      actionId: gap.id
-    };
-  }
+function verifyActionForGap(_gap) {
   return {
     label: "Verify",
     commandPreview: "npx -y viberaven --verify",
@@ -20278,20 +20489,21 @@ function mapArtifactToLocalUiState(artifact, presentProviderIds) {
     selectedProviderId: selectedProvider.id,
     currentPrompt: selectedProvider.nextFix?.prompt ?? "",
     artifacts: {
-      tasklist: (0, import_node_path33.join)(".viberaven", "agent-tasklist.md"),
-      contextMap: (0, import_node_path33.join)(".viberaven", "context-map.json"),
-      gateResult: (0, import_node_path33.join)(".viberaven", "gate-result.json"),
-      lastScan: (0, import_node_path33.join)(".viberaven", "last-scan.json")
+      tasklist: (0, import_node_path35.join)(".viberaven", "agent-tasklist.md"),
+      contextMap: (0, import_node_path35.join)(".viberaven", "context-map.json"),
+      gateResult: (0, import_node_path35.join)(".viberaven", "gate-result.json"),
+      lastScan: (0, import_node_path35.join)(".viberaven", "last-scan.json")
     },
     empty: false
   };
 }
-var import_node_path33, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
+var import_node_path35, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
 var init_artifactAdapter = __esm({
   "src/local-ui/artifactAdapter.ts"() {
     "use strict";
-    import_node_path33 = require("node:path");
+    import_node_path35 = require("node:path");
     init_providerLogos();
+    init_buildTaskList();
     init_prompts();
     init_providerLaunchPaths();
     init_launchRunway();
@@ -20592,18 +20804,18 @@ var init_planLimits = __esm({
 // src/hosted/credentials.ts
 function defaultConfigDir(env = process.env, platform = process.platform) {
   const override = env.VIBERAVEN_CONFIG_DIR?.trim();
-  if (override) return (0, import_node_path34.resolve)(override);
+  if (override) return (0, import_node_path36.resolve)(override);
   if (platform === "win32") {
-    return (0, import_node_path34.join)(env.APPDATA?.trim() || (0, import_node_path34.join)((0, import_node_os.homedir)(), "AppData", "Roaming"), "viberaven");
+    return (0, import_node_path36.join)(env.APPDATA?.trim() || (0, import_node_path36.join)((0, import_node_os.homedir)(), "AppData", "Roaming"), "viberaven");
   }
   if (platform === "darwin") {
-    return (0, import_node_path34.join)((0, import_node_os.homedir)(), "Library", "Application Support", "viberaven");
+    return (0, import_node_path36.join)((0, import_node_os.homedir)(), "Library", "Application Support", "viberaven");
   }
-  return (0, import_node_path34.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path34.join)((0, import_node_os.homedir)(), ".config"), "viberaven");
+  return (0, import_node_path36.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path36.join)((0, import_node_os.homedir)(), ".config"), "viberaven");
 }
 function isInside(child, parent) {
-  const rel = (0, import_node_path34.relative)((0, import_node_path34.resolve)(parent), (0, import_node_path34.resolve)(child));
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path34.isAbsolute)(rel);
+  const rel = (0, import_node_path36.relative)((0, import_node_path36.resolve)(parent), (0, import_node_path36.resolve)(child));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path36.isAbsolute)(rel);
 }
 async function retryTransient(work) {
   for (let attempt = 1; ; attempt += 1) {
@@ -20616,15 +20828,15 @@ async function retryTransient(work) {
     }
   }
 }
-var import_node_child_process7, import_node_crypto3, import_promises27, import_node_os, import_node_path34, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
+var import_node_child_process7, import_node_crypto4, import_promises28, import_node_os, import_node_path36, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
 var init_credentials = __esm({
   "src/hosted/credentials.ts"() {
     "use strict";
     import_node_child_process7 = require("node:child_process");
-    import_node_crypto3 = require("node:crypto");
-    import_promises27 = require("node:fs/promises");
+    import_node_crypto4 = require("node:crypto");
+    import_promises28 = require("node:fs/promises");
     import_node_os = require("node:os");
-    import_node_path34 = require("node:path");
+    import_node_path36 = require("node:path");
     CREDENTIALS_FILE_NAME = "credentials.json";
     CredentialLocationError = class extends Error {
     };
@@ -20651,9 +20863,9 @@ var init_credentials = __esm({
       constructor(configDir, workspacePath, options = {}) {
         this.configDir = configDir;
         this.workspacePath = workspacePath;
-        this.path = (0, import_node_path34.join)(configDir, CREDENTIALS_FILE_NAME);
+        this.path = (0, import_node_path36.join)(configDir, CREDENTIALS_FILE_NAME);
         this.restrict = options.restrict !== void 0 ? options.restrict : process.platform === "win32" ? restrictWithIcacls : null;
-        this.fs = { readFile: (path, encoding) => (0, import_promises27.readFile)(path, encoding), rename: (from, to) => (0, import_promises27.rename)(from, to), rm: (path) => (0, import_promises27.rm)(path, { force: true }), ...options.fs };
+        this.fs = { readFile: (path, encoding) => (0, import_promises28.readFile)(path, encoding), rename: (from, to) => (0, import_promises28.rename)(from, to), rm: (path) => (0, import_promises28.rm)(path, { force: true }), ...options.fs };
       }
       path;
       restrict;
@@ -20702,15 +20914,15 @@ var init_credentials = __esm({
             `Refusing to store the VibeRaven sign-in inside this project (${this.configDir}). Set VIBERAVEN_CONFIG_DIR to a folder outside the repo.`
           );
         }
-        await (0, import_promises27.mkdir)(this.configDir, { recursive: true, mode: 448 });
-        const temp = `${this.path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-        await (0, import_promises27.writeFile)(temp, `${JSON.stringify(body, null, 2)}
+        await (0, import_promises28.mkdir)(this.configDir, { recursive: true, mode: 448 });
+        const temp = `${this.path}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
+        await (0, import_promises28.writeFile)(temp, `${JSON.stringify(body, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await (0, import_promises27.chmod)(temp, 384).catch(() => void 0);
+        await (0, import_promises28.chmod)(temp, 384).catch(() => void 0);
         try {
           if (this.restrict) await this.restrict(temp);
         } catch (error) {
-          await (0, import_promises27.rm)(temp, { force: true });
+          await (0, import_promises28.rm)(temp, { force: true });
           const code = error?.code;
           const toolMissing = code === "ENOENT";
           throw new CredentialPermissionError(
@@ -20721,17 +20933,17 @@ var init_credentials = __esm({
         if (guard) {
           const onDisk = await this.readFor(guard.apiBaseUrl);
           if (onDisk?.accessToken !== guard.accessToken || guard.isCurrent && !guard.isCurrent()) {
-            await (0, import_promises27.rm)(temp, { force: true });
+            await (0, import_promises28.rm)(temp, { force: true });
             return false;
           }
         }
         try {
           await retryTransient(() => this.fs.rename(temp, this.path));
         } catch (error) {
-          await (0, import_promises27.rm)(temp, { force: true });
+          await (0, import_promises28.rm)(temp, { force: true });
           throw error;
         }
-        await (0, import_promises27.chmod)(this.path, 384).catch(() => void 0);
+        await (0, import_promises28.chmod)(this.path, 384).catch(() => void 0);
         return true;
       }
       /** Keeps the stored plan label in step with what the API last said. */
@@ -21100,7 +21312,7 @@ async function buildHostedCheckPayload(workspacePath) {
   throw new Error("Could not assemble the full check request.");
 }
 function finalizePayload(payload) {
-  const folder = (0, import_node_path35.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
+  const folder = (0, import_node_path37.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
   const redacted = redactPayload({ ...payload, workspacePath: folder });
   return { payload: redacted.payload, redactions: redacted.count };
 }
@@ -21131,13 +21343,13 @@ function splitSections(prompt) {
     chars: section.length
   }));
 }
-var import_node_path35, PayloadCaptured;
+var import_node_path37, PayloadCaptured;
 var init_payload = __esm({
   "src/hosted/payload.ts"() {
     "use strict";
     init_fileScanner();
     init_orchestrator();
-    import_node_path35 = require("node:path");
+    import_node_path37 = require("node:path");
     init_config();
     init_redact();
     PayloadCaptured = class extends Error {
@@ -21213,11 +21425,11 @@ function readServerMessage(body) {
     return body.slice(0, 300);
   }
 }
-var import_node_crypto4, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK3, FullCheckService;
+var import_node_crypto5, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK3, FullCheckService;
 var init_fullCheck = __esm({
   "src/hosted/fullCheck.ts"() {
     "use strict";
-    import_node_crypto4 = require("node:crypto");
+    import_node_crypto5 = require("node:crypto");
     init_engines();
     init_planLimits();
     init_productionMapLanes();
@@ -21482,8 +21694,8 @@ var init_fullCheck = __esm({
           const built = await this.buildPayload(this.workspacePath);
           const final = finalizePayload(built.payload);
           this.prunePreviews();
-          const id = (0, import_node_crypto4.randomUUID)();
-          this.previews.set(id, { payload: final.payload, idempotencyKey: (0, import_node_crypto4.randomUUID)(), createdAt: Date.now() });
+          const id = (0, import_node_crypto5.randomUUID)();
+          this.previews.set(id, { payload: final.payload, idempotencyKey: (0, import_node_crypto5.randomUUID)(), createdAt: Date.now() });
           return { kind: "preview", preview: describePayload(id, `${this.apiBaseUrl}/v1/station/run`, final.payload, built.scan, final.redactions) };
         } catch (error) {
           if (error instanceof HostedCallError) return this.fromCallError(error);
@@ -21603,10 +21815,10 @@ async function connectProviderMcp(cwd, providerId) {
   if (!recipe) {
     return { ok: false, message: `No known MCP server for ${providerId} yet. Add one manually to .mcp.json.` };
   }
-  const configPath = (0, import_node_path36.join)(cwd, ".mcp.json");
+  const configPath = (0, import_node_path38.join)(cwd, ".mcp.json");
   let config = {};
   try {
-    const raw = await (0, import_promises28.readFile)(configPath, "utf8");
+    const raw = await (0, import_promises29.readFile)(configPath, "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     if (!isRecord5(parsed) || parsed.mcpServers !== void 0 && !isRecord5(parsed.mcpServers)) {
       return { ok: false, message: "Existing .mcp.json has an unsupported structure. It was left unchanged." };
@@ -21623,7 +21835,7 @@ async function connectProviderMcp(cwd, providerId) {
   }
   servers[providerId] = recipe.entry;
   const next = { ...config, mcpServers: servers };
-  await (0, import_promises28.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises29.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const suffix = recipe.note ? ` ${recipe.note}` : "";
   return { ok: true, message: `Added ${providerId} MCP server to .mcp.json.${suffix}`, path: ".mcp.json" };
@@ -21635,7 +21847,7 @@ function headerValue(request, name) {
 function tokensMatch(given, expected) {
   const a = Buffer.from(given, "utf8");
   const b3 = Buffer.from(expected, "utf8");
-  return a.length === b3.length && (0, import_node_crypto5.timingSafeEqual)(a, b3);
+  return a.length === b3.length && (0, import_node_crypto6.timingSafeEqual)(a, b3);
 }
 function guardRequest(request, response, pathname, guard) {
   const allowedHosts = [`127.0.0.1:${guard.port}`, `localhost:${guard.port}`];
@@ -21676,7 +21888,7 @@ async function defaultScanRunner(flags, positional) {
 }
 async function readPackageJson(cwd) {
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, "package.json"), "utf8");
+    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, "package.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -21699,7 +21911,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
     if (files.length >= maxFiles) return;
     let entries;
     try {
-      entries = await (0, import_promises28.readdir)(dir, { withFileTypes: true });
+      entries = await (0, import_promises29.readdir)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -21707,7 +21919,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
       if (files.length >= maxFiles) return;
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        if (!skipped.has(entry.name)) await walk((0, import_node_path36.join)(dir, entry.name), rel);
+        if (!skipped.has(entry.name)) await walk((0, import_node_path38.join)(dir, entry.name), rel);
         continue;
       }
       if (entry.isFile()) files.push(rel.toLowerCase());
@@ -21726,7 +21938,7 @@ async function readEnvKeys(cwd) {
   const keys = /* @__PURE__ */ new Set();
   for (const name of [".env.example", ".env"]) {
     try {
-      const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, name), "utf8");
+      const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, name), "utf8");
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -22044,7 +22256,7 @@ async function codexModelOptions() {
     { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" }
   ];
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)((0, import_node_os2.homedir)(), ".codex", "models_cache.json"), "utf8");
+    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)((0, import_node_os2.homedir)(), ".codex", "models_cache.json"), "utf8");
     const parsed = JSON.parse(raw);
     const list = Array.isArray(parsed) ? parsed : parsed.models ?? [];
     const options = list.filter((model) => typeof model?.slug === "string").filter((model) => !/auto-review|reserve/i.test(model.slug)).map((model) => ({ id: model.slug, label: model.display_name?.trim() || model.slug }));
@@ -22247,19 +22459,19 @@ function isPlaceholderProjectName(value) {
 async function readMcpEvidence(cwd) {
   const candidates = MCP_CONFIG_PATHS.map((relativePath) => ({
     source: relativePath.replace(/\\/g, "/"),
-    path: (0, import_node_path36.resolve)(cwd, relativePath)
+    path: (0, import_node_path38.resolve)(cwd, relativePath)
   }));
   const home = process.env.USERPROFILE || process.env.HOME;
   if (home) {
     candidates.push({
       source: "~/.codex/config.toml",
-      path: (0, import_node_path36.resolve)(home, ".codex", "config.toml")
+      path: (0, import_node_path38.resolve)(home, ".codex", "config.toml")
     });
   }
   const evidence = [];
   for (const candidate of candidates) {
     try {
-      const text = await (0, import_promises28.readFile)(candidate.path, "utf8");
+      const text = await (0, import_promises29.readFile)(candidate.path, "utf8");
       if (/mcp/i.test(text)) evidence.push({ source: candidate.source, text });
     } catch {
     }
@@ -22350,7 +22562,7 @@ async function enrichProjectMetadata(state, cwd) {
 async function readState(cwd) {
   let state;
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
+    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
     const packageJson = await readPackageJson(cwd);
     const deps = dependencyNames(packageJson);
     const files = await listProjectFiles(cwd);
@@ -22617,7 +22829,7 @@ async function whereExe(command, cwd) {
 }
 function expandShimPath(value, base) {
   const relative8 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
-  return relative8 === value ? value : (0, import_node_path36.join)(base, ...relative8.split(/[\\/]+/));
+  return relative8 === value ? value : (0, import_node_path38.join)(base, ...relative8.split(/[\\/]+/));
 }
 function findShimTarget(lines, pattern, accept = () => true) {
   for (const line of lines) {
@@ -22628,21 +22840,21 @@ function findShimTarget(lines, pattern, accept = () => true) {
 }
 async function resolveWindowsShimTarget(shimPath) {
   try {
-    const content = await (0, import_promises28.readFile)(shimPath, "utf8");
-    const base = (0, import_node_path36.dirname)(shimPath);
+    const content = await (0, import_promises29.readFile)(shimPath, "utf8");
+    const base = (0, import_node_path38.dirname)(shimPath);
     const lines = content.split(/\r?\n/);
     const trailingArgs = (line, after) => [...line.slice(after).split("%*")[0].matchAll(/"([^"]*)"|([^\s"&|<>]+)/g)].map((token) => expandShimPath(token[1] ?? token[2], base)).filter((value) => value.length > 0 && !value.includes("%"));
     const script = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.js)"/i);
     if (script) {
       return {
         command: process.execPath,
-        args: [(0, import_node_path36.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
+        args: [(0, import_node_path38.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
       };
     }
-    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path36.basename)(target).toLowerCase() !== "node.exe");
+    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path38.basename)(target).toLowerCase() !== "node.exe");
     if (binary) {
       return {
-        command: (0, import_node_path36.join)(base, ...binary.match[1].split(/[\\/]+/)),
+        command: (0, import_node_path38.join)(base, ...binary.match[1].split(/[\\/]+/)),
         args: trailingArgs(binary.line, binary.match.index + binary.match[0].length)
       };
     }
@@ -22767,8 +22979,8 @@ async function writeChatContextArtifact(cwd, request, prompt) {
       "",
       prompt
     ].filter((line) => typeof line === "string");
-    await (0, import_promises28.mkdir)((0, import_node_path36.join)(cwd, ".viberaven"), { recursive: true });
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
+    await (0, import_promises29.mkdir)((0, import_node_path38.join)(cwd, ".viberaven"), { recursive: true });
+    await (0, import_promises29.writeFile)((0, import_node_path38.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
 `, "utf8");
   } catch {
   }
@@ -22788,13 +23000,13 @@ async function runAgentChat(cwd, request) {
   }
   const prompt = await buildAgentChatPrompt(request, cwd);
   await writeChatContextArtifact(cwd, request, prompt);
-  const outputPath = request.cliId === "codex" ? (0, import_node_path36.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
-  if (outputPath) await (0, import_promises28.mkdir)((0, import_node_path36.dirname)(outputPath), { recursive: true });
+  const outputPath = request.cliId === "codex" ? (0, import_node_path38.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
+  if (outputPath) await (0, import_promises29.mkdir)((0, import_node_path38.dirname)(outputPath), { recursive: true });
   const { command, args, stdin } = commandForAgentChat(request, prompt, cwd, outputPath);
   const result = await runAgentCommand(command, args, cwd, stdin, request.runId);
   if (outputPath) {
     try {
-      const finalMessage = (await (0, import_promises28.readFile)(outputPath, "utf8")).trim();
+      const finalMessage = (await (0, import_promises29.readFile)(outputPath, "utf8")).trim();
       if (finalMessage) return { ...result, output: finalMessage };
     } catch {
     }
@@ -22806,8 +23018,8 @@ function firstGapId(state) {
   return state.providers.find((provider2) => provider2.nextFix?.id)?.nextFix?.id;
 }
 async function runLocalAction(cwd, intent) {
-  const artifactDir = (0, import_node_path36.join)(cwd, ".viberaven");
-  await (0, import_promises28.mkdir)(artifactDir, { recursive: true });
+  const artifactDir = (0, import_node_path38.join)(cwd, ".viberaven");
+  await (0, import_promises29.mkdir)(artifactDir, { recursive: true });
   if (intent === "preview_rehearsal") {
     const state2 = await readState(cwd);
     const topProvider = state2.providers[0];
@@ -22848,7 +23060,7 @@ async function runLocalAction(cwd, intent) {
       proof,
       ""
     ].join("\n");
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
+    await (0, import_promises29.writeFile)((0, import_node_path38.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
     return {
       title: "Preview rehearsal ready",
       summary: `${projectName}: ${gateLabel} with ${state2.providers.length} provider beat${state2.providers.length === 1 ? "" : "s"}`,
@@ -22858,7 +23070,7 @@ async function runLocalAction(cwd, intent) {
   if (intent === "audit_vercel_supabase") {
     const auditInput = await collectVercelSupabaseAuditInput(cwd);
     const result2 = buildVercelSupabaseAudit(auditInput);
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
+    await (0, import_promises29.writeFile)((0, import_node_path38.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
 `, "utf8");
     return {
       title: result2.status === "pass" ? "Audit passed" : "Audit needs work",
@@ -22886,7 +23098,7 @@ async function runLocalAction(cwd, intent) {
   const mode = intent === "heal_prompt" ? "prompt" : intent === "heal_apply" ? "apply" : "plan";
   const result = await runHealCommand({ cwd, mode, gapId, yes: mode === "apply", noVerify: true });
   if (mode === "apply") {
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
+    await (0, import_promises29.writeFile)((0, import_node_path38.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   }
   return {
@@ -22896,14 +23108,14 @@ async function runLocalAction(cwd, intent) {
   };
 }
 async function sendArtifact(cwd, rel, response, contentType = "text/plain; charset=utf-8") {
-  const absolute = (0, import_node_path36.resolve)(cwd, rel);
-  const root = (0, import_node_path36.resolve)(cwd);
+  const absolute = (0, import_node_path38.resolve)(cwd, rel);
+  const root = (0, import_node_path38.resolve)(cwd);
   if (!absolute.startsWith(root)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const text = await (0, import_promises28.readFile)(absolute, "utf8");
+    const text = await (0, import_promises29.readFile)(absolute, "utf8");
     response.writeHead(200, { "content-type": contentType });
     response.end(text);
   } catch {
@@ -22912,7 +23124,7 @@ async function sendArtifact(cwd, rel, response, contentType = "text/plain; chars
 }
 async function sendReportArtifact(cwd, response) {
   try {
-    const text = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "report.html"), "utf8");
+    const text = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "report.html"), "utf8");
     response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     response.end(text);
     return;
@@ -23039,7 +23251,7 @@ async function sendReportArtifact(cwd, response) {
 }
 async function sendExtensionIcon(cwd, response) {
   try {
-    const body = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, "media", "extension-icon.png"));
+    const body = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, "media", "extension-icon.png"));
     sendBinary(response, 200, "image/png", body);
   } catch {
     sendText(response, 404, "Icon not found");
@@ -23052,15 +23264,15 @@ async function sendMangaAsset(pathname, response) {
     return;
   }
   const candidates = [
-    (0, import_node_path36.join)(__dirname, "manga", name),
+    (0, import_node_path38.join)(__dirname, "manga", name),
     // installed + dev: <pkg>/dist/manga
-    (0, import_node_path36.join)(__dirname, "..", "assets", "manga", name),
+    (0, import_node_path38.join)(__dirname, "..", "assets", "manga", name),
     // fallback: <pkg>/assets/manga (source)
-    (0, import_node_path36.join)(__dirname, "..", "..", "assets", "manga", name)
+    (0, import_node_path38.join)(__dirname, "..", "..", "assets", "manga", name)
   ];
   for (const candidate of candidates) {
     try {
-      const body = await (0, import_promises28.readFile)(candidate);
+      const body = await (0, import_promises29.readFile)(candidate);
       response.setHeader("cache-control", "no-cache");
       sendBinary(response, 200, contentTypeForAsset(candidate), body);
       return;
@@ -23070,7 +23282,7 @@ async function sendMangaAsset(pathname, response) {
   sendText(response, 404, "Asset not found");
 }
 function contentTypeForAsset(pathname) {
-  switch ((0, import_node_path36.extname)(pathname).toLowerCase()) {
+  switch ((0, import_node_path38.extname)(pathname).toLowerCase()) {
     case ".svg":
       return "image/svg+xml; charset=utf-8";
     case ".png":
@@ -23087,14 +23299,14 @@ function contentTypeForAsset(pathname) {
 }
 async function sendBundledReportAsset(pathname, response) {
   const rel = decodeURIComponent(pathname.replace(/^\/report\//, ""));
-  const assetRoot = (0, import_node_path36.resolve)(getBundledReportAssetsDir());
-  const absolute = (0, import_node_path36.resolve)(assetRoot, rel);
+  const assetRoot = (0, import_node_path38.resolve)(getBundledReportAssetsDir());
+  const absolute = (0, import_node_path38.resolve)(assetRoot, rel);
   if (!absolute.startsWith(assetRoot)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const body = await (0, import_promises28.readFile)(absolute);
+    const body = await (0, import_promises29.readFile)(absolute);
     sendBinary(response, 200, contentTypeForAsset(absolute), body);
   } catch {
     sendText(response, 404, "Asset not found");
@@ -23116,18 +23328,18 @@ async function bundleStackClient(entryPath) {
   return output.text;
 }
 async function sendStackAppJs(response) {
-  const distPath = (0, import_node_path36.join)(__dirname, "stack", "app.js");
+  const distPath = (0, import_node_path38.join)(__dirname, "stack", "app.js");
   try {
-    const body = await (0, import_promises28.readFile)(distPath);
+    const body = await (0, import_promises29.readFile)(distPath);
     response.writeHead(200, { "content-type": "application/javascript; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
     return;
   } catch {
   }
-  const entryPath = (0, import_node_path36.join)(__dirname, "stack", "main.ts");
+  const entryPath = (0, import_node_path38.join)(__dirname, "stack", "main.ts");
   let mtimeMs;
   try {
-    mtimeMs = (await (0, import_promises28.stat)(entryPath)).mtimeMs;
+    mtimeMs = (await (0, import_promises29.stat)(entryPath)).mtimeMs;
   } catch {
     sendText(response, 404, "Stack client entry not found: src/local-ui/stack/main.ts is missing.");
     return;
@@ -23146,7 +23358,7 @@ async function sendStackAppJs(response) {
 }
 async function sendStackAppCss(response) {
   try {
-    const body = await (0, import_promises28.readFile)((0, import_node_path36.join)(__dirname, "stack", "stack.css"));
+    const body = await (0, import_promises29.readFile)((0, import_node_path38.join)(__dirname, "stack", "stack.css"));
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
   } catch {
@@ -23155,7 +23367,7 @@ async function sendStackAppCss(response) {
 }
 async function readProviderVerifyLedger(cwd) {
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
+    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -23165,8 +23377,8 @@ async function readProviderVerifyLedger(cwd) {
 async function writeProviderVerifyEntry(cwd, providerId, entry) {
   const ledger = await readProviderVerifyLedger(cwd);
   ledger[providerId] = entry;
-  await (0, import_promises28.mkdir)((0, import_node_path36.join)(cwd, ".viberaven"), { recursive: true });
-  await (0, import_promises28.writeFile)((0, import_node_path36.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
+  await (0, import_promises29.mkdir)((0, import_node_path38.join)(cwd, ".viberaven"), { recursive: true });
+  await (0, import_promises29.writeFile)((0, import_node_path38.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
 }
 async function handleRequest(request, response, options) {
@@ -23227,13 +23439,13 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/architecture-map") {
-    const mapPath = (0, import_node_path36.join)(options.cwd, ".viberaven", "architecture-map.md");
-    const markdown = await (0, import_promises28.readFile)(mapPath, "utf8").catch(() => null);
+    const mapPath = (0, import_node_path38.join)(options.cwd, ".viberaven", "architecture-map.md");
+    const markdown = await (0, import_promises29.readFile)(mapPath, "utf8").catch(() => null);
     if (markdown === null) {
       sendJsonStatus(response, 404, { error: "No architecture map yet. Run a scan first (it is written on every scan)." });
       return;
     }
-    const dataRaw = await (0, import_promises28.readFile)((0, import_node_path36.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
+    const dataRaw = await (0, import_promises29.readFile)((0, import_node_path38.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
     let data = null;
     if (dataRaw) {
       try {
@@ -23242,7 +23454,7 @@ async function handleRequest(request, response, options) {
         data = null;
       }
     }
-    const contextRaw = await (0, import_promises28.readFile)((0, import_node_path36.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
+    const contextRaw = await (0, import_promises29.readFile)((0, import_node_path38.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
     let gaps = [];
     if (contextRaw) {
       try {
@@ -23508,35 +23720,35 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/tasklist") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "agent-tasklist.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "agent-tasklist.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/playbook") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "launch-playbook.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "launch-playbook.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/audit") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "audit-vercel-supabase.txt"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "audit-vercel-supabase.txt"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/cleanup") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "context-cleanup.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "context-cleanup.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/preview") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "preview-rehearsal.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "preview-rehearsal.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-plan") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-plan.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "heal-plan.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-prompt") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-prompt.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "heal-prompt.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-apply") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
+    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/report") {
@@ -23562,12 +23774,12 @@ async function handleRequest(request, response, options) {
   }
   if (request.method === "GET" && url.pathname === "/vendor/anime.umd.min.js") {
     for (const candidate of [
-      (0, import_node_path36.join)(__dirname, "vendor", "anime.umd.min.js"),
-      (0, import_node_path36.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
-      (0, import_node_path36.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
+      (0, import_node_path38.join)(__dirname, "vendor", "anime.umd.min.js"),
+      (0, import_node_path38.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
+      (0, import_node_path38.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
     ]) {
       try {
-        const body = await (0, import_promises28.readFile)(candidate);
+        const body = await (0, import_promises29.readFile)(candidate);
         response.setHeader("cache-control", "public, max-age=604800, immutable");
         sendBinary(response, 200, "text/javascript; charset=utf-8", body);
         return;
@@ -23784,11 +23996,11 @@ function listen(server, startPort) {
   });
 }
 async function startLocalUiServer(options) {
-  const cwd = (0, import_node_path36.resolve)(options.cwd);
+  const cwd = (0, import_node_path38.resolve)(options.cwd);
   const scanRunner = options.scanRunner ?? defaultScanRunner;
   const autoScan = { state: "idle" };
   const fullCheck = new FullCheckService(cwd, options.fullCheck);
-  const guard = { token: (0, import_node_crypto5.randomBytes)(32).toString("base64url"), port: 0 };
+  const guard = { token: (0, import_node_crypto6.randomBytes)(32).toString("base64url"), port: 0 };
   const server = (0, import_node_http.createServer)((request, response) => {
     const pathname = new URL(request.url ?? "/", "http://127.0.0.1").pathname;
     if (!guardRequest(request, response, pathname, guard)) {
@@ -23801,7 +24013,7 @@ async function startLocalUiServer(options) {
   });
   const port = await listen(server, options.port ?? 4177);
   guard.port = port;
-  const hasArtifact = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
+  const hasArtifact = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
     () => true,
     () => false
   );
@@ -23840,16 +24052,16 @@ async function waitForServerShutdown() {
     process.once("SIGTERM", done);
   });
 }
-var import_node_http, import_node_child_process8, import_node_crypto5, import_promises28, import_node_os2, import_node_path36, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
+var import_node_http, import_node_child_process8, import_node_crypto6, import_promises29, import_node_os2, import_node_path38, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
 var init_server = __esm({
   "src/local-ui/server.ts"() {
     "use strict";
     import_node_http = require("node:http");
     import_node_child_process8 = require("node:child_process");
-    import_node_crypto5 = require("node:crypto");
-    import_promises28 = require("node:fs/promises");
+    import_node_crypto6 = require("node:crypto");
+    import_promises29 = require("node:fs/promises");
     import_node_os2 = require("node:os");
-    import_node_path36 = require("node:path");
+    import_node_path38 = require("node:path");
     init_cleanPlan();
     init_audit();
     init_heal();
@@ -23890,8 +24102,8 @@ var init_server = __esm({
     MCP_CONFIG_PATHS = [
       ".mcp.json",
       "mcp.json",
-      (0, import_node_path36.join)(".cursor", "mcp.json"),
-      (0, import_node_path36.join)(".vscode", "mcp.json")
+      (0, import_node_path38.join)(".cursor", "mcp.json"),
+      (0, import_node_path38.join)(".vscode", "mcp.json")
     ];
     MCP_PROVIDER_NEEDLES = {
       supabase: ["supabase", "@supabase/mcp", "mcp-server-supabase"],
@@ -23976,13 +24188,25 @@ function buildNextActionBlock(tasks, loopState) {
       requiresUserAction: false
     };
   }
-  const providerTask = tasks.find((t) => t.fixType === "provider-action");
-  if (providerTask) {
+  const userTask = tasks.find((t) => t.fixType === "provider-action" || t.fixType === "repo-code" && t.requiresUserAction);
+  if (userTask?.fixType === "repo-code") {
+    return {
+      ...base,
+      type: "repo-code",
+      gapId: userTask.gapId,
+      title: userTask.title,
+      mcpTool: userTask.mcpTool,
+      mcpArgs: userTask.mcpArgs,
+      fallbackCommand: userTask.mcpArgs ? `npx -y viberaven --heal --apply --gap ${userTask.gapId} --yes` : void 0,
+      requiresUserAction: true
+    };
+  }
+  if (userTask) {
     return {
       ...base,
       type: "provider-action",
-      gapId: providerTask.gapId,
-      title: providerTask.title,
+      gapId: userTask.gapId,
+      title: userTask.title,
       requiresUserAction: true
     };
   }
@@ -24050,9 +24274,9 @@ var init_nextActionBlock = __esm({
 function defaultMcpConfigPaths() {
   const home = (0, import_node_os3.homedir)();
   return [
-    (0, import_node_path37.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path37.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path37.join)(home, ".gemini", "antigravity", "mcp_config.json")
+    (0, import_node_path39.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path39.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path39.join)(home, ".gemini", "antigravity", "mcp_config.json")
   ];
 }
 function resolveConfigPaths() {
@@ -24081,11 +24305,11 @@ function findServerEntry(servers, provider2) {
 function findProviderMcpConfig(provider2, configPaths) {
   const paths = configPaths ?? resolveConfigPaths();
   for (const path of paths) {
-    if (!(0, import_node_fs13.existsSync)(path)) {
+    if (!(0, import_node_fs14.existsSync)(path)) {
       continue;
     }
     try {
-      const raw = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
+      const raw = JSON.parse((0, import_node_fs14.readFileSync)(path, "utf8"));
       const servers = parseMcpServers(raw);
       if (!servers) {
         continue;
@@ -24129,13 +24353,13 @@ async function verifyProviderGap(options) {
     fallbackCommand: FALLBACK_COMMAND
   };
 }
-var import_node_fs13, import_node_os3, import_node_path37, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
+var import_node_fs14, import_node_os3, import_node_path39, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
 var init_providerMcpBridge = __esm({
   "src/providerMcpBridge.ts"() {
     "use strict";
-    import_node_fs13 = require("node:fs");
+    import_node_fs14 = require("node:fs");
     import_node_os3 = require("node:os");
-    import_node_path37 = require("node:path");
+    import_node_path39 = require("node:path");
     FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
     SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
   }
@@ -24166,8 +24390,8 @@ Usage:
   viberaven check [--json] [--quiet] [path]
                        Local production check: one line per finding, exit 1 on blockers
 
-  viberaven fix [--gap <id>] [path]
-                       Apply a safe automated fix for a known gap (heal recipe)
+  viberaven fix [--gap <id>] [--dry-run] [path]
+                       Apply a safe automated fix for a known gap (heal recipe); --dry-run previews only
 
   viberaven scan [--open] [--json] [path]
                        Full local scan; writes .viberaven/ artifacts
@@ -24315,7 +24539,7 @@ function isBooleanFlag(command, key) {
   if (key === "quiet" && command === "check") return true;
   if (key === "vercel-supabase" && command === "audit") return true;
   if (key === "json" && command === "validate-npm-package") return true;
-  if (key === "dry-run" && command === "init") return true;
+  if (key === "dry-run" && (command === "init" || command === "fix")) return true;
   if (key === "agents" && command === "doctor") return true;
   return false;
 }
@@ -24346,7 +24570,7 @@ async function cmdProviderVerify(flags, positional) {
   return result.verified ? 0 : 1;
 }
 async function cmdStatus(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -24385,7 +24609,7 @@ async function cmdStatus(flags, positional) {
   return 0;
 }
 async function runScanCommand(flags, positional, options) {
-  const workspacePath = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
+  const workspacePath = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
   if (!options?.deferMachineOutput) {
     console.log(`Scanning ${workspacePath}\u2026 (local, offline)`);
   }
@@ -24412,7 +24636,7 @@ async function runScanCommand(flags, positional, options) {
     printNextActionBlock(block);
     printProviderActionBlock(tasks);
     try {
-      const manifest = JSON.parse(await (0, import_promises29.readFile)(paths.actionsPath, "utf8"));
+      const manifest = JSON.parse(await (0, import_promises30.readFile)(paths.actionsPath, "utf8"));
       console.log(renderActionSurface(manifest, { limit: 5 }).trimEnd());
     } catch (error) {
       console.warn(error instanceof Error ? error.message : String(error));
@@ -24429,7 +24653,7 @@ async function runScanCommand(flags, positional, options) {
   return { exitCode: 0, artifacts: paths };
 }
 async function cmdReport(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
   try {
     const paths = await refreshReportFromDisk(startDir);
     console.log(`Report refreshed: ${paths.reportPath}`);
@@ -24451,7 +24675,7 @@ async function cmdReport(flags, positional) {
   }
 }
 async function cmdPrompt(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -24548,7 +24772,7 @@ async function main() {
   const wantsJsonl = hasFlag(flags, "jsonl");
   const wantsStrict = hasFlag(flags, "strict");
   if (flags.condense) {
-    const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+    const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
     const result = await runCondenseCommand({ cwd });
     console.log(`VibeRaven context map refreshed: ${result.contextMapPath}`);
     return 0;
@@ -24568,7 +24792,7 @@ async function main() {
   }
   if (!command && flags.verify === true && typeof flags.action === "string") {
     return runVerifyActionCommand({
-      cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+      cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
       actionId: flags.action
     });
   }
@@ -24579,7 +24803,7 @@ async function main() {
       console.error("VibeRaven could not produce machine output because scan artifacts were not written.");
       return 3;
     }
-    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises29.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
+    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises30.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
     const strictExitCode = wantsStrict && gateResult ? exitCodeForStrictGate(gateResult, { failOnWarnings: flags.strict === "warning" }) : scanResult.exitCode;
     if (wantsJson && gateResult) {
       process.stdout.write(renderGateResultJson(gateResult));
@@ -24601,7 +24825,7 @@ async function main() {
       env: process.env
     });
     if (mode === "local-ui") {
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
       const handle = await startLocalUiServer({ cwd });
       console.log(`VibeRaven local UI: ${handle.url}`);
       await waitForServerShutdown();
@@ -24621,7 +24845,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     case "ui": {
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
       const envPort = Number(process.env.PORT);
       const handle = await startLocalUiServer({ cwd, port: Number.isFinite(envPort) && envPort > 0 ? envPort : void 0 });
       console.log(`VibeRaven local UI: ${handle.url}`);
@@ -24633,31 +24857,33 @@ async function main() {
       return cmdStatus(flags, positional);
     case "check":
       return runCheckCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json),
         quiet: Boolean(flags.quiet)
       });
     case "fix": {
-      const fixCwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const fixCwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
       const gapId = typeof flags.gap === "string" ? flags.gap : void 0;
       if (!gapId) {
         const artifact = await loadLastArtifact(fixCwd).catch(() => void 0);
-        const fixable = artifact ? buildTaskList(artifact).filter((t) => t.fixType === "repo-code" && !t.requiresUserAction) : [];
+        const fixable = artifact ? buildTaskList(artifact).filter((t) => t.fixType === "repo-code" && t.mcpTool === "viberaven_heal_apply") : [];
         if (fixable.length === 0) {
           console.log("Nothing to fix automatically. Run `viberaven check` first, then `viberaven fix --gap <id>`.");
           return artifact ? 0 : 1;
         }
         console.log("Fixable gaps:");
         for (const task of fixable) {
-          console.log(`  viberaven fix --gap ${task.gapId}   ${task.title}`);
+          const ask = task.requiresUserAction ? task.action?.match(/^Ask the user first: ([^.]+)\./)?.[1] : void 0;
+          console.log(`  viberaven fix --gap ${task.gapId}   ${task.title}${ask ? `   (asks first: ${ask})` : ""}`);
         }
         return 0;
       }
+      const dryRun = flags["dry-run"] === true;
       const result = await runHealCommand({
         cwd: fixCwd,
-        mode: "apply",
+        mode: dryRun ? "plan" : "apply",
         gapId,
-        yes: true,
+        yes: !dryRun,
         noVerify: flags["no-verify"] === true
       });
       console.log(JSON.stringify(result, null, 2));
@@ -24665,19 +24891,19 @@ async function main() {
     }
     case "actions":
       return runActionsCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "preview":
       return runPreviewCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
         agentMode: flags["agent-mode"] === true,
         json: Boolean(flags.json)
       });
     case "next":
       return runNextCommand({
         json: Boolean(flags.json),
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "guide": {
       const provider2 = positional[0];
@@ -24711,7 +24937,7 @@ async function main() {
     case "provider-verify":
       return cmdProviderVerify(flags, positional);
     case "init": {
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
       const agents = typeof flags.agents === "string" ? flags.agents : void 0;
       return runInitCommand({
         cwd,
@@ -24725,7 +24951,7 @@ async function main() {
         return 1;
       }
       return runDoctorAgentsCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "validate-npm-package":
       return runValidateNpmPackageCommand({
@@ -24738,7 +24964,7 @@ async function main() {
         return 1;
       }
       return runAuditCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "clean": {
@@ -24746,7 +24972,7 @@ async function main() {
         console.error("Usage: viberaven clean --plan [path]");
         return 1;
       }
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
       const plan = buildContextCleanupPlan({ projectRoot: cwd, files: await collectCleanupFiles(cwd) });
       const outputPath = await writeCleanupPlan(cwd, plan);
       console.log(`Wrote ${outputPath}
@@ -24756,9 +24982,9 @@ async function main() {
     }
     case "rls-test":
       return runRlsTestCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
-        matrix: typeof flags.matrix === "string" ? (0, import_node_path38.resolve)(process.cwd(), flags.matrix) : void 0,
-        migrations: typeof flags.migrations === "string" ? (0, import_node_path38.resolve)(process.cwd(), flags.migrations) : void 0,
+        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        matrix: typeof flags.matrix === "string" ? (0, import_node_path40.resolve)(process.cwd(), flags.matrix) : void 0,
+        migrations: typeof flags.migrations === "string" ? (0, import_node_path40.resolve)(process.cwd(), flags.migrations) : void 0,
         json: Boolean(flags.json)
       });
     default:
@@ -24767,11 +24993,11 @@ async function main() {
       return 1;
   }
 }
-var import_promises29, import_node_path38, STACK_AREAS;
+var import_promises30, import_node_path40, STACK_AREAS;
 var init_cli = __esm({
   "src/cli.ts"() {
-    import_promises29 = require("node:fs/promises");
-    import_node_path38 = require("node:path");
+    import_promises30 = require("node:fs/promises");
+    import_node_path40 = require("node:path");
     init_config();
     init_runScan();
     init_artifacts2();