@viberaven/cli 1.5.2 → 1.6.0

package/dist/cli.js

@@ -6970,7 +6970,7 @@ var init_mockSupabaseVerifier = __esm({
             providerObservationMet: false,
             fixType: "mcp-connect",
             severity: tables.length > 0 ? "critical" : "info",
-            repoSignals: tables.map((table) => `table referenced: ${table}`),
+            repoSignals: tables.map((table2) => `table referenced: ${table2}`),
             providerSignals: ["Supabase policy list API or MCP"],
             requiredEvidence: ["Policies exist for tables used in application code"]
           }),
@@ -6986,7 +6986,7 @@ var init_mockSupabaseVerifier = __esm({
             providerObservationMet: false,
             fixType: "provider-config",
             severity: "warning",
-            repoSignals: tables.map((table) => `.from("${table}")`),
+            repoSignals: tables.map((table2) => `.from("${table2}")`),
             providerSignals: ["Live table policy map"],
             requiredEvidence: ["Each referenced public table has RLS + policy in production"]
           })
@@ -7008,7 +7008,7 @@ var init_mockSupabaseVerifier = __esm({
             providerActual: "Live RLS state unknown without Supabase MCP",
             severity: "critical",
             suggestedFix: "repo-fix",
-            evidenceRefs: tables.map((table) => `table: ${table}`)
+            evidenceRefs: tables.map((table2) => `table: ${table2}`)
           });
         }
         if (rlsInRepo) {
@@ -8303,7 +8303,7 @@ function replayProject(files, root) {
     }
   }
   const replayed = [...tables.values()];
-  for (const table of replayed) table.root = root;
+  for (const table2 of replayed) table2.root = root;
   return { tables: replayed, functions: [...functions.values()], statementsSeen };
 }
 function isSqlTestPath(path) {
@@ -8574,38 +8574,38 @@ function analyzeRls(replay) {
   const noPolicies = [];
   const permissive = [];
   const rlsEnabledEvidence = [];
-  for (const table of replay.tables) {
-    if (table.schema !== "public") continue;
-    if (table.rls) {
-      rlsEnabledEvidence.push(`${at(table.rlsLoc)}: row level security enabled on ${safe(table.display)}`);
+  for (const table2 of replay.tables) {
+    if (table2.schema !== "public") continue;
+    if (table2.rls) {
+      rlsEnabledEvidence.push(`${at(table2.rlsLoc)}: row level security enabled on ${safe(table2.display)}`);
     }
-    if (!table.rls && (table.created || table.disabledLoc)) {
-      const where = table.disabledLoc ?? table.arrivedLoc ?? table.created;
+    if (!table2.rls && (table2.created || table2.disabledLoc)) {
+      const where = table2.disabledLoc ?? table2.arrivedLoc ?? table2.created;
       const risk = "Anyone holding the anon key your frontend ships can read and change every row through the Data API (unless the table's grants were revoked).";
-      const message = table.disabledLoc ? `${table.display} has row level security turned off at ${at(table.disabledLoc)}. ${risk}` : table.arrivedLoc ? `${table.display} is moved into public at ${at(table.arrivedLoc)} without row level security, and no later migration enables it. ${risk}` : `${table.display} is created at ${at(table.created)} and no migration enables row level security on it. ${risk}`;
+      const message = table2.disabledLoc ? `${table2.display} has row level security turned off at ${at(table2.disabledLoc)}. ${risk}` : table2.arrivedLoc ? `${table2.display} is moved into public at ${at(table2.arrivedLoc)} without row level security, and no later migration enables it. ${risk}` : `${table2.display} is created at ${at(table2.created)} and no migration enables row level security on it. ${risk}`;
       missingRls.push({
         id: "rls_disabled",
         severity: "critical",
         message: safe(message),
         file: where?.file,
         line: where?.line,
-        table: table.display,
-        fix: `alter table ${table.display} enable row level security;`
+        table: table2.display,
+        fix: `alter table ${table2.display} enable row level security;`
       });
     }
-    if (table.rls && table.policies.size === 0) {
+    if (table2.rls && table2.policies.size === 0) {
       noPolicies.push({
         id: "rls_no_policies",
         severity: "info",
         message: safe(
-          `${table.display} has row level security on and no policies, so it is locked to the service role: the browser client gets no rows back and cannot write. Fine for server-only tables; add policies if the app reads it from the frontend.`
+          `${table2.display} has row level security on and no policies, so it is locked to the service role: the browser client gets no rows back and cannot write. Fine for server-only tables; add policies if the app reads it from the frontend.`
         ),
-        file: table.rlsLoc?.file,
-        line: table.rlsLoc?.line,
-        table: table.display
+        file: table2.rlsLoc?.file,
+        line: table2.rlsLoc?.line,
+        table: table2.display
       });
     }
-    for (const policy of table.policies.values()) {
+    for (const policy of table2.policies.values()) {
       if (!policy.permissive) continue;
       const roles = policy.roles.filter((r) => r === "public" || r === "anon" || r === "authenticated");
       if (roles.length === 0) continue;
@@ -8618,11 +8618,11 @@ function analyzeRls(replay) {
           id: "rls_policy_allows_all_read",
           severity: "high",
           message: safe(
-            `Policy "${policy.name}" on ${table.display} (${at(policy.loc)}) lets ${who} read every row: using (true). Fine for truly public content; wrong for anything per-user.`
+            `Policy "${policy.name}" on ${table2.display} (${at(policy.loc)}) lets ${who} read every row: using (true). Fine for truly public content; wrong for anything per-user.`
           ),
           file: policy.loc.file,
           line: policy.loc.line,
-          table: table.display,
+          table: table2.display,
           policy: policy.name
         });
         continue;
@@ -8650,10 +8650,10 @@ function analyzeRls(replay) {
       permissive.push({
         id: "rls_policy_allows_all_write",
         severity,
-        message: safe(`Policy "${policy.name}" on ${table.display} (${at(policy.loc)}) lets ${who} ${verb}: ${clause}.`),
+        message: safe(`Policy "${policy.name}" on ${table2.display} (${at(policy.loc)}) lets ${who} ${verb}: ${clause}.`),
         file: policy.loc.file,
         line: policy.loc.line,
-        table: table.display,
+        table: table2.display,
         policy: policy.name
       });
     }
@@ -8733,35 +8733,35 @@ function analyzeGrants(replay, uses, autoExpose) {
     if (existing) use.ops.forEach((op) => existing.ops.add(op));
     else byName.set(use.table, { ...use, ops: new Set(use.ops) });
   }
-  for (const table of replay.tables) {
-    if (table.schema !== "public") continue;
-    const granted = table.grants.size > 0;
-    if (granted && !table.rls) {
-      const roles2 = [...new Set([...table.grants].map((g2) => g2.split(":")[0]))].join(" and ");
+  for (const table2 of replay.tables) {
+    if (table2.schema !== "public") continue;
+    const granted = table2.grants.size > 0;
+    if (granted && !table2.rls) {
+      const roles2 = [...new Set([...table2.grants].map((g2) => g2.split(":")[0]))].join(" and ");
       out.push({
         id: "data_api_grant_without_rls",
         severity: "critical",
         message: safe(
-          `${table.display} is granted to ${roles2} (${at(table.grantLoc)}) but row level security is off. A grant without RLS is the dangerous combination: the Data API serves every row to that role. Enable RLS and add policies before granting.`
+          `${table2.display} is granted to ${roles2} (${at(table2.grantLoc)}) but row level security is off. A grant without RLS is the dangerous combination: the Data API serves every row to that role. Enable RLS and add policies before granting.`
         ),
-        file: table.grantLoc?.file,
-        line: table.grantLoc?.line,
-        table: table.display,
-        fix: `alter table ${table.display} enable row level security;`
+        file: table2.grantLoc?.file,
+        line: table2.grantLoc?.line,
+        table: table2.display,
+        fix: `alter table ${table2.display} enable row level security;`
       });
       continue;
     }
-    if (!table.created || !table.rls) continue;
+    if (!table2.created || !table2.rls) continue;
     const configOff = autoExpose && !autoExpose.value ? autoExpose : void 0;
-    const revokedAtCreate = table.defaultsRevoked ?? /* @__PURE__ */ new Set();
+    const revokedAtCreate = table2.defaultsRevoked ?? /* @__PURE__ */ new Set();
     if (revokedAtCreate.size === 0 && !configOff) continue;
-    const use = byName.get(table.name);
+    const use = byName.get(table2.name);
     if (!use) continue;
-    const lacks = (role, priv) => !table.grants.has(`${role}:${priv}`) && (configOff !== void 0 || revokedAtCreate.has(`${role}:${priv}`));
+    const lacks = (role, priv) => !table2.grants.has(`${role}:${priv}`) && (configOff !== void 0 || revokedAtCreate.has(`${role}:${priv}`));
     const rolesFor = (priv) => {
-      if (!table.rls) return [...DATA_API_ROLES];
+      if (!table2.rls) return [...DATA_API_ROLES];
       return expandRoles(
-        [...table.policies.values()].filter((p2) => p2.permissive && (p2.command === priv || p2.command === "all")).flatMap((p2) => p2.roles)
+        [...table2.policies.values()].filter((p2) => p2.permissive && (p2.command === priv || p2.command === "all")).flatMap((p2) => p2.roles)
       );
     };
     const blocked = /* @__PURE__ */ new Map();
@@ -8773,17 +8773,17 @@ function analyzeGrants(replay, uses, autoExpose) {
     if (blocked.size === 0) continue;
     const privs = [...blocked.keys()];
     const roles = [...new Set([...blocked.values()].flat())];
-    const reason = configOff ? `${configOff.file}:${configOff.line} sets auto_expose_new_tables = false, so new public tables get no default grants` : `the default grants for new public tables are revoked at ${at(table.defaultsRevokedLoc)}`;
-    const fix = `grant ${privs.join(", ")} on table ${table.display} to ${roles.join(", ")};`;
+    const reason = configOff ? `${configOff.file}:${configOff.line} sets auto_expose_new_tables = false, so new public tables get no default grants` : `the default grants for new public tables are revoked at ${at(table2.defaultsRevokedLoc)}`;
+    const fix = `grant ${privs.join(", ")} on table ${table2.display} to ${roles.join(", ")};`;
     out.push({
       id: "data_api_grant_missing",
       severity: "warning",
       message: safe(
-        `${table.display} is used from the client (${use.file}:${use.line}) for ${privs.join(", ")}, but ${roles.join(" and ")} ${roles.length === 1 ? "has" : "have"} no ${privs.join("/")} grant on it: ${reason}, and no migration grants it back. Those calls get "permission denied for table ${table.name}". Add to a migration: ${fix}`
+        `${table2.display} is used from the client (${use.file}:${use.line}) for ${privs.join(", ")}, but ${roles.join(" and ")} ${roles.length === 1 ? "has" : "have"} no ${privs.join("/")} grant on it: ${reason}, and no migration grants it back. Those calls get "permission denied for table ${table2.name}". Add to a migration: ${fix}`
       ),
-      file: table.created.file,
-      line: table.created.line,
-      table: table.display,
+      file: table2.created.file,
+      line: table2.created.line,
+      table: table2.display,
       fix
     });
   }
@@ -10291,10 +10291,10 @@ async function listTrackedIgnoredFiles(workspacePath) {
     return { paths: [], incomplete: false };
   }
   try {
-    const git = await safeGitInvocation(workspacePath, ["ls-files", "-c", "-i", "--exclude-standard", "-z"]);
-    const { stdout } = await execFileAsync2("git", git.args, {
+    const git2 = await safeGitInvocation(workspacePath, ["ls-files", "-c", "-i", "--exclude-standard", "-z"]);
+    const { stdout } = await execFileAsync2("git", git2.args, {
       cwd: workspacePath,
-      env: git.env,
+      env: git2.env,
       timeout: GIT_TIMEOUT_MS,
       maxBuffer: GIT_MAX_OUTPUT_BYTES,
       windowsHide: true
@@ -10318,14 +10318,14 @@ async function collectDatabaseEvidence(workspacePath, scan) {
       [...scan.fileTree.split("\n"), ...scan.secretsFound, ...walk.listed, ...trackedIgnored.paths].map((p2) => normalizedPath(p2.trim()))
     )
   ].filter((p2) => p2.length > 0 && !isOwnArtifact(p2) && !fullyLoaded.has(p2));
-  const wanted = [
+  const wanted2 = [
     ...candidates.filter((p2) => EVIDENCE_MANIFEST.test(p2)),
     ...candidates.filter((p2) => !EVIDENCE_MANIFEST.test(p2) && EVIDENCE_CODE.test(p2))
   ];
-  if (wanted.length > EVIDENCE_MAX_FILES) incomplete = true;
+  if (wanted2.length > EVIDENCE_MAX_FILES) incomplete = true;
   const files = [];
   let bytesRead = 0;
-  for (const path of wanted.slice(0, EVIDENCE_MAX_FILES)) {
+  for (const path of wanted2.slice(0, EVIDENCE_MAX_FILES)) {
     if (bytesRead >= EVIDENCE_MAX_TOTAL_BYTES) {
       incomplete = true;
       break;
@@ -10605,6 +10605,25 @@ function assessStripeWebhooks(files) {
   }
   return { verified: verified.sort(), unverified: unverified.sort((a, b3) => a.path < b3.path ? -1 : 1) };
 }
+function stripeUsageEvidence(scan, files) {
+  const dependency = (scan.packageDeps ?? []).find((dep) => {
+    const name = dep.toLowerCase();
+    return name === "stripe" || name.startsWith("@stripe/");
+  });
+  if (dependency) return { kind: "dependency", dependency };
+  const sorted = [...files].sort((a, b3) => a.path < b3.path ? -1 : 1);
+  for (const file of sorted) {
+    const path = file.path.replace(/\\/g, "/");
+    if (!CODE_FILE.test(path) || TEST_FILE.test(path)) continue;
+    const match = stripComments2(file.content).match(STRIPE_CODE_USE);
+    if (match) return { kind: "code", path, signal: match[0] };
+  }
+  return void 0;
+}
+function stripeCodeOnlyInEdgeFunctions(files) {
+  const users = files.map((file) => ({ path: file.path.replace(/\\/g, "/"), content: file.content })).filter((file) => CODE_FILE.test(file.path) && !TEST_FILE.test(file.path) && STRIPE_CODE_USE.test(stripComments2(file.content)));
+  return users.length > 0 && users.every((file) => /(^|\/)supabase\/functions\//.test(file.path));
+}
 function codeFilesFor(scan, fullCopies = []) {
   const full = new Map(fullCopies.map((f) => [f.path.replace(/\\/g, "/"), f.content]));
   const merged = /* @__PURE__ */ new Map();
@@ -10650,8 +10669,8 @@ function noReleaseTagsSeed(commitCount) {
 }
 async function detectReleaseTagGap(workspacePath) {
   try {
-    const git = (args) => safeGitInvocation(workspacePath, args).then((call) => execFileAsync3("git", call.args, { cwd: workspacePath, env: call.env, windowsHide: true }));
-    const [tags, count] = await Promise.all([git(["tag", "--list"]), git(["rev-list", "--count", "HEAD"])]);
+    const git2 = (args) => safeGitInvocation(workspacePath, args).then((call) => execFileAsync3("git", call.args, { cwd: workspacePath, env: call.env, windowsHide: true }));
+    const [tags, count] = await Promise.all([git2(["tag", "--list"]), git2(["rev-list", "--count", "HEAD"])]);
     const tagCount = tags.stdout.split("\n").filter((line) => line.trim().length > 0).length;
     const commitCount = Number.parseInt(count.stdout.trim(), 10) || 0;
     if (tagCount === 0 && commitCount >= 20) {
@@ -10891,7 +10910,8 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
     });
   }
   if (signals.hasStripe) {
-    const webhooks = assessStripeWebhooks(codeFilesFor(scan, extra.codeFiles));
+    const stripeFiles = codeFilesFor(scan, extra.codeFiles);
+    const webhooks = assessStripeWebhooks(stripeFiles);
     if (webhooks.unverified.length > 0) {
       const lines = webhooks.unverified.map((u2) => `${u2.path} (${u2.missing.join(", ")})`);
       seeds.push({
@@ -10904,15 +10924,20 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
         primaryMapCategory: "payments"
       });
     } else if (webhooks.verified.length === 0) {
-      seeds.push({
-        id: "missing_stripe_webhook",
-        category: "MISSING FEATURES",
-        severity: "warning",
-        title: "Stripe installed but no webhook handler",
-        detail: "Stripe is a dependency but no webhook route or signature verification (constructEvent) was found. Payment state will silently drift from app state.",
-        copyPrompt: "Add a Stripe webhook route (e.g. app/api/webhooks/stripe/route.ts) that verifies the signature with stripe.webhooks.constructEvent and handles checkout.session.completed plus subscription lifecycle events.",
-        primaryMapCategory: "payments"
-      });
+      const usage = stripeUsageEvidence(scan, stripeFiles);
+      if (usage) {
+        const seen = usage.kind === "dependency" ? `package.json lists ${usage.dependency}` : `${usage.path} uses Stripe (${usage.signal}) and package.json does not list stripe`;
+        seeds.push({
+          id: "missing_stripe_webhook",
+          category: "MISSING FEATURES",
+          severity: "warning",
+          title: usage.kind === "dependency" ? "Stripe installed but no webhook handler" : "Stripe used but no webhook handler",
+          detail: `${seen}, but no webhook route or signature verification (constructEvent) was found. Payment state will silently drift from app state.`,
+          // Stripe code that only runs in Supabase Edge Functions is verified there, on Deno, not in a Next.js route.
+          copyPrompt: stripeCodeOnlyInEdgeFunctions(stripeFiles) ? STRIPE_EDGE_WEBHOOK_PROMPT : (usage.kind === "code" ? "Add the stripe package, then add" : "Add") + " a Stripe webhook route (e.g. app/api/webhooks/stripe/route.ts) that verifies the signature with stripe.webhooks.constructEvent and handles checkout.session.completed plus subscription lifecycle events.",
+          primaryMapCategory: "payments"
+        });
+      }
     }
   }
   {
@@ -11112,7 +11137,7 @@ async function buildLocalStationOutput(input) {
     productionChecklist: checklistFrom(seeds)
   };
 }
-var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
+var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, STRIPE_CODE_USE, STRIPE_EDGE_WEBHOOK_PROMPT, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
 var init_localStation = __esm({
   "src/localStation.ts"() {
     "use strict";
@@ -11204,6 +11229,8 @@ var init_localStation = __esm({
     STRIPE_EVENT_TYPE = /['"`](?:checkout\.session|customer\.subscription|invoice|payment_intent|charge)\.[a-z_.]+['"`]/;
     REQUEST_HANDLER = /export\s+(?:async\s+)?function\s+POST\b|export\s+const\s+POST\b|export\s+default\s+(?:async\s+)?function\s*[\w$]*\s*\(\s*(?:req|request)\b|export\s+(?:async\s+function|function|const)\s+handler\b|\b[A-Za-z_$][\w$]*\.post\s*\(|Deno\.serve\s*\(|\bserve\s*\(|addEventListener\(\s*['"]fetch|export\s+default\s*\{\s*(?:async\s+)?fetch\b/;
     TEST_FILE = /(^|\/)(?:__tests__|__mocks__)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/i;
+    STRIPE_CODE_USE = /\bSTRIPE_(?:SECRET_KEY|WEBHOOK_SECRET)\b|\bapi\.stripe\.com\b|\bfrom\s*['"](?:npm:)?stripe(?:@[^'"]*)?['"]|\brequire\(\s*['"]stripe['"]\s*\)|\bimport\(\s*['"](?:npm:)?stripe(?:@[^'"]*)?['"]\s*\)/;
+    STRIPE_EDGE_WEBHOOK_PROMPT = "In the Supabase Edge Function that receives Stripe events (add one under supabase/functions/ if there is none, e.g. supabase/functions/stripe-webhook/index.ts), read the raw body with await req.text(), read the Stripe-Signature header, and verify both with await stripe.webhooks.constructEventAsync(body, signature, Deno.env.get('STRIPE_WEBHOOK_SECRET'), undefined, Stripe.createSubtleCryptoProvider()) before trusting event.type. Return 400 when verification throws, and handle checkout.session.completed plus subscription lifecycle events.";
     AUDIT_FINDING_GAPS = {
       rls_policy_allows_all_write: {
         title: "A policy lets anyone write every row",
@@ -12391,7 +12418,81 @@ var init_agentSummary = __esm({
   }
 });
 
+// src/heal/rlsMigrationTarget.ts
+function rlsEnableStatements(tables) {
+  return [...new Set(tables)].map((table2) => `alter table ${table2} enable row level security;`);
+}
+function migrationStamp(now) {
+  return now.toISOString().replace(/\D/g, "").slice(0, 14);
+}
+function rlsMigrationTarget(cwd, evidence, now = /* @__PURE__ */ new Date()) {
+  if (evidence.length === 0) return { ok: false, reason: "No table without row level security was found in the repo SQL." };
+  const statementList = rlsEnableStatements(evidence.map((entry) => entry.table)).join(" ");
+  const turnedOff = evidence.filter((entry) => entry.turnedOff);
+  if (turnedOff.length > 0) {
+    const where = turnedOff.map((entry) => `${entry.table} (${entry.file.replace(/\\/g, "/")})`).join(", ");
+    return {
+      ok: false,
+      reason: `The latest migration that touches ${where} turns row level security off on purpose, so VibeRaven will not turn it back on automatically. If the user wants it on, add these statements by hand in a new migration, with the policies the app needs: ${statementList}`
+    };
+  }
+  const source = evidence[0].file.replace(/\\/g, "/");
+  const dir = import_node_path11.posix.dirname(source);
+  if (import_node_path11.posix.basename(dir) !== "migrations") {
+    return {
+      ok: false,
+      reason: `The tables come from ${source}, which is not in a migrations folder, so VibeRaven will not guess where a migration goes. Add these statements by hand where this project keeps its schema: ${statementList}`
+    };
+  }
+  let existing;
+  try {
+    existing = (0, import_node_fs6.readdirSync)((0, import_node_path11.join)(cwd, dir)).filter((file) => file.endsWith(".sql")).sort();
+  } catch {
+    return { ok: false, reason: `VibeRaven could not read ${dir}. Add these statements by hand in a new migration: ${statementList}` };
+  }
+  const otherNaming = existing.find((file) => !TIMESTAMPED_MIGRATION.test(file));
+  if (otherNaming) {
+    return {
+      ok: false,
+      reason: `The migrations in ${dir} are not named <14-digit timestamp>_name.sql (for example ${otherNaming}), so a timestamped file from VibeRaven could run in the wrong order next to them. Add these statements by hand in a new migration that follows this project's naming: ${statementList}`
+    };
+  }
+  const name = `${migrationStamp(now)}_viberaven_enable_rls.sql`;
+  const last = existing[existing.length - 1];
+  if (last && name <= last) {
+    return {
+      ok: false,
+      reason: `A new migration named ${name} would not run after ${last} in ${dir}, so VibeRaven will not write it. Add these statements by hand in a migration that runs last: ${statementList}`
+    };
+  }
+  return { ok: true, file: `${dir}/${name}` };
+}
+var import_node_fs6, import_node_path11, RLS_TURNED_OFF_PHRASE, RLS_ASK_FIRST, RLS_NO_POLICIES_WARNING, TIMESTAMPED_MIGRATION;
+var init_rlsMigrationTarget = __esm({
+  "src/heal/rlsMigrationTarget.ts"() {
+    "use strict";
+    import_node_fs6 = require("node:fs");
+    import_node_path11 = require("node:path");
+    RLS_TURNED_OFF_PHRASE = "has row level security turned off at";
+    RLS_ASK_FIRST = "Ask the user first: enabling RLS without policies makes browser reads return no rows until policies exist.";
+    RLS_NO_POLICIES_WARNING = "This migration enables row level security with no policies. Until you add policies, the anon and authenticated roles get no rows from these tables through the Data API, so browser reads return nothing and browser writes fail. `check` then reports the tables only as info (rls_no_policies), not as a blocker. Add the policies the app needs before you apply the migration to the database.";
+    TIMESTAMPED_MIGRATION = /^\d{14}_.+\.sql$/;
+  }
+});
+
 // src/buildTaskList.ts
+function rlsMigrationFile(gap) {
+  if (gap.id !== "rls_disabled" || typeof gap.detail !== "string") return void 0;
+  const evidence = gap.detail.split(/\r?\nEvidence:\r?\n/)[1];
+  if (!evidence) return void 0;
+  return evidence.match(/^- ([^\s:][^:\n]*\.sql):\d+: /m)?.[1];
+}
+function rlsEvidence2(detail) {
+  const evidence = detail.split(/\r?\nEvidence:\r?\n/)[1] ?? "";
+  return [...evidence.matchAll(/^- ([^\s:][^:\n]*\.sql):\d+: (\S+) (is created at|has row level security turned off at|is moved into public)/gm)].map(
+    (match) => ({ file: match[1], table: match[2], turnedOff: match[3] === RLS_TURNED_OFF_PHRASE })
+  );
+}
 function hasRecipe(gapId) {
   if (KNOWN_RECIPE_GAP_IDS.has(gapId)) return true;
   const lower = gapId.toLowerCase();
@@ -12445,7 +12546,8 @@ function buildTaskList(artifact) {
   return sorted.map((gap, index) => {
     const id = `TASK-${String(index + 1).padStart(3, "0")}`;
     let fixType;
-    if (hasRecipe(gap.id)) {
+    const migrationFile = rlsMigrationFile(gap);
+    if (hasRecipe(gap.id) || migrationFile) {
       fixType = "repo-code";
     } else if (hasPlaybook(gap)) {
       fixType = "provider-action";
@@ -12461,7 +12563,21 @@ function buildTaskList(artifact) {
       verifyCommand: PUBLIC_VERIFY_COMMAND,
       requiresUserAction: fixType !== "repo-code"
     };
-    if (fixType === "repo-code") {
+    if (fixType === "repo-code" && !hasRecipe(gap.id) && migrationFile) {
+      base.requiresUserAction = true;
+      base.file = migrationFile;
+      const target = rlsMigrationTarget(artifact.workspacePath, rlsEvidence2(gap.detail));
+      if (target.ok) {
+        base.mcpTool = "viberaven_heal_apply";
+        base.mcpArgs = { gap: gap.id };
+        base.action = `${RLS_ASK_FIRST} If they agree, \`npx -y viberaven fix --gap rls_disabled\` writes it: a new migration next to this one that enables row level security on each table listed in the gap detail. It adds no policies: add the ones the app needs, then apply the migration to the database the way this project applies migrations.`;
+      } else {
+        base.action = `${RLS_ASK_FIRST} ${target.reason} Add the policies the app needs too, then apply the change to the database the way this project applies schema changes.`;
+      }
+      if (gap.copyPrompt) {
+        base.exactFix = gap.copyPrompt.trim();
+      }
+    } else if (fixType === "repo-code") {
       base.mcpTool = "viberaven_heal_apply";
       base.mcpArgs = { gap: gap.id, yes: true };
       base.requiresUserAction = false;
@@ -12534,6 +12650,7 @@ var init_buildTaskList = __esm({
   "src/buildTaskList.ts"() {
     "use strict";
     init_commands();
+    init_rlsMigrationTarget();
     init_loadPlaybook();
     init_types2();
     init_menu();
@@ -12555,8 +12672,9 @@ var init_buildTaskList = __esm({
       "missing_csp_header",
       "missing_rate_limit",
       "eslint_restricted_imports"
-      // NOTE: 'rls_disabled' is intentionally NOT here — it is provider-action only,
-      // canAutoApply=false, and should be classified as 'provider-action' by buildTaskList.
+      // NOTE: 'rls_disabled' is intentionally NOT here. When the finding comes from repo SQL it is a repo action whose
+      // recipe writes a new migration (see rlsMigrationFile and heal/recipes/supabaseRls.ts); without SQL evidence it
+      // stays a provider action and heal refuses.
     ]);
   }
 });
@@ -12933,25 +13051,25 @@ var init_reportHtml = __esm({
 function getBundledReportAssetsDir() {
   const base = __dirname;
   const candidates = [
-    (0, import_node_path11.join)(base, "report"),
-    (0, import_node_path11.join)(base, "..", "assets", "report"),
-    (0, import_node_path11.join)(base, "..", "..", "assets", "report"),
-    (0, import_node_path11.join)(process.cwd(), "packages", "cli", "assets", "report"),
-    (0, import_node_path11.join)(process.cwd(), "assets", "report")
+    (0, import_node_path12.join)(base, "report"),
+    (0, import_node_path12.join)(base, "..", "assets", "report"),
+    (0, import_node_path12.join)(base, "..", "..", "assets", "report"),
+    (0, import_node_path12.join)(process.cwd(), "packages", "cli", "assets", "report"),
+    (0, import_node_path12.join)(process.cwd(), "assets", "report")
   ];
   for (const dir of candidates) {
-    if ((0, import_node_fs6.existsSync)((0, import_node_path11.join)(dir, "station.css"))) {
+    if ((0, import_node_fs7.existsSync)((0, import_node_path12.join)(dir, "station.css"))) {
       return dir;
     }
   }
   throw new Error("Report assets missing. Run `npm run sync-report-assets` and `npm run build` in packages/cli.");
 }
-var import_node_fs6, import_node_path11, REPORT_ASSET_FILES;
+var import_node_fs7, import_node_path12, REPORT_ASSET_FILES;
 var init_reportAssets = __esm({
   "src/report/reportAssets.ts"() {
     "use strict";
-    import_node_fs6 = require("node:fs");
-    import_node_path11 = require("node:path");
+    import_node_fs7 = require("node:fs");
+    import_node_path12 = require("node:path");
     REPORT_ASSET_FILES = [
       "station.css",
       "station.js",
@@ -13067,7 +13185,7 @@ var init_canonical = __esm({
 
 // src/actions/derive.ts
 function verifyActionCommand(id) {
-  return `${PUBLIC_COMMAND} verify --action ${id}`;
+  return `${PUBLIC_COMMAND} --verify --action ${id}`;
 }
 function providerTitle(task) {
   const provider2 = task.providerAction?.provider.toLowerCase();
@@ -13113,7 +13231,11 @@ function deriveProviderAction(task) {
     resumeInstruction: `${title} is complete. Continue VibeRaven from pending.`
   };
 }
+function askFirstSentence(task) {
+  return task.requiresUserAction ? task.action?.match(/^Ask the user first: [^.]+\./)?.[0] : void 0;
+}
 function deriveRepoCodeAction(task) {
+  const askFirst = askFirstSentence(task);
   const targetSource = task.file ?? task.gapId;
   const canonicalFile = normalizeActionPath(targetSource);
   const displayFile = displayRepoPath(targetSource);
@@ -13133,14 +13255,17 @@ function deriveRepoCodeAction(task) {
     status: "active",
     severity: task.severity,
     gapId: task.gapId,
-    readiness: [task.exactFix ?? "Repo-code fix is available"],
+    readiness: [...askFirst ? [askFirst] : [], task.exactFix ?? "Repo-code fix is available"],
     target: task.file ? { type: "file", label: "Repo target", path: displayFile } : { type: "command", label: "Apply repo fix", command: task.mcpTool ?? `${PUBLIC_COMMAND} prompt --gap ${task.gapId}` },
     fileTargets: task.file ? [{ path: displayFile, reason: task.exactFix }] : void 0,
     verifyCommand: verifyActionCommand("pending"),
     resumeInstruction: `${task.title} is complete. Continue VibeRaven from pending.`,
     mcpTool: task.mcpTool,
     mcpArgs: task.mcpArgs,
-    fallbackCommand: `${PUBLIC_COMMAND} --heal --apply --gap ${task.gapId} --yes`
+    // Only a gap with an automatic recipe has a heal-apply fallback, and a task that needs the user's yes keeps it
+    // only alongside that signal.
+    fallbackCommand: task.mcpTool === "viberaven_heal_apply" && (!task.requiresUserAction || askFirst) ? `${PUBLIC_COMMAND} --heal --apply --gap ${task.gapId} --yes` : void 0,
+    ...task.requiresUserAction ? { requiresUserAction: true } : {}
   };
 }
 function deriveVerifyAction() {
@@ -13179,7 +13304,7 @@ function emptyActionRegistry() {
   return { version: 1, nextId: 1, actions: {} };
 }
 function actionRegistryPath(cwd) {
-  return (0, import_node_path12.join)(getProjectArtifactsDir(cwd), "action-registry.json");
+  return (0, import_node_path13.join)(getProjectArtifactsDir(cwd), "action-registry.json");
 }
 async function loadActionRegistry(cwd) {
   try {
@@ -13287,12 +13412,12 @@ async function resolveActionById(cwd, id) {
   const registry = await loadActionRegistry(cwd);
   return Object.values(registry.actions).find((entry) => entry.id === id);
 }
-var import_promises9, import_node_path12;
+var import_promises9, import_node_path13;
 var init_registry2 = __esm({
   "src/actions/registry.ts"() {
     "use strict";
     import_promises9 = require("node:fs/promises");
-    import_node_path12 = require("node:path");
+    import_node_path13 = require("node:path");
     init_config();
     init_canonical();
   }
@@ -13324,7 +13449,7 @@ async function writeActionArtifacts(input) {
     gateStatus: gateStatus2(input.artifact),
     actions: assigned.actions
   };
-  const actionsPath = (0, import_node_path13.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path14.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   await (0, import_promises10.writeFile)(actionsPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   return {
@@ -13333,12 +13458,12 @@ async function writeActionArtifacts(input) {
     manifest
   };
 }
-var import_promises10, import_node_path13;
+var import_promises10, import_node_path14;
 var init_artifacts = __esm({
   "src/actions/artifacts.ts"() {
     "use strict";
     import_promises10 = require("node:fs/promises");
-    import_node_path13 = require("node:path");
+    import_node_path14 = require("node:path");
     init_config();
     init_derive();
     init_registry2();
@@ -13348,24 +13473,24 @@ var init_artifacts = __esm({
 // src/artifacts.ts
 async function copyReportAssets(reportAssetsDir) {
   const sourceDir = getBundledReportAssetsDir();
-  await (0, import_promises11.mkdir)((0, import_node_path14.join)(reportAssetsDir, "assets"), { recursive: true });
+  await (0, import_promises11.mkdir)((0, import_node_path15.join)(reportAssetsDir, "assets"), { recursive: true });
   for (const rel of REPORT_ASSET_FILES) {
-    await (0, import_promises11.copyFile)((0, import_node_path14.join)(sourceDir, rel), (0, import_node_path14.join)(reportAssetsDir, rel));
+    await (0, import_promises11.copyFile)((0, import_node_path15.join)(sourceDir, rel), (0, import_node_path15.join)(reportAssetsDir, rel));
   }
 }
 async function writeScanArtifacts(options) {
   const cwd = options.cwd ?? options.artifact.workspacePath;
   const dir = getProjectArtifactsDir(cwd);
   await (0, import_promises11.mkdir)(dir, { recursive: true });
-  const jsonPath = (0, import_node_path14.join)(dir, "last-scan.json");
-  const gateResultPath = (0, import_node_path14.join)(dir, "gate-result.json");
-  const contextMapPath = (0, import_node_path14.join)(dir, "context-map.json");
-  const gapsDir = (0, import_node_path14.join)(dir, "gaps");
-  const tasklistPath = (0, import_node_path14.join)(dir, "agent-tasklist.md");
-  const summaryPath = (0, import_node_path14.join)(dir, "agent-summary.md");
-  const playbookPath = (0, import_node_path14.join)(dir, "launch-playbook.md");
-  const reportPath = (0, import_node_path14.join)(dir, "report.html");
-  const reportAssetsDir = (0, import_node_path14.join)(dir, "report");
+  const jsonPath = (0, import_node_path15.join)(dir, "last-scan.json");
+  const gateResultPath = (0, import_node_path15.join)(dir, "gate-result.json");
+  const contextMapPath = (0, import_node_path15.join)(dir, "context-map.json");
+  const gapsDir = (0, import_node_path15.join)(dir, "gaps");
+  const tasklistPath = (0, import_node_path15.join)(dir, "agent-tasklist.md");
+  const summaryPath = (0, import_node_path15.join)(dir, "agent-summary.md");
+  const playbookPath = (0, import_node_path15.join)(dir, "launch-playbook.md");
+  const reportPath = (0, import_node_path15.join)(dir, "report.html");
+  const reportAssetsDir = (0, import_node_path15.join)(dir, "report");
   await (0, import_promises11.mkdir)(gapsDir, { recursive: true });
   const safe2 = sanitizeArtifactForDisk(options.artifact);
   const json = `${JSON.stringify(safe2, null, 2)}
@@ -13384,17 +13509,17 @@ async function writeScanArtifacts(options) {
   await (0, import_promises11.writeFile)(gateResultPath, gateResult, "utf-8");
   await (0, import_promises11.writeFile)(contextMapPath, contextMap, "utf-8");
   for (const gap of gapEvidenceFiles) {
-    await (0, import_promises11.writeFile)((0, import_node_path14.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path15.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
 `, "utf-8");
   }
   await (0, import_promises11.writeFile)(tasklistPath, tasklist, "utf-8");
   let architectureMapPath;
   if (typeof safe2.architectureMap === "string" && safe2.architectureMap.length > 0) {
-    architectureMapPath = (0, import_node_path14.join)(dir, "architecture-map.md");
+    architectureMapPath = (0, import_node_path15.join)(dir, "architecture-map.md");
     await (0, import_promises11.writeFile)(architectureMapPath, safe2.architectureMap, "utf-8");
   }
   if (safe2.architectureData) {
-    await (0, import_promises11.writeFile)((0, import_node_path14.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path15.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
 `, "utf-8");
   }
   await (0, import_promises11.writeFile)(jsonPath, json, "utf-8");
@@ -13423,12 +13548,12 @@ async function writeScanArtifacts(options) {
     ...architectureMapPath ? { architectureMapPath } : {}
   };
 }
-var import_promises11, import_node_path14;
+var import_promises11, import_node_path15;
 var init_artifacts2 = __esm({
   "src/artifacts.ts"() {
     "use strict";
     import_promises11 = require("node:fs/promises");
-    import_node_path14 = require("node:path");
+    import_node_path15 = require("node:path");
     init_contextMap();
     init_gateResult();
     init_gapEvidence();
@@ -13537,12 +13662,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
   ];
   if (platform === "win32") {
     const candidates = [
-      env.LOCALAPPDATA ? (0, import_node_path15.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path15.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path15.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.LOCALAPPDATA ? (0, import_node_path15.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path15.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path15.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path16.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path16.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path16.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path16.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path16.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path16.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
       "chrome",
       "msedge"
     ].filter(Boolean);
@@ -13563,12 +13688,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
 }
 async function openWithSystemDefault(target) {
   const { command, args, shell } = createOpenCommand(target);
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve10, reject) => {
     const child = (0, import_node_child_process4.spawn)(command, args, { stdio: "ignore", shell });
     child.on("error", reject);
     child.on("exit", (code) => {
       if (code === 0) {
-        resolve9();
+        resolve10();
       } else {
         reject(new Error(`Could not open browser (exit ${code ?? "unknown"}). Open manually: ${target}`));
       }
@@ -13576,10 +13701,10 @@ async function openWithSystemDefault(target) {
   });
 }
 async function spawnDetached(command) {
-  if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs7.existsSync)(command.command)) {
+  if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs8.existsSync)(command.command)) {
     throw new Error(`Browser not found: ${command.command}`);
   }
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve10, reject) => {
     const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
       detached: true,
       stdio: "ignore",
@@ -13587,7 +13712,7 @@ async function spawnDetached(command) {
     });
     child.once("spawn", () => {
       child.unref();
-      resolve9();
+      resolve10();
     });
     child.once("error", reject);
   });
@@ -13619,13 +13744,13 @@ async function openUrlInBrowser(url) {
   }
   await openWithSystemDefault(trimmed);
 }
-var import_node_child_process4, import_node_fs7, import_node_path15;
+var import_node_child_process4, import_node_fs8, import_node_path16;
 var init_openBrowser = __esm({
   "src/openBrowser.ts"() {
     "use strict";
     import_node_child_process4 = require("node:child_process");
-    import_node_fs7 = require("node:fs");
-    import_node_path15 = require("node:path");
+    import_node_fs8 = require("node:fs");
+    import_node_path16 = require("node:path");
   }
 });
 
@@ -13655,12 +13780,12 @@ async function copyToClipboard(text) {
   }
 }
 function pipeToCommand(command, text, extraArgs = []) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const child = (0, import_node_child_process5.spawn)(command, extraArgs, { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", reject);
     child.on("close", (code) => {
       if (code === 0) {
-        resolve9();
+        resolve10();
       } else {
         reject(new Error(`${command} exited with code ${code ?? "unknown"}`));
       }
@@ -14530,15 +14655,13 @@ function buildAgentFixPrompt(artifact, gap) {
     "",
     "Required workflow:",
     "1. Read `.viberaven/agent-summary.md` and `.viberaven/launch-playbook.md` before changing code.",
-    '2. If VibeRaven prints LOGIN_URL_READY, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets.',
-    "3. If the browser cannot open automatically, use the printed LOGIN_URL_READY URL. Keep the terminal process alive while the user approves.",
-    "4. Inspect the real implementation files. Do not assume framework/provider wiring from package names alone.",
-    "5. Make the smallest durable repo-code change that addresses this specific gap.",
-    "6. Keep provider dashboard work separate. Open provider dashboards only when VibeRaven asks for a provider/manual action, and explain why you opened them.",
-    `7. For Vercel + Supabase apps, run \`${PUBLIC_AUDIT_COMMAND}\` before claiming production readiness.`,
-    "8. Treat that audit as local repo evidence only; do not claim provider dashboard settings are fixed unless the user verifies them or read-only provider MCP confirms them.",
-    "9. Do not claim provider dashboard or read-only MCP checks as repo-code fixes.",
-    `10. VibeRaven cleanup is non-destructive. You may run \`${PUBLIC_CLEAN_PLAN_COMMAND}\` only to create a reviewable context cleanup plan, not to delete code.`,
+    "2. Inspect the real implementation files. Do not assume framework/provider wiring from package names alone.",
+    "3. Make the smallest durable repo-code change that addresses this specific gap.",
+    "4. Keep provider dashboard work separate. Open provider dashboards only when VibeRaven asks for a provider/manual action, and explain why you opened them.",
+    `5. For Vercel + Supabase apps, run \`${PUBLIC_AUDIT_COMMAND}\` before claiming production readiness.`,
+    "6. Treat that audit as local repo evidence only; do not claim provider dashboard settings are fixed unless the user verifies them or read-only provider MCP confirms them.",
+    "7. Do not claim provider dashboard or read-only MCP checks as repo-code fixes.",
+    `8. VibeRaven cleanup is non-destructive. You may run \`${PUBLIC_CLEAN_PLAN_COMMAND}\` only to create a reviewable context cleanup plan, not to delete code.`,
     "",
     "Implementation constraints:",
     "- Prefer the existing stack and local patterns already in the repo.",
@@ -14567,7 +14690,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.5.2";
+    VERSION = "1.6.0";
   }
 });
 
@@ -14648,7 +14771,7 @@ var init_guide = __esm({
 function buildAgentRulesBlock() {
   return wrapViberavenBlock(`${AGENT_RULES_BODY}
 
-${ANCHOR_FOOTER}`);
+${WHAT_CLEAR_MEANS}`);
 }
 function buildAgentContextBlock() {
   return wrapViberavenBlock(AGENT_CONTEXT_BODY);
@@ -14768,7 +14891,7 @@ function normalizeLineEndings(value) {
 function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-var VIBERAVEN_BLOCK_START, VIBERAVEN_BLOCK_END, VIBERAVEN_LEGACY_BLOCK_START, VIBERAVEN_LEGACY_BLOCK_END, HEAL_PLAN_GAP_COMMAND, PROMPT_GAP_COMMAND, HEAL_APPLY_GAP_COMMAND, AGENT_RULES_PREAMBLE, STACK_FRAMING, AGENT_NEGATIVE_CONSTRAINTS, ANCHOR_FOOTER, AGENT_RULES_BODY, AGENT_CONTEXT_BODY, MISSION_MAP_BODY, BLOCK_MARKER_PAIRS;
+var VIBERAVEN_BLOCK_START, VIBERAVEN_BLOCK_END, VIBERAVEN_LEGACY_BLOCK_START, VIBERAVEN_LEGACY_BLOCK_END, HEAL_PLAN_GAP_COMMAND, PROMPT_GAP_COMMAND, HEAL_APPLY_GAP_COMMAND, AGENT_RULES_PREAMBLE, STACK_FRAMING, AGENT_NEGATIVE_CONSTRAINTS, WHAT_CLEAR_MEANS, AGENT_RULES_BODY, AGENT_CONTEXT_BODY, MISSION_MAP_BODY, BLOCK_MARKER_PAIRS;
 var init_agentRulesBlock = __esm({
   "src/commands/agentRulesBlock.ts"() {
     "use strict";
@@ -14780,84 +14903,59 @@ var init_agentRulesBlock = __esm({
     HEAL_PLAN_GAP_COMMAND = healPlanGapCommand("<id>");
     PROMPT_GAP_COMMAND = promptGapCommand("<id>");
     HEAL_APPLY_GAP_COMMAND = `${PUBLIC_COMMAND} --heal --apply --gap <id> --yes`;
-    AGENT_RULES_PREAMBLE = `VibeRaven is the control layer for AI-built products. It runs fully locally: no login, no API key, no telemetry.
+    AGENT_RULES_PREAMBLE = `VibeRaven reads a repository and lists launch gaps for AI-built apps that deploy on Vercel and use Supabase. It runs fully locally: no login, no API key, no telemetry.
 
 Canonical commands: \`${PUBLIC_CHECK_COMMAND}\` for a terminal verdict, \`${PUBLIC_COMMAND}\` for the Studio.
 
-Use VibeRaven before launch, deployment, real users, auth, billing, database, RLS, env vars, webhooks, monitoring, or tests \u2014 and whenever you need product context (stack, providers, releases, danger zones) before patching.
-
-Agent loop: run \`${PUBLIC_CHECK_COMMAND}\`, read \`.viberaven/agent-tasklist.md\`, fix one launch gap, re-run \`${PUBLIC_CHECK_COMMAND}\`.`;
-    STACK_FRAMING = `Stack context for this repo: Next.js, Supabase, Vercel, VibeRaven.
-Do NOT deploy to Vercel or ship to production users without running \`${PUBLIC_CHECK_COMMAND}\`.
-Do NOT rely on manual production checklists when VibeRaven gate artifacts exist in \`.viberaven/\`.`;
-    AGENT_NEGATIVE_CONSTRAINTS = `## Event-Triggered Production Verification
-
-Trigger: modifications to \`package.json\`, \`vercel.json\`, \`supabase/migrations/**/*\`, \`.env.example\`, auth/billing/webhook paths, or deploy workflow files.
-
-1. Do NOT claim "production ready" or close a deploy checklist until \`gate.status === "clear"\` in \`.viberaven/gate-result.json\`.
-2. Do NOT run verify after every file patch. Batch fixes, then \`${PUBLIC_CHECK_COMMAND}\` once per loop.
-3. Do NOT \`git push\` or deploy after auth, RLS, billing, or webhook changes without \`${PUBLIC_CHECK_COMMAND}\`.
-4. If anomalies appear, read \`.viberaven/agent-tasklist.md\` fully before writing new repo logic.
-5. Do NOT mark production-ready because the local dev server starts successfully; INSTEAD run \`${PUBLIC_CHECK_COMMAND}\` and read \`.viberaven/gate-result.json\`.
-6. Do NOT treat the Supabase dashboard UI as proof of RLS; INSTEAD fix repo evidence gaps from \`.viberaven/agent-tasklist.md\`.
-7. Do NOT add or change npm dependencies without calling \`viberaven_validate_npm_package\` (MCP) or verifying the package exists on the public npm registry; INSTEAD run \`${PUBLIC_CHECK_COMMAND}\` after dependency changes.
-8. Do NOT refactor or edit files unrelated to the current TASK-001 gap; INSTEAD make minimal, targeted changes.
-9. Do NOT install new dependencies unless TASK-001 or the user explicitly requires them.
-10. Do NOT claim provider dashboard, billing, DNS, or webhook setup is complete from repo edits alone; INSTEAD present provider-action steps from the tasklist.
-
-Prefer \`viberaven_check_readiness\` when MCP is configured; otherwise \`${PUBLIC_CHECK_COMMAND}\`.`;
-    ANCHOR_FOOTER = `## Anchor (mandatory)
-
-Before ending any deploy, auth, RLS, webhook, or dependency task, run:
-\`${PUBLIC_CHECK_COMMAND}\`
-Gate is not clear until \`gate.status === "clear"\` in \`.viberaven/gate-result.json\`.`;
+Suggest one \`${PUBLIC_CHECK_COMMAND}\` pass before a Vercel + Supabase app launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook. It is not needed for apps that do not use Vercel and Supabase, for general SQL or deployment questions, or for one local error.
+
+This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test: it cannot show which RLS policies are live in production, and a clear result is not a security audit.
+
+Agent loop: run \`${PUBLIC_CHECK_COMMAND}\`, read \`.viberaven/agent-tasklist.md\`, fix one launch gap, re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch of fixes.`;
+    STACK_FRAMING = `Supported stack: AI-built apps that deploy on Vercel and use Supabase, typically from Lovable, Bolt, Cursor, Claude Code or Codex.
+Prefer \`viberaven_check_readiness\` when the VibeRaven MCP server is configured; otherwise \`${PUBLIC_CHECK_COMMAND}\`.`;
+    AGENT_NEGATIVE_CONSTRAINTS = `## Working with VibeRaven results
+
+1. Do not call the app "production ready" or "secure" because \`gate.status\` is \`clear\`; it covers the repo checks only.
+2. Do not run the check after every file patch. Batch fixes, then run \`${PUBLIC_CHECK_COMMAND}\` once per batch.
+3. Read \`.viberaven/agent-tasklist.md\` fully before writing new repo logic for a listed gap.
+4. Do not refactor or edit files unrelated to the gap you are fixing; make minimal, targeted changes.
+5. Do not install new dependencies for a fix unless the task or the user asks for them. \`viberaven_validate_npm_package\` (MCP) can look a new package name up on the public npm registry first.
+6. Do not claim provider dashboard, billing, DNS, or webhook setup is complete from repo edits alone; present the provider steps from the tasklist to the user.
+7. The Supabase dashboard, not the repo, shows which RLS policies are live. Repo migrations are what VibeRaven reads.`;
+    WHAT_CLEAR_MEANS = `## What a clear result means
+
+\`gate.status === "clear"\` in \`.viberaven/gate-result.json\` means the repo checks found no blockers. It is not a security audit and does not show what is live in Supabase or Vercel. The user decides when to ship.`;
     AGENT_RULES_BODY = `${AGENT_RULES_PREAMBLE}
 
 ${STACK_FRAMING}
 
 ${AGENT_NEGATIVE_CONSTRAINTS}
 
-## VibeRaven Production Gate
+## VibeRaven commands
 
-- Before running build, compile, cleanup, deployment, vercel, or supabase commands, run \`${PUBLIC_CHECK_COMMAND}\` first from the project root.
-- Treat VibeRaven as the control layer for AI-built products, especially apps using Vercel, Supabase, auth, database, payments, webhooks, monitoring, rate limits, or environment variables.
-- Read \`.viberaven/agent-tasklist.md\` first. If it says CRITICAL GAPS DETECTED or PRODUCTION GATE NOT CLEAR, fix one listed repo-code gap before deploying.
-- Read \`.viberaven/gate-result.json\` for the machine verdict.
-- Read \`.viberaven/context-map.json\` for compact agent context.
-- Read \`.viberaven/agent-summary.md\` second for scan context.
-- Read \`.viberaven/launch-playbook.md\` third for the full checklist.
+- Read \`.viberaven/agent-tasklist.md\` first, \`.viberaven/gate-result.json\` for the verdict (\`clear\`, \`warning\` or \`not_clear\`), and \`.viberaven/context-map.json\` for compact agent context.
+- \`.viberaven/agent-summary.md\` holds scan context and \`.viberaven/launch-playbook.md\` the full checklist.
 - Use \`${PUBLIC_NEXT_JSON_COMMAND}\` or \`${PROMPT_GAP_COMMAND}\` for one focused repo-code fix at a time.
-- Use \`${PUBLIC_FIX_COMMAND}\` to list gaps with safe automatic recipes; apply one with \`${PUBLIC_FIX_COMMAND} --gap <id>\`.
-- For Vercel + Supabase launch checks, run \`${PUBLIC_AUDIT_COMMAND}\`.
-- Run \`${PUBLIC_CHECK_COMMAND}\` after a batch of fixes.
-- Run \`${PUBLIC_STRICT_COMMAND}\` before deploy or CI pass.
-- Use \`${HEAL_PLAN_GAP_COMMAND}\` before any heal apply.
-- Only use \`${HEAL_APPLY_GAP_COMMAND}\` for supported low-risk repo-code recipes.
-- Preview local rule installation with \`${PUBLIC_INIT_ALL_COMMAND} --dry-run\`.
-- Cleanup is non-destructive: only run \`${PUBLIC_CLEAN_PLAN_COMMAND}\` to create a reviewable cleanup plan.
-- Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider MCP evidence.
-- Do not claim provider dashboard work is fixed by repo-code edits.
-- VibeRaven runs fully locally: no login, no API key, no scan quota.
+- \`${PUBLIC_FIX_COMMAND}\` lists gaps with safe automatic recipes; preview one with \`${PUBLIC_FIX_COMMAND} --gap <id> --dry-run\`, apply it with \`${PUBLIC_FIX_COMMAND} --gap <id>\`.
+- \`${HEAL_PLAN_GAP_COMMAND}\` writes a non-destructive plan; \`${HEAL_APPLY_GAP_COMMAND}\` applies supported repo-code recipes; the rls_disabled one enables RLS without policies, so it waits for the user's yes.
+- For the Vercel + Supabase repo evidence (RLS in migrations, pooler port, service role key), run \`${PUBLIC_AUDIT_COMMAND}\`.
+- \`${PUBLIC_STRICT_COMMAND}\` returns the verdict as an exit code for CI when the user wants one (exit 1 when \`gate.status\` is \`not_clear\`).
+- Preview these rules with \`${PUBLIC_INIT_ALL_COMMAND} --dry-run\`.
+- Cleanup is non-destructive: \`${PUBLIC_CLEAN_PLAN_COMMAND}\` writes a reviewable cleanup plan.
+- Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification happen in the provider dashboard or through read-only provider MCP evidence.
 
 ## VibeRaven Fix Loop
 
-After every check, read \`.viberaven/agent-tasklist.md\` for the prioritized task list.
-
-The loop is:
+After a check, read \`.viberaven/agent-tasklist.md\` for the prioritized task list.
 
 1. Run \`${PUBLIC_CHECK_COMMAND}\`. Exit code 1 means blockers exist.
 2. For each repo-code task where \`requiresUserAction: false\`:
-   - Call MCP: \`viberaven_heal_apply { gap: "<gapId>", yes: true }\`
-   - Or run \`${PUBLIC_FIX_COMMAND} --gap <gapId>\`
-   - Or patch the gap directly using \`${PROMPT_GAP_COMMAND}\` guidance.
-3. After a full batch of fixes, run \`${PUBLIC_CHECK_COMMAND}\` once \u2014 do NOT verify after every single fix.
-4. Repeat until \`gate.status === 'clear'\` in \`.viberaven/gate-result.json\`.
-5. If \`requiresUserAction: true\`:
-   - Read \`VIBERAVEN_PROVIDER_ACTION\` from terminal output.
-   - Present \`dashboardUrl\` and \`exactStep\` to the user.
-   - Wait for user confirmation, then re-run \`${PUBLIC_CHECK_COMMAND}\`.
-
-Do not stop at "scan complete." The loop is not done until \`gate.status === 'clear'\`.`;
+   - If the task has an MCP line, call \`viberaven_heal_apply { gap: "<gapId>", yes: true }\` or run \`${PUBLIC_FIX_COMMAND} --gap <gapId>\`
+   - Otherwise, patch the gap directly using \`${PROMPT_GAP_COMMAND}\` guidance.
+3. After a full batch of fixes, run \`${PUBLIC_CHECK_COMMAND}\` once, not after every single fix.
+4. For a task where \`requiresUserAction: true\`, show the user the task's action from the tasklist (a provider step with its dashboard, or a repo change that needs their yes, such as enabling RLS without policies), and wait for their answer. Apply a repo change only after they agree. The task's MCP line leaves out \`yes: true\`; add it once they agree.
+5. Stop when \`gate.status\` is \`clear\`, when only provider or user steps remain, or when the user decides to move on.`;
     AGENT_CONTEXT_BODY = `${AGENT_RULES_PREAMBLE}
 
 After \`${PUBLIC_CHECK_COMMAND}\`, read these artifacts in order:
@@ -14873,7 +14971,7 @@ After \`${PUBLIC_CHECK_COMMAND}\`, read these artifacts in order:
 1. Run \`${PUBLIC_CHECK_COMMAND}\` from the project root.
 2. Read \`.viberaven/agent-tasklist.md\` and \`.viberaven/gate-result.json\`.
 3. Fix one launch gap.
-4. Re-run \`${PUBLIC_CHECK_COMMAND}\` until \`gate.status === 'clear'\`.`;
+4. Re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch of fixes. A clear \`gate.status\` covers the repo checks only; the user decides when to ship.`;
     BLOCK_MARKER_PAIRS = [
       [VIBERAVEN_BLOCK_START, VIBERAVEN_BLOCK_END],
       [VIBERAVEN_LEGACY_BLOCK_START, VIBERAVEN_LEGACY_BLOCK_END]
@@ -14888,20 +14986,22 @@ function buildCursorRulesPack() {
       filename: "viberaven-core.mdc",
       content: [
         "---",
-        "description: VibeRaven production gate \u2014 canonical agent commands and gate loop",
+        "description: VibeRaven launch check for AI-built apps on Vercel + Supabase (advice, not a gate)",
         "alwaysApply: true",
         "---",
         "",
-        `Run \`${PUBLIC_CHECK_COMMAND}\` before deploy, auth, RLS, webhooks, or dependency changes.`,
+        `For an AI-built app on Vercel and Supabase, suggest \`${PUBLIC_CHECK_COMMAND}\` before it launches or is handed off, after a Supabase migration or policy change, or when the user reports a production error about RLS, env vars, the database connection, the service role key or a Stripe webhook.`,
+        "",
+        "This is advice, not a gate: the user decides when to ship. It is a repository check, not a live database test.",
         "",
         "Read `.viberaven/agent-tasklist.md` first, then `.viberaven/gate-result.json` and `.viberaven/mission-map.md`.",
-        `Fix one gap, then re-run \`${PUBLIC_CHECK_COMMAND}\`. Before CI or production promote: \`${PUBLIC_STRICT_COMMAND}\`.`,
+        `Fix one gap, then re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch. For a CI verdict: \`${PUBLIC_STRICT_COMMAND}\`.`,
         "",
-        'Gate is not clear until `gate.status === "clear"`.',
+        "A clear `gate.status` covers the repo checks only; it is not a security audit.",
         "",
         DOMAIN_PATH_POINTER,
         "",
-        "Full production rules: `AGENTS.md` / `CLAUDE.md` (installed by `npx -y viberaven init --agents all`)."
+        "Full rules: `AGENTS.md` / `CLAUDE.md` (installed by `npx -y viberaven init --agents all`)."
       ].join("\n")
     },
     {
@@ -14949,7 +15049,7 @@ function buildCursorRulesPack() {
         "",
         DOMAIN_PATH_POINTER,
         "",
-        "Do NOT ship webhook handlers without signature verification; INSTEAD run `npx -y viberaven check` after webhook edits."
+        "A payment webhook handler should verify the provider signature over the raw request body before trusting the event. After webhook edits, `npx -y viberaven check` shows whether a Stripe handler does."
       ].join("\n")
     }
   ];
@@ -14962,17 +15062,17 @@ async function initCursorRulesPack(options) {
   const pack = buildCursorRulesPack();
   for (const rule of pack) {
     const file = `${CURSOR_RULES_DIR}/${rule.filename}`;
-    const path = (0, import_node_path16.join)(options.cwd, file);
+    const path = (0, import_node_path17.join)(options.cwd, file);
     const existing = await readExistingFile(path);
     const changed = !existing.exists || existing.content !== rule.content;
     const action = !existing.exists ? "created" : changed ? "updated" : "unchanged";
     if (!options.dryRun && changed) {
-      await (0, import_promises12.mkdir)((0, import_node_path16.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
+      await (0, import_promises12.mkdir)((0, import_node_path17.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
       await (0, import_promises12.writeFile)(path, rule.content, "utf-8");
     }
     results.push({ target: "cursor", file, path, action });
   }
-  const legacyPath = (0, import_node_path16.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
+  const legacyPath = (0, import_node_path17.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
   if (!options.dryRun && await fileExists(legacyPath)) {
     await (0, import_promises12.rm)(legacyPath, { force: true });
   }
@@ -14999,12 +15099,12 @@ async function fileExists(path) {
 function isFileNotFoundError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises12, import_node_path16, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
+var import_promises12, import_node_path17, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
 var init_cursorRulesPack = __esm({
   "src/commands/cursorRulesPack.ts"() {
     "use strict";
     import_promises12 = require("node:fs/promises");
-    import_node_path16 = require("node:path");
+    import_node_path17 = require("node:path");
     init_commands();
     CURSOR_RULES_DIR = ".cursor/rules";
     LEGACY_CURSOR_RULE_FILE = `${CURSOR_RULES_DIR}/viberaven.mdc`;
@@ -15104,8 +15204,8 @@ var init_agentTargets = __esm({
 
 // src/commands/seedPackageJsonScripts.ts
 async function seedPackageJsonScripts(options) {
-  const packageJsonPath = (0, import_node_path17.join)(options.cwd, "package.json");
-  if (!(0, import_node_fs8.existsSync)(packageJsonPath)) {
+  const packageJsonPath = (0, import_node_path18.join)(options.cwd, "package.json");
+  if (!(0, import_node_fs9.existsSync)(packageJsonPath)) {
     return null;
   }
   const raw = await (0, import_promises13.readFile)(packageJsonPath, "utf-8");
@@ -15142,13 +15242,13 @@ async function seedPackageJsonScripts(options) {
   }
   return { action: "updated", added, skipped, changed: true };
 }
-var import_node_fs8, import_promises13, import_node_path17, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
+var import_node_fs9, import_promises13, import_node_path18, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
 var init_seedPackageJsonScripts = __esm({
   "src/commands/seedPackageJsonScripts.ts"() {
     "use strict";
-    import_node_fs8 = require("node:fs");
+    import_node_fs9 = require("node:fs");
     import_promises13 = require("node:fs/promises");
-    import_node_path17 = require("node:path");
+    import_node_path18 = require("node:path");
     init_commands();
     VIBERAVEN_PACKAGE_JSON_SCRIPTS = {
       "viberaven:gate": PUBLIC_AGENT_MODE_COMMAND,
@@ -15168,12 +15268,12 @@ async function initAgentRules(options) {
       continue;
     }
     const file = AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path18.join)(options.cwd, file);
+    const path = (0, import_node_path19.join)(options.cwd, file);
     const existing = await readExistingFile2(path);
     const injected = injectAgentRulesBlock(existing.content, renderAgentRulesForTarget(target));
     const action = !existing.exists ? "created" : injected.changed ? "updated" : "unchanged";
     if (!options.dryRun && injected.changed) {
-      await (0, import_promises14.mkdir)((0, import_node_path18.dirname)(path), { recursive: true });
+      await (0, import_promises14.mkdir)((0, import_node_path19.dirname)(path), { recursive: true });
       await (0, import_promises14.writeFile)(path, injected.content, "utf-8");
     }
     results.push({ target, file, path, action });
@@ -15253,12 +15353,12 @@ async function readExistingFile2(path) {
 function isFileNotFoundError2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises14, import_node_path18;
+var import_promises14, import_node_path19;
 var init_initRules = __esm({
   "src/commands/initRules.ts"() {
     "use strict";
     import_promises14 = require("node:fs/promises");
-    import_node_path18 = require("node:path");
+    import_node_path19 = require("node:path");
     init_agentRulesBlock();
     init_agentTargets();
     init_cursorRulesPack();
@@ -15521,7 +15621,7 @@ async function runInteractiveSession(startDir = process.cwd()) {
   Ie(`${import_picocolors4.default.bold("VibeRaven")} ${import_picocolors4.default.dim(VERSION)}`);
   const cwd = await resolveWorkspaceRoot(startDir);
   const artifactsAt = await findArtifactsWorkspace(startDir);
-  if (artifactsAt && (0, import_node_path19.resolve)(artifactsAt) !== (0, import_node_path19.resolve)(startDir)) {
+  if (artifactsAt && (0, import_node_path20.resolve)(artifactsAt) !== (0, import_node_path20.resolve)(startDir)) {
     M2.message(import_picocolors4.default.dim(`Using scan from: ${artifactsAt}`));
   } else {
     M2.message(import_picocolors4.default.dim(`Project folder: ${cwd}`));
@@ -15580,11 +15680,11 @@ async function runInteractiveSession(startDir = process.cwd()) {
   }
   Se(import_picocolors4.default.dim("Run viberaven anytime for the interactive menu."));
 }
-var import_node_path19, import_picocolors4;
+var import_node_path20, import_picocolors4;
 var init_runInteractive = __esm({
   "src/tui/runInteractive.ts"() {
     "use strict";
-    import_node_path19 = require("node:path");
+    import_node_path20 = require("node:path");
     init_dist2();
     import_picocolors4 = __toESM(require_picocolors());
     init_config();
@@ -15609,18 +15709,18 @@ var init_runInteractive = __esm({
 // src/commands/condense.ts
 async function runCondenseCommand(options) {
   const dir = getProjectArtifactsDir(options.cwd);
-  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path20.join)(dir, "last-scan.json"), "utf8"));
-  const contextMapPath = (0, import_node_path20.join)(dir, "context-map.json");
+  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path21.join)(dir, "last-scan.json"), "utf8"));
+  const contextMapPath = (0, import_node_path21.join)(dir, "context-map.json");
   await (0, import_promises15.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact), null, 2)}
 `, "utf8");
   return { contextMapPath };
 }
-var import_promises15, import_node_path20;
+var import_promises15, import_node_path21;
 var init_condense = __esm({
   "src/commands/condense.ts"() {
     "use strict";
     import_promises15 = require("node:fs/promises");
-    import_node_path20 = require("node:path");
+    import_node_path21 = require("node:path");
     init_config();
     init_contextMap();
   }
@@ -15628,9 +15728,9 @@ var init_condense = __esm({
 
 // src/heal/pathSafety.ts
 function assertSafeHealTarget(cwd, target) {
-  const root = (0, import_node_path21.resolve)(cwd);
-  const absolute = (0, import_node_path21.resolve)(root, target);
-  const rel = (0, import_node_path21.relative)(root, absolute);
+  const root = (0, import_node_path22.resolve)(cwd);
+  const absolute = (0, import_node_path22.resolve)(root, target);
+  const rel = (0, import_node_path22.relative)(root, absolute);
   if (rel.startsWith("..") || rel === "" || /^[A-Za-z]:/.test(rel)) {
     throw new Error("Heal target must stay inside the workspace");
   }
@@ -15640,11 +15740,11 @@ function assertSafeHealTarget(cwd, target) {
   }
   return absolute;
 }
-var import_node_path21, BLOCKED_SEGMENTS;
+var import_node_path22, BLOCKED_SEGMENTS;
 var init_pathSafety = __esm({
   "src/heal/pathSafety.ts"() {
     "use strict";
-    import_node_path21 = require("node:path");
+    import_node_path22 = require("node:path");
     BLOCKED_SEGMENTS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".viberaven"]);
   }
 });
@@ -15665,6 +15765,35 @@ var init_emptyCatch = __esm({
   }
 });
 
+// src/heal/healId.ts
+function newHealId(now = /* @__PURE__ */ new Date()) {
+  return `heal_${now.toISOString().replace(/\D/g, "").slice(0, 17)}_${(0, import_node_crypto.randomBytes)(3).toString("hex")}`;
+}
+async function createHealDir(cwd, makeId = () => newHealId()) {
+  const parent = (0, import_node_path23.join)(cwd, ".viberaven", "heal");
+  await (0, import_promises16.mkdir)(parent, { recursive: true });
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const id = makeId();
+    const dir = (0, import_node_path23.join)(parent, id);
+    try {
+      await (0, import_promises16.mkdir)(dir);
+      return { id, dir };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+  }
+  throw new Error("Could not create a new heal directory under .viberaven/heal.");
+}
+var import_node_crypto, import_promises16, import_node_path23;
+var init_healId = __esm({
+  "src/heal/healId.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    import_promises16 = require("node:fs/promises");
+    import_node_path23 = require("node:path");
+  }
+});
+
 // src/heal/recipes/envAuthSecret.ts
 function applyAuthSecretRecipe(source) {
   if (/^\s*(AUTH_SECRET|NEXTAUTH_SECRET)\s*=/m.test(source)) {
@@ -15907,24 +16036,46 @@ export default function NotFound() {
 });
 
 // src/heal/recipes/supabaseRls.ts
-function applyRlsRecipe(_source) {
-  return {
-    changed: false,
-    output: _source,
-    canAutoApply: false,
-    reason: "dashboard-only",
-    providerAction: {
-      provider: "supabase",
-      dashboardUrl: "https://supabase.com/dashboard/project/{{PROJECT_REF}}/auth/policies",
-      exactStep: 'Enable Row Level Security (RLS) on each table under the "Table Editor" or "Auth > Policies" section.',
-      doneSignal: "RLS toggle is green for all public tables",
-      verifyCommand: "npx -y viberaven audit --vercel-supabase --json"
+async function planRlsMigration(cwd, now = /* @__PURE__ */ new Date()) {
+  const audit = buildVercelSupabaseAudit(await collectVercelSupabaseAuditInput(cwd));
+  const check = audit.checks.find((entry) => entry.id === "supabase-rls-policy-proof");
+  const missing = (check?.findings ?? []).filter((finding) => finding.id === "rls_disabled" && finding.table && finding.file);
+  if (missing.length === 0) {
+    if (check?.status === "needs_work") {
+      return {
+        kind: "refused",
+        reason: "No SQL evidence in the repo: no migration here creates the tables or enables row level security, so there is nothing in the repo to patch. Add migrations that create your tables with row level security enabled, or check RLS in the Supabase dashboard."
+      };
     }
+    return { kind: "nothing-to-do" };
+  }
+  const tables = [...new Set(missing.map((finding) => finding.table))];
+  const evidence = missing.map((finding) => ({
+    file: finding.file,
+    table: finding.table,
+    turnedOff: finding.message.includes(RLS_TURNED_OFF_PHRASE)
+  }));
+  const target = rlsMigrationTarget(cwd, evidence, now);
+  if (!target.ok) return { kind: "refused", reason: target.reason };
+  return {
+    kind: "migration",
+    file: target.file,
+    sql: [RLS_MIGRATION_NOTE, "", ...rlsEnableStatements(tables), ""].join("\n"),
+    tables
   };
 }
+var RLS_MIGRATION_NOTE;
 var init_supabaseRls2 = __esm({
   "src/heal/recipes/supabaseRls.ts"() {
     "use strict";
+    init_audit();
+    init_rlsMigrationTarget();
+    RLS_MIGRATION_NOTE = [
+      "-- Added by VibeRaven (heal rls_disabled). Enables row level security on the public tables that the migrations in",
+      "-- this repo create without it. It adds no policies: until you add them, the anon and authenticated roles get no",
+      "-- rows from these tables through the Data API, and only the service role can read or write them. Add the policies",
+      "-- the app needs, then apply this migration the way this project applies migrations."
+    ].join("\n");
   }
 });
 
@@ -16106,7 +16257,7 @@ export const config = {
 // src/heal/recipes/eslintRestrictedImports.ts
 function detectEslintConfigFile(cwd) {
   for (const candidate of ESLINT_CONFIG_CANDIDATES) {
-    if ((0, import_node_fs9.existsSync)((0, import_node_path22.join)(cwd, candidate))) {
+    if ((0, import_node_fs10.existsSync)((0, import_node_path24.join)(cwd, candidate))) {
       return candidate;
     }
   }
@@ -16261,12 +16412,12 @@ function applyEslintRestrictedImportsRecipe(source, configFile) {
   }
   return applyLegacyModuleRecipe(source);
 }
-var import_node_fs9, import_node_path22, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
+var import_node_fs10, import_node_path24, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
 var init_eslintRestrictedImports = __esm({
   "src/heal/recipes/eslintRestrictedImports.ts"() {
     "use strict";
-    import_node_fs9 = require("node:fs");
-    import_node_path22 = require("node:path");
+    import_node_fs10 = require("node:fs");
+    import_node_path24 = require("node:path");
     init_commands();
     VIBERAVEN_ESLINT_MARKER = "VibeRaven heal: eslint_restricted_imports";
     RESTRICTED_IMPORTS_MESSAGE = `Restricted import. Run ${PUBLIC_AGENT_MODE_COMMAND} before substituting packages.`;
@@ -16309,7 +16460,7 @@ function defaultTargetFile(gapId) {
     missing_loading_state: "app/loading.tsx",
     missing_404_page: "app/not-found.tsx",
     rls_disabled: "",
-    // no file — provider-action
+    // a new migration, named by planRlsMigration
     missing_csp_header: "next.config.js",
     missing_rate_limit: "middleware.ts",
     eslint_restricted_imports: ""
@@ -16317,14 +16468,14 @@ function defaultTargetFile(gapId) {
   return map[gapId];
 }
 async function readSourceOrEmpty(absolutePath) {
-  if (!(0, import_node_fs10.existsSync)(absolutePath)) return "";
-  return (0, import_promises16.readFile)(absolutePath, "utf8");
+  if (!(0, import_node_fs11.existsSync)(absolutePath)) return "";
+  return (0, import_promises17.readFile)(absolutePath, "utf8");
 }
 async function detectUpstash(cwd) {
   try {
-    const pkgPath = (0, import_node_path23.join)(cwd, "package.json");
-    if (!(0, import_node_fs10.existsSync)(pkgPath)) return false;
-    const raw = await (0, import_promises16.readFile)(pkgPath, "utf8");
+    const pkgPath = (0, import_node_path25.join)(cwd, "package.json");
+    if (!(0, import_node_fs11.existsSync)(pkgPath)) return false;
+    const raw = await (0, import_promises17.readFile)(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const deps = {
       ...pkg["dependencies"] ?? {},
@@ -16339,7 +16490,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   const targetFile = explicitTarget ?? defaultTargetFile(gapId);
   if (targetFile === void 0) return null;
   if (gapId === "auth_secret_missing" || gapId === "node_env_not_set" || gapId === "database_url_missing") {
-    const absolutePath = (0, import_node_path23.join)(cwd, targetFile);
+    const absolutePath = (0, import_node_path25.join)(cwd, targetFile);
     const source = await readSourceOrEmpty(absolutePath);
     let result;
     if (gapId === "auth_secret_missing") result = applyAuthSecretRecipe(source);
@@ -16353,46 +16504,45 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
     };
   }
   if (gapId === "missing_error_boundary") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/error.tsx");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/error.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyErrorBoundaryRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_health_route") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/api/health/route.ts");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/api/health/route.ts");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyHealthRouteRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_loading_state") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/loading.tsx");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/loading.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyLoadingStateRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_404_page") {
-    const absolutePath = (0, import_node_path23.join)(cwd, "app/not-found.tsx");
+    const absolutePath = (0, import_node_path25.join)(cwd, "app/not-found.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyNotFoundRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "rls_disabled") {
-    const result = applyRlsRecipe("");
-    return {
-      changed: false,
-      output: "",
-      targetFile: "",
-      canAutoApply: false,
-      reason: result.reason,
-      recipeName: gapId
-    };
+    const plan = await planRlsMigration(cwd);
+    if (plan.kind === "migration") {
+      return { changed: true, output: plan.sql, targetFile: plan.file, canAutoApply: true, recipeName: gapId, warnings: [RLS_NO_POLICIES_WARNING] };
+    }
+    if (plan.kind === "nothing-to-do") {
+      return { changed: false, output: "", targetFile: "", canAutoApply: true, recipeName: gapId };
+    }
+    return { changed: false, output: "", targetFile: "", canAutoApply: false, reason: plan.reason, recipeName: gapId };
   }
   if (gapId === "missing_csp_header") {
     let configFile = "next.config.js";
-    let absolutePath = (0, import_node_path23.join)(cwd, configFile);
-    if (!(0, import_node_fs10.existsSync)(absolutePath)) {
+    let absolutePath = (0, import_node_path25.join)(cwd, configFile);
+    if (!(0, import_node_fs11.existsSync)(absolutePath)) {
       configFile = "next.config.mjs";
-      absolutePath = (0, import_node_path23.join)(cwd, configFile);
+      absolutePath = (0, import_node_path25.join)(cwd, configFile);
     }
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyCspHeaderRecipe(source);
@@ -16404,7 +16554,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_rate_limit") {
     const hasUpstash = await detectUpstash(cwd);
-    const middlewarePath = (0, import_node_path23.join)(cwd, "middleware.ts");
+    const middlewarePath = (0, import_node_path25.join)(cwd, "middleware.ts");
     const source = await readSourceOrEmpty(middlewarePath);
     const result = applyRateLimitRecipe(source, hasUpstash);
     return {
@@ -16426,7 +16576,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
         recipeName: gapId
       };
     }
-    const absolutePath = (0, import_node_path23.join)(cwd, configFile);
+    const absolutePath = (0, import_node_path25.join)(cwd, configFile);
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyEslintRestrictedImportsRecipe(source, configFile);
     return {
@@ -16440,13 +16590,13 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   return null;
 }
-var import_node_fs10, import_promises16, import_node_path23;
+var import_node_fs11, import_promises17, import_node_path25;
 var init_recipes = __esm({
   "src/heal/recipes/index.ts"() {
     "use strict";
-    import_node_fs10 = require("node:fs");
-    import_promises16 = require("node:fs/promises");
-    import_node_path23 = require("node:path");
+    import_node_fs11 = require("node:fs");
+    import_promises17 = require("node:fs/promises");
+    import_node_path25 = require("node:path");
     init_envAuthSecret();
     init_envNodeEnv();
     init_envDatabaseUrl();
@@ -16455,6 +16605,7 @@ var init_recipes = __esm({
     init_nextjsLoadingState();
     init_nextjsNotFound();
     init_supabaseRls2();
+    init_rlsMigrationTarget();
     init_nextjsCspHeader();
     init_nextjsRateLimit();
     init_eslintRestrictedImports();
@@ -16462,11 +16613,12 @@ var init_recipes = __esm({
 });
 
 // src/heal/apply.ts
-function healId() {
-  return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
+function rollbackInstructions(id, file, existedBefore) {
+  if (!existedBefore) return `Delete ${file}: it did not exist before this heal.`;
+  return `Copy .viberaven/heal/${id}/before/target.txt back over ${file}, or apply the reverse of .viberaven/heal/${id}/patch.diff.`;
 }
 async function applyHeal(options) {
-  const id = healId();
+  let id = newHealId();
   if (!options.yes) {
     return {
       $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
@@ -16521,14 +16673,17 @@ async function applyHeal(options) {
           rollback: { available: false, instructions: "Recipe matched but no change was needed (already applied or file already exists)." }
         };
       }
-      const absoluteTarget = (0, import_node_path24.join)(options.cwd, dispatched.targetFile);
+      const absoluteTarget = (0, import_node_path26.join)(options.cwd, dispatched.targetFile);
       assertSafeHealTarget(options.cwd, dispatched.targetFile);
-      await (0, import_promises17.mkdir)((0, import_node_path24.dirname)(absoluteTarget), { recursive: true });
-      const healDir2 = (0, import_node_path24.join)(options.cwd, ".viberaven", "heal", id);
-      await (0, import_promises17.mkdir)((0, import_node_path24.join)(healDir2, "before"), { recursive: true });
-      const beforeContent = (0, import_node_fs11.existsSync)(absoluteTarget) ? await (0, import_promises17.readFile)(absoluteTarget, "utf8") : "";
-      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
-      await (0, import_promises17.writeFile)(absoluteTarget, dispatched.output, "utf8");
+      await (0, import_promises18.mkdir)((0, import_node_path26.dirname)(absoluteTarget), { recursive: true });
+      const created2 = await createHealDir(options.cwd);
+      id = created2.id;
+      const healDir2 = created2.dir;
+      await (0, import_promises18.mkdir)((0, import_node_path26.join)(healDir2, "before"));
+      const existedBefore = (0, import_node_fs12.existsSync)(absoluteTarget);
+      const beforeContent = existedBefore ? await (0, import_promises18.readFile)(absoluteTarget, "utf8") : "";
+      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
+      await (0, import_promises18.writeFile)(absoluteTarget, dispatched.output, "utf8");
       const patch2 = [
         `--- ${dispatched.targetFile}`,
         `+++ ${dispatched.targetFile}`,
@@ -16538,7 +16693,7 @@ async function applyHeal(options) {
         dispatched.output,
         ""
       ].join("\n");
-      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "patch.diff"), patch2, "utf8");
+      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "patch.diff"), patch2, "utf8");
       const result2 = {
         $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
         schemaVersion: "v1",
@@ -16548,18 +16703,19 @@ async function applyHeal(options) {
         status: "applied_verify_not_run",
         gapId: options.gapId,
         recipe: dispatched.recipeName,
+        ...dispatched.warnings?.length ? { warnings: dispatched.warnings } : {},
         target: dispatched.targetFile,
-        changedFiles: [(0, import_node_path24.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
+        changedFiles: [(0, import_node_path26.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
         artifacts: {
           patch: `.viberaven/heal/${id}/patch.diff`,
           result: `.viberaven/heal/${id}/result.json`
         },
         rollback: {
           available: true,
-          instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
+          instructions: rollbackInstructions(id, (0, import_node_path26.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/"), existedBefore)
         }
       };
-      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
+      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
 `, "utf8");
       return result2;
     }
@@ -16579,7 +16735,7 @@ async function applyHeal(options) {
     };
   }
   const absolute = assertSafeHealTarget(options.cwd, options.target);
-  const before = await (0, import_promises17.readFile)(absolute, "utf8");
+  const before = await (0, import_promises18.readFile)(absolute, "utf8");
   const recipe = applyEmptyCatchRecipe(before);
   if (!recipe.changed) {
     return {
@@ -16596,10 +16752,12 @@ async function applyHeal(options) {
       rollback: { available: false, instructions: "No supported heal recipe matched this file." }
     };
   }
-  const healDir = (0, import_node_path24.join)(options.cwd, ".viberaven", "heal", id);
-  await (0, import_promises17.mkdir)((0, import_node_path24.join)(healDir, "before"), { recursive: true });
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "before", "target.txt"), before, "utf8");
-  await (0, import_promises17.writeFile)(absolute, recipe.output, "utf8");
+  const created = await createHealDir(options.cwd);
+  id = created.id;
+  const healDir = created.dir;
+  await (0, import_promises18.mkdir)((0, import_node_path26.join)(healDir, "before"));
+  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "before", "target.txt"), before, "utf8");
+  await (0, import_promises18.writeFile)(absolute, recipe.output, "utf8");
   const patch = [
     `--- ${options.target}`,
     `+++ ${options.target}`,
@@ -16609,7 +16767,7 @@ async function applyHeal(options) {
     recipe.output,
     ""
   ].join("\n");
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "patch.diff"), patch, "utf8");
+  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "patch.diff"), patch, "utf8");
   const result = {
     $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
     schemaVersion: "v1",
@@ -16620,42 +16778,65 @@ async function applyHeal(options) {
     gapId: options.gapId,
     recipe: "empty-catch-safe-response",
     target: options.target,
-    changedFiles: [(0, import_node_path24.relative)(options.cwd, absolute).replace(/\\/g, "/")],
+    changedFiles: [(0, import_node_path26.relative)(options.cwd, absolute).replace(/\\/g, "/")],
     artifacts: {
       patch: `.viberaven/heal/${id}/patch.diff`,
       result: `.viberaven/heal/${id}/result.json`
     },
     rollback: {
       available: true,
-      instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
+      // The empty-catch recipe only edits a file that already exists.
+      instructions: rollbackInstructions(id, (0, import_node_path26.relative)(options.cwd, absolute).replace(/\\/g, "/"), true)
     }
   };
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises17, import_node_fs11, import_node_path24;
+var import_promises18, import_node_fs12, import_node_path26;
 var init_apply = __esm({
   "src/heal/apply.ts"() {
     "use strict";
-    import_promises17 = require("node:fs/promises");
-    import_node_fs11 = require("node:fs");
-    import_node_path24 = require("node:path");
+    import_promises18 = require("node:fs/promises");
+    import_node_fs12 = require("node:fs");
+    import_node_path26 = require("node:path");
     init_pathSafety();
     init_emptyCatch();
+    init_healId();
     init_recipes();
   }
 });
 
 // src/heal/plan.ts
-function healId2() {
-  return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
-}
 async function writeHealPlan(options) {
-  const dir = (0, import_node_path25.join)(options.cwd, ".viberaven");
-  await (0, import_promises18.mkdir)(dir, { recursive: true });
-  const id = healId2();
+  const dir = (0, import_node_path27.join)(options.cwd, ".viberaven");
+  await (0, import_promises19.mkdir)(dir, { recursive: true });
+  const id = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
+  const proposal = [];
+  let proposedFile;
+  if (!options.target && options.gapId === "rls_disabled") {
+    const rls = await planRlsMigration(options.cwd);
+    if (rls.kind === "migration") {
+      proposedFile = rls.file;
+      proposal.push(
+        "## Proposed change",
+        "",
+        `New migration: \`${rls.file}\``,
+        "",
+        "```sql",
+        rls.sql.trimEnd(),
+        "```",
+        "",
+        "It adds no policies. Apply it with `npx -y viberaven fix --gap rls_disabled`, add the policies the app needs, then apply the migration to the database the way this project applies migrations.",
+        ""
+      );
+    } else if (rls.kind === "refused") {
+      proposal.push("## No automatic recipe", "", rls.reason, "");
+    } else {
+      proposal.push("## Nothing to change", "", "Every public table the migrations create already has row level security.", "");
+    }
+  }
   const markdown = [
     "# VibeRaven Heal Plan",
     "",
@@ -16664,6 +16845,7 @@ async function writeHealPlan(options) {
     "",
     "This plan is non-destructive. It does not edit source files.",
     "",
+    ...proposal,
     `Verify after manual fix: \`${PUBLIC_VERIFY_COMMAND}\``,
     ""
   ].join("\n");
@@ -16675,34 +16857,33 @@ async function writeHealPlan(options) {
     mode: "plan",
     status: "planned",
     gapId: options.gapId,
-    target: options.target,
+    target: options.target ?? proposedFile,
     changedFiles: [],
     artifacts: { plan: ".viberaven/heal-plan.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-plan.md"), markdown, "utf8");
-  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises19.writeFile)((0, import_node_path27.join)(dir, "heal-plan.md"), markdown, "utf8");
+  await (0, import_promises19.writeFile)((0, import_node_path27.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises18, import_node_path25;
+var import_promises19, import_node_path27;
 var init_plan = __esm({
   "src/heal/plan.ts"() {
     "use strict";
-    import_promises18 = require("node:fs/promises");
-    import_node_path25 = require("node:path");
+    import_promises19 = require("node:fs/promises");
+    init_healId();
+    import_node_path27 = require("node:path");
     init_commands();
+    init_supabaseRls2();
   }
 });
 
 // src/heal/prompt.ts
-function healId3() {
-  return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
-}
 async function writeHealPrompt(options) {
-  const dir = (0, import_node_path26.join)(options.cwd, ".viberaven");
-  await (0, import_promises19.mkdir)(dir, { recursive: true });
-  const id = healId3();
+  const dir = (0, import_node_path28.join)(options.cwd, ".viberaven");
+  await (0, import_promises20.mkdir)(dir, { recursive: true });
+  const id = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
   const prompt = [
     "# VibeRaven Heal Prompt",
@@ -16728,15 +16909,16 @@ async function writeHealPrompt(options) {
     artifacts: { prompt: ".viberaven/heal-prompt.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises19.writeFile)((0, import_node_path26.join)(dir, "heal-prompt.md"), prompt, "utf8");
+  await (0, import_promises20.writeFile)((0, import_node_path28.join)(dir, "heal-prompt.md"), prompt, "utf8");
   return result;
 }
-var import_promises19, import_node_path26;
+var import_promises20, import_node_path28;
 var init_prompt = __esm({
   "src/heal/prompt.ts"() {
     "use strict";
-    import_promises19 = require("node:fs/promises");
-    import_node_path26 = require("node:path");
+    import_promises20 = require("node:fs/promises");
+    init_healId();
+    import_node_path28 = require("node:path");
     init_commands();
   }
 });
@@ -16747,7 +16929,7 @@ function loopStatePath(workspaceRoot) {
 }
 async function loadLoopState(workspaceRoot) {
   try {
-    const raw = await (0, import_promises20.readFile)(loopStatePath(workspaceRoot), "utf8");
+    const raw = await (0, import_promises21.readFile)(loopStatePath(workspaceRoot), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.batchApplied === "number" && typeof parsed.lastGapCount === "number" && typeof parsed.stalledScans === "number") {
       const p2 = parsed;
@@ -16767,8 +16949,8 @@ async function loadLoopState(workspaceRoot) {
 async function saveLoopState(workspaceRoot, state) {
   try {
     const dir = (0, import_path.join)(workspaceRoot, ".viberaven");
-    await (0, import_promises20.mkdir)(dir, { recursive: true });
-    await (0, import_promises20.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
+    await (0, import_promises21.mkdir)(dir, { recursive: true });
+    await (0, import_promises21.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
   } catch (err) {
     console.warn("[VibeRaven] Could not save loop-state.json:", err instanceof Error ? err.message : String(err));
   }
@@ -16794,11 +16976,11 @@ function resetBatch(state, newGapCount) {
     appliedGapIdsSinceScan: []
   };
 }
-var import_promises20, import_path, DEFAULT_LOOP_STATE;
+var import_promises21, import_path, DEFAULT_LOOP_STATE;
 var init_loopState = __esm({
   "src/loopState.ts"() {
     "use strict";
-    import_promises20 = require("fs/promises");
+    import_promises21 = require("fs/promises");
     import_path = require("path");
     DEFAULT_LOOP_STATE = {
       batchApplied: 0,
@@ -16839,11 +17021,11 @@ var init_heal = __esm({
 
 // src/stackRecommend.ts
 async function recommendStack(cwd = process.cwd()) {
-  const pkgPath = (0, import_node_path27.join)(cwd, "package.json");
-  if (!(0, import_node_fs12.existsSync)(pkgPath)) {
+  const pkgPath = (0, import_node_path29.join)(cwd, "package.json");
+  if (!(0, import_node_fs13.existsSync)(pkgPath)) {
     return DEFAULT_STACK;
   }
-  const pkg = JSON.parse(await (0, import_promises21.readFile)(pkgPath, "utf-8"));
+  const pkg = JSON.parse(await (0, import_promises22.readFile)(pkgPath, "utf-8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   const names = Object.keys(deps).join(" ").toLowerCase();
   const rec = {
@@ -16871,13 +17053,13 @@ async function recommendStack(cwd = process.cwd()) {
   }
   return rec;
 }
-var import_promises21, import_node_fs12, import_node_path27, DEFAULT_STACK;
+var import_promises22, import_node_fs13, import_node_path29, DEFAULT_STACK;
 var init_stackRecommend = __esm({
   "src/stackRecommend.ts"() {
     "use strict";
-    import_promises21 = require("node:fs/promises");
-    import_node_fs12 = require("node:fs");
-    import_node_path27 = require("node:path");
+    import_promises22 = require("node:fs/promises");
+    import_node_fs13 = require("node:fs");
+    import_node_path29 = require("node:path");
     DEFAULT_STACK = {
       frontend: "react",
       ui: "tailwind + shadcn/ui",
@@ -16918,11 +17100,332 @@ var init_runInit = __esm({
   }
 });
 
+// src/commands/checkChange.ts
+function findingKey(finding) {
+  return `${finding.id}\0${finding.title}`;
+}
+function findingSubjects(finding) {
+  const line = (finding.detail.split("\n").find((part) => part.trim()) ?? "").replace(LOCATION_TEXT, " ");
+  return [...new Set((line.match(SUBJECT) ?? []).map((subject) => subject.toLowerCase()))].sort();
+}
+function bySeverity(a, b3) {
+  return SEVERITY_RANK3[a.severity] - SEVERITY_RANK3[b3.severity] || a.title.localeCompare(b3.title);
+}
+function compareFindings(base, head, ref, baseCommit) {
+  const baseByKey = new Map(base.map((finding) => [findingKey(finding), finding]));
+  const headKeys = new Set(head.map(findingKey));
+  const introduced = [];
+  const resolved = base.filter((finding) => !headKeys.has(findingKey(finding)));
+  const unchanged = [];
+  for (const finding of head) {
+    const before = baseByKey.get(findingKey(finding));
+    if (!before) {
+      introduced.push(finding);
+      continue;
+    }
+    const was = new Set(findingSubjects(before));
+    const now = findingSubjects(finding);
+    const added = now.filter((subject) => !was.has(subject));
+    const removed = [...was].filter((subject) => !now.includes(subject));
+    if (added.length) introduced.push({ ...finding, subjects: added });
+    else unchanged.push(finding);
+    if (removed.length) resolved.push({ ...before, subjects: removed });
+  }
+  return { base: ref, baseCommit, introduced: introduced.sort(bySeverity), resolved: resolved.sort(bySeverity), unchanged: unchanged.sort(bySeverity) };
+}
+async function git(cwd, args) {
+  const call = await safeGitInvocation(cwd, args);
+  const { stdout } = await execFileAsync4("git", call.args, { cwd, env: call.env, windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
+  return stdout;
+}
+async function resolveBaseCommit(cwd, ref) {
+  let commit;
+  try {
+    commit = (await git(cwd, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`])).trim();
+  } catch {
+    throw new Error(
+      `Could not find "${ref}" in this repository. Fetch it first (git fetch origin ${ref.replace(/^origin\//, "")}); in GitHub Actions, check out with fetch-depth: 0.`
+    );
+  }
+  try {
+    const mergeBase = (await git(cwd, ["merge-base", commit, "HEAD"])).trim();
+    return mergeBase || commit;
+  } catch {
+    return commit;
+  }
+}
+function parseTree(output) {
+  const entries = [];
+  for (const record of output.split("\0")) {
+    if (!record) continue;
+    const tab = record.indexOf("	");
+    const [mode, type, sha, size] = record.slice(0, tab).trim().split(/\s+/);
+    entries.push({ mode, type, sha, size: Number.parseInt(size, 10) || 0, path: record.slice(tab + 1) });
+  }
+  return entries;
+}
+function wanted(entry) {
+  if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") return false;
+  if (entry.size > MAX_BLOB_BYTES) return false;
+  return !entry.path.split("/").some((segment) => SKIP_SEGMENTS.has(segment));
+}
+async function readBlobs(cwd, shas) {
+  const blobs = /* @__PURE__ */ new Map();
+  if (!shas.length) return blobs;
+  const call = await safeGitInvocation(cwd, ["cat-file", "--batch"]);
+  const output = await new Promise((resolveOutput, reject) => {
+    const child = (0, import_node_child_process6.spawn)("git", call.args, { cwd, env: call.env, windowsHide: true });
+    const chunks = [];
+    let stderr = "";
+    child.stdout.on("data", (chunk) => chunks.push(chunk));
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolveOutput(Buffer.concat(chunks)) : reject(new Error(stderr.trim() || `git cat-file exited with ${code}`)));
+    child.stdin.end(`${shas.join("\n")}
+`);
+  });
+  let offset = 0;
+  while (offset < output.length) {
+    const newline = output.indexOf(10, offset);
+    if (newline === -1) break;
+    const [sha, type, sizeText] = output.subarray(offset, newline).toString().split(" ");
+    offset = newline + 1;
+    if (type === "missing" || sizeText === void 0) continue;
+    const size = Number.parseInt(sizeText, 10);
+    blobs.set(sha, output.subarray(offset, offset + size));
+    offset += size + 1;
+  }
+  return blobs;
+}
+async function exportCommit(cwd, commit) {
+  const entries = parseTree(await git(cwd, ["ls-tree", "-r", "-z", "-l", "--full-tree", commit])).filter(wanted);
+  const blobs = await readBlobs(cwd, [...new Set(entries.map((entry) => entry.sha))]);
+  const root = await (0, import_promises23.mkdtemp)((0, import_node_path30.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
+  for (const entry of entries) {
+    const target = (0, import_node_path30.resolve)(root, ...entry.path.split("/"));
+    if (!target.startsWith(root + import_node_path30.sep)) continue;
+    const content = blobs.get(entry.sha);
+    if (!content) continue;
+    await (0, import_promises23.mkdir)((0, import_node_path30.dirname)(target), { recursive: true });
+    await (0, import_promises23.writeFile)(target, content);
+  }
+  return root;
+}
+async function checkChange(cwd, ref, head) {
+  const baseCommit = await resolveBaseCommit(cwd, ref);
+  const folder = await exportCommit(cwd, baseCommit);
+  try {
+    const result = await runProjectScan({ workspacePath: folder });
+    if (!result.ok) throw new Error(`The check on ${ref} did not finish: ${result.message}`);
+    return compareFindings(result.artifact.gaps, head, ref, baseCommit);
+  } finally {
+    await (0, import_promises23.rm)(folder, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
+  }
+}
+function cell(text) {
+  return text.replace(/\r?\n/g, " ").replace(/\|/g, "\\|").trim();
+}
+function firstLine(detail) {
+  const line = detail.split("\n").map((part) => part.trim()).find(Boolean) ?? "";
+  return line.length > 180 ? `${line.slice(0, 177)}\u2026` : line;
+}
+function plural2(count, word) {
+  return `${count} ${word}${count === 1 ? "" : "s"}`;
+}
+function table(findings) {
+  return [
+    "| | Finding | Check |",
+    "|---|---|---|",
+    ...findings.map((finding) => {
+      const why = finding.subjects?.length ? `New in this change: ${finding.subjects.join(", ")}` : firstLine(finding.detail);
+      return `| ${DOT[finding.severity]} | **${cell(finding.title)}**${why ? `<br>${cell(why)}` : ""} | \`${cell(finding.id)}\` |`;
+    })
+  ];
+}
+function fixedLabel(finding) {
+  return `\u2705 ${cell(finding.title)}${finding.subjects?.length ? ` for ${cell(finding.subjects.join(", "))}` : ""} (\`${cell(finding.id)}\`)`;
+}
+function renderCheckMarkdown({ head, change, version, score }) {
+  const lines = [COMMENT_MARKER];
+  const sorted = [...head].sort(bySeverity);
+  const critical = sorted.filter((finding) => finding.severity === "critical").length;
+  const warnings = sorted.filter((finding) => finding.severity === "warning").length;
+  if (change) {
+    const newCritical = change.introduced.filter((finding) => finding.severity === "critical").length;
+    const headline = newCritical ? `${plural2(newCritical, "new blocker")} in this change` : change.introduced.length ? `${plural2(change.introduced.length, "new finding")} in this change, no new blockers` : "No new findings in this change";
+    lines.push(`### VibeRaven \xB7 ${headline}`, "");
+    lines.push(`Compared with \`${change.base}\` (${change.baseCommit.slice(0, 7)}).${change.resolved.length ? ` This change fixes ${plural2(change.resolved.length, "finding")}.` : ""}`, "");
+    if (change.introduced.length) lines.push(...table(change.introduced), "");
+    if (change.resolved.length) {
+      lines.push(`**Fixed by this change:** ${change.resolved.map(fixedLabel).join(" \xB7 ")}`, "");
+    }
+    if (change.unchanged.length) {
+      lines.push(`<details><summary>Already in ${cell(change.base)} before this change (${change.unchanged.length})</summary>`, "", ...table(change.unchanged), "", "</details>", "");
+    }
+    const firstNew = change.introduced.find((finding) => finding.severity === "critical") ?? change.introduced[0];
+    if (firstNew) lines.push(`Fix it with your coding agent: \`npx -y viberaven fix --gap ${firstNew.id}\`, or open the Studio with \`npx -y viberaven\`.`, "");
+  } else {
+    const headline = critical ? `${plural2(critical, "blocker")}, ${plural2(warnings, "warning")}` : `No blockers, ${plural2(warnings, "warning")}`;
+    lines.push(`### VibeRaven \xB7 ${headline}`, "");
+    if (sorted.length) lines.push(...table(sorted), "");
+    else lines.push("No launch findings in the repo evidence.", "");
+  }
+  lines.push(
+    `<sub>viberaven ${version}${typeof score === "number" ? ` \xB7 readiness ${score}/100` : ""} \xB7 checked where it ran, nothing was uploaded. Advice, not a gate: a clear result reads the repo, it is not a security audit.</sub>`
+  );
+  return `${lines.join("\n")}
+`;
+}
+var import_node_child_process6, import_promises23, import_node_os, import_node_path30, import_node_util4, execFileAsync4, MAX_BLOB_BYTES, SKIP_SEGMENTS, SEVERITY_RANK3, LOCATION_TEXT, SUBJECT, COMMENT_MARKER, DOT;
+var init_checkChange = __esm({
+  "src/commands/checkChange.ts"() {
+    "use strict";
+    import_node_child_process6 = require("node:child_process");
+    import_promises23 = require("node:fs/promises");
+    import_node_os = require("node:os");
+    import_node_path30 = require("node:path");
+    import_node_util4 = require("node:util");
+    init_runScan();
+    init_safeGit();
+    execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process6.execFile);
+    MAX_BLOB_BYTES = 1e6;
+    SKIP_SEGMENTS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".turbo", ".vercel", ".output", "dist", "build", "coverage"]);
+    SEVERITY_RANK3 = { critical: 0, warning: 1, info: 2 };
+    LOCATION_TEXT = /[\w./\\-]+\.(?:sql|tsx?|jsx?|mjs|cjs|json|toml|ya?ml|env|prisma|md)(?::\d+)?/gi;
+    SUBJECT = /\b[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*\b/gi;
+    COMMENT_MARKER = "<!-- viberaven-check -->";
+    DOT = { critical: "\u{1F534}", warning: "\u{1F7E1}", info: "\u26AA" };
+  }
+});
+
+// src/commands/initGithub.ts
+function renderWorkflow(version = VERSION) {
+  return [
+    "# VibeRaven checks every pull request in this repository's own GitHub Actions run.",
+    "# The code is read on the runner and never uploaded. Written by `npx -y viberaven init --github`.",
+    "name: VibeRaven",
+    "",
+    "on:",
+    "  pull_request:",
+    "",
+    "permissions:",
+    "  contents: read",
+    "  pull-requests: write",
+    "",
+    "jobs:",
+    "  check:",
+    "    name: Launch check",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          fetch-depth: 0",
+    "",
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 20",
+    "",
+    "      - name: Check this change",
+    "        id: check",
+    "        env:",
+    "          BASE_REF: ${{ github.base_ref }}",
+    "        run: |",
+    "          code=0",
+    `          npx -y viberaven@${version} check --base "origin/$BASE_REF" --markdown > viberaven-check.md || code=$?`,
+    '          cat viberaven-check.md >> "$GITHUB_STEP_SUMMARY"',
+    '          echo "code=$code" >> "$GITHUB_OUTPUT"',
+    "",
+    "      # Pull requests from forks get a read-only token: they keep the job summary and skip the comment.",
+    "      - name: Comment on the pull request",
+    "        if: github.event.pull_request.head.repo.full_name == github.repository",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    "          PR: ${{ github.event.pull_request.number }}",
+    "        run: |",
+    `          id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR/comments" --paginate --jq '.[] | select(.body | contains("${COMMENT_MARKER}")) | .id' | tail -n 1)`,
+    '          if [ -n "$id" ]; then',
+    '            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -F body=@viberaven-check.md > /dev/null',
+    "          else",
+    '            gh pr comment "$PR" --body-file viberaven-check.md',
+    "          fi",
+    "",
+    "      # Advice, not a gate. To block merging when a change adds a launch blocker, uncomment this step",
+    '      # and mark "Launch check" as required in the branch protection settings.',
+    "      # - name: Fail on new blockers",
+    "      #   if: steps.check.outputs.code == '1'",
+    "      #   run: exit 1",
+    ""
+  ].join("\n");
+}
+async function hasGithubRemote(cwd) {
+  try {
+    const call = await safeGitInvocation(cwd, ["remote", "-v"]);
+    const { stdout } = await execFileAsync5("git", call.args, { cwd, env: call.env, windowsHide: true });
+    return /github\.com[:/]/i.test(stdout);
+  } catch {
+    return false;
+  }
+}
+async function githubWorkflowStatus(cwd) {
+  return { exists: (0, import_node_fs14.existsSync)((0, import_node_path31.join)(cwd, WORKFLOW_PATH)), path: DISPLAY_PATH, onGithub: await hasGithubRemote(cwd) };
+}
+async function writeGithubWorkflow(cwd, options = {}) {
+  const target = (0, import_node_path31.join)(cwd, WORKFLOW_PATH);
+  if ((0, import_node_fs14.existsSync)(target) && !options.force) return { written: false, status: await githubWorkflowStatus(cwd) };
+  await (0, import_promises24.mkdir)((0, import_node_path31.dirname)(target), { recursive: true });
+  await (0, import_promises24.writeFile)(target, renderWorkflow(), "utf8");
+  return { written: true, status: await githubWorkflowStatus(cwd) };
+}
+async function runInitGithubCommand(options) {
+  if (options.dryRun) {
+    console.log(`Would write ${DISPLAY_PATH}:
+`);
+    console.log(renderWorkflow());
+    return 0;
+  }
+  const { written, status } = await writeGithubWorkflow(options.cwd, { force: options.force });
+  if (!written) {
+    console.log(`${DISPLAY_PATH} already exists. Nothing changed. Run with --force to replace it.`);
+    return 0;
+  }
+  console.log(`Wrote ${DISPLAY_PATH}.`);
+  console.log("");
+  console.log("Commit it, and every pull request gets one VibeRaven comment with what the change added or fixed:");
+  console.log(`  git add ${DISPLAY_PATH} && git commit -m "Check pull requests with VibeRaven"`);
+  console.log("");
+  console.log("It runs in your own GitHub Actions, so private repositories work and the code is never uploaded.");
+  if (!status.onGithub) console.log("This repository has no github.com remote yet: the workflow runs once it is pushed to GitHub.");
+  return 0;
+}
+var import_node_child_process7, import_node_fs14, import_promises24, import_node_path31, import_node_util5, execFileAsync5, WORKFLOW_PATH, DISPLAY_PATH;
+var init_initGithub = __esm({
+  "src/commands/initGithub.ts"() {
+    "use strict";
+    import_node_child_process7 = require("node:child_process");
+    import_node_fs14 = require("node:fs");
+    import_promises24 = require("node:fs/promises");
+    import_node_path31 = require("node:path");
+    import_node_util5 = require("node:util");
+    init_safeGit();
+    init_version();
+    init_checkChange();
+    execFileAsync5 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
+    WORKFLOW_PATH = (0, import_node_path31.join)(".github", "workflows", "viberaven.yml");
+    DISPLAY_PATH = ".github/workflows/viberaven.yml";
+  }
+});
+
 // src/commands/doctorAgents.ts
+function managedBlocks(content) {
+  const blocks = content.match(/<!-- (?:VIBERAVEN:START|viberaven:agent-rules:start) -->[\s\S]*?<!-- (?:VIBERAVEN:END|viberaven:agent-rules:end) -->/g);
+  return (blocks ?? []).join("\n");
+}
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item4 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists = await fileExists2((0, import_node_path28.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path32.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
@@ -16930,17 +17433,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item4 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists = await fileExists2((0, import_node_path28.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path32.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
       message: exists ? `${item4.file} exists` : `Missing ${item4.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path28.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path32.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
-    const legacyContent = await (0, import_promises22.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path28.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const legacyContent = await (0, import_promises25.readFile)(legacyCursorPath, "utf-8");
+    const hasCoreSplit = await fileExists2((0, import_node_path32.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -16951,7 +17454,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path28.join)(cwd, file);
+    const path = (0, import_node_path32.join)(cwd, file);
     const exists = await fileExists2(path);
     if (!exists) {
       checks.push({
@@ -16961,7 +17464,7 @@ async function checkAgentInjection(cwd) {
       });
       continue;
     }
-    const content = await (0, import_promises22.readFile)(path, "utf-8");
+    const content = await (0, import_promises25.readFile)(path, "utf-8");
     const hasCommand = content.includes(PUBLIC_CHECK_COMMAND);
     checks.push({
       id: `canonical-${target}`,
@@ -16977,6 +17480,15 @@ async function checkAgentInjection(cwd) {
         });
       }
     }
+    const managed = target === "cursor" ? content : managedBlocks(content);
+    const gatePhrase = GATE_RULE_PHRASES_1_5_2.find((phrase) => managed.includes(phrase));
+    if (gatePhrase) {
+      checks.push({
+        id: `stale-gate-rules-${target}`,
+        status: "fail",
+        message: `${file} still has the 1.5.2 gate rules ("${gatePhrase} ..."). Run npx -y viberaven init --agents all to replace them with the current advice block.`
+      });
+    }
   }
   return {
     ok: checks.every((check) => check.status === "pass"),
@@ -16995,18 +17507,18 @@ function formatDoctorAgentsReport(report) {
 }
 async function fileExists2(path) {
   try {
-    await (0, import_promises22.access)(path);
+    await (0, import_promises25.access)(path);
     return true;
   } catch {
     return false;
   }
 }
-var import_promises22, import_node_path28, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS;
+var import_promises25, import_node_path32, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
 var init_doctorAgents = __esm({
   "src/commands/doctorAgents.ts"() {
     "use strict";
-    import_promises22 = require("node:fs/promises");
-    import_node_path28 = require("node:path");
+    import_promises25 = require("node:fs/promises");
+    import_node_path32 = require("node:path");
     init_commands();
     init_agentTargets();
     REQUIRED_EXISTENCE_CHECKS = [
@@ -17025,6 +17537,12 @@ var init_doctorAgents = __esm({
       { id: "stale-viberaven-station", pattern: "viberaven-station" },
       { id: "stale-viberice", pattern: "viberice" }
     ];
+    GATE_RULE_PHRASES_1_5_2 = [
+      "The loop is not done until",
+      "Gate is not clear until",
+      "Do NOT rely on manual production checklists",
+      "Use VibeRaven before launch, deployment, real users"
+    ];
   }
 });
 
@@ -17271,7 +17789,7 @@ function buildContextCleanupPlan(input) {
   const items = [];
   const seen = /* @__PURE__ */ new Set();
   for (const file of input.files) {
-    const path = normalizePath5((0, import_node_path29.relative)(input.projectRoot, file.path) || file.path);
+    const path = normalizePath5((0, import_node_path33.relative)(input.projectRoot, file.path) || file.path);
     const fullPath = normalizePath5(file.path);
     const category = categorizeCleanupFile(path, fullPath, file);
     if (!category || seen.has(path)) {
@@ -17297,10 +17815,10 @@ async function collectCleanupFiles(projectRoot) {
   return files;
 }
 async function writeCleanupPlan(projectRoot, plan) {
-  const outputDir = (0, import_node_path29.join)(projectRoot, ".viberaven");
-  const outputPath = (0, import_node_path29.join)(outputDir, "context-cleanup.md");
-  await (0, import_promises23.mkdir)(outputDir, { recursive: true });
-  await (0, import_promises23.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
+  const outputDir = (0, import_node_path33.join)(projectRoot, ".viberaven");
+  const outputPath = (0, import_node_path33.join)(outputDir, "context-cleanup.md");
+  await (0, import_promises26.mkdir)(outputDir, { recursive: true });
+  await (0, import_promises26.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
   return outputPath;
 }
 function categorizeCleanupFile(relativePath, fullPath, file) {
@@ -17348,7 +17866,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
   }
   let entries;
   try {
-    entries = await (0, import_promises23.readdir)(dir, { withFileTypes: true });
+    entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -17356,9 +17874,9 @@ async function walkCleanupFiles(root, dir, result, depth) {
     if (SKIP_DIRECTORIES.has(entry.name)) {
       continue;
     }
-    const absolute = (0, import_node_path29.join)(dir, entry.name);
+    const absolute = (0, import_node_path33.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (isCachePath(normalizePath5((0, import_node_path29.relative)(root, absolute)))) {
+      if (isCachePath(normalizePath5((0, import_node_path33.relative)(root, absolute)))) {
         result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
         continue;
       }
@@ -17369,7 +17887,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
       continue;
     }
     try {
-      const fileStat = await (0, import_promises23.stat)(absolute);
+      const fileStat = await (0, import_promises26.stat)(absolute);
       result.push({ path: absolute, sizeBytes: fileStat.size, kind: "file" });
     } catch {
       continue;
@@ -17379,12 +17897,12 @@ async function walkCleanupFiles(root, dir, result, depth) {
 function normalizePath5(path) {
   return path.replace(/\\/g, "/");
 }
-var import_promises23, import_node_path29, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
+var import_promises26, import_node_path33, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
 var init_cleanPlan = __esm({
   "src/commands/cleanPlan.ts"() {
     "use strict";
-    import_promises23 = require("node:fs/promises");
-    import_node_path29 = require("node:path");
+    import_promises26 = require("node:fs/promises");
+    import_node_path33 = require("node:path");
     MAX_WALK_DEPTH = 5;
     LARGE_LOG_BYTES = 8192;
     SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -17432,6 +17950,10 @@ function renderTarget(target) {
   return ["Verify:", "```bash", redact(target.command), "```"];
 }
 function renderReadiness(action) {
+  if (action.requiresUserAction && action.readiness?.[0]) {
+    const rest = action.readiness.slice(1, 3).map(redact).filter(Boolean);
+    return [redact(action.readiness[0]), rest.length ? `Ready: ${rest.join(", ")}` : void 0].filter(Boolean).join("\n");
+  }
   const readiness = action.readiness?.slice(0, 2).map(redact).filter(Boolean);
   if (!readiness || readiness.length === 0) {
     return void 0;
@@ -17493,10 +18015,10 @@ var init_render = __esm({
 
 // src/commands/actions.ts
 async function runActionsCommand(input) {
-  const actionsPath = (0, import_node_path30.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path34.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   let raw;
   try {
-    raw = await (0, import_promises24.readFile)(actionsPath, "utf8");
+    raw = await (0, import_promises27.readFile)(actionsPath, "utf8");
   } catch {
     process.stderr.write("No VibeRaven actions found. Run `npx -y viberaven --agent-mode` first.\n");
     return 1;
@@ -17510,12 +18032,12 @@ async function runActionsCommand(input) {
   process.stdout.write(renderActionSurface(manifest));
   return 0;
 }
-var import_promises24, import_node_path30;
+var import_promises27, import_node_path34;
 var init_actions = __esm({
   "src/commands/actions.ts"() {
     "use strict";
-    import_promises24 = require("node:fs/promises");
-    import_node_path30 = require("node:path");
+    import_promises27 = require("node:fs/promises");
+    import_node_path34 = require("node:path");
     init_render();
     init_config();
   }
@@ -17524,7 +18046,7 @@ var init_actions = __esm({
 // src/commands/verifyAction.ts
 async function currentActionExists(cwd, actionId) {
   try {
-    const raw = await (0, import_promises25.readFile)((0, import_node_path31.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path35.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
     const manifest = JSON.parse(raw);
     return manifest.actions.some((action) => action.id === actionId);
   } catch {
@@ -17563,17 +18085,17 @@ async function runVerifyActionCommand(input) {
   }
   process.stdout.write(
     `Verifying ${entry.id} (${entry.title ?? "untitled action"}).
-Run \`npx -y viberaven --verify\` to refresh the production gate for this action.
+This only looks the action up. Run \`npx -y viberaven --verify\` to scan the repo again and see whether the gap is gone.
 `
   );
   return 0;
 }
-var import_promises25, import_node_path31;
+var import_promises28, import_node_path35;
 var init_verifyAction = __esm({
   "src/commands/verifyAction.ts"() {
     "use strict";
-    import_promises25 = require("node:fs/promises");
-    import_node_path31 = require("node:path");
+    import_promises28 = require("node:fs/promises");
+    import_node_path35 = require("node:path");
     init_registry2();
     init_config();
   }
@@ -17614,7 +18136,7 @@ function buildPreviewManifest() {
             ]
           }
         ],
-        verifyCommand: `${PUBLIC_COMMAND} verify --action VR-A1`,
+        verifyCommand: `${PUBLIC_COMMAND} --verify --action VR-A1`,
         resumeInstruction: "Stripe webhook is configured. Continue VibeRaven from VR-A1."
       },
       {
@@ -17640,7 +18162,7 @@ function buildPreviewManifest() {
             value: 'alter table public.example enable row level security;\ncreate policy "Users manage own rows" on public.example for all using (auth.uid() = user_id);'
           }
         ],
-        verifyCommand: `${PUBLIC_COMMAND} verify --action VR-A2`,
+        verifyCommand: `${PUBLIC_COMMAND} --verify --action VR-A2`,
         resumeInstruction: "Supabase RLS is applied. Continue VibeRaven from VR-A2."
       },
       {
@@ -17697,11 +18219,36 @@ var init_preview = __esm({
 async function runCheckCommand(options) {
   const result = await runProjectScan({ workspacePath: options.cwd });
   if (!result.ok) {
+    if (options.markdown) console.log(`${COMMENT_MARKER}
+### VibeRaven could not check this change
+
+${result.message}
+`);
     console.error(formatAgentStatus(ERROR, result.message));
     return 2;
   }
   const artifact = result.artifact;
   const paths = await writeScanArtifacts({ artifact, cwd: options.cwd });
+  let change;
+  if (options.base) {
+    try {
+      change = await checkChange(options.cwd, options.base, artifact.gaps);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.markdown) console.log(`${COMMENT_MARKER}
+### VibeRaven could not compare this change
+
+${message}
+`);
+      console.error(formatAgentStatus(ERROR, message));
+      return 2;
+    }
+  }
+  const failing = change ? change.introduced.some((g2) => g2.severity === "critical") : artifact.gaps.some((g2) => g2.severity === "critical");
+  if (options.markdown) {
+    console.log(renderCheckMarkdown({ head: artifact.gaps, change, version: VERSION, score: artifact.score }));
+    return failing ? 1 : 0;
+  }
   if (options.json) {
     console.log(
       JSON.stringify(
@@ -17716,13 +18263,22 @@ async function runCheckCommand(options) {
             title: gap.title,
             detail: gap.detail
           })),
+          ...change ? {
+            change: {
+              base: change.base,
+              baseCommit: change.baseCommit,
+              introduced: change.introduced.map((gap) => gap.id),
+              resolved: change.resolved.map((gap) => gap.id),
+              unchanged: change.unchanged.map((gap) => gap.id)
+            }
+          } : {},
           artifacts: paths
         },
         null,
         2
       )
     );
-    return artifact.gaps.some((g2) => g2.severity === "critical") ? 1 : 0;
+    return failing ? 1 : 0;
   }
   const sorted = [...artifact.gaps].sort(
     (a, b3) => SEVERITY_ORDER3[a.severity] - SEVERITY_ORDER3[b3.severity]
@@ -17732,14 +18288,37 @@ async function runCheckCommand(options) {
   console.log("");
   console.log(`viberaven check \xB7 ${options.cwd}`);
   console.log("");
+  if (change) {
+    const line = (gap) => `${SEVERITY_ICON[gap.severity]} ${gap.title}  (${gap.id})`;
+    console.log(`Compared with ${change.base} (${change.baseCommit.slice(0, 7)})`);
+    console.log("");
+    console.log(change.introduced.length ? "New in this change:" : "New in this change: nothing");
+    for (const gap of change.introduced) {
+      console.log(`  ${line(gap)}${gap.subjects?.length ? `  new: ${gap.subjects.join(", ")}` : ""}`);
+      if (!options.quiet && !gap.subjects?.length && gap.detail) console.log(`     ${gap.detail.split("\n")[0]}`);
+    }
+    if (change.resolved.length) {
+      console.log("Fixed by this change:");
+      for (const gap of change.resolved) console.log(`  \u2705 ${gap.title}${gap.subjects?.length ? ` for ${gap.subjects.join(", ")}` : ""}  (${gap.id})`);
+    }
+    if (change.unchanged.length) console.log(`Already there before: ${change.unchanged.length}`);
+    const newCritical = change.introduced.filter((g2) => g2.severity === "critical").length;
+    console.log("");
+    console.log(
+      newCritical > 0 ? `Verdict: \u274C ${newCritical} new blocker${newCritical === 1 ? "" : "s"} in this change \xB7 score ${artifact.score}` : `Verdict: \u2705 no new blockers in this change \xB7 score ${artifact.score}`
+    );
+    console.log(`Fix: viberaven fix \xB7 Details: ${paths.tasklistPath}`);
+    console.log("");
+    return failing ? 1 : 0;
+  }
   if (sorted.length === 0) {
     console.log("\u2705 No launch blockers found in repo evidence.");
   } else {
     for (const gap of sorted) {
       console.log(`${SEVERITY_ICON[gap.severity]} ${gap.title}  (${gap.id})`);
       if (!options.quiet && gap.detail) {
-        const firstLine2 = gap.detail.split("\n")[0];
-        console.log(`   ${firstLine2}`);
+        const firstLine3 = gap.detail.split("\n")[0];
+        console.log(`   ${firstLine3}`);
       }
     }
   }
@@ -17758,6 +18337,8 @@ var init_check = __esm({
     init_runScan();
     init_artifacts2();
     init_statusLabels();
+    init_version();
+    init_checkChange();
     SEVERITY_ICON = {
       critical: "\u{1F534}",
       // red circle
@@ -17772,7 +18353,7 @@ var init_check = __esm({
 
 // src/rls/permissionsMatrix.ts
 function sha256(data) {
-  return (0, import_node_crypto.createHash)("sha256").update(data).digest("hex");
+  return (0, import_node_crypto2.createHash)("sha256").update(data).digest("hex");
 }
 function parsePermissionsMatrix(text) {
   let raw;
@@ -17801,12 +18382,12 @@ function parsePermissionsMatrix(text) {
   } else {
     const seen = /* @__PURE__ */ new Set();
     for (const [key, value] of Object.entries(raw.tables)) {
-      const table = parseTable(key, value, problems);
-      if (!table) continue;
-      const full = `${table.schema}.${table.name}`;
+      const table2 = parseTable(key, value, problems);
+      if (!table2) continue;
+      const full = `${table2.schema}.${table2.name}`;
       if (seen.has(full)) problems.push(`tables[${show(key)}]: ${full} is listed twice`);
       seen.add(full);
-      tables.push(table);
+      tables.push(table2);
     }
   }
   if (problems.length > 0) throw new MatrixError(problems);
@@ -17880,10 +18461,10 @@ function parseTable(key, value, problems) {
       }
       const parsed = {};
       for (const action of MATRIX_ACTIONS) {
-        const cell = cells[action];
-        if (cell === void 0) problems.push(`${actorAt}.${action}: missing; write ${quoteList(CELL_VALUES)}`);
-        else if (!CELL_VALUES.includes(cell)) problems.push(`${actorAt}.${action}: must be ${quoteList(CELL_VALUES)} (got ${show(cell)})`);
-        else parsed[action] = cell;
+        const cell2 = cells[action];
+        if (cell2 === void 0) problems.push(`${actorAt}.${action}: missing; write ${quoteList(CELL_VALUES)}`);
+        else if (!CELL_VALUES.includes(cell2)) problems.push(`${actorAt}.${action}: must be ${quoteList(CELL_VALUES)} (got ${show(cell2)})`);
+        else parsed[action] = cell2;
       }
       if (cells.reassign !== void 0) {
         if (!CELL_VALUES.includes(cells.reassign)) problems.push(`${actorAt}.reassign: must be ${quoteList(CELL_VALUES)} (got ${show(cells.reassign)})`);
@@ -17920,11 +18501,11 @@ function parseTable(key, value, problems) {
   const [schema, name] = parts.length === 2 ? parts : ["public", parts[0]];
   return { key, schema, name, ownerColumn, expect, serviceRoleExcluded, seed, ...updateColumn ? { updateColumn } : {} };
 }
-var import_node_crypto, MATRIX_ACTORS, TESTED_ACTORS, MATRIX_ACTIONS, OPTIONAL_ACTIONS, ALL_ACTIONS, CELL_VALUES, DEFAULT_GRANT_MODES, DEFAULT_MATRIX_FILE, MatrixError, IDENT, TOP_KEYS, TABLE_KEYS, OWNER_KEYS, isObject2, show, quoteList;
+var import_node_crypto2, MATRIX_ACTORS, TESTED_ACTORS, MATRIX_ACTIONS, OPTIONAL_ACTIONS, ALL_ACTIONS, CELL_VALUES, DEFAULT_GRANT_MODES, DEFAULT_MATRIX_FILE, MatrixError, IDENT, TOP_KEYS, TABLE_KEYS, OWNER_KEYS, isObject2, show, quoteList;
 var init_permissionsMatrix = __esm({
   "src/rls/permissionsMatrix.ts"() {
     "use strict";
-    import_node_crypto = require("node:crypto");
+    import_node_crypto2 = require("node:crypto");
     MATRIX_ACTORS = ["owner", "other_user", "anon", "service_role"];
     TESTED_ACTORS = ["owner", "other_user", "anon"];
     MATRIX_ACTIONS = ["select", "insert", "update", "delete"];
@@ -18103,13 +18684,13 @@ async function createWorkerDatabase(options) {
   const call = (message, timeoutMs) => {
     if (dead) return Promise.reject(dead);
     const id = ++nextId;
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const timer = setTimeout(() => {
         const error = new RlsTimeoutError(`timed out after ${Math.round(timeoutMs / 1e3)} s`);
         failAll(error);
         void worker.terminate();
       }, timeoutMs);
-      pending.set(id, { resolve: resolve9, reject, timer });
+      pending.set(id, { resolve: resolve10, reject, timer });
       worker.postMessage({ ...message, id });
     });
   };
@@ -18194,22 +18775,22 @@ parentPort.on('message', async (m) => {
 // src/rls/rlsRunner.ts
 function sqlError(error) {
   const e2 = error;
-  return { code: typeof e2?.code === "string" ? e2.code : "unknown", message: firstLine(typeof e2?.message === "string" ? e2.message : String(error)) };
+  return { code: typeof e2?.code === "string" ? e2.code : "unknown", message: firstLine2(typeof e2?.message === "string" ? e2.message : String(error)) };
 }
 function isSqlError(error) {
   return !(error instanceof RlsTimeoutError) && typeof error?.code === "string";
 }
 function displayPath(projectDir, path) {
   for (const base of [projectDir, process.cwd()]) {
-    const rel = (0, import_node_path32.relative)(base, path);
-    if (rel && !rel.startsWith("..") && !(0, import_node_path32.isAbsolute)(rel)) return rel.split("\\").join("/");
+    const rel = (0, import_node_path36.relative)(base, path);
+    if (rel && !rel.startsWith("..") && !(0, import_node_path36.isAbsolute)(rel)) return rel.split("\\").join("/");
   }
   return path;
 }
 async function gitCommit(projectDir, paths) {
   const run = async (args) => {
     const call = await safeGitInvocation(projectDir, args);
-    const { stdout } = await (0, import_node_util4.promisify)(import_node_child_process6.execFile)("git", call.args, { cwd: projectDir, env: call.env, windowsHide: true, timeout: 5e3, encoding: "utf8" });
+    const { stdout } = await (0, import_node_util6.promisify)(import_node_child_process8.execFile)("git", call.args, { cwd: projectDir, env: call.env, windowsHide: true, timeout: 5e3, encoding: "utf8" });
     return String(stdout);
   };
   let sha;
@@ -18256,7 +18837,7 @@ function valueCandidates(column, label) {
   const u2 = label === "u";
   switch (column.typname) {
     case "uuid":
-      return [(0, import_node_crypto2.randomUUID)()];
+      return [(0, import_node_crypto3.randomUUID)()];
     case "json":
     case "jsonb":
       return u2 ? ['{"vr":"u"}', "{}"] : ["{}"];
@@ -18282,11 +18863,11 @@ function valueCandidates(column, label) {
   if (column.category === "A") return u2 ? [] : ["{}"];
   return [];
 }
-async function describeTable(db, table) {
-  const display = `${table.schema}.${table.name}`;
+async function describeTable(db, table2) {
+  const display = `${table2.schema}.${table2.name}`;
   const rel = await db.query(
     `select c.oid::int as oid, c.relkind::text as kind from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = $1 and c.relname = $2`,
-    [table.schema, table.name]
+    [table2.schema, table2.name]
   );
   if (rel.rows.length === 0) return { reason: `${display} does not exist after the migrations; check the table name in the matrix.` };
   const kind = String(rel.rows[0].kind);
@@ -18325,35 +18906,35 @@ async function describeTable(db, table) {
     };
   });
   const byName = new Map(columns.map((c) => [c.name, c]));
-  const owner = byName.get(table.ownerColumn);
-  if (!owner) return { reason: `${display} has no column ${table.ownerColumn} (the matrix owner column).` };
+  const owner = byName.get(table2.ownerColumn);
+  if (!owner) return { reason: `${display} has no column ${table2.ownerColumn} (the matrix owner column).` };
   if (owner.typname !== "uuid" && owner.category !== "S") {
-    return { reason: `${display}.${table.ownerColumn} is ${owner.type}; the owner column must hold auth.uid() (uuid or text).` };
+    return { reason: `${display}.${table2.ownerColumn} is ${owner.type}; the owner column must hold auth.uid() (uuid or text).` };
   }
   const pk = columns.filter((c) => c.isPk);
   if (pk.length === 0) return { reason: `${display} has no primary key; rls-test targets the owner's row by primary key.` };
-  for (const column of Object.keys(table.seed)) {
+  for (const column of Object.keys(table2.seed)) {
     if (!byName.has(column)) return { reason: `the matrix seeds ${display}.${column}, which does not exist.` };
   }
-  if (table.updateColumn) {
-    const column = byName.get(table.updateColumn);
-    if (!column) return { reason: `the matrix updateColumn ${display}.${table.updateColumn} does not exist.` };
+  if (table2.updateColumn) {
+    const column = byName.get(table2.updateColumn);
+    if (!column) return { reason: `the matrix updateColumn ${display}.${table2.updateColumn} does not exist.` };
     if (valueCandidates(column, "u").length === 0) return { reason: `the test cannot invent a new value for ${display}.${column.name} (${column.type}); pick another updateColumn.` };
   }
   const writable = (c) => c.identity === "" && c.generated === "";
-  const required = columns.filter((c) => c.name !== owner.name && c.notNull && !c.hasDefault && writable(c) && !(c.name in table.seed));
+  const required = columns.filter((c) => c.name !== owner.name && c.notNull && !c.hasDefault && writable(c) && !(c.name in table2.seed));
   for (const column of required) {
     if (column.isFk) return { reason: `${display}.${column.name} is a NOT NULL foreign key the test cannot invent; give it a value under "seed" in the matrix.` };
     if (valueCandidates(column, "a").length === 0) {
       return { reason: `${display}.${column.name} (${column.type}) is NOT NULL and the test cannot invent a value; give it one under "seed" in the matrix.` };
     }
   }
-  const seedColumns = Object.keys(table.seed);
+  const seedColumns = Object.keys(table2.seed);
   return {
     shape: {
-      table,
+      table: table2,
       oid,
-      qualified: `${quoteIdent2(table.schema)}.${quoteIdent2(table.name)}`,
+      qualified: `${quoteIdent2(table2.schema)}.${quoteIdent2(table2.name)}`,
       display,
       columns,
       pk,
@@ -18361,7 +18942,7 @@ async function describeTable(db, table) {
       ownerUnique: unique3.has(owner.name),
       ownerInPk: pk.some((c) => c.name === owner.name),
       insertColumns: [owner.name, ...seedColumns, ...required.map((c) => c.name)],
-      rowValues: (label, ownerId) => [ownerId, ...seedColumns.map((c) => table.seed[c]), ...required.map((c) => valueCandidates(c, label)[0])]
+      rowValues: (label, ownerId) => [ownerId, ...seedColumns.map((c) => table2.seed[c]), ...required.map((c) => valueCandidates(c, label)[0])]
     }
   };
 }
@@ -18457,10 +19038,10 @@ function writeControl(filtered, changed) {
     if (!changed(run)) {
       return {
         ok: false,
-        detail: filtered ? `as the superuser the same statement changed ${plural2(run.affected ?? 0, "row")}, expected 1` : "as the superuser the same statement did not change the owner row"
+        detail: filtered ? `as the superuser the same statement changed ${plural3(run.affected ?? 0, "row")}, expected 1` : "as the superuser the same statement did not change the owner row"
       };
     }
-    return { ok: true, detail: `as the superuser the same statement changed ${plural2(filtered ? run.affected ?? 0 : 1, "row")}` };
+    return { ok: true, detail: `as the superuser the same statement changed ${plural3(filtered ? run.affected ?? 0 : 1, "row")}` };
   };
 }
 async function differingValue(db, shape, target, column) {
@@ -18487,7 +19068,7 @@ async function selectPlans(c) {
     return [
       {
         stmt: { name: "select", sql: `select ${pkList} from ${shape.qualified} where ${pkCondition(shape, 1)}`, params: target, display: `select the owner's row from ${shape.display} by primary key`, filtered: true, select: "pk" },
-        controlOk: (run) => run.error ? { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` } : run.rows?.length === 1 ? { ok: true, detail: "as the superuser the same statement returned 1 row" } : { ok: false, detail: `as the superuser the same statement returned ${plural2(run.rows?.length ?? 0, "row")}, expected 1` },
+        controlOk: (run) => run.error ? { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` } : run.rows?.length === 1 ? { ok: true, detail: "as the superuser the same statement returned 1 row" } : { ok: false, detail: `as the superuser the same statement returned ${plural3(run.rows?.length ?? 0, "row")}, expected 1` },
         judge: (run) => {
           const denied = privilegeDenied(run);
           if (denied) return denied;
@@ -18542,7 +19123,7 @@ function insertPlans(c) {
       prep,
       controlOk: (run) => {
         if (run.error) return { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` };
-        return added(run) ? { ok: true, detail: "as the superuser the same statement changed 1 row" } : { ok: false, detail: `as the superuser the same statement changed ${plural2(run.affected ?? 0, "row")}, expected 1` };
+        return added(run) ? { ok: true, detail: "as the superuser the same statement changed 1 row" } : { ok: false, detail: `as the superuser the same statement changed ${plural3(run.affected ?? 0, "row")}, expected 1` };
       },
       judge: (run) => {
         if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message} (42501). Only the generated row was tried; other values may allow insertion` };
@@ -18554,7 +19135,7 @@ function insertPlans(c) {
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows added, table unchanged" };
         return {
           verdict: "unknown",
-          detail: `reported ${plural2(run.affected ?? 0, "row")}, but the table went from ${run.before.count} to ${run.after.count} rows and the owner's rows from ${run.before.owned} to ${run.after.owned}`
+          detail: `reported ${plural3(run.affected ?? 0, "row")}, but the table went from ${run.before.count} to ${run.after.count} rows and the owner's rows from ${run.before.owned} to ${run.after.owned}`
         };
       }
     }
@@ -18602,7 +19183,7 @@ async function updatePlans(c) {
         if (changed(run)) return { verdict: "allowed", detail: noop ? "1 row updated (rewrote its own value)" : `${changedRows(filtered ? run.affected : 1)} (${sets.map((s) => s.column).join(" and ")} rewritten)` };
         if (!filtered) return { verdict: "denied", detail: "the owner row is unchanged" };
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
-        return { verdict: "unknown", detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
+        return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
       }
     });
   };
@@ -18654,7 +19235,7 @@ function reassignPlans(c) {
         if (moved(run)) return { verdict: "allowed", detail: `the owner row now belongs to the other user` };
         if (!filtered && run.after.target === run.before.target) return { verdict: "denied", detail: "the owner row is unchanged" };
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
-        return { verdict: "unknown", detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner column did not move` };
+        return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner column did not move` };
       }
     }
   ];
@@ -18683,7 +19264,7 @@ function deletePlans(c) {
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
         return {
           verdict: "unknown",
-          detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
+          detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
         };
       }
     }
@@ -18754,25 +19335,25 @@ async function runCell(ctx, privilegesByRole, actor, action, expected) {
   const reason = pass ? `Expected ${expected}, observed ${allowed ? "allowed" : "denied"}.` : want ? `Expected ${actorText} to be allowed to ${action}, but ${observed.summary}.${action !== "select" && !r.error ? " Postgres reports rows no policy allows as 0 rows, not as an error, so the app sees no failure." : ""}` : `Expected ${actorText} to be denied ${action}, but ${observed.summary}.`;
   return { ...base, outcome: pass ? "Pass" : "Fail", observed, reason };
 }
-function cellsFor(table) {
+function cellsFor(table2) {
   const out = [];
   for (const actor of TESTED_ACTORS) {
-    for (const action of MATRIX_ACTIONS) out.push({ actor, action, expected: table.expect[actor][action] });
-    const reassign = table.expect[actor].reassign;
+    for (const action of MATRIX_ACTIONS) out.push({ actor, action, expected: table2.expect[actor][action] });
+    const reassign = table2.expect[actor].reassign;
     if (reassign) out.push({ actor, action: "reassign", expected: reassign });
   }
   return out;
 }
-function unknownCells(table, reason, summary) {
-  const display = `${table.schema}.${table.name}`;
-  const cells = cellsFor(table).map(
+function unknownCells(table2, reason, summary) {
+  const display = `${table2.schema}.${table2.name}`;
+  const cells = cellsFor(table2).map(
     ({ actor, action, expected }) => expected === "skip" ? { table: display, actor, action, expected, outcome: "N/A", observed: { summary: "not tested (skip in the matrix)" }, reason: "The matrix marks this cell skip." } : { table: display, actor, action, expected, outcome: "Unknown", observed: { summary }, reason }
   );
-  return [...cells, ...serviceRoleCells(table)];
+  return [...cells, ...serviceRoleCells(table2)];
 }
-function serviceRoleCells(table) {
-  if (!table.serviceRoleExcluded) return [];
-  const display = `${table.schema}.${table.name}`;
+function serviceRoleCells(table2) {
+  if (!table2.serviceRoleExcluded) return [];
+  const display = `${table2.schema}.${table2.name}`;
   return MATRIX_ACTIONS.map((action) => ({
     table: display,
     actor: "service_role",
@@ -18792,40 +19373,40 @@ function summarise(tables) {
 function verdictFor(summary) {
   if (summary.fail > 0) {
     return {
-      verdict: `Not ready within tested scope: ${plural2(summary.fail, "cell does", "cells do")} not match the matrix; ${plural2(summary.unknown, "unknown")}.`,
+      verdict: `Not ready within tested scope: ${plural3(summary.fail, "cell does", "cells do")} not match the matrix; ${plural3(summary.unknown, "unknown")}.`,
       exitCode: 1
     };
   }
   if (summary.pass === 0) {
-    return { verdict: `Nothing was observed: ${plural2(summary.unknown, "unknown")}, ${summary.notApplicable} N/A.`, exitCode: 2 };
+    return { verdict: `Nothing was observed: ${plural3(summary.unknown, "unknown")}, ${summary.notApplicable} N/A.`, exitCode: 2 };
   }
   if (summary.unknown > 0) {
-    return { verdict: `No blockers found within tested scope; ${plural2(summary.unknown, "unknown")}.`, exitCode: 2 };
+    return { verdict: `No blockers found within tested scope; ${plural3(summary.unknown, "unknown")}.`, exitCode: 2 };
   }
   return { verdict: "No blockers found within tested scope; 0 unknowns. Scenario passed locally.", exitCode: 0 };
 }
 async function listMigrations(dir) {
   try {
-    const entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
+    const entries = await (0, import_promises29.readdir)(dir, { withFileTypes: true });
     return entries.filter((e2) => e2.isFile() && /\.sql$/i.test(e2.name) && !e2.name.startsWith(".")).map((e2) => e2.name).sort((a, b3) => a < b3 ? -1 : a > b3 ? 1 : 0);
   } catch {
     return [];
   }
 }
 async function runRlsTest(options) {
-  const projectDir = (0, import_node_path32.resolve)(options.projectDir);
-  const matrixPath = (0, import_node_path32.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
-  const migrationsDir = (0, import_node_path32.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path32.join)("supabase", "migrations"));
+  const projectDir = (0, import_node_path36.resolve)(options.projectDir);
+  const matrixPath = (0, import_node_path36.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
+  const migrationsDir = (0, import_node_path36.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path36.join)("supabase", "migrations"));
   const timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
-  if ((0, import_node_path32.basename)(matrixPath).toLowerCase().startsWith(".env")) {
-    throw new RlsInputError(`Refusing to read ${(0, import_node_path32.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
+  if ((0, import_node_path36.basename)(matrixPath).toLowerCase().startsWith(".env")) {
+    throw new RlsInputError(`Refusing to read ${(0, import_node_path36.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
   }
   const filesRead = [];
   let matrixText;
   try {
-    const info = await (0, import_promises26.stat)(matrixPath);
+    const info = await (0, import_promises29.stat)(matrixPath);
     if (!info.isFile()) throw new Error("not a file");
-    matrixText = normalise(await (0, import_promises26.readFile)(matrixPath, "utf8"));
+    matrixText = normalise(await (0, import_promises29.readFile)(matrixPath, "utf8"));
   } catch {
     throw new RlsInputError(
       `No permissions matrix at ${matrixPath}. Write one by hand (schema: schemas/permissions-matrix.schema.json in the @viberaven/cli package); rls-test never infers it from your policies.`
@@ -18836,8 +19417,8 @@ async function runRlsTest(options) {
   const names = await listMigrations(migrationsDir);
   const migrationFiles = [];
   for (const name of names) {
-    const sql = normalise(await (0, import_promises26.readFile)((0, import_node_path32.join)(migrationsDir, name), "utf8"));
-    filesRead.push(displayPath(projectDir, (0, import_node_path32.join)(migrationsDir, name)));
+    const sql = normalise(await (0, import_promises29.readFile)((0, import_node_path36.join)(migrationsDir, name), "utf8"));
+    filesRead.push(displayPath(projectDir, (0, import_node_path36.join)(migrationsDir, name)));
     migrationFiles.push({ name, sha256: sha256(sql), sql });
   }
   const migrationsHash = sha256(migrationFiles.map((f) => `${f.name}\0${f.sha256}`).join("\n"));
@@ -18889,7 +19470,7 @@ async function runRlsTest(options) {
       engineLoaded = true;
       db = await engine.create({ env: allowlistedEnv(process.env), statementTimeoutMs: timeouts.statementMs });
     } catch (error) {
-      result.engine.error = firstLine(error instanceof Error ? error.message : String(error));
+      result.engine.error = firstLine2(error instanceof Error ? error.message : String(error));
       if (engineLoaded) return allUnknown(`PGlite could not start: ${result.engine.error}. Nothing was tested.`, "not run: PGlite startup failed");
       const missing = error?.code === "MODULE_NOT_FOUND" || error?.code === "ERR_MODULE_NOT_FOUND";
       return missing ? allUnknown(PGLITE_INSTALL_HINT, "not run: PGlite is not installed") : allUnknown(`PGlite could not load: ${result.engine.error}. Nothing was tested.`, "not run: PGlite loading failed");
@@ -18949,13 +19530,13 @@ async function runRlsTest(options) {
         result.roleChecks.push({ role, ok, detail: row ? `superuser ${Boolean(row.su)}, BYPASSRLS ${Boolean(row.bypass)}` : "the role does not exist after the migrations" });
       }
       const badRoles = result.roleChecks.filter((c) => !c.ok);
-      for (const table of matrix.tables) {
-        result.tables.push(await runTable(db, table, badRoles, result.roleChecks));
+      for (const table2 of matrix.tables) {
+        result.tables.push(await runTable(db, table2, badRoles, result.roleChecks));
       }
       return finish();
     } catch (error) {
       if (error instanceof RlsTimeoutError || !isSqlError(error)) {
-        const message = firstLine(error instanceof Error ? error.message : String(error));
+        const message = firstLine2(error instanceof Error ? error.message : String(error));
         return allUnknown(
           error instanceof RlsTimeoutError ? `A statement did not finish within ${Math.round(timeouts.statementMs / 1e3)} s, so the PGlite worker was stopped and no cell is reported as passed.` : `The PGlite worker stopped (${message}), so no cell is reported as passed.`,
           "not run: the database stopped"
@@ -18981,13 +19562,13 @@ async function seedRow(db, shape, label, userId) {
   if (r.rows.length !== 1) throw Object.assign(new Error("the insert returned no row (a trigger or rule may drop it)"), { code: "vr000" });
   return { key: keyOf2(r.rows[0]), reused: false };
 }
-async function runTable(db, table, badRoles, roleChecks) {
-  const display = `${table.schema}.${table.name}`;
-  const unknownTable = (reason, extra = {}) => ({ name: display, ...extra, unknownReason: reason, cells: unknownCells(table, reason, "not run") });
+async function runTable(db, table2, badRoles, roleChecks) {
+  const display = `${table2.schema}.${table2.name}`;
+  const unknownTable = (reason, extra = {}) => ({ name: display, ...extra, unknownReason: reason, cells: unknownCells(table2, reason, "not run") });
   if (badRoles.length > 0) {
     return unknownTable(`Role check failed (${badRoles.map((c) => `${c.role}: ${c.detail}`).join("; ")}), so RLS would not apply to the probes the way it does for the Data API.`);
   }
-  const described = await describeTable(db, table);
+  const described = await describeTable(db, table2);
   if (!described.shape) return unknownTable(described.reason ?? "unknown table problem");
   const shape = described.shape;
   const rel = await db.query(
@@ -19021,15 +19602,15 @@ async function runTable(db, table, badRoles, roleChecks) {
   const privilegesByRole = /* @__PURE__ */ new Map();
   for (const role of ["anon", "authenticated"]) privilegesByRole.set(role, await privilegesFor(db, shape, role));
   const cells = [];
-  for (const { actor, action, expected } of cellsFor(table)) {
+  for (const { actor, action, expected } of cellsFor(table2)) {
     cells.push(await runCell({ db, shape, target: ownerSeed.key }, privilegesByRole, actor, action, expected));
   }
-  cells.push(...serviceRoleCells(table));
+  cells.push(...serviceRoleCells(table2));
   const columns = {};
   shape.insertColumns.forEach((c) => {
     columns[c] = c === shape.owner.name ? "the test user id" : "generated test value";
   });
-  for (const c of Object.keys(table.seed)) columns[c] = "from the matrix seed";
+  for (const c of Object.keys(table2.seed)) columns[c] = "from the matrix seed";
   return {
     name: display,
     rls,
@@ -19037,16 +19618,16 @@ async function runTable(db, table, badRoles, roleChecks) {
     cells
   };
 }
-var import_node_child_process6, import_node_crypto2, import_promises26, import_node_net, import_node_path32, import_node_util4, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine, plural2, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
+var import_node_child_process8, import_node_crypto3, import_promises29, import_node_net, import_node_path36, import_node_util6, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine2, plural3, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
 var init_rlsRunner = __esm({
   "src/rls/rlsRunner.ts"() {
     "use strict";
-    import_node_child_process6 = require("node:child_process");
-    import_node_crypto2 = require("node:crypto");
-    import_promises26 = require("node:fs/promises");
+    import_node_child_process8 = require("node:child_process");
+    import_node_crypto3 = require("node:crypto");
+    import_promises29 = require("node:fs/promises");
     import_node_net = __toESM(require("node:net"));
-    import_node_path32 = require("node:path");
-    import_node_util4 = require("node:util");
+    import_node_path36 = require("node:path");
+    import_node_util6 = require("node:util");
     init_safeGit();
     init_permissionsMatrix();
     init_supabaseImitation();
@@ -19062,15 +19643,15 @@ var init_rlsRunner = __esm({
     };
     normalise = (text) => text.replace(/\r\n/g, "\n");
     quoteIdent2 = (name) => `"${name.replace(/"/g, '""')}"`;
-    firstLine = (message) => message.split("\n")[0].trim();
-    plural2 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+    firstLine2 = (message) => message.split("\n")[0].trim();
+    plural3 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
     NUMBERS = { a: ["1001"], b: ["1002"], i: ["1003"], u: ["1004", "7", "1"] };
     ACTOR_SESSION = {
       owner: { role: "authenticated", uid: OWNER_ID, claims: { sub: OWNER_ID, role: "authenticated", aud: "authenticated", email: "owner@example.test" } },
       other_user: { role: "authenticated", uid: OTHER_USER_ID, claims: { sub: OTHER_USER_ID, role: "authenticated", aud: "authenticated", email: "other-user@example.test" } },
       anon: { role: "anon", uid: null, claims: { role: "anon" } }
     };
-    changedRows = (n) => `${plural2(n ?? 0, "row")} changed`;
+    changedRows = (n) => `${plural3(n ?? 0, "row")} changed`;
     isRlsRefusal = (run) => run.error?.code === PERMISSION_DENIED && RLS_REFUSAL.test(run.error.message);
     isPrivilegeRefusal = (run) => run.error?.code === PERMISSION_DENIED && !RLS_REFUSAL.test(run.error.message);
     SELF = Symbol("self");
@@ -19117,25 +19698,25 @@ function renderRlsText(result) {
     lines.push("");
     if (result.engine.error) lines.push(`(${result.engine.error})`);
   }
-  for (const table of result.tables) {
+  for (const table2 of result.tables) {
     lines.push("");
-    const rls = table.rls ? `RLS ${table.rls.enabled ? "on" : "off"}${table.rls.forced ? ", forced" : ""}, owner ${table.rls.owner}` : "not inspected";
-    lines.push(`${table.name}  (${rls})`);
-    if (table.seed) {
-      const reused = [table.seed.reused.owner ? "the owner" : "", table.seed.reused.otherUser ? "the other user" : ""].filter(Boolean);
+    const rls = table2.rls ? `RLS ${table2.rls.enabled ? "on" : "off"}${table2.rls.forced ? ", forced" : ""}, owner ${table2.rls.owner}` : "not inspected";
+    lines.push(`${table2.name}  (${rls})`);
+    if (table2.seed) {
+      const reused = [table2.seed.reused.owner ? "the owner" : "", table2.seed.reused.otherUser ? "the other user" : ""].filter(Boolean);
       lines.push(
-        `  One row for the owner and one for another user (${table.seed.rowsBefore} rows in the table)${reused.length > 0 ? `; reused the rows the migrations created for ${reused.join(" and ")}` : ""}.`
+        `  One row for the owner and one for another user (${table2.seed.rowsBefore} rows in the table)${reused.length > 0 ? `; reused the rows the migrations created for ${reused.join(" and ")}` : ""}.`
       );
     }
-    if (table.unknownReason) lines.push(`  Unknown: ${table.unknownReason}`);
-    const tested = table.cells.filter((c) => c.actor !== "service_role");
+    if (table2.unknownReason) lines.push(`  Unknown: ${table2.unknownReason}`);
+    const tested = table2.cells.filter((c) => c.actor !== "service_role");
     const actorWidth = 14;
     const actionWidth = 10;
     lines.push(`  ${"actor".padEnd(actorWidth)}${"action".padEnd(actionWidth)}${"expected".padEnd(10)}${"result".padEnd(9)}observed`);
-    for (const cell of tested) {
-      lines.push(`  ${cell.actor.padEnd(actorWidth)}${cell.action.padEnd(actionWidth)}${cell.expected.padEnd(10)}${cell.outcome.padEnd(9)}${cell.observed.summary}`);
+    for (const cell2 of tested) {
+      lines.push(`  ${cell2.actor.padEnd(actorWidth)}${cell2.action.padEnd(actionWidth)}${cell2.expected.padEnd(10)}${cell2.outcome.padEnd(9)}${cell2.observed.summary}`);
     }
-    const service = table.cells.filter((c) => c.actor === "service_role");
+    const service = table2.cells.filter((c) => c.actor === "service_role");
     if (service.length > 0) lines.push(`  ${"service_role".padEnd(actorWidth)}${"all".padEnd(actionWidth)}${"excluded".padEnd(10)}${"N/A".padEnd(9)}bypasses RLS by design, not tested`);
   }
   const s = result.summary;
@@ -19143,8 +19724,8 @@ function renderRlsText(result) {
   lines.push(`Result: ${s.pass} Pass, ${s.fail} Fail, ${s.unknown} Unknown, ${s.notApplicable} N/A \xB7 ${s.pass + s.fail} of ${s.tested} tested cells observed (${s.total} cells in the matrix)`);
   lines.push(result.verdict);
   const failed = result.tables.flatMap((t) => t.cells).filter((c) => c.outcome === "Fail");
-  for (const cell of failed) {
-    lines.push(`  Fail  ${cell.actor} ${cell.action} on ${cell.table}: ${cell.reason}`);
+  for (const cell2 of failed) {
+    lines.push(`  Fail  ${cell2.actor} ${cell2.action} on ${cell2.table}: ${cell2.reason}`);
   }
   const unknown = result.tables.flatMap((t) => t.cells).filter((c) => c.outcome === "Unknown");
   const unknownReasons = [...new Set(unknown.map((c) => c.reason))];
@@ -19829,7 +20410,19 @@ function buildConnectProviders(providers) {
     dashboardUrl: providerDashboardUrls[provider2.id]
   }));
 }
+function asksFirstByGap(artifact) {
+  const asks = /* @__PURE__ */ new Map();
+  try {
+    for (const task of buildTaskList(artifact)) {
+      const sentence = task.fixType === "repo-code" && task.requiresUserAction ? task.action?.match(/^Ask the user first: [^.]+\./)?.[0] : void 0;
+      if (sentence) asks.set(task.gapId, sentence);
+    }
+  } catch {
+  }
+  return asks;
+}
 function buildMissionCards(artifact, providers) {
+  const asksFirst = asksFirstByGap(artifact);
   const blockers = artifact.gaps.map((gap) => ({
     id: gap.id,
     title: gap.title,
@@ -19838,13 +20431,15 @@ function buildMissionCards(artifact, providers) {
     category: blockerCategoryLabel(gap),
     tone: blockerTone(gap.severity),
     prompt: gap.copyPrompt || void 0,
-    requiresUserAction: gapRequiresUserAction(gap)
+    requiresUserAction: gapRequiresUserAction(gap),
+    ...asksFirst.has(gap.id) ? { asksFirst: asksFirst.get(gap.id) } : {}
   }));
   const planSteps = artifact.gaps.map((gap) => ({
     id: gap.id,
     title: gap.title,
     category: planStepCategoryLabel(gap),
-    requiresUserAction: gapRequiresUserAction(gap)
+    requiresUserAction: gapRequiresUserAction(gap),
+    ...asksFirst.has(gap.id) ? { asksFirst: asksFirst.get(gap.id) } : {}
   }));
   const connectProviders = buildConnectProviders(providers);
   const blockerCount = blockers.length;
@@ -19859,7 +20454,7 @@ function buildMissionCards(artifact, providers) {
   };
 }
 function projectNameFromPath(pathValue) {
-  return (0, import_node_path33.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
+  return (0, import_node_path37.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
 }
 function gapSearchText(gap) {
   return [
@@ -19927,15 +20522,7 @@ function providerStatusText(state) {
       return "Missing";
   }
 }
-function verifyActionForGap(gap) {
-  if (gap?.id) {
-    return {
-      label: "Verify",
-      commandPreview: `npx -y viberaven verify --action ${gap.id}`,
-      intent: "verify_action",
-      actionId: gap.id
-    };
-  }
+function verifyActionForGap(_gap) {
   return {
     label: "Verify",
     commandPreview: "npx -y viberaven --verify",
@@ -20278,20 +20865,21 @@ function mapArtifactToLocalUiState(artifact, presentProviderIds) {
     selectedProviderId: selectedProvider.id,
     currentPrompt: selectedProvider.nextFix?.prompt ?? "",
     artifacts: {
-      tasklist: (0, import_node_path33.join)(".viberaven", "agent-tasklist.md"),
-      contextMap: (0, import_node_path33.join)(".viberaven", "context-map.json"),
-      gateResult: (0, import_node_path33.join)(".viberaven", "gate-result.json"),
-      lastScan: (0, import_node_path33.join)(".viberaven", "last-scan.json")
+      tasklist: (0, import_node_path37.join)(".viberaven", "agent-tasklist.md"),
+      contextMap: (0, import_node_path37.join)(".viberaven", "context-map.json"),
+      gateResult: (0, import_node_path37.join)(".viberaven", "gate-result.json"),
+      lastScan: (0, import_node_path37.join)(".viberaven", "last-scan.json")
     },
     empty: false
   };
 }
-var import_node_path33, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
+var import_node_path37, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
 var init_artifactAdapter = __esm({
   "src/local-ui/artifactAdapter.ts"() {
     "use strict";
-    import_node_path33 = require("node:path");
+    import_node_path37 = require("node:path");
     init_providerLogos();
+    init_buildTaskList();
     init_prompts();
     init_providerLaunchPaths();
     init_launchRunway();
@@ -20592,18 +21180,18 @@ var init_planLimits = __esm({
 // src/hosted/credentials.ts
 function defaultConfigDir(env = process.env, platform = process.platform) {
   const override = env.VIBERAVEN_CONFIG_DIR?.trim();
-  if (override) return (0, import_node_path34.resolve)(override);
+  if (override) return (0, import_node_path38.resolve)(override);
   if (platform === "win32") {
-    return (0, import_node_path34.join)(env.APPDATA?.trim() || (0, import_node_path34.join)((0, import_node_os.homedir)(), "AppData", "Roaming"), "viberaven");
+    return (0, import_node_path38.join)(env.APPDATA?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), "AppData", "Roaming"), "viberaven");
   }
   if (platform === "darwin") {
-    return (0, import_node_path34.join)((0, import_node_os.homedir)(), "Library", "Application Support", "viberaven");
+    return (0, import_node_path38.join)((0, import_node_os2.homedir)(), "Library", "Application Support", "viberaven");
   }
-  return (0, import_node_path34.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path34.join)((0, import_node_os.homedir)(), ".config"), "viberaven");
+  return (0, import_node_path38.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), ".config"), "viberaven");
 }
 function isInside(child, parent) {
-  const rel = (0, import_node_path34.relative)((0, import_node_path34.resolve)(parent), (0, import_node_path34.resolve)(child));
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path34.isAbsolute)(rel);
+  const rel = (0, import_node_path38.relative)((0, import_node_path38.resolve)(parent), (0, import_node_path38.resolve)(child));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path38.isAbsolute)(rel);
 }
 async function retryTransient(work) {
   for (let attempt = 1; ; attempt += 1) {
@@ -20616,15 +21204,15 @@ async function retryTransient(work) {
     }
   }
 }
-var import_node_child_process7, import_node_crypto3, import_promises27, import_node_os, import_node_path34, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
+var import_node_child_process9, import_node_crypto4, import_promises30, import_node_os2, import_node_path38, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
 var init_credentials = __esm({
   "src/hosted/credentials.ts"() {
     "use strict";
-    import_node_child_process7 = require("node:child_process");
-    import_node_crypto3 = require("node:crypto");
-    import_promises27 = require("node:fs/promises");
-    import_node_os = require("node:os");
-    import_node_path34 = require("node:path");
+    import_node_child_process9 = require("node:child_process");
+    import_node_crypto4 = require("node:crypto");
+    import_promises30 = require("node:fs/promises");
+    import_node_os2 = require("node:os");
+    import_node_path38 = require("node:path");
     CREDENTIALS_FILE_NAME = "credentials.json";
     CredentialLocationError = class extends Error {
     };
@@ -20635,10 +21223,10 @@ var init_credentials = __esm({
       }
     };
     restrictWithIcacls = (path) => {
-      const name = (0, import_node_os.userInfo)().username;
+      const name = (0, import_node_os2.userInfo)().username;
       const user = process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\${name}` : name;
       return new Promise((resolveRestrict, reject) => {
-        (0, import_node_child_process7.execFile)("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { windowsHide: true, timeout: 1e4 }, (error) => {
+        (0, import_node_child_process9.execFile)("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { windowsHide: true, timeout: 1e4 }, (error) => {
           if (error) reject(error);
           else resolveRestrict();
         });
@@ -20651,9 +21239,9 @@ var init_credentials = __esm({
       constructor(configDir, workspacePath, options = {}) {
         this.configDir = configDir;
         this.workspacePath = workspacePath;
-        this.path = (0, import_node_path34.join)(configDir, CREDENTIALS_FILE_NAME);
+        this.path = (0, import_node_path38.join)(configDir, CREDENTIALS_FILE_NAME);
         this.restrict = options.restrict !== void 0 ? options.restrict : process.platform === "win32" ? restrictWithIcacls : null;
-        this.fs = { readFile: (path, encoding) => (0, import_promises27.readFile)(path, encoding), rename: (from, to) => (0, import_promises27.rename)(from, to), rm: (path) => (0, import_promises27.rm)(path, { force: true }), ...options.fs };
+        this.fs = { readFile: (path, encoding) => (0, import_promises30.readFile)(path, encoding), rename: (from, to) => (0, import_promises30.rename)(from, to), rm: (path) => (0, import_promises30.rm)(path, { force: true }), ...options.fs };
       }
       path;
       restrict;
@@ -20702,15 +21290,15 @@ var init_credentials = __esm({
             `Refusing to store the VibeRaven sign-in inside this project (${this.configDir}). Set VIBERAVEN_CONFIG_DIR to a folder outside the repo.`
           );
         }
-        await (0, import_promises27.mkdir)(this.configDir, { recursive: true, mode: 448 });
-        const temp = `${this.path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-        await (0, import_promises27.writeFile)(temp, `${JSON.stringify(body, null, 2)}
+        await (0, import_promises30.mkdir)(this.configDir, { recursive: true, mode: 448 });
+        const temp = `${this.path}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
+        await (0, import_promises30.writeFile)(temp, `${JSON.stringify(body, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await (0, import_promises27.chmod)(temp, 384).catch(() => void 0);
+        await (0, import_promises30.chmod)(temp, 384).catch(() => void 0);
         try {
           if (this.restrict) await this.restrict(temp);
         } catch (error) {
-          await (0, import_promises27.rm)(temp, { force: true });
+          await (0, import_promises30.rm)(temp, { force: true });
           const code = error?.code;
           const toolMissing = code === "ENOENT";
           throw new CredentialPermissionError(
@@ -20721,17 +21309,17 @@ var init_credentials = __esm({
         if (guard) {
           const onDisk = await this.readFor(guard.apiBaseUrl);
           if (onDisk?.accessToken !== guard.accessToken || guard.isCurrent && !guard.isCurrent()) {
-            await (0, import_promises27.rm)(temp, { force: true });
+            await (0, import_promises30.rm)(temp, { force: true });
             return false;
           }
         }
         try {
           await retryTransient(() => this.fs.rename(temp, this.path));
         } catch (error) {
-          await (0, import_promises27.rm)(temp, { force: true });
+          await (0, import_promises30.rm)(temp, { force: true });
           throw error;
         }
-        await (0, import_promises27.chmod)(this.path, 384).catch(() => void 0);
+        await (0, import_promises30.chmod)(this.path, 384).catch(() => void 0);
         return true;
       }
       /** Keeps the stored plan label in step with what the API last said. */
@@ -21100,7 +21688,7 @@ async function buildHostedCheckPayload(workspacePath) {
   throw new Error("Could not assemble the full check request.");
 }
 function finalizePayload(payload) {
-  const folder = (0, import_node_path35.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
+  const folder = (0, import_node_path39.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
   const redacted = redactPayload({ ...payload, workspacePath: folder });
   return { payload: redacted.payload, redactions: redacted.count };
 }
@@ -21131,13 +21719,13 @@ function splitSections(prompt) {
     chars: section.length
   }));
 }
-var import_node_path35, PayloadCaptured;
+var import_node_path39, PayloadCaptured;
 var init_payload = __esm({
   "src/hosted/payload.ts"() {
     "use strict";
     init_fileScanner();
     init_orchestrator();
-    import_node_path35 = require("node:path");
+    import_node_path39 = require("node:path");
     init_config();
     init_redact();
     PayloadCaptured = class extends Error {
@@ -21175,7 +21763,7 @@ function shapeResult(response, now = /* @__PURE__ */ new Date()) {
   const usage = toUsage(response.usage);
   const freeKeys = new Set(FREE_TRIAL_UNLOCKED_MAP_CATEGORY_KEYS);
   const unlocked = (key) => usage.plan === "pro" || freeKeys.has(key) && response.usage.unlockedMapCategoryKeys.includes(key);
-  const sorted = [...output.gaps].sort((a, b3) => SEVERITY_RANK3[a.severity] - SEVERITY_RANK3[b3.severity]);
+  const sorted = [...output.gaps].sort((a, b3) => SEVERITY_RANK4[a.severity] - SEVERITY_RANK4[b3.severity]);
   const areas = PRODUCTION_MAP_LANES.map((lane) => {
     const gaps = sorted.filter((gap) => gap.primaryMapCategory === lane.extensionKey);
     const locked = !unlocked(lane.extensionKey);
@@ -21213,11 +21801,11 @@ function readServerMessage(body) {
     return body.slice(0, 300);
   }
 }
-var import_node_crypto4, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK3, FullCheckService;
+var import_node_crypto5, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK4, FullCheckService;
 var init_fullCheck = __esm({
   "src/hosted/fullCheck.ts"() {
     "use strict";
-    import_node_crypto4 = require("node:crypto");
+    import_node_crypto5 = require("node:crypto");
     init_engines();
     init_planLimits();
     init_productionMapLanes();
@@ -21232,7 +21820,7 @@ var init_fullCheck = __esm({
     STATUS_CACHE_MS = 5e3;
     MAX_PREVIEWS = 5;
     TRANSIENT_REASONS = /* @__PURE__ */ new Set(["network", "timeout", "server", "rate_limited", "busy"]);
-    SEVERITY_RANK3 = { critical: 0, warning: 1, info: 2 };
+    SEVERITY_RANK4 = { critical: 0, warning: 1, info: 2 };
     FullCheckService = class {
       constructor(workspacePath, options = {}) {
         this.workspacePath = workspacePath;
@@ -21482,8 +22070,8 @@ var init_fullCheck = __esm({
           const built = await this.buildPayload(this.workspacePath);
           const final = finalizePayload(built.payload);
           this.prunePreviews();
-          const id = (0, import_node_crypto4.randomUUID)();
-          this.previews.set(id, { payload: final.payload, idempotencyKey: (0, import_node_crypto4.randomUUID)(), createdAt: Date.now() });
+          const id = (0, import_node_crypto5.randomUUID)();
+          this.previews.set(id, { payload: final.payload, idempotencyKey: (0, import_node_crypto5.randomUUID)(), createdAt: Date.now() });
           return { kind: "preview", preview: describePayload(id, `${this.apiBaseUrl}/v1/station/run`, final.payload, built.scan, final.redactions) };
         } catch (error) {
           if (error instanceof HostedCallError) return this.fromCallError(error);
@@ -21603,10 +22191,10 @@ async function connectProviderMcp(cwd, providerId) {
   if (!recipe) {
     return { ok: false, message: `No known MCP server for ${providerId} yet. Add one manually to .mcp.json.` };
   }
-  const configPath = (0, import_node_path36.join)(cwd, ".mcp.json");
+  const configPath = (0, import_node_path40.join)(cwd, ".mcp.json");
   let config = {};
   try {
-    const raw = await (0, import_promises28.readFile)(configPath, "utf8");
+    const raw = await (0, import_promises31.readFile)(configPath, "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     if (!isRecord5(parsed) || parsed.mcpServers !== void 0 && !isRecord5(parsed.mcpServers)) {
       return { ok: false, message: "Existing .mcp.json has an unsupported structure. It was left unchanged." };
@@ -21623,7 +22211,7 @@ async function connectProviderMcp(cwd, providerId) {
   }
   servers[providerId] = recipe.entry;
   const next = { ...config, mcpServers: servers };
-  await (0, import_promises28.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises31.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const suffix = recipe.note ? ` ${recipe.note}` : "";
   return { ok: true, message: `Added ${providerId} MCP server to .mcp.json.${suffix}`, path: ".mcp.json" };
@@ -21635,7 +22223,7 @@ function headerValue(request, name) {
 function tokensMatch(given, expected) {
   const a = Buffer.from(given, "utf8");
   const b3 = Buffer.from(expected, "utf8");
-  return a.length === b3.length && (0, import_node_crypto5.timingSafeEqual)(a, b3);
+  return a.length === b3.length && (0, import_node_crypto6.timingSafeEqual)(a, b3);
 }
 function guardRequest(request, response, pathname, guard) {
   const allowedHosts = [`127.0.0.1:${guard.port}`, `localhost:${guard.port}`];
@@ -21676,7 +22264,7 @@ async function defaultScanRunner(flags, positional) {
 }
 async function readPackageJson(cwd) {
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, "package.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, "package.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -21699,7 +22287,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
     if (files.length >= maxFiles) return;
     let entries;
     try {
-      entries = await (0, import_promises28.readdir)(dir, { withFileTypes: true });
+      entries = await (0, import_promises31.readdir)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -21707,7 +22295,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
       if (files.length >= maxFiles) return;
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        if (!skipped.has(entry.name)) await walk((0, import_node_path36.join)(dir, entry.name), rel);
+        if (!skipped.has(entry.name)) await walk((0, import_node_path40.join)(dir, entry.name), rel);
         continue;
       }
       if (entry.isFile()) files.push(rel.toLowerCase());
@@ -21726,7 +22314,7 @@ async function readEnvKeys(cwd) {
   const keys = /* @__PURE__ */ new Set();
   for (const name of [".env.example", ".env"]) {
     try {
-      const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, name), "utf8");
+      const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, name), "utf8");
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -21820,7 +22408,7 @@ function applyProviderDetection(state, deps, files) {
 }
 function runGit(cwd, args, timeoutMs = 1500) {
   return safeGitInvocation(cwd, args).then(
-    (git) => spawnGit(cwd, git.args, git.env, timeoutMs),
+    (git2) => spawnGit(cwd, git2.args, git2.env, timeoutMs),
     (error) => {
       if (error instanceof SafeGitRefusal) throw error;
       return "";
@@ -21829,7 +22417,7 @@ function runGit(cwd, args, timeoutMs = 1500) {
 }
 function spawnGit(cwd, args, env, timeoutMs) {
   return new Promise((resolveGit) => {
-    const child = (0, import_node_child_process8.spawn)("git", args, {
+    const child = (0, import_node_child_process10.spawn)("git", args, {
       cwd,
       env,
       windowsHide: true,
@@ -21892,7 +22480,7 @@ function parseGitShortstat(raw) {
 }
 function runGitCommand(cwd, args, timeoutMs = 5e3) {
   return safeGitInvocation(cwd, args).then(
-    (git) => spawnGitCommand(cwd, git.args, git.env, timeoutMs),
+    (git2) => spawnGitCommand(cwd, git2.args, git2.env, timeoutMs),
     (error) => ({
       code: 1,
       stdout: "",
@@ -21902,7 +22490,7 @@ function runGitCommand(cwd, args, timeoutMs = 5e3) {
 }
 function spawnGitCommand(cwd, args, env, timeoutMs) {
   return new Promise((resolveCommand) => {
-    const child = (0, import_node_child_process8.spawn)("git", args, {
+    const child = (0, import_node_child_process10.spawn)("git", args, {
       cwd,
       env,
       windowsHide: true,
@@ -22044,7 +22632,7 @@ async function codexModelOptions() {
     { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" }
   ];
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)((0, import_node_os2.homedir)(), ".codex", "models_cache.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)((0, import_node_os3.homedir)(), ".codex", "models_cache.json"), "utf8");
     const parsed = JSON.parse(raw);
     const list = Array.isArray(parsed) ? parsed : parsed.models ?? [];
     const options = list.filter((model) => typeof model?.slug === "string").filter((model) => !/auto-review|reserve/i.test(model.slug)).map((model) => ({ id: model.slug, label: model.display_name?.trim() || model.slug }));
@@ -22068,7 +22656,7 @@ function cliModelDefaults(id) {
 }
 function detectCommand(command, cwd) {
   return new Promise((resolveDetect) => {
-    const child = (0, import_node_child_process8.spawn)(process.platform === "win32" ? "where.exe" : "sh", process.platform === "win32" ? [command] : ["-lc", `command -v ${command}`], {
+    const child = (0, import_node_child_process10.spawn)(process.platform === "win32" ? "where.exe" : "sh", process.platform === "win32" ? [command] : ["-lc", `command -v ${command}`], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
@@ -22095,7 +22683,7 @@ function commandMissingFromOutput(text) {
   return /not recognized|not found|unknown command|no such file|command not found|is not recognized as an internal or external command/.test(text.toLowerCase());
 }
 function redactProbeOutput(output) {
-  const home = (0, import_node_os2.homedir)();
+  const home = (0, import_node_os3.homedir)();
   const homeVariants = [home, home.split("\\").join("\\\\"), home.split("\\").join("/")].filter((value) => value.length > 3);
   let scrubbed = output;
   for (const variant of homeVariants) scrubbed = scrubbed.split(variant).join("~");
@@ -22155,7 +22743,7 @@ function setupCommandFor(cliId, step) {
 function runShellCommand(command, cwd, timeoutMs = 18e4) {
   return new Promise((resolveRun) => {
     const useCmd = process.platform === "win32";
-    const child = (0, import_node_child_process8.spawn)(useCmd ? process.env.ComSpec || "cmd.exe" : "sh", useCmd ? ["/d", "/s", "/c", command] : ["-lc", command], {
+    const child = (0, import_node_child_process10.spawn)(useCmd ? process.env.ComSpec || "cmd.exe" : "sh", useCmd ? ["/d", "/s", "/c", command] : ["-lc", command], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
@@ -22189,7 +22777,7 @@ function openSystemTerminal(command, cwd) {
     const fullCommand = process.platform === "win32" ? `cd /d ${quotedCwd} && ${command}` : `cd ${quotedCwd} && ${command}`;
     let child;
     if (process.platform === "win32") {
-      child = (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "start", "cmd.exe", "/k", fullCommand], {
+      child = (0, import_node_child_process10.spawn)("cmd.exe", ["/c", "start", "cmd.exe", "/k", fullCommand], {
         cwd,
         windowsHide: true,
         stdio: "ignore",
@@ -22197,9 +22785,9 @@ function openSystemTerminal(command, cwd) {
       });
     } else if (process.platform === "darwin") {
       const script = `tell application "Terminal" to do script "${fullCommand.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-      child = (0, import_node_child_process8.spawn)("osascript", ["-e", script], { cwd, windowsHide: true, stdio: "ignore", detached: true });
+      child = (0, import_node_child_process10.spawn)("osascript", ["-e", script], { cwd, windowsHide: true, stdio: "ignore", detached: true });
     } else {
-      child = (0, import_node_child_process8.spawn)("x-terminal-emulator", ["-e", `bash -lc ${JSON.stringify(fullCommand)}`], {
+      child = (0, import_node_child_process10.spawn)("x-terminal-emulator", ["-e", `bash -lc ${JSON.stringify(fullCommand)}`], {
         cwd,
         windowsHide: true,
         stdio: "ignore",
@@ -22247,19 +22835,19 @@ function isPlaceholderProjectName(value) {
 async function readMcpEvidence(cwd) {
   const candidates = MCP_CONFIG_PATHS.map((relativePath) => ({
     source: relativePath.replace(/\\/g, "/"),
-    path: (0, import_node_path36.resolve)(cwd, relativePath)
+    path: (0, import_node_path40.resolve)(cwd, relativePath)
   }));
   const home = process.env.USERPROFILE || process.env.HOME;
   if (home) {
     candidates.push({
       source: "~/.codex/config.toml",
-      path: (0, import_node_path36.resolve)(home, ".codex", "config.toml")
+      path: (0, import_node_path40.resolve)(home, ".codex", "config.toml")
     });
   }
   const evidence = [];
   for (const candidate of candidates) {
     try {
-      const text = await (0, import_promises28.readFile)(candidate.path, "utf8");
+      const text = await (0, import_promises31.readFile)(candidate.path, "utf8");
       if (/mcp/i.test(text)) evidence.push({ source: candidate.source, text });
     } catch {
     }
@@ -22350,7 +22938,7 @@ async function enrichProjectMetadata(state, cwd) {
 async function readState(cwd) {
   let state;
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
     const packageJson = await readPackageJson(cwd);
     const deps = dependencyNames(packageJson);
     const files = await listProjectFiles(cwd);
@@ -22596,7 +23184,7 @@ function quoteWindowsCmdArg(value) {
 }
 async function whereExe(command, cwd) {
   return new Promise((resolvePath) => {
-    const child = (0, import_node_child_process8.spawn)("where.exe", [command], {
+    const child = (0, import_node_child_process10.spawn)("where.exe", [command], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "ignore"]
@@ -22617,7 +23205,7 @@ async function whereExe(command, cwd) {
 }
 function expandShimPath(value, base) {
   const relative8 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
-  return relative8 === value ? value : (0, import_node_path36.join)(base, ...relative8.split(/[\\/]+/));
+  return relative8 === value ? value : (0, import_node_path40.join)(base, ...relative8.split(/[\\/]+/));
 }
 function findShimTarget(lines, pattern, accept = () => true) {
   for (const line of lines) {
@@ -22628,21 +23216,21 @@ function findShimTarget(lines, pattern, accept = () => true) {
 }
 async function resolveWindowsShimTarget(shimPath) {
   try {
-    const content = await (0, import_promises28.readFile)(shimPath, "utf8");
-    const base = (0, import_node_path36.dirname)(shimPath);
+    const content = await (0, import_promises31.readFile)(shimPath, "utf8");
+    const base = (0, import_node_path40.dirname)(shimPath);
     const lines = content.split(/\r?\n/);
     const trailingArgs = (line, after) => [...line.slice(after).split("%*")[0].matchAll(/"([^"]*)"|([^\s"&|<>]+)/g)].map((token) => expandShimPath(token[1] ?? token[2], base)).filter((value) => value.length > 0 && !value.includes("%"));
     const script = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.js)"/i);
     if (script) {
       return {
         command: process.execPath,
-        args: [(0, import_node_path36.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
+        args: [(0, import_node_path40.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
       };
     }
-    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path36.basename)(target).toLowerCase() !== "node.exe");
+    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path40.basename)(target).toLowerCase() !== "node.exe");
     if (binary) {
       return {
-        command: (0, import_node_path36.join)(base, ...binary.match[1].split(/[\\/]+/)),
+        command: (0, import_node_path40.join)(base, ...binary.match[1].split(/[\\/]+/)),
         args: trailingArgs(binary.line, binary.match.index + binary.match[0].length)
       };
     }
@@ -22663,7 +23251,7 @@ function killProcessTree(pid, fallback) {
     return;
   }
   if (process.platform === "win32") {
-    const killer = (0, import_node_child_process8.spawn)("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+    const killer = (0, import_node_child_process10.spawn)("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
     killer.once("error", fallback);
     killer.once("close", (code) => {
       if (code !== 0) fallback();
@@ -22688,7 +23276,7 @@ async function runAgentCommand(command, args, cwd, stdin, runId) {
   const spawnCommand = shim?.command ?? (useCmdShim ? process.env.ComSpec || "cmd.exe" : command);
   const spawnArgs = shim ? [...shim.args, ...args] : useCmdShim ? ["/d", "/s", "/c", [command, ...args.map(quoteWindowsCmdArg)].join(" ")] : args;
   return new Promise((resolveRun) => {
-    const child = (0, import_node_child_process8.spawn)(spawnCommand, spawnArgs, {
+    const child = (0, import_node_child_process10.spawn)(spawnCommand, spawnArgs, {
       cwd,
       windowsHide: true,
       // A separate process group lets Stop and timeout terminate descendants on Unix too.
@@ -22767,8 +23355,8 @@ async function writeChatContextArtifact(cwd, request, prompt) {
       "",
       prompt
     ].filter((line) => typeof line === "string");
-    await (0, import_promises28.mkdir)((0, import_node_path36.join)(cwd, ".viberaven"), { recursive: true });
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
+    await (0, import_promises31.mkdir)((0, import_node_path40.join)(cwd, ".viberaven"), { recursive: true });
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
 `, "utf8");
   } catch {
   }
@@ -22788,13 +23376,13 @@ async function runAgentChat(cwd, request) {
   }
   const prompt = await buildAgentChatPrompt(request, cwd);
   await writeChatContextArtifact(cwd, request, prompt);
-  const outputPath = request.cliId === "codex" ? (0, import_node_path36.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
-  if (outputPath) await (0, import_promises28.mkdir)((0, import_node_path36.dirname)(outputPath), { recursive: true });
+  const outputPath = request.cliId === "codex" ? (0, import_node_path40.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
+  if (outputPath) await (0, import_promises31.mkdir)((0, import_node_path40.dirname)(outputPath), { recursive: true });
   const { command, args, stdin } = commandForAgentChat(request, prompt, cwd, outputPath);
   const result = await runAgentCommand(command, args, cwd, stdin, request.runId);
   if (outputPath) {
     try {
-      const finalMessage = (await (0, import_promises28.readFile)(outputPath, "utf8")).trim();
+      const finalMessage = (await (0, import_promises31.readFile)(outputPath, "utf8")).trim();
       if (finalMessage) return { ...result, output: finalMessage };
     } catch {
     }
@@ -22806,8 +23394,8 @@ function firstGapId(state) {
   return state.providers.find((provider2) => provider2.nextFix?.id)?.nextFix?.id;
 }
 async function runLocalAction(cwd, intent) {
-  const artifactDir = (0, import_node_path36.join)(cwd, ".viberaven");
-  await (0, import_promises28.mkdir)(artifactDir, { recursive: true });
+  const artifactDir = (0, import_node_path40.join)(cwd, ".viberaven");
+  await (0, import_promises31.mkdir)(artifactDir, { recursive: true });
   if (intent === "preview_rehearsal") {
     const state2 = await readState(cwd);
     const topProvider = state2.providers[0];
@@ -22848,7 +23436,7 @@ async function runLocalAction(cwd, intent) {
       proof,
       ""
     ].join("\n");
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
     return {
       title: "Preview rehearsal ready",
       summary: `${projectName}: ${gateLabel} with ${state2.providers.length} provider beat${state2.providers.length === 1 ? "" : "s"}`,
@@ -22858,7 +23446,7 @@ async function runLocalAction(cwd, intent) {
   if (intent === "audit_vercel_supabase") {
     const auditInput = await collectVercelSupabaseAuditInput(cwd);
     const result2 = buildVercelSupabaseAudit(auditInput);
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
 `, "utf8");
     return {
       title: result2.status === "pass" ? "Audit passed" : "Audit needs work",
@@ -22886,7 +23474,7 @@ async function runLocalAction(cwd, intent) {
   const mode = intent === "heal_prompt" ? "prompt" : intent === "heal_apply" ? "apply" : "plan";
   const result = await runHealCommand({ cwd, mode, gapId, yes: mode === "apply", noVerify: true });
   if (mode === "apply") {
-    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   }
   return {
@@ -22896,14 +23484,14 @@ async function runLocalAction(cwd, intent) {
   };
 }
 async function sendArtifact(cwd, rel, response, contentType = "text/plain; charset=utf-8") {
-  const absolute = (0, import_node_path36.resolve)(cwd, rel);
-  const root = (0, import_node_path36.resolve)(cwd);
+  const absolute = (0, import_node_path40.resolve)(cwd, rel);
+  const root = (0, import_node_path40.resolve)(cwd);
   if (!absolute.startsWith(root)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const text = await (0, import_promises28.readFile)(absolute, "utf8");
+    const text = await (0, import_promises31.readFile)(absolute, "utf8");
     response.writeHead(200, { "content-type": contentType });
     response.end(text);
   } catch {
@@ -22912,7 +23500,7 @@ async function sendArtifact(cwd, rel, response, contentType = "text/plain; chars
 }
 async function sendReportArtifact(cwd, response) {
   try {
-    const text = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "report.html"), "utf8");
+    const text = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "report.html"), "utf8");
     response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     response.end(text);
     return;
@@ -23039,7 +23627,7 @@ async function sendReportArtifact(cwd, response) {
 }
 async function sendExtensionIcon(cwd, response) {
   try {
-    const body = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, "media", "extension-icon.png"));
+    const body = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, "media", "extension-icon.png"));
     sendBinary(response, 200, "image/png", body);
   } catch {
     sendText(response, 404, "Icon not found");
@@ -23052,15 +23640,15 @@ async function sendMangaAsset(pathname, response) {
     return;
   }
   const candidates = [
-    (0, import_node_path36.join)(__dirname, "manga", name),
+    (0, import_node_path40.join)(__dirname, "manga", name),
     // installed + dev: <pkg>/dist/manga
-    (0, import_node_path36.join)(__dirname, "..", "assets", "manga", name),
+    (0, import_node_path40.join)(__dirname, "..", "assets", "manga", name),
     // fallback: <pkg>/assets/manga (source)
-    (0, import_node_path36.join)(__dirname, "..", "..", "assets", "manga", name)
+    (0, import_node_path40.join)(__dirname, "..", "..", "assets", "manga", name)
   ];
   for (const candidate of candidates) {
     try {
-      const body = await (0, import_promises28.readFile)(candidate);
+      const body = await (0, import_promises31.readFile)(candidate);
       response.setHeader("cache-control", "no-cache");
       sendBinary(response, 200, contentTypeForAsset(candidate), body);
       return;
@@ -23070,7 +23658,7 @@ async function sendMangaAsset(pathname, response) {
   sendText(response, 404, "Asset not found");
 }
 function contentTypeForAsset(pathname) {
-  switch ((0, import_node_path36.extname)(pathname).toLowerCase()) {
+  switch ((0, import_node_path40.extname)(pathname).toLowerCase()) {
     case ".svg":
       return "image/svg+xml; charset=utf-8";
     case ".png":
@@ -23087,14 +23675,14 @@ function contentTypeForAsset(pathname) {
 }
 async function sendBundledReportAsset(pathname, response) {
   const rel = decodeURIComponent(pathname.replace(/^\/report\//, ""));
-  const assetRoot = (0, import_node_path36.resolve)(getBundledReportAssetsDir());
-  const absolute = (0, import_node_path36.resolve)(assetRoot, rel);
+  const assetRoot = (0, import_node_path40.resolve)(getBundledReportAssetsDir());
+  const absolute = (0, import_node_path40.resolve)(assetRoot, rel);
   if (!absolute.startsWith(assetRoot)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const body = await (0, import_promises28.readFile)(absolute);
+    const body = await (0, import_promises31.readFile)(absolute);
     sendBinary(response, 200, contentTypeForAsset(absolute), body);
   } catch {
     sendText(response, 404, "Asset not found");
@@ -23116,18 +23704,18 @@ async function bundleStackClient(entryPath) {
   return output.text;
 }
 async function sendStackAppJs(response) {
-  const distPath = (0, import_node_path36.join)(__dirname, "stack", "app.js");
+  const distPath = (0, import_node_path40.join)(__dirname, "stack", "app.js");
   try {
-    const body = await (0, import_promises28.readFile)(distPath);
+    const body = await (0, import_promises31.readFile)(distPath);
     response.writeHead(200, { "content-type": "application/javascript; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
     return;
   } catch {
   }
-  const entryPath = (0, import_node_path36.join)(__dirname, "stack", "main.ts");
+  const entryPath = (0, import_node_path40.join)(__dirname, "stack", "main.ts");
   let mtimeMs;
   try {
-    mtimeMs = (await (0, import_promises28.stat)(entryPath)).mtimeMs;
+    mtimeMs = (await (0, import_promises31.stat)(entryPath)).mtimeMs;
   } catch {
     sendText(response, 404, "Stack client entry not found: src/local-ui/stack/main.ts is missing.");
     return;
@@ -23146,7 +23734,7 @@ async function sendStackAppJs(response) {
 }
 async function sendStackAppCss(response) {
   try {
-    const body = await (0, import_promises28.readFile)((0, import_node_path36.join)(__dirname, "stack", "stack.css"));
+    const body = await (0, import_promises31.readFile)((0, import_node_path40.join)(__dirname, "stack", "stack.css"));
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
   } catch {
@@ -23155,7 +23743,7 @@ async function sendStackAppCss(response) {
 }
 async function readProviderVerifyLedger(cwd) {
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -23165,8 +23753,8 @@ async function readProviderVerifyLedger(cwd) {
 async function writeProviderVerifyEntry(cwd, providerId, entry) {
   const ledger = await readProviderVerifyLedger(cwd);
   ledger[providerId] = entry;
-  await (0, import_promises28.mkdir)((0, import_node_path36.join)(cwd, ".viberaven"), { recursive: true });
-  await (0, import_promises28.writeFile)((0, import_node_path36.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
+  await (0, import_promises31.mkdir)((0, import_node_path40.join)(cwd, ".viberaven"), { recursive: true });
+  await (0, import_promises31.writeFile)((0, import_node_path40.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
 }
 async function handleRequest(request, response, options) {
@@ -23209,6 +23797,18 @@ async function handleRequest(request, response, options) {
     sendText(response, 404, "This VibeRaven surface has been removed. Use the Launch Canvas at /.");
     return;
   }
+  if (request.method === "GET" && url.pathname === "/api/github-workflow") {
+    sendJson(response, await githubWorkflowStatus(options.cwd));
+    return;
+  }
+  if (request.method === "POST" && url.pathname === "/api/github-workflow") {
+    try {
+      sendJson(response, await writeGithubWorkflow(options.cwd));
+    } catch (error) {
+      sendJsonStatus(response, 500, { error: `Could not write the workflow: ${error instanceof Error ? error.message : String(error)}` });
+    }
+    return;
+  }
   if (request.method === "GET" && url.pathname === "/api/project") {
     sendJson(response, await readState(options.cwd));
     return;
@@ -23227,13 +23827,13 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/architecture-map") {
-    const mapPath = (0, import_node_path36.join)(options.cwd, ".viberaven", "architecture-map.md");
-    const markdown = await (0, import_promises28.readFile)(mapPath, "utf8").catch(() => null);
+    const mapPath = (0, import_node_path40.join)(options.cwd, ".viberaven", "architecture-map.md");
+    const markdown = await (0, import_promises31.readFile)(mapPath, "utf8").catch(() => null);
     if (markdown === null) {
       sendJsonStatus(response, 404, { error: "No architecture map yet. Run a scan first (it is written on every scan)." });
       return;
     }
-    const dataRaw = await (0, import_promises28.readFile)((0, import_node_path36.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
+    const dataRaw = await (0, import_promises31.readFile)((0, import_node_path40.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
     let data = null;
     if (dataRaw) {
       try {
@@ -23242,7 +23842,7 @@ async function handleRequest(request, response, options) {
         data = null;
       }
     }
-    const contextRaw = await (0, import_promises28.readFile)((0, import_node_path36.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
+    const contextRaw = await (0, import_promises31.readFile)((0, import_node_path40.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
     let gaps = [];
     if (contextRaw) {
       try {
@@ -23508,35 +24108,35 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/tasklist") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "agent-tasklist.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "agent-tasklist.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/playbook") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "launch-playbook.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "launch-playbook.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/audit") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "audit-vercel-supabase.txt"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "audit-vercel-supabase.txt"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/cleanup") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "context-cleanup.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "context-cleanup.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/preview") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "preview-rehearsal.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "preview-rehearsal.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-plan") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-plan.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-plan.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-prompt") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-prompt.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-prompt.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-apply") {
-    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/report") {
@@ -23562,12 +24162,12 @@ async function handleRequest(request, response, options) {
   }
   if (request.method === "GET" && url.pathname === "/vendor/anime.umd.min.js") {
     for (const candidate of [
-      (0, import_node_path36.join)(__dirname, "vendor", "anime.umd.min.js"),
-      (0, import_node_path36.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
-      (0, import_node_path36.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
+      (0, import_node_path40.join)(__dirname, "vendor", "anime.umd.min.js"),
+      (0, import_node_path40.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
+      (0, import_node_path40.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
     ]) {
       try {
-        const body = await (0, import_promises28.readFile)(candidate);
+        const body = await (0, import_promises31.readFile)(candidate);
         response.setHeader("cache-control", "public, max-age=604800, immutable");
         sendBinary(response, 200, "text/javascript; charset=utf-8", body);
         return;
@@ -23784,11 +24384,11 @@ function listen(server, startPort) {
   });
 }
 async function startLocalUiServer(options) {
-  const cwd = (0, import_node_path36.resolve)(options.cwd);
+  const cwd = (0, import_node_path40.resolve)(options.cwd);
   const scanRunner = options.scanRunner ?? defaultScanRunner;
   const autoScan = { state: "idle" };
   const fullCheck = new FullCheckService(cwd, options.fullCheck);
-  const guard = { token: (0, import_node_crypto5.randomBytes)(32).toString("base64url"), port: 0 };
+  const guard = { token: (0, import_node_crypto6.randomBytes)(32).toString("base64url"), port: 0 };
   const server = (0, import_node_http.createServer)((request, response) => {
     const pathname = new URL(request.url ?? "/", "http://127.0.0.1").pathname;
     if (!guardRequest(request, response, pathname, guard)) {
@@ -23801,7 +24401,7 @@ async function startLocalUiServer(options) {
   });
   const port = await listen(server, options.port ?? 4177);
   guard.port = port;
-  const hasArtifact = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
+  const hasArtifact = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
     () => true,
     () => false
   );
@@ -23840,16 +24440,17 @@ async function waitForServerShutdown() {
     process.once("SIGTERM", done);
   });
 }
-var import_node_http, import_node_child_process8, import_node_crypto5, import_promises28, import_node_os2, import_node_path36, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
+var import_node_http, import_node_child_process10, import_node_crypto6, import_promises31, import_node_os3, import_node_path40, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
 var init_server = __esm({
   "src/local-ui/server.ts"() {
     "use strict";
     import_node_http = require("node:http");
-    import_node_child_process8 = require("node:child_process");
-    import_node_crypto5 = require("node:crypto");
-    import_promises28 = require("node:fs/promises");
-    import_node_os2 = require("node:os");
-    import_node_path36 = require("node:path");
+    import_node_child_process10 = require("node:child_process");
+    import_node_crypto6 = require("node:crypto");
+    import_promises31 = require("node:fs/promises");
+    import_node_os3 = require("node:os");
+    import_node_path40 = require("node:path");
+    init_initGithub();
     init_cleanPlan();
     init_audit();
     init_heal();
@@ -23890,8 +24491,8 @@ var init_server = __esm({
     MCP_CONFIG_PATHS = [
       ".mcp.json",
       "mcp.json",
-      (0, import_node_path36.join)(".cursor", "mcp.json"),
-      (0, import_node_path36.join)(".vscode", "mcp.json")
+      (0, import_node_path40.join)(".cursor", "mcp.json"),
+      (0, import_node_path40.join)(".vscode", "mcp.json")
     ];
     MCP_PROVIDER_NEEDLES = {
       supabase: ["supabase", "@supabase/mcp", "mcp-server-supabase"],
@@ -23976,13 +24577,25 @@ function buildNextActionBlock(tasks, loopState) {
       requiresUserAction: false
     };
   }
-  const providerTask = tasks.find((t) => t.fixType === "provider-action");
-  if (providerTask) {
+  const userTask = tasks.find((t) => t.fixType === "provider-action" || t.fixType === "repo-code" && t.requiresUserAction);
+  if (userTask?.fixType === "repo-code") {
+    return {
+      ...base,
+      type: "repo-code",
+      gapId: userTask.gapId,
+      title: userTask.title,
+      mcpTool: userTask.mcpTool,
+      mcpArgs: userTask.mcpArgs,
+      fallbackCommand: userTask.mcpArgs ? `npx -y viberaven --heal --apply --gap ${userTask.gapId} --yes` : void 0,
+      requiresUserAction: true
+    };
+  }
+  if (userTask) {
     return {
       ...base,
       type: "provider-action",
-      gapId: providerTask.gapId,
-      title: providerTask.title,
+      gapId: userTask.gapId,
+      title: userTask.title,
       requiresUserAction: true
     };
   }
@@ -24048,11 +24661,11 @@ var init_nextActionBlock = __esm({
 
 // src/providerMcpBridge.ts
 function defaultMcpConfigPaths() {
-  const home = (0, import_node_os3.homedir)();
+  const home = (0, import_node_os4.homedir)();
   return [
-    (0, import_node_path37.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path37.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path37.join)(home, ".gemini", "antigravity", "mcp_config.json")
+    (0, import_node_path41.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path41.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path41.join)(home, ".gemini", "antigravity", "mcp_config.json")
   ];
 }
 function resolveConfigPaths() {
@@ -24081,11 +24694,11 @@ function findServerEntry(servers, provider2) {
 function findProviderMcpConfig(provider2, configPaths) {
   const paths = configPaths ?? resolveConfigPaths();
   for (const path of paths) {
-    if (!(0, import_node_fs13.existsSync)(path)) {
+    if (!(0, import_node_fs15.existsSync)(path)) {
       continue;
     }
     try {
-      const raw = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
+      const raw = JSON.parse((0, import_node_fs15.readFileSync)(path, "utf8"));
       const servers = parseMcpServers(raw);
       if (!servers) {
         continue;
@@ -24129,13 +24742,13 @@ async function verifyProviderGap(options) {
     fallbackCommand: FALLBACK_COMMAND
   };
 }
-var import_node_fs13, import_node_os3, import_node_path37, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
+var import_node_fs15, import_node_os4, import_node_path41, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
 var init_providerMcpBridge = __esm({
   "src/providerMcpBridge.ts"() {
     "use strict";
-    import_node_fs13 = require("node:fs");
-    import_node_os3 = require("node:os");
-    import_node_path37 = require("node:path");
+    import_node_fs15 = require("node:fs");
+    import_node_os4 = require("node:os");
+    import_node_path41 = require("node:path");
     FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
     SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
   }
@@ -24164,10 +24777,12 @@ Usage:
   viberaven tui          Interactive terminal menu
 
   viberaven check [--json] [--quiet] [path]
+  viberaven check --base <ref> [--markdown]   What this change introduced and fixed, compared with <ref>
+  viberaven init --github [--dry-run]         Check every pull request in GitHub Actions
                        Local production check: one line per finding, exit 1 on blockers
 
-  viberaven fix [--gap <id>] [path]
-                       Apply a safe automated fix for a known gap (heal recipe)
+  viberaven fix [--gap <id>] [--dry-run] [path]
+                       Apply a safe automated fix for a known gap (heal recipe); --dry-run previews only
 
   viberaven scan [--open] [--json] [path]
                        Full local scan; writes .viberaven/ artifacts
@@ -24313,9 +24928,12 @@ function isBooleanFlag(command, key) {
   if (key === "open" && (command === "" || command === "scan" || command === "report")) return true;
   if (key === "verify" && command === "") return true;
   if (key === "quiet" && command === "check") return true;
+  if (key === "markdown" && command === "check") return true;
+  if (key === "github" && command === "init") return true;
+  if (key === "force" && command === "init") return true;
   if (key === "vercel-supabase" && command === "audit") return true;
   if (key === "json" && command === "validate-npm-package") return true;
-  if (key === "dry-run" && command === "init") return true;
+  if (key === "dry-run" && (command === "init" || command === "fix")) return true;
   if (key === "agents" && command === "doctor") return true;
   return false;
 }
@@ -24346,7 +24964,7 @@ async function cmdProviderVerify(flags, positional) {
   return result.verified ? 0 : 1;
 }
 async function cmdStatus(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -24385,7 +25003,7 @@ async function cmdStatus(flags, positional) {
   return 0;
 }
 async function runScanCommand(flags, positional, options) {
-  const workspacePath = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
+  const workspacePath = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
   if (!options?.deferMachineOutput) {
     console.log(`Scanning ${workspacePath}\u2026 (local, offline)`);
   }
@@ -24412,7 +25030,7 @@ async function runScanCommand(flags, positional, options) {
     printNextActionBlock(block);
     printProviderActionBlock(tasks);
     try {
-      const manifest = JSON.parse(await (0, import_promises29.readFile)(paths.actionsPath, "utf8"));
+      const manifest = JSON.parse(await (0, import_promises32.readFile)(paths.actionsPath, "utf8"));
       console.log(renderActionSurface(manifest, { limit: 5 }).trimEnd());
     } catch (error) {
       console.warn(error instanceof Error ? error.message : String(error));
@@ -24429,7 +25047,7 @@ async function runScanCommand(flags, positional, options) {
   return { exitCode: 0, artifacts: paths };
 }
 async function cmdReport(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
   try {
     const paths = await refreshReportFromDisk(startDir);
     console.log(`Report refreshed: ${paths.reportPath}`);
@@ -24451,7 +25069,7 @@ async function cmdReport(flags, positional) {
   }
 }
 async function cmdPrompt(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -24548,7 +25166,7 @@ async function main() {
   const wantsJsonl = hasFlag(flags, "jsonl");
   const wantsStrict = hasFlag(flags, "strict");
   if (flags.condense) {
-    const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+    const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
     const result = await runCondenseCommand({ cwd });
     console.log(`VibeRaven context map refreshed: ${result.contextMapPath}`);
     return 0;
@@ -24568,7 +25186,7 @@ async function main() {
   }
   if (!command && flags.verify === true && typeof flags.action === "string") {
     return runVerifyActionCommand({
-      cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+      cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
       actionId: flags.action
     });
   }
@@ -24579,7 +25197,7 @@ async function main() {
       console.error("VibeRaven could not produce machine output because scan artifacts were not written.");
       return 3;
     }
-    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises29.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
+    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises32.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
     const strictExitCode = wantsStrict && gateResult ? exitCodeForStrictGate(gateResult, { failOnWarnings: flags.strict === "warning" }) : scanResult.exitCode;
     if (wantsJson && gateResult) {
       process.stdout.write(renderGateResultJson(gateResult));
@@ -24601,7 +25219,7 @@ async function main() {
       env: process.env
     });
     if (mode === "local-ui") {
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const handle = await startLocalUiServer({ cwd });
       console.log(`VibeRaven local UI: ${handle.url}`);
       await waitForServerShutdown();
@@ -24621,7 +25239,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     case "ui": {
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const envPort = Number(process.env.PORT);
       const handle = await startLocalUiServer({ cwd, port: Number.isFinite(envPort) && envPort > 0 ? envPort : void 0 });
       console.log(`VibeRaven local UI: ${handle.url}`);
@@ -24633,31 +25251,35 @@ async function main() {
       return cmdStatus(flags, positional);
     case "check":
       return runCheckCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json),
-        quiet: Boolean(flags.quiet)
+        quiet: Boolean(flags.quiet),
+        base: typeof flags.base === "string" ? flags.base : void 0,
+        markdown: flags.markdown === true
       });
     case "fix": {
-      const fixCwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const fixCwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const gapId = typeof flags.gap === "string" ? flags.gap : void 0;
       if (!gapId) {
         const artifact = await loadLastArtifact(fixCwd).catch(() => void 0);
-        const fixable = artifact ? buildTaskList(artifact).filter((t) => t.fixType === "repo-code" && !t.requiresUserAction) : [];
+        const fixable = artifact ? buildTaskList(artifact).filter((t) => t.fixType === "repo-code" && t.mcpTool === "viberaven_heal_apply") : [];
         if (fixable.length === 0) {
           console.log("Nothing to fix automatically. Run `viberaven check` first, then `viberaven fix --gap <id>`.");
           return artifact ? 0 : 1;
         }
         console.log("Fixable gaps:");
         for (const task of fixable) {
-          console.log(`  viberaven fix --gap ${task.gapId}   ${task.title}`);
+          const ask = task.requiresUserAction ? task.action?.match(/^Ask the user first: ([^.]+)\./)?.[1] : void 0;
+          console.log(`  viberaven fix --gap ${task.gapId}   ${task.title}${ask ? `   (asks first: ${ask})` : ""}`);
         }
         return 0;
       }
+      const dryRun = flags["dry-run"] === true;
       const result = await runHealCommand({
         cwd: fixCwd,
-        mode: "apply",
+        mode: dryRun ? "plan" : "apply",
         gapId,
-        yes: true,
+        yes: !dryRun,
         noVerify: flags["no-verify"] === true
       });
       console.log(JSON.stringify(result, null, 2));
@@ -24665,19 +25287,19 @@ async function main() {
     }
     case "actions":
       return runActionsCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "preview":
       return runPreviewCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         agentMode: flags["agent-mode"] === true,
         json: Boolean(flags.json)
       });
     case "next":
       return runNextCommand({
         json: Boolean(flags.json),
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "guide": {
       const provider2 = positional[0];
@@ -24711,8 +25333,11 @@ async function main() {
     case "provider-verify":
       return cmdProviderVerify(flags, positional);
     case "init": {
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const agents = typeof flags.agents === "string" ? flags.agents : void 0;
+      if (flags.github === true) {
+        return runInitGithubCommand({ cwd, dryRun: flags["dry-run"] === true, force: flags.force === true });
+      }
       return runInitCommand({
         cwd,
         agents,
@@ -24725,7 +25350,7 @@ async function main() {
         return 1;
       }
       return runDoctorAgentsCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "validate-npm-package":
       return runValidateNpmPackageCommand({
@@ -24738,7 +25363,7 @@ async function main() {
         return 1;
       }
       return runAuditCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "clean": {
@@ -24746,7 +25371,7 @@ async function main() {
         console.error("Usage: viberaven clean --plan [path]");
         return 1;
       }
-      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const plan = buildContextCleanupPlan({ projectRoot: cwd, files: await collectCleanupFiles(cwd) });
       const outputPath = await writeCleanupPlan(cwd, plan);
       console.log(`Wrote ${outputPath}
@@ -24756,9 +25381,9 @@ async function main() {
     }
     case "rls-test":
       return runRlsTestCommand({
-        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
-        matrix: typeof flags.matrix === "string" ? (0, import_node_path38.resolve)(process.cwd(), flags.matrix) : void 0,
-        migrations: typeof flags.migrations === "string" ? (0, import_node_path38.resolve)(process.cwd(), flags.migrations) : void 0,
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        matrix: typeof flags.matrix === "string" ? (0, import_node_path42.resolve)(process.cwd(), flags.matrix) : void 0,
+        migrations: typeof flags.migrations === "string" ? (0, import_node_path42.resolve)(process.cwd(), flags.migrations) : void 0,
         json: Boolean(flags.json)
       });
     default:
@@ -24767,11 +25392,11 @@ async function main() {
       return 1;
   }
 }
-var import_promises29, import_node_path38, STACK_AREAS;
+var import_promises32, import_node_path42, STACK_AREAS;
 var init_cli = __esm({
   "src/cli.ts"() {
-    import_promises29 = require("node:fs/promises");
-    import_node_path38 = require("node:path");
+    import_promises32 = require("node:fs/promises");
+    import_node_path42 = require("node:path");
     init_config();
     init_runScan();
     init_artifacts2();
@@ -24795,6 +25420,7 @@ var init_cli = __esm({
     init_stackRecommend();
     init_commands();
     init_runInit();
+    init_initGithub();
     init_runDoctor();
     init_runValidateNpmPackage();
     init_runAudit();