@viberaven/cli 1.5.3 → 1.6.0

package/dist/cli.js

@@ -6970,7 +6970,7 @@ var init_mockSupabaseVerifier = __esm({
             providerObservationMet: false,
             fixType: "mcp-connect",
             severity: tables.length > 0 ? "critical" : "info",
-            repoSignals: tables.map((table) => `table referenced: ${table}`),
+            repoSignals: tables.map((table2) => `table referenced: ${table2}`),
             providerSignals: ["Supabase policy list API or MCP"],
             requiredEvidence: ["Policies exist for tables used in application code"]
           }),
@@ -6986,7 +6986,7 @@ var init_mockSupabaseVerifier = __esm({
             providerObservationMet: false,
             fixType: "provider-config",
             severity: "warning",
-            repoSignals: tables.map((table) => `.from("${table}")`),
+            repoSignals: tables.map((table2) => `.from("${table2}")`),
             providerSignals: ["Live table policy map"],
             requiredEvidence: ["Each referenced public table has RLS + policy in production"]
           })
@@ -7008,7 +7008,7 @@ var init_mockSupabaseVerifier = __esm({
             providerActual: "Live RLS state unknown without Supabase MCP",
             severity: "critical",
             suggestedFix: "repo-fix",
-            evidenceRefs: tables.map((table) => `table: ${table}`)
+            evidenceRefs: tables.map((table2) => `table: ${table2}`)
           });
         }
         if (rlsInRepo) {
@@ -8303,7 +8303,7 @@ function replayProject(files, root) {
     }
   }
   const replayed = [...tables.values()];
-  for (const table of replayed) table.root = root;
+  for (const table2 of replayed) table2.root = root;
   return { tables: replayed, functions: [...functions.values()], statementsSeen };
 }
 function isSqlTestPath(path) {
@@ -8574,38 +8574,38 @@ function analyzeRls(replay) {
   const noPolicies = [];
   const permissive = [];
   const rlsEnabledEvidence = [];
-  for (const table of replay.tables) {
-    if (table.schema !== "public") continue;
-    if (table.rls) {
-      rlsEnabledEvidence.push(`${at(table.rlsLoc)}: row level security enabled on ${safe(table.display)}`);
+  for (const table2 of replay.tables) {
+    if (table2.schema !== "public") continue;
+    if (table2.rls) {
+      rlsEnabledEvidence.push(`${at(table2.rlsLoc)}: row level security enabled on ${safe(table2.display)}`);
     }
-    if (!table.rls && (table.created || table.disabledLoc)) {
-      const where = table.disabledLoc ?? table.arrivedLoc ?? table.created;
+    if (!table2.rls && (table2.created || table2.disabledLoc)) {
+      const where = table2.disabledLoc ?? table2.arrivedLoc ?? table2.created;
       const risk = "Anyone holding the anon key your frontend ships can read and change every row through the Data API (unless the table's grants were revoked).";
-      const message = table.disabledLoc ? `${table.display} has row level security turned off at ${at(table.disabledLoc)}. ${risk}` : table.arrivedLoc ? `${table.display} is moved into public at ${at(table.arrivedLoc)} without row level security, and no later migration enables it. ${risk}` : `${table.display} is created at ${at(table.created)} and no migration enables row level security on it. ${risk}`;
+      const message = table2.disabledLoc ? `${table2.display} has row level security turned off at ${at(table2.disabledLoc)}. ${risk}` : table2.arrivedLoc ? `${table2.display} is moved into public at ${at(table2.arrivedLoc)} without row level security, and no later migration enables it. ${risk}` : `${table2.display} is created at ${at(table2.created)} and no migration enables row level security on it. ${risk}`;
       missingRls.push({
         id: "rls_disabled",
         severity: "critical",
         message: safe(message),
         file: where?.file,
         line: where?.line,
-        table: table.display,
-        fix: `alter table ${table.display} enable row level security;`
+        table: table2.display,
+        fix: `alter table ${table2.display} enable row level security;`
       });
     }
-    if (table.rls && table.policies.size === 0) {
+    if (table2.rls && table2.policies.size === 0) {
       noPolicies.push({
         id: "rls_no_policies",
         severity: "info",
         message: safe(
-          `${table.display} has row level security on and no policies, so it is locked to the service role: the browser client gets no rows back and cannot write. Fine for server-only tables; add policies if the app reads it from the frontend.`
+          `${table2.display} has row level security on and no policies, so it is locked to the service role: the browser client gets no rows back and cannot write. Fine for server-only tables; add policies if the app reads it from the frontend.`
         ),
-        file: table.rlsLoc?.file,
-        line: table.rlsLoc?.line,
-        table: table.display
+        file: table2.rlsLoc?.file,
+        line: table2.rlsLoc?.line,
+        table: table2.display
       });
     }
-    for (const policy of table.policies.values()) {
+    for (const policy of table2.policies.values()) {
       if (!policy.permissive) continue;
       const roles = policy.roles.filter((r) => r === "public" || r === "anon" || r === "authenticated");
       if (roles.length === 0) continue;
@@ -8618,11 +8618,11 @@ function analyzeRls(replay) {
           id: "rls_policy_allows_all_read",
           severity: "high",
           message: safe(
-            `Policy "${policy.name}" on ${table.display} (${at(policy.loc)}) lets ${who} read every row: using (true). Fine for truly public content; wrong for anything per-user.`
+            `Policy "${policy.name}" on ${table2.display} (${at(policy.loc)}) lets ${who} read every row: using (true). Fine for truly public content; wrong for anything per-user.`
           ),
           file: policy.loc.file,
           line: policy.loc.line,
-          table: table.display,
+          table: table2.display,
           policy: policy.name
         });
         continue;
@@ -8650,10 +8650,10 @@ function analyzeRls(replay) {
       permissive.push({
         id: "rls_policy_allows_all_write",
         severity,
-        message: safe(`Policy "${policy.name}" on ${table.display} (${at(policy.loc)}) lets ${who} ${verb}: ${clause}.`),
+        message: safe(`Policy "${policy.name}" on ${table2.display} (${at(policy.loc)}) lets ${who} ${verb}: ${clause}.`),
         file: policy.loc.file,
         line: policy.loc.line,
-        table: table.display,
+        table: table2.display,
         policy: policy.name
       });
     }
@@ -8733,35 +8733,35 @@ function analyzeGrants(replay, uses, autoExpose) {
     if (existing) use.ops.forEach((op) => existing.ops.add(op));
     else byName.set(use.table, { ...use, ops: new Set(use.ops) });
   }
-  for (const table of replay.tables) {
-    if (table.schema !== "public") continue;
-    const granted = table.grants.size > 0;
-    if (granted && !table.rls) {
-      const roles2 = [...new Set([...table.grants].map((g2) => g2.split(":")[0]))].join(" and ");
+  for (const table2 of replay.tables) {
+    if (table2.schema !== "public") continue;
+    const granted = table2.grants.size > 0;
+    if (granted && !table2.rls) {
+      const roles2 = [...new Set([...table2.grants].map((g2) => g2.split(":")[0]))].join(" and ");
       out.push({
         id: "data_api_grant_without_rls",
         severity: "critical",
         message: safe(
-          `${table.display} is granted to ${roles2} (${at(table.grantLoc)}) but row level security is off. A grant without RLS is the dangerous combination: the Data API serves every row to that role. Enable RLS and add policies before granting.`
+          `${table2.display} is granted to ${roles2} (${at(table2.grantLoc)}) but row level security is off. A grant without RLS is the dangerous combination: the Data API serves every row to that role. Enable RLS and add policies before granting.`
         ),
-        file: table.grantLoc?.file,
-        line: table.grantLoc?.line,
-        table: table.display,
-        fix: `alter table ${table.display} enable row level security;`
+        file: table2.grantLoc?.file,
+        line: table2.grantLoc?.line,
+        table: table2.display,
+        fix: `alter table ${table2.display} enable row level security;`
       });
       continue;
     }
-    if (!table.created || !table.rls) continue;
+    if (!table2.created || !table2.rls) continue;
     const configOff = autoExpose && !autoExpose.value ? autoExpose : void 0;
-    const revokedAtCreate = table.defaultsRevoked ?? /* @__PURE__ */ new Set();
+    const revokedAtCreate = table2.defaultsRevoked ?? /* @__PURE__ */ new Set();
     if (revokedAtCreate.size === 0 && !configOff) continue;
-    const use = byName.get(table.name);
+    const use = byName.get(table2.name);
     if (!use) continue;
-    const lacks = (role, priv) => !table.grants.has(`${role}:${priv}`) && (configOff !== void 0 || revokedAtCreate.has(`${role}:${priv}`));
+    const lacks = (role, priv) => !table2.grants.has(`${role}:${priv}`) && (configOff !== void 0 || revokedAtCreate.has(`${role}:${priv}`));
     const rolesFor = (priv) => {
-      if (!table.rls) return [...DATA_API_ROLES];
+      if (!table2.rls) return [...DATA_API_ROLES];
       return expandRoles(
-        [...table.policies.values()].filter((p2) => p2.permissive && (p2.command === priv || p2.command === "all")).flatMap((p2) => p2.roles)
+        [...table2.policies.values()].filter((p2) => p2.permissive && (p2.command === priv || p2.command === "all")).flatMap((p2) => p2.roles)
       );
     };
     const blocked = /* @__PURE__ */ new Map();
@@ -8773,17 +8773,17 @@ function analyzeGrants(replay, uses, autoExpose) {
     if (blocked.size === 0) continue;
     const privs = [...blocked.keys()];
     const roles = [...new Set([...blocked.values()].flat())];
-    const reason = configOff ? `${configOff.file}:${configOff.line} sets auto_expose_new_tables = false, so new public tables get no default grants` : `the default grants for new public tables are revoked at ${at(table.defaultsRevokedLoc)}`;
-    const fix = `grant ${privs.join(", ")} on table ${table.display} to ${roles.join(", ")};`;
+    const reason = configOff ? `${configOff.file}:${configOff.line} sets auto_expose_new_tables = false, so new public tables get no default grants` : `the default grants for new public tables are revoked at ${at(table2.defaultsRevokedLoc)}`;
+    const fix = `grant ${privs.join(", ")} on table ${table2.display} to ${roles.join(", ")};`;
     out.push({
       id: "data_api_grant_missing",
       severity: "warning",
       message: safe(
-        `${table.display} is used from the client (${use.file}:${use.line}) for ${privs.join(", ")}, but ${roles.join(" and ")} ${roles.length === 1 ? "has" : "have"} no ${privs.join("/")} grant on it: ${reason}, and no migration grants it back. Those calls get "permission denied for table ${table.name}". Add to a migration: ${fix}`
+        `${table2.display} is used from the client (${use.file}:${use.line}) for ${privs.join(", ")}, but ${roles.join(" and ")} ${roles.length === 1 ? "has" : "have"} no ${privs.join("/")} grant on it: ${reason}, and no migration grants it back. Those calls get "permission denied for table ${table2.name}". Add to a migration: ${fix}`
       ),
-      file: table.created.file,
-      line: table.created.line,
-      table: table.display,
+      file: table2.created.file,
+      line: table2.created.line,
+      table: table2.display,
       fix
     });
   }
@@ -10291,10 +10291,10 @@ async function listTrackedIgnoredFiles(workspacePath) {
     return { paths: [], incomplete: false };
   }
   try {
-    const git = await safeGitInvocation(workspacePath, ["ls-files", "-c", "-i", "--exclude-standard", "-z"]);
-    const { stdout } = await execFileAsync2("git", git.args, {
+    const git2 = await safeGitInvocation(workspacePath, ["ls-files", "-c", "-i", "--exclude-standard", "-z"]);
+    const { stdout } = await execFileAsync2("git", git2.args, {
       cwd: workspacePath,
-      env: git.env,
+      env: git2.env,
       timeout: GIT_TIMEOUT_MS,
       maxBuffer: GIT_MAX_OUTPUT_BYTES,
       windowsHide: true
@@ -10318,14 +10318,14 @@ async function collectDatabaseEvidence(workspacePath, scan) {
       [...scan.fileTree.split("\n"), ...scan.secretsFound, ...walk.listed, ...trackedIgnored.paths].map((p2) => normalizedPath(p2.trim()))
     )
   ].filter((p2) => p2.length > 0 && !isOwnArtifact(p2) && !fullyLoaded.has(p2));
-  const wanted = [
+  const wanted2 = [
     ...candidates.filter((p2) => EVIDENCE_MANIFEST.test(p2)),
     ...candidates.filter((p2) => !EVIDENCE_MANIFEST.test(p2) && EVIDENCE_CODE.test(p2))
   ];
-  if (wanted.length > EVIDENCE_MAX_FILES) incomplete = true;
+  if (wanted2.length > EVIDENCE_MAX_FILES) incomplete = true;
   const files = [];
   let bytesRead = 0;
-  for (const path of wanted.slice(0, EVIDENCE_MAX_FILES)) {
+  for (const path of wanted2.slice(0, EVIDENCE_MAX_FILES)) {
     if (bytesRead >= EVIDENCE_MAX_TOTAL_BYTES) {
       incomplete = true;
       break;
@@ -10669,8 +10669,8 @@ function noReleaseTagsSeed(commitCount) {
 }
 async function detectReleaseTagGap(workspacePath) {
   try {
-    const git = (args) => safeGitInvocation(workspacePath, args).then((call) => execFileAsync3("git", call.args, { cwd: workspacePath, env: call.env, windowsHide: true }));
-    const [tags, count] = await Promise.all([git(["tag", "--list"]), git(["rev-list", "--count", "HEAD"])]);
+    const git2 = (args) => safeGitInvocation(workspacePath, args).then((call) => execFileAsync3("git", call.args, { cwd: workspacePath, env: call.env, windowsHide: true }));
+    const [tags, count] = await Promise.all([git2(["tag", "--list"]), git2(["rev-list", "--count", "HEAD"])]);
     const tagCount = tags.stdout.split("\n").filter((line) => line.trim().length > 0).length;
     const commitCount = Number.parseInt(count.stdout.trim(), 10) || 0;
     if (tagCount === 0 && commitCount >= 20) {
@@ -12420,7 +12420,7 @@ var init_agentSummary = __esm({
 
 // src/heal/rlsMigrationTarget.ts
 function rlsEnableStatements(tables) {
-  return [...new Set(tables)].map((table) => `alter table ${table} enable row level security;`);
+  return [...new Set(tables)].map((table2) => `alter table ${table2} enable row level security;`);
 }
 function migrationStamp(now) {
   return now.toISOString().replace(/\D/g, "").slice(0, 14);
@@ -13688,12 +13688,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
 }
 async function openWithSystemDefault(target) {
   const { command, args, shell } = createOpenCommand(target);
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve10, reject) => {
     const child = (0, import_node_child_process4.spawn)(command, args, { stdio: "ignore", shell });
     child.on("error", reject);
     child.on("exit", (code) => {
       if (code === 0) {
-        resolve9();
+        resolve10();
       } else {
         reject(new Error(`Could not open browser (exit ${code ?? "unknown"}). Open manually: ${target}`));
       }
@@ -13704,7 +13704,7 @@ async function spawnDetached(command) {
   if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs8.existsSync)(command.command)) {
     throw new Error(`Browser not found: ${command.command}`);
   }
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve10, reject) => {
     const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
       detached: true,
       stdio: "ignore",
@@ -13712,7 +13712,7 @@ async function spawnDetached(command) {
     });
     child.once("spawn", () => {
       child.unref();
-      resolve9();
+      resolve10();
     });
     child.once("error", reject);
   });
@@ -13780,12 +13780,12 @@ async function copyToClipboard(text) {
   }
 }
 function pipeToCommand(command, text, extraArgs = []) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const child = (0, import_node_child_process5.spawn)(command, extraArgs, { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", reject);
     child.on("close", (code) => {
       if (code === 0) {
-        resolve9();
+        resolve10();
       } else {
         reject(new Error(`${command} exited with code ${code ?? "unknown"}`));
       }
@@ -14690,7 +14690,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.5.3";
+    VERSION = "1.6.0";
   }
 });
 
@@ -17100,6 +17100,323 @@ var init_runInit = __esm({
   }
 });
 
+// src/commands/checkChange.ts
+function findingKey(finding) {
+  return `${finding.id}\0${finding.title}`;
+}
+function findingSubjects(finding) {
+  const line = (finding.detail.split("\n").find((part) => part.trim()) ?? "").replace(LOCATION_TEXT, " ");
+  return [...new Set((line.match(SUBJECT) ?? []).map((subject) => subject.toLowerCase()))].sort();
+}
+function bySeverity(a, b3) {
+  return SEVERITY_RANK3[a.severity] - SEVERITY_RANK3[b3.severity] || a.title.localeCompare(b3.title);
+}
+function compareFindings(base, head, ref, baseCommit) {
+  const baseByKey = new Map(base.map((finding) => [findingKey(finding), finding]));
+  const headKeys = new Set(head.map(findingKey));
+  const introduced = [];
+  const resolved = base.filter((finding) => !headKeys.has(findingKey(finding)));
+  const unchanged = [];
+  for (const finding of head) {
+    const before = baseByKey.get(findingKey(finding));
+    if (!before) {
+      introduced.push(finding);
+      continue;
+    }
+    const was = new Set(findingSubjects(before));
+    const now = findingSubjects(finding);
+    const added = now.filter((subject) => !was.has(subject));
+    const removed = [...was].filter((subject) => !now.includes(subject));
+    if (added.length) introduced.push({ ...finding, subjects: added });
+    else unchanged.push(finding);
+    if (removed.length) resolved.push({ ...before, subjects: removed });
+  }
+  return { base: ref, baseCommit, introduced: introduced.sort(bySeverity), resolved: resolved.sort(bySeverity), unchanged: unchanged.sort(bySeverity) };
+}
+async function git(cwd, args) {
+  const call = await safeGitInvocation(cwd, args);
+  const { stdout } = await execFileAsync4("git", call.args, { cwd, env: call.env, windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
+  return stdout;
+}
+async function resolveBaseCommit(cwd, ref) {
+  let commit;
+  try {
+    commit = (await git(cwd, ["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`])).trim();
+  } catch {
+    throw new Error(
+      `Could not find "${ref}" in this repository. Fetch it first (git fetch origin ${ref.replace(/^origin\//, "")}); in GitHub Actions, check out with fetch-depth: 0.`
+    );
+  }
+  try {
+    const mergeBase = (await git(cwd, ["merge-base", commit, "HEAD"])).trim();
+    return mergeBase || commit;
+  } catch {
+    return commit;
+  }
+}
+function parseTree(output) {
+  const entries = [];
+  for (const record of output.split("\0")) {
+    if (!record) continue;
+    const tab = record.indexOf("	");
+    const [mode, type, sha, size] = record.slice(0, tab).trim().split(/\s+/);
+    entries.push({ mode, type, sha, size: Number.parseInt(size, 10) || 0, path: record.slice(tab + 1) });
+  }
+  return entries;
+}
+function wanted(entry) {
+  if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") return false;
+  if (entry.size > MAX_BLOB_BYTES) return false;
+  return !entry.path.split("/").some((segment) => SKIP_SEGMENTS.has(segment));
+}
+async function readBlobs(cwd, shas) {
+  const blobs = /* @__PURE__ */ new Map();
+  if (!shas.length) return blobs;
+  const call = await safeGitInvocation(cwd, ["cat-file", "--batch"]);
+  const output = await new Promise((resolveOutput, reject) => {
+    const child = (0, import_node_child_process6.spawn)("git", call.args, { cwd, env: call.env, windowsHide: true });
+    const chunks = [];
+    let stderr = "";
+    child.stdout.on("data", (chunk) => chunks.push(chunk));
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolveOutput(Buffer.concat(chunks)) : reject(new Error(stderr.trim() || `git cat-file exited with ${code}`)));
+    child.stdin.end(`${shas.join("\n")}
+`);
+  });
+  let offset = 0;
+  while (offset < output.length) {
+    const newline = output.indexOf(10, offset);
+    if (newline === -1) break;
+    const [sha, type, sizeText] = output.subarray(offset, newline).toString().split(" ");
+    offset = newline + 1;
+    if (type === "missing" || sizeText === void 0) continue;
+    const size = Number.parseInt(sizeText, 10);
+    blobs.set(sha, output.subarray(offset, offset + size));
+    offset += size + 1;
+  }
+  return blobs;
+}
+async function exportCommit(cwd, commit) {
+  const entries = parseTree(await git(cwd, ["ls-tree", "-r", "-z", "-l", "--full-tree", commit])).filter(wanted);
+  const blobs = await readBlobs(cwd, [...new Set(entries.map((entry) => entry.sha))]);
+  const root = await (0, import_promises23.mkdtemp)((0, import_node_path30.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
+  for (const entry of entries) {
+    const target = (0, import_node_path30.resolve)(root, ...entry.path.split("/"));
+    if (!target.startsWith(root + import_node_path30.sep)) continue;
+    const content = blobs.get(entry.sha);
+    if (!content) continue;
+    await (0, import_promises23.mkdir)((0, import_node_path30.dirname)(target), { recursive: true });
+    await (0, import_promises23.writeFile)(target, content);
+  }
+  return root;
+}
+async function checkChange(cwd, ref, head) {
+  const baseCommit = await resolveBaseCommit(cwd, ref);
+  const folder = await exportCommit(cwd, baseCommit);
+  try {
+    const result = await runProjectScan({ workspacePath: folder });
+    if (!result.ok) throw new Error(`The check on ${ref} did not finish: ${result.message}`);
+    return compareFindings(result.artifact.gaps, head, ref, baseCommit);
+  } finally {
+    await (0, import_promises23.rm)(folder, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
+  }
+}
+function cell(text) {
+  return text.replace(/\r?\n/g, " ").replace(/\|/g, "\\|").trim();
+}
+function firstLine(detail) {
+  const line = detail.split("\n").map((part) => part.trim()).find(Boolean) ?? "";
+  return line.length > 180 ? `${line.slice(0, 177)}\u2026` : line;
+}
+function plural2(count, word) {
+  return `${count} ${word}${count === 1 ? "" : "s"}`;
+}
+function table(findings) {
+  return [
+    "| | Finding | Check |",
+    "|---|---|---|",
+    ...findings.map((finding) => {
+      const why = finding.subjects?.length ? `New in this change: ${finding.subjects.join(", ")}` : firstLine(finding.detail);
+      return `| ${DOT[finding.severity]} | **${cell(finding.title)}**${why ? `<br>${cell(why)}` : ""} | \`${cell(finding.id)}\` |`;
+    })
+  ];
+}
+function fixedLabel(finding) {
+  return `\u2705 ${cell(finding.title)}${finding.subjects?.length ? ` for ${cell(finding.subjects.join(", "))}` : ""} (\`${cell(finding.id)}\`)`;
+}
+function renderCheckMarkdown({ head, change, version, score }) {
+  const lines = [COMMENT_MARKER];
+  const sorted = [...head].sort(bySeverity);
+  const critical = sorted.filter((finding) => finding.severity === "critical").length;
+  const warnings = sorted.filter((finding) => finding.severity === "warning").length;
+  if (change) {
+    const newCritical = change.introduced.filter((finding) => finding.severity === "critical").length;
+    const headline = newCritical ? `${plural2(newCritical, "new blocker")} in this change` : change.introduced.length ? `${plural2(change.introduced.length, "new finding")} in this change, no new blockers` : "No new findings in this change";
+    lines.push(`### VibeRaven \xB7 ${headline}`, "");
+    lines.push(`Compared with \`${change.base}\` (${change.baseCommit.slice(0, 7)}).${change.resolved.length ? ` This change fixes ${plural2(change.resolved.length, "finding")}.` : ""}`, "");
+    if (change.introduced.length) lines.push(...table(change.introduced), "");
+    if (change.resolved.length) {
+      lines.push(`**Fixed by this change:** ${change.resolved.map(fixedLabel).join(" \xB7 ")}`, "");
+    }
+    if (change.unchanged.length) {
+      lines.push(`<details><summary>Already in ${cell(change.base)} before this change (${change.unchanged.length})</summary>`, "", ...table(change.unchanged), "", "</details>", "");
+    }
+    const firstNew = change.introduced.find((finding) => finding.severity === "critical") ?? change.introduced[0];
+    if (firstNew) lines.push(`Fix it with your coding agent: \`npx -y viberaven fix --gap ${firstNew.id}\`, or open the Studio with \`npx -y viberaven\`.`, "");
+  } else {
+    const headline = critical ? `${plural2(critical, "blocker")}, ${plural2(warnings, "warning")}` : `No blockers, ${plural2(warnings, "warning")}`;
+    lines.push(`### VibeRaven \xB7 ${headline}`, "");
+    if (sorted.length) lines.push(...table(sorted), "");
+    else lines.push("No launch findings in the repo evidence.", "");
+  }
+  lines.push(
+    `<sub>viberaven ${version}${typeof score === "number" ? ` \xB7 readiness ${score}/100` : ""} \xB7 checked where it ran, nothing was uploaded. Advice, not a gate: a clear result reads the repo, it is not a security audit.</sub>`
+  );
+  return `${lines.join("\n")}
+`;
+}
+var import_node_child_process6, import_promises23, import_node_os, import_node_path30, import_node_util4, execFileAsync4, MAX_BLOB_BYTES, SKIP_SEGMENTS, SEVERITY_RANK3, LOCATION_TEXT, SUBJECT, COMMENT_MARKER, DOT;
+var init_checkChange = __esm({
+  "src/commands/checkChange.ts"() {
+    "use strict";
+    import_node_child_process6 = require("node:child_process");
+    import_promises23 = require("node:fs/promises");
+    import_node_os = require("node:os");
+    import_node_path30 = require("node:path");
+    import_node_util4 = require("node:util");
+    init_runScan();
+    init_safeGit();
+    execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process6.execFile);
+    MAX_BLOB_BYTES = 1e6;
+    SKIP_SEGMENTS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".turbo", ".vercel", ".output", "dist", "build", "coverage"]);
+    SEVERITY_RANK3 = { critical: 0, warning: 1, info: 2 };
+    LOCATION_TEXT = /[\w./\\-]+\.(?:sql|tsx?|jsx?|mjs|cjs|json|toml|ya?ml|env|prisma|md)(?::\d+)?/gi;
+    SUBJECT = /\b[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*\b/gi;
+    COMMENT_MARKER = "<!-- viberaven-check -->";
+    DOT = { critical: "\u{1F534}", warning: "\u{1F7E1}", info: "\u26AA" };
+  }
+});
+
+// src/commands/initGithub.ts
+function renderWorkflow(version = VERSION) {
+  return [
+    "# VibeRaven checks every pull request in this repository's own GitHub Actions run.",
+    "# The code is read on the runner and never uploaded. Written by `npx -y viberaven init --github`.",
+    "name: VibeRaven",
+    "",
+    "on:",
+    "  pull_request:",
+    "",
+    "permissions:",
+    "  contents: read",
+    "  pull-requests: write",
+    "",
+    "jobs:",
+    "  check:",
+    "    name: Launch check",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          fetch-depth: 0",
+    "",
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 20",
+    "",
+    "      - name: Check this change",
+    "        id: check",
+    "        env:",
+    "          BASE_REF: ${{ github.base_ref }}",
+    "        run: |",
+    "          code=0",
+    `          npx -y viberaven@${version} check --base "origin/$BASE_REF" --markdown > viberaven-check.md || code=$?`,
+    '          cat viberaven-check.md >> "$GITHUB_STEP_SUMMARY"',
+    '          echo "code=$code" >> "$GITHUB_OUTPUT"',
+    "",
+    "      # Pull requests from forks get a read-only token: they keep the job summary and skip the comment.",
+    "      - name: Comment on the pull request",
+    "        if: github.event.pull_request.head.repo.full_name == github.repository",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    "          PR: ${{ github.event.pull_request.number }}",
+    "        run: |",
+    `          id=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR/comments" --paginate --jq '.[] | select(.body | contains("${COMMENT_MARKER}")) | .id' | tail -n 1)`,
+    '          if [ -n "$id" ]; then',
+    '            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -F body=@viberaven-check.md > /dev/null',
+    "          else",
+    '            gh pr comment "$PR" --body-file viberaven-check.md',
+    "          fi",
+    "",
+    "      # Advice, not a gate. To block merging when a change adds a launch blocker, uncomment this step",
+    '      # and mark "Launch check" as required in the branch protection settings.',
+    "      # - name: Fail on new blockers",
+    "      #   if: steps.check.outputs.code == '1'",
+    "      #   run: exit 1",
+    ""
+  ].join("\n");
+}
+async function hasGithubRemote(cwd) {
+  try {
+    const call = await safeGitInvocation(cwd, ["remote", "-v"]);
+    const { stdout } = await execFileAsync5("git", call.args, { cwd, env: call.env, windowsHide: true });
+    return /github\.com[:/]/i.test(stdout);
+  } catch {
+    return false;
+  }
+}
+async function githubWorkflowStatus(cwd) {
+  return { exists: (0, import_node_fs14.existsSync)((0, import_node_path31.join)(cwd, WORKFLOW_PATH)), path: DISPLAY_PATH, onGithub: await hasGithubRemote(cwd) };
+}
+async function writeGithubWorkflow(cwd, options = {}) {
+  const target = (0, import_node_path31.join)(cwd, WORKFLOW_PATH);
+  if ((0, import_node_fs14.existsSync)(target) && !options.force) return { written: false, status: await githubWorkflowStatus(cwd) };
+  await (0, import_promises24.mkdir)((0, import_node_path31.dirname)(target), { recursive: true });
+  await (0, import_promises24.writeFile)(target, renderWorkflow(), "utf8");
+  return { written: true, status: await githubWorkflowStatus(cwd) };
+}
+async function runInitGithubCommand(options) {
+  if (options.dryRun) {
+    console.log(`Would write ${DISPLAY_PATH}:
+`);
+    console.log(renderWorkflow());
+    return 0;
+  }
+  const { written, status } = await writeGithubWorkflow(options.cwd, { force: options.force });
+  if (!written) {
+    console.log(`${DISPLAY_PATH} already exists. Nothing changed. Run with --force to replace it.`);
+    return 0;
+  }
+  console.log(`Wrote ${DISPLAY_PATH}.`);
+  console.log("");
+  console.log("Commit it, and every pull request gets one VibeRaven comment with what the change added or fixed:");
+  console.log(`  git add ${DISPLAY_PATH} && git commit -m "Check pull requests with VibeRaven"`);
+  console.log("");
+  console.log("It runs in your own GitHub Actions, so private repositories work and the code is never uploaded.");
+  if (!status.onGithub) console.log("This repository has no github.com remote yet: the workflow runs once it is pushed to GitHub.");
+  return 0;
+}
+var import_node_child_process7, import_node_fs14, import_promises24, import_node_path31, import_node_util5, execFileAsync5, WORKFLOW_PATH, DISPLAY_PATH;
+var init_initGithub = __esm({
+  "src/commands/initGithub.ts"() {
+    "use strict";
+    import_node_child_process7 = require("node:child_process");
+    import_node_fs14 = require("node:fs");
+    import_promises24 = require("node:fs/promises");
+    import_node_path31 = require("node:path");
+    import_node_util5 = require("node:util");
+    init_safeGit();
+    init_version();
+    init_checkChange();
+    execFileAsync5 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
+    WORKFLOW_PATH = (0, import_node_path31.join)(".github", "workflows", "viberaven.yml");
+    DISPLAY_PATH = ".github/workflows/viberaven.yml";
+  }
+});
+
 // src/commands/doctorAgents.ts
 function managedBlocks(content) {
   const blocks = content.match(/<!-- (?:VIBERAVEN:START|viberaven:agent-rules:start) -->[\s\S]*?<!-- (?:VIBERAVEN:END|viberaven:agent-rules:end) -->/g);
@@ -17108,7 +17425,7 @@ function managedBlocks(content) {
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item4 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists = await fileExists2((0, import_node_path30.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path32.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
@@ -17116,17 +17433,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item4 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists = await fileExists2((0, import_node_path30.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path32.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
       message: exists ? `${item4.file} exists` : `Missing ${item4.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path30.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path32.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
-    const legacyContent = await (0, import_promises23.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path30.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const legacyContent = await (0, import_promises25.readFile)(legacyCursorPath, "utf-8");
+    const hasCoreSplit = await fileExists2((0, import_node_path32.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -17137,7 +17454,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path30.join)(cwd, file);
+    const path = (0, import_node_path32.join)(cwd, file);
     const exists = await fileExists2(path);
     if (!exists) {
       checks.push({
@@ -17147,7 +17464,7 @@ async function checkAgentInjection(cwd) {
       });
       continue;
     }
-    const content = await (0, import_promises23.readFile)(path, "utf-8");
+    const content = await (0, import_promises25.readFile)(path, "utf-8");
     const hasCommand = content.includes(PUBLIC_CHECK_COMMAND);
     checks.push({
       id: `canonical-${target}`,
@@ -17190,18 +17507,18 @@ function formatDoctorAgentsReport(report) {
 }
 async function fileExists2(path) {
   try {
-    await (0, import_promises23.access)(path);
+    await (0, import_promises25.access)(path);
     return true;
   } catch {
     return false;
   }
 }
-var import_promises23, import_node_path30, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
+var import_promises25, import_node_path32, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
 var init_doctorAgents = __esm({
   "src/commands/doctorAgents.ts"() {
     "use strict";
-    import_promises23 = require("node:fs/promises");
-    import_node_path30 = require("node:path");
+    import_promises25 = require("node:fs/promises");
+    import_node_path32 = require("node:path");
     init_commands();
     init_agentTargets();
     REQUIRED_EXISTENCE_CHECKS = [
@@ -17472,7 +17789,7 @@ function buildContextCleanupPlan(input) {
   const items = [];
   const seen = /* @__PURE__ */ new Set();
   for (const file of input.files) {
-    const path = normalizePath5((0, import_node_path31.relative)(input.projectRoot, file.path) || file.path);
+    const path = normalizePath5((0, import_node_path33.relative)(input.projectRoot, file.path) || file.path);
     const fullPath = normalizePath5(file.path);
     const category = categorizeCleanupFile(path, fullPath, file);
     if (!category || seen.has(path)) {
@@ -17498,10 +17815,10 @@ async function collectCleanupFiles(projectRoot) {
   return files;
 }
 async function writeCleanupPlan(projectRoot, plan) {
-  const outputDir = (0, import_node_path31.join)(projectRoot, ".viberaven");
-  const outputPath = (0, import_node_path31.join)(outputDir, "context-cleanup.md");
-  await (0, import_promises24.mkdir)(outputDir, { recursive: true });
-  await (0, import_promises24.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
+  const outputDir = (0, import_node_path33.join)(projectRoot, ".viberaven");
+  const outputPath = (0, import_node_path33.join)(outputDir, "context-cleanup.md");
+  await (0, import_promises26.mkdir)(outputDir, { recursive: true });
+  await (0, import_promises26.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
   return outputPath;
 }
 function categorizeCleanupFile(relativePath, fullPath, file) {
@@ -17549,7 +17866,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
   }
   let entries;
   try {
-    entries = await (0, import_promises24.readdir)(dir, { withFileTypes: true });
+    entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -17557,9 +17874,9 @@ async function walkCleanupFiles(root, dir, result, depth) {
     if (SKIP_DIRECTORIES.has(entry.name)) {
       continue;
     }
-    const absolute = (0, import_node_path31.join)(dir, entry.name);
+    const absolute = (0, import_node_path33.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (isCachePath(normalizePath5((0, import_node_path31.relative)(root, absolute)))) {
+      if (isCachePath(normalizePath5((0, import_node_path33.relative)(root, absolute)))) {
         result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
         continue;
       }
@@ -17570,7 +17887,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
       continue;
     }
     try {
-      const fileStat = await (0, import_promises24.stat)(absolute);
+      const fileStat = await (0, import_promises26.stat)(absolute);
       result.push({ path: absolute, sizeBytes: fileStat.size, kind: "file" });
     } catch {
       continue;
@@ -17580,12 +17897,12 @@ async function walkCleanupFiles(root, dir, result, depth) {
 function normalizePath5(path) {
   return path.replace(/\\/g, "/");
 }
-var import_promises24, import_node_path31, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
+var import_promises26, import_node_path33, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
 var init_cleanPlan = __esm({
   "src/commands/cleanPlan.ts"() {
     "use strict";
-    import_promises24 = require("node:fs/promises");
-    import_node_path31 = require("node:path");
+    import_promises26 = require("node:fs/promises");
+    import_node_path33 = require("node:path");
     MAX_WALK_DEPTH = 5;
     LARGE_LOG_BYTES = 8192;
     SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -17698,10 +18015,10 @@ var init_render = __esm({
 
 // src/commands/actions.ts
 async function runActionsCommand(input) {
-  const actionsPath = (0, import_node_path32.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path34.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   let raw;
   try {
-    raw = await (0, import_promises25.readFile)(actionsPath, "utf8");
+    raw = await (0, import_promises27.readFile)(actionsPath, "utf8");
   } catch {
     process.stderr.write("No VibeRaven actions found. Run `npx -y viberaven --agent-mode` first.\n");
     return 1;
@@ -17715,12 +18032,12 @@ async function runActionsCommand(input) {
   process.stdout.write(renderActionSurface(manifest));
   return 0;
 }
-var import_promises25, import_node_path32;
+var import_promises27, import_node_path34;
 var init_actions = __esm({
   "src/commands/actions.ts"() {
     "use strict";
-    import_promises25 = require("node:fs/promises");
-    import_node_path32 = require("node:path");
+    import_promises27 = require("node:fs/promises");
+    import_node_path34 = require("node:path");
     init_render();
     init_config();
   }
@@ -17729,7 +18046,7 @@ var init_actions = __esm({
 // src/commands/verifyAction.ts
 async function currentActionExists(cwd, actionId) {
   try {
-    const raw = await (0, import_promises26.readFile)((0, import_node_path33.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path35.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
     const manifest = JSON.parse(raw);
     return manifest.actions.some((action) => action.id === actionId);
   } catch {
@@ -17773,12 +18090,12 @@ This only looks the action up. Run \`npx -y viberaven --verify\` to scan the rep
   );
   return 0;
 }
-var import_promises26, import_node_path33;
+var import_promises28, import_node_path35;
 var init_verifyAction = __esm({
   "src/commands/verifyAction.ts"() {
     "use strict";
-    import_promises26 = require("node:fs/promises");
-    import_node_path33 = require("node:path");
+    import_promises28 = require("node:fs/promises");
+    import_node_path35 = require("node:path");
     init_registry2();
     init_config();
   }
@@ -17902,11 +18219,36 @@ var init_preview = __esm({
 async function runCheckCommand(options) {
   const result = await runProjectScan({ workspacePath: options.cwd });
   if (!result.ok) {
+    if (options.markdown) console.log(`${COMMENT_MARKER}
+### VibeRaven could not check this change
+
+${result.message}
+`);
     console.error(formatAgentStatus(ERROR, result.message));
     return 2;
   }
   const artifact = result.artifact;
   const paths = await writeScanArtifacts({ artifact, cwd: options.cwd });
+  let change;
+  if (options.base) {
+    try {
+      change = await checkChange(options.cwd, options.base, artifact.gaps);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (options.markdown) console.log(`${COMMENT_MARKER}
+### VibeRaven could not compare this change
+
+${message}
+`);
+      console.error(formatAgentStatus(ERROR, message));
+      return 2;
+    }
+  }
+  const failing = change ? change.introduced.some((g2) => g2.severity === "critical") : artifact.gaps.some((g2) => g2.severity === "critical");
+  if (options.markdown) {
+    console.log(renderCheckMarkdown({ head: artifact.gaps, change, version: VERSION, score: artifact.score }));
+    return failing ? 1 : 0;
+  }
   if (options.json) {
     console.log(
       JSON.stringify(
@@ -17921,13 +18263,22 @@ async function runCheckCommand(options) {
             title: gap.title,
             detail: gap.detail
           })),
+          ...change ? {
+            change: {
+              base: change.base,
+              baseCommit: change.baseCommit,
+              introduced: change.introduced.map((gap) => gap.id),
+              resolved: change.resolved.map((gap) => gap.id),
+              unchanged: change.unchanged.map((gap) => gap.id)
+            }
+          } : {},
           artifacts: paths
         },
         null,
         2
       )
     );
-    return artifact.gaps.some((g2) => g2.severity === "critical") ? 1 : 0;
+    return failing ? 1 : 0;
   }
   const sorted = [...artifact.gaps].sort(
     (a, b3) => SEVERITY_ORDER3[a.severity] - SEVERITY_ORDER3[b3.severity]
@@ -17937,14 +18288,37 @@ async function runCheckCommand(options) {
   console.log("");
   console.log(`viberaven check \xB7 ${options.cwd}`);
   console.log("");
+  if (change) {
+    const line = (gap) => `${SEVERITY_ICON[gap.severity]} ${gap.title}  (${gap.id})`;
+    console.log(`Compared with ${change.base} (${change.baseCommit.slice(0, 7)})`);
+    console.log("");
+    console.log(change.introduced.length ? "New in this change:" : "New in this change: nothing");
+    for (const gap of change.introduced) {
+      console.log(`  ${line(gap)}${gap.subjects?.length ? `  new: ${gap.subjects.join(", ")}` : ""}`);
+      if (!options.quiet && !gap.subjects?.length && gap.detail) console.log(`     ${gap.detail.split("\n")[0]}`);
+    }
+    if (change.resolved.length) {
+      console.log("Fixed by this change:");
+      for (const gap of change.resolved) console.log(`  \u2705 ${gap.title}${gap.subjects?.length ? ` for ${gap.subjects.join(", ")}` : ""}  (${gap.id})`);
+    }
+    if (change.unchanged.length) console.log(`Already there before: ${change.unchanged.length}`);
+    const newCritical = change.introduced.filter((g2) => g2.severity === "critical").length;
+    console.log("");
+    console.log(
+      newCritical > 0 ? `Verdict: \u274C ${newCritical} new blocker${newCritical === 1 ? "" : "s"} in this change \xB7 score ${artifact.score}` : `Verdict: \u2705 no new blockers in this change \xB7 score ${artifact.score}`
+    );
+    console.log(`Fix: viberaven fix \xB7 Details: ${paths.tasklistPath}`);
+    console.log("");
+    return failing ? 1 : 0;
+  }
   if (sorted.length === 0) {
     console.log("\u2705 No launch blockers found in repo evidence.");
   } else {
     for (const gap of sorted) {
       console.log(`${SEVERITY_ICON[gap.severity]} ${gap.title}  (${gap.id})`);
       if (!options.quiet && gap.detail) {
-        const firstLine2 = gap.detail.split("\n")[0];
-        console.log(`   ${firstLine2}`);
+        const firstLine3 = gap.detail.split("\n")[0];
+        console.log(`   ${firstLine3}`);
       }
     }
   }
@@ -17963,6 +18337,8 @@ var init_check = __esm({
     init_runScan();
     init_artifacts2();
     init_statusLabels();
+    init_version();
+    init_checkChange();
     SEVERITY_ICON = {
       critical: "\u{1F534}",
       // red circle
@@ -18006,12 +18382,12 @@ function parsePermissionsMatrix(text) {
   } else {
     const seen = /* @__PURE__ */ new Set();
     for (const [key, value] of Object.entries(raw.tables)) {
-      const table = parseTable(key, value, problems);
-      if (!table) continue;
-      const full = `${table.schema}.${table.name}`;
+      const table2 = parseTable(key, value, problems);
+      if (!table2) continue;
+      const full = `${table2.schema}.${table2.name}`;
       if (seen.has(full)) problems.push(`tables[${show(key)}]: ${full} is listed twice`);
       seen.add(full);
-      tables.push(table);
+      tables.push(table2);
     }
   }
   if (problems.length > 0) throw new MatrixError(problems);
@@ -18085,10 +18461,10 @@ function parseTable(key, value, problems) {
       }
       const parsed = {};
       for (const action of MATRIX_ACTIONS) {
-        const cell = cells[action];
-        if (cell === void 0) problems.push(`${actorAt}.${action}: missing; write ${quoteList(CELL_VALUES)}`);
-        else if (!CELL_VALUES.includes(cell)) problems.push(`${actorAt}.${action}: must be ${quoteList(CELL_VALUES)} (got ${show(cell)})`);
-        else parsed[action] = cell;
+        const cell2 = cells[action];
+        if (cell2 === void 0) problems.push(`${actorAt}.${action}: missing; write ${quoteList(CELL_VALUES)}`);
+        else if (!CELL_VALUES.includes(cell2)) problems.push(`${actorAt}.${action}: must be ${quoteList(CELL_VALUES)} (got ${show(cell2)})`);
+        else parsed[action] = cell2;
       }
       if (cells.reassign !== void 0) {
         if (!CELL_VALUES.includes(cells.reassign)) problems.push(`${actorAt}.reassign: must be ${quoteList(CELL_VALUES)} (got ${show(cells.reassign)})`);
@@ -18308,13 +18684,13 @@ async function createWorkerDatabase(options) {
   const call = (message, timeoutMs) => {
     if (dead) return Promise.reject(dead);
     const id = ++nextId;
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const timer = setTimeout(() => {
         const error = new RlsTimeoutError(`timed out after ${Math.round(timeoutMs / 1e3)} s`);
         failAll(error);
         void worker.terminate();
       }, timeoutMs);
-      pending.set(id, { resolve: resolve9, reject, timer });
+      pending.set(id, { resolve: resolve10, reject, timer });
       worker.postMessage({ ...message, id });
     });
   };
@@ -18399,22 +18775,22 @@ parentPort.on('message', async (m) => {
 // src/rls/rlsRunner.ts
 function sqlError(error) {
   const e2 = error;
-  return { code: typeof e2?.code === "string" ? e2.code : "unknown", message: firstLine(typeof e2?.message === "string" ? e2.message : String(error)) };
+  return { code: typeof e2?.code === "string" ? e2.code : "unknown", message: firstLine2(typeof e2?.message === "string" ? e2.message : String(error)) };
 }
 function isSqlError(error) {
   return !(error instanceof RlsTimeoutError) && typeof error?.code === "string";
 }
 function displayPath(projectDir, path) {
   for (const base of [projectDir, process.cwd()]) {
-    const rel = (0, import_node_path34.relative)(base, path);
-    if (rel && !rel.startsWith("..") && !(0, import_node_path34.isAbsolute)(rel)) return rel.split("\\").join("/");
+    const rel = (0, import_node_path36.relative)(base, path);
+    if (rel && !rel.startsWith("..") && !(0, import_node_path36.isAbsolute)(rel)) return rel.split("\\").join("/");
   }
   return path;
 }
 async function gitCommit(projectDir, paths) {
   const run = async (args) => {
     const call = await safeGitInvocation(projectDir, args);
-    const { stdout } = await (0, import_node_util4.promisify)(import_node_child_process6.execFile)("git", call.args, { cwd: projectDir, env: call.env, windowsHide: true, timeout: 5e3, encoding: "utf8" });
+    const { stdout } = await (0, import_node_util6.promisify)(import_node_child_process8.execFile)("git", call.args, { cwd: projectDir, env: call.env, windowsHide: true, timeout: 5e3, encoding: "utf8" });
     return String(stdout);
   };
   let sha;
@@ -18487,11 +18863,11 @@ function valueCandidates(column, label) {
   if (column.category === "A") return u2 ? [] : ["{}"];
   return [];
 }
-async function describeTable(db, table) {
-  const display = `${table.schema}.${table.name}`;
+async function describeTable(db, table2) {
+  const display = `${table2.schema}.${table2.name}`;
   const rel = await db.query(
     `select c.oid::int as oid, c.relkind::text as kind from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = $1 and c.relname = $2`,
-    [table.schema, table.name]
+    [table2.schema, table2.name]
   );
   if (rel.rows.length === 0) return { reason: `${display} does not exist after the migrations; check the table name in the matrix.` };
   const kind = String(rel.rows[0].kind);
@@ -18530,35 +18906,35 @@ async function describeTable(db, table) {
     };
   });
   const byName = new Map(columns.map((c) => [c.name, c]));
-  const owner = byName.get(table.ownerColumn);
-  if (!owner) return { reason: `${display} has no column ${table.ownerColumn} (the matrix owner column).` };
+  const owner = byName.get(table2.ownerColumn);
+  if (!owner) return { reason: `${display} has no column ${table2.ownerColumn} (the matrix owner column).` };
   if (owner.typname !== "uuid" && owner.category !== "S") {
-    return { reason: `${display}.${table.ownerColumn} is ${owner.type}; the owner column must hold auth.uid() (uuid or text).` };
+    return { reason: `${display}.${table2.ownerColumn} is ${owner.type}; the owner column must hold auth.uid() (uuid or text).` };
   }
   const pk = columns.filter((c) => c.isPk);
   if (pk.length === 0) return { reason: `${display} has no primary key; rls-test targets the owner's row by primary key.` };
-  for (const column of Object.keys(table.seed)) {
+  for (const column of Object.keys(table2.seed)) {
     if (!byName.has(column)) return { reason: `the matrix seeds ${display}.${column}, which does not exist.` };
   }
-  if (table.updateColumn) {
-    const column = byName.get(table.updateColumn);
-    if (!column) return { reason: `the matrix updateColumn ${display}.${table.updateColumn} does not exist.` };
+  if (table2.updateColumn) {
+    const column = byName.get(table2.updateColumn);
+    if (!column) return { reason: `the matrix updateColumn ${display}.${table2.updateColumn} does not exist.` };
     if (valueCandidates(column, "u").length === 0) return { reason: `the test cannot invent a new value for ${display}.${column.name} (${column.type}); pick another updateColumn.` };
   }
   const writable = (c) => c.identity === "" && c.generated === "";
-  const required = columns.filter((c) => c.name !== owner.name && c.notNull && !c.hasDefault && writable(c) && !(c.name in table.seed));
+  const required = columns.filter((c) => c.name !== owner.name && c.notNull && !c.hasDefault && writable(c) && !(c.name in table2.seed));
   for (const column of required) {
     if (column.isFk) return { reason: `${display}.${column.name} is a NOT NULL foreign key the test cannot invent; give it a value under "seed" in the matrix.` };
     if (valueCandidates(column, "a").length === 0) {
       return { reason: `${display}.${column.name} (${column.type}) is NOT NULL and the test cannot invent a value; give it one under "seed" in the matrix.` };
     }
   }
-  const seedColumns = Object.keys(table.seed);
+  const seedColumns = Object.keys(table2.seed);
   return {
     shape: {
-      table,
+      table: table2,
       oid,
-      qualified: `${quoteIdent2(table.schema)}.${quoteIdent2(table.name)}`,
+      qualified: `${quoteIdent2(table2.schema)}.${quoteIdent2(table2.name)}`,
       display,
       columns,
       pk,
@@ -18566,7 +18942,7 @@ async function describeTable(db, table) {
       ownerUnique: unique3.has(owner.name),
       ownerInPk: pk.some((c) => c.name === owner.name),
       insertColumns: [owner.name, ...seedColumns, ...required.map((c) => c.name)],
-      rowValues: (label, ownerId) => [ownerId, ...seedColumns.map((c) => table.seed[c]), ...required.map((c) => valueCandidates(c, label)[0])]
+      rowValues: (label, ownerId) => [ownerId, ...seedColumns.map((c) => table2.seed[c]), ...required.map((c) => valueCandidates(c, label)[0])]
     }
   };
 }
@@ -18662,10 +19038,10 @@ function writeControl(filtered, changed) {
     if (!changed(run)) {
       return {
         ok: false,
-        detail: filtered ? `as the superuser the same statement changed ${plural2(run.affected ?? 0, "row")}, expected 1` : "as the superuser the same statement did not change the owner row"
+        detail: filtered ? `as the superuser the same statement changed ${plural3(run.affected ?? 0, "row")}, expected 1` : "as the superuser the same statement did not change the owner row"
       };
     }
-    return { ok: true, detail: `as the superuser the same statement changed ${plural2(filtered ? run.affected ?? 0 : 1, "row")}` };
+    return { ok: true, detail: `as the superuser the same statement changed ${plural3(filtered ? run.affected ?? 0 : 1, "row")}` };
   };
 }
 async function differingValue(db, shape, target, column) {
@@ -18692,7 +19068,7 @@ async function selectPlans(c) {
     return [
       {
         stmt: { name: "select", sql: `select ${pkList} from ${shape.qualified} where ${pkCondition(shape, 1)}`, params: target, display: `select the owner's row from ${shape.display} by primary key`, filtered: true, select: "pk" },
-        controlOk: (run) => run.error ? { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` } : run.rows?.length === 1 ? { ok: true, detail: "as the superuser the same statement returned 1 row" } : { ok: false, detail: `as the superuser the same statement returned ${plural2(run.rows?.length ?? 0, "row")}, expected 1` },
+        controlOk: (run) => run.error ? { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` } : run.rows?.length === 1 ? { ok: true, detail: "as the superuser the same statement returned 1 row" } : { ok: false, detail: `as the superuser the same statement returned ${plural3(run.rows?.length ?? 0, "row")}, expected 1` },
         judge: (run) => {
           const denied = privilegeDenied(run);
           if (denied) return denied;
@@ -18747,7 +19123,7 @@ function insertPlans(c) {
       prep,
       controlOk: (run) => {
         if (run.error) return { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` };
-        return added(run) ? { ok: true, detail: "as the superuser the same statement changed 1 row" } : { ok: false, detail: `as the superuser the same statement changed ${plural2(run.affected ?? 0, "row")}, expected 1` };
+        return added(run) ? { ok: true, detail: "as the superuser the same statement changed 1 row" } : { ok: false, detail: `as the superuser the same statement changed ${plural3(run.affected ?? 0, "row")}, expected 1` };
       },
       judge: (run) => {
         if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message} (42501). Only the generated row was tried; other values may allow insertion` };
@@ -18759,7 +19135,7 @@ function insertPlans(c) {
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows added, table unchanged" };
         return {
           verdict: "unknown",
-          detail: `reported ${plural2(run.affected ?? 0, "row")}, but the table went from ${run.before.count} to ${run.after.count} rows and the owner's rows from ${run.before.owned} to ${run.after.owned}`
+          detail: `reported ${plural3(run.affected ?? 0, "row")}, but the table went from ${run.before.count} to ${run.after.count} rows and the owner's rows from ${run.before.owned} to ${run.after.owned}`
         };
       }
     }
@@ -18807,7 +19183,7 @@ async function updatePlans(c) {
         if (changed(run)) return { verdict: "allowed", detail: noop ? "1 row updated (rewrote its own value)" : `${changedRows(filtered ? run.affected : 1)} (${sets.map((s) => s.column).join(" and ")} rewritten)` };
         if (!filtered) return { verdict: "denied", detail: "the owner row is unchanged" };
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
-        return { verdict: "unknown", detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
+        return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
       }
     });
   };
@@ -18859,7 +19235,7 @@ function reassignPlans(c) {
         if (moved(run)) return { verdict: "allowed", detail: `the owner row now belongs to the other user` };
         if (!filtered && run.after.target === run.before.target) return { verdict: "denied", detail: "the owner row is unchanged" };
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
-        return { verdict: "unknown", detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner column did not move` };
+        return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner column did not move` };
       }
     }
   ];
@@ -18888,7 +19264,7 @@ function deletePlans(c) {
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
         return {
           verdict: "unknown",
-          detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
+          detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
         };
       }
     }
@@ -18959,25 +19335,25 @@ async function runCell(ctx, privilegesByRole, actor, action, expected) {
   const reason = pass ? `Expected ${expected}, observed ${allowed ? "allowed" : "denied"}.` : want ? `Expected ${actorText} to be allowed to ${action}, but ${observed.summary}.${action !== "select" && !r.error ? " Postgres reports rows no policy allows as 0 rows, not as an error, so the app sees no failure." : ""}` : `Expected ${actorText} to be denied ${action}, but ${observed.summary}.`;
   return { ...base, outcome: pass ? "Pass" : "Fail", observed, reason };
 }
-function cellsFor(table) {
+function cellsFor(table2) {
   const out = [];
   for (const actor of TESTED_ACTORS) {
-    for (const action of MATRIX_ACTIONS) out.push({ actor, action, expected: table.expect[actor][action] });
-    const reassign = table.expect[actor].reassign;
+    for (const action of MATRIX_ACTIONS) out.push({ actor, action, expected: table2.expect[actor][action] });
+    const reassign = table2.expect[actor].reassign;
     if (reassign) out.push({ actor, action: "reassign", expected: reassign });
   }
   return out;
 }
-function unknownCells(table, reason, summary) {
-  const display = `${table.schema}.${table.name}`;
-  const cells = cellsFor(table).map(
+function unknownCells(table2, reason, summary) {
+  const display = `${table2.schema}.${table2.name}`;
+  const cells = cellsFor(table2).map(
     ({ actor, action, expected }) => expected === "skip" ? { table: display, actor, action, expected, outcome: "N/A", observed: { summary: "not tested (skip in the matrix)" }, reason: "The matrix marks this cell skip." } : { table: display, actor, action, expected, outcome: "Unknown", observed: { summary }, reason }
   );
-  return [...cells, ...serviceRoleCells(table)];
+  return [...cells, ...serviceRoleCells(table2)];
 }
-function serviceRoleCells(table) {
-  if (!table.serviceRoleExcluded) return [];
-  const display = `${table.schema}.${table.name}`;
+function serviceRoleCells(table2) {
+  if (!table2.serviceRoleExcluded) return [];
+  const display = `${table2.schema}.${table2.name}`;
   return MATRIX_ACTIONS.map((action) => ({
     table: display,
     actor: "service_role",
@@ -18997,40 +19373,40 @@ function summarise(tables) {
 function verdictFor(summary) {
   if (summary.fail > 0) {
     return {
-      verdict: `Not ready within tested scope: ${plural2(summary.fail, "cell does", "cells do")} not match the matrix; ${plural2(summary.unknown, "unknown")}.`,
+      verdict: `Not ready within tested scope: ${plural3(summary.fail, "cell does", "cells do")} not match the matrix; ${plural3(summary.unknown, "unknown")}.`,
       exitCode: 1
     };
   }
   if (summary.pass === 0) {
-    return { verdict: `Nothing was observed: ${plural2(summary.unknown, "unknown")}, ${summary.notApplicable} N/A.`, exitCode: 2 };
+    return { verdict: `Nothing was observed: ${plural3(summary.unknown, "unknown")}, ${summary.notApplicable} N/A.`, exitCode: 2 };
   }
   if (summary.unknown > 0) {
-    return { verdict: `No blockers found within tested scope; ${plural2(summary.unknown, "unknown")}.`, exitCode: 2 };
+    return { verdict: `No blockers found within tested scope; ${plural3(summary.unknown, "unknown")}.`, exitCode: 2 };
   }
   return { verdict: "No blockers found within tested scope; 0 unknowns. Scenario passed locally.", exitCode: 0 };
 }
 async function listMigrations(dir) {
   try {
-    const entries = await (0, import_promises27.readdir)(dir, { withFileTypes: true });
+    const entries = await (0, import_promises29.readdir)(dir, { withFileTypes: true });
     return entries.filter((e2) => e2.isFile() && /\.sql$/i.test(e2.name) && !e2.name.startsWith(".")).map((e2) => e2.name).sort((a, b3) => a < b3 ? -1 : a > b3 ? 1 : 0);
   } catch {
     return [];
   }
 }
 async function runRlsTest(options) {
-  const projectDir = (0, import_node_path34.resolve)(options.projectDir);
-  const matrixPath = (0, import_node_path34.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
-  const migrationsDir = (0, import_node_path34.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path34.join)("supabase", "migrations"));
+  const projectDir = (0, import_node_path36.resolve)(options.projectDir);
+  const matrixPath = (0, import_node_path36.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
+  const migrationsDir = (0, import_node_path36.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path36.join)("supabase", "migrations"));
   const timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
-  if ((0, import_node_path34.basename)(matrixPath).toLowerCase().startsWith(".env")) {
-    throw new RlsInputError(`Refusing to read ${(0, import_node_path34.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
+  if ((0, import_node_path36.basename)(matrixPath).toLowerCase().startsWith(".env")) {
+    throw new RlsInputError(`Refusing to read ${(0, import_node_path36.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
   }
   const filesRead = [];
   let matrixText;
   try {
-    const info = await (0, import_promises27.stat)(matrixPath);
+    const info = await (0, import_promises29.stat)(matrixPath);
     if (!info.isFile()) throw new Error("not a file");
-    matrixText = normalise(await (0, import_promises27.readFile)(matrixPath, "utf8"));
+    matrixText = normalise(await (0, import_promises29.readFile)(matrixPath, "utf8"));
   } catch {
     throw new RlsInputError(
       `No permissions matrix at ${matrixPath}. Write one by hand (schema: schemas/permissions-matrix.schema.json in the @viberaven/cli package); rls-test never infers it from your policies.`
@@ -19041,8 +19417,8 @@ async function runRlsTest(options) {
   const names = await listMigrations(migrationsDir);
   const migrationFiles = [];
   for (const name of names) {
-    const sql = normalise(await (0, import_promises27.readFile)((0, import_node_path34.join)(migrationsDir, name), "utf8"));
-    filesRead.push(displayPath(projectDir, (0, import_node_path34.join)(migrationsDir, name)));
+    const sql = normalise(await (0, import_promises29.readFile)((0, import_node_path36.join)(migrationsDir, name), "utf8"));
+    filesRead.push(displayPath(projectDir, (0, import_node_path36.join)(migrationsDir, name)));
     migrationFiles.push({ name, sha256: sha256(sql), sql });
   }
   const migrationsHash = sha256(migrationFiles.map((f) => `${f.name}\0${f.sha256}`).join("\n"));
@@ -19094,7 +19470,7 @@ async function runRlsTest(options) {
       engineLoaded = true;
       db = await engine.create({ env: allowlistedEnv(process.env), statementTimeoutMs: timeouts.statementMs });
     } catch (error) {
-      result.engine.error = firstLine(error instanceof Error ? error.message : String(error));
+      result.engine.error = firstLine2(error instanceof Error ? error.message : String(error));
       if (engineLoaded) return allUnknown(`PGlite could not start: ${result.engine.error}. Nothing was tested.`, "not run: PGlite startup failed");
       const missing = error?.code === "MODULE_NOT_FOUND" || error?.code === "ERR_MODULE_NOT_FOUND";
       return missing ? allUnknown(PGLITE_INSTALL_HINT, "not run: PGlite is not installed") : allUnknown(`PGlite could not load: ${result.engine.error}. Nothing was tested.`, "not run: PGlite loading failed");
@@ -19154,13 +19530,13 @@ async function runRlsTest(options) {
         result.roleChecks.push({ role, ok, detail: row ? `superuser ${Boolean(row.su)}, BYPASSRLS ${Boolean(row.bypass)}` : "the role does not exist after the migrations" });
       }
       const badRoles = result.roleChecks.filter((c) => !c.ok);
-      for (const table of matrix.tables) {
-        result.tables.push(await runTable(db, table, badRoles, result.roleChecks));
+      for (const table2 of matrix.tables) {
+        result.tables.push(await runTable(db, table2, badRoles, result.roleChecks));
       }
       return finish();
     } catch (error) {
       if (error instanceof RlsTimeoutError || !isSqlError(error)) {
-        const message = firstLine(error instanceof Error ? error.message : String(error));
+        const message = firstLine2(error instanceof Error ? error.message : String(error));
         return allUnknown(
           error instanceof RlsTimeoutError ? `A statement did not finish within ${Math.round(timeouts.statementMs / 1e3)} s, so the PGlite worker was stopped and no cell is reported as passed.` : `The PGlite worker stopped (${message}), so no cell is reported as passed.`,
           "not run: the database stopped"
@@ -19186,13 +19562,13 @@ async function seedRow(db, shape, label, userId) {
   if (r.rows.length !== 1) throw Object.assign(new Error("the insert returned no row (a trigger or rule may drop it)"), { code: "vr000" });
   return { key: keyOf2(r.rows[0]), reused: false };
 }
-async function runTable(db, table, badRoles, roleChecks) {
-  const display = `${table.schema}.${table.name}`;
-  const unknownTable = (reason, extra = {}) => ({ name: display, ...extra, unknownReason: reason, cells: unknownCells(table, reason, "not run") });
+async function runTable(db, table2, badRoles, roleChecks) {
+  const display = `${table2.schema}.${table2.name}`;
+  const unknownTable = (reason, extra = {}) => ({ name: display, ...extra, unknownReason: reason, cells: unknownCells(table2, reason, "not run") });
   if (badRoles.length > 0) {
     return unknownTable(`Role check failed (${badRoles.map((c) => `${c.role}: ${c.detail}`).join("; ")}), so RLS would not apply to the probes the way it does for the Data API.`);
   }
-  const described = await describeTable(db, table);
+  const described = await describeTable(db, table2);
   if (!described.shape) return unknownTable(described.reason ?? "unknown table problem");
   const shape = described.shape;
   const rel = await db.query(
@@ -19226,15 +19602,15 @@ async function runTable(db, table, badRoles, roleChecks) {
   const privilegesByRole = /* @__PURE__ */ new Map();
   for (const role of ["anon", "authenticated"]) privilegesByRole.set(role, await privilegesFor(db, shape, role));
   const cells = [];
-  for (const { actor, action, expected } of cellsFor(table)) {
+  for (const { actor, action, expected } of cellsFor(table2)) {
     cells.push(await runCell({ db, shape, target: ownerSeed.key }, privilegesByRole, actor, action, expected));
   }
-  cells.push(...serviceRoleCells(table));
+  cells.push(...serviceRoleCells(table2));
   const columns = {};
   shape.insertColumns.forEach((c) => {
     columns[c] = c === shape.owner.name ? "the test user id" : "generated test value";
   });
-  for (const c of Object.keys(table.seed)) columns[c] = "from the matrix seed";
+  for (const c of Object.keys(table2.seed)) columns[c] = "from the matrix seed";
   return {
     name: display,
     rls,
@@ -19242,16 +19618,16 @@ async function runTable(db, table, badRoles, roleChecks) {
     cells
   };
 }
-var import_node_child_process6, import_node_crypto3, import_promises27, import_node_net, import_node_path34, import_node_util4, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine, plural2, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
+var import_node_child_process8, import_node_crypto3, import_promises29, import_node_net, import_node_path36, import_node_util6, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine2, plural3, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
 var init_rlsRunner = __esm({
   "src/rls/rlsRunner.ts"() {
     "use strict";
-    import_node_child_process6 = require("node:child_process");
+    import_node_child_process8 = require("node:child_process");
     import_node_crypto3 = require("node:crypto");
-    import_promises27 = require("node:fs/promises");
+    import_promises29 = require("node:fs/promises");
     import_node_net = __toESM(require("node:net"));
-    import_node_path34 = require("node:path");
-    import_node_util4 = require("node:util");
+    import_node_path36 = require("node:path");
+    import_node_util6 = require("node:util");
     init_safeGit();
     init_permissionsMatrix();
     init_supabaseImitation();
@@ -19267,15 +19643,15 @@ var init_rlsRunner = __esm({
     };
     normalise = (text) => text.replace(/\r\n/g, "\n");
     quoteIdent2 = (name) => `"${name.replace(/"/g, '""')}"`;
-    firstLine = (message) => message.split("\n")[0].trim();
-    plural2 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+    firstLine2 = (message) => message.split("\n")[0].trim();
+    plural3 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
     NUMBERS = { a: ["1001"], b: ["1002"], i: ["1003"], u: ["1004", "7", "1"] };
     ACTOR_SESSION = {
       owner: { role: "authenticated", uid: OWNER_ID, claims: { sub: OWNER_ID, role: "authenticated", aud: "authenticated", email: "owner@example.test" } },
       other_user: { role: "authenticated", uid: OTHER_USER_ID, claims: { sub: OTHER_USER_ID, role: "authenticated", aud: "authenticated", email: "other-user@example.test" } },
       anon: { role: "anon", uid: null, claims: { role: "anon" } }
     };
-    changedRows = (n) => `${plural2(n ?? 0, "row")} changed`;
+    changedRows = (n) => `${plural3(n ?? 0, "row")} changed`;
     isRlsRefusal = (run) => run.error?.code === PERMISSION_DENIED && RLS_REFUSAL.test(run.error.message);
     isPrivilegeRefusal = (run) => run.error?.code === PERMISSION_DENIED && !RLS_REFUSAL.test(run.error.message);
     SELF = Symbol("self");
@@ -19322,25 +19698,25 @@ function renderRlsText(result) {
     lines.push("");
     if (result.engine.error) lines.push(`(${result.engine.error})`);
   }
-  for (const table of result.tables) {
+  for (const table2 of result.tables) {
     lines.push("");
-    const rls = table.rls ? `RLS ${table.rls.enabled ? "on" : "off"}${table.rls.forced ? ", forced" : ""}, owner ${table.rls.owner}` : "not inspected";
-    lines.push(`${table.name}  (${rls})`);
-    if (table.seed) {
-      const reused = [table.seed.reused.owner ? "the owner" : "", table.seed.reused.otherUser ? "the other user" : ""].filter(Boolean);
+    const rls = table2.rls ? `RLS ${table2.rls.enabled ? "on" : "off"}${table2.rls.forced ? ", forced" : ""}, owner ${table2.rls.owner}` : "not inspected";
+    lines.push(`${table2.name}  (${rls})`);
+    if (table2.seed) {
+      const reused = [table2.seed.reused.owner ? "the owner" : "", table2.seed.reused.otherUser ? "the other user" : ""].filter(Boolean);
       lines.push(
-        `  One row for the owner and one for another user (${table.seed.rowsBefore} rows in the table)${reused.length > 0 ? `; reused the rows the migrations created for ${reused.join(" and ")}` : ""}.`
+        `  One row for the owner and one for another user (${table2.seed.rowsBefore} rows in the table)${reused.length > 0 ? `; reused the rows the migrations created for ${reused.join(" and ")}` : ""}.`
       );
     }
-    if (table.unknownReason) lines.push(`  Unknown: ${table.unknownReason}`);
-    const tested = table.cells.filter((c) => c.actor !== "service_role");
+    if (table2.unknownReason) lines.push(`  Unknown: ${table2.unknownReason}`);
+    const tested = table2.cells.filter((c) => c.actor !== "service_role");
     const actorWidth = 14;
     const actionWidth = 10;
     lines.push(`  ${"actor".padEnd(actorWidth)}${"action".padEnd(actionWidth)}${"expected".padEnd(10)}${"result".padEnd(9)}observed`);
-    for (const cell of tested) {
-      lines.push(`  ${cell.actor.padEnd(actorWidth)}${cell.action.padEnd(actionWidth)}${cell.expected.padEnd(10)}${cell.outcome.padEnd(9)}${cell.observed.summary}`);
+    for (const cell2 of tested) {
+      lines.push(`  ${cell2.actor.padEnd(actorWidth)}${cell2.action.padEnd(actionWidth)}${cell2.expected.padEnd(10)}${cell2.outcome.padEnd(9)}${cell2.observed.summary}`);
     }
-    const service = table.cells.filter((c) => c.actor === "service_role");
+    const service = table2.cells.filter((c) => c.actor === "service_role");
     if (service.length > 0) lines.push(`  ${"service_role".padEnd(actorWidth)}${"all".padEnd(actionWidth)}${"excluded".padEnd(10)}${"N/A".padEnd(9)}bypasses RLS by design, not tested`);
   }
   const s = result.summary;
@@ -19348,8 +19724,8 @@ function renderRlsText(result) {
   lines.push(`Result: ${s.pass} Pass, ${s.fail} Fail, ${s.unknown} Unknown, ${s.notApplicable} N/A \xB7 ${s.pass + s.fail} of ${s.tested} tested cells observed (${s.total} cells in the matrix)`);
   lines.push(result.verdict);
   const failed = result.tables.flatMap((t) => t.cells).filter((c) => c.outcome === "Fail");
-  for (const cell of failed) {
-    lines.push(`  Fail  ${cell.actor} ${cell.action} on ${cell.table}: ${cell.reason}`);
+  for (const cell2 of failed) {
+    lines.push(`  Fail  ${cell2.actor} ${cell2.action} on ${cell2.table}: ${cell2.reason}`);
   }
   const unknown = result.tables.flatMap((t) => t.cells).filter((c) => c.outcome === "Unknown");
   const unknownReasons = [...new Set(unknown.map((c) => c.reason))];
@@ -20078,7 +20454,7 @@ function buildMissionCards(artifact, providers) {
   };
 }
 function projectNameFromPath(pathValue) {
-  return (0, import_node_path35.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
+  return (0, import_node_path37.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
 }
 function gapSearchText(gap) {
   return [
@@ -20489,19 +20865,19 @@ function mapArtifactToLocalUiState(artifact, presentProviderIds) {
     selectedProviderId: selectedProvider.id,
     currentPrompt: selectedProvider.nextFix?.prompt ?? "",
     artifacts: {
-      tasklist: (0, import_node_path35.join)(".viberaven", "agent-tasklist.md"),
-      contextMap: (0, import_node_path35.join)(".viberaven", "context-map.json"),
-      gateResult: (0, import_node_path35.join)(".viberaven", "gate-result.json"),
-      lastScan: (0, import_node_path35.join)(".viberaven", "last-scan.json")
+      tasklist: (0, import_node_path37.join)(".viberaven", "agent-tasklist.md"),
+      contextMap: (0, import_node_path37.join)(".viberaven", "context-map.json"),
+      gateResult: (0, import_node_path37.join)(".viberaven", "gate-result.json"),
+      lastScan: (0, import_node_path37.join)(".viberaven", "last-scan.json")
     },
     empty: false
   };
 }
-var import_node_path35, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
+var import_node_path37, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
 var init_artifactAdapter = __esm({
   "src/local-ui/artifactAdapter.ts"() {
     "use strict";
-    import_node_path35 = require("node:path");
+    import_node_path37 = require("node:path");
     init_providerLogos();
     init_buildTaskList();
     init_prompts();
@@ -20804,18 +21180,18 @@ var init_planLimits = __esm({
 // src/hosted/credentials.ts
 function defaultConfigDir(env = process.env, platform = process.platform) {
   const override = env.VIBERAVEN_CONFIG_DIR?.trim();
-  if (override) return (0, import_node_path36.resolve)(override);
+  if (override) return (0, import_node_path38.resolve)(override);
   if (platform === "win32") {
-    return (0, import_node_path36.join)(env.APPDATA?.trim() || (0, import_node_path36.join)((0, import_node_os.homedir)(), "AppData", "Roaming"), "viberaven");
+    return (0, import_node_path38.join)(env.APPDATA?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), "AppData", "Roaming"), "viberaven");
   }
   if (platform === "darwin") {
-    return (0, import_node_path36.join)((0, import_node_os.homedir)(), "Library", "Application Support", "viberaven");
+    return (0, import_node_path38.join)((0, import_node_os2.homedir)(), "Library", "Application Support", "viberaven");
   }
-  return (0, import_node_path36.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path36.join)((0, import_node_os.homedir)(), ".config"), "viberaven");
+  return (0, import_node_path38.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), ".config"), "viberaven");
 }
 function isInside(child, parent) {
-  const rel = (0, import_node_path36.relative)((0, import_node_path36.resolve)(parent), (0, import_node_path36.resolve)(child));
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path36.isAbsolute)(rel);
+  const rel = (0, import_node_path38.relative)((0, import_node_path38.resolve)(parent), (0, import_node_path38.resolve)(child));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path38.isAbsolute)(rel);
 }
 async function retryTransient(work) {
   for (let attempt = 1; ; attempt += 1) {
@@ -20828,15 +21204,15 @@ async function retryTransient(work) {
     }
   }
 }
-var import_node_child_process7, import_node_crypto4, import_promises28, import_node_os, import_node_path36, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
+var import_node_child_process9, import_node_crypto4, import_promises30, import_node_os2, import_node_path38, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
 var init_credentials = __esm({
   "src/hosted/credentials.ts"() {
     "use strict";
-    import_node_child_process7 = require("node:child_process");
+    import_node_child_process9 = require("node:child_process");
     import_node_crypto4 = require("node:crypto");
-    import_promises28 = require("node:fs/promises");
-    import_node_os = require("node:os");
-    import_node_path36 = require("node:path");
+    import_promises30 = require("node:fs/promises");
+    import_node_os2 = require("node:os");
+    import_node_path38 = require("node:path");
     CREDENTIALS_FILE_NAME = "credentials.json";
     CredentialLocationError = class extends Error {
     };
@@ -20847,10 +21223,10 @@ var init_credentials = __esm({
       }
     };
     restrictWithIcacls = (path) => {
-      const name = (0, import_node_os.userInfo)().username;
+      const name = (0, import_node_os2.userInfo)().username;
       const user = process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\${name}` : name;
       return new Promise((resolveRestrict, reject) => {
-        (0, import_node_child_process7.execFile)("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { windowsHide: true, timeout: 1e4 }, (error) => {
+        (0, import_node_child_process9.execFile)("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { windowsHide: true, timeout: 1e4 }, (error) => {
           if (error) reject(error);
           else resolveRestrict();
         });
@@ -20863,9 +21239,9 @@ var init_credentials = __esm({
       constructor(configDir, workspacePath, options = {}) {
         this.configDir = configDir;
         this.workspacePath = workspacePath;
-        this.path = (0, import_node_path36.join)(configDir, CREDENTIALS_FILE_NAME);
+        this.path = (0, import_node_path38.join)(configDir, CREDENTIALS_FILE_NAME);
         this.restrict = options.restrict !== void 0 ? options.restrict : process.platform === "win32" ? restrictWithIcacls : null;
-        this.fs = { readFile: (path, encoding) => (0, import_promises28.readFile)(path, encoding), rename: (from, to) => (0, import_promises28.rename)(from, to), rm: (path) => (0, import_promises28.rm)(path, { force: true }), ...options.fs };
+        this.fs = { readFile: (path, encoding) => (0, import_promises30.readFile)(path, encoding), rename: (from, to) => (0, import_promises30.rename)(from, to), rm: (path) => (0, import_promises30.rm)(path, { force: true }), ...options.fs };
       }
       path;
       restrict;
@@ -20914,15 +21290,15 @@ var init_credentials = __esm({
             `Refusing to store the VibeRaven sign-in inside this project (${this.configDir}). Set VIBERAVEN_CONFIG_DIR to a folder outside the repo.`
           );
         }
-        await (0, import_promises28.mkdir)(this.configDir, { recursive: true, mode: 448 });
+        await (0, import_promises30.mkdir)(this.configDir, { recursive: true, mode: 448 });
         const temp = `${this.path}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
-        await (0, import_promises28.writeFile)(temp, `${JSON.stringify(body, null, 2)}
+        await (0, import_promises30.writeFile)(temp, `${JSON.stringify(body, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await (0, import_promises28.chmod)(temp, 384).catch(() => void 0);
+        await (0, import_promises30.chmod)(temp, 384).catch(() => void 0);
         try {
           if (this.restrict) await this.restrict(temp);
         } catch (error) {
-          await (0, import_promises28.rm)(temp, { force: true });
+          await (0, import_promises30.rm)(temp, { force: true });
           const code = error?.code;
           const toolMissing = code === "ENOENT";
           throw new CredentialPermissionError(
@@ -20933,17 +21309,17 @@ var init_credentials = __esm({
         if (guard) {
           const onDisk = await this.readFor(guard.apiBaseUrl);
           if (onDisk?.accessToken !== guard.accessToken || guard.isCurrent && !guard.isCurrent()) {
-            await (0, import_promises28.rm)(temp, { force: true });
+            await (0, import_promises30.rm)(temp, { force: true });
             return false;
           }
         }
         try {
           await retryTransient(() => this.fs.rename(temp, this.path));
         } catch (error) {
-          await (0, import_promises28.rm)(temp, { force: true });
+          await (0, import_promises30.rm)(temp, { force: true });
           throw error;
         }
-        await (0, import_promises28.chmod)(this.path, 384).catch(() => void 0);
+        await (0, import_promises30.chmod)(this.path, 384).catch(() => void 0);
         return true;
       }
       /** Keeps the stored plan label in step with what the API last said. */
@@ -21312,7 +21688,7 @@ async function buildHostedCheckPayload(workspacePath) {
   throw new Error("Could not assemble the full check request.");
 }
 function finalizePayload(payload) {
-  const folder = (0, import_node_path37.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
+  const folder = (0, import_node_path39.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
   const redacted = redactPayload({ ...payload, workspacePath: folder });
   return { payload: redacted.payload, redactions: redacted.count };
 }
@@ -21343,13 +21719,13 @@ function splitSections(prompt) {
     chars: section.length
   }));
 }
-var import_node_path37, PayloadCaptured;
+var import_node_path39, PayloadCaptured;
 var init_payload = __esm({
   "src/hosted/payload.ts"() {
     "use strict";
     init_fileScanner();
     init_orchestrator();
-    import_node_path37 = require("node:path");
+    import_node_path39 = require("node:path");
     init_config();
     init_redact();
     PayloadCaptured = class extends Error {
@@ -21387,7 +21763,7 @@ function shapeResult(response, now = /* @__PURE__ */ new Date()) {
   const usage = toUsage(response.usage);
   const freeKeys = new Set(FREE_TRIAL_UNLOCKED_MAP_CATEGORY_KEYS);
   const unlocked = (key) => usage.plan === "pro" || freeKeys.has(key) && response.usage.unlockedMapCategoryKeys.includes(key);
-  const sorted = [...output.gaps].sort((a, b3) => SEVERITY_RANK3[a.severity] - SEVERITY_RANK3[b3.severity]);
+  const sorted = [...output.gaps].sort((a, b3) => SEVERITY_RANK4[a.severity] - SEVERITY_RANK4[b3.severity]);
   const areas = PRODUCTION_MAP_LANES.map((lane) => {
     const gaps = sorted.filter((gap) => gap.primaryMapCategory === lane.extensionKey);
     const locked = !unlocked(lane.extensionKey);
@@ -21425,7 +21801,7 @@ function readServerMessage(body) {
     return body.slice(0, 300);
   }
 }
-var import_node_crypto5, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK3, FullCheckService;
+var import_node_crypto5, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK4, FullCheckService;
 var init_fullCheck = __esm({
   "src/hosted/fullCheck.ts"() {
     "use strict";
@@ -21444,7 +21820,7 @@ var init_fullCheck = __esm({
     STATUS_CACHE_MS = 5e3;
     MAX_PREVIEWS = 5;
     TRANSIENT_REASONS = /* @__PURE__ */ new Set(["network", "timeout", "server", "rate_limited", "busy"]);
-    SEVERITY_RANK3 = { critical: 0, warning: 1, info: 2 };
+    SEVERITY_RANK4 = { critical: 0, warning: 1, info: 2 };
     FullCheckService = class {
       constructor(workspacePath, options = {}) {
         this.workspacePath = workspacePath;
@@ -21815,10 +22191,10 @@ async function connectProviderMcp(cwd, providerId) {
   if (!recipe) {
     return { ok: false, message: `No known MCP server for ${providerId} yet. Add one manually to .mcp.json.` };
   }
-  const configPath = (0, import_node_path38.join)(cwd, ".mcp.json");
+  const configPath = (0, import_node_path40.join)(cwd, ".mcp.json");
   let config = {};
   try {
-    const raw = await (0, import_promises29.readFile)(configPath, "utf8");
+    const raw = await (0, import_promises31.readFile)(configPath, "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     if (!isRecord5(parsed) || parsed.mcpServers !== void 0 && !isRecord5(parsed.mcpServers)) {
       return { ok: false, message: "Existing .mcp.json has an unsupported structure. It was left unchanged." };
@@ -21835,7 +22211,7 @@ async function connectProviderMcp(cwd, providerId) {
   }
   servers[providerId] = recipe.entry;
   const next = { ...config, mcpServers: servers };
-  await (0, import_promises29.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises31.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const suffix = recipe.note ? ` ${recipe.note}` : "";
   return { ok: true, message: `Added ${providerId} MCP server to .mcp.json.${suffix}`, path: ".mcp.json" };
@@ -21888,7 +22264,7 @@ async function defaultScanRunner(flags, positional) {
 }
 async function readPackageJson(cwd) {
   try {
-    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, "package.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, "package.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -21911,7 +22287,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
     if (files.length >= maxFiles) return;
     let entries;
     try {
-      entries = await (0, import_promises29.readdir)(dir, { withFileTypes: true });
+      entries = await (0, import_promises31.readdir)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -21919,7 +22295,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
       if (files.length >= maxFiles) return;
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        if (!skipped.has(entry.name)) await walk((0, import_node_path38.join)(dir, entry.name), rel);
+        if (!skipped.has(entry.name)) await walk((0, import_node_path40.join)(dir, entry.name), rel);
         continue;
       }
       if (entry.isFile()) files.push(rel.toLowerCase());
@@ -21938,7 +22314,7 @@ async function readEnvKeys(cwd) {
   const keys = /* @__PURE__ */ new Set();
   for (const name of [".env.example", ".env"]) {
     try {
-      const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, name), "utf8");
+      const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, name), "utf8");
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -22032,7 +22408,7 @@ function applyProviderDetection(state, deps, files) {
 }
 function runGit(cwd, args, timeoutMs = 1500) {
   return safeGitInvocation(cwd, args).then(
-    (git) => spawnGit(cwd, git.args, git.env, timeoutMs),
+    (git2) => spawnGit(cwd, git2.args, git2.env, timeoutMs),
     (error) => {
       if (error instanceof SafeGitRefusal) throw error;
       return "";
@@ -22041,7 +22417,7 @@ function runGit(cwd, args, timeoutMs = 1500) {
 }
 function spawnGit(cwd, args, env, timeoutMs) {
   return new Promise((resolveGit) => {
-    const child = (0, import_node_child_process8.spawn)("git", args, {
+    const child = (0, import_node_child_process10.spawn)("git", args, {
       cwd,
       env,
       windowsHide: true,
@@ -22104,7 +22480,7 @@ function parseGitShortstat(raw) {
 }
 function runGitCommand(cwd, args, timeoutMs = 5e3) {
   return safeGitInvocation(cwd, args).then(
-    (git) => spawnGitCommand(cwd, git.args, git.env, timeoutMs),
+    (git2) => spawnGitCommand(cwd, git2.args, git2.env, timeoutMs),
     (error) => ({
       code: 1,
       stdout: "",
@@ -22114,7 +22490,7 @@ function runGitCommand(cwd, args, timeoutMs = 5e3) {
 }
 function spawnGitCommand(cwd, args, env, timeoutMs) {
   return new Promise((resolveCommand) => {
-    const child = (0, import_node_child_process8.spawn)("git", args, {
+    const child = (0, import_node_child_process10.spawn)("git", args, {
       cwd,
       env,
       windowsHide: true,
@@ -22256,7 +22632,7 @@ async function codexModelOptions() {
     { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" }
   ];
   try {
-    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)((0, import_node_os2.homedir)(), ".codex", "models_cache.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)((0, import_node_os3.homedir)(), ".codex", "models_cache.json"), "utf8");
     const parsed = JSON.parse(raw);
     const list = Array.isArray(parsed) ? parsed : parsed.models ?? [];
     const options = list.filter((model) => typeof model?.slug === "string").filter((model) => !/auto-review|reserve/i.test(model.slug)).map((model) => ({ id: model.slug, label: model.display_name?.trim() || model.slug }));
@@ -22280,7 +22656,7 @@ function cliModelDefaults(id) {
 }
 function detectCommand(command, cwd) {
   return new Promise((resolveDetect) => {
-    const child = (0, import_node_child_process8.spawn)(process.platform === "win32" ? "where.exe" : "sh", process.platform === "win32" ? [command] : ["-lc", `command -v ${command}`], {
+    const child = (0, import_node_child_process10.spawn)(process.platform === "win32" ? "where.exe" : "sh", process.platform === "win32" ? [command] : ["-lc", `command -v ${command}`], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
@@ -22307,7 +22683,7 @@ function commandMissingFromOutput(text) {
   return /not recognized|not found|unknown command|no such file|command not found|is not recognized as an internal or external command/.test(text.toLowerCase());
 }
 function redactProbeOutput(output) {
-  const home = (0, import_node_os2.homedir)();
+  const home = (0, import_node_os3.homedir)();
   const homeVariants = [home, home.split("\\").join("\\\\"), home.split("\\").join("/")].filter((value) => value.length > 3);
   let scrubbed = output;
   for (const variant of homeVariants) scrubbed = scrubbed.split(variant).join("~");
@@ -22367,7 +22743,7 @@ function setupCommandFor(cliId, step) {
 function runShellCommand(command, cwd, timeoutMs = 18e4) {
   return new Promise((resolveRun) => {
     const useCmd = process.platform === "win32";
-    const child = (0, import_node_child_process8.spawn)(useCmd ? process.env.ComSpec || "cmd.exe" : "sh", useCmd ? ["/d", "/s", "/c", command] : ["-lc", command], {
+    const child = (0, import_node_child_process10.spawn)(useCmd ? process.env.ComSpec || "cmd.exe" : "sh", useCmd ? ["/d", "/s", "/c", command] : ["-lc", command], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
@@ -22401,7 +22777,7 @@ function openSystemTerminal(command, cwd) {
     const fullCommand = process.platform === "win32" ? `cd /d ${quotedCwd} && ${command}` : `cd ${quotedCwd} && ${command}`;
     let child;
     if (process.platform === "win32") {
-      child = (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "start", "cmd.exe", "/k", fullCommand], {
+      child = (0, import_node_child_process10.spawn)("cmd.exe", ["/c", "start", "cmd.exe", "/k", fullCommand], {
         cwd,
         windowsHide: true,
         stdio: "ignore",
@@ -22409,9 +22785,9 @@ function openSystemTerminal(command, cwd) {
       });
     } else if (process.platform === "darwin") {
       const script = `tell application "Terminal" to do script "${fullCommand.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-      child = (0, import_node_child_process8.spawn)("osascript", ["-e", script], { cwd, windowsHide: true, stdio: "ignore", detached: true });
+      child = (0, import_node_child_process10.spawn)("osascript", ["-e", script], { cwd, windowsHide: true, stdio: "ignore", detached: true });
     } else {
-      child = (0, import_node_child_process8.spawn)("x-terminal-emulator", ["-e", `bash -lc ${JSON.stringify(fullCommand)}`], {
+      child = (0, import_node_child_process10.spawn)("x-terminal-emulator", ["-e", `bash -lc ${JSON.stringify(fullCommand)}`], {
         cwd,
         windowsHide: true,
         stdio: "ignore",
@@ -22459,19 +22835,19 @@ function isPlaceholderProjectName(value) {
 async function readMcpEvidence(cwd) {
   const candidates = MCP_CONFIG_PATHS.map((relativePath) => ({
     source: relativePath.replace(/\\/g, "/"),
-    path: (0, import_node_path38.resolve)(cwd, relativePath)
+    path: (0, import_node_path40.resolve)(cwd, relativePath)
   }));
   const home = process.env.USERPROFILE || process.env.HOME;
   if (home) {
     candidates.push({
       source: "~/.codex/config.toml",
-      path: (0, import_node_path38.resolve)(home, ".codex", "config.toml")
+      path: (0, import_node_path40.resolve)(home, ".codex", "config.toml")
     });
   }
   const evidence = [];
   for (const candidate of candidates) {
     try {
-      const text = await (0, import_promises29.readFile)(candidate.path, "utf8");
+      const text = await (0, import_promises31.readFile)(candidate.path, "utf8");
       if (/mcp/i.test(text)) evidence.push({ source: candidate.source, text });
     } catch {
     }
@@ -22562,7 +22938,7 @@ async function enrichProjectMetadata(state, cwd) {
 async function readState(cwd) {
   let state;
   try {
-    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
     const packageJson = await readPackageJson(cwd);
     const deps = dependencyNames(packageJson);
     const files = await listProjectFiles(cwd);
@@ -22808,7 +23184,7 @@ function quoteWindowsCmdArg(value) {
 }
 async function whereExe(command, cwd) {
   return new Promise((resolvePath) => {
-    const child = (0, import_node_child_process8.spawn)("where.exe", [command], {
+    const child = (0, import_node_child_process10.spawn)("where.exe", [command], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "ignore"]
@@ -22829,7 +23205,7 @@ async function whereExe(command, cwd) {
 }
 function expandShimPath(value, base) {
   const relative8 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
-  return relative8 === value ? value : (0, import_node_path38.join)(base, ...relative8.split(/[\\/]+/));
+  return relative8 === value ? value : (0, import_node_path40.join)(base, ...relative8.split(/[\\/]+/));
 }
 function findShimTarget(lines, pattern, accept = () => true) {
   for (const line of lines) {
@@ -22840,21 +23216,21 @@ function findShimTarget(lines, pattern, accept = () => true) {
 }
 async function resolveWindowsShimTarget(shimPath) {
   try {
-    const content = await (0, import_promises29.readFile)(shimPath, "utf8");
-    const base = (0, import_node_path38.dirname)(shimPath);
+    const content = await (0, import_promises31.readFile)(shimPath, "utf8");
+    const base = (0, import_node_path40.dirname)(shimPath);
     const lines = content.split(/\r?\n/);
     const trailingArgs = (line, after) => [...line.slice(after).split("%*")[0].matchAll(/"([^"]*)"|([^\s"&|<>]+)/g)].map((token) => expandShimPath(token[1] ?? token[2], base)).filter((value) => value.length > 0 && !value.includes("%"));
     const script = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.js)"/i);
     if (script) {
       return {
         command: process.execPath,
-        args: [(0, import_node_path38.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
+        args: [(0, import_node_path40.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
       };
     }
-    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path38.basename)(target).toLowerCase() !== "node.exe");
+    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path40.basename)(target).toLowerCase() !== "node.exe");
     if (binary) {
       return {
-        command: (0, import_node_path38.join)(base, ...binary.match[1].split(/[\\/]+/)),
+        command: (0, import_node_path40.join)(base, ...binary.match[1].split(/[\\/]+/)),
         args: trailingArgs(binary.line, binary.match.index + binary.match[0].length)
       };
     }
@@ -22875,7 +23251,7 @@ function killProcessTree(pid, fallback) {
     return;
   }
   if (process.platform === "win32") {
-    const killer = (0, import_node_child_process8.spawn)("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+    const killer = (0, import_node_child_process10.spawn)("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
     killer.once("error", fallback);
     killer.once("close", (code) => {
       if (code !== 0) fallback();
@@ -22900,7 +23276,7 @@ async function runAgentCommand(command, args, cwd, stdin, runId) {
   const spawnCommand = shim?.command ?? (useCmdShim ? process.env.ComSpec || "cmd.exe" : command);
   const spawnArgs = shim ? [...shim.args, ...args] : useCmdShim ? ["/d", "/s", "/c", [command, ...args.map(quoteWindowsCmdArg)].join(" ")] : args;
   return new Promise((resolveRun) => {
-    const child = (0, import_node_child_process8.spawn)(spawnCommand, spawnArgs, {
+    const child = (0, import_node_child_process10.spawn)(spawnCommand, spawnArgs, {
       cwd,
       windowsHide: true,
       // A separate process group lets Stop and timeout terminate descendants on Unix too.
@@ -22979,8 +23355,8 @@ async function writeChatContextArtifact(cwd, request, prompt) {
       "",
       prompt
     ].filter((line) => typeof line === "string");
-    await (0, import_promises29.mkdir)((0, import_node_path38.join)(cwd, ".viberaven"), { recursive: true });
-    await (0, import_promises29.writeFile)((0, import_node_path38.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
+    await (0, import_promises31.mkdir)((0, import_node_path40.join)(cwd, ".viberaven"), { recursive: true });
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
 `, "utf8");
   } catch {
   }
@@ -23000,13 +23376,13 @@ async function runAgentChat(cwd, request) {
   }
   const prompt = await buildAgentChatPrompt(request, cwd);
   await writeChatContextArtifact(cwd, request, prompt);
-  const outputPath = request.cliId === "codex" ? (0, import_node_path38.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
-  if (outputPath) await (0, import_promises29.mkdir)((0, import_node_path38.dirname)(outputPath), { recursive: true });
+  const outputPath = request.cliId === "codex" ? (0, import_node_path40.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
+  if (outputPath) await (0, import_promises31.mkdir)((0, import_node_path40.dirname)(outputPath), { recursive: true });
   const { command, args, stdin } = commandForAgentChat(request, prompt, cwd, outputPath);
   const result = await runAgentCommand(command, args, cwd, stdin, request.runId);
   if (outputPath) {
     try {
-      const finalMessage = (await (0, import_promises29.readFile)(outputPath, "utf8")).trim();
+      const finalMessage = (await (0, import_promises31.readFile)(outputPath, "utf8")).trim();
       if (finalMessage) return { ...result, output: finalMessage };
     } catch {
     }
@@ -23018,8 +23394,8 @@ function firstGapId(state) {
   return state.providers.find((provider2) => provider2.nextFix?.id)?.nextFix?.id;
 }
 async function runLocalAction(cwd, intent) {
-  const artifactDir = (0, import_node_path38.join)(cwd, ".viberaven");
-  await (0, import_promises29.mkdir)(artifactDir, { recursive: true });
+  const artifactDir = (0, import_node_path40.join)(cwd, ".viberaven");
+  await (0, import_promises31.mkdir)(artifactDir, { recursive: true });
   if (intent === "preview_rehearsal") {
     const state2 = await readState(cwd);
     const topProvider = state2.providers[0];
@@ -23060,7 +23436,7 @@ async function runLocalAction(cwd, intent) {
       proof,
       ""
     ].join("\n");
-    await (0, import_promises29.writeFile)((0, import_node_path38.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
     return {
       title: "Preview rehearsal ready",
       summary: `${projectName}: ${gateLabel} with ${state2.providers.length} provider beat${state2.providers.length === 1 ? "" : "s"}`,
@@ -23070,7 +23446,7 @@ async function runLocalAction(cwd, intent) {
   if (intent === "audit_vercel_supabase") {
     const auditInput = await collectVercelSupabaseAuditInput(cwd);
     const result2 = buildVercelSupabaseAudit(auditInput);
-    await (0, import_promises29.writeFile)((0, import_node_path38.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
 `, "utf8");
     return {
       title: result2.status === "pass" ? "Audit passed" : "Audit needs work",
@@ -23098,7 +23474,7 @@ async function runLocalAction(cwd, intent) {
   const mode = intent === "heal_prompt" ? "prompt" : intent === "heal_apply" ? "apply" : "plan";
   const result = await runHealCommand({ cwd, mode, gapId, yes: mode === "apply", noVerify: true });
   if (mode === "apply") {
-    await (0, import_promises29.writeFile)((0, import_node_path38.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
+    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   }
   return {
@@ -23108,14 +23484,14 @@ async function runLocalAction(cwd, intent) {
   };
 }
 async function sendArtifact(cwd, rel, response, contentType = "text/plain; charset=utf-8") {
-  const absolute = (0, import_node_path38.resolve)(cwd, rel);
-  const root = (0, import_node_path38.resolve)(cwd);
+  const absolute = (0, import_node_path40.resolve)(cwd, rel);
+  const root = (0, import_node_path40.resolve)(cwd);
   if (!absolute.startsWith(root)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const text = await (0, import_promises29.readFile)(absolute, "utf8");
+    const text = await (0, import_promises31.readFile)(absolute, "utf8");
     response.writeHead(200, { "content-type": contentType });
     response.end(text);
   } catch {
@@ -23124,7 +23500,7 @@ async function sendArtifact(cwd, rel, response, contentType = "text/plain; chars
 }
 async function sendReportArtifact(cwd, response) {
   try {
-    const text = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "report.html"), "utf8");
+    const text = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "report.html"), "utf8");
     response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     response.end(text);
     return;
@@ -23251,7 +23627,7 @@ async function sendReportArtifact(cwd, response) {
 }
 async function sendExtensionIcon(cwd, response) {
   try {
-    const body = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, "media", "extension-icon.png"));
+    const body = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, "media", "extension-icon.png"));
     sendBinary(response, 200, "image/png", body);
   } catch {
     sendText(response, 404, "Icon not found");
@@ -23264,15 +23640,15 @@ async function sendMangaAsset(pathname, response) {
     return;
   }
   const candidates = [
-    (0, import_node_path38.join)(__dirname, "manga", name),
+    (0, import_node_path40.join)(__dirname, "manga", name),
     // installed + dev: <pkg>/dist/manga
-    (0, import_node_path38.join)(__dirname, "..", "assets", "manga", name),
+    (0, import_node_path40.join)(__dirname, "..", "assets", "manga", name),
     // fallback: <pkg>/assets/manga (source)
-    (0, import_node_path38.join)(__dirname, "..", "..", "assets", "manga", name)
+    (0, import_node_path40.join)(__dirname, "..", "..", "assets", "manga", name)
   ];
   for (const candidate of candidates) {
     try {
-      const body = await (0, import_promises29.readFile)(candidate);
+      const body = await (0, import_promises31.readFile)(candidate);
       response.setHeader("cache-control", "no-cache");
       sendBinary(response, 200, contentTypeForAsset(candidate), body);
       return;
@@ -23282,7 +23658,7 @@ async function sendMangaAsset(pathname, response) {
   sendText(response, 404, "Asset not found");
 }
 function contentTypeForAsset(pathname) {
-  switch ((0, import_node_path38.extname)(pathname).toLowerCase()) {
+  switch ((0, import_node_path40.extname)(pathname).toLowerCase()) {
     case ".svg":
       return "image/svg+xml; charset=utf-8";
     case ".png":
@@ -23299,14 +23675,14 @@ function contentTypeForAsset(pathname) {
 }
 async function sendBundledReportAsset(pathname, response) {
   const rel = decodeURIComponent(pathname.replace(/^\/report\//, ""));
-  const assetRoot = (0, import_node_path38.resolve)(getBundledReportAssetsDir());
-  const absolute = (0, import_node_path38.resolve)(assetRoot, rel);
+  const assetRoot = (0, import_node_path40.resolve)(getBundledReportAssetsDir());
+  const absolute = (0, import_node_path40.resolve)(assetRoot, rel);
   if (!absolute.startsWith(assetRoot)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const body = await (0, import_promises29.readFile)(absolute);
+    const body = await (0, import_promises31.readFile)(absolute);
     sendBinary(response, 200, contentTypeForAsset(absolute), body);
   } catch {
     sendText(response, 404, "Asset not found");
@@ -23328,18 +23704,18 @@ async function bundleStackClient(entryPath) {
   return output.text;
 }
 async function sendStackAppJs(response) {
-  const distPath = (0, import_node_path38.join)(__dirname, "stack", "app.js");
+  const distPath = (0, import_node_path40.join)(__dirname, "stack", "app.js");
   try {
-    const body = await (0, import_promises29.readFile)(distPath);
+    const body = await (0, import_promises31.readFile)(distPath);
     response.writeHead(200, { "content-type": "application/javascript; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
     return;
   } catch {
   }
-  const entryPath = (0, import_node_path38.join)(__dirname, "stack", "main.ts");
+  const entryPath = (0, import_node_path40.join)(__dirname, "stack", "main.ts");
   let mtimeMs;
   try {
-    mtimeMs = (await (0, import_promises29.stat)(entryPath)).mtimeMs;
+    mtimeMs = (await (0, import_promises31.stat)(entryPath)).mtimeMs;
   } catch {
     sendText(response, 404, "Stack client entry not found: src/local-ui/stack/main.ts is missing.");
     return;
@@ -23358,7 +23734,7 @@ async function sendStackAppJs(response) {
 }
 async function sendStackAppCss(response) {
   try {
-    const body = await (0, import_promises29.readFile)((0, import_node_path38.join)(__dirname, "stack", "stack.css"));
+    const body = await (0, import_promises31.readFile)((0, import_node_path40.join)(__dirname, "stack", "stack.css"));
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
   } catch {
@@ -23367,7 +23743,7 @@ async function sendStackAppCss(response) {
 }
 async function readProviderVerifyLedger(cwd) {
   try {
-    const raw = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
+    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -23377,8 +23753,8 @@ async function readProviderVerifyLedger(cwd) {
 async function writeProviderVerifyEntry(cwd, providerId, entry) {
   const ledger = await readProviderVerifyLedger(cwd);
   ledger[providerId] = entry;
-  await (0, import_promises29.mkdir)((0, import_node_path38.join)(cwd, ".viberaven"), { recursive: true });
-  await (0, import_promises29.writeFile)((0, import_node_path38.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
+  await (0, import_promises31.mkdir)((0, import_node_path40.join)(cwd, ".viberaven"), { recursive: true });
+  await (0, import_promises31.writeFile)((0, import_node_path40.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
 }
 async function handleRequest(request, response, options) {
@@ -23421,6 +23797,18 @@ async function handleRequest(request, response, options) {
     sendText(response, 404, "This VibeRaven surface has been removed. Use the Launch Canvas at /.");
     return;
   }
+  if (request.method === "GET" && url.pathname === "/api/github-workflow") {
+    sendJson(response, await githubWorkflowStatus(options.cwd));
+    return;
+  }
+  if (request.method === "POST" && url.pathname === "/api/github-workflow") {
+    try {
+      sendJson(response, await writeGithubWorkflow(options.cwd));
+    } catch (error) {
+      sendJsonStatus(response, 500, { error: `Could not write the workflow: ${error instanceof Error ? error.message : String(error)}` });
+    }
+    return;
+  }
   if (request.method === "GET" && url.pathname === "/api/project") {
     sendJson(response, await readState(options.cwd));
     return;
@@ -23439,13 +23827,13 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/architecture-map") {
-    const mapPath = (0, import_node_path38.join)(options.cwd, ".viberaven", "architecture-map.md");
-    const markdown = await (0, import_promises29.readFile)(mapPath, "utf8").catch(() => null);
+    const mapPath = (0, import_node_path40.join)(options.cwd, ".viberaven", "architecture-map.md");
+    const markdown = await (0, import_promises31.readFile)(mapPath, "utf8").catch(() => null);
     if (markdown === null) {
       sendJsonStatus(response, 404, { error: "No architecture map yet. Run a scan first (it is written on every scan)." });
       return;
     }
-    const dataRaw = await (0, import_promises29.readFile)((0, import_node_path38.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
+    const dataRaw = await (0, import_promises31.readFile)((0, import_node_path40.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
     let data = null;
     if (dataRaw) {
       try {
@@ -23454,7 +23842,7 @@ async function handleRequest(request, response, options) {
         data = null;
       }
     }
-    const contextRaw = await (0, import_promises29.readFile)((0, import_node_path38.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
+    const contextRaw = await (0, import_promises31.readFile)((0, import_node_path40.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
     let gaps = [];
     if (contextRaw) {
       try {
@@ -23720,35 +24108,35 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/tasklist") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "agent-tasklist.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "agent-tasklist.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/playbook") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "launch-playbook.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "launch-playbook.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/audit") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "audit-vercel-supabase.txt"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "audit-vercel-supabase.txt"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/cleanup") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "context-cleanup.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "context-cleanup.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/preview") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "preview-rehearsal.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "preview-rehearsal.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-plan") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "heal-plan.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-plan.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-prompt") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "heal-prompt.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-prompt.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-apply") {
-    await sendArtifact(options.cwd, (0, import_node_path38.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
+    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/report") {
@@ -23774,12 +24162,12 @@ async function handleRequest(request, response, options) {
   }
   if (request.method === "GET" && url.pathname === "/vendor/anime.umd.min.js") {
     for (const candidate of [
-      (0, import_node_path38.join)(__dirname, "vendor", "anime.umd.min.js"),
-      (0, import_node_path38.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
-      (0, import_node_path38.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
+      (0, import_node_path40.join)(__dirname, "vendor", "anime.umd.min.js"),
+      (0, import_node_path40.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
+      (0, import_node_path40.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
     ]) {
       try {
-        const body = await (0, import_promises29.readFile)(candidate);
+        const body = await (0, import_promises31.readFile)(candidate);
         response.setHeader("cache-control", "public, max-age=604800, immutable");
         sendBinary(response, 200, "text/javascript; charset=utf-8", body);
         return;
@@ -23996,7 +24384,7 @@ function listen(server, startPort) {
   });
 }
 async function startLocalUiServer(options) {
-  const cwd = (0, import_node_path38.resolve)(options.cwd);
+  const cwd = (0, import_node_path40.resolve)(options.cwd);
   const scanRunner = options.scanRunner ?? defaultScanRunner;
   const autoScan = { state: "idle" };
   const fullCheck = new FullCheckService(cwd, options.fullCheck);
@@ -24013,7 +24401,7 @@ async function startLocalUiServer(options) {
   });
   const port = await listen(server, options.port ?? 4177);
   guard.port = port;
-  const hasArtifact = await (0, import_promises29.readFile)((0, import_node_path38.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
+  const hasArtifact = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
     () => true,
     () => false
   );
@@ -24052,16 +24440,17 @@ async function waitForServerShutdown() {
     process.once("SIGTERM", done);
   });
 }
-var import_node_http, import_node_child_process8, import_node_crypto6, import_promises29, import_node_os2, import_node_path38, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
+var import_node_http, import_node_child_process10, import_node_crypto6, import_promises31, import_node_os3, import_node_path40, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
 var init_server = __esm({
   "src/local-ui/server.ts"() {
     "use strict";
     import_node_http = require("node:http");
-    import_node_child_process8 = require("node:child_process");
+    import_node_child_process10 = require("node:child_process");
     import_node_crypto6 = require("node:crypto");
-    import_promises29 = require("node:fs/promises");
-    import_node_os2 = require("node:os");
-    import_node_path38 = require("node:path");
+    import_promises31 = require("node:fs/promises");
+    import_node_os3 = require("node:os");
+    import_node_path40 = require("node:path");
+    init_initGithub();
     init_cleanPlan();
     init_audit();
     init_heal();
@@ -24102,8 +24491,8 @@ var init_server = __esm({
     MCP_CONFIG_PATHS = [
       ".mcp.json",
       "mcp.json",
-      (0, import_node_path38.join)(".cursor", "mcp.json"),
-      (0, import_node_path38.join)(".vscode", "mcp.json")
+      (0, import_node_path40.join)(".cursor", "mcp.json"),
+      (0, import_node_path40.join)(".vscode", "mcp.json")
     ];
     MCP_PROVIDER_NEEDLES = {
       supabase: ["supabase", "@supabase/mcp", "mcp-server-supabase"],
@@ -24272,11 +24661,11 @@ var init_nextActionBlock = __esm({
 
 // src/providerMcpBridge.ts
 function defaultMcpConfigPaths() {
-  const home = (0, import_node_os3.homedir)();
+  const home = (0, import_node_os4.homedir)();
   return [
-    (0, import_node_path39.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path39.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path39.join)(home, ".gemini", "antigravity", "mcp_config.json")
+    (0, import_node_path41.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path41.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path41.join)(home, ".gemini", "antigravity", "mcp_config.json")
   ];
 }
 function resolveConfigPaths() {
@@ -24305,11 +24694,11 @@ function findServerEntry(servers, provider2) {
 function findProviderMcpConfig(provider2, configPaths) {
   const paths = configPaths ?? resolveConfigPaths();
   for (const path of paths) {
-    if (!(0, import_node_fs14.existsSync)(path)) {
+    if (!(0, import_node_fs15.existsSync)(path)) {
       continue;
     }
     try {
-      const raw = JSON.parse((0, import_node_fs14.readFileSync)(path, "utf8"));
+      const raw = JSON.parse((0, import_node_fs15.readFileSync)(path, "utf8"));
       const servers = parseMcpServers(raw);
       if (!servers) {
         continue;
@@ -24353,13 +24742,13 @@ async function verifyProviderGap(options) {
     fallbackCommand: FALLBACK_COMMAND
   };
 }
-var import_node_fs14, import_node_os3, import_node_path39, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
+var import_node_fs15, import_node_os4, import_node_path41, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
 var init_providerMcpBridge = __esm({
   "src/providerMcpBridge.ts"() {
     "use strict";
-    import_node_fs14 = require("node:fs");
-    import_node_os3 = require("node:os");
-    import_node_path39 = require("node:path");
+    import_node_fs15 = require("node:fs");
+    import_node_os4 = require("node:os");
+    import_node_path41 = require("node:path");
     FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
     SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
   }
@@ -24388,6 +24777,8 @@ Usage:
   viberaven tui          Interactive terminal menu
 
   viberaven check [--json] [--quiet] [path]
+  viberaven check --base <ref> [--markdown]   What this change introduced and fixed, compared with <ref>
+  viberaven init --github [--dry-run]         Check every pull request in GitHub Actions
                        Local production check: one line per finding, exit 1 on blockers
 
   viberaven fix [--gap <id>] [--dry-run] [path]
@@ -24537,6 +24928,9 @@ function isBooleanFlag(command, key) {
   if (key === "open" && (command === "" || command === "scan" || command === "report")) return true;
   if (key === "verify" && command === "") return true;
   if (key === "quiet" && command === "check") return true;
+  if (key === "markdown" && command === "check") return true;
+  if (key === "github" && command === "init") return true;
+  if (key === "force" && command === "init") return true;
   if (key === "vercel-supabase" && command === "audit") return true;
   if (key === "json" && command === "validate-npm-package") return true;
   if (key === "dry-run" && (command === "init" || command === "fix")) return true;
@@ -24570,7 +24964,7 @@ async function cmdProviderVerify(flags, positional) {
   return result.verified ? 0 : 1;
 }
 async function cmdStatus(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -24609,7 +25003,7 @@ async function cmdStatus(flags, positional) {
   return 0;
 }
 async function runScanCommand(flags, positional, options) {
-  const workspacePath = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
+  const workspacePath = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
   if (!options?.deferMachineOutput) {
     console.log(`Scanning ${workspacePath}\u2026 (local, offline)`);
   }
@@ -24636,7 +25030,7 @@ async function runScanCommand(flags, positional, options) {
     printNextActionBlock(block);
     printProviderActionBlock(tasks);
     try {
-      const manifest = JSON.parse(await (0, import_promises30.readFile)(paths.actionsPath, "utf8"));
+      const manifest = JSON.parse(await (0, import_promises32.readFile)(paths.actionsPath, "utf8"));
       console.log(renderActionSurface(manifest, { limit: 5 }).trimEnd());
     } catch (error) {
       console.warn(error instanceof Error ? error.message : String(error));
@@ -24653,7 +25047,7 @@ async function runScanCommand(flags, positional, options) {
   return { exitCode: 0, artifacts: paths };
 }
 async function cmdReport(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
   try {
     const paths = await refreshReportFromDisk(startDir);
     console.log(`Report refreshed: ${paths.reportPath}`);
@@ -24675,7 +25069,7 @@ async function cmdReport(flags, positional) {
   }
 }
 async function cmdPrompt(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -24772,7 +25166,7 @@ async function main() {
   const wantsJsonl = hasFlag(flags, "jsonl");
   const wantsStrict = hasFlag(flags, "strict");
   if (flags.condense) {
-    const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+    const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
     const result = await runCondenseCommand({ cwd });
     console.log(`VibeRaven context map refreshed: ${result.contextMapPath}`);
     return 0;
@@ -24792,7 +25186,7 @@ async function main() {
   }
   if (!command && flags.verify === true && typeof flags.action === "string") {
     return runVerifyActionCommand({
-      cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
+      cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
       actionId: flags.action
     });
   }
@@ -24803,7 +25197,7 @@ async function main() {
       console.error("VibeRaven could not produce machine output because scan artifacts were not written.");
       return 3;
     }
-    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises30.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
+    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises32.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
     const strictExitCode = wantsStrict && gateResult ? exitCodeForStrictGate(gateResult, { failOnWarnings: flags.strict === "warning" }) : scanResult.exitCode;
     if (wantsJson && gateResult) {
       process.stdout.write(renderGateResultJson(gateResult));
@@ -24825,7 +25219,7 @@ async function main() {
       env: process.env
     });
     if (mode === "local-ui") {
-      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const handle = await startLocalUiServer({ cwd });
       console.log(`VibeRaven local UI: ${handle.url}`);
       await waitForServerShutdown();
@@ -24845,7 +25239,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     case "ui": {
-      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const envPort = Number(process.env.PORT);
       const handle = await startLocalUiServer({ cwd, port: Number.isFinite(envPort) && envPort > 0 ? envPort : void 0 });
       console.log(`VibeRaven local UI: ${handle.url}`);
@@ -24857,12 +25251,14 @@ async function main() {
       return cmdStatus(flags, positional);
     case "check":
       return runCheckCommand({
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json),
-        quiet: Boolean(flags.quiet)
+        quiet: Boolean(flags.quiet),
+        base: typeof flags.base === "string" ? flags.base : void 0,
+        markdown: flags.markdown === true
       });
     case "fix": {
-      const fixCwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const fixCwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const gapId = typeof flags.gap === "string" ? flags.gap : void 0;
       if (!gapId) {
         const artifact = await loadLastArtifact(fixCwd).catch(() => void 0);
@@ -24891,19 +25287,19 @@ async function main() {
     }
     case "actions":
       return runActionsCommand({
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "preview":
       return runPreviewCommand({
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         agentMode: flags["agent-mode"] === true,
         json: Boolean(flags.json)
       });
     case "next":
       return runNextCommand({
         json: Boolean(flags.json),
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "guide": {
       const provider2 = positional[0];
@@ -24937,8 +25333,11 @@ async function main() {
     case "provider-verify":
       return cmdProviderVerify(flags, positional);
     case "init": {
-      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const agents = typeof flags.agents === "string" ? flags.agents : void 0;
+      if (flags.github === true) {
+        return runInitGithubCommand({ cwd, dryRun: flags["dry-run"] === true, force: flags.force === true });
+      }
       return runInitCommand({
         cwd,
         agents,
@@ -24951,7 +25350,7 @@ async function main() {
         return 1;
       }
       return runDoctorAgentsCommand({
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "validate-npm-package":
       return runValidateNpmPackageCommand({
@@ -24964,7 +25363,7 @@ async function main() {
         return 1;
       }
       return runAuditCommand({
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "clean": {
@@ -24972,7 +25371,7 @@ async function main() {
         console.error("Usage: viberaven clean --plan [path]");
         return 1;
       }
-      const cwd = positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
       const plan = buildContextCleanupPlan({ projectRoot: cwd, files: await collectCleanupFiles(cwd) });
       const outputPath = await writeCleanupPlan(cwd, plan);
       console.log(`Wrote ${outputPath}
@@ -24982,9 +25381,9 @@ async function main() {
     }
     case "rls-test":
       return runRlsTestCommand({
-        cwd: positional[0] ? (0, import_node_path40.resolve)(process.cwd(), positional[0]) : process.cwd(),
-        matrix: typeof flags.matrix === "string" ? (0, import_node_path40.resolve)(process.cwd(), flags.matrix) : void 0,
-        migrations: typeof flags.migrations === "string" ? (0, import_node_path40.resolve)(process.cwd(), flags.migrations) : void 0,
+        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        matrix: typeof flags.matrix === "string" ? (0, import_node_path42.resolve)(process.cwd(), flags.matrix) : void 0,
+        migrations: typeof flags.migrations === "string" ? (0, import_node_path42.resolve)(process.cwd(), flags.migrations) : void 0,
         json: Boolean(flags.json)
       });
     default:
@@ -24993,11 +25392,11 @@ async function main() {
       return 1;
   }
 }
-var import_promises30, import_node_path40, STACK_AREAS;
+var import_promises32, import_node_path42, STACK_AREAS;
 var init_cli = __esm({
   "src/cli.ts"() {
-    import_promises30 = require("node:fs/promises");
-    import_node_path40 = require("node:path");
+    import_promises32 = require("node:fs/promises");
+    import_node_path42 = require("node:path");
     init_config();
     init_runScan();
     init_artifacts2();
@@ -25021,6 +25420,7 @@ var init_cli = __esm({
     init_stackRecommend();
     init_commands();
     init_runInit();
+    init_initGithub();
     init_runDoctor();
     init_runValidateNpmPackage();
     init_runAudit();