@viberaven/cli 1.6.2 → 1.6.4

package/dist/cli.js

@@ -656,9 +656,30 @@ function normalizeGap(v) {
     toolSuggestions,
     mcpSuggestion: typeof v.mcpSuggestion === "string" ? v.mcpSuggestion : null,
     primaryMapCategory: affectedMapCategories[0],
-    affectedMapCategories
+    affectedMapCategories,
+    ...normalizeLocations(v.locations)
   };
 }
+function normalizeLocations(v) {
+  if (!Array.isArray(v)) return {};
+  const locations = [];
+  for (const item4 of v) {
+    if (!isRecord(item4) || typeof item4.file !== "string" || !item4.file.trim()) continue;
+    const line = typeof item4.line === "number" && Number.isInteger(item4.line) && item4.line > 0 ? item4.line : void 0;
+    locations.push(line === void 0 ? { file: item4.file } : { file: item4.file, line });
+  }
+  return locations.length > 0 ? { locations } : {};
+}
+function mergeLocations(a, b3) {
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [...a ?? [], ...b3 ?? []].filter((location) => {
+    const key = `${location.file}:${location.line ?? ""}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  return merged.length > 0 ? { locations: merged } : {};
+}
 function rootGapKey(gap) {
   const titleKey = slugify(gap.title);
   if (titleKey) {
@@ -688,7 +709,8 @@ function mergeRootGaps(a, b3) {
     toolSuggestions: mergeToolSuggestions(a.toolSuggestions, b3.toolSuggestions),
     mcpSuggestion: a.mcpSuggestion ?? b3.mcpSuggestion,
     primaryMapCategory: a.primaryMapCategory,
-    affectedMapCategories: a.affectedMapCategories
+    affectedMapCategories: a.affectedMapCategories,
+    ...mergeLocations(a.locations, b3.locations)
   };
 }
 function dedupeRootGaps(gaps) {
@@ -3304,11 +3326,11 @@ var init_providerTruth = __esm({
 // ../../src/station/promptBuilder.ts
 function buildAnalysisPrompt(scan, specContent, productionConnectionContext, scannerEvidenceContext, stackWiringContext, stackAutomationContext) {
   const sections = [];
-  const detectedStack = Object.entries(scan.stackSignals).filter(([, v]) => v === true).map(([k3]) => k3).join(", ");
+  const detectedStack2 = Object.entries(scan.stackSignals).filter(([, v]) => v === true).map(([k3]) => k3).join(", ");
   sections.push(`## PROJECT CONTEXT
 Total files in repo: ${scan.totalFilesScanned}
 Files analyzed: ${scan.files.length}
-Detected stack signals: ${detectedStack || "none detected"}
+Detected stack signals: ${detectedStack2 || "none detected"}
 All dependencies: ${scan.packageDeps.join(", ") || "none found"}
 Secret files found (contents not read): ${scan.secretsFound.join(", ") || "none"}
 `);
@@ -8462,8 +8484,9 @@ function readFunctionAttributes(tokens) {
     if (t.value === "security" && next?.kind === "word" && (next.value === "definer" || next.value === "invoker")) {
       out.definer = next.value === "definer";
     }
-    if (t.value === "returns" && next?.kind === "word") {
-      out.returnsTrigger = next.value === "trigger" || next.value === "event_trigger";
+    if (t.value === "returns" && (next?.kind === "word" || next?.kind === "ident")) {
+      const type = next.value;
+      out.returnsTrigger = type === "trigger" || type === "event_trigger";
     }
   }
   return out;
@@ -8591,7 +8614,7 @@ function analyzeRls(replay) {
     }
     if (!table2.rls && (table2.created || table2.disabledLoc)) {
       const where = table2.disabledLoc ?? table2.arrivedLoc ?? table2.created;
-      const risk = "Anyone holding the anon key your frontend ships can read and change every row through the Data API (unless the table's grants were revoked).";
+      const risk = "Without RLS, the Data API does not enforce row restrictions for roles and operations allowed by the table's grants. Verify those grants to determine who can read or change rows.";
       const message = table2.disabledLoc ? `${table2.display} has row level security turned off at ${at(table2.disabledLoc)}. ${risk}` : table2.arrivedLoc ? `${table2.display} is moved into public at ${at(table2.arrivedLoc)} without row level security, and no later migration enables it. ${risk}` : `${table2.display} is created at ${at(table2.created)} and no migration enables row level security on it. ${risk}`;
       missingRls.push({
         id: "rls_disabled",
@@ -9417,7 +9440,7 @@ function buildRlsCheck(replay) {
       id: "supabase-rls-policy-proof",
       title: "Supabase RLS policy proof",
       status: "needs_work",
-      summary: `${plural(analysis.missingRls.length, "public table")} without row level security: ${names}. Anyone holding the anon key your frontend ships can read and change those rows through the Data API.`,
+      summary: `${plural(analysis.missingRls.length, "public table")} without row level security: ${names}. The Data API does not enforce row restrictions for roles and operations allowed by the table's grants. Verify those grants to determine who can read or change rows.`,
       evidence: findingEvidence(analysis.missingRls),
       findings
     };
@@ -10437,6 +10460,18 @@ var init_databaseEvidence = __esm({
 });
 
 // src/localStation.ts
+function findingLocations(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const finding of findings) {
+    if (!finding.file) continue;
+    const key = `${finding.file}:${finding.line ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(finding.line ? { file: finding.file, line: finding.line } : { file: finding.file });
+  }
+  return out.slice(0, DETAIL_MAX_FINDINGS);
+}
 function hasFilePath(scan, pattern) {
   return scan.files.some((f) => pattern.test(f.path));
 }
@@ -10730,7 +10765,8 @@ function auditFindingSeeds(audit) {
       detail: capLines(lines).join("\n"),
       copyPrompt: fixes.length > 0 ? `${meta.prompt}
 ${capLines(fixes).join("\n")}` : meta.prompt,
-      primaryMapCategory: meta.map
+      primaryMapCategory: meta.map,
+      locations: findingLocations(findings)
     };
   });
 }
@@ -10929,6 +10965,7 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
         category: "SECURITY & AUTH",
         severity: "warning",
         title: "Stripe webhook does not verify the signature",
+        locations: findingLocations(webhooks.unverified.map((u2) => ({ file: u2.path }))),
         detail: `${webhooks.unverified.length} Stripe webhook handler${webhooks.unverified.length === 1 ? "" : "s"} without signature verification over the raw body: ${capLines(lines).join("; ")}. Anyone who finds the URL can post a fake event, for example a paid checkout.`,
         copyPrompt: 'In each listed handler, read the raw request body (await req.text() in Next.js route handlers and Deno, express.raw({ type: "application/json" }) in Express), read the stripe-signature header, and pass both to stripe.webhooks.constructEvent (constructEventAsync on Deno or edge runtimes) with STRIPE_WEBHOOK_SECRET before trusting event.type. Return 400 when verification throws.',
         primaryMapCategory: "payments"
@@ -10965,7 +11002,7 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
           severity: "warning",
           title: `Env vars used in code but missing from ${target}`,
           detail: `Code reads ${count} that ${contract.templates.length === 1 ? target : `no env template (${contract.templates.join(", ")})`} does not document (${shown}${more}). Fresh clones, CI, and the production deploy can silently run without them.`,
-          copyPrompt: `Add placeholder entries for these variables to ${contract.templates.length === 1 ? target : contract.templates[0]} (never real values): ${shown}${drifted.length > 5 ? " and the rest" : ""}. Then confirm each one is set in the deployment environment (Vercel project settings).`,
+          copyPrompt: `Add placeholder entries for these variables to ${contract.templates.length === 1 ? target : contract.templates[0]} (never real values): ${shown}${drifted.length > 5 ? " and the rest" : ""}. Then confirm each one is set in the deployment environment (the hosting provider's project settings).`,
           primaryMapCategory: "deployment"
         });
       } else {
@@ -11032,9 +11069,9 @@ function scoreFrom(gaps) {
   }
   return Math.max(5, Math.min(96, score));
 }
-function labelFor(score, criticalCount) {
+function scoreLabelFor(score, criticalCount, warningCount) {
   if (criticalCount > 0) return "Blocked";
-  if (score >= 85) return "Launch ready";
+  if (warningCount === 0) return "No blockers in repo checks";
   if (score >= 60) return "Almost there";
   return "Needs work";
 }
@@ -11133,11 +11170,12 @@ async function buildLocalStationOutput(input) {
     toolSuggestions: [],
     mcpSuggestion: null,
     primaryMapCategory: seed.primaryMapCategory,
-    affectedMapCategories: [seed.primaryMapCategory]
+    affectedMapCategories: [seed.primaryMapCategory],
+    ...seed.locations?.length ? { locations: seed.locations } : {}
   }));
   return {
     score,
-    scoreLabel: labelFor(score, criticalCount),
+    scoreLabel: scoreLabelFor(score, criticalCount, warningCount),
     summary,
     archetype,
     gaps,
@@ -11593,6 +11631,28 @@ var init_runScan = __esm({
   }
 });
 
+// src/contracts/detectedProviders.ts
+function isProviderInRepo(row) {
+  if ((row.roles ?? []).includes("runtime-code")) return true;
+  const evidence = (row.evidence ?? []).filter((item4) => item4.kind !== "docs-mention");
+  if (!evidence.some((item4) => PACKAGE_OR_CONFIG.has(item4.kind))) return false;
+  return !evidence.every((item4) => item4.kind === "package-installed");
+}
+function providersInRepo(artifact) {
+  const areas = artifact.providerTruth?.areas;
+  if (!Array.isArray(areas)) return void 0;
+  return areas.flatMap(
+    (area) => (area.rows ?? []).filter(isProviderInRepo).map((row) => ({ area: String(area.area), provider: String(row.provider) }))
+  );
+}
+var PACKAGE_OR_CONFIG;
+var init_detectedProviders = __esm({
+  "src/contracts/detectedProviders.ts"() {
+    "use strict";
+    PACKAGE_OR_CONFIG = /* @__PURE__ */ new Set(["package-installed", "deployment-config", "provider-config"]);
+  }
+});
+
 // src/capabilities/classify.ts
 function gapText(gap) {
   return `${gap.id} ${gap.title} ${gap.detail} ${gap.primaryMapCategory}`.toLowerCase();
@@ -11780,6 +11840,37 @@ var init_capabilities = __esm({
   }
 });
 
+// src/contracts/packageManager.ts
+function detectPackageManager(workspacePath) {
+  if (!workspacePath) return "unknown";
+  try {
+    const manifest = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path8.join)(workspacePath, "package.json"), "utf8").replace(/^\uFEFF/, ""));
+    const named = typeof manifest.packageManager === "string" ? manifest.packageManager.split("@")[0] : "";
+    if (named === "npm" || named === "pnpm" || named === "yarn" || named === "bun") return named;
+  } catch {
+  }
+  for (const [file, manager] of LOCKFILES) {
+    if ((0, import_node_fs4.existsSync)((0, import_node_path8.join)(workspacePath, file))) return manager;
+  }
+  return "unknown";
+}
+var import_node_fs4, import_node_path8, LOCKFILES;
+var init_packageManager = __esm({
+  "src/contracts/packageManager.ts"() {
+    "use strict";
+    import_node_fs4 = require("node:fs");
+    import_node_path8 = require("node:path");
+    LOCKFILES = [
+      ["pnpm-lock.yaml", "pnpm"],
+      ["yarn.lock", "yarn"],
+      ["bun.lock", "bun"],
+      ["bun.lockb", "bun"],
+      ["package-lock.json", "npm"],
+      ["npm-shrinkwrap.json", "npm"]
+    ];
+  }
+});
+
 // src/contracts/commands.ts
 function promptGapCommand(gapId) {
   return `${PUBLIC_COMMAND} prompt --gap ${gapId}`;
@@ -11807,65 +11898,18 @@ var init_commands = __esm({
   }
 });
 
-// src/contracts/contextMap.ts
-function generateContextMap(artifact) {
-  const criticalCount = artifact.gaps.filter((gap) => gap.severity === "critical").length;
-  const warningCount = artifact.gaps.filter((gap) => gap.severity === "warning").length;
-  return {
-    $schema: "https://viberaven.dev/schemas/context-map.schema.json",
-    schemaVersion: "v1",
-    generatedAt: artifact.scannedAt,
-    workspace: {
-      root: artifact.workspacePath,
-      packageManager: "unknown",
-      languages: ["typescript"],
-      frameworks: artifact.archetype ? [artifact.archetype] : []
-    },
-    agentContract: {
-      readFirst: ".viberaven/agent-tasklist.md",
-      machineResult: ".viberaven/gate-result.json",
-      contextMap: ".viberaven/context-map.json",
-      verifyCommand: PUBLIC_VERIFY_COMMAND,
-      strictCommand: PUBLIC_STRICT_COMMAND,
-      nextCommand: PUBLIC_NEXT_JSON_COMMAND
-    },
-    stack: {
-      deployment: artifact.selectedProviders?.deployment ? [artifact.selectedProviders.deployment] : [],
-      database: artifact.selectedProviders?.database ? [artifact.selectedProviders.database] : [],
-      auth: artifact.selectedProviders?.auth ? [artifact.selectedProviders.auth] : [],
-      payments: artifact.selectedProviders?.payments ? [artifact.selectedProviders.payments] : [],
-      monitoring: artifact.selectedProviders?.monitoring ? [artifact.selectedProviders.monitoring] : []
-    },
-    capabilityGraph: summarizeCapabilities(artifact.gaps),
-    productionGate: {
-      status: criticalCount > 0 ? "not_clear" : warningCount > 0 ? "warning" : "clear",
-      criticalCount,
-      warningCount,
-      providerDashboardChecksRequired: true
-    },
-    topGaps: artifact.gaps.slice(0, 10).map((gap) => ({
-      id: gap.id,
-      severity: gap.severity,
-      title: gap.title,
-      area: String(gap.primaryMapCategory),
-      promptCommand: promptGapCommand(gap.id)
-    }))
-  };
-}
-var init_contextMap = __esm({
-  "src/contracts/contextMap.ts"() {
-    "use strict";
-    init_capabilities();
-    init_commands();
-  }
-});
-
 // src/contracts/gateResult.ts
 function gateStatus(criticalCount, warningCount) {
   if (criticalCount > 0) return "not_clear";
   if (warningCount > 0) return "warning";
   return "clear";
 }
+function gateStatusForGaps(gaps) {
+  return gateStatus(
+    gaps.filter((gap) => gap.severity === "critical").length,
+    gaps.filter((gap) => gap.severity === "warning").length
+  );
+}
 function runIdFrom(scannedAt) {
   return `vr_${scannedAt.replace(/\D/g, "").slice(0, 14) || "scan"}`;
 }
@@ -11883,7 +11927,7 @@ function generateGateResult(artifact, options = {}) {
     generatedAt: artifact.scannedAt,
     workspace: {
       root: artifact.workspacePath,
-      packageManager: "unknown",
+      packageManager: options.packageManager ?? detectPackageManager(artifact.workspacePath),
       languages: ["typescript"],
       frameworks: artifact.archetype ? [artifact.archetype] : []
     },
@@ -11924,101 +11968,246 @@ var init_gateResult = __esm({
   "src/contracts/gateResult.ts"() {
     "use strict";
     init_capabilities();
+    init_packageManager();
     init_commands();
   }
 });
 
-// src/contracts/gapEvidence.ts
-function summarizeGap(gap) {
-  return `${gap.title}. See the tasklist and original scan for redacted detail.`;
+// src/contracts/contextMap.ts
+function detectedStack(artifact) {
+  const stack = { deployment: [], database: [], auth: [], payments: [], monitoring: [] };
+  const add = (area, provider2) => {
+    if (!(area in stack) || typeof provider2 !== "string" || !provider2) return;
+    const list = stack[area];
+    if (!list.includes(provider2)) list.push(provider2);
+  };
+  for (const entry of providersInRepo(artifact) ?? []) add(entry.area, entry.provider);
+  for (const [area, provider2] of Object.entries(artifact.selectedProviders ?? {})) add(area, provider2);
+  return stack;
 }
-function generateGapEvidenceFiles(artifact) {
-  return artifact.gaps.slice(0, 50).map((gap) => ({
-    path: `.viberaven/gaps/${gap.id}.json`,
-    content: {
-      $schema: "https://viberaven.dev/schemas/gap.schema.json",
-      schemaVersion: "v1",
+function generateContextMap(artifact, options = {}) {
+  const criticalCount = artifact.gaps.filter((gap) => gap.severity === "critical").length;
+  const warningCount = artifact.gaps.filter((gap) => gap.severity === "warning").length;
+  return {
+    $schema: "https://viberaven.dev/schemas/context-map.schema.json",
+    schemaVersion: "v1",
+    generatedAt: artifact.scannedAt,
+    workspace: {
+      root: artifact.workspacePath,
+      packageManager: options.packageManager ?? detectPackageManager(artifact.workspacePath),
+      languages: ["typescript"],
+      frameworks: artifact.archetype ? [artifact.archetype] : []
+    },
+    agentContract: {
+      readFirst: ".viberaven/agent-tasklist.md",
+      machineResult: ".viberaven/gate-result.json",
+      contextMap: ".viberaven/context-map.json",
+      verifyCommand: PUBLIC_VERIFY_COMMAND,
+      strictCommand: PUBLIC_STRICT_COMMAND,
+      nextCommand: PUBLIC_NEXT_JSON_COMMAND
+    },
+    stack: detectedStack(artifact),
+    capabilityGraph: summarizeCapabilities(artifact.gaps),
+    productionGate: {
+      status: gateStatusForGaps(artifact.gaps),
+      criticalCount,
+      warningCount,
+      providerDashboardChecksRequired: true
+    },
+    topGaps: artifact.gaps.slice(0, 10).map((gap) => ({
       id: gap.id,
       severity: gap.severity,
-      capability: classifyGapCapability(gap),
       title: gap.title,
-      summary: summarizeGap(gap),
-      evidence: [{ kind: String(gap.primaryMapCategory), redacted: true }],
-      commands: {
-        prompt: promptGapCommand(gap.id),
-        healPlan: healPlanGapCommand(gap.id),
-        verify: PUBLIC_VERIFY_COMMAND
-      },
-      providerBoundary: {
-        requiresDashboardCheck: true,
-        reason: "Repo evidence cannot prove live provider dashboard state."
-      }
-    }
-  }));
+      area: String(gap.primaryMapCategory),
+      promptCommand: promptGapCommand(gap.id)
+    }))
+  };
 }
-var init_gapEvidence = __esm({
-  "src/contracts/gapEvidence.ts"() {
+var init_contextMap = __esm({
+  "src/contracts/contextMap.ts"() {
     "use strict";
+    init_detectedProviders();
+    init_gateResult();
     init_capabilities();
+    init_packageManager();
     init_commands();
   }
 });
 
-// src/playbooks/checkMap.ts
-function mapCheckToPlaybook(check) {
-  if (CHECK_TO_PLAYBOOK[check.id]) {
-    return CHECK_TO_PLAYBOOK[check.id];
+// src/contracts/gapLocations.ts
+function locationsForGap(gap) {
+  return gap.locations && gap.locations.length > 0 ? gap.locations : gapLocations(gap.detail);
+}
+function withoutUrlsAndAddresses(text) {
+  return text.split(/(\s+)/).map((word) => /:\/\/|@|=/.test(word) ? " " : word).join("");
+}
+function gapLocations(detail) {
+  if (typeof detail !== "string") return [];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const rawLine of detail.split(/\r?\n/)) {
+    const text = withoutUrlsAndAddresses(rawLine.split(" Fix:")[0]);
+    for (const match of text.matchAll(LOCATION)) {
+      const folder = match[1].replace(/\\/g, "/");
+      const name = match[2];
+      const file = `${folder}${name}`;
+      const line = match[3] ? Number(match[3]) : void 0;
+      if (line !== void 0 && !(line > 0)) continue;
+      const envFile = name.startsWith(".env");
+      if (!envFile && (VERSION_LIKE.test(name) || VERSION_LIKE.test(name.replace(/\.[A-Za-z0-9]+$/, "")))) continue;
+      const codeFile = CODE_EXTENSION.test(name) && !(folder === "" && PROSE_NAME.test(name));
+      const configFile = CONFIG_EXTENSION.test(name);
+      if (line !== void 0) {
+        if (!envFile && !codeFile && !configFile) continue;
+      } else if (!envFile && !codeFile && !(configFile && folder !== "")) {
+        continue;
+      }
+      const key = `${file}:${line ?? ""}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(line === void 0 ? { file } : { file, line });
+    }
   }
-  const providerKey = check.providerKey.toLowerCase();
-  if (providerKey.includes("vercel") || check.area === "deployment") {
-    return "vercel";
+  return out;
+}
+var SEGMENT, NAME, LOCATION, CODE_EXTENSION, CONFIG_EXTENSION, PROSE_NAME, VERSION_LIKE;
+var init_gapLocations = __esm({
+  "src/contracts/gapLocations.ts"() {
+    "use strict";
+    SEGMENT = String.raw`(?:\([\w.-]+\)|\[[\w.-]+\]|[\w-][\w.-]*)`;
+    NAME = String.raw`(\.env(?:\.[\w-]+)*|(?:\[[\w.-]+\]|[\w-][\w.-]*?)\.[A-Za-z0-9]+)`;
+    LOCATION = new RegExp(
+      String.raw`(?<![\w./\\:-])((?:[A-Za-z]:[\\/])?(?:${SEGMENT}[\\/])*)${NAME}(?::(\d+))?(?!\.?[\w\\/])`,
+      "g"
+    );
+    CODE_EXTENSION = /\.(?:sql|[cm]?[jt]sx?|py|rb|php|go|rs|java|kt|cs|swift|ex|exs|vue|svelte|astro)$/i;
+    CONFIG_EXTENSION = /\.(?:json|toml|ya?ml)$/i;
+    PROSE_NAME = /^(?:next|node|nuxt|vue|express|nest|react|three|chart|solid|ember|backbone|angular|alpine|d3)\.js$/i;
+    VERSION_LIKE = /^v?\d+(?:\.\d+)+$/i;
   }
-  if (providerKey.includes("stripe") || check.area === "payments") {
-    return "stripe";
+});
+
+// src/contracts/repoFixes.ts
+var APPLY_MIGRATION, ROTATE_KEY, REPO_FIX_GAPS, INFORMATIONAL_GAPS, REPO_ONLY_RECIPE_GAPS, RECIPE_GAPS_WITH_OUTSIDE_STEP, KNOWN_RECIPE_GAP_IDS, REPO_ONLY_GAPS;
+var init_repoFixes = __esm({
+  "src/contracts/repoFixes.ts"() {
+    "use strict";
+    APPLY_MIGRATION = "Apply the new migration to the live database the way this project applies migrations.";
+    ROTATE_KEY = "Rotate the service role key in the Supabase dashboard if this key was ever deployed or committed with a real value.";
+    REPO_FIX_GAPS = {
+      rls_policy_allows_all_write: [APPLY_MIGRATION],
+      rls_policy_allows_all_read: [APPLY_MIGRATION],
+      data_api_grant_without_rls: [APPLY_MIGRATION],
+      data_api_grant_missing: [APPLY_MIGRATION],
+      security_definer_function_executable: [APPLY_MIGRATION],
+      service_role_key_in_client_env: [ROTATE_KEY],
+      service_role_key_in_client_code: [ROTATE_KEY],
+      env_var_drift: ["Set each of these variables in the environment where the app is deployed."],
+      unverified_stripe_webhook: [
+        "Set STRIPE_WEBHOOK_SECRET where the handler runs to the signing secret of this endpoint in the Stripe dashboard, then deploy the handler."
+      ]
+    };
+    INFORMATIONAL_GAPS = {
+      rls_no_policies: "Informational. Nothing to change if only the server uses this table. If the frontend reads or writes it, add policies in a new migration."
+    };
+    REPO_ONLY_RECIPE_GAPS = [
+      // emptyCatch (original recipe)
+      "empty-catch",
+      "empty_catch",
+      "emptyCatch",
+      // file-create recipes
+      "missing_error_boundary",
+      "missing_health_route",
+      "missing_loading_state",
+      "missing_404_page",
+      // file-patch recipes
+      "missing_csp_header",
+      "eslint_restricted_imports"
+    ];
+    RECIPE_GAPS_WITH_OUTSIDE_STEP = ["auth_secret_missing", "node_env_not_set", "database_url_missing", "missing_rate_limit"];
+    KNOWN_RECIPE_GAP_IDS = /* @__PURE__ */ new Set([...REPO_ONLY_RECIPE_GAPS, ...RECIPE_GAPS_WITH_OUTSIDE_STEP]);
+    REPO_ONLY_GAPS = /* @__PURE__ */ new Set([...Object.keys(INFORMATIONAL_GAPS), ...REPO_ONLY_RECIPE_GAPS]);
   }
-  if (providerKey.includes("supabase") && check.area === "auth") {
-    return "auth-supabase";
+});
+
+// src/heal/rlsMigrationTarget.ts
+function rlsEnableStatements(tables) {
+  return [...new Set(tables)].map((table2) => `alter table ${table2} enable row level security;`);
+}
+function migrationStamp(now) {
+  return now.toISOString().replace(/\D/g, "").slice(0, 14);
+}
+function rlsMigrationTarget(cwd, evidence, now = /* @__PURE__ */ new Date()) {
+  if (evidence.length === 0) return { ok: false, reason: "No table without row level security was found in the repo SQL." };
+  const statementList = rlsEnableStatements(evidence.map((entry) => entry.table)).join(" ");
+  const turnedOff = evidence.filter((entry) => entry.turnedOff);
+  if (turnedOff.length > 0) {
+    const where = turnedOff.map((entry) => `${entry.table} (${entry.file.replace(/\\/g, "/")})`).join(", ");
+    return {
+      ok: false,
+      reason: `The latest migration that touches ${where} turns row level security off on purpose, so VibeRaven will not turn it back on automatically. If the user wants it on, add these statements by hand in a new migration, with the policies the app needs: ${statementList}`
+    };
   }
-  if (providerKey.includes("supabase") || check.area === "database") {
-    return "supabase";
+  const source = evidence[0].file.replace(/\\/g, "/");
+  const dir = import_node_path9.posix.dirname(source);
+  if (import_node_path9.posix.basename(dir) !== "migrations") {
+    return {
+      ok: false,
+      reason: `The tables come from ${source}, which is not in a migrations folder, so VibeRaven will not guess where a migration goes. Add these statements by hand where this project keeps its schema: ${statementList}`
+    };
   }
-  if (check.area === "auth") {
-    return "auth-supabase";
+  let existing;
+  try {
+    existing = (0, import_node_fs5.readdirSync)((0, import_node_path9.join)(cwd, dir)).filter((file) => file.endsWith(".sql")).sort();
+  } catch {
+    return { ok: false, reason: `VibeRaven could not read ${dir}. Add these statements by hand in a new migration: ${statementList}` };
+  }
+  const otherNaming = existing.find((file) => !TIMESTAMPED_MIGRATION.test(file));
+  if (otherNaming) {
+    return {
+      ok: false,
+      reason: `The migrations in ${dir} are not named <14-digit timestamp>_name.sql (for example ${otherNaming}), so a timestamped file from VibeRaven could run in the wrong order next to them. Add these statements by hand in a new migration that follows this project's naming: ${statementList}`
+    };
+  }
+  const name = `${migrationStamp(now)}_viberaven_enable_rls.sql`;
+  const last = existing[existing.length - 1];
+  if (last && name <= last) {
+    return {
+      ok: false,
+      reason: `A new migration named ${name} would not run after ${last} in ${dir}, so VibeRaven will not write it. Add these statements by hand in a migration that runs last: ${statementList}`
+    };
   }
-  return "vercel";
+  return { ok: true, file: `${dir}/${name}` };
 }
-var CHECK_TO_PLAYBOOK;
-var init_checkMap = __esm({
-  "src/playbooks/checkMap.ts"() {
+var import_node_fs5, import_node_path9, RLS_TURNED_OFF_PHRASE, RLS_ASK_FIRST, RLS_NO_POLICIES_WARNING, TIMESTAMPED_MIGRATION;
+var init_rlsMigrationTarget = __esm({
+  "src/heal/rlsMigrationTarget.ts"() {
     "use strict";
-    CHECK_TO_PLAYBOOK = {
-      "vercel-deployment": "vercel",
-      "vercel-project": "vercel",
-      "supabase-project": "supabase",
-      "supabase-env": "supabase",
-      "stripe-webhook": "stripe",
-      "stripe-product": "stripe",
-      "stripe-keys": "stripe"
-    };
+    import_node_fs5 = require("node:fs");
+    import_node_path9 = require("node:path");
+    RLS_TURNED_OFF_PHRASE = "has row level security turned off at";
+    RLS_ASK_FIRST = "Ask the user first: enabling RLS without policies makes browser reads return no rows until policies exist.";
+    RLS_NO_POLICIES_WARNING = "This migration enables row level security with no policies. Until you add policies, the anon and authenticated roles get no rows from these tables through the Data API, so browser reads return nothing and browser writes fail. `check` then reports the tables only as info (rls_no_policies), not as a blocker. Add the policies the app needs before you apply the migration to the database.";
+    TIMESTAMPED_MIGRATION = /^\d{14}_.+\.sql$/;
   }
 });
 
 // src/playbooks/playbooksRoot.ts
 function playbooksRoot() {
-  const candidates = [(0, import_node_path8.join)(__dirname, "playbooks"), (0, import_node_path8.join)(__dirname, "..", "..", "playbooks")];
+  const candidates = [(0, import_node_path10.join)(__dirname, "playbooks"), (0, import_node_path10.join)(__dirname, "..", "..", "playbooks")];
   for (const dir of candidates) {
-    if ((0, import_node_fs4.existsSync)((0, import_node_path8.join)(dir, "vercel.json"))) {
+    if ((0, import_node_fs6.existsSync)((0, import_node_path10.join)(dir, "vercel.json"))) {
       return dir;
     }
   }
   throw new Error("VibeRaven playbooks directory not found (expected vercel.json)");
 }
-var import_node_fs4, import_node_path8;
+var import_node_fs6, import_node_path10;
 var init_playbooksRoot = __esm({
   "src/playbooks/playbooksRoot.ts"() {
     "use strict";
-    import_node_fs4 = require("node:fs");
-    import_node_path8 = require("node:path");
+    import_node_fs6 = require("node:fs");
+    import_node_path10 = require("node:path");
   }
 });
 
@@ -12125,7 +12314,7 @@ async function loadPlaybook(provider2) {
       `Unknown provider "${provider2}". Available: ${PLAYBOOK_PROVIDERS.join(", ")}`
     );
   }
-  const path = (0, import_node_path9.join)(playbooksRoot(), `${normalized}.json`);
+  const path = (0, import_node_path11.join)(playbooksRoot(), `${normalized}.json`);
   const raw = JSON.parse(await (0, import_promises7.readFile)(path, "utf-8"));
   const playbook = parsePlaybook(raw);
   if (playbook.provider !== normalized) {
@@ -12140,59 +12329,30 @@ function loadPlaybookSync(provider2) {
       `Unknown provider "${provider2}". Available: ${PLAYBOOK_PROVIDERS.join(", ")}`
     );
   }
-  const path = (0, import_node_path9.join)(playbooksRoot(), `${normalized}.json`);
-  const raw = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf-8"));
+  const path = (0, import_node_path11.join)(playbooksRoot(), `${normalized}.json`);
+  const raw = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
   const playbook = parsePlaybook(raw);
   if (playbook.provider !== normalized) {
     throw new Error(`Playbook file ${normalized}.json has mismatched provider field`);
   }
   return playbook;
 }
-var import_node_fs5, import_promises7, import_node_path9;
+var import_node_fs7, import_promises7, import_node_path11;
 var init_loadPlaybook = __esm({
   "src/playbooks/loadPlaybook.ts"() {
     "use strict";
-    import_node_fs5 = require("node:fs");
+    import_node_fs7 = require("node:fs");
     import_promises7 = require("node:fs/promises");
-    import_node_path9 = require("node:path");
+    import_node_path11 = require("node:path");
     init_playbooksRoot();
     init_types2();
     init_validate();
   }
 });
 
-// src/playbooks/manualChecks.ts
-function isManualProviderCheck(check) {
-  return check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown";
-}
-function collectManualChecks(artifact) {
-  const refs = [];
-  for (const area of artifact.missionGraph.areas ?? []) {
-    for (const mission of area.providerMissions) {
-      for (const check of mission.checks) {
-        if (!isManualProviderCheck(check)) {
-          continue;
-        }
-        refs.push({
-          areaLabel: area.label,
-          providerLabel: mission.providerLabel,
-          check,
-          mapCategory: area.key
-        });
-      }
-    }
-  }
-  return refs;
-}
-var init_manualChecks = __esm({
-  "src/playbooks/manualChecks.ts"() {
-    "use strict";
-  }
-});
-
-// src/tui/menu.ts
-function isScanNotFoundError(error) {
-  return error instanceof ScanNotFoundError;
+// src/tui/menu.ts
+function isScanNotFoundError(error) {
+  return error instanceof ScanNotFoundError;
 }
 function needsScanMessage(startDir) {
   const cwd = startDir ?? process.cwd();
@@ -12239,7 +12399,7 @@ async function loadLastArtifact(startDir) {
   if (!workspace) {
     throw new ScanNotFoundError(needsScanMessage(startDir));
   }
-  const path = (0, import_node_path10.join)(getProjectArtifactsDir(workspace), "last-scan.json");
+  const path = (0, import_node_path12.join)(getProjectArtifactsDir(workspace), "last-scan.json");
   try {
     const raw = await (0, import_promises8.readFile)(path, "utf-8");
     return JSON.parse(raw);
@@ -12247,12 +12407,12 @@ async function loadLastArtifact(startDir) {
     throw new ScanNotFoundError(needsScanMessage(startDir));
   }
 }
-var import_promises8, import_node_path10, SEVERITY_RANK2, ScanNotFoundError;
+var import_promises8, import_node_path12, SEVERITY_RANK2, ScanNotFoundError;
 var init_menu = __esm({
   "src/tui/menu.ts"() {
     "use strict";
     import_promises8 = require("node:fs/promises");
-    import_node_path10 = require("node:path");
+    import_node_path12 = require("node:path");
     init_config();
     SEVERITY_RANK2 = {
       critical: 0,
@@ -12268,228 +12428,6 @@ var init_menu = __esm({
   }
 });
 
-// src/resolveNextAction.ts
-function resolveNextAction(artifact) {
-  const repoGap = sortGapsByPriority(artifact.gaps)[0];
-  if (repoGap) {
-    return {
-      type: "repo-fix",
-      title: repoGap.title,
-      detail: repoGap.detail,
-      command: `viberaven prompt --gap ${repoGap.id}`
-    };
-  }
-  const manual = collectManualChecks(artifact)[0];
-  if (manual) {
-    const provider2 = mapCheckToPlaybook(manual.check);
-    let openUrl;
-    try {
-      const playbook = loadPlaybookSync(provider2);
-      openUrl = playbook.steps[0]?.openUrl;
-    } catch {
-      openUrl = void 0;
-    }
-    return {
-      type: "provider-guide",
-      title: manual.check.label,
-      detail: manual.check.promptHint || `Configure ${manual.providerLabel} in the provider dashboard (${manual.areaLabel}).`,
-      provider: provider2,
-      playbookStep: 1,
-      command: `viberaven guide ${provider2} --step 1`,
-      openUrl
-    };
-  }
-  return {
-    type: "done",
-    title: "No blockers found",
-    detail: "Re-scan after changes to confirm production readiness."
-  };
-}
-var init_resolveNextAction = __esm({
-  "src/resolveNextAction.ts"() {
-    "use strict";
-    init_checkMap();
-    init_loadPlaybook();
-    init_manualChecks();
-    init_menu();
-  }
-});
-
-// src/report/agentSummary.ts
-function sortGaps(gaps) {
-  return [...gaps].sort((a, b3) => {
-    const sev = SEVERITY_ORDER2[a.severity] - SEVERITY_ORDER2[b3.severity];
-    if (sev !== 0) {
-      return sev;
-    }
-    return a.title.localeCompare(b3.title);
-  });
-}
-function generateAgentSummary(artifact) {
-  const lines = [];
-  const topGaps = sortGaps(artifact.gaps).slice(0, 8);
-  lines.push("# VibeRaven agent summary", "");
-  lines.push(`Scanned: \`${artifact.workspacePath}\``);
-  lines.push(`At: ${artifact.scannedAt}`);
-  lines.push(
-    `Production core: **${artifact.productionCorePercent}%** \xB7 Model score: **${artifact.score}** (${artifact.scoreLabel})`
-  );
-  lines.push("");
-  const next = resolveNextAction(artifact);
-  lines.push("## Next action", "");
-  lines.push(`**${next.title}** \u2014 ${next.detail}`);
-  if (next.command) {
-    lines.push(`Command: \`${next.command}\``);
-  }
-  lines.push("");
-  lines.push("## Suggested stack", "");
-  lines.push(
-    "React + Tailwind + shadcn/ui + Supabase + Vercel (agent-default stack for lowest launch friction)"
-  );
-  lines.push("");
-  lines.push("## Summary");
-  lines.push(artifact.summary || "_No summary returned._");
-  lines.push("");
-  lines.push("## Mission map (repo wiring)");
-  lines.push("");
-  lines.push("| Area | Provider | Readiness | Notes |");
-  lines.push("|------|----------|-----------|-------|");
-  for (const area of artifact.missionGraph.areas ?? []) {
-    for (const mission of area.providerMissions) {
-      const failed = mission.checks.filter(
-        (c) => c.status === "missing" || c.status === "failed" || c.status === "needs-connection"
-      ).length;
-      const notes = failed > 0 ? `${failed} open check${failed === 1 ? "" : "s"}` : `${mission.readinessPercent}% repo checks`;
-      lines.push(
-        `| ${area.label} | ${mission.providerLabel} | ${mission.readinessPercent}% | ${notes} |`
-      );
-    }
-  }
-  lines.push("");
-  lines.push("## Agent-code actions");
-  if (topGaps.length === 0) {
-    lines.push("_No model gaps returned. Review mission map checks before changing code._");
-  } else {
-    topGaps.forEach((gap, index) => {
-      lines.push(
-        `${index + 1}. **${gap.title}** (\`${gap.id}\`, ${gap.severity}, map: \`${gap.primaryMapCategory}\`)`
-      );
-      lines.push(`   - ${gap.detail}`);
-      lines.push(`   - Command: \`viberaven prompt --gap ${gap.id}\``);
-      if (gap.copyPrompt) {
-        lines.push(`   - Prompt: ${gap.copyPrompt}`);
-      }
-    });
-  }
-  const manualChecks = (artifact.missionGraph.areas ?? []).flatMap(
-    (area) => area.providerMissions.flatMap(
-      (mission) => mission.checks.filter(
-        (check) => check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown"
-      ).map((check) => ({ area: area.label, provider: mission.providerLabel, check }))
-    )
-  );
-  lines.push("");
-  lines.push("## Human-provider actions");
-  if (manualChecks.length === 0) {
-    lines.push("_No manual provider actions were identified in this scan._");
-  } else {
-    manualChecks.slice(0, 8).forEach((item4, index) => {
-      lines.push(`${index + 1}. **${item4.check.label}** (${item4.area} / ${item4.provider})`);
-      lines.push(
-        `   - ${item4.check.promptHint || "Ask the user to confirm this in the provider dashboard or through read-only MCP."}`
-      );
-    });
-  }
-  lines.push("");
-  lines.push("Do not claim human-provider actions as repo-code fixes.");
-  lines.push("");
-  lines.push("## Agent workflow");
-  lines.push("1. Read `.viberaven/agent-tasklist.md` first for the production gate.");
-  lines.push("2. Read `.viberaven/launch-playbook.md` for the full checklist.");
-  lines.push("3. Run `viberaven next --json` - one action at a time.");
-  lines.push("4. Repo fix: `viberaven prompt --gap <id>` then implement.");
-  lines.push("5. Provider: `viberaven guide <provider> --step N` and `viberaven open <provider>`.");
-  lines.push(`6. Run \`${PUBLIC_VERIFY_COMMAND}\` to rescan and refresh \`.viberaven/agent-tasklist.md\`.`);
-  lines.push("");
-  return `${lines.join("\n")}
-`;
-}
-var SEVERITY_ORDER2;
-var init_agentSummary = __esm({
-  "src/report/agentSummary.ts"() {
-    "use strict";
-    init_commands();
-    init_resolveNextAction();
-    SEVERITY_ORDER2 = {
-      critical: 0,
-      warning: 1,
-      info: 2
-    };
-  }
-});
-
-// src/heal/rlsMigrationTarget.ts
-function rlsEnableStatements(tables) {
-  return [...new Set(tables)].map((table2) => `alter table ${table2} enable row level security;`);
-}
-function migrationStamp(now) {
-  return now.toISOString().replace(/\D/g, "").slice(0, 14);
-}
-function rlsMigrationTarget(cwd, evidence, now = /* @__PURE__ */ new Date()) {
-  if (evidence.length === 0) return { ok: false, reason: "No table without row level security was found in the repo SQL." };
-  const statementList = rlsEnableStatements(evidence.map((entry) => entry.table)).join(" ");
-  const turnedOff = evidence.filter((entry) => entry.turnedOff);
-  if (turnedOff.length > 0) {
-    const where = turnedOff.map((entry) => `${entry.table} (${entry.file.replace(/\\/g, "/")})`).join(", ");
-    return {
-      ok: false,
-      reason: `The latest migration that touches ${where} turns row level security off on purpose, so VibeRaven will not turn it back on automatically. If the user wants it on, add these statements by hand in a new migration, with the policies the app needs: ${statementList}`
-    };
-  }
-  const source = evidence[0].file.replace(/\\/g, "/");
-  const dir = import_node_path11.posix.dirname(source);
-  if (import_node_path11.posix.basename(dir) !== "migrations") {
-    return {
-      ok: false,
-      reason: `The tables come from ${source}, which is not in a migrations folder, so VibeRaven will not guess where a migration goes. Add these statements by hand where this project keeps its schema: ${statementList}`
-    };
-  }
-  let existing;
-  try {
-    existing = (0, import_node_fs6.readdirSync)((0, import_node_path11.join)(cwd, dir)).filter((file) => file.endsWith(".sql")).sort();
-  } catch {
-    return { ok: false, reason: `VibeRaven could not read ${dir}. Add these statements by hand in a new migration: ${statementList}` };
-  }
-  const otherNaming = existing.find((file) => !TIMESTAMPED_MIGRATION.test(file));
-  if (otherNaming) {
-    return {
-      ok: false,
-      reason: `The migrations in ${dir} are not named <14-digit timestamp>_name.sql (for example ${otherNaming}), so a timestamped file from VibeRaven could run in the wrong order next to them. Add these statements by hand in a new migration that follows this project's naming: ${statementList}`
-    };
-  }
-  const name = `${migrationStamp(now)}_viberaven_enable_rls.sql`;
-  const last = existing[existing.length - 1];
-  if (last && name <= last) {
-    return {
-      ok: false,
-      reason: `A new migration named ${name} would not run after ${last} in ${dir}, so VibeRaven will not write it. Add these statements by hand in a migration that runs last: ${statementList}`
-    };
-  }
-  return { ok: true, file: `${dir}/${name}` };
-}
-var import_node_fs6, import_node_path11, RLS_TURNED_OFF_PHRASE, RLS_ASK_FIRST, RLS_NO_POLICIES_WARNING, TIMESTAMPED_MIGRATION;
-var init_rlsMigrationTarget = __esm({
-  "src/heal/rlsMigrationTarget.ts"() {
-    "use strict";
-    import_node_fs6 = require("node:fs");
-    import_node_path11 = require("node:path");
-    RLS_TURNED_OFF_PHRASE = "has row level security turned off at";
-    RLS_ASK_FIRST = "Ask the user first: enabling RLS without policies makes browser reads return no rows until policies exist.";
-    RLS_NO_POLICIES_WARNING = "This migration enables row level security with no policies. Until you add policies, the anon and authenticated roles get no rows from these tables through the Data API, so browser reads return nothing and browser writes fail. `check` then reports the tables only as info (rls_no_policies), not as a blocker. Add the policies the app needs before you apply the migration to the database.";
-    TIMESTAMPED_MIGRATION = /^\d{14}_.+\.sql$/;
-  }
-});
-
 // src/buildTaskList.ts
 function rlsMigrationFile(gap) {
   if (gap.id !== "rls_disabled" || typeof gap.detail !== "string") return void 0;
@@ -12508,7 +12446,12 @@ function hasRecipe(gapId) {
   const lower = gapId.toLowerCase();
   return lower.includes("empty") && lower.includes("catch");
 }
-function gapToPlaybookProvider(gap) {
+function gapToPlaybookProvider(gap, inRepo) {
+  const provider2 = playbookByCategoryOrId(gap);
+  if (!provider2 || !inRepo) return provider2;
+  return inRepo.has(PLAYBOOK_TOKEN[provider2] ?? provider2) ? provider2 : void 0;
+}
+function playbookByCategoryOrId(gap) {
   const cat = gap.primaryMapCategory.toLowerCase();
   if (cat === "deployment") return "vercel";
   if (cat === "payments") return "stripe";
@@ -12521,9 +12464,9 @@ function gapToPlaybookProvider(gap) {
   if (id.includes("auth")) return "auth-supabase";
   return void 0;
 }
-function hasPlaybook(gap) {
+function hasPlaybook(gap, inRepo) {
   try {
-    const provider2 = gapToPlaybookProvider(gap);
+    const provider2 = gapToPlaybookProvider(gap, inRepo);
     if (!provider2) return false;
     return PLAYBOOK_PROVIDERS.includes(provider2);
   } catch {
@@ -12553,13 +12496,20 @@ function buildProviderAction(gap, provider2) {
 }
 function buildTaskList(artifact) {
   const sorted = sortGapsByPriority(artifact.gaps);
+  const providers = providersInRepo(artifact);
+  const inRepo = providers ? new Set(providers.map((entry) => entry.provider.toLowerCase())) : void 0;
   return sorted.map((gap, index) => {
     const id = `TASK-${String(index + 1).padStart(3, "0")}`;
     let fixType;
     const migrationFile = rlsMigrationFile(gap);
-    if (hasRecipe(gap.id) || migrationFile) {
+    const location = locationsForGap(gap)[0];
+    const repoFixUserSteps = REPO_FIX_GAPS[gap.id];
+    const informational = INFORMATIONAL_GAPS[gap.id];
+    if (hasRecipe(gap.id) || migrationFile || repoFixUserSteps) {
       fixType = "repo-code";
-    } else if (hasPlaybook(gap)) {
+    } else if (informational) {
+      fixType = "manual-verify";
+    } else if (hasPlaybook(gap, inRepo)) {
       fixType = "provider-action";
     } else {
       fixType = "manual-verify";
@@ -12576,6 +12526,8 @@ function buildTaskList(artifact) {
     if (fixType === "repo-code" && !hasRecipe(gap.id) && migrationFile) {
       base.requiresUserAction = true;
       base.file = migrationFile;
+      base.userSteps = [APPLY_MIGRATION];
+      if (location?.file === migrationFile && location.line !== void 0) base.line = location.line;
       const target = rlsMigrationTarget(artifact.workspacePath, rlsEvidence2(gap.detail));
       if (target.ok) {
         base.mcpTool = "viberaven_heal_apply";
@@ -12587,6 +12539,28 @@ function buildTaskList(artifact) {
       if (gap.copyPrompt) {
         base.exactFix = gap.copyPrompt.trim();
       }
+    } else if (fixType === "repo-code" && !hasRecipe(gap.id) && repoFixUserSteps) {
+      base.requiresUserAction = false;
+      if (location) {
+        base.file = location.file;
+        if (location.line !== void 0) base.line = location.line;
+      } else {
+        base.action = "Edit the files named in the gap detail (`npx -y viberaven prompt --gap " + gap.id + "`).";
+      }
+      if (gap.copyPrompt) {
+        base.exactFix = gap.copyPrompt.trim();
+      }
+      base.userSteps = [...repoFixUserSteps];
+    } else if (fixType === "manual-verify" && informational) {
+      base.requiresUserAction = false;
+      base.action = informational;
+      if (location) {
+        base.file = location.file;
+        if (location.line !== void 0) base.line = location.line;
+      }
+      if (gap.copyPrompt) {
+        base.exactFix = gap.copyPrompt.trim();
+      }
     } else if (fixType === "repo-code") {
       base.mcpTool = "viberaven_heal_apply";
       base.mcpArgs = { gap: gap.id, yes: true };
@@ -12596,7 +12570,7 @@ function buildTaskList(artifact) {
       }
     } else if (fixType === "provider-action") {
       try {
-        const provider2 = gapToPlaybookProvider(gap);
+        const provider2 = gapToPlaybookProvider(gap, inRepo);
         if (provider2) {
           const pa = buildProviderAction(gap, provider2);
           if (pa) {
@@ -12614,7 +12588,7 @@ function buildTaskList(artifact) {
 }
 function buildTaskListMarkdown(tasks) {
   if (tasks.length === 0) {
-    return "# VibeRaven Agent Tasklist\n\n_No gaps found \u2014 production core looks solid._\n";
+    return "# VibeRaven Agent Tasklist\n\n_No gaps found in this scan._\n";
   }
   const lines = ["# VibeRaven Agent Tasklist", ""];
   for (const task of tasks) {
@@ -12622,7 +12596,7 @@ function buildTaskListMarkdown(tasks) {
     lines.push(`## ${task.id} \xB7 ${task.gapId} \xB7 ${severityLabel}`, "");
     lines.push(`**Fix type:** ${task.fixType}  `);
     if (task.file) {
-      lines.push(`**File:** \`${task.file}\`  `);
+      lines.push(`**File:** \`${task.file}${task.line !== void 0 ? `:${task.line}` : ""}\`  `);
     }
     if (task.action) {
       lines.push(`**Action:** ${task.action}  `);
@@ -12630,62 +12604,387 @@ function buildTaskListMarkdown(tasks) {
     if (task.exactFix) {
       lines.push(`**Exact fix:** ${task.exactFix}  `);
     } else {
-      lines.push(`**Exact fix:** No automated recipe \u2014 see scanner hint.  `);
+      lines.push(`**Exact fix:** No automated recipe; see the scanner hint in the gap detail.  `);
     }
     lines.push(`**Verify:** \`${task.verifyCommand}\`  `);
     if (task.mcpTool && task.mcpArgs) {
       lines.push(
-        `**MCP:** \`${task.mcpTool} ${JSON.stringify(task.mcpArgs)}\`  `
+        `**MCP:** \`${task.mcpTool} ${JSON.stringify(task.mcpArgs)}\`  `
+      );
+    }
+    lines.push(`**Requires user action:** ${task.requiresUserAction}`);
+    if (task.userSteps && task.userSteps.length > 0) {
+      lines.push("");
+      lines.push("**Outside the repo (needs the user):**");
+      for (const step of task.userSteps) lines.push(`- ${step}`);
+    }
+    if (task.providerAction) {
+      const pa = task.providerAction;
+      lines.push("");
+      lines.push("**Provider action:**");
+      lines.push(`- Provider: ${pa.provider}`);
+      lines.push(`- Dashboard: ${pa.dashboardUrl}`);
+      lines.push(`- Step: ${pa.exactStep}`);
+      if (pa.envKeyName) lines.push(`- Env key: \`${pa.envKeyName}\``);
+      if (pa.doneSignal) lines.push(`- Done when: ${pa.doneSignal}`);
+      if (pa.mcpAlternative) lines.push(`- MCP alternative: \`${pa.mcpAlternative}\``);
+    }
+    lines.push("");
+  }
+  return `${lines.join("\n")}
+`;
+}
+var PLAYBOOK_TOKEN;
+var init_buildTaskList = __esm({
+  "src/buildTaskList.ts"() {
+    "use strict";
+    init_commands();
+    init_rlsMigrationTarget();
+    init_gapLocations();
+    init_repoFixes();
+    init_detectedProviders();
+    init_loadPlaybook();
+    init_types2();
+    init_menu();
+    PLAYBOOK_TOKEN = { vercel: "vercel", stripe: "stripe", supabase: "supabase", "auth-supabase": "supabase" };
+  }
+});
+
+// src/contracts/gapEvidence.ts
+function summarizeGap(gap) {
+  return `${gap.title}. See the tasklist and original scan for redacted detail.`;
+}
+function evidenceFor2(gap) {
+  const kind = String(gap.primaryMapCategory);
+  const located = locationsForGap(gap).map((location) => ({ kind, ...location, redacted: true }));
+  return located.length > 0 ? located : [{ kind, redacted: true }];
+}
+function userStepsFor(gap) {
+  if (REPO_FIX_GAPS[gap.id]) return { userSteps: [...REPO_FIX_GAPS[gap.id]] };
+  if (rlsMigrationFile(gap)) return { userSteps: [APPLY_MIGRATION] };
+  return {};
+}
+function generateGapEvidenceFiles(artifact) {
+  return artifact.gaps.slice(0, 50).map((gap) => ({
+    path: `.viberaven/gaps/${gap.id}.json`,
+    content: {
+      $schema: "https://viberaven.dev/schemas/gap.schema.json",
+      schemaVersion: "v1",
+      id: gap.id,
+      severity: gap.severity,
+      capability: classifyGapCapability(gap),
+      title: gap.title,
+      summary: summarizeGap(gap),
+      evidence: evidenceFor2(gap),
+      commands: {
+        prompt: promptGapCommand(gap.id),
+        healPlan: healPlanGapCommand(gap.id),
+        verify: PUBLIC_VERIFY_COMMAND
+      },
+      ...userStepsFor(gap),
+      providerBoundary: REPO_ONLY_GAPS.has(gap.id) ? { requiresDashboardCheck: false, reason: "The fix is a repo change; no provider dashboard state is involved." } : { requiresDashboardCheck: true, reason: "Repo evidence cannot prove live provider dashboard state." }
+    }
+  }));
+}
+var init_gapEvidence = __esm({
+  "src/contracts/gapEvidence.ts"() {
+    "use strict";
+    init_capabilities();
+    init_gapLocations();
+    init_repoFixes();
+    init_buildTaskList();
+    init_commands();
+  }
+});
+
+// src/playbooks/checkMap.ts
+function mapCheckToPlaybook(check) {
+  if (CHECK_TO_PLAYBOOK[check.id]) {
+    return CHECK_TO_PLAYBOOK[check.id];
+  }
+  const providerKey = String(check.providerKey ?? "").toLowerCase();
+  if (providerKey.includes("vercel")) {
+    return "vercel";
+  }
+  if (providerKey.includes("stripe")) {
+    return "stripe";
+  }
+  if (providerKey.includes("supabase")) {
+    return check.area === "auth" ? "auth-supabase" : "supabase";
+  }
+  return void 0;
+}
+var CHECK_TO_PLAYBOOK;
+var init_checkMap = __esm({
+  "src/playbooks/checkMap.ts"() {
+    "use strict";
+    CHECK_TO_PLAYBOOK = {
+      "vercel-deployment": "vercel",
+      "vercel-project": "vercel",
+      "supabase-project": "supabase",
+      "supabase-env": "supabase",
+      "stripe-webhook": "stripe",
+      "stripe-product": "stripe",
+      "stripe-keys": "stripe"
+    };
+  }
+});
+
+// src/report/missionSelection.ts
+function normalizeProviderToken2(value) {
+  return value.toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "");
+}
+function missionMatchesProvider(mission, provider2) {
+  const current = normalizeProviderToken2(provider2);
+  return normalizeProviderToken2(mission.provider || mission.providerLabel || mission.key) === current || normalizeProviderToken2(mission.providerLabel || mission.provider || mission.key) === current;
+}
+function missionEvidenceScore(mission) {
+  const repoVerified = mission.checks.filter((check) => check.evidenceClass === "repo-verified" || check.status === "passed").length;
+  const missing = mission.checks.filter(
+    (check) => check.evidenceClass === "missing-repo-fix" || check.status === "missing" || check.status === "failed"
+  ).length;
+  return repoVerified * 100 + (mission.readinessPercent ?? 0) - missing;
+}
+function openChecksForMission(mission) {
+  if (!mission) {
+    return 0;
+  }
+  return mission.checks.filter(
+    (check) => check.status === "missing" || check.status === "failed" || check.status === "needs-connection"
+  ).length;
+}
+var init_missionSelection = __esm({
+  "src/report/missionSelection.ts"() {
+    "use strict";
+  }
+});
+
+// src/report/inRepoMissions.ts
+function detectedProviderTokens(artifact) {
+  const providers = providersInRepo(artifact);
+  if (!providers) return void 0;
+  return new Set(providers.map((entry) => normalizeProviderToken2(entry.provider)));
+}
+function missionInRepo(mission, detected) {
+  const provider2 = String(mission.provider || mission.key || "");
+  if (detected.has(normalizeProviderToken2(provider2))) return true;
+  if (PRACTICES.has(provider2)) return true;
+  const identity = mission.checks.find((check) => IDENTITY_CHECK.test(check.id));
+  return identity?.status === "passed";
+}
+function inRepoMissions(artifact, area) {
+  const missions = area.providerMissions ?? [];
+  const detected = detectedProviderTokens(artifact);
+  if (!detected) return missions;
+  const selected = artifact.selectedProviders?.[area.key] ?? "";
+  return missions.filter((mission) => missionInRepo(mission, detected) || selected && missionMatchesProvider(mission, selected));
+}
+function preferredInRepoMission(artifact, area) {
+  const missions = inRepoMissions(artifact, area);
+  if (missions.length === 0) return void 0;
+  const selected = artifact.selectedProviders?.[area.key] ?? "";
+  const picked = selected ? missions.find((mission) => missionMatchesProvider(mission, selected)) : void 0;
+  return picked ?? [...missions].sort((a, b3) => missionEvidenceScore(b3) - missionEvidenceScore(a))[0];
+}
+var IDENTITY_CHECK, PRACTICES, NONE_FOUND;
+var init_inRepoMissions = __esm({
+  "src/report/inRepoMissions.ts"() {
+    "use strict";
+    init_detectedProviders();
+    init_missionSelection();
+    IDENTITY_CHECK = /^(?:package-installed|package-or-config-found|package-or-widget-found|api-client-found|storybook-package-found|server-runtime-found|rails-runtime-found|go-runtime-found)$/;
+    PRACTICES = /* @__PURE__ */ new Set(["route-map", "product-spec", "secrets-hygiene"]);
+    NONE_FOUND = "none found";
+  }
+});
+
+// src/playbooks/manualChecks.ts
+function isManualProviderCheck(check) {
+  return check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown";
+}
+function collectManualChecks(artifact) {
+  const refs = [];
+  for (const area of artifact.missionGraph.areas ?? []) {
+    for (const mission of inRepoMissions(artifact, area)) {
+      for (const check of mission.checks) {
+        if (!isManualProviderCheck(check)) {
+          continue;
+        }
+        refs.push({
+          areaLabel: area.label,
+          providerLabel: mission.providerLabel,
+          check,
+          mapCategory: area.key
+        });
+      }
+    }
+  }
+  return refs;
+}
+var init_manualChecks = __esm({
+  "src/playbooks/manualChecks.ts"() {
+    "use strict";
+    init_inRepoMissions();
+  }
+});
+
+// src/resolveNextAction.ts
+function resolveNextAction(artifact) {
+  const repoGap = sortGapsByPriority(artifact.gaps)[0];
+  if (repoGap) {
+    return {
+      type: "repo-fix",
+      title: repoGap.title,
+      detail: repoGap.detail,
+      command: `viberaven prompt --gap ${repoGap.id}`
+    };
+  }
+  const manual = collectManualChecks(artifact)[0];
+  if (manual) {
+    const provider2 = mapCheckToPlaybook(manual.check);
+    let openUrl;
+    try {
+      openUrl = provider2 ? loadPlaybookSync(provider2).steps[0]?.openUrl : void 0;
+    } catch {
+      openUrl = void 0;
+    }
+    return {
+      type: "provider-guide",
+      title: manual.check.label,
+      detail: manual.check.promptHint || `Configure ${manual.providerLabel} in the provider dashboard (${manual.areaLabel}).`,
+      ...provider2 ? { provider: provider2, playbookStep: 1, command: `viberaven guide ${provider2} --step 1` } : {},
+      openUrl
+    };
+  }
+  return {
+    type: "done",
+    title: "No blockers found",
+    detail: "Re-scan after changes to confirm production readiness."
+  };
+}
+var init_resolveNextAction = __esm({
+  "src/resolveNextAction.ts"() {
+    "use strict";
+    init_checkMap();
+    init_loadPlaybook();
+    init_manualChecks();
+    init_menu();
+  }
+});
+
+// src/report/agentSummary.ts
+function sortGaps(gaps) {
+  return [...gaps].sort((a, b3) => {
+    const sev = SEVERITY_ORDER2[a.severity] - SEVERITY_ORDER2[b3.severity];
+    if (sev !== 0) {
+      return sev;
+    }
+    return a.title.localeCompare(b3.title);
+  });
+}
+function generateAgentSummary(artifact) {
+  const lines = [];
+  const topGaps = sortGaps(artifact.gaps).slice(0, 8);
+  lines.push("# VibeRaven agent summary", "");
+  lines.push(`Scanned: \`${artifact.workspacePath}\``);
+  lines.push(`At: ${artifact.scannedAt}`);
+  lines.push(
+    `Production core: **${artifact.productionCorePercent}%** \xB7 Model score: **${artifact.score}** (${artifact.scoreLabel})`
+  );
+  lines.push("");
+  const next = resolveNextAction(artifact);
+  lines.push("## Next action", "");
+  lines.push(`**${next.title}**: ${next.detail}`);
+  if (next.command) {
+    lines.push(`Command: \`${next.command}\``);
+  }
+  lines.push("");
+  lines.push("## Stack", "");
+  lines.push("The mission map below lists the providers detected in this repo. For a suggestion, run `npx -y viberaven stack recommend`.");
+  lines.push("");
+  lines.push("## Summary");
+  lines.push(artifact.summary || "_No summary returned._");
+  lines.push("");
+  lines.push("## Mission map (repo wiring)");
+  lines.push("");
+  lines.push("| Area | Provider | Readiness | Notes |");
+  lines.push("|------|----------|-----------|-------|");
+  for (const area of artifact.missionGraph.areas ?? []) {
+    const missions = inRepoMissions(artifact, area);
+    if (missions.length === 0 && (area.providerMissions ?? []).length > 0) {
+      lines.push(`| ${area.label} | ${NONE_FOUND} | - | - |`);
+    }
+    for (const mission of missions) {
+      const failed = mission.checks.filter(
+        (c) => c.status === "missing" || c.status === "failed" || c.status === "needs-connection"
+      ).length;
+      const notes = failed > 0 ? `${failed} open check${failed === 1 ? "" : "s"}` : `${mission.readinessPercent}% repo checks`;
+      lines.push(
+        `| ${area.label} | ${mission.providerLabel} | ${mission.readinessPercent}% | ${notes} |`
+      );
+    }
+  }
+  lines.push("");
+  lines.push("## Agent-code actions");
+  if (topGaps.length === 0) {
+    lines.push("_No model gaps returned. Review mission map checks before changing code._");
+  } else {
+    topGaps.forEach((gap, index) => {
+      lines.push(
+        `${index + 1}. **${gap.title}** (\`${gap.id}\`, ${gap.severity}, map: \`${gap.primaryMapCategory}\`)`
       );
-    }
-    lines.push(`**Requires user action:** ${task.requiresUserAction}`);
-    if (task.providerAction) {
-      const pa = task.providerAction;
-      lines.push("");
-      lines.push("**Provider action:**");
-      lines.push(`- Provider: ${pa.provider}`);
-      lines.push(`- Dashboard: ${pa.dashboardUrl}`);
-      lines.push(`- Step: ${pa.exactStep}`);
-      if (pa.envKeyName) lines.push(`- Env key: \`${pa.envKeyName}\``);
-      if (pa.doneSignal) lines.push(`- Done when: ${pa.doneSignal}`);
-      if (pa.mcpAlternative) lines.push(`- MCP alternative: \`${pa.mcpAlternative}\``);
-    }
-    lines.push("");
+      lines.push(`   - ${gap.detail}`);
+      lines.push(`   - Command: \`viberaven prompt --gap ${gap.id}\``);
+      if (gap.copyPrompt) {
+        lines.push(`   - Prompt: ${gap.copyPrompt}`);
+      }
+    });
+  }
+  const manualChecks = (artifact.missionGraph.areas ?? []).flatMap(
+    (area) => inRepoMissions(artifact, area).flatMap(
+      (mission) => mission.checks.filter(
+        (check) => check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown"
+      ).map((check) => ({ area: area.label, provider: mission.providerLabel, check }))
+    )
+  );
+  lines.push("");
+  lines.push("## Human-provider actions");
+  if (manualChecks.length === 0) {
+    lines.push("_No manual provider actions were identified in this scan._");
+  } else {
+    manualChecks.slice(0, 8).forEach((item4, index) => {
+      lines.push(`${index + 1}. **${item4.check.label}** (${item4.area} / ${item4.provider})`);
+      lines.push(
+        `   - ${item4.check.promptHint || "Ask the user to confirm this in the provider dashboard or through read-only MCP."}`
+      );
+    });
   }
+  lines.push("");
+  lines.push("Do not claim human-provider actions as repo-code fixes.");
+  lines.push("");
+  lines.push("## Agent workflow");
+  lines.push("1. Read `.viberaven/agent-tasklist.md` first for the production gate.");
+  lines.push("2. Read `.viberaven/launch-playbook.md` for the full checklist.");
+  lines.push("3. Run `viberaven next --json` - one action at a time.");
+  lines.push("4. Repo fix: `viberaven prompt --gap <id>` then implement.");
+  lines.push("5. Provider: `viberaven guide <provider> --step N` and `viberaven open <provider>`.");
+  lines.push(`6. Run \`${PUBLIC_VERIFY_COMMAND}\` to rescan and refresh \`.viberaven/agent-tasklist.md\`.`);
+  lines.push("");
   return `${lines.join("\n")}
 `;
 }
-var KNOWN_RECIPE_GAP_IDS;
-var init_buildTaskList = __esm({
-  "src/buildTaskList.ts"() {
+var SEVERITY_ORDER2;
+var init_agentSummary = __esm({
+  "src/report/agentSummary.ts"() {
     "use strict";
     init_commands();
-    init_rlsMigrationTarget();
-    init_loadPlaybook();
-    init_types2();
-    init_menu();
-    KNOWN_RECIPE_GAP_IDS = /* @__PURE__ */ new Set([
-      // emptyCatch (original recipe)
-      "empty-catch",
-      "empty_catch",
-      "emptyCatch",
-      // W3 env-add recipes
-      "auth_secret_missing",
-      "node_env_not_set",
-      "database_url_missing",
-      // W3 file-create recipes
-      "missing_error_boundary",
-      "missing_health_route",
-      "missing_loading_state",
-      "missing_404_page",
-      // W3 file-patch recipes
-      "missing_csp_header",
-      "missing_rate_limit",
-      "eslint_restricted_imports"
-      // NOTE: 'rls_disabled' is intentionally NOT here. When the finding comes from repo SQL it is a repo action whose
-      // recipe writes a new migration (see rlsMigrationFile and heal/recipes/supabaseRls.ts); without SQL evidence it
-      // stays a provider action and heal refuses.
-    ]);
+    init_resolveNextAction();
+    init_inRepoMissions();
+    SEVERITY_ORDER2 = {
+      critical: 0,
+      warning: 1,
+      info: 2
+    };
   }
 });
 
@@ -12695,12 +12994,21 @@ function generateLaunchPlaybook(artifact) {
   lines.push("# VibeRaven launch playbook", "");
   lines.push(`Generated from scan at ${artifact.scannedAt}. Work top to bottom.`, "");
   lines.push("## Repo fixes (agent code)", "");
-  const repoGaps = sortGapsByPriority(artifact.gaps);
+  const sorted = sortGapsByPriority(artifact.gaps);
+  const repoGaps = sorted.filter((gap) => !INFORMATIONAL_GAPS[gap.id]);
+  const informational = sorted.filter((gap) => INFORMATIONAL_GAPS[gap.id]);
   if (repoGaps.length === 0) {
     lines.push("_No repo-code gaps found._", "");
   } else {
     for (const gap of repoGaps) {
-      lines.push(`- [ ] ${gap.title} \u2014 \`viberaven prompt --gap ${gap.id}\``);
+      lines.push(`- [ ] ${gap.title}: \`viberaven prompt --gap ${gap.id}\``);
+    }
+    lines.push("");
+  }
+  if (informational.length > 0) {
+    lines.push("## Informational", "");
+    for (const gap of informational) {
+      lines.push(`- ${gap.title} (\`${gap.id}\`): ${INFORMATIONAL_GAPS[gap.id]}`);
     }
     lines.push("");
   }
@@ -12712,7 +13020,7 @@ function generateLaunchPlaybook(artifact) {
     for (const item4 of manuals) {
       const provider2 = mapCheckToPlaybook(item4.check);
       lines.push(
-        `- [ ] ${item4.check.label} (${item4.areaLabel}) \u2014 \`viberaven guide ${provider2} --step 1\``
+        provider2 ? `- [ ] ${item4.check.label} (${item4.areaLabel}): \`viberaven guide ${provider2} --step 1\`` : `- [ ] ${item4.check.label} (${item4.areaLabel})`
       );
     }
     lines.push("");
@@ -12733,6 +13041,7 @@ var init_launchPlaybook = __esm({
     init_manualChecks();
     init_menu();
     init_commands();
+    init_repoFixes();
   }
 });
 
@@ -13061,25 +13370,25 @@ var init_reportHtml = __esm({
 function getBundledReportAssetsDir() {
   const base = __dirname;
   const candidates = [
-    (0, import_node_path12.join)(base, "report"),
-    (0, import_node_path12.join)(base, "..", "assets", "report"),
-    (0, import_node_path12.join)(base, "..", "..", "assets", "report"),
-    (0, import_node_path12.join)(process.cwd(), "packages", "cli", "assets", "report"),
-    (0, import_node_path12.join)(process.cwd(), "assets", "report")
+    (0, import_node_path13.join)(base, "report"),
+    (0, import_node_path13.join)(base, "..", "assets", "report"),
+    (0, import_node_path13.join)(base, "..", "..", "assets", "report"),
+    (0, import_node_path13.join)(process.cwd(), "packages", "cli", "assets", "report"),
+    (0, import_node_path13.join)(process.cwd(), "assets", "report")
   ];
   for (const dir of candidates) {
-    if ((0, import_node_fs7.existsSync)((0, import_node_path12.join)(dir, "station.css"))) {
+    if ((0, import_node_fs8.existsSync)((0, import_node_path13.join)(dir, "station.css"))) {
       return dir;
     }
   }
   throw new Error("Report assets missing. Run `npm run sync-report-assets` and `npm run build` in packages/cli.");
 }
-var import_node_fs7, import_node_path12, REPORT_ASSET_FILES;
+var import_node_fs8, import_node_path13, REPORT_ASSET_FILES;
 var init_reportAssets = __esm({
   "src/report/reportAssets.ts"() {
     "use strict";
-    import_node_fs7 = require("node:fs");
-    import_node_path12 = require("node:path");
+    import_node_fs8 = require("node:fs");
+    import_node_path13 = require("node:path");
     REPORT_ASSET_FILES = [
       "station.css",
       "station.js",
@@ -13267,9 +13576,10 @@ function deriveRepoCodeAction(task) {
     gapId: task.gapId,
     readiness: [...askFirst ? [askFirst] : [], task.exactFix ?? "Repo-code fix is available"],
     target: task.file ? { type: "file", label: "Repo target", path: displayFile } : { type: "command", label: "Apply repo fix", command: task.mcpTool ?? `${PUBLIC_COMMAND} prompt --gap ${task.gapId}` },
-    fileTargets: task.file ? [{ path: displayFile, reason: task.exactFix }] : void 0,
+    fileTargets: task.file ? [{ path: displayFile, ...task.line !== void 0 ? { line: task.line } : {}, reason: task.exactFix }] : void 0,
     verifyCommand: verifyActionCommand("pending"),
-    resumeInstruction: `${task.title} is complete. Continue VibeRaven from pending.`,
+    resumeInstruction: `${task.title} is complete. Continue VibeRaven from pending.${task.userSteps?.length ? ` Then tell the user what is left outside the repo: ${task.userSteps.join(" ")}` : ""}`,
+    ...task.userSteps?.length ? { userSteps: [...task.userSteps] } : {},
     mcpTool: task.mcpTool,
     mcpArgs: task.mcpArgs,
     // Only a gap with an automatic recipe has a heal-apply fallback, and a task that needs the user's yes keeps it
@@ -13278,7 +13588,7 @@ function deriveRepoCodeAction(task) {
     ...task.requiresUserAction ? { requiresUserAction: true } : {}
   };
 }
-function deriveVerifyAction() {
+function deriveVerifyAction(waiting) {
   return {
     id: "pending",
     actionKey: buildActionKey({
@@ -13290,8 +13600,9 @@ function deriveVerifyAction() {
     revision: 1,
     kind: "verify",
     title: "Run Final Verification",
-    status: "blocked",
-    readiness: ["Run after provider and repo-code actions are complete"],
+    // Blocked only while repo-code or provider actions come first; with none left it is the next step.
+    status: waiting ? "blocked" : "active",
+    readiness: [waiting ? "Run after provider and repo-code actions are complete" : "No repo-code or provider actions left in this scan"],
     target: { type: "command", label: "Final strict gate", command: `${PUBLIC_COMMAND} --strict` },
     verifyCommand: `${PUBLIC_COMMAND} --strict`,
     resumeInstruction: "Final verification finished. Continue VibeRaven from pending."
@@ -13299,7 +13610,7 @@ function deriveVerifyAction() {
 }
 function deriveCurrentActions(input) {
   const primaryActions = input.tasks.filter((task) => task.fixType === "provider-action" || task.fixType === "repo-code").map((task) => task.fixType === "provider-action" ? deriveProviderAction(task) : deriveRepoCodeAction(task));
-  return [...primaryActions, deriveVerifyAction()];
+  return [...primaryActions, deriveVerifyAction(primaryActions.length > 0)];
 }
 var init_derive = __esm({
   "src/actions/derive.ts"() {
@@ -13314,7 +13625,7 @@ function emptyActionRegistry() {
   return { version: 1, nextId: 1, actions: {} };
 }
 function actionRegistryPath(cwd) {
-  return (0, import_node_path13.join)(getProjectArtifactsDir(cwd), "action-registry.json");
+  return (0, import_node_path14.join)(getProjectArtifactsDir(cwd), "action-registry.json");
 }
 async function loadActionRegistry(cwd) {
   try {
@@ -13386,7 +13697,8 @@ async function assignActionIds(input) {
         title: action.title,
         gapId: action.gapId,
         kind: action.kind,
-        provider: action.provider
+        provider: action.provider,
+        ...action.userSteps?.length ? { userSteps: [...action.userSteps] } : {}
       };
     } else {
       entry.status = "active";
@@ -13395,6 +13707,9 @@ async function assignActionIds(input) {
       entry.gapId = action.gapId;
       entry.kind = action.kind;
       entry.provider = action.provider;
+      if (action.userSteps?.length) entry.userSteps = [...action.userSteps];
+      else delete entry.userSteps;
+      delete entry.followUpShownAt;
       if (entry.fingerprint !== fingerprint) {
         entry.revision += 1;
         entry.fingerprint = fingerprint;
@@ -13418,16 +13733,27 @@ async function assignActionIds(input) {
   await saveActionRegistry(input.cwd, registry);
   return { actions, registry };
 }
+function pendingUserFollowUps(registry) {
+  return Object.values(registry.actions).filter((entry) => entry.status === "resolved" && entry.userSteps?.length && !entry.followUpShownAt).map((entry) => ({ id: entry.id, gapId: entry.gapId, title: entry.title, userSteps: [...entry.userSteps ?? []] }));
+}
+async function markUserFollowUpsShown(cwd, ids, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  if (ids.length === 0) return;
+  const registry = await loadActionRegistry(cwd);
+  for (const entry of Object.values(registry.actions)) {
+    if (ids.includes(entry.id)) entry.followUpShownAt = now;
+  }
+  await saveActionRegistry(cwd, registry);
+}
 async function resolveActionById(cwd, id) {
   const registry = await loadActionRegistry(cwd);
   return Object.values(registry.actions).find((entry) => entry.id === id);
 }
-var import_promises9, import_node_path13;
+var import_promises9, import_node_path14;
 var init_registry2 = __esm({
   "src/actions/registry.ts"() {
     "use strict";
     import_promises9 = require("node:fs/promises");
-    import_node_path13 = require("node:path");
+    import_node_path14 = require("node:path");
     init_config();
     init_canonical();
   }
@@ -13438,7 +13764,7 @@ function gateStatus2(artifact) {
   if (!Array.isArray(artifact.gaps)) {
     return "unknown";
   }
-  return artifact.gaps.length === 0 ? "clear" : "not_clear";
+  return gateStatusForGaps(artifact.gaps);
 }
 async function writeActionArtifacts(input) {
   const derived = deriveCurrentActions({
@@ -13459,7 +13785,9 @@ async function writeActionArtifacts(input) {
     gateStatus: gateStatus2(input.artifact),
     actions: assigned.actions
   };
-  const actionsPath = (0, import_node_path14.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const followUps = pendingUserFollowUps(assigned.registry);
+  if (followUps.length > 0) manifest.userFollowUps = followUps;
+  const actionsPath = (0, import_node_path15.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   await (0, import_promises10.writeFile)(actionsPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   return {
@@ -13468,13 +13796,14 @@ async function writeActionArtifacts(input) {
     manifest
   };
 }
-var import_promises10, import_node_path14;
+var import_promises10, import_node_path15;
 var init_artifacts = __esm({
   "src/actions/artifacts.ts"() {
     "use strict";
     import_promises10 = require("node:fs/promises");
-    import_node_path14 = require("node:path");
+    import_node_path15 = require("node:path");
     init_config();
+    init_gateResult();
     init_derive();
     init_registry2();
   }
@@ -13483,24 +13812,47 @@ var init_artifacts = __esm({
 // src/artifacts.ts
 async function copyReportAssets(reportAssetsDir) {
   const sourceDir = getBundledReportAssetsDir();
-  await (0, import_promises11.mkdir)((0, import_node_path15.join)(reportAssetsDir, "assets"), { recursive: true });
+  await (0, import_promises11.mkdir)((0, import_node_path16.join)(reportAssetsDir, "assets"), { recursive: true });
   for (const rel of REPORT_ASSET_FILES) {
-    await (0, import_promises11.copyFile)((0, import_node_path15.join)(sourceDir, rel), (0, import_node_path15.join)(reportAssetsDir, rel));
+    await (0, import_promises11.copyFile)((0, import_node_path16.join)(sourceDir, rel), (0, import_node_path16.join)(reportAssetsDir, rel));
+  }
+}
+async function isGapEvidenceFile(path) {
+  try {
+    return JSON.parse(await (0, import_promises11.readFile)(path, "utf8")).$schema === GAP_SCHEMA;
+  } catch {
+    return false;
+  }
+}
+async function removeStaleGapFiles(gapsDir, current) {
+  let entries;
+  try {
+    entries = await (0, import_promises11.readdir)(gapsDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".json") || current.has(entry.name)) continue;
+    const path = (0, import_node_path16.join)(gapsDir, entry.name);
+    try {
+      if (await isGapEvidenceFile(path)) await (0, import_promises11.rm)(path, { force: true });
+    } catch {
+    }
   }
 }
 async function writeScanArtifacts(options) {
   const cwd = options.cwd ?? options.artifact.workspacePath;
   const dir = getProjectArtifactsDir(cwd);
   await (0, import_promises11.mkdir)(dir, { recursive: true });
-  const jsonPath = (0, import_node_path15.join)(dir, "last-scan.json");
-  const gateResultPath = (0, import_node_path15.join)(dir, "gate-result.json");
-  const contextMapPath = (0, import_node_path15.join)(dir, "context-map.json");
-  const gapsDir = (0, import_node_path15.join)(dir, "gaps");
-  const tasklistPath = (0, import_node_path15.join)(dir, "agent-tasklist.md");
-  const summaryPath = (0, import_node_path15.join)(dir, "agent-summary.md");
-  const playbookPath = (0, import_node_path15.join)(dir, "launch-playbook.md");
-  const reportPath = (0, import_node_path15.join)(dir, "report.html");
-  const reportAssetsDir = (0, import_node_path15.join)(dir, "report");
+  const jsonPath = (0, import_node_path16.join)(dir, "last-scan.json");
+  const gateResultPath = (0, import_node_path16.join)(dir, "gate-result.json");
+  const contextMapPath = (0, import_node_path16.join)(dir, "context-map.json");
+  const gapsDir = (0, import_node_path16.join)(dir, "gaps");
+  const tasklistPath = (0, import_node_path16.join)(dir, "agent-tasklist.md");
+  const summaryPath = (0, import_node_path16.join)(dir, "agent-summary.md");
+  const playbookPath = (0, import_node_path16.join)(dir, "launch-playbook.md");
+  const reportPath = (0, import_node_path16.join)(dir, "report.html");
+  const reportAssetsDir = (0, import_node_path16.join)(dir, "report");
   await (0, import_promises11.mkdir)(gapsDir, { recursive: true });
   const safe2 = sanitizeArtifactForDisk(options.artifact);
   const json = `${JSON.stringify(safe2, null, 2)}
@@ -13510,26 +13862,27 @@ async function writeScanArtifacts(options) {
   const html = generateReportHtml(safe2);
   const tasks = buildTaskList(safe2);
   const tasklist = buildTaskListMarkdown(tasks);
-  const gateResult = `${JSON.stringify(generateGateResult(safe2), null, 2)}
+  const packageManager = detectPackageManager(options.artifact.workspacePath);
+  const gateResult = `${JSON.stringify(generateGateResult(safe2, { packageManager }), null, 2)}
 `;
-  const contextMap = `${JSON.stringify(generateContextMap(safe2), null, 2)}
+  const contextMap = `${JSON.stringify(generateContextMap(safe2, { packageManager }), null, 2)}
 `;
   const gapEvidenceFiles = generateGapEvidenceFiles(safe2);
   await copyReportAssets(reportAssetsDir);
   await (0, import_promises11.writeFile)(gateResultPath, gateResult, "utf-8");
   await (0, import_promises11.writeFile)(contextMapPath, contextMap, "utf-8");
   for (const gap of gapEvidenceFiles) {
-    await (0, import_promises11.writeFile)((0, import_node_path15.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path16.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
 `, "utf-8");
   }
   await (0, import_promises11.writeFile)(tasklistPath, tasklist, "utf-8");
   let architectureMapPath;
   if (typeof safe2.architectureMap === "string" && safe2.architectureMap.length > 0) {
-    architectureMapPath = (0, import_node_path15.join)(dir, "architecture-map.md");
+    architectureMapPath = (0, import_node_path16.join)(dir, "architecture-map.md");
     await (0, import_promises11.writeFile)(architectureMapPath, safe2.architectureMap, "utf-8");
   }
   if (safe2.architectureData) {
-    await (0, import_promises11.writeFile)((0, import_node_path15.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path16.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
 `, "utf-8");
   }
   await (0, import_promises11.writeFile)(jsonPath, json, "utf-8");
@@ -13542,6 +13895,7 @@ async function writeScanArtifacts(options) {
     tasks,
     paths: { reportPath, playbookPath }
   });
+  await removeStaleGapFiles(gapsDir, new Set(gapEvidenceFiles.map((gap) => `${gap.content.id}.json`)));
   return {
     dir,
     jsonPath,
@@ -13558,14 +13912,15 @@ async function writeScanArtifacts(options) {
     ...architectureMapPath ? { architectureMapPath } : {}
   };
 }
-var import_promises11, import_node_path15;
+var import_promises11, import_node_path16, GAP_SCHEMA;
 var init_artifacts2 = __esm({
   "src/artifacts.ts"() {
     "use strict";
     import_promises11 = require("node:fs/promises");
-    import_node_path15 = require("node:path");
+    import_node_path16 = require("node:path");
     init_contextMap();
     init_gateResult();
+    init_packageManager();
     init_gapEvidence();
     init_agentSummary();
     init_buildTaskList();
@@ -13575,6 +13930,7 @@ var init_artifacts2 = __esm({
     init_config();
     init_sanitizeArtifact();
     init_artifacts();
+    GAP_SCHEMA = "https://viberaven.dev/schemas/gap.schema.json";
   }
 });
 
@@ -13672,12 +14028,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
   ];
   if (platform === "win32") {
     const candidates = [
-      env.LOCALAPPDATA ? (0, import_node_path16.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path16.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path16.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.LOCALAPPDATA ? (0, import_node_path16.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path16.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path16.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path17.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path17.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path17.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path17.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path17.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path17.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
       "chrome",
       "msedge"
     ].filter(Boolean);
@@ -13711,7 +14067,7 @@ async function openWithSystemDefault(target) {
   });
 }
 async function spawnDetached(command) {
-  if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs8.existsSync)(command.command)) {
+  if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs9.existsSync)(command.command)) {
     throw new Error(`Browser not found: ${command.command}`);
   }
   await new Promise((resolve10, reject) => {
@@ -13754,13 +14110,13 @@ async function openUrlInBrowser(url) {
   }
   await openWithSystemDefault(trimmed);
 }
-var import_node_child_process4, import_node_fs8, import_node_path16;
+var import_node_child_process4, import_node_fs9, import_node_path17;
 var init_openBrowser = __esm({
   "src/openBrowser.ts"() {
     "use strict";
     import_node_child_process4 = require("node:child_process");
-    import_node_fs8 = require("node:fs");
-    import_node_path16 = require("node:path");
+    import_node_fs9 = require("node:fs");
+    import_node_path17 = require("node:path");
   }
 });
 
@@ -13817,9 +14173,9 @@ var init_clipboard = __esm({
   }
 });
 
-// ../../../../../VibeRice/packages/cli/node_modules/picocolors/picocolors.js
+// node_modules/picocolors/picocolors.js
 var require_picocolors = __commonJS({
-  "../../../../../VibeRice/packages/cli/node_modules/picocolors/picocolors.js"(exports2, module2) {
+  "node_modules/picocolors/picocolors.js"(exports2, module2) {
     var p2 = process || {};
     var argv = p2.argv || [];
     var env = p2.env || {};
@@ -13889,46 +14245,6 @@ var require_picocolors = __commonJS({
   }
 });
 
-// src/report/missionSelection.ts
-function normalizeProviderToken2(value) {
-  return value.toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "");
-}
-function missionMatchesProvider(mission, provider2) {
-  const current = normalizeProviderToken2(provider2);
-  return normalizeProviderToken2(mission.provider || mission.providerLabel || mission.key) === current || normalizeProviderToken2(mission.providerLabel || mission.provider || mission.key) === current;
-}
-function missionEvidenceScore(mission) {
-  const repoVerified = mission.checks.filter((check) => check.evidenceClass === "repo-verified" || check.status === "passed").length;
-  const missing = mission.checks.filter(
-    (check) => check.evidenceClass === "missing-repo-fix" || check.status === "missing" || check.status === "failed"
-  ).length;
-  return repoVerified * 100 + (mission.readinessPercent ?? 0) - missing;
-}
-function preferredMissionForArea(area, selectedProvider) {
-  const missions = area?.providerMissions ?? [];
-  if (missions.length === 0) {
-    return void 0;
-  }
-  const selected = selectedProvider ? missions.find((mission) => missionMatchesProvider(mission, selectedProvider)) : void 0;
-  if (selected) {
-    return selected;
-  }
-  return [...missions].sort((a, b3) => missionEvidenceScore(b3) - missionEvidenceScore(a))[0] ?? missions[0];
-}
-function openChecksForMission(mission) {
-  if (!mission) {
-    return 0;
-  }
-  return mission.checks.filter(
-    (check) => check.status === "missing" || check.status === "failed" || check.status === "needs-connection"
-  ).length;
-}
-var init_missionSelection = __esm({
-  "src/report/missionSelection.ts"() {
-    "use strict";
-  }
-});
-
 // src/statusLabels.ts
 function formatAgentStatus(label, message) {
   return `${label}: ${message}`;
@@ -13970,7 +14286,7 @@ function gapTagColor(modelGaps, open2) {
 }
 function manualActionCheckCount(artifact) {
   return (artifact.missionGraph.areas ?? []).reduce((areaTotal, area) => {
-    return areaTotal + area.providerMissions.reduce((missionTotal, mission) => {
+    return areaTotal + inRepoMissions(artifact, area).reduce((missionTotal, mission) => {
       return missionTotal + mission.checks.filter(
         (check) => check.evidenceClass === "manual-dashboard" || check.evidenceClass === "mcp-verifier" || check.evidenceSource === "provider" || check.evidenceSource === "mcp" || check.status === "needs-connection" || check.status === "unknown"
       ).length;
@@ -13991,8 +14307,14 @@ function printScanSummary(artifact, paths) {
   console.log(import_picocolors.default.dim("\u2514") + import_picocolors.default.dim("\u2500".repeat(width - 2)) + import_picocolors.default.dim("\u2518"));
   console.log("");
   for (const area of artifact.missionGraph.areas ?? []) {
-    const mission = preferredMissionForArea(area, artifact.selectedProviders?.[area.key] ?? "");
+    if ((area.providerMissions ?? []).length === 0) {
+      continue;
+    }
+    const mission = preferredInRepoMission(artifact, area);
     if (!mission) {
+      const modelGaps2 = artifact.gaps.filter((g2) => g2.primaryMapCategory === area.key).length;
+      const tag2 = modelGaps2 > 0 ? import_picocolors.default.red(`  GAP ${modelGaps2}`) : "";
+      console.log(`  ${import_picocolors.default.dim(area.label.padEnd(18))} ${import_picocolors.default.dim(NONE_FOUND)}${tag2}`);
       continue;
     }
     const open2 = openChecksForMission(mission);
@@ -14038,14 +14360,15 @@ var init_terminalSummary = __esm({
     "use strict";
     import_picocolors = __toESM(require_picocolors());
     init_missionSelection();
+    init_inRepoMissions();
     init_statusLabels();
     init_resolveNextAction();
   }
 });
 
-// ../../../../../VibeRice/packages/cli/node_modules/sisteransi/src/index.js
+// node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
-  "../../../../../VibeRice/packages/cli/node_modules/sisteransi/src/index.js"(exports2, module2) {
+  "node_modules/sisteransi/src/index.js"(exports2, module2) {
     "use strict";
     var ESC = "\x1B";
     var CSI = `${ESC}[`;
@@ -14099,7 +14422,7 @@ var require_src = __commonJS({
   }
 });
 
-// ../../../../../VibeRice/packages/cli/node_modules/@clack/core/dist/index.mjs
+// node_modules/@clack/core/dist/index.mjs
 function DD({ onlyFirst: e2 = false } = {}) {
   const t = ["[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?(?:\\u0007|\\u001B\\u005C|\\u009C))", "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
   return new RegExp(t, e2 ? void 0 : "g");
@@ -14211,7 +14534,7 @@ function fD({ input: e2 = import_node_process.stdin, output: u2 = import_node_pr
 }
 var import_sisteransi, import_node_process, g, import_node_readline, import_node_stream, uD, W, tD, eD, FD, sD, w, N, I, R, C, iD, rD, ED, d, oD, y, V, nD, G, _, z, K, aD, k, hD, lD, xD, B, AD, S, gD, vD, h, x, A, OD, PD, J, LD;
 var init_dist = __esm({
-  "../../../../../VibeRice/packages/cli/node_modules/@clack/core/dist/index.mjs"() {
+  "node_modules/@clack/core/dist/index.mjs"() {
     import_sisteransi = __toESM(require_src(), 1);
     import_node_process = require("node:process");
     g = __toESM(require("node:readline"), 1);
@@ -14461,13 +14784,13 @@ var init_dist = __esm({
   }
 });
 
-// ../../../../../VibeRice/packages/cli/node_modules/@clack/prompts/dist/index.mjs
+// node_modules/@clack/prompts/dist/index.mjs
 function ce() {
   return import_node_process2.default.platform !== "win32" ? import_node_process2.default.env.TERM !== "linux" : !!import_node_process2.default.env.CI || !!import_node_process2.default.env.WT_SESSION || !!import_node_process2.default.env.TERMINUS_SUBLIME || import_node_process2.default.env.ConEmuTask === "{cmd::Cmder}" || import_node_process2.default.env.TERM_PROGRAM === "Terminus-Sublime" || import_node_process2.default.env.TERM_PROGRAM === "vscode" || import_node_process2.default.env.TERM === "xterm-256color" || import_node_process2.default.env.TERM === "alacritty" || import_node_process2.default.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 var import_node_process2, import_picocolors2, import_sisteransi2, V2, u, le, L2, W2, C2, ue, o, d2, k2, P2, A2, T, F, $e, _2, me, de, pe, q, D, U, K2, b2, G2, ve, xe, Ie, Se, M2, J2, Y2;
 var init_dist2 = __esm({
-  "../../../../../VibeRice/packages/cli/node_modules/@clack/prompts/dist/index.mjs"() {
+  "node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist();
     init_dist();
     import_node_process2 = __toESM(require("node:process"), 1);
@@ -14700,7 +15023,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.6.2";
+    VERSION = "1.6.4";
   }
 });
 
@@ -15072,17 +15395,17 @@ async function initCursorRulesPack(options) {
   const pack = buildCursorRulesPack();
   for (const rule of pack) {
     const file = `${CURSOR_RULES_DIR}/${rule.filename}`;
-    const path = (0, import_node_path17.join)(options.cwd, file);
+    const path = (0, import_node_path18.join)(options.cwd, file);
     const existing = await readExistingFile(path);
     const changed = !existing.exists || existing.content !== rule.content;
     const action = !existing.exists ? "created" : changed ? "updated" : "unchanged";
     if (!options.dryRun && changed) {
-      await (0, import_promises12.mkdir)((0, import_node_path17.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
+      await (0, import_promises12.mkdir)((0, import_node_path18.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
       await (0, import_promises12.writeFile)(path, rule.content, "utf-8");
     }
     results.push({ target: "cursor", file, path, action });
   }
-  const legacyPath = (0, import_node_path17.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
+  const legacyPath = (0, import_node_path18.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
   if (!options.dryRun && await fileExists(legacyPath)) {
     await (0, import_promises12.rm)(legacyPath, { force: true });
   }
@@ -15109,12 +15432,12 @@ async function fileExists(path) {
 function isFileNotFoundError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises12, import_node_path17, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
+var import_promises12, import_node_path18, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
 var init_cursorRulesPack = __esm({
   "src/commands/cursorRulesPack.ts"() {
     "use strict";
     import_promises12 = require("node:fs/promises");
-    import_node_path17 = require("node:path");
+    import_node_path18 = require("node:path");
     init_commands();
     CURSOR_RULES_DIR = ".cursor/rules";
     LEGACY_CURSOR_RULE_FILE = `${CURSOR_RULES_DIR}/viberaven.mdc`;
@@ -15214,8 +15537,8 @@ var init_agentTargets = __esm({
 
 // src/commands/seedPackageJsonScripts.ts
 async function seedPackageJsonScripts(options) {
-  const packageJsonPath = (0, import_node_path18.join)(options.cwd, "package.json");
-  if (!(0, import_node_fs9.existsSync)(packageJsonPath)) {
+  const packageJsonPath = (0, import_node_path19.join)(options.cwd, "package.json");
+  if (!(0, import_node_fs10.existsSync)(packageJsonPath)) {
     return null;
   }
   const raw = await (0, import_promises13.readFile)(packageJsonPath, "utf-8");
@@ -15252,13 +15575,13 @@ async function seedPackageJsonScripts(options) {
   }
   return { action: "updated", added, skipped, changed: true };
 }
-var import_node_fs9, import_promises13, import_node_path18, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
+var import_node_fs10, import_promises13, import_node_path19, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
 var init_seedPackageJsonScripts = __esm({
   "src/commands/seedPackageJsonScripts.ts"() {
     "use strict";
-    import_node_fs9 = require("node:fs");
+    import_node_fs10 = require("node:fs");
     import_promises13 = require("node:fs/promises");
-    import_node_path18 = require("node:path");
+    import_node_path19 = require("node:path");
     init_commands();
     VIBERAVEN_PACKAGE_JSON_SCRIPTS = {
       "viberaven:gate": PUBLIC_AGENT_MODE_COMMAND,
@@ -15278,12 +15601,12 @@ async function initAgentRules(options) {
       continue;
     }
     const file = AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path19.join)(options.cwd, file);
+    const path = (0, import_node_path20.join)(options.cwd, file);
     const existing = await readExistingFile2(path);
     const injected = injectAgentRulesBlock(existing.content, renderAgentRulesForTarget(target));
     const action = !existing.exists ? "created" : injected.changed ? "updated" : "unchanged";
     if (!options.dryRun && injected.changed) {
-      await (0, import_promises14.mkdir)((0, import_node_path19.dirname)(path), { recursive: true });
+      await (0, import_promises14.mkdir)((0, import_node_path20.dirname)(path), { recursive: true });
       await (0, import_promises14.writeFile)(path, injected.content, "utf-8");
     }
     results.push({ target, file, path, action });
@@ -15363,12 +15686,12 @@ async function readExistingFile2(path) {
 function isFileNotFoundError2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises14, import_node_path19;
+var import_promises14, import_node_path20;
 var init_initRules = __esm({
   "src/commands/initRules.ts"() {
     "use strict";
     import_promises14 = require("node:fs/promises");
-    import_node_path19 = require("node:path");
+    import_node_path20 = require("node:path");
     init_agentRulesBlock();
     init_agentTargets();
     init_cursorRulesPack();
@@ -15631,7 +15954,7 @@ async function runInteractiveSession(startDir = process.cwd()) {
   Ie(`${import_picocolors4.default.bold("VibeRaven")} ${import_picocolors4.default.dim(VERSION)}`);
   const cwd = await resolveWorkspaceRoot(startDir);
   const artifactsAt = await findArtifactsWorkspace(startDir);
-  if (artifactsAt && (0, import_node_path20.resolve)(artifactsAt) !== (0, import_node_path20.resolve)(startDir)) {
+  if (artifactsAt && (0, import_node_path21.resolve)(artifactsAt) !== (0, import_node_path21.resolve)(startDir)) {
     M2.message(import_picocolors4.default.dim(`Using scan from: ${artifactsAt}`));
   } else {
     M2.message(import_picocolors4.default.dim(`Project folder: ${cwd}`));
@@ -15690,11 +16013,11 @@ async function runInteractiveSession(startDir = process.cwd()) {
   }
   Se(import_picocolors4.default.dim("Run viberaven anytime for the interactive menu."));
 }
-var import_node_path20, import_picocolors4;
+var import_node_path21, import_picocolors4;
 var init_runInteractive = __esm({
   "src/tui/runInteractive.ts"() {
     "use strict";
-    import_node_path20 = require("node:path");
+    import_node_path21 = require("node:path");
     init_dist2();
     import_picocolors4 = __toESM(require_picocolors());
     init_config();
@@ -15719,18 +16042,18 @@ var init_runInteractive = __esm({
 // src/commands/condense.ts
 async function runCondenseCommand(options) {
   const dir = getProjectArtifactsDir(options.cwd);
-  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path21.join)(dir, "last-scan.json"), "utf8"));
-  const contextMapPath = (0, import_node_path21.join)(dir, "context-map.json");
+  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path22.join)(dir, "last-scan.json"), "utf8"));
+  const contextMapPath = (0, import_node_path22.join)(dir, "context-map.json");
   await (0, import_promises15.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact), null, 2)}
 `, "utf8");
   return { contextMapPath };
 }
-var import_promises15, import_node_path21;
+var import_promises15, import_node_path22;
 var init_condense = __esm({
   "src/commands/condense.ts"() {
     "use strict";
     import_promises15 = require("node:fs/promises");
-    import_node_path21 = require("node:path");
+    import_node_path22 = require("node:path");
     init_config();
     init_contextMap();
   }
@@ -15738,9 +16061,9 @@ var init_condense = __esm({
 
 // src/heal/pathSafety.ts
 function assertSafeHealTarget(cwd, target) {
-  const root = (0, import_node_path22.resolve)(cwd);
-  const absolute = (0, import_node_path22.resolve)(root, target);
-  const rel = (0, import_node_path22.relative)(root, absolute);
+  const root = (0, import_node_path23.resolve)(cwd);
+  const absolute = (0, import_node_path23.resolve)(root, target);
+  const rel = (0, import_node_path23.relative)(root, absolute);
   if (rel.startsWith("..") || rel === "" || /^[A-Za-z]:/.test(rel)) {
     throw new Error("Heal target must stay inside the workspace");
   }
@@ -15750,11 +16073,11 @@ function assertSafeHealTarget(cwd, target) {
   }
   return absolute;
 }
-var import_node_path22, BLOCKED_SEGMENTS;
+var import_node_path23, BLOCKED_SEGMENTS;
 var init_pathSafety = __esm({
   "src/heal/pathSafety.ts"() {
     "use strict";
-    import_node_path22 = require("node:path");
+    import_node_path23 = require("node:path");
     BLOCKED_SEGMENTS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".viberaven"]);
   }
 });
@@ -15780,11 +16103,11 @@ function newHealId(now = /* @__PURE__ */ new Date()) {
   return `heal_${now.toISOString().replace(/\D/g, "").slice(0, 17)}_${(0, import_node_crypto.randomBytes)(3).toString("hex")}`;
 }
 async function createHealDir(cwd, makeId = () => newHealId()) {
-  const parent = (0, import_node_path23.join)(cwd, ".viberaven", "heal");
+  const parent = (0, import_node_path24.join)(cwd, ".viberaven", "heal");
   await (0, import_promises16.mkdir)(parent, { recursive: true });
   for (let attempt = 0; attempt < 10; attempt += 1) {
     const id = makeId();
-    const dir = (0, import_node_path23.join)(parent, id);
+    const dir = (0, import_node_path24.join)(parent, id);
     try {
       await (0, import_promises16.mkdir)(dir);
       return { id, dir };
@@ -15794,13 +16117,13 @@ async function createHealDir(cwd, makeId = () => newHealId()) {
   }
   throw new Error("Could not create a new heal directory under .viberaven/heal.");
 }
-var import_node_crypto, import_promises16, import_node_path23;
+var import_node_crypto, import_promises16, import_node_path24;
 var init_healId = __esm({
   "src/heal/healId.ts"() {
     "use strict";
     import_node_crypto = require("node:crypto");
     import_promises16 = require("node:fs/promises");
-    import_node_path23 = require("node:path");
+    import_node_path24 = require("node:path");
   }
 });
 
@@ -16267,7 +16590,7 @@ export const config = {
 // src/heal/recipes/eslintRestrictedImports.ts
 function detectEslintConfigFile(cwd) {
   for (const candidate of ESLINT_CONFIG_CANDIDATES) {
-    if ((0, import_node_fs10.existsSync)((0, import_node_path24.join)(cwd, candidate))) {
+    if ((0, import_node_fs11.existsSync)((0, import_node_path25.join)(cwd, candidate))) {
       return candidate;
     }
   }
@@ -16422,12 +16745,12 @@ function applyEslintRestrictedImportsRecipe(source, configFile) {
   }
   return applyLegacyModuleRecipe(source);
 }
-var import_node_fs10, import_node_path24, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
+var import_node_fs11, import_node_path25, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
 var init_eslintRestrictedImports = __esm({
   "src/heal/recipes/eslintRestrictedImports.ts"() {
     "use strict";
-    import_node_fs10 = require("node:fs");
-    import_node_path24 = require("node:path");
+    import_node_fs11 = require("node:fs");
+    import_node_path25 = require("node:path");
     init_commands();
     VIBERAVEN_ESLINT_MARKER = "VibeRaven heal: eslint_restricted_imports";
     RESTRICTED_IMPORTS_MESSAGE = `Restricted import. Run ${PUBLIC_AGENT_MODE_COMMAND} before substituting packages.`;
@@ -16478,13 +16801,13 @@ function defaultTargetFile(gapId) {
   return map[gapId];
 }
 async function readSourceOrEmpty(absolutePath) {
-  if (!(0, import_node_fs11.existsSync)(absolutePath)) return "";
+  if (!(0, import_node_fs12.existsSync)(absolutePath)) return "";
   return (0, import_promises17.readFile)(absolutePath, "utf8");
 }
 async function detectUpstash(cwd) {
   try {
-    const pkgPath = (0, import_node_path25.join)(cwd, "package.json");
-    if (!(0, import_node_fs11.existsSync)(pkgPath)) return false;
+    const pkgPath = (0, import_node_path26.join)(cwd, "package.json");
+    if (!(0, import_node_fs12.existsSync)(pkgPath)) return false;
     const raw = await (0, import_promises17.readFile)(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const deps = {
@@ -16500,7 +16823,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   const targetFile = explicitTarget ?? defaultTargetFile(gapId);
   if (targetFile === void 0) return null;
   if (gapId === "auth_secret_missing" || gapId === "node_env_not_set" || gapId === "database_url_missing") {
-    const absolutePath = (0, import_node_path25.join)(cwd, targetFile);
+    const absolutePath = (0, import_node_path26.join)(cwd, targetFile);
     const source = await readSourceOrEmpty(absolutePath);
     let result;
     if (gapId === "auth_secret_missing") result = applyAuthSecretRecipe(source);
@@ -16514,25 +16837,25 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
     };
   }
   if (gapId === "missing_error_boundary") {
-    const absolutePath = (0, import_node_path25.join)(cwd, "app/error.tsx");
+    const absolutePath = (0, import_node_path26.join)(cwd, "app/error.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyErrorBoundaryRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_health_route") {
-    const absolutePath = (0, import_node_path25.join)(cwd, "app/api/health/route.ts");
+    const absolutePath = (0, import_node_path26.join)(cwd, "app/api/health/route.ts");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyHealthRouteRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_loading_state") {
-    const absolutePath = (0, import_node_path25.join)(cwd, "app/loading.tsx");
+    const absolutePath = (0, import_node_path26.join)(cwd, "app/loading.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyLoadingStateRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_404_page") {
-    const absolutePath = (0, import_node_path25.join)(cwd, "app/not-found.tsx");
+    const absolutePath = (0, import_node_path26.join)(cwd, "app/not-found.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyNotFoundRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
@@ -16549,10 +16872,10 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_csp_header") {
     let configFile = "next.config.js";
-    let absolutePath = (0, import_node_path25.join)(cwd, configFile);
-    if (!(0, import_node_fs11.existsSync)(absolutePath)) {
+    let absolutePath = (0, import_node_path26.join)(cwd, configFile);
+    if (!(0, import_node_fs12.existsSync)(absolutePath)) {
       configFile = "next.config.mjs";
-      absolutePath = (0, import_node_path25.join)(cwd, configFile);
+      absolutePath = (0, import_node_path26.join)(cwd, configFile);
     }
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyCspHeaderRecipe(source);
@@ -16564,7 +16887,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_rate_limit") {
     const hasUpstash = await detectUpstash(cwd);
-    const middlewarePath = (0, import_node_path25.join)(cwd, "middleware.ts");
+    const middlewarePath = (0, import_node_path26.join)(cwd, "middleware.ts");
     const source = await readSourceOrEmpty(middlewarePath);
     const result = applyRateLimitRecipe(source, hasUpstash);
     return {
@@ -16586,7 +16909,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
         recipeName: gapId
       };
     }
-    const absolutePath = (0, import_node_path25.join)(cwd, configFile);
+    const absolutePath = (0, import_node_path26.join)(cwd, configFile);
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyEslintRestrictedImportsRecipe(source, configFile);
     return {
@@ -16600,13 +16923,13 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   return null;
 }
-var import_node_fs11, import_promises17, import_node_path25;
+var import_node_fs12, import_promises17, import_node_path26;
 var init_recipes = __esm({
   "src/heal/recipes/index.ts"() {
     "use strict";
-    import_node_fs11 = require("node:fs");
+    import_node_fs12 = require("node:fs");
     import_promises17 = require("node:fs/promises");
-    import_node_path25 = require("node:path");
+    import_node_path26 = require("node:path");
     init_envAuthSecret();
     init_envNodeEnv();
     init_envDatabaseUrl();
@@ -16683,16 +17006,16 @@ async function applyHeal(options) {
           rollback: { available: false, instructions: "Recipe matched but no change was needed (already applied or file already exists)." }
         };
       }
-      const absoluteTarget = (0, import_node_path26.join)(options.cwd, dispatched.targetFile);
+      const absoluteTarget = (0, import_node_path27.join)(options.cwd, dispatched.targetFile);
       assertSafeHealTarget(options.cwd, dispatched.targetFile);
-      await (0, import_promises18.mkdir)((0, import_node_path26.dirname)(absoluteTarget), { recursive: true });
+      await (0, import_promises18.mkdir)((0, import_node_path27.dirname)(absoluteTarget), { recursive: true });
       const created2 = await createHealDir(options.cwd);
       id = created2.id;
       const healDir2 = created2.dir;
-      await (0, import_promises18.mkdir)((0, import_node_path26.join)(healDir2, "before"));
-      const existedBefore = (0, import_node_fs12.existsSync)(absoluteTarget);
+      await (0, import_promises18.mkdir)((0, import_node_path27.join)(healDir2, "before"));
+      const existedBefore = (0, import_node_fs13.existsSync)(absoluteTarget);
       const beforeContent = existedBefore ? await (0, import_promises18.readFile)(absoluteTarget, "utf8") : "";
-      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
+      await (0, import_promises18.writeFile)((0, import_node_path27.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
       await (0, import_promises18.writeFile)(absoluteTarget, dispatched.output, "utf8");
       const patch2 = [
         `--- ${dispatched.targetFile}`,
@@ -16703,7 +17026,7 @@ async function applyHeal(options) {
         dispatched.output,
         ""
       ].join("\n");
-      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "patch.diff"), patch2, "utf8");
+      await (0, import_promises18.writeFile)((0, import_node_path27.join)(healDir2, "patch.diff"), patch2, "utf8");
       const result2 = {
         $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
         schemaVersion: "v1",
@@ -16715,17 +17038,17 @@ async function applyHeal(options) {
         recipe: dispatched.recipeName,
         ...dispatched.warnings?.length ? { warnings: dispatched.warnings } : {},
         target: dispatched.targetFile,
-        changedFiles: [(0, import_node_path26.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
+        changedFiles: [(0, import_node_path27.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
         artifacts: {
           patch: `.viberaven/heal/${id}/patch.diff`,
           result: `.viberaven/heal/${id}/result.json`
         },
         rollback: {
           available: true,
-          instructions: rollbackInstructions(id, (0, import_node_path26.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/"), existedBefore)
+          instructions: rollbackInstructions(id, (0, import_node_path27.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/"), existedBefore)
         }
       };
-      await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
+      await (0, import_promises18.writeFile)((0, import_node_path27.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
 `, "utf8");
       return result2;
     }
@@ -16765,8 +17088,8 @@ async function applyHeal(options) {
   const created = await createHealDir(options.cwd);
   id = created.id;
   const healDir = created.dir;
-  await (0, import_promises18.mkdir)((0, import_node_path26.join)(healDir, "before"));
-  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "before", "target.txt"), before, "utf8");
+  await (0, import_promises18.mkdir)((0, import_node_path27.join)(healDir, "before"));
+  await (0, import_promises18.writeFile)((0, import_node_path27.join)(healDir, "before", "target.txt"), before, "utf8");
   await (0, import_promises18.writeFile)(absolute, recipe.output, "utf8");
   const patch = [
     `--- ${options.target}`,
@@ -16777,7 +17100,7 @@ async function applyHeal(options) {
     recipe.output,
     ""
   ].join("\n");
-  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "patch.diff"), patch, "utf8");
+  await (0, import_promises18.writeFile)((0, import_node_path27.join)(healDir, "patch.diff"), patch, "utf8");
   const result = {
     $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
     schemaVersion: "v1",
@@ -16788,7 +17111,7 @@ async function applyHeal(options) {
     gapId: options.gapId,
     recipe: "empty-catch-safe-response",
     target: options.target,
-    changedFiles: [(0, import_node_path26.relative)(options.cwd, absolute).replace(/\\/g, "/")],
+    changedFiles: [(0, import_node_path27.relative)(options.cwd, absolute).replace(/\\/g, "/")],
     artifacts: {
       patch: `.viberaven/heal/${id}/patch.diff`,
       result: `.viberaven/heal/${id}/result.json`
@@ -16796,20 +17119,20 @@ async function applyHeal(options) {
     rollback: {
       available: true,
       // The empty-catch recipe only edits a file that already exists.
-      instructions: rollbackInstructions(id, (0, import_node_path26.relative)(options.cwd, absolute).replace(/\\/g, "/"), true)
+      instructions: rollbackInstructions(id, (0, import_node_path27.relative)(options.cwd, absolute).replace(/\\/g, "/"), true)
     }
   };
-  await (0, import_promises18.writeFile)((0, import_node_path26.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises18.writeFile)((0, import_node_path27.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises18, import_node_fs12, import_node_path26;
+var import_promises18, import_node_fs13, import_node_path27;
 var init_apply = __esm({
   "src/heal/apply.ts"() {
     "use strict";
     import_promises18 = require("node:fs/promises");
-    import_node_fs12 = require("node:fs");
-    import_node_path26 = require("node:path");
+    import_node_fs13 = require("node:fs");
+    import_node_path27 = require("node:path");
     init_pathSafety();
     init_emptyCatch();
     init_healId();
@@ -16819,7 +17142,7 @@ var init_apply = __esm({
 
 // src/heal/plan.ts
 async function writeHealPlan(options) {
-  const dir = (0, import_node_path27.join)(options.cwd, ".viberaven");
+  const dir = (0, import_node_path28.join)(options.cwd, ".viberaven");
   await (0, import_promises19.mkdir)(dir, { recursive: true });
   const id = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
@@ -16872,18 +17195,18 @@ async function writeHealPlan(options) {
     artifacts: { plan: ".viberaven/heal-plan.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises19.writeFile)((0, import_node_path27.join)(dir, "heal-plan.md"), markdown, "utf8");
-  await (0, import_promises19.writeFile)((0, import_node_path27.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises19.writeFile)((0, import_node_path28.join)(dir, "heal-plan.md"), markdown, "utf8");
+  await (0, import_promises19.writeFile)((0, import_node_path28.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises19, import_node_path27;
+var import_promises19, import_node_path28;
 var init_plan = __esm({
   "src/heal/plan.ts"() {
     "use strict";
     import_promises19 = require("node:fs/promises");
     init_healId();
-    import_node_path27 = require("node:path");
+    import_node_path28 = require("node:path");
     init_commands();
     init_supabaseRls2();
   }
@@ -16891,7 +17214,7 @@ var init_plan = __esm({
 
 // src/heal/prompt.ts
 async function writeHealPrompt(options) {
-  const dir = (0, import_node_path28.join)(options.cwd, ".viberaven");
+  const dir = (0, import_node_path29.join)(options.cwd, ".viberaven");
   await (0, import_promises20.mkdir)(dir, { recursive: true });
   const id = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
@@ -16919,16 +17242,16 @@ async function writeHealPrompt(options) {
     artifacts: { prompt: ".viberaven/heal-prompt.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises20.writeFile)((0, import_node_path28.join)(dir, "heal-prompt.md"), prompt, "utf8");
+  await (0, import_promises20.writeFile)((0, import_node_path29.join)(dir, "heal-prompt.md"), prompt, "utf8");
   return result;
 }
-var import_promises20, import_node_path28;
+var import_promises20, import_node_path29;
 var init_prompt = __esm({
   "src/heal/prompt.ts"() {
     "use strict";
     import_promises20 = require("node:fs/promises");
     init_healId();
-    import_node_path28 = require("node:path");
+    import_node_path29 = require("node:path");
     init_commands();
   }
 });
@@ -17031,8 +17354,8 @@ var init_heal = __esm({
 
 // src/stackRecommend.ts
 async function recommendStack(cwd = process.cwd()) {
-  const pkgPath = (0, import_node_path29.join)(cwd, "package.json");
-  if (!(0, import_node_fs13.existsSync)(pkgPath)) {
+  const pkgPath = (0, import_node_path30.join)(cwd, "package.json");
+  if (!(0, import_node_fs14.existsSync)(pkgPath)) {
     return DEFAULT_STACK;
   }
   const pkg = JSON.parse(await (0, import_promises22.readFile)(pkgPath, "utf-8"));
@@ -17063,13 +17386,13 @@ async function recommendStack(cwd = process.cwd()) {
   }
   return rec;
 }
-var import_promises22, import_node_fs13, import_node_path29, DEFAULT_STACK;
+var import_promises22, import_node_fs14, import_node_path30, DEFAULT_STACK;
 var init_stackRecommend = __esm({
   "src/stackRecommend.ts"() {
     "use strict";
     import_promises22 = require("node:fs/promises");
-    import_node_fs13 = require("node:fs");
-    import_node_path29 = require("node:path");
+    import_node_fs14 = require("node:fs");
+    import_node_path30 = require("node:path");
     DEFAULT_STACK = {
       frontend: "react",
       ui: "tailwind + shadcn/ui",
@@ -17212,13 +17535,13 @@ async function readBlobs(cwd, shas) {
 async function exportCommit(cwd, commit) {
   const entries = parseTree(await git(cwd, ["ls-tree", "-r", "-z", "-l", "--full-tree", commit])).filter(wanted);
   const blobs = await readBlobs(cwd, [...new Set(entries.map((entry) => entry.sha))]);
-  const root = await (0, import_promises23.mkdtemp)((0, import_node_path30.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
+  const root = await (0, import_promises23.mkdtemp)((0, import_node_path31.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
   for (const entry of entries) {
-    const target = (0, import_node_path30.resolve)(root, ...entry.path.split("/"));
-    if (!target.startsWith(root + import_node_path30.sep)) continue;
+    const target = (0, import_node_path31.resolve)(root, ...entry.path.split("/"));
+    if (!target.startsWith(root + import_node_path31.sep)) continue;
     const content = blobs.get(entry.sha);
     if (!content) continue;
-    await (0, import_promises23.mkdir)((0, import_node_path30.dirname)(target), { recursive: true });
+    await (0, import_promises23.mkdir)((0, import_node_path31.dirname)(target), { recursive: true });
     await (0, import_promises23.writeFile)(target, content);
   }
   return root;
@@ -17288,14 +17611,14 @@ function renderCheckMarkdown({ head, change, version, score }) {
   return `${lines.join("\n")}
 `;
 }
-var import_node_child_process6, import_promises23, import_node_os, import_node_path30, import_node_util4, execFileAsync4, MAX_BLOB_BYTES, SKIP_SEGMENTS, SEVERITY_RANK3, LOCATION_TEXT, SUBJECT, COMMENT_MARKER, DOT;
+var import_node_child_process6, import_promises23, import_node_os, import_node_path31, import_node_util4, execFileAsync4, MAX_BLOB_BYTES, SKIP_SEGMENTS, SEVERITY_RANK3, LOCATION_TEXT, SUBJECT, COMMENT_MARKER, DOT;
 var init_checkChange = __esm({
   "src/commands/checkChange.ts"() {
     "use strict";
     import_node_child_process6 = require("node:child_process");
     import_promises23 = require("node:fs/promises");
     import_node_os = require("node:os");
-    import_node_path30 = require("node:path");
+    import_node_path31 = require("node:path");
     import_node_util4 = require("node:util");
     init_runScan();
     init_safeGit();
@@ -17379,12 +17702,12 @@ async function hasGithubRemote(cwd) {
   }
 }
 async function githubWorkflowStatus(cwd) {
-  return { exists: (0, import_node_fs14.existsSync)((0, import_node_path31.join)(cwd, WORKFLOW_PATH)), path: DISPLAY_PATH, onGithub: await hasGithubRemote(cwd) };
+  return { exists: (0, import_node_fs15.existsSync)((0, import_node_path32.join)(cwd, WORKFLOW_PATH)), path: DISPLAY_PATH, onGithub: await hasGithubRemote(cwd) };
 }
 async function writeGithubWorkflow(cwd, options = {}) {
-  const target = (0, import_node_path31.join)(cwd, WORKFLOW_PATH);
-  if ((0, import_node_fs14.existsSync)(target) && !options.force) return { written: false, status: await githubWorkflowStatus(cwd) };
-  await (0, import_promises24.mkdir)((0, import_node_path31.dirname)(target), { recursive: true });
+  const target = (0, import_node_path32.join)(cwd, WORKFLOW_PATH);
+  if ((0, import_node_fs15.existsSync)(target) && !options.force) return { written: false, status: await githubWorkflowStatus(cwd) };
+  await (0, import_promises24.mkdir)((0, import_node_path32.dirname)(target), { recursive: true });
   await (0, import_promises24.writeFile)(target, renderWorkflow(), "utf8");
   return { written: true, status: await githubWorkflowStatus(cwd) };
 }
@@ -17409,20 +17732,20 @@ async function runInitGithubCommand(options) {
   if (!status.onGithub) console.log("This repository has no github.com remote yet: the workflow runs once it is pushed to GitHub.");
   return 0;
 }
-var import_node_child_process7, import_node_fs14, import_promises24, import_node_path31, import_node_util5, execFileAsync5, WORKFLOW_PATH, DISPLAY_PATH;
+var import_node_child_process7, import_node_fs15, import_promises24, import_node_path32, import_node_util5, execFileAsync5, WORKFLOW_PATH, DISPLAY_PATH;
 var init_initGithub = __esm({
   "src/commands/initGithub.ts"() {
     "use strict";
     import_node_child_process7 = require("node:child_process");
-    import_node_fs14 = require("node:fs");
+    import_node_fs15 = require("node:fs");
     import_promises24 = require("node:fs/promises");
-    import_node_path31 = require("node:path");
+    import_node_path32 = require("node:path");
     import_node_util5 = require("node:util");
     init_safeGit();
     init_version();
     init_checkChange();
     execFileAsync5 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
-    WORKFLOW_PATH = (0, import_node_path31.join)(".github", "workflows", "viberaven.yml");
+    WORKFLOW_PATH = (0, import_node_path32.join)(".github", "workflows", "viberaven.yml");
     DISPLAY_PATH = ".github/workflows/viberaven.yml";
   }
 });
@@ -17446,7 +17769,7 @@ function managedBlocks(content) {
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item4 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists = await fileExists2((0, import_node_path32.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path33.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
@@ -17454,17 +17777,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item4 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists = await fileExists2((0, import_node_path32.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path33.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
       message: exists ? `${item4.file} exists` : `Missing ${item4.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path32.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path33.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
     const legacyContent = await (0, import_promises25.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path32.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const hasCoreSplit = await fileExists2((0, import_node_path33.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -17475,7 +17798,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path32.join)(cwd, file);
+    const path = (0, import_node_path33.join)(cwd, file);
     const exists = await fileExists2(path);
     if (!exists) {
       checks.push({
@@ -17534,12 +17857,12 @@ async function fileExists2(path) {
     return false;
   }
 }
-var import_promises25, import_node_path32, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
+var import_promises25, import_node_path33, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
 var init_doctorAgents = __esm({
   "src/commands/doctorAgents.ts"() {
     "use strict";
     import_promises25 = require("node:fs/promises");
-    import_node_path32 = require("node:path");
+    import_node_path33 = require("node:path");
     init_commands();
     init_agentTargets();
     REQUIRED_EXISTENCE_CHECKS = [
@@ -17810,7 +18133,7 @@ function buildContextCleanupPlan(input) {
   const items = [];
   const seen = /* @__PURE__ */ new Set();
   for (const file of input.files) {
-    const path = normalizePath5((0, import_node_path33.relative)(input.projectRoot, file.path) || file.path);
+    const path = normalizePath5((0, import_node_path34.relative)(input.projectRoot, file.path) || file.path);
     const fullPath = normalizePath5(file.path);
     const category = categorizeCleanupFile(path, fullPath, file);
     if (!category || seen.has(path)) {
@@ -17836,8 +18159,8 @@ async function collectCleanupFiles(projectRoot) {
   return files;
 }
 async function writeCleanupPlan(projectRoot, plan) {
-  const outputDir = (0, import_node_path33.join)(projectRoot, ".viberaven");
-  const outputPath = (0, import_node_path33.join)(outputDir, "context-cleanup.md");
+  const outputDir = (0, import_node_path34.join)(projectRoot, ".viberaven");
+  const outputPath = (0, import_node_path34.join)(outputDir, "context-cleanup.md");
   await (0, import_promises26.mkdir)(outputDir, { recursive: true });
   await (0, import_promises26.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
   return outputPath;
@@ -17895,9 +18218,9 @@ async function walkCleanupFiles(root, dir, result, depth) {
     if (SKIP_DIRECTORIES.has(entry.name)) {
       continue;
     }
-    const absolute = (0, import_node_path33.join)(dir, entry.name);
+    const absolute = (0, import_node_path34.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (isCachePath(normalizePath5((0, import_node_path33.relative)(root, absolute)))) {
+      if (isCachePath(normalizePath5((0, import_node_path34.relative)(root, absolute)))) {
         result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
         continue;
       }
@@ -17918,12 +18241,12 @@ async function walkCleanupFiles(root, dir, result, depth) {
 function normalizePath5(path) {
   return path.replace(/\\/g, "/");
 }
-var import_promises26, import_node_path33, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
+var import_promises26, import_node_path34, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
 var init_cleanPlan = __esm({
   "src/commands/cleanPlan.ts"() {
     "use strict";
     import_promises26 = require("node:fs/promises");
-    import_node_path33 = require("node:path");
+    import_node_path34 = require("node:path");
     MAX_WALK_DEPTH = 5;
     LARGE_LOG_BYTES = 8192;
     SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -18001,6 +18324,9 @@ function renderVerifyCommand(action) {
   }
   return ["Verify:", "```bash", redact(action.verifyCommand), "```"];
 }
+function renderUserSteps(steps) {
+  return steps?.length ? ["Outside the repo (tell the user):", ...steps.map((step) => `- ${redact(step)}`)] : [];
+}
 function renderAction(action) {
   return [
     `[${action.id}] ${redact(action.title)}`,
@@ -18009,6 +18335,7 @@ function renderAction(action) {
     ...renderTarget(action.target),
     ...renderCopyPayload(action),
     ...renderVerifyCommand(action),
+    ...renderUserSteps(action.userSteps),
     action.resumeInstruction ? `Resume: "${redact(action.resumeInstruction)}"` : void 0
   ].filter((line) => Boolean(line));
 }
@@ -18024,6 +18351,9 @@ function renderActionSurface(manifest, options = {}) {
   for (const action of visibleActions) {
     lines.push(...renderAction(action), "");
   }
+  for (const followUp of options.followUps === false ? [] : manifest.userFollowUps ?? []) {
+    lines.push(`[${followUp.id}] ${redact(followUp.title ?? followUp.gapId ?? "Fixed in the repo")}`, "Status: resolved in the repo", ...renderUserSteps(followUp.userSteps), "");
+  }
   return `${lines.join("\n").trimEnd()}
 `;
 }
@@ -18036,7 +18366,7 @@ var init_render = __esm({
 
 // src/commands/actions.ts
 async function runActionsCommand(input) {
-  const actionsPath = (0, import_node_path34.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path35.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   let raw;
   try {
     raw = await (0, import_promises27.readFile)(actionsPath, "utf8");
@@ -18053,12 +18383,12 @@ async function runActionsCommand(input) {
   process.stdout.write(renderActionSurface(manifest));
   return 0;
 }
-var import_promises27, import_node_path34;
+var import_promises27, import_node_path35;
 var init_actions = __esm({
   "src/commands/actions.ts"() {
     "use strict";
     import_promises27 = require("node:fs/promises");
-    import_node_path34 = require("node:path");
+    import_node_path35 = require("node:path");
     init_render();
     init_config();
   }
@@ -18067,7 +18397,7 @@ var init_actions = __esm({
 // src/commands/verifyAction.ts
 async function currentActionExists(cwd, actionId) {
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path35.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
     const manifest = JSON.parse(raw);
     return manifest.actions.some((action) => action.id === actionId);
   } catch {
@@ -18111,12 +18441,12 @@ This only looks the action up. Run \`npx -y viberaven --verify\` to scan the rep
   );
   return 0;
 }
-var import_promises28, import_node_path35;
+var import_promises28, import_node_path36;
 var init_verifyAction = __esm({
   "src/commands/verifyAction.ts"() {
     "use strict";
     import_promises28 = require("node:fs/promises");
-    import_node_path35 = require("node:path");
+    import_node_path36 = require("node:path");
     init_registry2();
     init_config();
   }
@@ -18271,6 +18601,7 @@ ${message}
     return failing ? 1 : 0;
   }
   if (options.json) {
+    const userFollowUps = await readUserFollowUps(paths.actionsPath);
     console.log(
       JSON.stringify(
         {
@@ -18293,6 +18624,8 @@ ${message}
               unchanged: change.unchanged.map((gap) => gap.id)
             }
           } : {},
+          // Steps outside the repo for fixes already in it (MCP check and verify read this). Read only.
+          ...userFollowUps.length > 0 ? { userFollowUps } : {},
           artifacts: paths
         },
         null,
@@ -18347,14 +18680,31 @@ ${message}
   console.log(
     critical > 0 ? `Verdict: \u274C ${critical} blocker${critical === 1 ? "" : "s"}, ${warnings} warning${warnings === 1 ? "" : "s"} \xB7 score ${artifact.score}` : `Verdict: \u2705 no blockers, ${warnings} warning${warnings === 1 ? "" : "s"} \xB7 score ${artifact.score}`
   );
+  await printUserFollowUps(paths.actionsPath);
   console.log(`Fix: viberaven fix \xB7 Details: ${paths.tasklistPath}`);
   console.log("");
   return critical > 0 ? 1 : 0;
 }
-var SEVERITY_ICON, SEVERITY_ORDER3;
+async function readUserFollowUps(actionsPath) {
+  try {
+    return JSON.parse(await (0, import_promises29.readFile)(actionsPath, "utf8")).userFollowUps ?? [];
+  } catch {
+    return [];
+  }
+}
+async function printUserFollowUps(actionsPath) {
+  const followUps = await readUserFollowUps(actionsPath);
+  if (followUps.length === 0) return;
+  console.log("Outside the repo, still on you:");
+  for (const followUp of followUps) {
+    for (const step of followUp.userSteps) console.log(`  - ${step} (${followUp.gapId ?? followUp.id})`);
+  }
+}
+var import_promises29, SEVERITY_ICON, SEVERITY_ORDER3;
 var init_check = __esm({
   "src/commands/check.ts"() {
     "use strict";
+    import_promises29 = require("node:fs/promises");
     init_runScan();
     init_artifacts2();
     init_statusLabels();
@@ -18803,8 +19153,8 @@ function isSqlError(error) {
 }
 function displayPath(projectDir, path) {
   for (const base of [projectDir, process.cwd()]) {
-    const rel = (0, import_node_path36.relative)(base, path);
-    if (rel && !rel.startsWith("..") && !(0, import_node_path36.isAbsolute)(rel)) return rel.split("\\").join("/");
+    const rel = (0, import_node_path37.relative)(base, path);
+    if (rel && !rel.startsWith("..") && !(0, import_node_path37.isAbsolute)(rel)) return rel.split("\\").join("/");
   }
   return path;
 }
@@ -19408,26 +19758,26 @@ function verdictFor(summary) {
 }
 async function listMigrations(dir) {
   try {
-    const entries = await (0, import_promises29.readdir)(dir, { withFileTypes: true });
+    const entries = await (0, import_promises30.readdir)(dir, { withFileTypes: true });
     return entries.filter((e2) => e2.isFile() && /\.sql$/i.test(e2.name) && !e2.name.startsWith(".")).map((e2) => e2.name).sort((a, b3) => a < b3 ? -1 : a > b3 ? 1 : 0);
   } catch {
     return [];
   }
 }
 async function runRlsTest(options) {
-  const projectDir = (0, import_node_path36.resolve)(options.projectDir);
-  const matrixPath = (0, import_node_path36.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
-  const migrationsDir = (0, import_node_path36.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path36.join)("supabase", "migrations"));
+  const projectDir = (0, import_node_path37.resolve)(options.projectDir);
+  const matrixPath = (0, import_node_path37.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
+  const migrationsDir = (0, import_node_path37.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path37.join)("supabase", "migrations"));
   const timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
-  if ((0, import_node_path36.basename)(matrixPath).toLowerCase().startsWith(".env")) {
-    throw new RlsInputError(`Refusing to read ${(0, import_node_path36.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
+  if ((0, import_node_path37.basename)(matrixPath).toLowerCase().startsWith(".env")) {
+    throw new RlsInputError(`Refusing to read ${(0, import_node_path37.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
   }
   const filesRead = [];
   let matrixText;
   try {
-    const info = await (0, import_promises29.stat)(matrixPath);
+    const info = await (0, import_promises30.stat)(matrixPath);
     if (!info.isFile()) throw new Error("not a file");
-    matrixText = normalise(await (0, import_promises29.readFile)(matrixPath, "utf8"));
+    matrixText = normalise(await (0, import_promises30.readFile)(matrixPath, "utf8"));
   } catch {
     throw new RlsInputError(
       `No permissions matrix at ${matrixPath}. Write one by hand (schema: schemas/permissions-matrix.schema.json in the @viberaven/cli package); rls-test never infers it from your policies.`
@@ -19438,8 +19788,8 @@ async function runRlsTest(options) {
   const names = await listMigrations(migrationsDir);
   const migrationFiles = [];
   for (const name of names) {
-    const sql = normalise(await (0, import_promises29.readFile)((0, import_node_path36.join)(migrationsDir, name), "utf8"));
-    filesRead.push(displayPath(projectDir, (0, import_node_path36.join)(migrationsDir, name)));
+    const sql = normalise(await (0, import_promises30.readFile)((0, import_node_path37.join)(migrationsDir, name), "utf8"));
+    filesRead.push(displayPath(projectDir, (0, import_node_path37.join)(migrationsDir, name)));
     migrationFiles.push({ name, sha256: sha256(sql), sql });
   }
   const migrationsHash = sha256(migrationFiles.map((f) => `${f.name}\0${f.sha256}`).join("\n"));
@@ -19639,15 +19989,15 @@ async function runTable(db, table2, badRoles, roleChecks) {
     cells
   };
 }
-var import_node_child_process8, import_node_crypto3, import_promises29, import_node_net, import_node_path36, import_node_util6, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine2, plural3, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
+var import_node_child_process8, import_node_crypto3, import_promises30, import_node_net, import_node_path37, import_node_util6, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine2, plural3, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
 var init_rlsRunner = __esm({
   "src/rls/rlsRunner.ts"() {
     "use strict";
     import_node_child_process8 = require("node:child_process");
     import_node_crypto3 = require("node:crypto");
-    import_promises29 = require("node:fs/promises");
+    import_promises30 = require("node:fs/promises");
     import_node_net = __toESM(require("node:net"));
-    import_node_path36 = require("node:path");
+    import_node_path37 = require("node:path");
     import_node_util6 = require("node:util");
     init_safeGit();
     init_permissionsMatrix();
@@ -20475,7 +20825,7 @@ function buildMissionCards(artifact, providers) {
   };
 }
 function projectNameFromPath(pathValue) {
-  return (0, import_node_path37.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
+  return (0, import_node_path38.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
 }
 function gapSearchText(gap) {
   return [
@@ -20666,7 +21016,7 @@ function mapProvider(template, artifact, projectName) {
   const gaps = providerGaps(artifact, template.id);
   const primaryGap2 = gaps[0];
   const state = providerState(gaps);
-  const launchGateClear = artifact.gaps.length === 0 && artifact.score >= 80;
+  const launchGateClear = gateStatusForGaps(artifact.gaps) === "clear";
   const launchPath = template.items.map((item4, index) => ({
     ...item4,
     state: itemState(primaryGap2, index, item4, launchGateClear),
@@ -20875,8 +21225,9 @@ function mapArtifactToLocalUiState(artifact, presentProviderIds) {
       scannedAt: artifact.scannedAt
     },
     gate: {
-      status: artifact.gaps.length === 0 && artifact.score >= 80 ? "clear" : "not_clear",
-      label: artifact.gaps.length === 0 && artifact.score >= 80 ? "Ready" : "Gate not clear",
+      // The same rule as gate-result.json, so the Studio never shows a different verdict.
+      status: gateStatusForGaps(artifact.gaps),
+      label: GATE_LABEL[gateStatusForGaps(artifact.gaps)],
       score: artifact.score,
       productionCorePercent: artifact.productionCorePercent
     },
@@ -20886,25 +21237,31 @@ function mapArtifactToLocalUiState(artifact, presentProviderIds) {
     selectedProviderId: selectedProvider.id,
     currentPrompt: selectedProvider.nextFix?.prompt ?? "",
     artifacts: {
-      tasklist: (0, import_node_path37.join)(".viberaven", "agent-tasklist.md"),
-      contextMap: (0, import_node_path37.join)(".viberaven", "context-map.json"),
-      gateResult: (0, import_node_path37.join)(".viberaven", "gate-result.json"),
-      lastScan: (0, import_node_path37.join)(".viberaven", "last-scan.json")
+      tasklist: (0, import_node_path38.join)(".viberaven", "agent-tasklist.md"),
+      contextMap: (0, import_node_path38.join)(".viberaven", "context-map.json"),
+      gateResult: (0, import_node_path38.join)(".viberaven", "gate-result.json"),
+      lastScan: (0, import_node_path38.join)(".viberaven", "last-scan.json")
     },
     empty: false
   };
 }
-var import_node_path37, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
+var import_node_path38, GATE_LABEL, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
 var init_artifactAdapter = __esm({
   "src/local-ui/artifactAdapter.ts"() {
     "use strict";
-    import_node_path37 = require("node:path");
+    import_node_path38 = require("node:path");
     init_providerLogos();
     init_buildTaskList();
     init_prompts();
     init_providerLaunchPaths();
     init_launchRunway();
     init_providerGrade();
+    init_gateResult();
+    GATE_LABEL = {
+      clear: "No blockers in repo checks",
+      warning: "Warnings to review",
+      not_clear: "Gate not clear"
+    };
     CONNECT_PROVIDER_PRIORITY = ["supabase", "vercel", "stripe"];
     providerDashboardUrls = {
       supabase: "https://supabase.com/dashboard/projects",
@@ -21201,18 +21558,18 @@ var init_planLimits = __esm({
 // src/hosted/credentials.ts
 function defaultConfigDir(env = process.env, platform = process.platform) {
   const override = env.VIBERAVEN_CONFIG_DIR?.trim();
-  if (override) return (0, import_node_path38.resolve)(override);
+  if (override) return (0, import_node_path39.resolve)(override);
   if (platform === "win32") {
-    return (0, import_node_path38.join)(env.APPDATA?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), "AppData", "Roaming"), "viberaven");
+    return (0, import_node_path39.join)(env.APPDATA?.trim() || (0, import_node_path39.join)((0, import_node_os2.homedir)(), "AppData", "Roaming"), "viberaven");
   }
   if (platform === "darwin") {
-    return (0, import_node_path38.join)((0, import_node_os2.homedir)(), "Library", "Application Support", "viberaven");
+    return (0, import_node_path39.join)((0, import_node_os2.homedir)(), "Library", "Application Support", "viberaven");
   }
-  return (0, import_node_path38.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), ".config"), "viberaven");
+  return (0, import_node_path39.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path39.join)((0, import_node_os2.homedir)(), ".config"), "viberaven");
 }
 function isInside(child, parent) {
-  const rel = (0, import_node_path38.relative)((0, import_node_path38.resolve)(parent), (0, import_node_path38.resolve)(child));
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path38.isAbsolute)(rel);
+  const rel = (0, import_node_path39.relative)((0, import_node_path39.resolve)(parent), (0, import_node_path39.resolve)(child));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path39.isAbsolute)(rel);
 }
 async function retryTransient(work) {
   for (let attempt = 1; ; attempt += 1) {
@@ -21225,15 +21582,15 @@ async function retryTransient(work) {
     }
   }
 }
-var import_node_child_process9, import_node_crypto4, import_promises30, import_node_os2, import_node_path38, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
+var import_node_child_process9, import_node_crypto4, import_promises31, import_node_os2, import_node_path39, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
 var init_credentials = __esm({
   "src/hosted/credentials.ts"() {
     "use strict";
     import_node_child_process9 = require("node:child_process");
     import_node_crypto4 = require("node:crypto");
-    import_promises30 = require("node:fs/promises");
+    import_promises31 = require("node:fs/promises");
     import_node_os2 = require("node:os");
-    import_node_path38 = require("node:path");
+    import_node_path39 = require("node:path");
     CREDENTIALS_FILE_NAME = "credentials.json";
     CredentialLocationError = class extends Error {
     };
@@ -21260,9 +21617,9 @@ var init_credentials = __esm({
       constructor(configDir, workspacePath, options = {}) {
         this.configDir = configDir;
         this.workspacePath = workspacePath;
-        this.path = (0, import_node_path38.join)(configDir, CREDENTIALS_FILE_NAME);
+        this.path = (0, import_node_path39.join)(configDir, CREDENTIALS_FILE_NAME);
         this.restrict = options.restrict !== void 0 ? options.restrict : process.platform === "win32" ? restrictWithIcacls : null;
-        this.fs = { readFile: (path, encoding) => (0, import_promises30.readFile)(path, encoding), rename: (from, to) => (0, import_promises30.rename)(from, to), rm: (path) => (0, import_promises30.rm)(path, { force: true }), ...options.fs };
+        this.fs = { readFile: (path, encoding) => (0, import_promises31.readFile)(path, encoding), rename: (from, to) => (0, import_promises31.rename)(from, to), rm: (path) => (0, import_promises31.rm)(path, { force: true }), ...options.fs };
       }
       path;
       restrict;
@@ -21311,15 +21668,15 @@ var init_credentials = __esm({
             `Refusing to store the VibeRaven sign-in inside this project (${this.configDir}). Set VIBERAVEN_CONFIG_DIR to a folder outside the repo.`
           );
         }
-        await (0, import_promises30.mkdir)(this.configDir, { recursive: true, mode: 448 });
+        await (0, import_promises31.mkdir)(this.configDir, { recursive: true, mode: 448 });
         const temp = `${this.path}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
-        await (0, import_promises30.writeFile)(temp, `${JSON.stringify(body, null, 2)}
+        await (0, import_promises31.writeFile)(temp, `${JSON.stringify(body, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await (0, import_promises30.chmod)(temp, 384).catch(() => void 0);
+        await (0, import_promises31.chmod)(temp, 384).catch(() => void 0);
         try {
           if (this.restrict) await this.restrict(temp);
         } catch (error) {
-          await (0, import_promises30.rm)(temp, { force: true });
+          await (0, import_promises31.rm)(temp, { force: true });
           const code = error?.code;
           const toolMissing = code === "ENOENT";
           throw new CredentialPermissionError(
@@ -21330,17 +21687,17 @@ var init_credentials = __esm({
         if (guard) {
           const onDisk = await this.readFor(guard.apiBaseUrl);
           if (onDisk?.accessToken !== guard.accessToken || guard.isCurrent && !guard.isCurrent()) {
-            await (0, import_promises30.rm)(temp, { force: true });
+            await (0, import_promises31.rm)(temp, { force: true });
             return false;
           }
         }
         try {
           await retryTransient(() => this.fs.rename(temp, this.path));
         } catch (error) {
-          await (0, import_promises30.rm)(temp, { force: true });
+          await (0, import_promises31.rm)(temp, { force: true });
           throw error;
         }
-        await (0, import_promises30.chmod)(this.path, 384).catch(() => void 0);
+        await (0, import_promises31.chmod)(this.path, 384).catch(() => void 0);
         return true;
       }
       /** Keeps the stored plan label in step with what the API last said. */
@@ -21709,7 +22066,7 @@ async function buildHostedCheckPayload(workspacePath) {
   throw new Error("Could not assemble the full check request.");
 }
 function finalizePayload(payload) {
-  const folder = (0, import_node_path39.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
+  const folder = (0, import_node_path40.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
   const redacted = redactPayload({ ...payload, workspacePath: folder });
   return { payload: redacted.payload, redactions: redacted.count };
 }
@@ -21740,13 +22097,13 @@ function splitSections(prompt) {
     chars: section.length
   }));
 }
-var import_node_path39, PayloadCaptured;
+var import_node_path40, PayloadCaptured;
 var init_payload = __esm({
   "src/hosted/payload.ts"() {
     "use strict";
     init_fileScanner();
     init_orchestrator();
-    import_node_path39 = require("node:path");
+    import_node_path40 = require("node:path");
     init_config();
     init_redact();
     PayloadCaptured = class extends Error {
@@ -22212,10 +22569,10 @@ async function connectProviderMcp(cwd, providerId) {
   if (!recipe) {
     return { ok: false, message: `No known MCP server for ${providerId} yet. Add one manually to .mcp.json.` };
   }
-  const configPath = (0, import_node_path40.join)(cwd, ".mcp.json");
+  const configPath = (0, import_node_path41.join)(cwd, ".mcp.json");
   let config = {};
   try {
-    const raw = await (0, import_promises31.readFile)(configPath, "utf8");
+    const raw = await (0, import_promises32.readFile)(configPath, "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     if (!isRecord5(parsed) || parsed.mcpServers !== void 0 && !isRecord5(parsed.mcpServers)) {
       return { ok: false, message: "Existing .mcp.json has an unsupported structure. It was left unchanged." };
@@ -22232,7 +22589,7 @@ async function connectProviderMcp(cwd, providerId) {
   }
   servers[providerId] = recipe.entry;
   const next = { ...config, mcpServers: servers };
-  await (0, import_promises31.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises32.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const suffix = recipe.note ? ` ${recipe.note}` : "";
   return { ok: true, message: `Added ${providerId} MCP server to .mcp.json.${suffix}`, path: ".mcp.json" };
@@ -22285,7 +22642,7 @@ async function defaultScanRunner(flags, positional) {
 }
 async function readPackageJson(cwd) {
   try {
-    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, "package.json"), "utf8");
+    const raw = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, "package.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -22308,7 +22665,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
     if (files.length >= maxFiles) return;
     let entries;
     try {
-      entries = await (0, import_promises31.readdir)(dir, { withFileTypes: true });
+      entries = await (0, import_promises32.readdir)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -22316,7 +22673,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
       if (files.length >= maxFiles) return;
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        if (!skipped.has(entry.name)) await walk((0, import_node_path40.join)(dir, entry.name), rel);
+        if (!skipped.has(entry.name)) await walk((0, import_node_path41.join)(dir, entry.name), rel);
         continue;
       }
       if (entry.isFile()) files.push(rel.toLowerCase());
@@ -22335,7 +22692,7 @@ async function readEnvKeys(cwd) {
   const keys = /* @__PURE__ */ new Set();
   for (const name of [".env.example", ".env"]) {
     try {
-      const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, name), "utf8");
+      const raw = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, name), "utf8");
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -22653,7 +23010,7 @@ async function codexModelOptions() {
     { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" }
   ];
   try {
-    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)((0, import_node_os3.homedir)(), ".codex", "models_cache.json"), "utf8");
+    const raw = await (0, import_promises32.readFile)((0, import_node_path41.join)((0, import_node_os3.homedir)(), ".codex", "models_cache.json"), "utf8");
     const parsed = JSON.parse(raw);
     const list = Array.isArray(parsed) ? parsed : parsed.models ?? [];
     const options = list.filter((model) => typeof model?.slug === "string").filter((model) => !/auto-review|reserve/i.test(model.slug)).map((model) => ({ id: model.slug, label: model.display_name?.trim() || model.slug }));
@@ -22856,19 +23213,19 @@ function isPlaceholderProjectName(value) {
 async function readMcpEvidence(cwd) {
   const candidates = MCP_CONFIG_PATHS.map((relativePath) => ({
     source: relativePath.replace(/\\/g, "/"),
-    path: (0, import_node_path40.resolve)(cwd, relativePath)
+    path: (0, import_node_path41.resolve)(cwd, relativePath)
   }));
   const home = process.env.USERPROFILE || process.env.HOME;
   if (home) {
     candidates.push({
       source: "~/.codex/config.toml",
-      path: (0, import_node_path40.resolve)(home, ".codex", "config.toml")
+      path: (0, import_node_path41.resolve)(home, ".codex", "config.toml")
     });
   }
   const evidence = [];
   for (const candidate of candidates) {
     try {
-      const text = await (0, import_promises31.readFile)(candidate.path, "utf8");
+      const text = await (0, import_promises32.readFile)(candidate.path, "utf8");
       if (/mcp/i.test(text)) evidence.push({ source: candidate.source, text });
     } catch {
     }
@@ -22959,7 +23316,7 @@ async function enrichProjectMetadata(state, cwd) {
 async function readState(cwd) {
   let state;
   try {
-    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
+    const raw = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
     const packageJson = await readPackageJson(cwd);
     const deps = dependencyNames(packageJson);
     const files = await listProjectFiles(cwd);
@@ -23226,7 +23583,7 @@ async function whereExe(command, cwd) {
 }
 function expandShimPath(value, base) {
   const relative8 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
-  return relative8 === value ? value : (0, import_node_path40.join)(base, ...relative8.split(/[\\/]+/));
+  return relative8 === value ? value : (0, import_node_path41.join)(base, ...relative8.split(/[\\/]+/));
 }
 function findShimTarget(lines, pattern, accept = () => true) {
   for (const line of lines) {
@@ -23237,21 +23594,21 @@ function findShimTarget(lines, pattern, accept = () => true) {
 }
 async function resolveWindowsShimTarget(shimPath) {
   try {
-    const content = await (0, import_promises31.readFile)(shimPath, "utf8");
-    const base = (0, import_node_path40.dirname)(shimPath);
+    const content = await (0, import_promises32.readFile)(shimPath, "utf8");
+    const base = (0, import_node_path41.dirname)(shimPath);
     const lines = content.split(/\r?\n/);
     const trailingArgs = (line, after) => [...line.slice(after).split("%*")[0].matchAll(/"([^"]*)"|([^\s"&|<>]+)/g)].map((token) => expandShimPath(token[1] ?? token[2], base)).filter((value) => value.length > 0 && !value.includes("%"));
     const script = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.js)"/i);
     if (script) {
       return {
         command: process.execPath,
-        args: [(0, import_node_path40.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
+        args: [(0, import_node_path41.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
       };
     }
-    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path40.basename)(target).toLowerCase() !== "node.exe");
+    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path41.basename)(target).toLowerCase() !== "node.exe");
     if (binary) {
       return {
-        command: (0, import_node_path40.join)(base, ...binary.match[1].split(/[\\/]+/)),
+        command: (0, import_node_path41.join)(base, ...binary.match[1].split(/[\\/]+/)),
         args: trailingArgs(binary.line, binary.match.index + binary.match[0].length)
       };
     }
@@ -23376,8 +23733,8 @@ async function writeChatContextArtifact(cwd, request, prompt) {
       "",
       prompt
     ].filter((line) => typeof line === "string");
-    await (0, import_promises31.mkdir)((0, import_node_path40.join)(cwd, ".viberaven"), { recursive: true });
-    await (0, import_promises31.writeFile)((0, import_node_path40.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
+    await (0, import_promises32.mkdir)((0, import_node_path41.join)(cwd, ".viberaven"), { recursive: true });
+    await (0, import_promises32.writeFile)((0, import_node_path41.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
 `, "utf8");
   } catch {
   }
@@ -23397,13 +23754,13 @@ async function runAgentChat(cwd, request) {
   }
   const prompt = await buildAgentChatPrompt(request, cwd);
   await writeChatContextArtifact(cwd, request, prompt);
-  const outputPath = request.cliId === "codex" ? (0, import_node_path40.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
-  if (outputPath) await (0, import_promises31.mkdir)((0, import_node_path40.dirname)(outputPath), { recursive: true });
+  const outputPath = request.cliId === "codex" ? (0, import_node_path41.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
+  if (outputPath) await (0, import_promises32.mkdir)((0, import_node_path41.dirname)(outputPath), { recursive: true });
   const { command, args, stdin } = commandForAgentChat(request, prompt, cwd, outputPath);
   const result = await runAgentCommand(command, args, cwd, stdin, request.runId);
   if (outputPath) {
     try {
-      const finalMessage = (await (0, import_promises31.readFile)(outputPath, "utf8")).trim();
+      const finalMessage = (await (0, import_promises32.readFile)(outputPath, "utf8")).trim();
       if (finalMessage) return { ...result, output: finalMessage };
     } catch {
     }
@@ -23415,8 +23772,8 @@ function firstGapId(state) {
   return state.providers.find((provider2) => provider2.nextFix?.id)?.nextFix?.id;
 }
 async function runLocalAction(cwd, intent) {
-  const artifactDir = (0, import_node_path40.join)(cwd, ".viberaven");
-  await (0, import_promises31.mkdir)(artifactDir, { recursive: true });
+  const artifactDir = (0, import_node_path41.join)(cwd, ".viberaven");
+  await (0, import_promises32.mkdir)(artifactDir, { recursive: true });
   if (intent === "preview_rehearsal") {
     const state2 = await readState(cwd);
     const topProvider = state2.providers[0];
@@ -23457,7 +23814,7 @@ async function runLocalAction(cwd, intent) {
       proof,
       ""
     ].join("\n");
-    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
+    await (0, import_promises32.writeFile)((0, import_node_path41.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
     return {
       title: "Preview rehearsal ready",
       summary: `${projectName}: ${gateLabel} with ${state2.providers.length} provider beat${state2.providers.length === 1 ? "" : "s"}`,
@@ -23467,7 +23824,7 @@ async function runLocalAction(cwd, intent) {
   if (intent === "audit_vercel_supabase") {
     const auditInput = await collectVercelSupabaseAuditInput(cwd);
     const result2 = buildVercelSupabaseAudit(auditInput);
-    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
+    await (0, import_promises32.writeFile)((0, import_node_path41.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
 `, "utf8");
     return {
       title: result2.status === "pass" ? "Audit passed" : "Audit needs work",
@@ -23495,7 +23852,7 @@ async function runLocalAction(cwd, intent) {
   const mode = intent === "heal_prompt" ? "prompt" : intent === "heal_apply" ? "apply" : "plan";
   const result = await runHealCommand({ cwd, mode, gapId, yes: mode === "apply", noVerify: true });
   if (mode === "apply") {
-    await (0, import_promises31.writeFile)((0, import_node_path40.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
+    await (0, import_promises32.writeFile)((0, import_node_path41.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   }
   return {
@@ -23505,14 +23862,14 @@ async function runLocalAction(cwd, intent) {
   };
 }
 async function sendArtifact(cwd, rel, response, contentType = "text/plain; charset=utf-8") {
-  const absolute = (0, import_node_path40.resolve)(cwd, rel);
-  const root = (0, import_node_path40.resolve)(cwd);
+  const absolute = (0, import_node_path41.resolve)(cwd, rel);
+  const root = (0, import_node_path41.resolve)(cwd);
   if (!absolute.startsWith(root)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const text = await (0, import_promises31.readFile)(absolute, "utf8");
+    const text = await (0, import_promises32.readFile)(absolute, "utf8");
     response.writeHead(200, { "content-type": contentType });
     response.end(text);
   } catch {
@@ -23521,7 +23878,7 @@ async function sendArtifact(cwd, rel, response, contentType = "text/plain; chars
 }
 async function sendReportArtifact(cwd, response) {
   try {
-    const text = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "report.html"), "utf8");
+    const text = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, ".viberaven", "report.html"), "utf8");
     response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     response.end(text);
     return;
@@ -23648,7 +24005,7 @@ async function sendReportArtifact(cwd, response) {
 }
 async function sendExtensionIcon(cwd, response) {
   try {
-    const body = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, "media", "extension-icon.png"));
+    const body = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, "media", "extension-icon.png"));
     sendBinary(response, 200, "image/png", body);
   } catch {
     sendText(response, 404, "Icon not found");
@@ -23661,15 +24018,15 @@ async function sendMangaAsset(pathname, response) {
     return;
   }
   const candidates = [
-    (0, import_node_path40.join)(__dirname, "manga", name),
+    (0, import_node_path41.join)(__dirname, "manga", name),
     // installed + dev: <pkg>/dist/manga
-    (0, import_node_path40.join)(__dirname, "..", "assets", "manga", name),
+    (0, import_node_path41.join)(__dirname, "..", "assets", "manga", name),
     // fallback: <pkg>/assets/manga (source)
-    (0, import_node_path40.join)(__dirname, "..", "..", "assets", "manga", name)
+    (0, import_node_path41.join)(__dirname, "..", "..", "assets", "manga", name)
   ];
   for (const candidate of candidates) {
     try {
-      const body = await (0, import_promises31.readFile)(candidate);
+      const body = await (0, import_promises32.readFile)(candidate);
       response.setHeader("cache-control", "no-cache");
       sendBinary(response, 200, contentTypeForAsset(candidate), body);
       return;
@@ -23679,7 +24036,7 @@ async function sendMangaAsset(pathname, response) {
   sendText(response, 404, "Asset not found");
 }
 function contentTypeForAsset(pathname) {
-  switch ((0, import_node_path40.extname)(pathname).toLowerCase()) {
+  switch ((0, import_node_path41.extname)(pathname).toLowerCase()) {
     case ".svg":
       return "image/svg+xml; charset=utf-8";
     case ".png":
@@ -23696,14 +24053,14 @@ function contentTypeForAsset(pathname) {
 }
 async function sendBundledReportAsset(pathname, response) {
   const rel = decodeURIComponent(pathname.replace(/^\/report\//, ""));
-  const assetRoot = (0, import_node_path40.resolve)(getBundledReportAssetsDir());
-  const absolute = (0, import_node_path40.resolve)(assetRoot, rel);
+  const assetRoot = (0, import_node_path41.resolve)(getBundledReportAssetsDir());
+  const absolute = (0, import_node_path41.resolve)(assetRoot, rel);
   if (!absolute.startsWith(assetRoot)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const body = await (0, import_promises31.readFile)(absolute);
+    const body = await (0, import_promises32.readFile)(absolute);
     sendBinary(response, 200, contentTypeForAsset(absolute), body);
   } catch {
     sendText(response, 404, "Asset not found");
@@ -23725,18 +24082,18 @@ async function bundleStackClient(entryPath) {
   return output.text;
 }
 async function sendStackAppJs(response) {
-  const distPath = (0, import_node_path40.join)(__dirname, "stack", "app.js");
+  const distPath = (0, import_node_path41.join)(__dirname, "stack", "app.js");
   try {
-    const body = await (0, import_promises31.readFile)(distPath);
+    const body = await (0, import_promises32.readFile)(distPath);
     response.writeHead(200, { "content-type": "application/javascript; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
     return;
   } catch {
   }
-  const entryPath = (0, import_node_path40.join)(__dirname, "stack", "main.ts");
+  const entryPath = (0, import_node_path41.join)(__dirname, "stack", "main.ts");
   let mtimeMs;
   try {
-    mtimeMs = (await (0, import_promises31.stat)(entryPath)).mtimeMs;
+    mtimeMs = (await (0, import_promises32.stat)(entryPath)).mtimeMs;
   } catch {
     sendText(response, 404, "Stack client entry not found: src/local-ui/stack/main.ts is missing.");
     return;
@@ -23755,7 +24112,7 @@ async function sendStackAppJs(response) {
 }
 async function sendStackAppCss(response) {
   try {
-    const body = await (0, import_promises31.readFile)((0, import_node_path40.join)(__dirname, "stack", "stack.css"));
+    const body = await (0, import_promises32.readFile)((0, import_node_path41.join)(__dirname, "stack", "stack.css"));
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
   } catch {
@@ -23764,7 +24121,7 @@ async function sendStackAppCss(response) {
 }
 async function readProviderVerifyLedger(cwd) {
   try {
-    const raw = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
+    const raw = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -23774,8 +24131,8 @@ async function readProviderVerifyLedger(cwd) {
 async function writeProviderVerifyEntry(cwd, providerId, entry) {
   const ledger = await readProviderVerifyLedger(cwd);
   ledger[providerId] = entry;
-  await (0, import_promises31.mkdir)((0, import_node_path40.join)(cwd, ".viberaven"), { recursive: true });
-  await (0, import_promises31.writeFile)((0, import_node_path40.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
+  await (0, import_promises32.mkdir)((0, import_node_path41.join)(cwd, ".viberaven"), { recursive: true });
+  await (0, import_promises32.writeFile)((0, import_node_path41.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
 }
 async function handleRequest(request, response, options) {
@@ -23848,13 +24205,13 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/architecture-map") {
-    const mapPath = (0, import_node_path40.join)(options.cwd, ".viberaven", "architecture-map.md");
-    const markdown = await (0, import_promises31.readFile)(mapPath, "utf8").catch(() => null);
+    const mapPath = (0, import_node_path41.join)(options.cwd, ".viberaven", "architecture-map.md");
+    const markdown = await (0, import_promises32.readFile)(mapPath, "utf8").catch(() => null);
     if (markdown === null) {
       sendJsonStatus(response, 404, { error: "No architecture map yet. Run a scan first (it is written on every scan)." });
       return;
     }
-    const dataRaw = await (0, import_promises31.readFile)((0, import_node_path40.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
+    const dataRaw = await (0, import_promises32.readFile)((0, import_node_path41.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
     let data = null;
     if (dataRaw) {
       try {
@@ -23863,7 +24220,7 @@ async function handleRequest(request, response, options) {
         data = null;
       }
     }
-    const contextRaw = await (0, import_promises31.readFile)((0, import_node_path40.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
+    const contextRaw = await (0, import_promises32.readFile)((0, import_node_path41.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
     let gaps = [];
     if (contextRaw) {
       try {
@@ -24129,35 +24486,35 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/tasklist") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "agent-tasklist.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "agent-tasklist.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/playbook") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "launch-playbook.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "launch-playbook.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/audit") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "audit-vercel-supabase.txt"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "audit-vercel-supabase.txt"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/cleanup") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "context-cleanup.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "context-cleanup.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/preview") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "preview-rehearsal.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "preview-rehearsal.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-plan") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-plan.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "heal-plan.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-prompt") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-prompt.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "heal-prompt.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-apply") {
-    await sendArtifact(options.cwd, (0, import_node_path40.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
+    await sendArtifact(options.cwd, (0, import_node_path41.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/report") {
@@ -24183,12 +24540,12 @@ async function handleRequest(request, response, options) {
   }
   if (request.method === "GET" && url.pathname === "/vendor/anime.umd.min.js") {
     for (const candidate of [
-      (0, import_node_path40.join)(__dirname, "vendor", "anime.umd.min.js"),
-      (0, import_node_path40.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
-      (0, import_node_path40.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
+      (0, import_node_path41.join)(__dirname, "vendor", "anime.umd.min.js"),
+      (0, import_node_path41.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
+      (0, import_node_path41.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
     ]) {
       try {
-        const body = await (0, import_promises31.readFile)(candidate);
+        const body = await (0, import_promises32.readFile)(candidate);
         response.setHeader("cache-control", "public, max-age=604800, immutable");
         sendBinary(response, 200, "text/javascript; charset=utf-8", body);
         return;
@@ -24405,7 +24762,7 @@ function listen(server, startPort) {
   });
 }
 async function startLocalUiServer(options) {
-  const cwd = (0, import_node_path40.resolve)(options.cwd);
+  const cwd = (0, import_node_path41.resolve)(options.cwd);
   const scanRunner = options.scanRunner ?? defaultScanRunner;
   const autoScan = { state: "idle" };
   const fullCheck = new FullCheckService(cwd, options.fullCheck);
@@ -24422,7 +24779,7 @@ async function startLocalUiServer(options) {
   });
   const port = await listen(server, options.port ?? 4177);
   guard.port = port;
-  const hasArtifact = await (0, import_promises31.readFile)((0, import_node_path40.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
+  const hasArtifact = await (0, import_promises32.readFile)((0, import_node_path41.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
     () => true,
     () => false
   );
@@ -24461,16 +24818,16 @@ async function waitForServerShutdown() {
     process.once("SIGTERM", done);
   });
 }
-var import_node_http, import_node_child_process10, import_node_crypto6, import_promises31, import_node_os3, import_node_path40, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
+var import_node_http, import_node_child_process10, import_node_crypto6, import_promises32, import_node_os3, import_node_path41, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
 var init_server = __esm({
   "src/local-ui/server.ts"() {
     "use strict";
     import_node_http = require("node:http");
     import_node_child_process10 = require("node:child_process");
     import_node_crypto6 = require("node:crypto");
-    import_promises31 = require("node:fs/promises");
+    import_promises32 = require("node:fs/promises");
     import_node_os3 = require("node:os");
-    import_node_path40 = require("node:path");
+    import_node_path41 = require("node:path");
     init_initGithub();
     init_cleanPlan();
     init_audit();
@@ -24512,8 +24869,8 @@ var init_server = __esm({
     MCP_CONFIG_PATHS = [
       ".mcp.json",
       "mcp.json",
-      (0, import_node_path40.join)(".cursor", "mcp.json"),
-      (0, import_node_path40.join)(".vscode", "mcp.json")
+      (0, import_node_path41.join)(".cursor", "mcp.json"),
+      (0, import_node_path41.join)(".vscode", "mcp.json")
     ];
     MCP_PROVIDER_NEEDLES = {
       supabase: ["supabase", "@supabase/mcp", "mcp-server-supabase"],
@@ -24595,6 +24952,7 @@ function buildNextActionBlock(tasks, loopState) {
       mcpTool: repoCodeTask.mcpTool,
       mcpArgs: repoCodeTask.mcpArgs,
       fallbackCommand: repoCodeTask.mcpArgs ? `npx -y viberaven --heal --apply --gap ${repoCodeTask.gapId} --yes` : void 0,
+      ...whereAndAfter(repoCodeTask),
       requiresUserAction: false
     };
   }
@@ -24608,6 +24966,7 @@ function buildNextActionBlock(tasks, loopState) {
       mcpTool: userTask.mcpTool,
       mcpArgs: userTask.mcpArgs,
       fallbackCommand: userTask.mcpArgs ? `npx -y viberaven --heal --apply --gap ${userTask.gapId} --yes` : void 0,
+      ...whereAndAfter(userTask),
       requiresUserAction: true
     };
   }
@@ -24623,10 +24982,17 @@ function buildNextActionBlock(tasks, loopState) {
   return {
     ...base,
     type: "done",
-    title: "All gaps resolved \u2014 production gate is clear",
+    title: "No repo-code or provider tasks left; gate-result.json has the verdict",
     requiresUserAction: false
   };
 }
+function whereAndAfter(task) {
+  return {
+    ...task.file ? { file: task.file } : {},
+    ...task.line !== void 0 ? { line: task.line } : {},
+    ...task.userSteps?.length ? { userSteps: [...task.userSteps] } : {}
+  };
+}
 function resolveStallReason(tasks) {
   if (tasks.length === 0) return "no-recipes";
   const allProviderAction = tasks.every((t) => t.fixType === "provider-action");
@@ -24684,9 +25050,9 @@ var init_nextActionBlock = __esm({
 function defaultMcpConfigPaths() {
   const home = (0, import_node_os4.homedir)();
   return [
-    (0, import_node_path41.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path41.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path41.join)(home, ".gemini", "antigravity", "mcp_config.json")
+    (0, import_node_path42.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path42.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path42.join)(home, ".gemini", "antigravity", "mcp_config.json")
   ];
 }
 function resolveConfigPaths() {
@@ -24715,11 +25081,11 @@ function findServerEntry(servers, provider2) {
 function findProviderMcpConfig(provider2, configPaths) {
   const paths = configPaths ?? resolveConfigPaths();
   for (const path of paths) {
-    if (!(0, import_node_fs15.existsSync)(path)) {
+    if (!(0, import_node_fs16.existsSync)(path)) {
       continue;
     }
     try {
-      const raw = JSON.parse((0, import_node_fs15.readFileSync)(path, "utf8"));
+      const raw = JSON.parse((0, import_node_fs16.readFileSync)(path, "utf8"));
       const servers = parseMcpServers(raw);
       if (!servers) {
         continue;
@@ -24763,13 +25129,13 @@ async function verifyProviderGap(options) {
     fallbackCommand: FALLBACK_COMMAND
   };
 }
-var import_node_fs15, import_node_os4, import_node_path41, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
+var import_node_fs16, import_node_os4, import_node_path42, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
 var init_providerMcpBridge = __esm({
   "src/providerMcpBridge.ts"() {
     "use strict";
-    import_node_fs15 = require("node:fs");
+    import_node_fs16 = require("node:fs");
     import_node_os4 = require("node:os");
-    import_node_path41 = require("node:path");
+    import_node_path42 = require("node:path");
     FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
     SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
   }
@@ -24992,7 +25358,7 @@ async function cmdProviderVerify(flags, positional) {
   return result.verified ? 0 : 1;
 }
 async function cmdStatus(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -25031,7 +25397,7 @@ async function cmdStatus(flags, positional) {
   return 0;
 }
 async function runScanCommand(flags, positional, options) {
-  const workspacePath = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
+  const workspacePath = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
   if (!options?.deferMachineOutput) {
     console.log(`Scanning ${workspacePath}\u2026 (local, offline)`);
   }
@@ -25055,15 +25421,27 @@ async function runScanCommand(flags, positional, options) {
     const updatedState = resetBatch(loopState, openGapCount);
     const tasks = buildTaskList(artifact);
     const block = buildNextActionBlock(tasks, updatedState);
-    printNextActionBlock(block);
-    printProviderActionBlock(tasks);
+    let manifest;
     try {
-      const manifest = JSON.parse(await (0, import_promises32.readFile)(paths.actionsPath, "utf8"));
-      console.log(renderActionSurface(manifest, { limit: 5 }).trimEnd());
+      manifest = JSON.parse(await (0, import_promises33.readFile)(paths.actionsPath, "utf8"));
     } catch (error) {
       console.warn(error instanceof Error ? error.message : String(error));
     }
+    const followUps = manifest?.userFollowUps ?? [];
+    if (followUps.length > 0) block.userFollowUps = followUps;
+    printNextActionBlock(block);
+    printProviderActionBlock(tasks);
+    if (manifest) {
+      console.log(renderActionSurface(manifest, { limit: 5, followUps: false }).trimEnd());
+    }
     await saveLoopState(workspacePath, updatedState);
+    if (options?.markFollowUpsShown && followUps.length > 0) {
+      try {
+        await markUserFollowUpsShown(workspacePath, followUps.map((followUp) => followUp.id));
+      } catch (error) {
+        console.warn(`Could not record that the outside-the-repo steps were shown (${error instanceof Error ? error.message : String(error)}); they will be shown again.`);
+      }
+    }
   }
   if (flags.open) {
     try {
@@ -25075,7 +25453,7 @@ async function runScanCommand(flags, positional, options) {
   return { exitCode: 0, artifacts: paths };
 }
 async function cmdReport(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
   try {
     const paths = await refreshReportFromDisk(startDir);
     console.log(`Report refreshed: ${paths.reportPath}`);
@@ -25097,7 +25475,7 @@ async function cmdReport(flags, positional) {
   }
 }
 async function cmdPrompt(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -25194,7 +25572,7 @@ async function main() {
   const wantsJsonl = hasFlag(flags, "jsonl");
   const wantsStrict = hasFlag(flags, "strict");
   if (flags.condense) {
-    const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+    const cwd = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
     const result = await runCondenseCommand({ cwd });
     console.log(`VibeRaven context map refreshed: ${result.contextMapPath}`);
     return 0;
@@ -25214,18 +25592,18 @@ async function main() {
   }
   if (!command && flags.verify === true && typeof flags.action === "string") {
     return runVerifyActionCommand({
-      cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+      cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd(),
       actionId: flags.action
     });
   }
   if (!command && (isAgentMode || flags.verify === true || wantsJson || wantsJsonl || wantsStrict)) {
     const deferMachineOutput = wantsJson || wantsJsonl;
-    const scanResult = await runScanCommand(flags, positional, { deferMachineOutput });
+    const scanResult = await runScanCommand(flags, positional, { deferMachineOutput, markFollowUpsShown: true });
     if ((wantsJson || wantsJsonl) && !scanResult.artifacts) {
       console.error("VibeRaven could not produce machine output because scan artifacts were not written.");
       return 3;
     }
-    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises32.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
+    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises33.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
     const strictExitCode = wantsStrict && gateResult ? exitCodeForStrictGate(gateResult, { failOnWarnings: flags.strict === "warning" }) : scanResult.exitCode;
     if (wantsJson && gateResult) {
       process.stdout.write(renderGateResultJson(gateResult));
@@ -25247,7 +25625,7 @@ async function main() {
       env: process.env
     });
     if (mode === "local-ui") {
-      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
       const handle = await startLocalUiServer({ cwd, initialPath: stackInitialPath(flags) });
       console.log(`VibeRaven local UI: ${handle.url}`);
       await waitForServerShutdown();
@@ -25258,7 +25636,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     }
-    const scanResult = await runScanCommand({ "agent-mode": true }, positional);
+    const scanResult = await runScanCommand({ "agent-mode": true }, positional, { markFollowUpsShown: true });
     return scanResult.exitCode;
   }
   switch (command) {
@@ -25267,7 +25645,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     case "ui": {
-      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
       const envPort = Number(process.env.PORT);
       const handle = await startLocalUiServer({ cwd, port: Number.isFinite(envPort) && envPort > 0 ? envPort : void 0, initialPath: stackInitialPath(flags) });
       console.log(`VibeRaven local UI: ${handle.url}`);
@@ -25279,14 +25657,14 @@ async function main() {
       return cmdStatus(flags, positional);
     case "check":
       return runCheckCommand({
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json),
         quiet: Boolean(flags.quiet),
         base: typeof flags.base === "string" ? flags.base : void 0,
         markdown: flags.markdown === true
       });
     case "fix": {
-      const fixCwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const fixCwd = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
       const gapId = typeof flags.gap === "string" ? flags.gap : void 0;
       if (!gapId) {
         const artifact = await loadLastArtifact(fixCwd).catch(() => void 0);
@@ -25315,19 +25693,19 @@ async function main() {
     }
     case "actions":
       return runActionsCommand({
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "preview":
       return runPreviewCommand({
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd(),
         agentMode: flags["agent-mode"] === true,
         json: Boolean(flags.json)
       });
     case "next":
       return runNextCommand({
         json: Boolean(flags.json),
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "guide": {
       const provider2 = positional[0];
@@ -25349,7 +25727,7 @@ async function main() {
         cwd: process.cwd()
       });
     case "scan": {
-      const scanResult = await runScanCommand(flags, positional);
+      const scanResult = await runScanCommand(flags, positional, { markFollowUpsShown: true });
       return scanResult.exitCode;
     }
     case "report":
@@ -25361,7 +25739,7 @@ async function main() {
     case "provider-verify":
       return cmdProviderVerify(flags, positional);
     case "init": {
-      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
       const agents = typeof flags.agents === "string" ? flags.agents : void 0;
       if (flags.github === true) {
         return runInitGithubCommand({ cwd, dryRun: flags["dry-run"] === true, force: flags.force === true });
@@ -25378,7 +25756,7 @@ async function main() {
         return 1;
       }
       return runDoctorAgentsCommand({
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "validate-npm-package":
       return runValidateNpmPackageCommand({
@@ -25391,7 +25769,7 @@ async function main() {
         return 1;
       }
       return runAuditCommand({
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "clean": {
@@ -25399,7 +25777,7 @@ async function main() {
         console.error("Usage: viberaven clean --plan [path]");
         return 1;
       }
-      const cwd = positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd();
       const plan = buildContextCleanupPlan({ projectRoot: cwd, files: await collectCleanupFiles(cwd) });
       const outputPath = await writeCleanupPlan(cwd, plan);
       console.log(`Wrote ${outputPath}
@@ -25409,9 +25787,9 @@ async function main() {
     }
     case "rls-test":
       return runRlsTestCommand({
-        cwd: positional[0] ? (0, import_node_path42.resolve)(process.cwd(), positional[0]) : process.cwd(),
-        matrix: typeof flags.matrix === "string" ? (0, import_node_path42.resolve)(process.cwd(), flags.matrix) : void 0,
-        migrations: typeof flags.migrations === "string" ? (0, import_node_path42.resolve)(process.cwd(), flags.migrations) : void 0,
+        cwd: positional[0] ? (0, import_node_path43.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        matrix: typeof flags.matrix === "string" ? (0, import_node_path43.resolve)(process.cwd(), flags.matrix) : void 0,
+        migrations: typeof flags.migrations === "string" ? (0, import_node_path43.resolve)(process.cwd(), flags.migrations) : void 0,
         json: Boolean(flags.json)
       });
     default:
@@ -25420,11 +25798,11 @@ async function main() {
       return 1;
   }
 }
-var import_promises32, import_node_path42, STACK_AREAS;
+var import_promises33, import_node_path43, STACK_AREAS;
 var init_cli = __esm({
   "src/cli.ts"() {
-    import_promises32 = require("node:fs/promises");
-    import_node_path42 = require("node:path");
+    import_promises33 = require("node:fs/promises");
+    import_node_path43 = require("node:path");
     init_config();
     init_runScan();
     init_artifacts2();
@@ -25466,6 +25844,7 @@ var init_cli = __esm({
     init_buildTaskList();
     init_providerMcpBridge();
     init_render();
+    init_registry2();
     STACK_AREAS = /* @__PURE__ */ new Set(["database", "auth", "payments", "deployment", "monitoring", "security"]);
     if (require.main === module) {
       main().then((code) => {