@viberaven/cli 1.7.0 → 1.7.1

package/dist/cli.js

@@ -14406,9 +14406,9 @@ var init_clipboard = __esm({
   }
 });
 
-// node_modules/picocolors/picocolors.js
+// ../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/picocolors/picocolors.js
 var require_picocolors = __commonJS({
-  "node_modules/picocolors/picocolors.js"(exports2, module2) {
+  "../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/picocolors/picocolors.js"(exports2, module2) {
     var p2 = process || {};
     var argv = p2.argv || [];
     var env = p2.env || {};
@@ -14599,9 +14599,9 @@ var init_terminalSummary = __esm({
   }
 });
 
-// node_modules/sisteransi/src/index.js
+// ../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
-  "node_modules/sisteransi/src/index.js"(exports2, module2) {
+  "../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/sisteransi/src/index.js"(exports2, module2) {
     "use strict";
     var ESC = "\x1B";
     var CSI = `${ESC}[`;
@@ -14655,7 +14655,7 @@ var require_src = __commonJS({
   }
 });
 
-// node_modules/@clack/core/dist/index.mjs
+// ../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/@clack/core/dist/index.mjs
 function DD({ onlyFirst: e2 = false } = {}) {
   const t = ["[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?(?:\\u0007|\\u001B\\u005C|\\u009C))", "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
   return new RegExp(t, e2 ? void 0 : "g");
@@ -14767,7 +14767,7 @@ function fD({ input: e2 = import_node_process.stdin, output: u2 = import_node_pr
 }
 var import_sisteransi, import_node_process, g, import_node_readline, import_node_stream, import_picocolors2, uD, W, tD, eD, FD, sD, w, N, I, R, C, iD, rD, ED, d, oD, y, V, nD, G, _, z, K, aD, k, hD, lD, xD, B, AD, S, gD, vD, h, x, A, TD, jD, U, MD, OD, PD, J, LD;
 var init_dist = __esm({
-  "node_modules/@clack/core/dist/index.mjs"() {
+  "../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/@clack/core/dist/index.mjs"() {
     import_sisteransi = __toESM(require_src(), 1);
     import_node_process = require("node:process");
     g = __toESM(require("node:readline"), 1);
@@ -15040,13 +15040,13 @@ var init_dist = __esm({
   }
 });
 
-// node_modules/@clack/prompts/dist/index.mjs
+// ../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/@clack/prompts/dist/index.mjs
 function ce() {
   return import_node_process2.default.platform !== "win32" ? import_node_process2.default.env.TERM !== "linux" : !!import_node_process2.default.env.CI || !!import_node_process2.default.env.WT_SESSION || !!import_node_process2.default.env.TERMINUS_SUBLIME || import_node_process2.default.env.ConEmuTask === "{cmd::Cmder}" || import_node_process2.default.env.TERM_PROGRAM === "Terminus-Sublime" || import_node_process2.default.env.TERM_PROGRAM === "vscode" || import_node_process2.default.env.TERM === "xterm-256color" || import_node_process2.default.env.TERM === "alacritty" || import_node_process2.default.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 var import_node_process2, import_picocolors3, import_sisteransi2, V2, u, le, L2, W2, C2, ue, o, d2, k2, P2, A2, T, F, $e, _2, me, de, pe, q, D, U2, K2, b2, G2, ge, ve, xe, Ie, Se, M2, J2, Y2;
 var init_dist2 = __esm({
-  "node_modules/@clack/prompts/dist/index.mjs"() {
+  "../../../../pipeline-release-integration/VibeRice/packages/cli/node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist();
     init_dist();
     import_node_process2 = __toESM(require("node:process"), 1);
@@ -15300,7 +15300,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.7.0";
+    VERSION = "1.7.1";
   }
 });
 
@@ -15525,7 +15525,7 @@ This is advice, not a gate: the user decides when to ship. It is a repository ch
 
 Agent loop: run \`${PUBLIC_CHECK_COMMAND}\`, read \`.viberaven/agent-tasklist.md\`, fix one launch gap, re-run \`${PUBLIC_CHECK_COMMAND}\` once per batch of fixes.`;
     STACK_FRAMING = `Supported stack: AI-built apps that deploy on Vercel and use Supabase, typically from Lovable, Bolt, Cursor, Claude Code or Codex.
-Prefer \`viberaven_check_readiness\` when the VibeRaven MCP server is configured; otherwise \`${PUBLIC_CHECK_COMMAND}\`.`;
+Use \`viberaven_check_readiness\` only when that tool is in your tool list (the local \`@viberaven/mcp\` server); otherwise \`${PUBLIC_CHECK_COMMAND}\`. The hosted server at \`https://viberaven.dev/mcp\` cannot see the repository: pass it migration SQL or an exact error.`;
     AGENT_NEGATIVE_CONSTRAINTS = `## Working with VibeRaven results
 
 1. Do not call the app "production ready" or "secure" because \`gate.status\` is \`clear\`; it covers the repo checks only.
@@ -15609,7 +15609,7 @@ After \`${PUBLIC_CHECK_COMMAND}\`, read these artifacts in order:
 function buildShortAgentRulesBlock() {
   return wrapViberavenBlock(SHORT_AGENT_RULES_BODY);
 }
-var SHORT_AGENT_RULES_BODY, AGENT_SKILL_FILE, AGENT_SKILL_CONTENT;
+var SHORT_AGENT_RULES_BODY, AGENT_SKILL_FILE, CODEX_AGENT_SKILL_FILE, AGENT_SKILL_CONTENT;
 var init_agentSkill = __esm({
   "src/commands/agentSkill.ts"() {
     "use strict";
@@ -15628,7 +15628,67 @@ When you change or review Supabase migrations or RLS, auth, Stripe webhooks, env
 
 This is advice, not a gate: the user decides when to ship. Full loop: \`.viberaven/agent-rules.md\`. For requested task proof, follow that guide using \`.viberaven/task-contract.template.json\`.`;
     AGENT_SKILL_FILE = ".claude/skills/viberaven/SKILL.md";
-    AGENT_SKILL_CONTENT = '---\nname: viberaven\ndescription: "Use VibeRaven when working on an AI-built app that must ship to real users; when the user asks to ship, deploy, go to production, connect auth, database, payments, RLS, env vars, webhooks, or monitoring; when production-only errors appear; or when the agent needs product context (versions, providers, launch risks) before patching. Fully local: no login, no API key."\n---\n\n# VibeRaven Skill\n\nVibeRaven is the control layer for AI-built products. Its repository checks run fully locally: no login, no API key, no telemetry. They map the product (stack, providers, releases, launch risks) into `.viberaven/` artifacts any agent can read, and list the launch gaps found in the repo, each with the file that caused it. They are advice, not a gate: the user decides when to ship. Repository checks are not live database or security tests. Optional live steps have a separate account, consent and allowance boundary.\n\n## When To Use\n\nUse when the user wants production-ready, launch-ready, "what is missing before ship", a production audit, or a safe deploy for an AI-coded codebase: auth, database, payments, monitoring, error handling, rate limits, env vars. Also use when you need product context before editing: which providers the app uses, what changed between releases, and where the danger zones are.\n\n## The Loop\n\n1. Run `npx -y viberaven check` from the project root. It runs offline checks and prints \u{1F534}/\u{1F7E1}/\u26AA findings with a verdict. Exit code 1 means blockers exist.\n2. Read `.viberaven/agent-tasklist.md` first, then `.viberaven/gate-result.json` and `.viberaven/context-map.json`.\n3. Run `npx -y viberaven fix` to list gaps with safe automatic repo-code recipes. Preview a permitted fix with `npx -y viberaven fix --gap <id> --dry-run`, then apply it with `npx -y viberaven fix --gap <id>`. Respect `requiresUserAction`: finish other permitted repo fixes first, then ask before changes needing approval, such as enabling RLS without policies.\n4. For gaps without a recipe, use `npx -y viberaven prompt --gap <id>` for focused guidance and patch one gap yourself.\n5. Re-run `npx -y viberaven check` after a batch of fixes, not after every file patch.\n6. `npx -y viberaven --strict` returns the verdict as an exit code for CI when the user wants one.\n\nStop when `gate.status === "clear"` in `.viberaven/gate-result.json`, when only provider or user steps remain, or when the user decides to move on. A clear `gate.status` covers the repo checks only; the user decides when to ship. Local checks need no credentials. Do not ask for secret values or bypass a required approval.\n\n## Provider-aware feature planning\n\nFor feature work, get the relevant versioned pack with `provider_playbook` and `{"provider":"supabase"}` in MCP, or `viberaven provider supabase --json` in the CLI. Use the installed candidate version; this command is not claimed to exist in the published release yet. The pack is the single source for setup, gotchas, dated changes, provider seams, repo-check IDs and planned live checks. Do not duplicate its guidance in this Skill. Unsupported providers return the available packs; do not invent one.\n\nUse the pack to plan the feature, let the person\'s coding agent make the authorized edits, then run relevant repo checks and behavior tests. Pack retrieval is free, offline and needs no account. It is knowledge, not evidence that a check ran: report `not_checked` for unobserved provider state. Read the available pack list from the tool. Better feature results than ordinary Claude remain an experiment, not an established advantage.\n\n## Optional live catalog check (local candidate)\n\nAfter Supabase work, when actual provider metadata is relevant, offer `viberaven_live_start` with the exact project reference and selected schemas, or `viberaven live start --provider supabase --project <ref> --schemas public --json`. This only saves the scope locally. Use the installed candidate, not an assumed published version. Vercel live reads remain blocked until a metadata-only transport is available.\n\nExplain the named project/schema read and get the person\'s approval before `viberaven_live_resume` with `approvedRead: true` or `viberaven live resume --id <stepId> --approve-read --json`. The live-enabled account API must be configured. Show sign-in/payment action URLs to the person; keep the same step ID afterward. The provider token belongs in the hidden local terminal prompt, never in chat, MCP arguments or a command flag. An MCP resume without a locally stored encrypted credential returns instructions to continue in the terminal. Tokens are session-only by default; the person may choose Windows DPAPI persistence using `--persist-token` in their terminal.\n\nCatalog facts returned by the local tool may contain schema/object names and enter the connected coding agent\'s context. The account API receives project/scope IDs and bounded outcome counts, not catalog facts or provider credentials. A complete scoped result consumes one live step, including a detected mismatch; blocked or incomplete checks release the reservation. Local checks, plans and status remain free without login. `viberaven_live_status` reads the saved result; `viberaven_live_disconnect` removes this task\'s stored provider credential and evidence. A metadata result does not establish row-level behavior or completion of the feature; run the application\'s tests separately.\n\n## Studio\n\n`npx -y viberaven` opens the local Studio: the product auto-mapped (stack, providers, git releases, launch verdict), drag-context into agent chat, provider MCP connect, and release diffs. Suggest it when the user wants to see or control the product rather than read terminal output.\n\n## MCP\n\nWhen the VibeRaven MCP server is configured, prefer `viberaven_check_readiness`, then `viberaven_heal_apply` for supported safe repo-code fixes, then `viberaven_verify`. Before `npm install` of a new package, call `viberaven_validate_npm_package`.\n\n## Vercel + Supabase\n\n```bash\nnpx -y viberaven audit --vercel-supabase\n```\n\nCheck RLS, service-role exposure, and pooler ports `5432` / `6543` before making launch claims.\n\n## Local task proof onboarding (local candidate)\n\nFor requested feature proof, follow the shared `.viberaven/agent-rules.md` workflow installed by `init` for both Claude and Codex. Start from `.viberaven/task-contract.template.json`: copy it to a task-specific file, replace the request placeholder from the actual user\'s request, and fill testable acceptance conditions, preservation conditions and actual repository-relative scope. It is a schema-valid draft, not evidence or an executable task. Mark it ready only after review. Ready contracts are immutable; changed requirements need a newly reviewed task.\n\nThe shared guide leads through local `work start` with the selected CLI/access, a reviewed `work prepare` plan outside the project BEFORE editing, direct authorized coding-agent edits, then authorized `work verify` and `work report` with the same task ID. No `work resume`, login or account is needed for this local route. Keep the useful free check/fix/recheck loop. Unsupported provider/browser behavior stays `not_checked`; a report exit code of 0 means export succeeded, so inspect its outcome. The sections below describe optional account execution and the existing independent adapters in detail. Onboarding does not enable `init --github` or upload a report to its separate trusted static-check workflow.\n\n## Optional account-linked work (local candidate)\n\nOnly when the user chooses account-linked agent execution, first agree on one task contract: `schemaVersion: 1`, `status: "ready"`, the exact `request`, `acceptance` and `mustNotBreak` lists of `{id, description}`, and `scope` with `environment`, relative repository `paths`, and `providers`. Use `environment: "local"` and an empty provider list for local work. Do not include credentials or shell commands. Choose the person\'s installed agent; `ask` plans and `approve` permits local edits through the existing engine.\n\nSave it with `viberaven work start --contract task.json --cli codex --access approve --json`, or `viberaven_work_start` with the `contract` object. Start and status are local and need no login. Request-only start remains available but creates a draft that cannot execute. Before a remote session exists, upgrade the same draft with `viberaven work resume --id <taskId> --contract task.json --json`, keeping the original request. Ready definitions are immutable. Provider, preview and test-mode contracts can be saved for planning; their execution is not implemented in this candidate.\n\nShow the saved acceptance conditions, preservation conditions and scope to the person. Only after their approval, use `viberaven work resume --id <taskId> --approve-contract --json`, or `viberaven_work_resume` with `approvedContract: true`. Approval is tied to the exact contract hash. Explain that resume shares the short request and redacted results with the VibeRaven account; the full contract stays in the local engine context. Keep the same task ID and approved definition through sign-in, quota/payment and interrupted delivery. Show any action URL to the person; never authorize sign-in or payment for them. The matching work-enabled backend is required.\n\nRead the receipt with `viberaven work status --id <taskId> --json` or `viberaven_work_status`. Report execution state separately from condition evidence: an agent\'s successful exit, checkout return or account connection does not prove the task is complete. Conditions remain `not_checked` unless the separately prepared independent local verifier observes them. A historical passing receipt becomes stale after a source change; read current status before claiming it still applies. Review an interrupted or legacy task rather than starting a duplicate to hide failure. Scope paths describe intent, not an enforced filesystem sandbox.\n\nThis uses the person\'s local coding agent and computer, not an included hosted model. Free checks and direct agent repairs remain available without an account. Use the installed candidate; do not assume these contract commands exist in the published release.\n\n## Independent local observations (local candidate)\n\nBefore the coding agent edits an existing Node module, propose a declarative verification plan for the agreed task conditions. Have the person review expected behavior independently of the implementation. Use `viberaven_work_prepare` with `{taskId, verification}` or `viberaven work prepare --id <taskId> --verification /outside/project/plan.json --json`. This freezes dirty/untracked baseline bytes and the plan outside the project. The contract and plan are immutable; do not weaken them after seeing a failure.\n\nThe first plan format is `{schemaVersion: 1, checks: [...]}`. A module check has `id`, `conditionId`, `adapter: "module"`, `module` (relative path), `export` and `cases: [{args: [...], expected: <JSON>}]`. Use an existing baseline module and concrete expected values. A preservation check can instead use `adapter: "node-test"`, `entry` and `frozenPaths` for original test/helpers. An HTTP check uses `adapter: "http"`, an existing `module`/`export` returning an unlistened Node HTTP server, and sequential `cases: [{request: {method, path, headers?, body?}, expected: {status, json}}]` (or `text` instead of `json`). Only synthetic fixture headers and origin-relative paths are supported; expected values stay outside the container. The CLI accepts a bounded JSON file; MCP inline transport is limited to 4800 UTF-8 bytes. These are observations, not shell commands or supplied proof.\n\nAfter the authorized edit, run `viberaven_work_verify` with `approvedVerification: true` or `viberaven work verify --id <taskId> --approve-verification --json` only after the person approves the reviewed plan\'s isolated execution. This needs the local pinned Docker image, but no account, payment, provider token or network. It neither runs the coding agent again nor installs dependencies. Status returns each condition as `checked` with its outcome, or `not_checked` with a reason, plus snapshot/provenance. Read failures, uncovered conditions, source-scope changes and exclusions before reporting completion.\n\nSupport is bounded to Node JS/erasable TS module observations, local HTTP loopback and frozen Node preservation tests. HTTP observations share one server per check inside network-isolated Docker; they do not prove database persistence, real authentication, browser or provider flows. Unsupported dependencies, secrets/excluded required inputs or unavailable Docker do not establish completion. The plan\'s quality and coverage remain review decisions; do not invent a benchmark advantage from these checks.\n\n## Local proof export (local candidate)\n\nAfter reading current status, use `viberaven work report --id <taskId>` for Markdown, add `--json` for the structured report plus Markdown, or call `viberaven_work_report` with `{taskId}`. This reads the same immutable verifier state and current source freshness as status. It performs no login, network call, Docker run, agent execution or file write. Export goes to stdout only. A successful export exits 0 even when evidence is `failed` or `not_checked`; read `outcome`, condition counts and scope, not the export exit code. Missing or corrupt saved state fails with nonzero exit and no passing report.\n\nThe standalone MCP report route requires an already installed `@viberaven/cli` with the exact MCP version, resolvable from the MCP installation. For a local candidate, the host may set `VIBERAVEN_CLI_PATH` to the absolute matching `dist/cli.js` outside the task repository; this is host configuration, never an MCP argument. Report calls execute that installed CLI directly and never run npm or download/install packages. If the matching CLI is unavailable, reporting fails until it is installed/configured separately.\n\nThe local draft includes the request, acceptance and must-not-break conditions, checked/passed/failed/unknown counts, open items, scope/exclusion counts, snapshot hashes, descriptive HEAD SHAs and receipt hashes. Only current independently checked conditions and checked scope can yield `passed`. Execution state is separate. HEAD does not imply a clean source tree; actual-byte snapshot hashes identify proof. Human text is redacted and explicitly marked if truncated; the contract hash binds the original definition. No source, response bodies, output streams, private path lists, account actions or artifact file references are exported. Pattern redaction cannot find every secret: have a person review the entire draft before sharing.\n\nDo not treat this local report as authoritative CI or feed it into the trusted GitHub static-check comment path. Export posts no comment, proves no deployment/provider state and does not complete the L1.3 live GitHub pilot. An explicitly authorized live finding/fix/update-same-comment sequence remains separate future work.\n\n## Boundaries\n\n- Repo-code edits never prove provider dashboard state. Billing, DNS, webhooks, quotas, and live provider verification need dashboard or MCP proof; say so explicitly.\n- Never ask for passwords, tokens, cookies, or secret values.\n- `check`, `scan`, `audit` and `clean --plan` write only under `.viberaven/`. `init` and `fix --gap` edit repo files: `init` writes agent rule files such as `AGENTS.md` and adds `viberaven:*` scripts to `package.json` (preview with `init --dry-run`), and `fix --gap` edits code (preview with `npx -y viberaven fix --gap <id> --dry-run`).\n\nNext skill: `architecture-context` when feature work is vague and product questions are missing; `architecture-plan` once those questions are answered; `what-broke` when a working app regressed; `production-context` to record durable risk in `.viberaven/production-context.md`; `go-live` when the user wants the app pushed to GitHub and live on Vercel.\n';
+    CODEX_AGENT_SKILL_FILE = ".agents/skills/viberaven/SKILL.md";
+    AGENT_SKILL_CONTENT = '---\nname: viberaven\ndescription: "Use for Supabase RLS and migrations, grants and 42501 errors, a service role key in client code, Vercel env vars, Stripe webhook signature checks, or a Vercel + Supabase review before deploy. Choose local repository checks or hosted SQL/error guidance by the actual tools available. Local checks are free: no login or API key."\n---\n\n# VibeRaven Skill\n\nVibeRaven is the control layer for AI-built products. Its repository checks run fully locally: no login, no API key, no telemetry. They map the product (stack, providers, releases, launch risks) into `.viberaven/` artifacts any agent can read, and list the launch gaps found in the repo, each with the file that caused it. They are advice, not a gate: the user decides when to ship. Repository checks are not live database or security tests. Optional live steps have a separate account, consent and allowance boundary.\n\n## When To Use\n\nUse when the user wants production-ready, launch-ready, "what is missing before ship", a production audit, or a safe deploy for an AI-coded codebase: auth, database, payments, monitoring, error handling, rate limits, env vars. Also use when you need product context before editing: which providers the app uses, what changed between releases, and where the danger zones are.\n\n## The Loop\n\n1. Run `npx -y viberaven check` from the project root. It runs offline checks and prints \u{1F534}/\u{1F7E1}/\u26AA findings with a verdict. Exit code 1 means blockers exist.\n2. Read `.viberaven/agent-tasklist.md` first, then `.viberaven/gate-result.json` and `.viberaven/context-map.json`.\n3. Run `npx -y viberaven fix` to list gaps with safe automatic repo-code recipes. Preview a permitted fix with `npx -y viberaven fix --gap <id> --dry-run`, then apply it with `npx -y viberaven fix --gap <id>`. Respect `requiresUserAction`: finish other permitted repo fixes first, then ask before changes needing approval, such as enabling RLS without policies.\n4. For gaps without a recipe, use `npx -y viberaven prompt --gap <id>` for focused guidance and patch one gap yourself.\n5. Re-run `npx -y viberaven check` after a batch of fixes, not after every file patch.\n6. `npx -y viberaven --strict` returns the verdict as an exit code for CI when the user wants one.\n\nStop when `gate.status === "clear"` in `.viberaven/gate-result.json`, when only provider or user steps remain, or when the user decides to move on. A clear `gate.status` covers the repo checks only; the user decides when to ship. Local checks need no credentials. Do not ask for secret values or bypass a required approval.\n\n## Provider-aware feature planning\n\nFor feature work, get the relevant versioned pack with `provider_playbook` and `{"provider":"supabase"}` in MCP, or `viberaven provider supabase --json` in the CLI. Use the installed candidate version; this command is not claimed to exist in the published release yet. The pack is the single source for setup, gotchas, dated changes, provider seams, repo-check IDs and planned live checks. Do not duplicate its guidance in this Skill. Unsupported providers return the available packs; do not invent one.\n\nUse the pack to plan the feature, let the person\'s coding agent make the authorized edits, then run relevant repo checks and behavior tests. Pack retrieval is free, offline and needs no account. It is knowledge, not evidence that a check ran: report `not_checked` for unobserved provider state. Read the available pack list from the tool. Better feature results than ordinary Claude remain an experiment, not an established advantage.\n\n## Optional local behavioral RLS test (local candidate)\n\nAfter reviewing a Supabase migration or ownership policy, optionally run already reviewed permissions scenarios. Derive expectations from intended access for owner, other_user and anon; do not rewrite expectations to match failures. Prefer `defaultGrants: none` in the matrix with actual GRANT SQL for new schemas; disclose `supabase-legacy` defaults otherwise.\n\nIf `viberaven_rls_test` is in your tool list, call it with `{matrix: "PATH", cwd: "PROJECT"}` and optional `migrations`. Otherwise use the installed candidate CLI: `viberaven rls-test --matrix PATH --json`. Read each Pass, Fail and Unknown with its evidence and coverage; Unknown is inconclusive. This is an experimental PGlite imitation, not live Supabase proof or a security claim.\n\nThe optional PGlite dependency must already be installed next to the CLI that runs the test. The local MCP host needs a matching installed CLI with PGlite alongside it; a dependency installed only in the target project may be unavailable to that host. Missing setup is a tool error with CLI guidance. Do not install dependencies without normal user authorization. This optional local test needs no login, provider access or payment; keep the free check/fix/recheck loop.\n\n## Optional live catalog check (local candidate)\n\nAfter Supabase work, when actual provider metadata is relevant, offer `viberaven_live_start` with the exact project reference and selected schemas, or `viberaven live start --provider supabase --project <ref> --schemas public --json`. This only saves the scope locally. Use the installed candidate, not an assumed published version. Vercel live reads remain blocked until a metadata-only transport is available.\n\nExplain the named project/schema read and get the person\'s approval before `viberaven_live_resume` with `approvedRead: true` or `viberaven live resume --id <stepId> --approve-read --json`. The live-enabled account API must be configured. Show sign-in/payment action URLs to the person; keep the same step ID afterward. The provider token belongs in the hidden local terminal prompt, never in chat, MCP arguments or a command flag. An MCP resume without a locally stored encrypted credential returns instructions to continue in the terminal. Tokens are session-only by default; the person may choose Windows DPAPI persistence using `--persist-token` in their terminal.\n\nCatalog facts returned by the local tool may contain schema/object names and enter the connected coding agent\'s context. The account API receives project/scope IDs and bounded outcome counts, not catalog facts or provider credentials. A complete scoped result consumes one live step, including a detected mismatch; blocked or incomplete checks release the reservation. Local checks, plans and status remain free without login. `viberaven_live_status` reads the saved result; `viberaven_live_disconnect` removes this task\'s stored provider credential and evidence. A metadata result does not establish row-level behavior or completion of the feature; run the application\'s tests separately.\n\n## Studio\n\n`npx -y viberaven` opens the local Studio: the product auto-mapped (stack, providers, git releases, launch verdict), drag-context into agent chat, provider MCP connect, and release diffs. Suggest it when the user wants to see or control the product rather than read terminal output.\n\n## MCP\n\nChoose by the tools you actually have, not by the server\'s name. Two different servers are both called VibeRaven:\n\n- If `viberaven_check_readiness` is in your tool list (the local `@viberaven/mcp` server, which runs the CLI in a repository), call it on the project root you are working in, then `viberaven_heal_apply` for supported safe repo-code fixes, then `viberaven_verify`. Before `npm install` of a new package, call `viberaven_validate_npm_package`.\n- If you only have the hosted server (`https://viberaven.dev/mcp`, with tools such as `check_supabase_migrations` and `search_guides`), it cannot see the repository. Pass it the migration SQL or the exact error text, and say that the result covers only what you passed. For a repository check, run `npx -y viberaven check` in the project root.\n- With no VibeRaven tools, run `npx -y viberaven check` for a Vercel + Supabase repository. Answer a general question without running anything.\n\n## Vercel + Supabase\n\n```bash\nnpx -y viberaven audit --vercel-supabase\n```\n\nCheck RLS, service-role exposure, and pooler ports `5432` / `6543` before making launch claims.\n\n## Local task proof onboarding (local candidate)\n\nFor requested feature proof, follow the shared `.viberaven/agent-rules.md` workflow installed by `init` for both Claude and Codex. Start from `.viberaven/task-contract.template.json`: copy it to a task-specific file, replace the request placeholder from the actual user\'s request, and fill testable acceptance conditions, preservation conditions and actual repository-relative scope. It is a schema-valid draft, not evidence or an executable task. Mark it ready only after review. Ready contracts are immutable; changed requirements need a newly reviewed task.\n\nThe shared guide leads through local `work start` with the selected CLI/access, a reviewed `work prepare` plan outside the project BEFORE editing, direct authorized coding-agent edits, then authorized `work verify` and `work report` with the same task ID. No `work resume`, login or account is needed for this local route. Keep the useful free check/fix/recheck loop. Unsupported provider/browser behavior stays `not_checked`; a report exit code of 0 means export succeeded, so inspect its outcome. The sections below describe optional account execution and the existing independent adapters in detail. Onboarding does not enable `init --github` or upload a report to its separate trusted static-check workflow.\n\n## Optional account-linked work (local candidate)\n\nOnly when the user chooses account-linked agent execution, first agree on one task contract: `schemaVersion: 1`, `status: "ready"`, the exact `request`, `acceptance` and `mustNotBreak` lists of `{id, description}`, and `scope` with `environment`, relative repository `paths`, and `providers`. Use `environment: "local"` and an empty provider list for local work. Do not include credentials or shell commands. Choose the person\'s installed agent; `ask` plans and `approve` permits local edits through the existing engine.\n\nSave it with `viberaven work start --contract task.json --cli codex --access approve --json`, or `viberaven_work_start` with the `contract` object. Start and status are local and need no login. Request-only start remains available but creates a draft that cannot execute. Before a remote session exists, upgrade the same draft with `viberaven work resume --id <taskId> --contract task.json --json`, keeping the original request. Ready definitions are immutable. Provider, preview and test-mode contracts can be saved for planning; their execution is not implemented in this candidate.\n\nShow the saved acceptance conditions, preservation conditions and scope to the person. Only after their approval, use `viberaven work resume --id <taskId> --approve-contract --json`, or `viberaven_work_resume` with `approvedContract: true`. Approval is tied to the exact contract hash. Explain that resume shares the short request and redacted results with the VibeRaven account; the full contract stays in the local engine context. Keep the same task ID and approved definition through sign-in, quota/payment and interrupted delivery. Show any action URL to the person; never authorize sign-in or payment for them. The matching work-enabled backend is required.\n\nRead the receipt with `viberaven work status --id <taskId> --json` or `viberaven_work_status`. Report execution state separately from condition evidence: an agent\'s successful exit, checkout return or account connection does not prove the task is complete. Conditions remain `not_checked` unless the separately prepared independent local verifier observes them. A historical passing receipt becomes stale after a source change; read current status before claiming it still applies. Review an interrupted or legacy task rather than starting a duplicate to hide failure. Scope paths describe intent, not an enforced filesystem sandbox.\n\nThis uses the person\'s local coding agent and computer, not an included hosted model. Free checks and direct agent repairs remain available without an account. Use the installed candidate; do not assume these contract commands exist in the published release.\n\n## Independent local observations (local candidate)\n\nBefore the coding agent edits an existing Node module, propose a declarative verification plan for the agreed task conditions. Have the person review expected behavior independently of the implementation. Use `viberaven_work_prepare` with `{taskId, verification}` or `viberaven work prepare --id <taskId> --verification /outside/project/plan.json --json`. This freezes dirty/untracked baseline bytes and the plan outside the project. The contract and plan are immutable; do not weaken them after seeing a failure.\n\nThe first plan format is `{schemaVersion: 1, checks: [...]}`. A module check has `id`, `conditionId`, `adapter: "module"`, `module` (relative path), `export` and `cases: [{args: [...], expected: <JSON>}]`. Use an existing baseline module and concrete expected values. A preservation check can instead use `adapter: "node-test"`, `entry` and `frozenPaths` for original test/helpers. An HTTP check uses `adapter: "http"`, an existing `module`/`export` returning an unlistened Node HTTP server, and sequential `cases: [{request: {method, path, headers?, body?}, expected: {status, json}}]` (or `text` instead of `json`). Only synthetic fixture headers and origin-relative paths are supported; expected values stay outside the container. The CLI accepts a bounded JSON file; MCP inline transport is limited to 4800 UTF-8 bytes. These are observations, not shell commands or supplied proof.\n\nAfter the authorized edit, run `viberaven_work_verify` with `approvedVerification: true` or `viberaven work verify --id <taskId> --approve-verification --json` only after the person approves the reviewed plan\'s isolated execution. This needs the local pinned Docker image, but no account, payment, provider token or network. It neither runs the coding agent again nor installs dependencies. Status returns each condition as `checked` with its outcome, or `not_checked` with a reason, plus snapshot/provenance. Read failures, uncovered conditions, source-scope changes and exclusions before reporting completion.\n\nSupport is bounded to Node JS/erasable TS module observations, local HTTP loopback and frozen Node preservation tests. HTTP observations share one server per check inside network-isolated Docker; they do not prove database persistence, real authentication, browser or provider flows. Unsupported dependencies, secrets/excluded required inputs or unavailable Docker do not establish completion. The plan\'s quality and coverage remain review decisions; do not invent a benchmark advantage from these checks.\n\n## Local proof export (local candidate)\n\nAfter reading current status, use `viberaven work report --id <taskId>` for Markdown, add `--json` for the structured report plus Markdown, or call `viberaven_work_report` with `{taskId}`. This reads the same immutable verifier state and current source freshness as status. It performs no login, network call, Docker run, agent execution or file write. Export goes to stdout only. A successful export exits 0 even when evidence is `failed` or `not_checked`; read `outcome`, condition counts and scope, not the export exit code. Missing or corrupt saved state fails with nonzero exit and no passing report.\n\nThe standalone MCP report route requires an already installed `@viberaven/cli` with the exact MCP version, resolvable from the MCP installation. For a local candidate, the host may set `VIBERAVEN_CLI_PATH` to the absolute matching `dist/cli.js` outside the task repository; this is host configuration, never an MCP argument. Report calls execute that installed CLI directly and never run npm or download/install packages. If the matching CLI is unavailable, reporting fails until it is installed/configured separately.\n\nThe local draft includes the request, acceptance and must-not-break conditions, checked/passed/failed/unknown counts, open items, scope/exclusion counts, snapshot hashes, descriptive HEAD SHAs and receipt hashes. Only current independently checked conditions and checked scope can yield `passed`. Execution state is separate. HEAD does not imply a clean source tree; actual-byte snapshot hashes identify proof. Human text is redacted and explicitly marked if truncated; the contract hash binds the original definition. No source, response bodies, output streams, private path lists, account actions or artifact file references are exported. Pattern redaction cannot find every secret: have a person review the entire draft before sharing.\n\nDo not treat this local report as authoritative CI or feed it into the trusted GitHub static-check comment path. Export posts no comment, proves no deployment/provider state and does not complete the L1.3 live GitHub pilot. An explicitly authorized live finding/fix/update-same-comment sequence remains separate future work.\n\n## Boundaries\n\n- Repo-code edits never prove provider dashboard state. Billing, DNS, webhooks, quotas, and live provider verification need dashboard or MCP proof; say so explicitly.\n- Never ask for passwords, tokens, cookies, or secret values.\n- `check`, `scan`, `audit` and `clean --plan` write only under `.viberaven/`. `init` and `fix --gap` edit repo files: `init` writes agent rule files such as `AGENTS.md` and adds `viberaven:*` scripts to `package.json` (preview with `init --dry-run`), and `fix --gap` edits code (preview with `npx -y viberaven fix --gap <id> --dry-run`).\n\nNext skill: `architecture-context` when feature work is vague and product questions are missing; `architecture-plan` once those questions are answered; `what-broke` when a working app regressed; `production-context` to record durable risk in `.viberaven/production-context.md`; `go-live` when the user wants the app pushed to GitHub and live on Vercel.\n';
+  }
+});
+
+// src/commands/initAgentSkill.ts
+async function initAgentSkill(options) {
+  const path2 = (0, import_node_path18.join)(options.cwd, options.file);
+  const parents = options.file.split("/").slice(0, -1);
+  const regularParents = async (create) => {
+    let parent = options.cwd;
+    for (const part of parents) {
+      parent = (0, import_node_path18.join)(parent, part);
+      let stat12 = await (0, import_promises12.lstat)(parent).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      if (!stat12 && create) {
+        try {
+          await (0, import_promises12.mkdir)(parent);
+        } catch (error) {
+          if (error.code !== "EEXIST") throw error;
+        }
+        stat12 = await (0, import_promises12.lstat)(parent);
+      }
+      if (!stat12) return true;
+      if (!stat12.isDirectory() || stat12.isSymbolicLink()) return false;
+    }
+    return true;
+  };
+  const existing = async () => {
+    if (!await regularParents(false)) return "preserved";
+    try {
+      const stat12 = await (0, import_promises12.lstat)(path2);
+      if (!stat12.isFile() || stat12.isSymbolicLink()) return "preserved";
+      const content = await (0, import_promises12.readFile)(path2, "utf8");
+      return content.replace(/\r\n/g, "\n") === AGENT_SKILL_CONTENT ? "unchanged" : "preserved";
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  };
+  const found = await existing();
+  if (found) return found;
+  if (options.dryRun) return "created";
+  if (!await regularParents(true)) return "preserved";
+  try {
+    await (0, import_promises12.writeFile)(path2, AGENT_SKILL_CONTENT, { encoding: "utf8", flag: "wx" });
+    return "created";
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    return await existing() ?? "preserved";
+  }
+}
+var import_promises12, import_node_path18;
+var init_initAgentSkill = __esm({
+  "src/commands/initAgentSkill.ts"() {
+    "use strict";
+    import_promises12 = require("node:fs/promises");
+    import_node_path18 = require("node:path");
+    init_agentSkill();
   }
 });
 
@@ -15715,25 +15775,25 @@ async function initCursorRulesPack(options) {
   const pack = buildCursorRulesPack();
   for (const rule of pack) {
     const file = `${CURSOR_RULES_DIR}/${rule.filename}`;
-    const path2 = (0, import_node_path18.join)(options.cwd, file);
+    const path2 = (0, import_node_path19.join)(options.cwd, file);
     const existing = await readExistingFile(path2);
     const changed = !existing.exists || existing.content !== rule.content;
     const action = !existing.exists ? "created" : changed ? "updated" : "unchanged";
     if (!options.dryRun && changed) {
-      await (0, import_promises12.mkdir)((0, import_node_path18.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
-      await (0, import_promises12.writeFile)(path2, rule.content, "utf-8");
+      await (0, import_promises13.mkdir)((0, import_node_path19.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
+      await (0, import_promises13.writeFile)(path2, rule.content, "utf-8");
     }
     results.push({ target: "cursor", file, path: path2, action });
   }
-  const legacyPath = (0, import_node_path18.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
+  const legacyPath = (0, import_node_path19.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
   if (!options.dryRun && await fileExists(legacyPath)) {
-    await (0, import_promises12.rm)(legacyPath, { force: true });
+    await (0, import_promises13.rm)(legacyPath, { force: true });
   }
   return results;
 }
 async function readExistingFile(path2) {
   try {
-    return { exists: true, content: await (0, import_promises12.readFile)(path2, "utf-8") };
+    return { exists: true, content: await (0, import_promises13.readFile)(path2, "utf-8") };
   } catch (error) {
     if (isFileNotFoundError(error)) {
       return { exists: false, content: "" };
@@ -15743,7 +15803,7 @@ async function readExistingFile(path2) {
 }
 async function fileExists(path2) {
   try {
-    await (0, import_promises12.access)(path2);
+    await (0, import_promises13.access)(path2);
     return true;
   } catch {
     return false;
@@ -15752,12 +15812,12 @@ async function fileExists(path2) {
 function isFileNotFoundError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises12, import_node_path18, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
+var import_promises13, import_node_path19, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
 var init_cursorRulesPack = __esm({
   "src/commands/cursorRulesPack.ts"() {
     "use strict";
-    import_promises12 = require("node:fs/promises");
-    import_node_path18 = require("node:path");
+    import_promises13 = require("node:fs/promises");
+    import_node_path19 = require("node:path");
     init_commands();
     CURSOR_RULES_DIR = ".cursor/rules";
     LEGACY_CURSOR_RULE_FILE = `${CURSOR_RULES_DIR}/viberaven.mdc`;
@@ -15770,7 +15830,7 @@ function renderAgentRulesForTarget(target) {
   if (target === "claude") {
     return ["@AGENTS.md", "", buildShortAgentRulesBlock()].join("\n");
   }
-  if (target === "skill") {
+  if (target === "skill" || target === "codexSkill") {
     return AGENT_SKILL_CONTENT;
   }
   if (target === "agentGuide") {
@@ -15826,6 +15886,7 @@ var init_agentTargets = __esm({
       missionMap: { file: ".viberaven/mission-map.md", aliases: ["mission-map"] },
       agentGuide: { file: ".viberaven/agent-rules.md", aliases: ["agent-rules"] },
       skill: { file: AGENT_SKILL_FILE, aliases: ["claude-skill"] },
+      codexSkill: { file: CODEX_AGENT_SKILL_FILE, aliases: ["codex-skill"] },
       devin: { file: ".devin/rules/viberaven.md" },
       windsurf: { file: ".windsurf/rules/viberaven.md" },
       cline: { file: ".clinerules/viberaven.md" },
@@ -15842,7 +15903,8 @@ var init_agentTargets = __esm({
       "agentContext",
       "missionMap",
       "agentGuide",
-      "skill"
+      "skill",
+      "codexSkill"
     ];
     EXTENDED_AGENT_RULE_TARGETS = [
       "cursorLegacy",
@@ -15862,17 +15924,17 @@ var init_agentTargets = __esm({
       ...(AGENT_RULE_TARGETS[target].aliases ?? []).map((alias) => [alias, target])
     ]);
     AGENT_RULE_TARGET_ALIASES = new Map(AGENT_RULE_TARGET_ALIAS_ENTRIES);
-    VALID_AGENT_RULES_TARGET_TEXT = "all, codex, claude, cursor, cursor-legacy, copilot, github-copilot, gemini, agent-context, mission-map, agent-rules, claude-skill, devin, windsurf, cline, roo, junie, zed";
+    VALID_AGENT_RULES_TARGET_TEXT = "all, codex, claude, cursor, cursor-legacy, copilot, github-copilot, gemini, agent-context, mission-map, agent-rules, claude-skill, codex-skill, devin, windsurf, cline, roo, junie, zed";
   }
 });
 
 // src/commands/seedPackageJsonScripts.ts
 async function seedPackageJsonScripts(options) {
-  const packageJsonPath = (0, import_node_path19.join)(options.cwd, "package.json");
+  const packageJsonPath = (0, import_node_path20.join)(options.cwd, "package.json");
   if (!(0, import_node_fs10.existsSync)(packageJsonPath)) {
     return null;
   }
-  const raw = await (0, import_promises13.readFile)(packageJsonPath, "utf-8");
+  const raw = await (0, import_promises14.readFile)(packageJsonPath, "utf-8");
   let pkg;
   try {
     pkg = JSON.parse(raw);
@@ -15902,17 +15964,17 @@ async function seedPackageJsonScripts(options) {
     pkg.scripts = scripts;
     const output = `${JSON.stringify(pkg, null, 2)}
 `;
-    await (0, import_promises13.writeFile)(packageJsonPath, output, "utf-8");
+    await (0, import_promises14.writeFile)(packageJsonPath, output, "utf-8");
   }
   return { action: "updated", added, skipped, changed: true };
 }
-var import_node_fs10, import_promises13, import_node_path19, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
+var import_node_fs10, import_promises14, import_node_path20, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
 var init_seedPackageJsonScripts = __esm({
   "src/commands/seedPackageJsonScripts.ts"() {
     "use strict";
     import_node_fs10 = require("node:fs");
-    import_promises13 = require("node:fs/promises");
-    import_node_path19 = require("node:path");
+    import_promises14 = require("node:fs/promises");
+    import_node_path20 = require("node:path");
     init_commands();
     VIBERAVEN_PACKAGE_JSON_SCRIPTS = {
       "viberaven:check": PUBLIC_CHECK_COMMAND
@@ -16058,19 +16120,19 @@ var init_taskContract = __esm({
 
 // src/commands/initTaskContract.ts
 async function initTaskContractTemplate(options) {
-  const path2 = (0, import_node_path20.join)(options.cwd, TASK_CONTRACT_TEMPLATE_FILE);
-  const parent = (0, import_node_path20.dirname)(path2);
+  const path2 = (0, import_node_path21.join)(options.cwd, TASK_CONTRACT_TEMPLATE_FILE);
+  const parent = (0, import_node_path21.dirname)(path2);
   const result = (action) => ({ file: TASK_CONTRACT_TEMPLATE_FILE, path: path2, action });
-  const parentStat = await (0, import_promises14.lstat)(parent).catch((error) => {
+  const parentStat = await (0, import_promises15.lstat)(parent).catch((error) => {
     if (error.code === "ENOENT") return null;
     throw error;
   });
   if (parentStat && (!parentStat.isDirectory() || parentStat.isSymbolicLink())) return result("preserved");
   const existing = async () => {
     try {
-      const stat12 = await (0, import_promises14.lstat)(path2);
+      const stat12 = await (0, import_promises15.lstat)(path2);
       if (!stat12.isFile() || stat12.isSymbolicLink() || stat12.size !== Buffer.byteLength(TASK_CONTRACT_TEMPLATE_CONTENT, "utf8")) return result("preserved");
-      return result((await (0, import_promises14.readFile)(path2)).equals(Buffer.from(TASK_CONTRACT_TEMPLATE_CONTENT, "utf8")) ? "unchanged" : "preserved");
+      return result((await (0, import_promises15.readFile)(path2)).equals(Buffer.from(TASK_CONTRACT_TEMPLATE_CONTENT, "utf8")) ? "unchanged" : "preserved");
     } catch (error) {
       if (error.code === "ENOENT") return null;
       throw error;
@@ -16079,23 +16141,23 @@ async function initTaskContractTemplate(options) {
   const found = await existing();
   if (found) return found;
   if (options.dryRun) return result("created");
-  await (0, import_promises14.mkdir)(parent, { recursive: true });
-  const checkedParent = await (0, import_promises14.lstat)(parent);
+  await (0, import_promises15.mkdir)(parent, { recursive: true });
+  const checkedParent = await (0, import_promises15.lstat)(parent);
   if (!checkedParent.isDirectory() || checkedParent.isSymbolicLink()) return result("preserved");
   try {
-    await (0, import_promises14.writeFile)(path2, TASK_CONTRACT_TEMPLATE_CONTENT, { encoding: "utf8", flag: "wx" });
+    await (0, import_promises15.writeFile)(path2, TASK_CONTRACT_TEMPLATE_CONTENT, { encoding: "utf8", flag: "wx" });
     return result("created");
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
     return await existing() ?? result("preserved");
   }
 }
-var import_promises14, import_node_path20, TASK_CONTRACT_TEMPLATE_FILE, TASK_CONTRACT_TEMPLATE_CONTENT;
+var import_promises15, import_node_path21, TASK_CONTRACT_TEMPLATE_FILE, TASK_CONTRACT_TEMPLATE_CONTENT;
 var init_initTaskContract = __esm({
   "src/commands/initTaskContract.ts"() {
     "use strict";
-    import_promises14 = require("node:fs/promises");
-    import_node_path20 = require("node:path");
+    import_promises15 = require("node:fs/promises");
+    import_node_path21 = require("node:path");
     init_taskContract();
     TASK_CONTRACT_TEMPLATE_FILE = ".viberaven/task-contract.template.json";
     TASK_CONTRACT_TEMPLATE_CONTENT = `${JSON.stringify(draftTaskContract(
@@ -16115,22 +16177,18 @@ async function initAgentRules(options) {
       continue;
     }
     const file = AGENT_RULE_TARGETS[target].file;
-    const path2 = (0, import_node_path21.join)(options.cwd, file);
-    const existing = await readExistingFile2(path2);
-    if (target === "skill") {
-      const same = existing.content.replace(/\r\n/g, "\n") === AGENT_SKILL_CONTENT;
-      if (!options.dryRun && !existing.exists) {
-        await (0, import_promises15.mkdir)((0, import_node_path21.dirname)(path2), { recursive: true });
-        await (0, import_promises15.writeFile)(path2, AGENT_SKILL_CONTENT, "utf-8");
-      }
-      results.push({ target, file, path: path2, action: !existing.exists ? "created" : same ? "unchanged" : "preserved" });
+    const path2 = (0, import_node_path22.join)(options.cwd, file);
+    if (target === "skill" || target === "codexSkill") {
+      const action2 = await initAgentSkill({ ...options, file });
+      results.push({ target, file, path: path2, action: action2 });
       continue;
     }
+    const existing = await readExistingFile2(path2);
     const injected = injectAgentRulesBlock(existing.content, renderAgentRulesForTarget(target));
     const action = !existing.exists ? "created" : injected.changed ? "updated" : "unchanged";
     if (!options.dryRun && injected.changed) {
-      await (0, import_promises15.mkdir)((0, import_node_path21.dirname)(path2), { recursive: true });
-      await (0, import_promises15.writeFile)(path2, injected.content, "utf-8");
+      await (0, import_promises16.mkdir)((0, import_node_path22.dirname)(path2), { recursive: true });
+      await (0, import_promises16.writeFile)(path2, injected.content, "utf-8");
     }
     results.push({ target, file, path: path2, action });
   }
@@ -16144,6 +16202,7 @@ async function initAgentRules(options) {
 function withTargetDependencies(requested) {
   const targets = [...new Set(requested)];
   if (targets.includes("claude") && !targets.includes("skill")) targets.push("skill");
+  if (targets.includes("codex") && !targets.includes("codexSkill")) targets.push("codexSkill");
   const standalone = ["cursor", "agentContext", "missionMap", "agentGuide"];
   if (targets.some((target) => !standalone.includes(target)) && !targets.includes("agentGuide")) {
     targets.push("agentGuide");
@@ -16228,7 +16287,7 @@ function formatAgentRulesInitSummary(output) {
 }
 async function readExistingFile2(path2) {
   try {
-    return { exists: true, content: await (0, import_promises15.readFile)(path2, "utf-8") };
+    return { exists: true, content: await (0, import_promises16.readFile)(path2, "utf-8") };
   } catch (error) {
     if (isFileNotFoundError2(error)) {
       return { exists: false, content: "" };
@@ -16239,14 +16298,14 @@ async function readExistingFile2(path2) {
 function isFileNotFoundError2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises15, import_node_path21;
+var import_promises16, import_node_path22;
 var init_initRules = __esm({
   "src/commands/initRules.ts"() {
     "use strict";
-    import_promises15 = require("node:fs/promises");
-    import_node_path21 = require("node:path");
+    import_promises16 = require("node:fs/promises");
+    import_node_path22 = require("node:path");
     init_agentRulesBlock();
-    init_agentSkill();
+    init_initAgentSkill();
     init_agentTargets();
     init_cursorRulesPack();
     init_seedPackageJsonScripts();
@@ -16509,7 +16568,7 @@ async function runInteractiveSession(startDir = process.cwd()) {
   Ie(`${import_picocolors5.default.bold("VibeRaven")} ${import_picocolors5.default.dim(VERSION)}`);
   const cwd = await resolveWorkspaceRoot(startDir);
   const artifactsAt = await findArtifactsWorkspace(startDir);
-  if (artifactsAt && (0, import_node_path22.resolve)(artifactsAt) !== (0, import_node_path22.resolve)(startDir)) {
+  if (artifactsAt && (0, import_node_path23.resolve)(artifactsAt) !== (0, import_node_path23.resolve)(startDir)) {
     M2.message(import_picocolors5.default.dim(`Using scan from: ${artifactsAt}`));
   } else {
     M2.message(import_picocolors5.default.dim(`Project folder: ${cwd}`));
@@ -16568,11 +16627,11 @@ async function runInteractiveSession(startDir = process.cwd()) {
   }
   Se(import_picocolors5.default.dim("Run viberaven anytime for the interactive menu."));
 }
-var import_node_path22, import_picocolors5;
+var import_node_path23, import_picocolors5;
 var init_runInteractive = __esm({
   "src/tui/runInteractive.ts"() {
     "use strict";
-    import_node_path22 = require("node:path");
+    import_node_path23 = require("node:path");
     init_dist2();
     import_picocolors5 = __toESM(require_picocolors());
     init_config();
@@ -16597,18 +16656,18 @@ var init_runInteractive = __esm({
 // src/commands/condense.ts
 async function runCondenseCommand(options) {
   const dir = getProjectArtifactsDir(options.cwd);
-  const artifact2 = JSON.parse(await (0, import_promises16.readFile)((0, import_node_path23.join)(dir, "last-scan.json"), "utf8"));
-  const contextMapPath = (0, import_node_path23.join)(dir, "context-map.json");
-  await (0, import_promises16.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact2), null, 2)}
+  const artifact2 = JSON.parse(await (0, import_promises17.readFile)((0, import_node_path24.join)(dir, "last-scan.json"), "utf8"));
+  const contextMapPath = (0, import_node_path24.join)(dir, "context-map.json");
+  await (0, import_promises17.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact2), null, 2)}
 `, "utf8");
   return { contextMapPath };
 }
-var import_promises16, import_node_path23;
+var import_promises17, import_node_path24;
 var init_condense = __esm({
   "src/commands/condense.ts"() {
     "use strict";
-    import_promises16 = require("node:fs/promises");
-    import_node_path23 = require("node:path");
+    import_promises17 = require("node:fs/promises");
+    import_node_path24 = require("node:path");
     init_config();
     init_contextMap();
   }
@@ -16616,9 +16675,9 @@ var init_condense = __esm({
 
 // src/heal/pathSafety.ts
 function assertSafeHealTarget(cwd, target) {
-  const root = (0, import_node_path24.resolve)(cwd);
-  const absolute = (0, import_node_path24.resolve)(root, target);
-  const rel = (0, import_node_path24.relative)(root, absolute);
+  const root = (0, import_node_path25.resolve)(cwd);
+  const absolute = (0, import_node_path25.resolve)(root, target);
+  const rel = (0, import_node_path25.relative)(root, absolute);
   if (rel.startsWith("..") || rel === "" || /^[A-Za-z]:/.test(rel)) {
     throw new Error("Heal target must stay inside the workspace");
   }
@@ -16628,11 +16687,11 @@ function assertSafeHealTarget(cwd, target) {
   }
   return absolute;
 }
-var import_node_path24, BLOCKED_SEGMENTS;
+var import_node_path25, BLOCKED_SEGMENTS;
 var init_pathSafety = __esm({
   "src/heal/pathSafety.ts"() {
     "use strict";
-    import_node_path24 = require("node:path");
+    import_node_path25 = require("node:path");
     BLOCKED_SEGMENTS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".viberaven"]);
   }
 });
@@ -16658,13 +16717,13 @@ function newHealId(now2 = /* @__PURE__ */ new Date()) {
   return `heal_${now2.toISOString().replace(/\D/g, "").slice(0, 17)}_${(0, import_node_crypto2.randomBytes)(3).toString("hex")}`;
 }
 async function createHealDir(cwd, makeId = () => newHealId()) {
-  const parent = (0, import_node_path25.join)(cwd, ".viberaven", "heal");
-  await (0, import_promises17.mkdir)(parent, { recursive: true });
+  const parent = (0, import_node_path26.join)(cwd, ".viberaven", "heal");
+  await (0, import_promises18.mkdir)(parent, { recursive: true });
   for (let attempt = 0; attempt < 10; attempt += 1) {
     const id2 = makeId();
-    const dir = (0, import_node_path25.join)(parent, id2);
+    const dir = (0, import_node_path26.join)(parent, id2);
     try {
-      await (0, import_promises17.mkdir)(dir);
+      await (0, import_promises18.mkdir)(dir);
       return { id: id2, dir };
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
@@ -16672,13 +16731,13 @@ async function createHealDir(cwd, makeId = () => newHealId()) {
   }
   throw new Error("Could not create a new heal directory under .viberaven/heal.");
 }
-var import_node_crypto2, import_promises17, import_node_path25;
+var import_node_crypto2, import_promises18, import_node_path26;
 var init_healId = __esm({
   "src/heal/healId.ts"() {
     "use strict";
     import_node_crypto2 = require("node:crypto");
-    import_promises17 = require("node:fs/promises");
-    import_node_path25 = require("node:path");
+    import_promises18 = require("node:fs/promises");
+    import_node_path26 = require("node:path");
   }
 });
 
@@ -17145,7 +17204,7 @@ export const config = {
 // src/heal/recipes/eslintRestrictedImports.ts
 function detectEslintConfigFile(cwd) {
   for (const candidate of ESLINT_CONFIG_CANDIDATES) {
-    if ((0, import_node_fs11.existsSync)((0, import_node_path26.join)(cwd, candidate))) {
+    if ((0, import_node_fs11.existsSync)((0, import_node_path27.join)(cwd, candidate))) {
       return candidate;
     }
   }
@@ -17300,12 +17359,12 @@ function applyEslintRestrictedImportsRecipe(source, configFile) {
   }
   return applyLegacyModuleRecipe(source);
 }
-var import_node_fs11, import_node_path26, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
+var import_node_fs11, import_node_path27, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
 var init_eslintRestrictedImports = __esm({
   "src/heal/recipes/eslintRestrictedImports.ts"() {
     "use strict";
     import_node_fs11 = require("node:fs");
-    import_node_path26 = require("node:path");
+    import_node_path27 = require("node:path");
     init_commands();
     VIBERAVEN_ESLINT_MARKER = "VibeRaven heal: eslint_restricted_imports";
     RESTRICTED_IMPORTS_MESSAGE = `Restricted import. Run ${PUBLIC_AGENT_MODE_COMMAND} before substituting packages.`;
@@ -17357,13 +17416,13 @@ function defaultTargetFile(gapId) {
 }
 async function readSourceOrEmpty(absolutePath) {
   if (!(0, import_node_fs12.existsSync)(absolutePath)) return "";
-  return (0, import_promises18.readFile)(absolutePath, "utf8");
+  return (0, import_promises19.readFile)(absolutePath, "utf8");
 }
 async function detectUpstash(cwd) {
   try {
-    const pkgPath = (0, import_node_path27.join)(cwd, "package.json");
+    const pkgPath = (0, import_node_path28.join)(cwd, "package.json");
     if (!(0, import_node_fs12.existsSync)(pkgPath)) return false;
-    const raw = await (0, import_promises18.readFile)(pkgPath, "utf8");
+    const raw = await (0, import_promises19.readFile)(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const deps = {
       ...pkg["dependencies"] ?? {},
@@ -17378,7 +17437,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   const targetFile = explicitTarget ?? defaultTargetFile(gapId);
   if (targetFile === void 0) return null;
   if (gapId === "auth_secret_missing" || gapId === "node_env_not_set" || gapId === "database_url_missing") {
-    const absolutePath = (0, import_node_path27.join)(cwd, targetFile);
+    const absolutePath = (0, import_node_path28.join)(cwd, targetFile);
     const source = await readSourceOrEmpty(absolutePath);
     let result;
     if (gapId === "auth_secret_missing") result = applyAuthSecretRecipe(source);
@@ -17392,25 +17451,25 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
     };
   }
   if (gapId === "missing_error_boundary") {
-    const absolutePath = (0, import_node_path27.join)(cwd, "app/error.tsx");
+    const absolutePath = (0, import_node_path28.join)(cwd, "app/error.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyErrorBoundaryRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_health_route") {
-    const absolutePath = (0, import_node_path27.join)(cwd, "app/api/health/route.ts");
+    const absolutePath = (0, import_node_path28.join)(cwd, "app/api/health/route.ts");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyHealthRouteRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_loading_state") {
-    const absolutePath = (0, import_node_path27.join)(cwd, "app/loading.tsx");
+    const absolutePath = (0, import_node_path28.join)(cwd, "app/loading.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyLoadingStateRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_404_page") {
-    const absolutePath = (0, import_node_path27.join)(cwd, "app/not-found.tsx");
+    const absolutePath = (0, import_node_path28.join)(cwd, "app/not-found.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyNotFoundRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
@@ -17427,10 +17486,10 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_csp_header") {
     let configFile = "next.config.js";
-    let absolutePath = (0, import_node_path27.join)(cwd, configFile);
+    let absolutePath = (0, import_node_path28.join)(cwd, configFile);
     if (!(0, import_node_fs12.existsSync)(absolutePath)) {
       configFile = "next.config.mjs";
-      absolutePath = (0, import_node_path27.join)(cwd, configFile);
+      absolutePath = (0, import_node_path28.join)(cwd, configFile);
     }
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyCspHeaderRecipe(source);
@@ -17442,7 +17501,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_rate_limit") {
     const hasUpstash = await detectUpstash(cwd);
-    const middlewarePath = (0, import_node_path27.join)(cwd, "middleware.ts");
+    const middlewarePath = (0, import_node_path28.join)(cwd, "middleware.ts");
     const source = await readSourceOrEmpty(middlewarePath);
     const result = applyRateLimitRecipe(source, hasUpstash);
     return {
@@ -17464,7 +17523,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
         recipeName: gapId
       };
     }
-    const absolutePath = (0, import_node_path27.join)(cwd, configFile);
+    const absolutePath = (0, import_node_path28.join)(cwd, configFile);
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyEslintRestrictedImportsRecipe(source, configFile);
     return {
@@ -17478,13 +17537,13 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   return null;
 }
-var import_node_fs12, import_promises18, import_node_path27;
+var import_node_fs12, import_promises19, import_node_path28;
 var init_recipes = __esm({
   "src/heal/recipes/index.ts"() {
     "use strict";
     import_node_fs12 = require("node:fs");
-    import_promises18 = require("node:fs/promises");
-    import_node_path27 = require("node:path");
+    import_promises19 = require("node:fs/promises");
+    import_node_path28 = require("node:path");
     init_envAuthSecret();
     init_envNodeEnv();
     init_envDatabaseUrl();
@@ -17561,17 +17620,17 @@ async function applyHeal(options) {
           rollback: { available: false, instructions: "Recipe matched but no change was needed (already applied or file already exists)." }
         };
       }
-      const absoluteTarget = (0, import_node_path28.join)(options.cwd, dispatched.targetFile);
+      const absoluteTarget = (0, import_node_path29.join)(options.cwd, dispatched.targetFile);
       assertSafeHealTarget(options.cwd, dispatched.targetFile);
-      await (0, import_promises19.mkdir)((0, import_node_path28.dirname)(absoluteTarget), { recursive: true });
+      await (0, import_promises20.mkdir)((0, import_node_path29.dirname)(absoluteTarget), { recursive: true });
       const created2 = await createHealDir(options.cwd);
       id2 = created2.id;
       const healDir2 = created2.dir;
-      await (0, import_promises19.mkdir)((0, import_node_path28.join)(healDir2, "before"));
+      await (0, import_promises20.mkdir)((0, import_node_path29.join)(healDir2, "before"));
       const existedBefore = (0, import_node_fs13.existsSync)(absoluteTarget);
-      const beforeContent = existedBefore ? await (0, import_promises19.readFile)(absoluteTarget, "utf8") : "";
-      await (0, import_promises19.writeFile)((0, import_node_path28.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
-      await (0, import_promises19.writeFile)(absoluteTarget, dispatched.output, "utf8");
+      const beforeContent = existedBefore ? await (0, import_promises20.readFile)(absoluteTarget, "utf8") : "";
+      await (0, import_promises20.writeFile)((0, import_node_path29.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
+      await (0, import_promises20.writeFile)(absoluteTarget, dispatched.output, "utf8");
       const patch2 = [
         `--- ${dispatched.targetFile}`,
         `+++ ${dispatched.targetFile}`,
@@ -17581,7 +17640,7 @@ async function applyHeal(options) {
         dispatched.output,
         ""
       ].join("\n");
-      await (0, import_promises19.writeFile)((0, import_node_path28.join)(healDir2, "patch.diff"), patch2, "utf8");
+      await (0, import_promises20.writeFile)((0, import_node_path29.join)(healDir2, "patch.diff"), patch2, "utf8");
       const result2 = {
         $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
         schemaVersion: "v1",
@@ -17593,17 +17652,17 @@ async function applyHeal(options) {
         recipe: dispatched.recipeName,
         ...dispatched.warnings?.length ? { warnings: dispatched.warnings } : {},
         target: dispatched.targetFile,
-        changedFiles: [(0, import_node_path28.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
+        changedFiles: [(0, import_node_path29.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
         artifacts: {
           patch: `.viberaven/heal/${id2}/patch.diff`,
           result: `.viberaven/heal/${id2}/result.json`
         },
         rollback: {
           available: true,
-          instructions: rollbackInstructions(id2, (0, import_node_path28.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/"), existedBefore)
+          instructions: rollbackInstructions(id2, (0, import_node_path29.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/"), existedBefore)
         }
       };
-      await (0, import_promises19.writeFile)((0, import_node_path28.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
+      await (0, import_promises20.writeFile)((0, import_node_path29.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
 `, "utf8");
       return result2;
     }
@@ -17623,7 +17682,7 @@ async function applyHeal(options) {
     };
   }
   const absolute = assertSafeHealTarget(options.cwd, options.target);
-  const before = await (0, import_promises19.readFile)(absolute, "utf8");
+  const before = await (0, import_promises20.readFile)(absolute, "utf8");
   const recipe = applyEmptyCatchRecipe(before);
   if (!recipe.changed) {
     return {
@@ -17643,9 +17702,9 @@ async function applyHeal(options) {
   const created = await createHealDir(options.cwd);
   id2 = created.id;
   const healDir = created.dir;
-  await (0, import_promises19.mkdir)((0, import_node_path28.join)(healDir, "before"));
-  await (0, import_promises19.writeFile)((0, import_node_path28.join)(healDir, "before", "target.txt"), before, "utf8");
-  await (0, import_promises19.writeFile)(absolute, recipe.output, "utf8");
+  await (0, import_promises20.mkdir)((0, import_node_path29.join)(healDir, "before"));
+  await (0, import_promises20.writeFile)((0, import_node_path29.join)(healDir, "before", "target.txt"), before, "utf8");
+  await (0, import_promises20.writeFile)(absolute, recipe.output, "utf8");
   const patch = [
     `--- ${options.target}`,
     `+++ ${options.target}`,
@@ -17655,7 +17714,7 @@ async function applyHeal(options) {
     recipe.output,
     ""
   ].join("\n");
-  await (0, import_promises19.writeFile)((0, import_node_path28.join)(healDir, "patch.diff"), patch, "utf8");
+  await (0, import_promises20.writeFile)((0, import_node_path29.join)(healDir, "patch.diff"), patch, "utf8");
   const result = {
     $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
     schemaVersion: "v1",
@@ -17666,7 +17725,7 @@ async function applyHeal(options) {
     gapId: options.gapId,
     recipe: "empty-catch-safe-response",
     target: options.target,
-    changedFiles: [(0, import_node_path28.relative)(options.cwd, absolute).replace(/\\/g, "/")],
+    changedFiles: [(0, import_node_path29.relative)(options.cwd, absolute).replace(/\\/g, "/")],
     artifacts: {
       patch: `.viberaven/heal/${id2}/patch.diff`,
       result: `.viberaven/heal/${id2}/result.json`
@@ -17674,20 +17733,20 @@ async function applyHeal(options) {
     rollback: {
       available: true,
       // The empty-catch recipe only edits a file that already exists.
-      instructions: rollbackInstructions(id2, (0, import_node_path28.relative)(options.cwd, absolute).replace(/\\/g, "/"), true)
+      instructions: rollbackInstructions(id2, (0, import_node_path29.relative)(options.cwd, absolute).replace(/\\/g, "/"), true)
     }
   };
-  await (0, import_promises19.writeFile)((0, import_node_path28.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises20.writeFile)((0, import_node_path29.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises19, import_node_fs13, import_node_path28;
+var import_promises20, import_node_fs13, import_node_path29;
 var init_apply = __esm({
   "src/heal/apply.ts"() {
     "use strict";
-    import_promises19 = require("node:fs/promises");
+    import_promises20 = require("node:fs/promises");
     import_node_fs13 = require("node:fs");
-    import_node_path28 = require("node:path");
+    import_node_path29 = require("node:path");
     init_pathSafety();
     init_emptyCatch();
     init_healId();
@@ -17697,8 +17756,8 @@ var init_apply = __esm({
 
 // src/heal/plan.ts
 async function writeHealPlan(options) {
-  const dir = (0, import_node_path29.join)(options.cwd, ".viberaven");
-  await (0, import_promises20.mkdir)(dir, { recursive: true });
+  const dir = (0, import_node_path30.join)(options.cwd, ".viberaven");
+  await (0, import_promises21.mkdir)(dir, { recursive: true });
   const id2 = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
   const proposal = [];
@@ -17750,18 +17809,18 @@ async function writeHealPlan(options) {
     artifacts: { plan: ".viberaven/heal-plan.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises20.writeFile)((0, import_node_path29.join)(dir, "heal-plan.md"), markdown, "utf8");
-  await (0, import_promises20.writeFile)((0, import_node_path29.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises21.writeFile)((0, import_node_path30.join)(dir, "heal-plan.md"), markdown, "utf8");
+  await (0, import_promises21.writeFile)((0, import_node_path30.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises20, import_node_path29;
+var import_promises21, import_node_path30;
 var init_plan = __esm({
   "src/heal/plan.ts"() {
     "use strict";
-    import_promises20 = require("node:fs/promises");
+    import_promises21 = require("node:fs/promises");
     init_healId();
-    import_node_path29 = require("node:path");
+    import_node_path30 = require("node:path");
     init_commands();
     init_supabaseRls2();
   }
@@ -17769,8 +17828,8 @@ var init_plan = __esm({
 
 // src/heal/prompt.ts
 async function writeHealPrompt(options) {
-  const dir = (0, import_node_path30.join)(options.cwd, ".viberaven");
-  await (0, import_promises21.mkdir)(dir, { recursive: true });
+  const dir = (0, import_node_path31.join)(options.cwd, ".viberaven");
+  await (0, import_promises22.mkdir)(dir, { recursive: true });
   const id2 = newHealId();
   const target = options.target ?? `gap:${options.gapId}`;
   const prompt = [
@@ -17797,16 +17856,16 @@ async function writeHealPrompt(options) {
     artifacts: { prompt: ".viberaven/heal-prompt.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises21.writeFile)((0, import_node_path30.join)(dir, "heal-prompt.md"), prompt, "utf8");
+  await (0, import_promises22.writeFile)((0, import_node_path31.join)(dir, "heal-prompt.md"), prompt, "utf8");
   return result;
 }
-var import_promises21, import_node_path30;
+var import_promises22, import_node_path31;
 var init_prompt = __esm({
   "src/heal/prompt.ts"() {
     "use strict";
-    import_promises21 = require("node:fs/promises");
+    import_promises22 = require("node:fs/promises");
     init_healId();
-    import_node_path30 = require("node:path");
+    import_node_path31 = require("node:path");
     init_commands();
   }
 });
@@ -17817,7 +17876,7 @@ function loopStatePath(workspaceRoot) {
 }
 async function loadLoopState(workspaceRoot) {
   try {
-    const raw = await (0, import_promises22.readFile)(loopStatePath(workspaceRoot), "utf8");
+    const raw = await (0, import_promises23.readFile)(loopStatePath(workspaceRoot), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.batchApplied === "number" && typeof parsed.lastGapCount === "number" && typeof parsed.stalledScans === "number") {
       const p2 = parsed;
@@ -17837,8 +17896,8 @@ async function loadLoopState(workspaceRoot) {
 async function saveLoopState(workspaceRoot, state) {
   try {
     const dir = (0, import_path.join)(workspaceRoot, ".viberaven");
-    await (0, import_promises22.mkdir)(dir, { recursive: true });
-    await (0, import_promises22.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
+    await (0, import_promises23.mkdir)(dir, { recursive: true });
+    await (0, import_promises23.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
   } catch (err) {
     console.warn("[VibeRaven] Could not save loop-state.json:", err instanceof Error ? err.message : String(err));
   }
@@ -17864,11 +17923,11 @@ function resetBatch(state, newGapCount) {
     appliedGapIdsSinceScan: []
   };
 }
-var import_promises22, import_path, DEFAULT_LOOP_STATE;
+var import_promises23, import_path, DEFAULT_LOOP_STATE;
 var init_loopState = __esm({
   "src/loopState.ts"() {
     "use strict";
-    import_promises22 = require("fs/promises");
+    import_promises23 = require("fs/promises");
     import_path = require("path");
     DEFAULT_LOOP_STATE = {
       batchApplied: 0,
@@ -17909,11 +17968,11 @@ var init_heal = __esm({
 
 // src/stackRecommend.ts
 async function recommendStack(cwd = process.cwd()) {
-  const pkgPath = (0, import_node_path31.join)(cwd, "package.json");
+  const pkgPath = (0, import_node_path32.join)(cwd, "package.json");
   if (!(0, import_node_fs14.existsSync)(pkgPath)) {
     return DEFAULT_STACK;
   }
-  const pkg = JSON.parse(await (0, import_promises23.readFile)(pkgPath, "utf-8"));
+  const pkg = JSON.parse(await (0, import_promises24.readFile)(pkgPath, "utf-8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   const names = Object.keys(deps).join(" ").toLowerCase();
   const rec = {
@@ -17941,13 +18000,13 @@ async function recommendStack(cwd = process.cwd()) {
   }
   return rec;
 }
-var import_promises23, import_node_fs14, import_node_path31, DEFAULT_STACK;
+var import_promises24, import_node_fs14, import_node_path32, DEFAULT_STACK;
 var init_stackRecommend = __esm({
   "src/stackRecommend.ts"() {
     "use strict";
-    import_promises23 = require("node:fs/promises");
+    import_promises24 = require("node:fs/promises");
     import_node_fs14 = require("node:fs");
-    import_node_path31 = require("node:path");
+    import_node_path32 = require("node:path");
     DEFAULT_STACK = {
       frontend: "react",
       ui: "tailwind + shadcn/ui",
@@ -18104,13 +18163,13 @@ async function hasGithubRemote(cwd) {
   }
 }
 async function githubWorkflowStatus(cwd) {
-  return { exists: (0, import_node_fs15.existsSync)((0, import_node_path32.join)(cwd, WORKFLOW_PATH)), path: DISPLAY_PATH, publisherExists: (0, import_node_fs15.existsSync)((0, import_node_path32.join)(cwd, PUBLISHER_PATH)), publisherPath: DISPLAY_PUBLISHER, onGithub: await hasGithubRemote(cwd) };
+  return { exists: (0, import_node_fs15.existsSync)((0, import_node_path33.join)(cwd, WORKFLOW_PATH)), path: DISPLAY_PATH, publisherExists: (0, import_node_fs15.existsSync)((0, import_node_path33.join)(cwd, PUBLISHER_PATH)), publisherPath: DISPLAY_PUBLISHER, onGithub: await hasGithubRemote(cwd) };
 }
 async function writeGithubWorkflow(cwd, options = {}) {
-  const targets = [(0, import_node_path32.join)(cwd, WORKFLOW_PATH), (0, import_node_path32.join)(cwd, PUBLISHER_PATH)];
-  for (const parent of [(0, import_node_path32.join)(cwd, ".github"), (0, import_node_path32.join)(cwd, ".github", "workflows")]) {
+  const targets = [(0, import_node_path33.join)(cwd, WORKFLOW_PATH), (0, import_node_path33.join)(cwd, PUBLISHER_PATH)];
+  for (const parent of [(0, import_node_path33.join)(cwd, ".github"), (0, import_node_path33.join)(cwd, ".github", "workflows")]) {
     try {
-      const stat12 = await (0, import_promises24.lstat)(parent);
+      const stat12 = await (0, import_promises25.lstat)(parent);
       if (!stat12.isDirectory() || stat12.isSymbolicLink()) throw new Error("Workflow directory must be a regular directory");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
@@ -18119,31 +18178,31 @@ async function writeGithubWorkflow(cwd, options = {}) {
   if (!options.force && targets.some(import_node_fs15.existsSync)) return { written: false, status: await githubWorkflowStatus(cwd) };
   const originals = await Promise.all(targets.map(async (p2) => {
     try {
-      if (!(await (0, import_promises24.lstat)(p2)).isFile()) throw new Error("Workflow target must be a regular file");
-      return await (0, import_promises24.readFile)(p2);
+      if (!(await (0, import_promises25.lstat)(p2)).isFile()) throw new Error("Workflow target must be a regular file");
+      return await (0, import_promises25.readFile)(p2);
     } catch (error) {
       if (error.code === "ENOENT") return null;
       throw error;
     }
   }));
-  await (0, import_promises24.mkdir)((0, import_node_path32.dirname)(targets[0]), { recursive: true });
-  const stagingDirectory = await (0, import_promises24.mkdtemp)((0, import_node_path32.join)((0, import_node_path32.dirname)(targets[0]), ".viberaven-stage-"));
-  const staged = targets.map((_3, i) => (0, import_node_path32.join)(stagingDirectory, `${i}.yml`));
+  await (0, import_promises25.mkdir)((0, import_node_path33.dirname)(targets[0]), { recursive: true });
+  const stagingDirectory = await (0, import_promises25.mkdtemp)((0, import_node_path33.join)((0, import_node_path33.dirname)(targets[0]), ".viberaven-stage-"));
+  const staged = targets.map((_3, i) => (0, import_node_path33.join)(stagingDirectory, `${i}.yml`));
   let replaced = 0;
   try {
-    for (const [i, content] of [renderWorkflow(), renderPublisherWorkflow()].entries()) await (0, import_promises24.writeFile)(staged[i], content, { encoding: "utf8", flag: "wx" });
+    for (const [i, content] of [renderWorkflow(), renderPublisherWorkflow()].entries()) await (0, import_promises25.writeFile)(staged[i], content, { encoding: "utf8", flag: "wx" });
     for (const [i, target] of targets.entries()) {
-      await (0, import_promises24.rename)(staged[i], target);
+      await (0, import_promises25.rename)(staged[i], target);
       replaced++;
     }
   } catch (error) {
     for (let i = 0; i < replaced; i++) {
-      if (originals[i] === null) await (0, import_promises24.rm)(targets[i], { force: true });
-      else await (0, import_promises24.writeFile)(targets[i], originals[i]);
+      if (originals[i] === null) await (0, import_promises25.rm)(targets[i], { force: true });
+      else await (0, import_promises25.writeFile)(targets[i], originals[i]);
     }
     throw error;
   } finally {
-    await (0, import_promises24.rm)(stagingDirectory, { recursive: true, force: true });
+    await (0, import_promises25.rm)(stagingDirectory, { recursive: true, force: true });
   }
   return { written: true, status: await githubWorkflowStatus(cwd) };
 }
@@ -18167,20 +18226,20 @@ ${renderPublisherWorkflow()}`);
   if (!status.onGithub) console.log("No github.com remote found; these workflows run after you push them to GitHub.");
   return 0;
 }
-var import_node_child_process6, import_node_fs15, import_promises24, import_node_path32, import_node_util4, execFileAsync4, WORKFLOW_PATH, PUBLISHER_PATH, SCAN_NAME, PUBLISHER_NAME, DISPLAY_PATH, DISPLAY_PUBLISHER, CHECKOUT, NODE, UPLOAD;
+var import_node_child_process6, import_node_fs15, import_promises25, import_node_path33, import_node_util4, execFileAsync4, WORKFLOW_PATH, PUBLISHER_PATH, SCAN_NAME, PUBLISHER_NAME, DISPLAY_PATH, DISPLAY_PUBLISHER, CHECKOUT, NODE, UPLOAD;
 var init_initGithub = __esm({
   "src/commands/initGithub.ts"() {
     "use strict";
     import_node_child_process6 = require("node:child_process");
     import_node_fs15 = require("node:fs");
-    import_promises24 = require("node:fs/promises");
-    import_node_path32 = require("node:path");
+    import_promises25 = require("node:fs/promises");
+    import_node_path33 = require("node:path");
     import_node_util4 = require("node:util");
     init_safeGit();
     init_version();
     execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process6.execFile);
-    WORKFLOW_PATH = (0, import_node_path32.join)(".github", "workflows", "viberaven.yml");
-    PUBLISHER_PATH = (0, import_node_path32.join)(".github", "workflows", "viberaven-comment.yml");
+    WORKFLOW_PATH = (0, import_node_path33.join)(".github", "workflows", "viberaven.yml");
+    PUBLISHER_PATH = (0, import_node_path33.join)(".github", "workflows", "viberaven-comment.yml");
     SCAN_NAME = "VibeRaven";
     PUBLISHER_NAME = "VibeRaven feedback";
     DISPLAY_PATH = ".github/workflows/viberaven.yml";
@@ -18210,7 +18269,7 @@ function managedBlocks(content) {
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item4 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists2 = await fileExists2((0, import_node_path33.join)(cwd, item4.file));
+    const exists2 = await fileExists2((0, import_node_path34.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists2 ? "pass" : "fail",
@@ -18218,17 +18277,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item4 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists2 = await fileExists2((0, import_node_path33.join)(cwd, item4.file));
+    const exists2 = await fileExists2((0, import_node_path34.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists2 ? "pass" : "fail",
       message: exists2 ? `${item4.file} exists` : `Missing ${item4.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path33.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path34.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
-    const legacyContent = await (0, import_promises25.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path33.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const legacyContent = await (0, import_promises26.readFile)(legacyCursorPath, "utf-8");
+    const hasCoreSplit = await fileExists2((0, import_node_path34.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -18239,7 +18298,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path2 = (0, import_node_path33.join)(cwd, file);
+    const path2 = (0, import_node_path34.join)(cwd, file);
     const exists2 = await fileExists2(path2);
     if (!exists2) {
       checks.push({
@@ -18249,7 +18308,7 @@ async function checkAgentInjection(cwd) {
       });
       continue;
     }
-    const content = await (0, import_promises25.readFile)(path2, "utf-8");
+    const content = await (0, import_promises26.readFile)(path2, "utf-8");
     const hasCommand = content.includes(PUBLIC_CHECK_COMMAND);
     checks.push({
       id: `canonical-${target}`,
@@ -18292,18 +18351,18 @@ function formatDoctorAgentsReport(report2) {
 }
 async function fileExists2(path2) {
   try {
-    await (0, import_promises25.access)(path2);
+    await (0, import_promises26.access)(path2);
     return true;
   } catch {
     return false;
   }
 }
-var import_promises25, import_node_path33, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
+var import_promises26, import_node_path34, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS, GATE_RULE_PHRASES_1_5_2;
 var init_doctorAgents = __esm({
   "src/commands/doctorAgents.ts"() {
     "use strict";
-    import_promises25 = require("node:fs/promises");
-    import_node_path33 = require("node:path");
+    import_promises26 = require("node:fs/promises");
+    import_node_path34 = require("node:path");
     init_commands();
     init_agentTargets();
     REQUIRED_EXISTENCE_CHECKS = [
@@ -18574,7 +18633,7 @@ function buildContextCleanupPlan(input) {
   const items = [];
   const seen = /* @__PURE__ */ new Set();
   for (const file of input.files) {
-    const path2 = normalizePath5((0, import_node_path34.relative)(input.projectRoot, file.path) || file.path);
+    const path2 = normalizePath5((0, import_node_path35.relative)(input.projectRoot, file.path) || file.path);
     const fullPath = normalizePath5(file.path);
     const category = categorizeCleanupFile(path2, fullPath, file);
     if (!category || seen.has(path2)) {
@@ -18600,10 +18659,10 @@ async function collectCleanupFiles(projectRoot) {
   return files;
 }
 async function writeCleanupPlan(projectRoot, plan) {
-  const outputDir = (0, import_node_path34.join)(projectRoot, ".viberaven");
-  const outputPath = (0, import_node_path34.join)(outputDir, "context-cleanup.md");
-  await (0, import_promises26.mkdir)(outputDir, { recursive: true });
-  await (0, import_promises26.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
+  const outputDir = (0, import_node_path35.join)(projectRoot, ".viberaven");
+  const outputPath = (0, import_node_path35.join)(outputDir, "context-cleanup.md");
+  await (0, import_promises27.mkdir)(outputDir, { recursive: true });
+  await (0, import_promises27.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
   return outputPath;
 }
 function categorizeCleanupFile(relativePath, fullPath, file) {
@@ -18651,7 +18710,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
   }
   let entries;
   try {
-    entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
+    entries = await (0, import_promises27.readdir)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -18659,9 +18718,9 @@ async function walkCleanupFiles(root, dir, result, depth) {
     if (SKIP_DIRECTORIES.has(entry.name)) {
       continue;
     }
-    const absolute = (0, import_node_path34.join)(dir, entry.name);
+    const absolute = (0, import_node_path35.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (isCachePath(normalizePath5((0, import_node_path34.relative)(root, absolute)))) {
+      if (isCachePath(normalizePath5((0, import_node_path35.relative)(root, absolute)))) {
         result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
         continue;
       }
@@ -18672,7 +18731,7 @@ async function walkCleanupFiles(root, dir, result, depth) {
       continue;
     }
     try {
-      const fileStat = await (0, import_promises26.stat)(absolute);
+      const fileStat = await (0, import_promises27.stat)(absolute);
       result.push({ path: absolute, sizeBytes: fileStat.size, kind: "file" });
     } catch {
       continue;
@@ -18682,12 +18741,12 @@ async function walkCleanupFiles(root, dir, result, depth) {
 function normalizePath5(path2) {
   return path2.replace(/\\/g, "/");
 }
-var import_promises26, import_node_path34, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
+var import_promises27, import_node_path35, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
 var init_cleanPlan = __esm({
   "src/commands/cleanPlan.ts"() {
     "use strict";
-    import_promises26 = require("node:fs/promises");
-    import_node_path34 = require("node:path");
+    import_promises27 = require("node:fs/promises");
+    import_node_path35 = require("node:path");
     MAX_WALK_DEPTH = 5;
     LARGE_LOG_BYTES = 8192;
     SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -18807,10 +18866,10 @@ var init_render = __esm({
 
 // src/commands/actions.ts
 async function runActionsCommand(input) {
-  const actionsPath = (0, import_node_path35.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path36.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   let raw;
   try {
-    raw = await (0, import_promises27.readFile)(actionsPath, "utf8");
+    raw = await (0, import_promises28.readFile)(actionsPath, "utf8");
   } catch {
     process.stderr.write("No VibeRaven actions found. Run `npx -y viberaven --agent-mode` first.\n");
     return 1;
@@ -18824,12 +18883,12 @@ async function runActionsCommand(input) {
   process.stdout.write(renderActionSurface(manifest));
   return 0;
 }
-var import_promises27, import_node_path35;
+var import_promises28, import_node_path36;
 var init_actions = __esm({
   "src/commands/actions.ts"() {
     "use strict";
-    import_promises27 = require("node:fs/promises");
-    import_node_path35 = require("node:path");
+    import_promises28 = require("node:fs/promises");
+    import_node_path36 = require("node:path");
     init_render();
     init_config();
   }
@@ -18838,7 +18897,7 @@ var init_actions = __esm({
 // src/commands/verifyAction.ts
 async function currentActionExists(cwd, actionId) {
   try {
-    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
+    const raw = await (0, import_promises29.readFile)((0, import_node_path37.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
     const manifest = JSON.parse(raw);
     return manifest.actions.some((action) => action.id === actionId);
   } catch {
@@ -18882,12 +18941,12 @@ This only looks the action up. Run \`npx -y viberaven --verify\` to scan the rep
   );
   return 0;
 }
-var import_promises28, import_node_path36;
+var import_promises29, import_node_path37;
 var init_verifyAction = __esm({
   "src/commands/verifyAction.ts"() {
     "use strict";
-    import_promises28 = require("node:fs/promises");
-    import_node_path36 = require("node:path");
+    import_promises29 = require("node:fs/promises");
+    import_node_path37 = require("node:path");
     init_registry2();
     init_config();
   }
@@ -19111,19 +19170,19 @@ async function exportCommit(cwd, commit) {
     throw new Error("Git snapshot exceeds the supported size limit (32 MB per file, 128 MB total). The comparison is incomplete.");
   }
   const blobs = await readBlobs(cwd, [...new Set(entries.map((entry) => entry.sha))]);
-  const root = await (0, import_promises29.mkdtemp)((0, import_node_path37.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
+  const root = await (0, import_promises30.mkdtemp)((0, import_node_path38.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
   try {
     for (const entry of entries) {
-      const target = (0, import_node_path37.resolve)(root, ...entry.path.split("/"));
-      if (!target.startsWith(root + import_node_path37.sep)) throw new Error("Invalid Git snapshot path");
+      const target = (0, import_node_path38.resolve)(root, ...entry.path.split("/"));
+      if (!target.startsWith(root + import_node_path38.sep)) throw new Error("Invalid Git snapshot path");
       const content = blobs.get(entry.sha);
       if (!content || content.length !== entry.size) throw new Error("Git snapshot blob is missing or truncated");
-      await (0, import_promises29.mkdir)((0, import_node_path37.dirname)(target), { recursive: true });
-      await (0, import_promises29.writeFile)(target, content);
+      await (0, import_promises30.mkdir)((0, import_node_path38.dirname)(target), { recursive: true });
+      await (0, import_promises30.writeFile)(target, content);
     }
     return root;
   } catch (error) {
-    await (0, import_promises29.rm)(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
+    await (0, import_promises30.rm)(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
     throw error;
   }
 }
@@ -19135,7 +19194,7 @@ async function checkChange(cwd, ref, head) {
     if (!result.ok) throw new Error(`The check on ${ref} did not finish: ${result.message}`);
     return compareFindings(result.artifact.gaps, head, ref, baseCommit);
   } finally {
-    await (0, import_promises29.rm)(folder, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
+    await (0, import_promises30.rm)(folder, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
   }
 }
 function cell(text2) {
@@ -19192,14 +19251,14 @@ function renderCheckMarkdown({ head, change, version, score }) {
   return `${lines.join("\n")}
 `;
 }
-var import_node_child_process7, import_promises29, import_node_os, import_node_path37, import_node_util5, execFileAsync5, MAX_BLOB_BYTES, MAX_SNAPSHOT_BYTES, SKIP_SEGMENTS, SEVERITY_RANK3, LOCATION_TEXT, SUBJECT, COMMENT_MARKER, DOT;
+var import_node_child_process7, import_promises30, import_node_os, import_node_path38, import_node_util5, execFileAsync5, MAX_BLOB_BYTES, MAX_SNAPSHOT_BYTES, SKIP_SEGMENTS, SEVERITY_RANK3, LOCATION_TEXT, SUBJECT, COMMENT_MARKER, DOT;
 var init_checkChange = __esm({
   "src/commands/checkChange.ts"() {
     "use strict";
     import_node_child_process7 = require("node:child_process");
-    import_promises29 = require("node:fs/promises");
+    import_promises30 = require("node:fs/promises");
     import_node_os = require("node:os");
-    import_node_path37 = require("node:path");
+    import_node_path38 = require("node:path");
     import_node_util5 = require("node:util");
     init_runScan();
     init_safeGit();
@@ -19356,7 +19415,7 @@ ${message}
 }
 async function readUserFollowUps(actionsPath) {
   try {
-    return JSON.parse(await (0, import_promises30.readFile)(actionsPath, "utf8")).userFollowUps ?? [];
+    return JSON.parse(await (0, import_promises31.readFile)(actionsPath, "utf8")).userFollowUps ?? [];
   } catch {
     return [];
   }
@@ -19369,11 +19428,11 @@ async function printUserFollowUps(actionsPath) {
     for (const step of followUp.userSteps) console.log(`  - ${step} (${followUp.gapId ?? followUp.id})`);
   }
 }
-var import_promises30, SEVERITY_ICON, SEVERITY_ORDER3, CHECK_NEXT_STEP;
+var import_promises31, SEVERITY_ICON, SEVERITY_ORDER3, CHECK_NEXT_STEP;
 var init_check = __esm({
   "src/commands/check.ts"() {
     "use strict";
-    import_promises30 = require("node:fs/promises");
+    import_promises31 = require("node:fs/promises");
     init_runScan();
     init_artifacts2();
     init_statusLabels();
@@ -19400,18 +19459,18 @@ var init_check = __esm({
 // src/hosted/credentials.ts
 function defaultConfigDir(env = process.env, platform = process.platform) {
   const override = env.VIBERAVEN_CONFIG_DIR?.trim();
-  if (override) return (0, import_node_path38.resolve)(override);
+  if (override) return (0, import_node_path39.resolve)(override);
   if (platform === "win32") {
-    return (0, import_node_path38.join)(env.APPDATA?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), "AppData", "Roaming"), "viberaven");
+    return (0, import_node_path39.join)(env.APPDATA?.trim() || (0, import_node_path39.join)((0, import_node_os2.homedir)(), "AppData", "Roaming"), "viberaven");
   }
   if (platform === "darwin") {
-    return (0, import_node_path38.join)((0, import_node_os2.homedir)(), "Library", "Application Support", "viberaven");
+    return (0, import_node_path39.join)((0, import_node_os2.homedir)(), "Library", "Application Support", "viberaven");
   }
-  return (0, import_node_path38.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path38.join)((0, import_node_os2.homedir)(), ".config"), "viberaven");
+  return (0, import_node_path39.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path39.join)((0, import_node_os2.homedir)(), ".config"), "viberaven");
 }
 function isInside(child, parent) {
-  const rel = (0, import_node_path38.relative)((0, import_node_path38.resolve)(parent), (0, import_node_path38.resolve)(child));
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path38.isAbsolute)(rel);
+  const rel = (0, import_node_path39.relative)((0, import_node_path39.resolve)(parent), (0, import_node_path39.resolve)(child));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path39.isAbsolute)(rel);
 }
 async function retryTransient(work) {
   for (let attempt = 1; ; attempt += 1) {
@@ -19424,15 +19483,15 @@ async function retryTransient(work) {
     }
   }
 }
-var import_node_child_process8, import_node_crypto3, import_promises31, import_node_os2, import_node_path38, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
+var import_node_child_process8, import_node_crypto3, import_promises32, import_node_os2, import_node_path39, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
 var init_credentials = __esm({
   "src/hosted/credentials.ts"() {
     "use strict";
     import_node_child_process8 = require("node:child_process");
     import_node_crypto3 = require("node:crypto");
-    import_promises31 = require("node:fs/promises");
+    import_promises32 = require("node:fs/promises");
     import_node_os2 = require("node:os");
-    import_node_path38 = require("node:path");
+    import_node_path39 = require("node:path");
     CREDENTIALS_FILE_NAME = "credentials.json";
     CredentialLocationError = class extends Error {
     };
@@ -19459,9 +19518,9 @@ var init_credentials = __esm({
       constructor(configDir, workspacePath, options = {}) {
         this.configDir = configDir;
         this.workspacePath = workspacePath;
-        this.path = (0, import_node_path38.join)(configDir, CREDENTIALS_FILE_NAME);
+        this.path = (0, import_node_path39.join)(configDir, CREDENTIALS_FILE_NAME);
         this.restrict = options.restrict !== void 0 ? options.restrict : process.platform === "win32" ? restrictWithIcacls : null;
-        this.fs = { readFile: (path2, encoding) => (0, import_promises31.readFile)(path2, encoding), rename: (from, to) => (0, import_promises31.rename)(from, to), rm: (path2) => (0, import_promises31.rm)(path2, { force: true }), ...options.fs };
+        this.fs = { readFile: (path2, encoding) => (0, import_promises32.readFile)(path2, encoding), rename: (from, to) => (0, import_promises32.rename)(from, to), rm: (path2) => (0, import_promises32.rm)(path2, { force: true }), ...options.fs };
       }
       path;
       restrict;
@@ -19510,15 +19569,15 @@ var init_credentials = __esm({
             `Refusing to store the VibeRaven sign-in inside this project (${this.configDir}). Set VIBERAVEN_CONFIG_DIR to a folder outside the repo.`
           );
         }
-        await (0, import_promises31.mkdir)(this.configDir, { recursive: true, mode: 448 });
+        await (0, import_promises32.mkdir)(this.configDir, { recursive: true, mode: 448 });
         const temp = `${this.path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-        await (0, import_promises31.writeFile)(temp, `${JSON.stringify(body, null, 2)}
+        await (0, import_promises32.writeFile)(temp, `${JSON.stringify(body, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await (0, import_promises31.chmod)(temp, 384).catch(() => void 0);
+        await (0, import_promises32.chmod)(temp, 384).catch(() => void 0);
         try {
           if (this.restrict) await this.restrict(temp);
         } catch (error) {
-          await (0, import_promises31.rm)(temp, { force: true });
+          await (0, import_promises32.rm)(temp, { force: true });
           const code = error?.code;
           const toolMissing = code === "ENOENT";
           throw new CredentialPermissionError(
@@ -19529,17 +19588,17 @@ var init_credentials = __esm({
         if (guard) {
           const onDisk = await this.readFor(guard.apiBaseUrl);
           if (onDisk?.accessToken !== guard.accessToken || guard.isCurrent && !guard.isCurrent()) {
-            await (0, import_promises31.rm)(temp, { force: true });
+            await (0, import_promises32.rm)(temp, { force: true });
             return false;
           }
         }
         try {
           await retryTransient(() => this.fs.rename(temp, this.path));
         } catch (error) {
-          await (0, import_promises31.rm)(temp, { force: true });
+          await (0, import_promises32.rm)(temp, { force: true });
           throw error;
         }
-        await (0, import_promises31.chmod)(this.path, 384).catch(() => void 0);
+        await (0, import_promises32.chmod)(this.path, 384).catch(() => void 0);
         return true;
       }
       /** Keeps the stored plan label in step with what the API last said. */
@@ -20566,7 +20625,7 @@ function buildMissionCards(artifact2, providers) {
   };
 }
 function projectNameFromPath(pathValue) {
-  return (0, import_node_path39.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
+  return (0, import_node_path40.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
 }
 function gapSearchText(gap) {
   return [
@@ -20978,19 +21037,19 @@ function mapArtifactToLocalUiState(artifact2, presentProviderIds) {
     selectedProviderId: selectedProvider.id,
     currentPrompt: selectedProvider.nextFix?.prompt ?? "",
     artifacts: {
-      tasklist: (0, import_node_path39.join)(".viberaven", "agent-tasklist.md"),
-      contextMap: (0, import_node_path39.join)(".viberaven", "context-map.json"),
-      gateResult: (0, import_node_path39.join)(".viberaven", "gate-result.json"),
-      lastScan: (0, import_node_path39.join)(".viberaven", "last-scan.json")
+      tasklist: (0, import_node_path40.join)(".viberaven", "agent-tasklist.md"),
+      contextMap: (0, import_node_path40.join)(".viberaven", "context-map.json"),
+      gateResult: (0, import_node_path40.join)(".viberaven", "gate-result.json"),
+      lastScan: (0, import_node_path40.join)(".viberaven", "last-scan.json")
     },
     empty: false
   };
 }
-var import_node_path39, GATE_LABEL, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
+var import_node_path40, GATE_LABEL, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
 var init_artifactAdapter = __esm({
   "src/local-ui/artifactAdapter.ts"() {
     "use strict";
-    import_node_path39 = require("node:path");
+    import_node_path40 = require("node:path");
     init_providerLogos();
     init_buildTaskList();
     init_prompts();
@@ -21332,7 +21391,7 @@ async function buildHostedCheckPayload(workspacePath) {
   throw new Error("Could not assemble the full check request.");
 }
 function finalizePayload(payload) {
-  const folder = (0, import_node_path40.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
+  const folder = (0, import_node_path41.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
   const redacted = redactPayload({ ...payload, workspacePath: folder });
   return { payload: redacted.payload, redactions: redacted.count };
 }
@@ -21363,13 +21422,13 @@ function splitSections(prompt) {
     chars: section.length
   }));
 }
-var import_node_path40, PayloadCaptured;
+var import_node_path41, PayloadCaptured;
 var init_payload = __esm({
   "src/hosted/payload.ts"() {
     "use strict";
     init_fileScanner();
     init_orchestrator();
-    import_node_path40 = require("node:path");
+    import_node_path41 = require("node:path");
     init_config();
     init_redact();
     PayloadCaptured = class extends Error {
@@ -21452,13 +21511,13 @@ function readServerMessage(body) {
     return body.slice(0, 300);
   }
 }
-var import_node_crypto4, import_promises32, import_node_path41, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK4, isRecordValue, isFinding, FullCheckService;
+var import_node_crypto4, import_promises33, import_node_path42, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK4, isRecordValue, isFinding, FullCheckService;
 var init_fullCheck = __esm({
   "src/hosted/fullCheck.ts"() {
     "use strict";
     import_node_crypto4 = require("node:crypto");
-    import_promises32 = require("node:fs/promises");
-    import_node_path41 = require("node:path");
+    import_promises33 = require("node:fs/promises");
+    import_node_path42 = require("node:path");
     init_engines();
     init_planLimits();
     init_productionMapLanes();
@@ -21774,27 +21833,27 @@ var init_fullCheck = __esm({
        */
       async latest() {
         try {
-          const saved = JSON.parse(await (0, import_promises32.readFile)(this.latestPath(), "utf8"));
+          const saved = JSON.parse(await (0, import_promises33.readFile)(this.latestPath(), "utf8"));
           return isSavedResult(saved) ? saved : null;
         } catch {
           return null;
         }
       }
       latestPath() {
-        const key = (0, import_node_crypto4.createHash)("sha256").update(process.platform === "win32" ? (0, import_node_path41.resolve)(this.workspacePath).toLowerCase() : (0, import_node_path41.resolve)(this.workspacePath)).digest("hex").slice(0, 24);
-        return (0, import_node_path41.join)(this.configDir, "full-checks", `${key}.json`);
+        const key = (0, import_node_crypto4.createHash)("sha256").update(process.platform === "win32" ? (0, import_node_path42.resolve)(this.workspacePath).toLowerCase() : (0, import_node_path42.resolve)(this.workspacePath)).digest("hex").slice(0, 24);
+        return (0, import_node_path42.join)(this.configDir, "full-checks", `${key}.json`);
       }
       /** Best effort: a result the user paid for is shown even if it cannot be written. */
       async saveLatest(result) {
         const path2 = this.latestPath();
         const temp = `${path2}.${(0, import_node_crypto4.randomUUID)()}.tmp`;
         try {
-          await (0, import_promises32.mkdir)((0, import_node_path41.join)(this.configDir, "full-checks"), { recursive: true });
-          await (0, import_promises32.writeFile)(temp, `${JSON.stringify(result, null, 2)}
+          await (0, import_promises33.mkdir)((0, import_node_path42.join)(this.configDir, "full-checks"), { recursive: true });
+          await (0, import_promises33.writeFile)(temp, `${JSON.stringify(result, null, 2)}
 `, "utf8");
-          await (0, import_promises32.rename)(temp, path2);
+          await (0, import_promises33.rename)(temp, path2);
         } catch {
-          await (0, import_promises32.unlink)(temp).catch(() => void 0);
+          await (0, import_promises33.unlink)(temp).catch(() => void 0);
         }
       }
       signInView(pending) {
@@ -21954,12 +22013,12 @@ function publicRun(run) {
   const { events: _events, ...rest } = run;
   return rest;
 }
-var import_promises33, import_node_path42, import_node_crypto5, TERMINAL_STATES, FINISHED_STEP, MAX_EVENTS, MAX_TEXT, RunStore;
+var import_promises34, import_node_path43, import_node_crypto5, TERMINAL_STATES, FINISHED_STEP, MAX_EVENTS, MAX_TEXT, RunStore;
 var init_runs = __esm({
   "src/local-ui/actions/runs.ts"() {
     "use strict";
-    import_promises33 = require("node:fs/promises");
-    import_node_path42 = require("node:path");
+    import_promises34 = require("node:fs/promises");
+    import_node_path43 = require("node:path");
     import_node_crypto5 = require("node:crypto");
     TERMINAL_STATES = /* @__PURE__ */ new Set(["succeeded", "partially_completed", "failed", "cancelled", "interrupted"]);
     FINISHED_STEP = /* @__PURE__ */ new Set(["done", "failed", "skipped", "unknown"]);
@@ -21981,13 +22040,13 @@ var init_runs = __esm({
       async readAll() {
         let names = [];
         try {
-          names = (await (0, import_promises33.readdir)(this.dir)).filter((name) => /^run_[a-z0-9_]+\.json$/.test(name));
+          names = (await (0, import_promises34.readdir)(this.dir)).filter((name) => /^run_[a-z0-9_]+\.json$/.test(name));
         } catch {
           return;
         }
         for (const name of names) {
           try {
-            const parsed = JSON.parse(await (0, import_promises33.readFile)((0, import_node_path42.join)(this.dir, name), "utf8"));
+            const parsed = JSON.parse(await (0, import_promises34.readFile)((0, import_node_path43.join)(this.dir, name), "utf8"));
             if (!parsed?.id || !Array.isArray(parsed.steps) || !Array.isArray(parsed.events)) continue;
             this.runs.set(parsed.id, parsed);
             if (!TERMINAL_STATES.has(parsed.state)) {
@@ -22113,11 +22172,11 @@ var init_runs = __esm({
         const previous = this.writes.get(id2) ?? Promise.resolve();
         const next = previous.then(async () => {
           try {
-            await (0, import_promises33.mkdir)(this.dir, { recursive: true });
-            const target = (0, import_node_path42.join)(this.dir, `${id2}.json`);
+            await (0, import_promises34.mkdir)(this.dir, { recursive: true });
+            const target = (0, import_node_path43.join)(this.dir, `${id2}.json`);
             const temp = `${target}.${process.pid}.tmp`;
-            await (0, import_promises33.writeFile)(temp, JSON.stringify(run), "utf8");
-            await (0, import_promises33.rename)(temp, target);
+            await (0, import_promises34.writeFile)(temp, JSON.stringify(run), "utf8");
+            await (0, import_promises34.rename)(temp, target);
           } catch {
           }
         });
@@ -22136,9 +22195,9 @@ function isSecretPath(path2) {
   return SECRET_FILE.test(path2);
 }
 function inside(root, path2) {
-  const base2 = (0, import_node_path43.resolve)(root);
-  const target = (0, import_node_path43.resolve)(base2, path2);
-  return target.startsWith(base2 + import_node_path43.sep) ? target : null;
+  const base2 = (0, import_node_path44.resolve)(root);
+  const target = (0, import_node_path44.resolve)(base2, path2);
+  return target.startsWith(base2 + import_node_path44.sep) ? target : null;
 }
 function runGitProcess(cwd, invocation, timeoutMs) {
   return new Promise((resolveRun) => {
@@ -22175,7 +22234,7 @@ function hashOf(content) {
 }
 async function readMaybe(path2) {
   try {
-    return await (0, import_promises34.readFile)(path2);
+    return await (0, import_promises35.readFile)(path2);
   } catch {
     return null;
   }
@@ -22216,7 +22275,7 @@ async function takeBaseline(cwd) {
   const dirty = {};
   let total = 0;
   for (const [index, entry] of entries.entries()) {
-    const content = await readMaybe((0, import_node_path43.join)(root, entry.path));
+    const content = await readMaybe((0, import_node_path44.join)(root, entry.path));
     const secret = isSecretPath(entry.path);
     const small = !secret && content !== null && content.length <= MAX_SNAPSHOT_BYTES2 && index < MAX_SNAPSHOT_FILES && total + content.length <= MAX_SNAPSHOT_TOTAL;
     if (small) total += content.length;
@@ -22248,8 +22307,8 @@ async function checkoutForms(cwd, root, head, dirty, budget) {
   const forms = {};
   let scanned = 0;
   const look = async ({ path: path2, id: id2 }) => {
-    const target = (0, import_node_path43.join)(root, path2);
-    const size = await (0, import_promises34.stat)(target).then((info) => info.size, () => null);
+    const target = (0, import_node_path44.join)(root, path2);
+    const size = await (0, import_promises35.stat)(target).then((info) => info.size, () => null);
     if (size === null || scanned + size > MAX_CHECKOUT_SCAN) return;
     scanned += size;
     const content = await readMaybe(target);
@@ -22306,7 +22365,7 @@ async function observeChanges(baseline, cwd) {
   const candidates = /* @__PURE__ */ new Set([...Object.keys(baseline.dirty), ...nowStatus.keys()]);
   const changes = [];
   for (const path2 of [...candidates].sort()) {
-    const current = await readMaybe((0, import_node_path43.join)(baseline.root, path2));
+    const current = await readMaybe((0, import_node_path44.join)(baseline.root, path2));
     const hash2 = current ? hashOf(current) : null;
     const before = baseline.dirty[path2];
     if (before && before.hash === hash2) continue;
@@ -22321,7 +22380,7 @@ async function observeChanges(baseline, cwd) {
 }
 async function diffChanges(baseline, paths) {
   if (!baseline.root) return [];
-  const scratch = await (0, import_promises34.mkdtemp)((0, import_node_path43.join)((0, import_node_os3.tmpdir)(), "viberaven-diff-"));
+  const scratch = await (0, import_promises35.mkdtemp)((0, import_node_path44.join)((0, import_node_os3.tmpdir)(), "viberaven-diff-"));
   try {
     const out = [];
     for (const [index, path2] of paths.slice(0, 60).entries()) {
@@ -22330,11 +22389,11 @@ async function diffChanges(baseline, paths) {
         continue;
       }
       const before = await baseContent(baseline, path2);
-      const after = await readMaybe((0, import_node_path43.join)(baseline.root, path2));
-      const left = (0, import_node_path43.join)(scratch, `${index}-a`);
-      const right = (0, import_node_path43.join)(scratch, `${index}-b`);
-      await (0, import_promises34.writeFile)(left, before ?? Buffer.alloc(0));
-      await (0, import_promises34.writeFile)(right, after ?? Buffer.alloc(0));
+      const after = await readMaybe((0, import_node_path44.join)(baseline.root, path2));
+      const left = (0, import_node_path44.join)(scratch, `${index}-a`);
+      const right = (0, import_node_path44.join)(scratch, `${index}-b`);
+      await (0, import_promises35.writeFile)(left, before ?? Buffer.alloc(0));
+      await (0, import_promises35.writeFile)(right, after ?? Buffer.alloc(0));
       const result = await runGitProcess(scratch, await safeNoIndexDiffInvocation(scratch, ["--no-color", "-U3", "--", left, right]), 8e3);
       const lines = result.stdout.toString("utf8").split("\n");
       const body = lines.slice(lines.findIndex((line) => line.startsWith("@@")));
@@ -22346,7 +22405,7 @@ ${body.join("\n")}`.trimEnd() });
     }
     return out;
   } finally {
-    await (0, import_promises34.rm)(scratch, { recursive: true, force: true }).catch(() => void 0);
+    await (0, import_promises35.rm)(scratch, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 function replayWrites(base2, writes) {
@@ -22375,9 +22434,9 @@ function pathKey(path2) {
   return process.platform === "win32" ? path2.toLowerCase() : path2;
 }
 function repoPath(root, cwd, path2) {
-  const rel = (0, import_node_path43.relative)((0, import_node_path43.resolve)(root), (0, import_node_path43.resolve)(cwd, path2));
-  if (!rel || rel.startsWith("..") || (0, import_node_path43.resolve)(rel) === rel) return null;
-  return rel.split(import_node_path43.sep).join("/");
+  const rel = (0, import_node_path44.relative)((0, import_node_path44.resolve)(root), (0, import_node_path44.resolve)(cwd, path2));
+  if (!rel || rel.startsWith("..") || (0, import_node_path44.resolve)(rel) === rel) return null;
+  return rel.split(import_node_path44.sep).join("/");
 }
 async function attributeChanges(baseline, cwd, changes, writes) {
   const owned = {};
@@ -22392,7 +22451,7 @@ async function attributeChanges(baseline, cwd, changes, writes) {
   for (const change of changes) {
     const mine = byPath.get(pathKey(change.path));
     const base2 = mine?.length && !isSecretPath(change.path) ? await baseContent(baseline, change.path) : void 0;
-    const current = base2 !== void 0 ? await readMaybe((0, import_node_path43.join)(baseline.root, change.path)) : null;
+    const current = base2 !== void 0 ? await readMaybe((0, import_node_path44.join)(baseline.root, change.path)) : null;
     const expected = base2 !== void 0 && mine ? replayWrites(base2 === null ? null : base2.toString("utf8"), mine) : void 0;
     if (current !== null && expected !== void 0 && lf(current.toString("utf8")) === expected) owned[change.path] = hashOf(current);
     else unattributed.push(change.path);
@@ -22409,10 +22468,10 @@ async function putBack(baseline, path2, target, current, keep) {
   }
   try {
     if (before === null) {
-      if (current !== null) await (0, import_promises34.unlink)(target);
+      if (current !== null) await (0, import_promises35.unlink)(target);
     } else {
-      await (0, import_promises34.mkdir)((0, import_node_path43.dirname)(target), { recursive: true });
-      await (0, import_promises34.writeFile)(target, before);
+      await (0, import_promises35.mkdir)((0, import_node_path44.dirname)(target), { recursive: true });
+      await (0, import_promises35.writeFile)(target, before);
     }
     return null;
   } catch (error) {
@@ -22462,41 +22521,41 @@ async function restoreFile(baseline, path2, keep) {
   return failure ? { error: failure } : { ok: true };
 }
 function backupsPath(runsDir, runId) {
-  return (0, import_node_path43.join)(runsDir, `${runId}.backups.json`);
+  return (0, import_node_path44.join)(runsDir, `${runId}.backups.json`);
 }
 async function saveBackup(runsDir, runId, backup) {
-  await (0, import_promises34.mkdir)(runsDir, { recursive: true });
+  await (0, import_promises35.mkdir)(runsDir, { recursive: true });
   let list = [];
   try {
-    list = JSON.parse(await (0, import_promises34.readFile)(backupsPath(runsDir, runId), "utf8"));
+    list = JSON.parse(await (0, import_promises35.readFile)(backupsPath(runsDir, runId), "utf8"));
   } catch {
   }
   list.push(backup);
-  await (0, import_promises34.writeFile)(backupsPath(runsDir, runId), JSON.stringify(list), "utf8");
+  await (0, import_promises35.writeFile)(backupsPath(runsDir, runId), JSON.stringify(list), "utf8");
 }
 function baselinePath(runsDir, runId) {
-  return (0, import_node_path43.join)(runsDir, `${runId}.baseline.json`);
+  return (0, import_node_path44.join)(runsDir, `${runId}.baseline.json`);
 }
 async function saveBaseline(runsDir, runId, baseline) {
-  await (0, import_promises34.mkdir)(runsDir, { recursive: true });
-  await (0, import_promises34.writeFile)(baselinePath(runsDir, runId), JSON.stringify(baseline), "utf8");
+  await (0, import_promises35.mkdir)(runsDir, { recursive: true });
+  await (0, import_promises35.writeFile)(baselinePath(runsDir, runId), JSON.stringify(baseline), "utf8");
 }
 async function loadBaseline(runsDir, runId) {
   try {
-    return JSON.parse(await (0, import_promises34.readFile)(baselinePath(runsDir, runId), "utf8"));
+    return JSON.parse(await (0, import_promises35.readFile)(baselinePath(runsDir, runId), "utf8"));
   } catch {
     return null;
   }
 }
-var import_node_child_process9, import_node_crypto6, import_promises34, import_node_os3, import_node_path43, STATUS_PATHSPEC, MAX_SNAPSHOT_FILES, MAX_SNAPSHOT_BYTES2, MAX_SNAPSHOT_TOTAL, MAX_CHECKOUT_SCAN, CHECKOUT_READS_AT_ONCE, SECRET_FILE, withCrlf, withoutCrlf, lf, NOT_PROVEN;
+var import_node_child_process9, import_node_crypto6, import_promises35, import_node_os3, import_node_path44, STATUS_PATHSPEC, MAX_SNAPSHOT_FILES, MAX_SNAPSHOT_BYTES2, MAX_SNAPSHOT_TOTAL, MAX_CHECKOUT_SCAN, CHECKOUT_READS_AT_ONCE, SECRET_FILE, withCrlf, withoutCrlf, lf, NOT_PROVEN;
 var init_workspace = __esm({
   "src/local-ui/actions/workspace.ts"() {
     "use strict";
     import_node_child_process9 = require("node:child_process");
     import_node_crypto6 = require("node:crypto");
-    import_promises34 = require("node:fs/promises");
+    import_promises35 = require("node:fs/promises");
     import_node_os3 = require("node:os");
-    import_node_path43 = require("node:path");
+    import_node_path44 = require("node:path");
     init_safeGit();
     STATUS_PATHSPEC = ["--", ".", ":(exclude).viberaven", ":(exclude)**/.viberaven/**"];
     MAX_SNAPSHOT_FILES = 300;
@@ -22519,14 +22578,14 @@ function reloadsItself(script) {
 async function detectPreviewCommand(cwd) {
   let pkg;
   try {
-    pkg = JSON.parse(await (0, import_promises35.readFile)((0, import_node_path44.join)(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(await (0, import_promises36.readFile)((0, import_node_path45.join)(cwd, "package.json"), "utf8"));
   } catch {
     return null;
   }
   const scripts = pkg.scripts ?? {};
   const script = ["dev", "start", "preview"].find((name) => typeof scripts[name] === "string" && scripts[name].trim());
   if (!script) return null;
-  const exists2 = async (name) => (0, import_promises35.stat)((0, import_node_path44.join)(cwd, name)).then(() => true, () => false);
+  const exists2 = async (name) => (0, import_promises36.stat)((0, import_node_path45.join)(cwd, name)).then(() => true, () => false);
   const packageManager = await exists2("pnpm-lock.yaml") ? "pnpm" : await exists2("yarn.lock") ? "yarn" : await exists2("bun.lockb") || await exists2("bun.lock") ? "bun" : "npm";
   const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const framework = FRAMEWORKS.find(([dep]) => dep in deps)?.[1] ?? null;
@@ -22574,14 +22633,14 @@ function previewFailureReason(log) {
   if (/Missing script/i.test(log)) return "The script VibeRaven picked is not in package.json.";
   return void 0;
 }
-var import_node_child_process10, import_promises35, import_node_net, import_node_path44, URL_PATTERN, READY_TIMEOUT_MS, LOG_LIMIT, FRAMEWORKS, RELOADS_ITSELF, SEVERAL_PROCESSES, PreviewManager;
+var import_node_child_process10, import_promises36, import_node_net, import_node_path45, URL_PATTERN, READY_TIMEOUT_MS, LOG_LIMIT, FRAMEWORKS, RELOADS_ITSELF, SEVERAL_PROCESSES, PreviewManager;
 var init_preview2 = __esm({
   "src/local-ui/preview.ts"() {
     "use strict";
     import_node_child_process10 = require("node:child_process");
-    import_promises35 = require("node:fs/promises");
+    import_promises36 = require("node:fs/promises");
     import_node_net = require("node:net");
-    import_node_path44 = require("node:path");
+    import_node_path45 = require("node:path");
     init_runs();
     URL_PATTERN = /https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0):(\d{2,5})(?:\/[^\s'"`]*)?/i;
     READY_TIMEOUT_MS = 12e4;
@@ -22767,21 +22826,21 @@ var init_preview2 = __esm({
 
 // src/local-ui/actions/engine.ts
 async function exists(path2) {
-  return (0, import_promises36.stat)(path2).then(() => true, () => false);
+  return (0, import_promises37.stat)(path2).then(() => true, () => false);
 }
 async function detectChecks(cwd) {
   let pkg;
   try {
-    pkg = JSON.parse(await (0, import_promises36.readFile)((0, import_node_path45.join)(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
   const scripts = pkg.scripts ?? {};
-  const pm = await exists((0, import_node_path45.join)(cwd, "pnpm-lock.yaml")) ? "pnpm" : await exists((0, import_node_path45.join)(cwd, "yarn.lock")) ? "yarn" : "npm";
+  const pm = await exists((0, import_node_path46.join)(cwd, "pnpm-lock.yaml")) ? "pnpm" : await exists((0, import_node_path46.join)(cwd, "yarn.lock")) ? "yarn" : "npm";
   const checks = [];
   if (scripts.typecheck) checks.push({ id: "typecheck", label: "Types", display: `${pm} run typecheck`, command: `${pm} run typecheck` });
-  else if (await exists((0, import_node_path45.join)(cwd, "tsconfig.json")) && await exists((0, import_node_path45.join)(cwd, "node_modules", "typescript", "bin", "tsc"))) {
-    checks.push({ id: "typecheck", label: "Types", display: "tsc --noEmit", command: `node "${(0, import_node_path45.join)("node_modules", "typescript", "bin", "tsc")}" --noEmit --incremental false -p .` });
+  else if (await exists((0, import_node_path46.join)(cwd, "tsconfig.json")) && await exists((0, import_node_path46.join)(cwd, "node_modules", "typescript", "bin", "tsc"))) {
+    checks.push({ id: "typecheck", label: "Types", display: "tsc --noEmit", command: `node "${(0, import_node_path46.join)("node_modules", "typescript", "bin", "tsc")}" --noEmit --incremental false -p .` });
   }
   if (scripts.test && !NPM_DEFAULT_TEST.test(scripts.test)) checks.push({ id: "test", label: "Tests", display: `${pm} run test`, command: `${pm} run test`, env: { CI: "1" } });
   return checks;
@@ -22852,14 +22911,14 @@ function envKeys(text2) {
 async function missingClientSettings(cwd) {
   let example = "";
   try {
-    example = await (0, import_promises36.readFile)((0, import_node_path45.join)(cwd, ".env.example"), "utf8");
+    example = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, ".env.example"), "utf8");
   } catch {
     return [];
   }
   const present = new Set(Object.keys(process.env));
   for (const name of [".env", ".env.local", ".env.development", ".env.development.local"]) {
     try {
-      for (const key of envKeys(await (0, import_promises36.readFile)((0, import_node_path45.join)(cwd, name), "utf8"))) present.add(key);
+      for (const key of envKeys(await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, name), "utf8"))) present.add(key);
     } catch {
     }
   }
@@ -22869,15 +22928,15 @@ async function isGitWorkTree(cwd) {
   const result = await safeGit(cwd, ["rev-parse", "--is-inside-work-tree"], 4e3);
   return result.code === 0 && result.stdout.toString("utf8").trim() === "true";
 }
-var import_node_child_process11, import_node_crypto7, import_promises36, import_node_path45, CHECK_TIMEOUT_MS, NPM_DEFAULT_TEST, MAX_REQUEST, ActionEngine;
+var import_node_child_process11, import_node_crypto7, import_promises37, import_node_path46, CHECK_TIMEOUT_MS, NPM_DEFAULT_TEST, MAX_REQUEST, ActionEngine;
 var init_engine = __esm({
   "src/local-ui/actions/engine.ts"() {
     "use strict";
     init_taskContract();
     import_node_child_process11 = require("node:child_process");
     import_node_crypto7 = require("node:crypto");
-    import_promises36 = require("node:fs/promises");
-    import_node_path45 = require("node:path");
+    import_promises37 = require("node:fs/promises");
+    import_node_path46 = require("node:path");
     init_catalog();
     init_runs();
     init_workspace();
@@ -22899,7 +22958,7 @@ var init_engine = __esm({
         const [command, checks, hasPackageJson, git3] = await Promise.all([
           detectPreviewCommand(cwd),
           detectChecks(cwd),
-          exists((0, import_node_path45.join)(cwd, "package.json")),
+          exists((0, import_node_path46.join)(cwd, "package.json")),
           isGitWorkTree(cwd)
         ]);
         return {
@@ -23418,10 +23477,10 @@ async function connectProviderMcp(cwd, providerId) {
   if (!recipe) {
     return { ok: false, message: `No known MCP server for ${providerId} yet. Add one manually to .mcp.json.` };
   }
-  const configPath = (0, import_node_path46.join)(cwd, ".mcp.json");
+  const configPath = (0, import_node_path47.join)(cwd, ".mcp.json");
   let config = {};
   try {
-    const raw = await (0, import_promises37.readFile)(configPath, "utf8");
+    const raw = await (0, import_promises38.readFile)(configPath, "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     if (!isRecord5(parsed) || parsed.mcpServers !== void 0 && !isRecord5(parsed.mcpServers)) {
       return { ok: false, message: "Existing .mcp.json has an unsupported structure. It was left unchanged." };
@@ -23438,7 +23497,7 @@ async function connectProviderMcp(cwd, providerId) {
   }
   servers[providerId] = recipe.entry;
   const next = { ...config, mcpServers: servers };
-  await (0, import_promises37.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises38.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const suffix = recipe.note ? ` ${recipe.note}` : "";
   return { ok: true, message: `Added ${providerId} MCP server to .mcp.json.${suffix}`, path: ".mcp.json" };
@@ -23491,7 +23550,7 @@ async function defaultScanRunner(flags, positional) {
 }
 async function readPackageJson(cwd) {
   try {
-    const raw = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, "package.json"), "utf8");
+    const raw = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, "package.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -23514,7 +23573,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
     if (files.length >= maxFiles) return;
     let entries;
     try {
-      entries = await (0, import_promises37.readdir)(dir, { withFileTypes: true });
+      entries = await (0, import_promises38.readdir)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -23522,7 +23581,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
       if (files.length >= maxFiles) return;
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        if (!skipped.has(entry.name)) await walk((0, import_node_path46.join)(dir, entry.name), rel);
+        if (!skipped.has(entry.name)) await walk((0, import_node_path47.join)(dir, entry.name), rel);
         continue;
       }
       if (entry.isFile()) files.push(rel.toLowerCase());
@@ -23541,7 +23600,7 @@ async function readEnvKeys(cwd) {
   const keys2 = /* @__PURE__ */ new Set();
   for (const name of [".env.example", ".env"]) {
     try {
-      const raw = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, name), "utf8");
+      const raw = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, name), "utf8");
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -23859,7 +23918,7 @@ async function codexModelOptions() {
     { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" }
   ];
   try {
-    const raw = await (0, import_promises37.readFile)((0, import_node_path46.join)((0, import_node_os4.homedir)(), ".codex", "models_cache.json"), "utf8");
+    const raw = await (0, import_promises38.readFile)((0, import_node_path47.join)((0, import_node_os4.homedir)(), ".codex", "models_cache.json"), "utf8");
     const parsed = JSON.parse(raw);
     const list = Array.isArray(parsed) ? parsed : parsed.models ?? [];
     const options = list.filter((model) => typeof model?.slug === "string").filter((model) => !/auto-review|reserve/i.test(model.slug)).map((model) => ({ id: model.slug, label: model.display_name?.trim() || model.slug }));
@@ -24062,19 +24121,19 @@ function isPlaceholderProjectName(value) {
 async function readMcpEvidence(cwd) {
   const candidates = MCP_CONFIG_PATHS.map((relativePath) => ({
     source: relativePath.replace(/\\/g, "/"),
-    path: (0, import_node_path46.resolve)(cwd, relativePath)
+    path: (0, import_node_path47.resolve)(cwd, relativePath)
   }));
   const home = process.env.USERPROFILE || process.env.HOME;
   if (home) {
     candidates.push({
       source: "~/.codex/config.toml",
-      path: (0, import_node_path46.resolve)(home, ".codex", "config.toml")
+      path: (0, import_node_path47.resolve)(home, ".codex", "config.toml")
     });
   }
   const evidence = [];
   for (const candidate of candidates) {
     try {
-      const text2 = await (0, import_promises37.readFile)(candidate.path, "utf8");
+      const text2 = await (0, import_promises38.readFile)(candidate.path, "utf8");
       if (/mcp/i.test(text2)) evidence.push({ source: candidate.source, text: text2 });
     } catch {
     }
@@ -24165,7 +24224,7 @@ async function enrichProjectMetadata(state, cwd) {
 async function readState(cwd) {
   let state;
   try {
-    const raw = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
+    const raw = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
     const packageJson = await readPackageJson(cwd);
     const deps = dependencyNames(packageJson);
     const files = await listProjectFiles(cwd);
@@ -24433,7 +24492,7 @@ async function whereExe(command, cwd) {
 }
 function expandShimPath(value, base2) {
   const relative11 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
-  return relative11 === value ? value : (0, import_node_path46.join)(base2, ...relative11.split(/[\\/]+/));
+  return relative11 === value ? value : (0, import_node_path47.join)(base2, ...relative11.split(/[\\/]+/));
 }
 function findShimTarget(lines, pattern, accept = () => true) {
   for (const line of lines) {
@@ -24444,21 +24503,21 @@ function findShimTarget(lines, pattern, accept = () => true) {
 }
 async function resolveWindowsShimTarget(shimPath) {
   try {
-    const content = await (0, import_promises37.readFile)(shimPath, "utf8");
-    const base2 = (0, import_node_path46.dirname)(shimPath);
+    const content = await (0, import_promises38.readFile)(shimPath, "utf8");
+    const base2 = (0, import_node_path47.dirname)(shimPath);
     const lines = content.split(/\r?\n/);
     const trailingArgs = (line, after) => [...line.slice(after).split("%*")[0].matchAll(/"([^"]*)"|([^\s"&|<>]+)/g)].map((token) => expandShimPath(token[1] ?? token[2], base2)).filter((value) => value.length > 0 && !value.includes("%"));
     const script = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.js)"/i);
     if (script) {
       return {
         command: process.execPath,
-        args: [(0, import_node_path46.join)(base2, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
+        args: [(0, import_node_path47.join)(base2, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
       };
     }
-    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path46.basename)(target).toLowerCase() !== "node.exe");
+    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path47.basename)(target).toLowerCase() !== "node.exe");
     if (binary) {
       return {
-        command: (0, import_node_path46.join)(base2, ...binary.match[1].split(/[\\/]+/)),
+        command: (0, import_node_path47.join)(base2, ...binary.match[1].split(/[\\/]+/)),
         args: trailingArgs(binary.line, binary.match.index + binary.match[0].length)
       };
     }
@@ -24583,8 +24642,8 @@ async function writeChatContextArtifact(cwd, request, prompt) {
       "",
       prompt
     ].filter((line) => typeof line === "string");
-    await (0, import_promises37.mkdir)((0, import_node_path46.join)(cwd, ".viberaven"), { recursive: true });
-    await (0, import_promises37.writeFile)((0, import_node_path46.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
+    await (0, import_promises38.mkdir)((0, import_node_path47.join)(cwd, ".viberaven"), { recursive: true });
+    await (0, import_promises38.writeFile)((0, import_node_path47.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
 `, "utf8");
   } catch {
   }
@@ -24607,13 +24666,13 @@ async function runAgentChat(cwd, request) {
   return executeAgentPrompt(cwd, request, prompt);
 }
 async function executeAgentPrompt(cwd, request, prompt, options = {}) {
-  const outputPath = request.cliId === "codex" ? (0, import_node_path46.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
-  if (outputPath) await (0, import_promises37.mkdir)((0, import_node_path46.dirname)(outputPath), { recursive: true });
+  const outputPath = request.cliId === "codex" ? (0, import_node_path47.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
+  if (outputPath) await (0, import_promises38.mkdir)((0, import_node_path47.dirname)(outputPath), { recursive: true });
   const { command, args, stdin } = commandForAgentChat(request, prompt, cwd, outputPath, options);
   const result = await runAgentCommand(command, args, cwd, stdin, request.runId, options.editRecord ? 16e6 : 48e3);
   if (outputPath) {
     try {
-      const finalMessage = (await (0, import_promises37.readFile)(outputPath, "utf8")).trim();
+      const finalMessage = (await (0, import_promises38.readFile)(outputPath, "utf8")).trim();
       if (finalMessage) return { ...result, output: finalMessage };
     } catch {
     }
@@ -24638,8 +24697,8 @@ function firstGapId(state) {
   return state.providers.find((provider2) => provider2.nextFix?.id)?.nextFix?.id;
 }
 async function runLocalAction(cwd, intent) {
-  const artifactDir = (0, import_node_path46.join)(cwd, ".viberaven");
-  await (0, import_promises37.mkdir)(artifactDir, { recursive: true });
+  const artifactDir = (0, import_node_path47.join)(cwd, ".viberaven");
+  await (0, import_promises38.mkdir)(artifactDir, { recursive: true });
   if (intent === "preview_rehearsal") {
     const state2 = await readState(cwd);
     const topProvider = state2.providers[0];
@@ -24680,7 +24739,7 @@ async function runLocalAction(cwd, intent) {
       proof2,
       ""
     ].join("\n");
-    await (0, import_promises37.writeFile)((0, import_node_path46.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
+    await (0, import_promises38.writeFile)((0, import_node_path47.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
     return {
       title: "Preview rehearsal ready",
       summary: `${projectName}: ${gateLabel} with ${state2.providers.length} provider beat${state2.providers.length === 1 ? "" : "s"}`,
@@ -24690,7 +24749,7 @@ async function runLocalAction(cwd, intent) {
   if (intent === "audit_vercel_supabase") {
     const auditInput = await collectVercelSupabaseAuditInput(cwd);
     const result2 = buildVercelSupabaseAudit(auditInput);
-    await (0, import_promises37.writeFile)((0, import_node_path46.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
+    await (0, import_promises38.writeFile)((0, import_node_path47.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
 `, "utf8");
     return {
       title: result2.status === "pass" ? "Audit passed" : "Audit needs work",
@@ -24718,7 +24777,7 @@ async function runLocalAction(cwd, intent) {
   const mode = intent === "heal_prompt" ? "prompt" : intent === "heal_apply" ? "apply" : "plan";
   const result = await runHealCommand({ cwd, mode, gapId, yes: mode === "apply", noVerify: true });
   if (mode === "apply") {
-    await (0, import_promises37.writeFile)((0, import_node_path46.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
+    await (0, import_promises38.writeFile)((0, import_node_path47.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   }
   return {
@@ -24728,14 +24787,14 @@ async function runLocalAction(cwd, intent) {
   };
 }
 async function sendArtifact(cwd, rel, response, contentType = "text/plain; charset=utf-8") {
-  const absolute = (0, import_node_path46.resolve)(cwd, rel);
-  const root = (0, import_node_path46.resolve)(cwd);
+  const absolute = (0, import_node_path47.resolve)(cwd, rel);
+  const root = (0, import_node_path47.resolve)(cwd);
   if (!absolute.startsWith(root)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const text2 = await (0, import_promises37.readFile)(absolute, "utf8");
+    const text2 = await (0, import_promises38.readFile)(absolute, "utf8");
     response.writeHead(200, { "content-type": contentType });
     response.end(text2);
   } catch {
@@ -24744,7 +24803,7 @@ async function sendArtifact(cwd, rel, response, contentType = "text/plain; chars
 }
 async function sendReportArtifact(cwd, response) {
   try {
-    const text2 = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, ".viberaven", "report.html"), "utf8");
+    const text2 = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, ".viberaven", "report.html"), "utf8");
     response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     response.end(text2);
     return;
@@ -24871,7 +24930,7 @@ async function sendReportArtifact(cwd, response) {
 }
 async function sendExtensionIcon(cwd, response) {
   try {
-    const body = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, "media", "extension-icon.png"));
+    const body = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, "media", "extension-icon.png"));
     sendBinary(response, 200, "image/png", body);
   } catch {
     sendText(response, 404, "Icon not found");
@@ -24884,15 +24943,15 @@ async function sendMangaAsset(pathname, response) {
     return;
   }
   const candidates = [
-    (0, import_node_path46.join)(__dirname, "manga", name),
+    (0, import_node_path47.join)(__dirname, "manga", name),
     // installed + dev: <pkg>/dist/manga
-    (0, import_node_path46.join)(__dirname, "..", "assets", "manga", name),
+    (0, import_node_path47.join)(__dirname, "..", "assets", "manga", name),
     // fallback: <pkg>/assets/manga (source)
-    (0, import_node_path46.join)(__dirname, "..", "..", "assets", "manga", name)
+    (0, import_node_path47.join)(__dirname, "..", "..", "assets", "manga", name)
   ];
   for (const candidate of candidates) {
     try {
-      const body = await (0, import_promises37.readFile)(candidate);
+      const body = await (0, import_promises38.readFile)(candidate);
       response.setHeader("cache-control", "no-cache");
       sendBinary(response, 200, contentTypeForAsset(candidate), body);
       return;
@@ -24902,7 +24961,7 @@ async function sendMangaAsset(pathname, response) {
   sendText(response, 404, "Asset not found");
 }
 function contentTypeForAsset(pathname) {
-  switch ((0, import_node_path46.extname)(pathname).toLowerCase()) {
+  switch ((0, import_node_path47.extname)(pathname).toLowerCase()) {
     case ".svg":
       return "image/svg+xml; charset=utf-8";
     case ".png":
@@ -24919,14 +24978,14 @@ function contentTypeForAsset(pathname) {
 }
 async function sendBundledReportAsset(pathname, response) {
   const rel = decodeURIComponent(pathname.replace(/^\/report\//, ""));
-  const assetRoot = (0, import_node_path46.resolve)(getBundledReportAssetsDir());
-  const absolute = (0, import_node_path46.resolve)(assetRoot, rel);
+  const assetRoot = (0, import_node_path47.resolve)(getBundledReportAssetsDir());
+  const absolute = (0, import_node_path47.resolve)(assetRoot, rel);
   if (!absolute.startsWith(assetRoot)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const body = await (0, import_promises37.readFile)(absolute);
+    const body = await (0, import_promises38.readFile)(absolute);
     sendBinary(response, 200, contentTypeForAsset(absolute), body);
   } catch {
     sendText(response, 404, "Asset not found");
@@ -24948,18 +25007,18 @@ async function bundleStackClient(entryPath) {
   return output.text;
 }
 async function sendStackAppJs(response) {
-  const distPath = (0, import_node_path46.join)(__dirname, "stack", "app.js");
+  const distPath = (0, import_node_path47.join)(__dirname, "stack", "app.js");
   try {
-    const body = await (0, import_promises37.readFile)(distPath);
+    const body = await (0, import_promises38.readFile)(distPath);
     response.writeHead(200, { "content-type": "application/javascript; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
     return;
   } catch {
   }
-  const entryPath = (0, import_node_path46.join)(__dirname, "stack", "main.ts");
+  const entryPath = (0, import_node_path47.join)(__dirname, "stack", "main.ts");
   let mtimeMs;
   try {
-    mtimeMs = (await (0, import_promises37.stat)(entryPath)).mtimeMs;
+    mtimeMs = (await (0, import_promises38.stat)(entryPath)).mtimeMs;
   } catch {
     sendText(response, 404, "Stack client entry not found: src/local-ui/stack/main.ts is missing.");
     return;
@@ -24979,8 +25038,8 @@ async function sendStackAppJs(response) {
 async function sendStackAppCss(response) {
   try {
     const [shell, scene] = await Promise.all([
-      (0, import_promises37.readFile)((0, import_node_path46.join)(__dirname, "stack", "stack.css"), "utf8"),
-      (0, import_promises37.readFile)((0, import_node_path46.join)(__dirname, "stack", "scene.css"), "utf8").catch(() => "")
+      (0, import_promises38.readFile)((0, import_node_path47.join)(__dirname, "stack", "stack.css"), "utf8"),
+      (0, import_promises38.readFile)((0, import_node_path47.join)(__dirname, "stack", "scene.css"), "utf8").catch(() => "")
     ]);
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
     response.end(`${shell}
@@ -24991,7 +25050,7 @@ ${scene}`);
 }
 async function readProviderVerifyLedger(cwd) {
   try {
-    const raw = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
+    const raw = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -25001,8 +25060,8 @@ async function readProviderVerifyLedger(cwd) {
 async function writeProviderVerifyEntry(cwd, providerId, entry) {
   const ledger = await readProviderVerifyLedger(cwd);
   ledger[providerId] = entry;
-  await (0, import_promises37.mkdir)((0, import_node_path46.join)(cwd, ".viberaven"), { recursive: true });
-  await (0, import_promises37.writeFile)((0, import_node_path46.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
+  await (0, import_promises38.mkdir)((0, import_node_path47.join)(cwd, ".viberaven"), { recursive: true });
+  await (0, import_promises38.writeFile)((0, import_node_path47.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
 }
 function isCliId(value) {
@@ -25209,13 +25268,13 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/architecture-map") {
-    const mapPath = (0, import_node_path46.join)(options.cwd, ".viberaven", "architecture-map.md");
-    const markdown = await (0, import_promises37.readFile)(mapPath, "utf8").catch(() => null);
+    const mapPath = (0, import_node_path47.join)(options.cwd, ".viberaven", "architecture-map.md");
+    const markdown = await (0, import_promises38.readFile)(mapPath, "utf8").catch(() => null);
     if (markdown === null) {
       sendJsonStatus(response, 404, { error: "No architecture map yet. Run a scan first (it is written on every scan)." });
       return;
     }
-    const dataRaw = await (0, import_promises37.readFile)((0, import_node_path46.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
+    const dataRaw = await (0, import_promises38.readFile)((0, import_node_path47.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
     let data = null;
     if (dataRaw) {
       try {
@@ -25224,7 +25283,7 @@ async function handleRequest(request, response, options) {
         data = null;
       }
     }
-    const contextRaw = await (0, import_promises37.readFile)((0, import_node_path46.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
+    const contextRaw = await (0, import_promises38.readFile)((0, import_node_path47.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
     let gaps = [];
     if (contextRaw) {
       try {
@@ -25491,35 +25550,35 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/tasklist") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "agent-tasklist.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "agent-tasklist.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/playbook") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "launch-playbook.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "launch-playbook.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/audit") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "audit-vercel-supabase.txt"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "audit-vercel-supabase.txt"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/cleanup") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "context-cleanup.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "context-cleanup.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/preview") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "preview-rehearsal.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "preview-rehearsal.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-plan") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "heal-plan.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "heal-plan.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-prompt") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "heal-prompt.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "heal-prompt.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-apply") {
-    await sendArtifact(options.cwd, (0, import_node_path46.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
+    await sendArtifact(options.cwd, (0, import_node_path47.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/report") {
@@ -25545,12 +25604,12 @@ async function handleRequest(request, response, options) {
   }
   if (request.method === "GET" && url.pathname === "/vendor/anime.umd.min.js") {
     for (const candidate of [
-      (0, import_node_path46.join)(__dirname, "vendor", "anime.umd.min.js"),
-      (0, import_node_path46.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
-      (0, import_node_path46.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
+      (0, import_node_path47.join)(__dirname, "vendor", "anime.umd.min.js"),
+      (0, import_node_path47.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
+      (0, import_node_path47.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
     ]) {
       try {
-        const body = await (0, import_promises37.readFile)(candidate);
+        const body = await (0, import_promises38.readFile)(candidate);
         response.setHeader("cache-control", "public, max-age=604800, immutable");
         sendBinary(response, 200, "text/javascript; charset=utf-8", body);
         return;
@@ -25771,8 +25830,8 @@ function listen(server, startPort) {
   });
 }
 function createActionStudio(cwd, options = {}) {
-  const root = (0, import_node_path46.resolve)(cwd);
-  const runsDir = (0, import_node_path46.join)(root, ".viberaven", "runs");
+  const root = (0, import_node_path47.resolve)(cwd);
+  const runsDir = (0, import_node_path47.join)(root, ".viberaven", "runs");
   const runs = new RunStore(runsDir, (0, import_node_os4.homedir)());
   const preview = new PreviewManager(root, (0, import_node_os4.homedir)());
   const agentReady = new Map(Object.entries(options.agentReady ?? {}));
@@ -25807,7 +25866,7 @@ function createActionStudio(cwd, options = {}) {
   };
 }
 async function startLocalUiServer(options) {
-  const cwd = (0, import_node_path46.resolve)(options.cwd);
+  const cwd = (0, import_node_path47.resolve)(options.cwd);
   const scanRunner = options.scanRunner ?? defaultScanRunner;
   const autoScan = { state: "idle" };
   const fullCheck = new FullCheckService(cwd, options.fullCheck);
@@ -25826,7 +25885,7 @@ async function startLocalUiServer(options) {
   });
   const port = await listen(server, options.port ?? 4177);
   guard.port = port;
-  const hasArtifact = await (0, import_promises37.readFile)((0, import_node_path46.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
+  const hasArtifact = await (0, import_promises38.readFile)((0, import_node_path47.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
     () => true,
     () => false
   );
@@ -25867,16 +25926,16 @@ async function waitForServerShutdown() {
     process.once("SIGTERM", done);
   });
 }
-var import_node_http, import_node_child_process12, import_node_crypto8, import_promises37, import_node_os4, import_node_path46, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache, AGENT_LABEL;
+var import_node_http, import_node_child_process12, import_node_crypto8, import_promises38, import_node_os4, import_node_path47, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache, AGENT_LABEL;
 var init_server = __esm({
   "src/local-ui/server.ts"() {
     "use strict";
     import_node_http = require("node:http");
     import_node_child_process12 = require("node:child_process");
     import_node_crypto8 = require("node:crypto");
-    import_promises37 = require("node:fs/promises");
+    import_promises38 = require("node:fs/promises");
     import_node_os4 = require("node:os");
-    import_node_path46 = require("node:path");
+    import_node_path47 = require("node:path");
     init_initGithub();
     init_cleanPlan();
     init_audit();
@@ -25922,8 +25981,8 @@ var init_server = __esm({
     MCP_CONFIG_PATHS = [
       ".mcp.json",
       "mcp.json",
-      (0, import_node_path46.join)(".cursor", "mcp.json"),
-      (0, import_node_path46.join)(".vscode", "mcp.json")
+      (0, import_node_path47.join)(".cursor", "mcp.json"),
+      (0, import_node_path47.join)(".vscode", "mcp.json")
     ];
     MCP_PROVIDER_NEEDLES = {
       supabase: ["supabase", "@supabase/mcp", "mcp-server-supabase"],
@@ -25978,11 +26037,11 @@ function readChangeInput(input) {
   return { request, accessMode, cliId };
 }
 function jobRunsPath(cwd) {
-  return (0, import_node_path47.join)(cwd, ".viberaven", "runner-jobs.json");
+  return (0, import_node_path48.join)(cwd, ".viberaven", "runner-jobs.json");
 }
 async function readJobRuns(cwd) {
   try {
-    const parsed = JSON.parse(await (0, import_promises38.readFile)(jobRunsPath(cwd), "utf8"));
+    const parsed = JSON.parse(await (0, import_promises39.readFile)(jobRunsPath(cwd), "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -25991,8 +26050,8 @@ async function readJobRuns(cwd) {
 async function rememberJobRun(cwd, jobId, runId) {
   const map = await readJobRuns(cwd);
   map[jobId] = runId;
-  await (0, import_promises38.mkdir)((0, import_node_path47.dirname)(jobRunsPath(cwd)), { recursive: true });
-  await (0, import_promises38.writeFile)(jobRunsPath(cwd), JSON.stringify(map, null, 2), "utf8");
+  await (0, import_promises39.mkdir)((0, import_node_path48.dirname)(jobRunsPath(cwd)), { recursive: true });
+  await (0, import_promises39.writeFile)(jobRunsPath(cwd), JSON.stringify(map, null, 2), "utf8");
 }
 function progressFromRun(run, previewUrl) {
   return {
@@ -26152,13 +26211,13 @@ async function runAgentUndoJob(job, ctx) {
     progress: final
   };
 }
-var import_promises38, import_node_path47, CLI_IDS, MAX_REQUEST2, MAX_DIFF_FILES, MAX_DIFF_CHARS, TERMINAL, SIGNALS, now, clean;
+var import_promises39, import_node_path48, CLI_IDS, MAX_REQUEST2, MAX_DIFF_FILES, MAX_DIFF_CHARS, TERMINAL, SIGNALS, now, clean;
 var init_connectAgent = __esm({
   "src/commands/connectAgent.ts"() {
     "use strict";
     init_taskContract();
-    import_promises38 = require("node:fs/promises");
-    import_node_path47 = require("node:path");
+    import_promises39 = require("node:fs/promises");
+    import_node_path48 = require("node:path");
     init_redact();
     CLI_IDS = ["claude", "codex", "gemini"];
     MAX_REQUEST2 = 1200;
@@ -26204,9 +26263,9 @@ async function readLocalRepo(cwd) {
   }
   const branch = await git2(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
   const status = await git2(cwd, ["status", "--porcelain"]);
-  const lock = (file) => (0, import_node_fs16.existsSync)((0, import_node_path48.join)(cwd, file));
+  const lock = (file) => (0, import_node_fs16.existsSync)((0, import_node_path49.join)(cwd, file));
   return {
-    rootName: (0, import_node_path48.basename)(cwd) || "workspace",
+    rootName: (0, import_node_path49.basename)(cwd) || "workspace",
     remotes: [...remotes.values()],
     branch: branch && branch !== "HEAD" ? branch : null,
     headSha: await git2(cwd, ["rev-parse", "HEAD"]),
@@ -26453,13 +26512,13 @@ function runConnectCommand(options) {
     await jobs.close();
   });
 }
-var import_node_child_process13, import_node_fs16, import_node_path48, import_node_util6, execFileAsync6, HEARTBEAT_MS, SITE;
+var import_node_child_process13, import_node_fs16, import_node_path49, import_node_util6, execFileAsync6, HEARTBEAT_MS, SITE;
 var init_connect = __esm({
   "src/commands/connect.ts"() {
     "use strict";
     import_node_child_process13 = require("node:child_process");
     import_node_fs16 = require("node:fs");
-    import_node_path48 = require("node:path");
+    import_node_path49 = require("node:path");
     import_node_util6 = require("node:util");
     init_safeGit();
     init_runScan();
@@ -26488,14 +26547,14 @@ function normalizeWorkContract(task) {
   if (task.result && task.job && task.result.jobId !== task.job.id) throw new Error("Saved result differs from its job identity.");
   if (task.contract.request !== task.request) throw new Error("Saved request differs from its frozen Task contract.");
 }
-var import_node_crypto9, import_promises39, import_node_path49, WORK_ID, WorkStore;
+var import_node_crypto9, import_promises40, import_node_path50, WORK_ID, WorkStore;
 var init_workStore = __esm({
   "src/commands/workStore.ts"() {
     "use strict";
     init_taskContract();
     import_node_crypto9 = require("node:crypto");
-    import_promises39 = require("node:fs/promises");
-    import_node_path49 = require("node:path");
+    import_promises40 = require("node:fs/promises");
+    import_node_path50 = require("node:path");
     init_credentials();
     WORK_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
     WorkStore = class {
@@ -26505,23 +26564,23 @@ var init_workStore = __esm({
         this.namespace = namespace;
       }
       async dir(create = true) {
-        const root = await (0, import_promises39.realpath)(this.cwd);
-        const target = (0, import_node_path49.resolve)(this.configDir);
-        if (create) await (0, import_promises39.mkdir)(target, { recursive: true, mode: 448 });
-        const canonical2 = await (0, import_promises39.realpath)(target);
-        const rel = (0, import_node_path49.relative)(root, canonical2);
-        if (!rel || !rel.startsWith("..") && !(0, import_node_path49.isAbsolute)(rel)) throw new Error("Work storage must be outside the project.");
-        const dir = (0, import_node_path49.join)(canonical2, this.namespace, (0, import_node_crypto9.createHash)("sha256").update(root).digest("hex"));
-        if (create) await (0, import_promises39.mkdir)(dir, { recursive: true, mode: 448 });
+        const root = await (0, import_promises40.realpath)(this.cwd);
+        const target = (0, import_node_path50.resolve)(this.configDir);
+        if (create) await (0, import_promises40.mkdir)(target, { recursive: true, mode: 448 });
+        const canonical2 = await (0, import_promises40.realpath)(target);
+        const rel = (0, import_node_path50.relative)(root, canonical2);
+        if (!rel || !rel.startsWith("..") && !(0, import_node_path50.isAbsolute)(rel)) throw new Error("Work storage must be outside the project.");
+        const dir = (0, import_node_path50.join)(canonical2, this.namespace, (0, import_node_crypto9.createHash)("sha256").update(root).digest("hex"));
+        if (create) await (0, import_promises40.mkdir)(dir, { recursive: true, mode: 448 });
         return dir;
       }
       async path(id2, create = true) {
         if (!WORK_ID.test(id2)) throw new Error("Invalid task id.");
-        return (0, import_node_path49.join)(await this.dir(create), `${id2}.json`);
+        return (0, import_node_path50.join)(await this.dir(create), `${id2}.json`);
       }
       async read(id2) {
-        const task = JSON.parse(await (0, import_promises39.readFile)(await this.path(id2, false), "utf8"));
-        if (task.version !== 1 || task.id !== id2 || task.cwd !== await (0, import_promises39.realpath)(this.cwd)) throw new Error("Task does not belong to this workspace.");
+        const task = JSON.parse(await (0, import_promises40.readFile)(await this.path(id2, false), "utf8"));
+        if (task.version !== 1 || task.id !== id2 || task.cwd !== await (0, import_promises40.realpath)(this.cwd)) throw new Error("Task does not belong to this workspace.");
         if (this.namespace === "work") normalizeWorkContract(task);
         return task;
       }
@@ -26532,7 +26591,7 @@ var init_workStore = __esm({
           normalizeWorkContract(next);
           let previous;
           try {
-            previous = JSON.parse(await (0, import_promises39.readFile)(path2, "utf8"));
+            previous = JSON.parse(await (0, import_promises40.readFile)(path2, "utf8"));
           } catch (error) {
             if (error.code !== "ENOENT") throw error;
           }
@@ -26544,22 +26603,22 @@ var init_workStore = __esm({
         }
         const temp = `${path2}.${(0, import_node_crypto9.randomUUID)()}.tmp`;
         try {
-          await (0, import_promises39.writeFile)(temp, JSON.stringify(task), { encoding: "utf8", mode: 384, flag: "wx" });
+          await (0, import_promises40.writeFile)(temp, JSON.stringify(task), { encoding: "utf8", mode: 384, flag: "wx" });
           if (process.platform === "win32") await restrictWithIcacls(temp);
-          await (0, import_promises39.rename)(temp, path2);
+          await (0, import_promises40.rename)(temp, path2);
         } finally {
-          await (0, import_promises39.rm)(temp, { force: true });
+          await (0, import_promises40.rm)(temp, { force: true });
         }
       }
       async lock(id2) {
         const path2 = `${await this.path(id2)}.lock`;
         try {
-          const file = await (0, import_promises39.open)(path2, "wx", 384);
+          const file = await (0, import_promises40.open)(path2, "wx", 384);
           await file.writeFile(String(process.pid));
           await file.close();
         } catch (error) {
           if (error.code !== "EEXIST") throw error;
-          const pid = Number(await (0, import_promises39.readFile)(path2, "utf8"));
+          const pid = Number(await (0, import_promises40.readFile)(path2, "utf8"));
           if (!Number.isInteger(pid) || pid < 1) throw new Error("Task lock needs manual review.");
           try {
             process.kill(pid, 0);
@@ -26571,7 +26630,7 @@ var init_workStore = __esm({
           throw new Error("This task is already being resumed.");
         }
         return async () => {
-          await (0, import_promises39.rm)(path2, { force: true });
+          await (0, import_promises40.rm)(path2, { force: true });
         };
       }
     };
@@ -26873,41 +26932,41 @@ function snapshotHash(snapshot) {
   return hashJson(snapshot);
 }
 function inside2(root, target) {
-  const rel = (0, import_node_path50.relative)((0, import_node_path50.resolve)(root), (0, import_node_path50.resolve)(target));
-  return !!rel && !rel.startsWith(`..${import_node_path50.sep}`) && rel !== ".." && !(0, import_node_path50.isAbsolute)(rel);
+  const rel = (0, import_node_path51.relative)((0, import_node_path51.resolve)(root), (0, import_node_path51.resolve)(target));
+  return !!rel && !rel.startsWith(`..${import_node_path51.sep}`) && rel !== ".." && !(0, import_node_path51.isAbsolute)(rel);
 }
 async function headSha(root) {
   const regular = async (path2, limit = 4096) => {
-    const info = await (0, import_promises40.lstat)(path2);
+    const info = await (0, import_promises41.lstat)(path2);
     if (!info.isFile() || info.isSymbolicLink() || info.size > limit) throw new Error("Unsupported Git metadata.");
-    return (0, import_promises40.readFile)(path2, "utf8");
+    return (0, import_promises41.readFile)(path2, "utf8");
   };
   try {
-    let gitDir = (0, import_node_path50.join)(root, ".git");
-    const info = await (0, import_promises40.lstat)(gitDir);
+    let gitDir = (0, import_node_path51.join)(root, ".git");
+    const info = await (0, import_promises41.lstat)(gitDir);
     if (info.isSymbolicLink()) return null;
     if (info.isFile()) {
       const pointer = /^gitdir: (.+)\r?\n?$/.exec(await regular(gitDir));
       if (!pointer) return null;
-      gitDir = (0, import_node_path50.resolve)(root, pointer[1].trim());
+      gitDir = (0, import_node_path51.resolve)(root, pointer[1].trim());
     }
-    if (!(await (0, import_promises40.lstat)(gitDir)).isDirectory() || (await (0, import_promises40.lstat)(gitDir)).isSymbolicLink()) return null;
-    const head = (await regular((0, import_node_path50.join)(gitDir, "HEAD"))).trim();
+    if (!(await (0, import_promises41.lstat)(gitDir)).isDirectory() || (await (0, import_promises41.lstat)(gitDir)).isSymbolicLink()) return null;
+    const head = (await regular((0, import_node_path51.join)(gitDir, "HEAD"))).trim();
     if (/^[a-f0-9]{40,64}$/.test(head)) return head;
     const ref = /^ref: (refs\/[A-Za-z0-9_./-]+)$/.exec(head)?.[1];
     if (!ref || !validVerificationPath(ref)) return null;
     let common2 = gitDir;
     try {
-      const value = (await regular((0, import_node_path50.join)(gitDir, "commondir"))).trim();
-      if (value) common2 = (0, import_node_path50.resolve)(gitDir, value);
+      const value = (await regular((0, import_node_path51.join)(gitDir, "commondir"))).trim();
+      if (value) common2 = (0, import_node_path51.resolve)(gitDir, value);
     } catch {
     }
     try {
-      const sha2 = (await regular((0, import_node_path50.join)(common2, ref))).trim();
+      const sha2 = (await regular((0, import_node_path51.join)(common2, ref))).trim();
       if (/^[a-f0-9]{40,64}$/.test(sha2)) return sha2;
     } catch {
     }
-    const packed = await regular((0, import_node_path50.join)(common2, "packed-refs"), 4e6);
+    const packed = await regular((0, import_node_path51.join)(common2, "packed-refs"), 4e6);
     for (const line of packed.split(/\r?\n/)) {
       const [sha2, name] = line.split(" ");
       if (name === ref && /^[a-f0-9]{40,64}$/.test(sha2)) return sha2;
@@ -26918,18 +26977,18 @@ async function headSha(root) {
   }
 }
 async function captureSnapshot(root, destination) {
-  root = await (0, import_promises40.realpath)(root);
-  if (destination && ((0, import_node_path50.resolve)(destination) === root || inside2(root, destination))) throw new Error("Verification snapshots must stay outside the repository.");
+  root = await (0, import_promises41.realpath)(root);
+  if (destination && ((0, import_node_path51.resolve)(destination) === root || inside2(root, destination))) throw new Error("Verification snapshots must stay outside the repository.");
   const files = [], excluded = [];
   let totalBytes = 0, entries = 0;
-  if (destination) await (0, import_promises40.mkdir)(destination, { recursive: true, mode: 493 });
+  if (destination) await (0, import_promises41.mkdir)(destination, { recursive: true, mode: 493 });
   async function walk(folder, prefix, depth) {
     if (depth > SNAPSHOT_LIMITS.depth) throw new Error("Snapshot depth exceeds the complete-input limit.");
-    for (const name of (await (0, import_promises40.readdir)(folder)).sort()) {
+    for (const name of (await (0, import_promises41.readdir)(folder)).sort()) {
       if (++entries > SNAPSHOT_LIMITS.files * 2) throw new Error("Snapshot directory entry limit exceeded; no complete proof is possible.");
-      const path2 = prefix ? `${prefix}/${name}` : name, absolute = (0, import_node_path50.join)(folder, name);
-      const info = await (0, import_promises40.lstat)(absolute);
-      if (info.isSymbolicLink() || await (0, import_promises40.realpath)(absolute) !== absolute) throw new Error("Snapshot refuses symlinks, junctions and noncanonical paths.");
+      const path2 = prefix ? `${prefix}/${name}` : name, absolute = (0, import_node_path51.join)(folder, name);
+      const info = await (0, import_promises41.lstat)(absolute);
+      if (info.isSymbolicLink() || await (0, import_promises41.realpath)(absolute) !== absolute) throw new Error("Snapshot refuses symlinks, junctions and noncanonical paths.");
       if (!validVerificationPath(path2)) throw new Error("Snapshot contains an unsupported path.");
       if (excludedDirectories.has(name.toLowerCase())) {
         excluded.push({ path: path2, reason: "generated_or_private" });
@@ -26945,13 +27004,13 @@ async function captureSnapshot(root, destination) {
       }
       if (!info.isFile()) throw new Error("Snapshot refuses non-regular input files.");
       if (files.length >= SNAPSHOT_LIMITS.files || info.size > SNAPSHOT_LIMITS.fileBytes || totalBytes + info.size > SNAPSHOT_LIMITS.totalBytes) throw new Error("Snapshot byte/file limit exceeded; inputs are incomplete.");
-      const bytes = await (0, import_promises40.readFile)(absolute), after = await (0, import_promises40.lstat)(absolute);
+      const bytes = await (0, import_promises41.readFile)(absolute), after = await (0, import_promises41.lstat)(absolute);
       if (after.isSymbolicLink() || info.size !== bytes.length || after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ino !== info.ino || after.ctimeMs !== info.ctimeMs) throw new Error("Repository changed while snapshotting; retry with a stable worktree.");
       totalBytes += bytes.length;
       files.push({ path: path2, sha256: hashBytes(bytes), bytes: bytes.length });
       if (destination) {
-        await (0, import_promises40.mkdir)((0, import_node_path50.join)(destination, ...path2.split("/").slice(0, -1)), { recursive: true, mode: 493 });
-        await (0, import_promises40.writeFile)((0, import_node_path50.join)(destination, path2), bytes, { mode: 292, flag: "wx" });
+        await (0, import_promises41.mkdir)((0, import_node_path51.join)(destination, ...path2.split("/").slice(0, -1)), { recursive: true, mode: 493 });
+        await (0, import_promises41.writeFile)((0, import_node_path51.join)(destination, path2), bytes, { mode: 292, flag: "wx" });
       }
     }
   }
@@ -26960,7 +27019,7 @@ async function captureSnapshot(root, destination) {
   return { ...data, hash: snapshotHash(data), headSha: await headSha(root) };
 }
 async function validateSnapshot(root, saved) {
-  if ((await (0, import_promises40.lstat)(root)).isSymbolicLink() || await (0, import_promises40.realpath)(root) !== (0, import_node_path50.resolve)(root)) throw new Error("Saved snapshot root cannot be a symlink or junction.");
+  if ((await (0, import_promises41.lstat)(root)).isSymbolicLink() || await (0, import_promises41.realpath)(root) !== (0, import_node_path51.resolve)(root)) throw new Error("Saved snapshot root cannot be a symlink or junction.");
   if (!saved || saved.version !== 1 || saved.hash !== snapshotHash({ version: 1, files: saved.files, excluded: saved.excluded, totalBytes: saved.totalBytes })) throw new Error("Saved snapshot manifest hash mismatch.");
   const actual = await captureSnapshot(root);
   if (hashJson(actual.files) !== hashJson(saved.files) || actual.totalBytes !== saved.totalBytes || actual.excluded.length) throw new Error("Saved snapshot bytes were changed or are incomplete.");
@@ -26969,12 +27028,12 @@ function changedPaths(before, after) {
   const a = new Map(before.files.map((f) => [f.path, f.sha256])), b3 = new Map(after.files.map((f) => [f.path, f.sha256]));
   return [.../* @__PURE__ */ new Set([...a.keys(), ...b3.keys()])].filter((path2) => a.get(path2) !== b3.get(path2)).sort();
 }
-var import_promises40, import_node_path50, SNAPSHOT_LIMITS, excludedDirectories, verificationSecretPath;
+var import_promises41, import_node_path51, SNAPSHOT_LIMITS, excludedDirectories, verificationSecretPath;
 var init_snapshot = __esm({
   "src/verification/snapshot.ts"() {
     "use strict";
-    import_promises40 = require("node:fs/promises");
-    import_node_path50 = require("node:path");
+    import_promises41 = require("node:fs/promises");
+    import_node_path51 = require("node:path");
     init_workspace();
     init_verificationPlan();
     SNAPSHOT_LIMITS = { files: 3e3, fileBytes: 2e6, totalBytes: 32e6, depth: 32 };
@@ -27045,13 +27104,13 @@ emit(JSON.stringify({protocol:1,nonce:input.nonce,...output})+'\\n',()=>exit(0))
 
 // src/verification/runtime.ts
 async function resolveDockerExecutable(searchPath = process.env.PATH ?? process.env.Path ?? "", projectCwd = process.cwd()) {
-  const project = await (0, import_promises41.realpath)(projectCwd);
-  for (let folder of searchPath.split(import_node_path51.delimiter)) {
+  const project = await (0, import_promises42.realpath)(projectCwd);
+  for (let folder of searchPath.split(import_node_path52.delimiter)) {
     folder = folder.replace(/^"(.*)"$/, "$1");
-    if (!(0, import_node_path51.isAbsolute)(folder) || /^(?:\\\\|\/\/)/.test(folder)) continue;
+    if (!(0, import_node_path52.isAbsolute)(folder) || /^(?:\\\\|\/\/)/.test(folder)) continue;
     try {
-      const executable = await (0, import_promises41.realpath)((0, import_node_path51.join)(folder, process.platform === "win32" ? "docker.exe" : "docker"));
-      if (executable === project || inside2(project, executable) || !(await (0, import_promises41.lstat)(executable)).isFile()) continue;
+      const executable = await (0, import_promises42.realpath)((0, import_node_path52.join)(folder, process.platform === "win32" ? "docker.exe" : "docker"));
+      if (executable === project || inside2(project, executable) || !(await (0, import_promises42.lstat)(executable)).isFile()) continue;
       return executable;
     } catch {
     }
@@ -27059,7 +27118,7 @@ async function resolveDockerExecutable(searchPath = process.env.PATH ?? process.
   return null;
 }
 async function dockerCommand(args, config, timeoutMs, signal, projectCwd = process.cwd()) {
-  const executable = await resolveDockerExecutable(void 0, projectCwd), launchCwd = (0, import_node_path51.resolve)(config);
+  const executable = await resolveDockerExecutable(void 0, projectCwd), launchCwd = (0, import_node_path52.resolve)(config);
   if (!executable) return { code: null, stdout: "", stderr: "", truncated: false, timedOut: false, cancelled: !!signal?.aborted };
   const env = { DOCKER_CONFIG: config };
   for (const key of ["SystemRoot", "SYSTEMROOT", "WINDIR", "TEMP", "TMP"]) if (process.env[key]) env[key] = process.env[key];
@@ -27257,14 +27316,14 @@ function verificationInputs(check, nonce) {
   if (check.adapter === "http") return { nonce, module: check.module, export: check.export, requests: check.cases.map((c) => c.request) };
   return { nonce, entry: check.entry };
 }
-var import_node_child_process14, import_node_crypto11, import_promises41, import_node_path51, import_node_util7, DEFAULT_IMAGE, RUNTIME_LIMITS, HTTP_ERRORS, MODULE_RUNNER, TEST_RUNNER, dockerRuntime;
+var import_node_child_process14, import_node_crypto11, import_promises42, import_node_path52, import_node_util7, DEFAULT_IMAGE, RUNTIME_LIMITS, HTTP_ERRORS, MODULE_RUNNER, TEST_RUNNER, dockerRuntime;
 var init_runtime = __esm({
   "src/verification/runtime.ts"() {
     "use strict";
     import_node_child_process14 = require("node:child_process");
     import_node_crypto11 = require("node:crypto");
-    import_promises41 = require("node:fs/promises");
-    import_node_path51 = require("node:path");
+    import_promises42 = require("node:fs/promises");
+    import_node_path52 = require("node:path");
     import_node_util7 = require("node:util");
     init_verificationPlan();
     init_httpRunner();
@@ -27318,38 +27377,38 @@ try {
     dockerRuntime = {
       async cleanup(runId, scratchDir, projectCwd) {
         if (!/^[a-f0-9-]{36}$/.test(runId)) throw new Error("Invalid owned verification container ID.");
-        await dockerCommand(["rm", "--force", `vr-verify-${runId}`], (0, import_node_path51.join)(scratchDir, "docker-config"), 5e3, void 0, projectCwd);
+        await dockerCommand(["rm", "--force", `vr-verify-${runId}`], (0, import_node_path52.join)(scratchDir, "docker-config"), 5e3, void 0, projectCwd);
       },
       async resolveImage(scratchDir, projectCwd) {
-        const config = (0, import_node_path51.join)(scratchDir, "docker-config");
-        await (0, import_promises41.mkdir)(config, { recursive: true, mode: 448 });
+        const config = (0, import_node_path52.join)(scratchDir, "docker-config");
+        await (0, import_promises42.mkdir)(config, { recursive: true, mode: 448 });
         const result = await dockerCommand(["image", "inspect", "--format", "{{.Id}}", DEFAULT_IMAGE], config, 5e3, void 0, projectCwd);
         return result.code === 0 && /^sha256:[a-f0-9]{64}$/.test(result.stdout.trim()) ? result.stdout.trim() : null;
       },
       async run({ check, snapshotDir, scratchDir, image, signal, runId = (0, import_node_crypto11.randomUUID)(), projectCwd = snapshotDir }) {
         if (!/^[a-f0-9-]{36}$/.test(runId)) throw new Error("Invalid owned verification container ID.");
         const startedAt = (/* @__PURE__ */ new Date()).toISOString(), start = Date.now(), name = `vr-verify-${runId}`;
-        const dir = await (0, import_promises41.mkdtemp)((0, import_node_path51.join)(scratchDir, "oracle-")), config = (0, import_node_path51.join)(scratchDir, "docker-config"), nonce = (0, import_node_crypto11.randomUUID)();
+        const dir = await (0, import_promises42.mkdtemp)((0, import_node_path52.join)(scratchDir, "oracle-")), config = (0, import_node_path52.join)(scratchDir, "docker-config"), nonce = (0, import_node_crypto11.randomUUID)();
         try {
-          await (0, import_promises41.chmod)(dir, 493);
-          await (0, import_promises41.mkdir)(config, { recursive: true, mode: 448 });
+          await (0, import_promises42.chmod)(dir, 493);
+          await (0, import_promises42.mkdir)(config, { recursive: true, mode: 448 });
           const inputs = verificationInputs(check, nonce);
-          await (0, import_promises41.writeFile)((0, import_node_path51.join)(dir, "input.json"), JSON.stringify(inputs), { mode: 292 });
-          await (0, import_promises41.writeFile)((0, import_node_path51.join)(dir, "runner.mjs"), check.adapter === "module" ? MODULE_RUNNER : check.adapter === "http" ? HTTP_RUNNER : TEST_RUNNER, { mode: 292 });
+          await (0, import_promises42.writeFile)((0, import_node_path52.join)(dir, "input.json"), JSON.stringify(inputs), { mode: 292 });
+          await (0, import_promises42.writeFile)((0, import_node_path52.join)(dir, "runner.mjs"), check.adapter === "module" ? MODULE_RUNNER : check.adapter === "http" ? HTTP_RUNNER : TEST_RUNNER, { mode: 292 });
           const raw = await dockerCommand(dockerRunArgs(name, image, snapshotDir, dir), config, RUNTIME_LIMITS.timeoutMs, signal, projectCwd);
           const observation = compareObservation(check, raw, nonce, image, startedAt, Date.now() - start);
           const sanitized = verificationArtifactText(check, raw);
-          const artifactId = (0, import_node_crypto11.randomUUID)(), artifacts = (0, import_node_path51.join)(scratchDir, "artifacts", artifactId);
-          await (0, import_promises41.mkdir)(artifacts, { recursive: true, mode: 448 });
-          await (0, import_promises41.writeFile)((0, import_node_path51.join)(artifacts, "stdout.txt"), sanitized.stdout, { mode: 384 });
-          await (0, import_promises41.writeFile)((0, import_node_path51.join)(artifacts, "stderr.txt"), sanitized.stderr, { mode: 384 });
+          const artifactId = (0, import_node_crypto11.randomUUID)(), artifacts = (0, import_node_path52.join)(scratchDir, "artifacts", artifactId);
+          await (0, import_promises42.mkdir)(artifacts, { recursive: true, mode: 448 });
+          await (0, import_promises42.writeFile)((0, import_node_path52.join)(artifacts, "stdout.txt"), sanitized.stdout, { mode: 384 });
+          await (0, import_promises42.writeFile)((0, import_node_path52.join)(artifacts, "stderr.txt"), sanitized.stderr, { mode: 384 });
           observation.artifacts.stdoutRef = `runtime/artifacts/${artifactId}/stdout.txt`;
           observation.artifacts.stderrRef = `runtime/artifacts/${artifactId}/stderr.txt`;
           return observation;
         } finally {
           await dockerCommand(["rm", "--force", name], config, 5e3, void 0, projectCwd);
           if (!inside2(scratchDir, dir)) throw new Error("Invalid owned oracle directory.");
-          await (0, import_promises41.rm)(dir, { recursive: true, force: true });
+          await (0, import_promises42.rm)(dir, { recursive: true, force: true });
         }
       }
     };
@@ -27363,12 +27422,12 @@ async function storage(store, id2) {
 async function saveState(dir, state, reservedBytes = 0) {
   const serialized = JSON.stringify(state);
   if (Buffer.byteLength(serialized, "utf8") + reservedBytes > MAX_VERIFICATION_STATE_BYTES) throw new Error("Verification aggregate state budget (8000000 UTF-8 bytes) reached. Previous receipts are preserved; create a new prepared task.");
-  const temp = (0, import_node_path52.join)(dir, `${(0, import_node_crypto12.randomUUID)()}.tmp`);
+  const temp = (0, import_node_path53.join)(dir, `${(0, import_node_crypto12.randomUUID)()}.tmp`);
   try {
-    await (0, import_promises42.writeFile)(temp, serialized, { flag: "wx", mode: 384 });
-    await (0, import_promises42.rename)(temp, (0, import_node_path52.join)(dir, "state.json"));
+    await (0, import_promises43.writeFile)(temp, serialized, { flag: "wx", mode: 384 });
+    await (0, import_promises43.rename)(temp, (0, import_node_path53.join)(dir, "state.json"));
   } finally {
-    await (0, import_promises42.rm)(temp, { force: true });
+    await (0, import_promises43.rm)(temp, { force: true });
   }
 }
 function receiptReserve(state, attempt) {
@@ -27378,25 +27437,25 @@ function receiptReserve(state, attempt) {
   }).length, 0) * RECEIPT_RESERVE_BYTES;
 }
 async function removeUnsavedAttempt(dir, id2) {
-  const parent = (0, import_node_path52.join)(dir, "attempts"), target = (0, import_node_path52.join)(parent, id2);
+  const parent = (0, import_node_path53.join)(dir, "attempts"), target = (0, import_node_path53.join)(parent, id2);
   let actual;
   try {
-    actual = await (0, import_promises42.realpath)(target);
+    actual = await (0, import_promises43.realpath)(target);
   } catch (error) {
     if (error.code === "ENOENT") return;
     throw error;
   }
-  if (!/^[a-f0-9-]{36}$/.test(id2) || actual !== (0, import_node_path52.resolve)(target) || !inside2(parent, actual)) throw new Error("Refusing cleanup outside the owned unsaved attempt.");
-  await (0, import_promises42.rm)(actual, { recursive: true, force: true });
+  if (!/^[a-f0-9-]{36}$/.test(id2) || actual !== (0, import_node_path53.resolve)(target) || !inside2(parent, actual)) throw new Error("Refusing cleanup outside the owned unsaved attempt.");
+  await (0, import_promises43.rm)(actual, { recursive: true, force: true });
 }
 async function readState2(store, task) {
   normalizeWorkContract(task);
   if (!task.verification) throw new Error("Prepare a reviewed verification plan before editing or verifying.");
   const dir = await storage(store, task.id);
-  const stateInfo = await (0, import_promises42.lstat)((0, import_node_path52.join)(dir, "state.json"));
-  if ((await (0, import_promises42.lstat)(dir)).isSymbolicLink() || stateInfo.isSymbolicLink() || !stateInfo.isFile()) throw new Error("Verification storage must be regular, not a symlink.");
+  const stateInfo = await (0, import_promises43.lstat)((0, import_node_path53.join)(dir, "state.json"));
+  if ((await (0, import_promises43.lstat)(dir)).isSymbolicLink() || stateInfo.isSymbolicLink() || !stateInfo.isFile()) throw new Error("Verification storage must be regular, not a symlink.");
   if (stateInfo.size > MAX_VERIFICATION_STATE_BYTES) throw new Error("Verification state exceeds its size bound.");
-  const bytes = await (0, import_promises42.readFile)((0, import_node_path52.join)(dir, "state.json"));
+  const bytes = await (0, import_promises43.readFile)((0, import_node_path53.join)(dir, "state.json"));
   if (bytes.length > MAX_VERIFICATION_STATE_BYTES) throw new Error("Verification state exceeds its size bound.");
   const state = JSON.parse(bytes.toString("utf8"));
   if (state.version !== 1 || hashJson(state.prepared) !== hashJson(task.verification) || state.prepared.contractHash !== task.contractHash || hashJson(parseVerificationPlan(state.plan, task.contract)) !== state.prepared.planHash || state.baseline.hash !== state.prepared.baselineHash) throw new Error("Saved verification plan or baseline hash mismatch.");
@@ -27404,7 +27463,7 @@ async function readState2(store, task) {
   if (state.attempts.length && !state.approvedAt || state.approvedAt && !Number.isFinite(Date.parse(state.approvedAt))) throw new Error("Invalid saved verification approval.");
   for (const a of state.attempts) {
     if (!/^[a-f0-9-]{36}$/.test(a.id) || !/^sha256:[a-f0-9]{64}$/.test(a.image) || !Array.isArray(a.receipts)) throw new Error("Invalid verification attempt.");
-    await validateSnapshot((0, import_node_path52.join)(dir, "attempts", a.id, "source"), a.candidate);
+    await validateSnapshot((0, import_node_path53.join)(dir, "attempts", a.id, "source"), a.candidate);
   }
   for (const list of [state.baselineReceipts, ...state.attempts.map((a) => a.receipts)]) {
     if (list.length > 32 || new Set(list.map((r) => r.checkId)).size !== list.length) throw new Error("Invalid verification receipt count.");
@@ -27415,13 +27474,13 @@ async function readState2(store, task) {
         const ref = receipt.observation?.artifacts[`${stream}Ref`];
         if (ref) {
           if (!new RegExp(`^runtime/artifacts/[a-f0-9-]{36}/${stream}\\.txt$`).test(ref)) throw new Error("Invalid verification artifact reference.");
-          const file = (0, import_node_path52.join)(dir, ref), info = await (0, import_promises42.lstat)(file);
-          if (!info.isFile() || info.isSymbolicLink() || info.size > 131072 || hashBytes(await (0, import_promises42.readFile)(file)) !== receipt.observation.artifacts[`${stream}Sha256`]) throw new Error("Saved verification artifact hash mismatch.");
+          const file = (0, import_node_path53.join)(dir, ref), info = await (0, import_promises43.lstat)(file);
+          if (!info.isFile() || info.isSymbolicLink() || info.size > 131072 || hashBytes(await (0, import_promises43.readFile)(file)) !== receipt.observation.artifacts[`${stream}Sha256`]) throw new Error("Saved verification artifact hash mismatch.");
         }
       }
     }
   }
-  await validateSnapshot((0, import_node_path52.join)(dir, "baseline"), state.baseline);
+  await validateSnapshot((0, import_node_path53.join)(dir, "baseline"), state.baseline);
   return { dir, state };
 }
 async function prepareVerification(store, task, rawPlan) {
@@ -27437,8 +27496,8 @@ async function prepareVerification(store, task, rawPlan) {
     for (const path2 of check.adapter === "node-test" ? [check.entry, ...check.frozenPaths] : [check.module]) if (verificationSecretPath(path2)) throw new Error("Secret paths cannot be verification inputs.");
   }
   const dir = await storage(store, task.id);
-  await (0, import_promises42.mkdir)(dir, { mode: 448 });
-  const baseline = await captureSnapshot(task.cwd, (0, import_node_path52.join)(dir, "baseline"));
+  await (0, import_promises43.mkdir)(dir, { mode: 448 });
+  const baseline = await captureSnapshot(task.cwd, (0, import_node_path53.join)(dir, "baseline"));
   const stable = await captureSnapshot(task.cwd);
   if (stable.hash !== baseline.hash) throw new Error("Repository changed while preparing; create a fresh prepared task.");
   const prepared = { version: 1, contractHash: task.contractHash, planHash, baselineHash: baseline.hash, preparedAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -27532,19 +27591,19 @@ async function verificationView(store, task) {
   }
 }
 async function frozenTestSource(dir, state, attempt, check) {
-  const source = (0, import_node_path52.join)(dir, "attempts", attempt.id, "source");
+  const source = (0, import_node_path53.join)(dir, "attempts", attempt.id, "source");
   if (check.adapter !== "node-test") return source;
-  const target = (0, import_node_path52.join)(dir, "attempts", attempt.id, `frozen-${check.id}`);
+  const target = (0, import_node_path53.join)(dir, "attempts", attempt.id, `frozen-${check.id}`);
   if (!inside2(dir, target)) throw new Error("Invalid owned frozen-test directory.");
-  await (0, import_promises42.rm)(target, { recursive: true, force: true });
-  await (0, import_promises42.mkdir)(target, { recursive: true, mode: 493 });
+  await (0, import_promises43.rm)(target, { recursive: true, force: true });
+  await (0, import_promises43.mkdir)(target, { recursive: true, mode: 493 });
   const frozen = (path2) => frozenVerificationPath(path2) || check.frozenPaths.some((p2) => within(path2, p2));
-  for (const [snapshot, root, isBaseline] of [[attempt.candidate, source, false], [state.baseline, (0, import_node_path52.join)(dir, "baseline"), true]]) {
+  for (const [snapshot, root, isBaseline] of [[attempt.candidate, source, false], [state.baseline, (0, import_node_path53.join)(dir, "baseline"), true]]) {
     for (const file of snapshot.files) {
       if (frozen(file.path) !== isBaseline) continue;
-      const to = (0, import_node_path52.join)(target, file.path);
-      await (0, import_promises42.mkdir)((0, import_node_path52.dirname)(to), { recursive: true, mode: 493 });
-      await (0, import_promises42.copyFile)((0, import_node_path52.join)(root, file.path), to);
+      const to = (0, import_node_path53.join)(target, file.path);
+      await (0, import_promises43.mkdir)((0, import_node_path53.dirname)(to), { recursive: true, mode: 493 });
+      await (0, import_promises43.copyFile)((0, import_node_path53.join)(root, file.path), to);
     }
   }
   return target;
@@ -27554,8 +27613,8 @@ async function verifyVerification(store, task, approved, runtime = dockerRuntime
   const { dir, state } = await readState2(store, task);
   state.approvedAt ??= (/* @__PURE__ */ new Date()).toISOString();
   await saveState(dir, state);
-  const scratch = (0, import_node_path52.join)(dir, "runtime");
-  await (0, import_promises42.mkdir)(scratch, { recursive: true, mode: 493 });
+  const scratch = (0, import_node_path53.join)(dir, "runtime");
+  await (0, import_promises43.mkdir)(scratch, { recursive: true, mode: 493 });
   const image = await runtime.resolveImage(scratch, task.cwd);
   if (!image) {
     const previous = state.attempts.at(-1);
@@ -27573,7 +27632,7 @@ async function verifyVerification(store, task, approved, runtime = dockerRuntime
     if (state.attempts.length >= 16) throw new Error("Verification attempt limit (16) reached. Create a new task.");
     const id2 = (0, import_node_crypto12.randomUUID)();
     try {
-      const candidate = await captureSnapshot(task.cwd, (0, import_node_path52.join)(dir, "attempts", id2, "source"));
+      const candidate = await captureSnapshot(task.cwd, (0, import_node_path53.join)(dir, "attempts", id2, "source"));
       if (candidate.hash !== current.hash) throw new Error("Repository changed while capturing candidate. Retry with a stable worktree.");
       attempt = { id: id2, candidate, image, createdAt: (/* @__PURE__ */ new Date()).toISOString(), receipts: [] };
       state.attempts.push(attempt);
@@ -27611,7 +27670,7 @@ async function verifyVerification(store, task, approved, runtime = dockerRuntime
         const needed = check.adapter === "node-test" ? [check.entry, ...check.frozenPaths] : [check.module];
         if (needed.some((p2) => !state.baseline.files.some((f) => within(f.path, p2))) || check.adapter !== "node-test" && !snapshot.files.some((f) => f.path === check.module)) receipt.observation = unknownObservation("missing_frozen_input", image, check);
         else {
-          const snapshotDir = phase === "baseline" ? (0, import_node_path52.join)(dir, "baseline") : await frozenTestSource(dir, state, active, check);
+          const snapshotDir = phase === "baseline" ? (0, import_node_path53.join)(dir, "baseline") : await frozenTestSource(dir, state, active, check);
           receipt.observation = await runtime.run({ check, snapshotDir, scratchDir: scratch, image, signal, runId: receipt.id, projectCwd: task.cwd });
         }
       } catch {
@@ -27625,13 +27684,13 @@ async function verifyVerification(store, task, approved, runtime = dockerRuntime
   const after = await captureSnapshot(task.cwd);
   return report(task, state, active, after.hash !== active.candidate.hash);
 }
-var import_node_crypto12, import_promises42, import_node_path52, MAX_VERIFICATION_STATE_BYTES, RECEIPT_RESERVE_BYTES, within, emptyArtifacts, unknownObservation, receiptHash;
+var import_node_crypto12, import_promises43, import_node_path53, MAX_VERIFICATION_STATE_BYTES, RECEIPT_RESERVE_BYTES, within, emptyArtifacts, unknownObservation, receiptHash;
 var init_verification2 = __esm({
   "src/verification/index.ts"() {
     "use strict";
     import_node_crypto12 = require("node:crypto");
-    import_promises42 = require("node:fs/promises");
-    import_node_path52 = require("node:path");
+    import_promises43 = require("node:fs/promises");
+    import_node_path53 = require("node:path");
     init_workStore();
     init_verificationPlan();
     init_snapshot();
@@ -27680,7 +27739,7 @@ function workView(task, extra = {}) {
 async function runWork(options, deps) {
   const url = new URL(deps.api);
   if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))) throw new Error("Work API must use HTTPS (HTTP is allowed only on loopback).");
-  const cwd = await (0, import_promises43.realpath)(options.cwd);
+  const cwd = await (0, import_promises44.realpath)(options.cwd);
   const store = new WorkStore(cwd, deps.configDir);
   const credentials = new CredentialStore(deps.configDir, cwd);
   const call2 = async (method, path2, body, token) => {
@@ -27703,9 +27762,9 @@ async function runWork(options, deps) {
   if (options.approvedContract !== void 0 && typeof options.approvedContract !== "boolean") throw new Error("Contract approval must be a boolean.");
   let supplied;
   if (options.contractPath !== void 0) {
-    const path2 = (0, import_node_path53.resolve)(cwd, options.contractPath);
-    if ((await (0, import_promises43.stat)(path2)).size > TASK_CONTRACT_MAX_BYTES) throw new Error("Task contract file exceeds 4800 UTF-8 bytes.");
-    supplied = parseTaskContract(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await (0, import_promises43.readFile)(path2))));
+    const path2 = (0, import_node_path54.resolve)(cwd, options.contractPath);
+    if ((await (0, import_promises44.stat)(path2)).size > TASK_CONTRACT_MAX_BYTES) throw new Error("Task contract file exceeds 4800 UTF-8 bytes.");
+    supplied = parseTaskContract(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await (0, import_promises44.readFile)(path2))));
   } else if (options.contractBase64 !== void 0) supplied = decodeTaskContract(options.contractBase64);
   else if (options.contract !== void 0) supplied = parseTaskContract(options.contract);
   let task;
@@ -27739,10 +27798,10 @@ async function runWork(options, deps) {
       if (options.action === "prepare") {
         let plan = options.verification;
         if (options.verificationPath !== void 0) {
-          const path2 = await (0, import_promises43.realpath)((0, import_node_path53.resolve)(cwd, options.verificationPath));
+          const path2 = await (0, import_promises44.realpath)((0, import_node_path54.resolve)(cwd, options.verificationPath));
           if (path2 === cwd || inside2(cwd, path2)) throw new Error("Keep the reviewed verification plan outside the repository so expectations cannot enter candidate snapshots.");
-          if ((await (0, import_promises43.stat)(path2)).size > VERIFICATION_PLAN_MAX_BYTES) throw new Error("Verification plan exceeds 65536 UTF-8 bytes.");
-          plan = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await (0, import_promises43.readFile)(path2)));
+          if ((await (0, import_promises44.stat)(path2)).size > VERIFICATION_PLAN_MAX_BYTES) throw new Error("Verification plan exceeds 65536 UTF-8 bytes.");
+          plan = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await (0, import_promises44.readFile)(path2)));
         } else if (options.verificationBase64 !== void 0) plan = decodeVerificationPlan(options.verificationBase64);
         verification = await prepareVerification(store, task, plan);
       } else verification = await verifyVerification(store, task, options.approvedVerification, deps.verificationRuntime, deps.signal);
@@ -27961,12 +28020,12 @@ function contractExecutionBlock(contract) {
 function assertWorkJob(task, job, executing) {
   if (job.kind !== "agent_change" || task.job && task.job.id !== job.id || job.deploySessionId !== task.sessionId || job.input?.requestId !== task.id || executing && (job.input?.request !== task.request || job.input?.cliId !== task.cliId || job.input?.accessMode !== task.accessMode) || job.input?.request !== void 0 && job.input.request !== task.request || job.input?.cliId !== void 0 && job.input.cliId !== task.cliId || job.input?.accessMode !== void 0 && job.input.accessMode !== task.accessMode) throw new Error("Remote job differs from the saved Task contract or job identity. No execution was started.");
 }
-var import_promises43, import_node_path53, import_node_crypto13, WorkHttpError, terminal, repoKey;
+var import_promises44, import_node_path54, import_node_crypto13, WorkHttpError, terminal, repoKey;
 var init_work = __esm({
   "src/commands/work.ts"() {
     "use strict";
-    import_promises43 = require("node:fs/promises");
-    import_node_path53 = require("node:path");
+    import_promises44 = require("node:fs/promises");
+    import_node_path54 = require("node:path");
     init_taskContract();
     import_node_crypto13 = require("node:crypto");
     init_credentials();
@@ -28589,7 +28648,7 @@ async function runLive(options, deps) {
   const api = new URL(deps.api);
   if (api.username || api.password || api.search || api.hash || api.protocol !== "https:" && !(api.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(api.hostname))) throw new Error("Account API must use HTTPS; HTTP is restricted to loopback.");
   if (!["start", "resume", "status", "disconnect"].includes(options.action)) throw new Error("Use live start, resume, status or disconnect.");
-  const cwd = await (0, import_promises44.realpath)(options.cwd);
+  const cwd = await (0, import_promises45.realpath)(options.cwd);
   const store = new WorkStore(cwd, deps.configDir, "live");
   const credentials = new CredentialStore(deps.configDir, cwd);
   const call2 = async (method, path2, body, token) => {
@@ -28754,12 +28813,12 @@ async function runLiveCommand(options) {
     return 1;
   }
 }
-var import_node_crypto15, import_promises44, LiveHttpError, terminal2;
+var import_node_crypto15, import_promises45, LiveHttpError, terminal2;
 var init_live = __esm({
   "src/commands/live.ts"() {
     "use strict";
     import_node_crypto15 = require("node:crypto");
-    import_promises44 = require("node:fs/promises");
+    import_promises45 = require("node:fs/promises");
     init_credentials();
     init_hostedClient();
     init_workStore();
@@ -29207,8 +29266,8 @@ function isSqlError(error) {
 }
 function displayPath(projectDir, path2) {
   for (const base2 of [projectDir, process.cwd()]) {
-    const rel = (0, import_node_path54.relative)(base2, path2);
-    if (rel && !rel.startsWith("..") && !(0, import_node_path54.isAbsolute)(rel)) return rel.split("\\").join("/");
+    const rel = (0, import_node_path55.relative)(base2, path2);
+    if (rel && !rel.startsWith("..") && !(0, import_node_path55.isAbsolute)(rel)) return rel.split("\\").join("/");
   }
   return path2;
 }
@@ -29466,7 +29525,7 @@ function writeControl(filtered, changed) {
         detail: filtered ? `as the superuser the same statement changed ${plural3(run.affected ?? 0, "row")}, expected 1` : "as the superuser the same statement did not change the owner row"
       };
     }
-    return { ok: true, detail: `as the superuser the same statement changed ${plural3(filtered ? run.affected ?? 0 : 1, "row")}` };
+    return { ok: true, detail: `as the superuser the same statement changed ${plural3(run.affected ?? 0, "row")}` };
   };
 }
 async function differingValue(db, shape, target, column) {
@@ -29566,6 +29625,9 @@ function insertPlans(c) {
     }
   ];
 }
+function writeFilters(pkSelectable, noPrivilege) {
+  return noPrivilege ? [true] : pkSelectable ? [true, false] : [false];
+}
 function freeOtherUserSlot(db, shape) {
   if (!shape.ownerUnique) return void 0;
   return async () => void await db.query(`delete from ${shape.qualified} where ${quoteIdent2(shape.owner.name)}::text = $1`, [OTHER_USER_ID]);
@@ -29582,50 +29644,55 @@ async function updatePlans(c) {
   const { db, shape, target, privileges, actor } = c;
   const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
   const noPrivilege = !privileges.table.update && !privileges.any.update;
-  const filtered = pkSelectable || noPrivilege;
-  const where = filtered ? ` where ${pkCondition(shape, 1)}` : "";
-  const baseParams = filtered ? target : [];
   const ownerUpdatable = Boolean(privileges.column.get(shape.owner.name)?.update) || noPrivilege;
   const column = pickUpdateColumn(shape, privileges);
   const value = column ? await differingValue(db, shape, target, column) : void 0;
   const plans = [];
-  const add = (name, sets, display, noop = false, prep) => {
-    let n = baseParams.length;
-    const assignments = sets.map((s) => `${quoteIdent2(s.column)} = ${s.value === SELF ? quoteIdent2(s.column) : `$${++n}`}`).join(", ");
-    const sql = `update ${shape.qualified} set ${assignments}${where}`;
-    const params = [...baseParams, ...sets.filter((s) => s.value !== SELF).map((s) => s.value)];
-    const changed = (run) => noop ? (run.affected ?? 0) >= 1 && run.after.target !== null : run.after.target !== null && run.after.target !== run.before.target;
-    plans.push({
-      stmt: { name, sql, params, display: `${display}${filtered ? "" : ", no row filter (the role cannot read the primary key)"}`, filtered },
-      prep,
-      controlOk: writeControl(filtered, changed),
-      judge: (run) => {
-        if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message}. USING matched the owner row, so this is not a denial` };
-        if (isPrivilegeRefusal(run)) {
-          return noPrivilege ? { verdict: "denied", detail: `refused: ${run.error.message} (42501), no UPDATE on any column` } : { verdict: "unknown", detail: `refused for column privileges (${run.error.message}), but the role can update some columns` };
+  for (const filtered of writeFilters(pkSelectable, noPrivilege)) {
+    const where = filtered ? ` where ${pkCondition(shape, 1)}` : "";
+    const baseParams = filtered ? target : [];
+    const planStart = plans.length;
+    const add = (name, sets, display, noop = false, prep) => {
+      let n = baseParams.length;
+      const assignments = sets.map((s) => `${quoteIdent2(s.column)} = ${s.value === SELF ? quoteIdent2(s.column) : `$${++n}`}`).join(", ");
+      const sql = `update ${shape.qualified} set ${assignments}${where}`;
+      const params = [...baseParams, ...sets.filter((s) => s.value !== SELF).map((s) => s.value)];
+      const changed = (run) => noop ? (run.affected ?? 0) >= 1 && run.after.target !== null : run.after.target !== null && run.after.target !== run.before.target;
+      plans.push({
+        stmt: { name: filtered ? name : `blind ${name}`, sql, params, display: `${display}${filtered ? "" : ", no row filter (blind write)"}`, filtered },
+        prep,
+        controlOk: writeControl(filtered, changed),
+        judge: (run) => {
+          if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message}. This does not establish denial of the owner row` };
+          if (isPrivilegeRefusal(run)) {
+            return noPrivilege ? { verdict: "denied", detail: `refused: ${run.error.message} (42501), no UPDATE on any column` } : { verdict: "unknown", detail: `refused for column privileges (${run.error.message}), but the role can update some columns` };
+          }
+          if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+          if (noop && !filtered && (run.affected ?? 0) > 0) {
+            return { verdict: "unknown", detail: `${changedRows(run.affected)}, but an unfiltered no-op cannot identify whether the owner row was updated` };
+          }
+          if (changed(run)) return { verdict: "allowed", detail: noop ? `${plural3(run.affected ?? 0, "row")} updated (rewrote its own value)` : `${changedRows(run.affected)} (${sets.map((s) => s.column).join(" and ")} rewritten; owner row changed)` };
+          if (!filtered) return { verdict: "denied", detail: "the owner row is unchanged" };
+          if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
+          return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
         }
-        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
-        if (changed(run)) return { verdict: "allowed", detail: noop ? "1 row updated (rewrote its own value)" : `${changedRows(filtered ? run.affected : 1)} (${sets.map((s) => s.column).join(" and ")} rewritten)` };
-        if (!filtered) return { verdict: "denied", detail: "the owner row is unchanged" };
-        if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
-        return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
-      }
-    });
-  };
-  if (column && value !== void 0) add("update value", [{ column: column.name, value }], `update ${column.name} on the owner's row in ${shape.display}`);
-  if (actor === "other_user" && ownerUpdatable && !shape.ownerInPk) {
-    const sets = [{ column: shape.owner.name, value: OTHER_USER_ID }];
-    if (column && value !== void 0) sets.push({ column: column.name, value });
-    add(
-      "update claiming the row",
-      sets,
-      `update the owner's row setting ${shape.owner.name} to the other user${column && value !== void 0 ? ` and ${column.name}` : ""}`,
-      false,
-      freeOtherUserSlot(db, shape)
-    );
-  }
-  if (plans.length === 0) {
-    add("update noop", [{ column: shape.owner.name, value: SELF }], `update the owner's row in ${shape.display} (${shape.owner.name} = itself)`, true);
+      });
+    };
+    if (column && value !== void 0) add("update value", [{ column: column.name, value }], `update ${column.name} on the owner's row in ${shape.display}`);
+    if (actor === "other_user" && ownerUpdatable && !shape.ownerInPk) {
+      const sets = [{ column: shape.owner.name, value: OTHER_USER_ID }];
+      if (column && value !== void 0) sets.push({ column: column.name, value });
+      add(
+        "update claiming the row",
+        sets,
+        `update the owner's row setting ${shape.owner.name} to the other user${column && value !== void 0 ? ` and ${column.name}` : ""}`,
+        false,
+        freeOtherUserSlot(db, shape)
+      );
+    }
+    if (plans.length === planStart) {
+      add("update noop", [{ column: shape.owner.name, value: SELF }], `update the owner's row in ${shape.display} (${shape.owner.name} = itself)`, true);
+    }
   }
   return plans;
 }
@@ -29634,20 +29701,19 @@ function reassignPlans(c) {
   const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
   const ownerUpdatable = Boolean(privileges.column.get(shape.owner.name)?.update);
   const noPrivilege = !ownerUpdatable;
-  const filtered = pkSelectable || noPrivilege;
-  const where = filtered ? ` where ${pkCondition(shape, 1)}` : "";
-  const baseParams = filtered ? target : [];
-  const owner = quoteIdent2(shape.owner.name);
-  const moved = (run) => run.after.targetOwner === OTHER_USER_ID;
-  const stmt = {
-    name: "reassign",
-    sql: `update ${shape.qualified} set ${owner} = $${baseParams.length + 1}${where}`,
-    params: [...baseParams, OTHER_USER_ID],
-    display: `set ${shape.owner.name} on the owner's row in ${shape.display} to the other user${filtered ? "" : ", no row filter"}`,
-    filtered
-  };
-  return [
-    {
+  return writeFilters(pkSelectable, noPrivilege).map((filtered) => {
+    const where = filtered ? ` where ${pkCondition(shape, 1)}` : "";
+    const baseParams = filtered ? target : [];
+    const owner = quoteIdent2(shape.owner.name);
+    const moved = (run) => run.after.targetOwner === OTHER_USER_ID;
+    const stmt = {
+      name: filtered ? "reassign" : "blind reassign",
+      sql: `update ${shape.qualified} set ${owner} = $${baseParams.length + 1}${where}`,
+      params: [...baseParams, OTHER_USER_ID],
+      display: `set ${shape.owner.name} on the owner's row in ${shape.display} to the other user${filtered ? "" : ", no row filter (blind write)"}`,
+      filtered
+    };
+    return {
       stmt,
       prep: freeOtherUserSlot(db, shape),
       controlOk: writeControl(filtered, moved),
@@ -29662,38 +29728,35 @@ function reassignPlans(c) {
         if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
         return { verdict: "unknown", detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner column did not move` };
       }
-    }
-  ];
+    };
+  });
 }
 function deletePlans(c) {
   const { shape, target, privileges } = c;
   const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
   const noPrivilege = !privileges.table.delete;
-  const filtered = pkSelectable || noPrivilege;
   const gone = (run) => run.after.target === null && run.before.target !== null;
-  return [
-    {
-      stmt: {
-        name: "delete",
-        sql: `delete from ${shape.qualified}${filtered ? ` where ${pkCondition(shape, 1)}` : ""}`,
-        params: filtered ? target : [],
-        display: `delete the owner's row from ${shape.display}${filtered ? "" : ", no row filter (the role cannot read the primary key)"}`,
-        filtered
-      },
-      controlOk: writeControl(filtered, gone),
-      judge: (run) => {
-        if (isPrivilegeRefusal(run) && noPrivilege) return { verdict: "denied", detail: `refused: ${run.error.message} (42501), no DELETE privilege` };
-        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
-        if (gone(run)) return { verdict: "allowed", detail: `${filtered ? "1 row deleted" : "deleted"}, the owner row is gone (${run.before.count} to ${run.after.count} rows)` };
-        if (!filtered) return { verdict: "denied", detail: "the owner row is still there" };
-        if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
-        return {
-          verdict: "unknown",
-          detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
-        };
-      }
+  return writeFilters(pkSelectable, noPrivilege).map((filtered) => ({
+    stmt: {
+      name: filtered ? "delete" : "blind delete",
+      sql: `delete from ${shape.qualified}${filtered ? ` where ${pkCondition(shape, 1)}` : ""}`,
+      params: filtered ? target : [],
+      display: `delete the owner's row from ${shape.display}${filtered ? "" : ", no row filter (blind write)"}`,
+      filtered
+    },
+    controlOk: writeControl(filtered, gone),
+    judge: (run) => {
+      if (isPrivilegeRefusal(run) && noPrivilege) return { verdict: "denied", detail: `refused: ${run.error.message} (42501), no DELETE privilege` };
+      if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+      if (gone(run)) return { verdict: "allowed", detail: `${plural3(run.affected ?? 0, "row")} deleted, the owner row is gone (${run.before.count} to ${run.after.count} rows)` };
+      if (!filtered) return { verdict: "denied", detail: "the owner row is still there" };
+      if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
+      return {
+        verdict: "unknown",
+        detail: `reported ${plural3(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
+      };
     }
-  ];
+  }));
 }
 async function runCell(ctx, privilegesByRole, actor, action, expected) {
   const base2 = { table: ctx.shape.display, actor, action, expected };
@@ -29707,11 +29770,11 @@ async function runCell(ctx, privilegesByRole, actor, action, expected) {
   const plans = action === "select" ? await selectPlans(c) : action === "insert" ? insertPlans(c) : action === "update" ? await updatePlans(c) : action === "reassign" ? reassignPlans(c) : deletePlans(c);
   const records = [];
   let decisive;
-  let firstRun;
+  let first;
+  let uncertain;
   for (const plan of plans) {
     const control = plan.controlOk(await runStatement(ctx.db, ctx.shape, ctx.target, plan.stmt, null, plan.prep));
     const run = await runStatement(ctx.db, ctx.shape, ctx.target, plan.stmt, session, plan.prep);
-    firstRun = firstRun ?? run;
     let judged;
     const id2 = run.identity;
     if (!id2 || id2.superuser || id2.bypass || id2.user !== session.role) {
@@ -29723,13 +29786,15 @@ async function runCell(ctx, privilegesByRole, actor, action, expected) {
     }
     const record = { name: plan.stmt.name, statement: plan.stmt.display, verdict: judged.verdict, detail: judged.detail, affectedRows: run.affected, ...run.error ? { error: run.error } : {}, control };
     records.push(record);
+    first = first ?? { run, record };
+    if (judged.verdict === "unknown" && !uncertain) uncertain = { run, record };
     if (judged.verdict === "allowed" && !decisive) decisive = { run, record };
   }
   let verdict;
   if (decisive) verdict = "allowed";
   else if (records.length > 0 && records.every((r2) => r2.verdict === "denied")) verdict = "denied";
   else verdict = "unknown";
-  const shown = decisive ?? { run: firstRun, record: records.find((r2) => r2.verdict !== "denied") ?? records[0] };
+  const shown = decisive ?? uncertain ?? first;
   const r = shown.run;
   const observed = {
     statement: shown.record.statement,
@@ -29812,26 +29877,26 @@ function verdictFor(summary) {
 }
 async function listMigrations(dir) {
   try {
-    const entries = await (0, import_promises45.readdir)(dir, { withFileTypes: true });
+    const entries = await (0, import_promises46.readdir)(dir, { withFileTypes: true });
     return entries.filter((e2) => e2.isFile() && /\.sql$/i.test(e2.name) && !e2.name.startsWith(".")).map((e2) => e2.name).sort((a, b3) => a < b3 ? -1 : a > b3 ? 1 : 0);
   } catch {
     return [];
   }
 }
 async function runRlsTest(options) {
-  const projectDir = (0, import_node_path54.resolve)(options.projectDir);
-  const matrixPath = (0, import_node_path54.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
-  const migrationsDir = (0, import_node_path54.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path54.join)("supabase", "migrations"));
+  const projectDir = (0, import_node_path55.resolve)(options.projectDir);
+  const matrixPath = (0, import_node_path55.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
+  const migrationsDir = (0, import_node_path55.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path55.join)("supabase", "migrations"));
   const timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
-  if ((0, import_node_path54.basename)(matrixPath).toLowerCase().startsWith(".env")) {
-    throw new RlsInputError(`Refusing to read ${(0, import_node_path54.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
+  if ((0, import_node_path55.basename)(matrixPath).toLowerCase().startsWith(".env")) {
+    throw new RlsInputError(`Refusing to read ${(0, import_node_path55.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
   }
   const filesRead = [];
   let matrixText;
   try {
-    const info = await (0, import_promises45.stat)(matrixPath);
+    const info = await (0, import_promises46.stat)(matrixPath);
     if (!info.isFile()) throw new Error("not a file");
-    matrixText = normalise(await (0, import_promises45.readFile)(matrixPath, "utf8"));
+    matrixText = normalise(await (0, import_promises46.readFile)(matrixPath, "utf8"));
   } catch {
     throw new RlsInputError(
       `No permissions matrix at ${matrixPath}. Write one by hand (schema: schemas/permissions-matrix.schema.json in the @viberaven/cli package); rls-test never infers it from your policies.`
@@ -29842,8 +29907,8 @@ async function runRlsTest(options) {
   const names = await listMigrations(migrationsDir);
   const migrationFiles = [];
   for (const name of names) {
-    const sql = normalise(await (0, import_promises45.readFile)((0, import_node_path54.join)(migrationsDir, name), "utf8"));
-    filesRead.push(displayPath(projectDir, (0, import_node_path54.join)(migrationsDir, name)));
+    const sql = normalise(await (0, import_promises46.readFile)((0, import_node_path55.join)(migrationsDir, name), "utf8"));
+    filesRead.push(displayPath(projectDir, (0, import_node_path55.join)(migrationsDir, name)));
     migrationFiles.push({ name, sha256: sha256(sql), sql });
   }
   const migrationsHash = sha256(migrationFiles.map((f) => `${f.name}\0${f.sha256}`).join("\n"));
@@ -29962,6 +30027,7 @@ async function runRlsTest(options) {
     } catch (error) {
       if (error instanceof RlsTimeoutError || !isSqlError(error)) {
         const message = firstLine2(error instanceof Error ? error.message : String(error));
+        result.engine.error = message;
         return allUnknown(
           error instanceof RlsTimeoutError ? `A statement did not finish within ${Math.round(timeouts.statementMs / 1e3)} s, so the PGlite worker was stopped and no cell is reported as passed.` : `The PGlite worker stopped (${message}), so no cell is reported as passed.`,
           "not run: the database stopped"
@@ -30043,15 +30109,15 @@ async function runTable(db, table2, badRoles, roleChecks) {
     cells
   };
 }
-var import_node_child_process16, import_node_crypto17, import_promises45, import_node_net2, import_node_path54, import_node_util8, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine2, plural3, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
+var import_node_child_process16, import_node_crypto17, import_promises46, import_node_net2, import_node_path55, import_node_util8, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine2, plural3, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
 var init_rlsRunner = __esm({
   "src/rls/rlsRunner.ts"() {
     "use strict";
     import_node_child_process16 = require("node:child_process");
     import_node_crypto17 = require("node:crypto");
-    import_promises45 = require("node:fs/promises");
+    import_promises46 = require("node:fs/promises");
     import_node_net2 = __toESM(require("node:net"));
-    import_node_path54 = require("node:path");
+    import_node_path55 = require("node:path");
     import_node_util8 = require("node:util");
     init_safeGit();
     init_permissionsMatrix();
@@ -30083,8 +30149,7 @@ var init_rlsRunner = __esm({
     PROBE_EXCLUSIONS = [
       "Policies that look up other tables (teams, organisations, memberships) are only exercised with the rows the migrations create: no membership rows are seeded.",
       "WITH CHECK expressions are tried with the generated values only; when every value tried is refused, the cell is Unknown, not a pass.",
-      "When a role can use some columns but cannot read the primary key, probes run without a row filter and are judged by the owner row alone.",
-      "When the primary key is readable, writes are filtered by it; unfiltered UPDATE and DELETE statements are not also tested.",
+      "Writes with applicable privileges also run without a row filter to test writes that SELECT policies may hide, and are judged by the owner row. Filtered writes also run when the primary key is readable.",
       "One row per test user is used; a row the migrations create for the user (an auth.users trigger) is reused.",
       "Side effects of triggers on other tables are not checked."
     ];
@@ -30353,9 +30418,9 @@ var init_nextActionBlock = __esm({
 function defaultMcpConfigPaths() {
   const home = (0, import_node_os5.homedir)();
   return [
-    (0, import_node_path55.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path55.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path55.join)(home, ".gemini", "antigravity", "mcp_config.json")
+    (0, import_node_path56.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path56.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path56.join)(home, ".gemini", "antigravity", "mcp_config.json")
   ];
 }
 function resolveConfigPaths() {
@@ -30432,13 +30497,13 @@ async function verifyProviderGap(options) {
     fallbackCommand: FALLBACK_COMMAND
   };
 }
-var import_node_fs17, import_node_os5, import_node_path55, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
+var import_node_fs17, import_node_os5, import_node_path56, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
 var init_providerMcpBridge = __esm({
   "src/providerMcpBridge.ts"() {
     "use strict";
     import_node_fs17 = require("node:fs");
     import_node_os5 = require("node:os");
-    import_node_path55 = require("node:path");
+    import_node_path56 = require("node:path");
     FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
     SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
   }
@@ -30675,7 +30740,7 @@ async function cmdProviderVerify(flags, positional) {
   return result.verified ? 0 : 1;
 }
 async function cmdStatus(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact2;
   try {
     artifact2 = await loadLastArtifact(startDir);
@@ -30714,7 +30779,7 @@ async function cmdStatus(flags, positional) {
   return 0;
 }
 async function runScanCommand(flags, positional, options) {
-  const workspacePath = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
+  const workspacePath = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
   if (!options?.deferMachineOutput) {
     console.log(`Scanning ${workspacePath}\u2026 (local, offline)`);
   }
@@ -30740,7 +30805,7 @@ async function runScanCommand(flags, positional, options) {
     const block = buildNextActionBlock(tasks, updatedState);
     let manifest;
     try {
-      manifest = JSON.parse(await (0, import_promises46.readFile)(paths.actionsPath, "utf8"));
+      manifest = JSON.parse(await (0, import_promises47.readFile)(paths.actionsPath, "utf8"));
     } catch (error) {
       console.warn(error instanceof Error ? error.message : String(error));
     }
@@ -30770,7 +30835,7 @@ async function runScanCommand(flags, positional, options) {
   return { exitCode: 0, artifacts: paths };
 }
 async function cmdReport(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
   try {
     const paths = await refreshReportFromDisk(startDir);
     console.log(`Report refreshed: ${paths.reportPath}`);
@@ -30792,7 +30857,7 @@ async function cmdReport(flags, positional) {
   }
 }
 async function cmdPrompt(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact2;
   try {
     artifact2 = await loadLastArtifact(startDir);
@@ -30889,7 +30954,7 @@ async function main() {
   const wantsJsonl = hasFlag(flags, "jsonl");
   const wantsStrict = hasFlag(flags, "strict");
   if (flags.condense) {
-    const cwd = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+    const cwd = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
     const result = await runCondenseCommand({ cwd });
     console.log(`VibeRaven context map refreshed: ${result.contextMapPath}`);
     return 0;
@@ -30909,7 +30974,7 @@ async function main() {
   }
   if (!command && flags.verify === true && typeof flags.action === "string") {
     return runVerifyActionCommand({
-      cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
+      cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
       actionId: flags.action
     });
   }
@@ -30920,7 +30985,7 @@ async function main() {
       console.error("VibeRaven could not produce machine output because scan artifacts were not written.");
       return 3;
     }
-    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises46.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
+    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises47.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
     const strictExitCode = wantsStrict && gateResult ? exitCodeForStrictGate(gateResult, { failOnWarnings: flags.strict === "warning" }) : scanResult.exitCode;
     if (wantsJson && gateResult) {
       process.stdout.write(renderGateResultJson(gateResult));
@@ -30942,7 +31007,7 @@ async function main() {
       env: process.env
     });
     if (mode === "local-ui") {
-      const cwd = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
       const handle = await startLocalUiServer({ cwd, initialPath: stackInitialPath(flags) });
       console.log(`VibeRaven local UI: ${handle.url}`);
       await waitForServerShutdown();
@@ -30962,7 +31027,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     case "ui": {
-      const cwd = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
       const envPort = Number(process.env.PORT);
       const handle = await startLocalUiServer({ cwd, port: Number.isFinite(envPort) && envPort > 0 ? envPort : void 0, initialPath: stackInitialPath(flags) });
       console.log(`VibeRaven local UI: ${handle.url}`);
@@ -31009,20 +31074,20 @@ async function main() {
       });
     case "connect":
       return runConnectCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
         session: typeof flags.session === "string" ? flags.session : void 0,
         token: typeof flags.token === "string" ? flags.token : void 0
       });
     case "check":
       return runCheckCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json),
         quiet: Boolean(flags.quiet),
         base: typeof flags.base === "string" ? flags.base : void 0,
         markdown: flags.markdown === true
       });
     case "fix": {
-      const fixCwd = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const fixCwd = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
       const gapId = typeof flags.gap === "string" ? flags.gap : void 0;
       if (!gapId) {
         const artifact2 = await loadLastArtifact(fixCwd).catch(() => void 0);
@@ -31051,19 +31116,19 @@ async function main() {
     }
     case "actions":
       return runActionsCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "preview":
       return runPreviewCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
         agentMode: flags["agent-mode"] === true,
         json: Boolean(flags.json)
       });
     case "next":
       return runNextCommand({
         json: Boolean(flags.json),
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "guide": {
       const provider2 = positional[0];
@@ -31097,7 +31162,7 @@ async function main() {
     case "provider-verify":
       return cmdProviderVerify(flags, positional);
     case "init": {
-      const cwd = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
       const agents = typeof flags.agents === "string" ? flags.agents : void 0;
       if (flags.github === true) {
         return runInitGithubCommand({ cwd, dryRun: flags["dry-run"] === true, force: flags.force === true });
@@ -31114,7 +31179,7 @@ async function main() {
         return 1;
       }
       return runDoctorAgentsCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "validate-npm-package":
       return runValidateNpmPackageCommand({
@@ -31127,7 +31192,7 @@ async function main() {
         return 1;
       }
       return runAuditCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "clean": {
@@ -31135,7 +31200,7 @@ async function main() {
         console.error("Usage: viberaven clean --plan [path]");
         return 1;
       }
-      const cwd = positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd();
       const plan = buildContextCleanupPlan({ projectRoot: cwd, files: await collectCleanupFiles(cwd) });
       const outputPath = await writeCleanupPlan(cwd, plan);
       console.log(`Wrote ${outputPath}
@@ -31145,9 +31210,9 @@ async function main() {
     }
     case "rls-test":
       return runRlsTestCommand({
-        cwd: positional[0] ? (0, import_node_path56.resolve)(process.cwd(), positional[0]) : process.cwd(),
-        matrix: typeof flags.matrix === "string" ? (0, import_node_path56.resolve)(process.cwd(), flags.matrix) : void 0,
-        migrations: typeof flags.migrations === "string" ? (0, import_node_path56.resolve)(process.cwd(), flags.migrations) : void 0,
+        cwd: positional[0] ? (0, import_node_path57.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        matrix: typeof flags.matrix === "string" ? (0, import_node_path57.resolve)(process.cwd(), flags.matrix) : void 0,
+        migrations: typeof flags.migrations === "string" ? (0, import_node_path57.resolve)(process.cwd(), flags.migrations) : void 0,
         json: Boolean(flags.json)
       });
     default:
@@ -31156,11 +31221,11 @@ async function main() {
       return 1;
   }
 }
-var import_promises46, import_node_path56, STACK_AREAS;
+var import_promises47, import_node_path57, STACK_AREAS;
 var init_cli = __esm({
   "src/cli.ts"() {
-    import_promises46 = require("node:fs/promises");
-    import_node_path56 = require("node:path");
+    import_promises47 = require("node:fs/promises");
+    import_node_path57 = require("node:path");
     init_config();
     init_runScan();
     init_artifacts2();