@wrongstack/core 0.305.1 → 0.306.2

package/dist/plugin/index.js

@@ -180,11 +180,15 @@ var init_errors = __esm({
 });
 
 // src/security/file-permissions.ts
-var SECRET_FILE_MODE;
+import {
+  restrictDirPermissions,
+  restrictFilePermissions,
+  SECRET_DIR_MODE,
+  SECRET_FILE_MODE
+} from "@wrongstack/persistence";
 var init_file_permissions = __esm({
   "src/security/file-permissions.ts"() {
     "use strict";
-    SECRET_FILE_MODE = 384;
   }
 });
 
@@ -671,7 +675,9 @@ var init_review_report_store = __esm({
               unparseableCount: input.unparseableCount,
               durationSeconds: input.durationSeconds ?? existing.durationSeconds,
               rawText: input.rawText || existing.rawText,
-              files: input.files.length > 0 ? input.files : existing.files
+              files: input.files.length > 0 ? input.files : existing.files,
+              ...input.evidenceStatus !== void 0 ? { evidenceStatus: input.evidenceStatus } : {},
+              ...input.evidenceChecks !== void 0 ? { evidenceChecks: input.evidenceChecks } : {}
             };
             await fsp4.appendFile(this.filePath, JSON.stringify({ __report: 1, data: updated }) + NL2, {
               encoding: "utf8",
@@ -694,7 +700,9 @@ var init_review_report_store = __esm({
             unparseableCount: input.unparseableCount,
             durationSeconds: input.durationSeconds,
             rawText: input.rawText,
-            ...input.cascadeDepth !== void 0 ? { cascadeDepth: input.cascadeDepth } : {}
+            ...input.cascadeDepth !== void 0 ? { cascadeDepth: input.cascadeDepth } : {},
+            ...input.evidenceStatus !== void 0 ? { evidenceStatus: input.evidenceStatus } : {},
+            ...input.evidenceChecks !== void 0 ? { evidenceChecks: input.evidenceChecks } : {}
           };
           const createdEvent = {
             id: randomUUID6(),
@@ -738,6 +746,24 @@ var init_review_report_store = __esm({
           return { ...entry.report };
         });
       }
+      async updateEvidence(reportId, status, checks) {
+        return withFileLock(this.filePath, async () => {
+          const all = await this._readAll();
+          const entry = all.find((candidate) => candidate.report.id === reportId);
+          if (!entry) throw new Error(`Review report not found: ${reportId}`);
+          const updated = {
+            ...this._materialize(entry),
+            evidenceStatus: status,
+            evidenceChecks: checks
+          };
+          await fsp4.appendFile(
+            this.filePath,
+            `${JSON.stringify({ __report: 1, data: updated })}${NL2}`,
+            { encoding: "utf8", mode: SECRET_FILE_MODE }
+          );
+          return updated;
+        });
+      }
       async addNote(reportId, actor, note) {
         return withFileLock(this.filePath, async () => {
           const all = await this._readAll();
@@ -1141,10 +1167,10 @@ function validateAgainstSchema(value, schema) {
   return { ok: errors.length === 0, errors };
 }
 var MAX_SCHEMA_DEPTH = 64;
-function walk(value, schema, path32, errors, depth) {
+function walk(value, schema, path33, errors, depth) {
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path32 || "<root>",
+      path: path33 || "<root>",
       message: `schema nesting exceeds maximum depth (${MAX_SCHEMA_DEPTH})`
     });
     return;
@@ -1152,7 +1178,7 @@ function walk(value, schema, path32, errors, depth) {
   if (schema.enum !== void 0) {
     if (!enumIncludes(schema.enum, value)) {
       errors.push({
-        path: path32 || "<root>",
+        path: path33 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -1161,7 +1187,7 @@ function walk(value, schema, path32, errors, depth) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path32 || "<root>",
+        path: path33 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)} (${previewValue(value)})`
       });
       return;
@@ -1173,7 +1199,7 @@ function walk(value, schema, path32, errors, depth) {
       if (!(req in obj)) {
         const expected = schema.properties?.[req]?.type;
         errors.push({
-          path: joinPath(path32, req),
+          path: joinPath(path33, req),
           message: `required property missing${typeof expected === "string" ? ` (expected ${expected})` : ""}`
         });
       }
@@ -1181,14 +1207,14 @@ function walk(value, schema, path32, errors, depth) {
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path32, key), errors, depth + 1);
+          walk(obj[key], subSchema, joinPath(path33, key), errors, depth + 1);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path32}[${i}]`, errors, depth + 1);
+      walk(value[i], schema.items, `${path33}[${i}]`, errors, depth + 1);
     }
   }
 }
@@ -1902,7 +1928,10 @@ var DefaultPluginAPI = class {
       }
     };
     this.tools = {
-      register: (t) => tr.register(t, owner),
+      register: (t) => {
+        tr.register(t, owner);
+        tr.exposeToProvider(t.name);
+      },
       unregister: (name) => {
         assertCanMutateTool(name, "unregister");
         return tr.unregister(name);
@@ -7956,6 +7985,15 @@ function resolveAutoReviewConfig(cfg, sessionConfig) {
     maxCascadeDepth: cfg.maxCascadeDepth ?? DEFAULT_MAX_CASCADE_DEPTH
   };
 }
+function severitiesFromFindings(findings) {
+  const severities = { critical: 0, high: 0, medium: 0 };
+  for (const finding of findings) {
+    if (finding.severity === "critical") severities.critical++;
+    else if (finding.severity === "high") severities.high++;
+    else if (finding.severity === "medium") severities.medium++;
+  }
+  return severities;
+}
 function parseReviewSeverity(text) {
   const result = { critical: 0, high: 0, medium: 0 };
   if (!text) return result;
@@ -7972,9 +8010,20 @@ function parseReviewSeverity(text) {
   }
   return result;
 }
-function decideCascadeAgents(text, severities) {
+function decideCascadeAgents(text, severities, findings) {
   const agents = /* @__PURE__ */ new Set();
   if (severities.critical > 0 || severities.high > 0) agents.add("bug-hunter");
+  if (findings && findings.length > 0) {
+    const highPlus = findings.filter(
+      (finding) => finding.severity === "critical" || finding.severity === "high"
+    );
+    if (highPlus.some((finding) => finding.category === "security")) {
+      agents.add("security-scanner");
+    }
+    if (highPlus.every((finding) => finding.category !== void 0)) {
+      return [...agents];
+    }
+  }
   const securityKeywords = [
     "injection",
     "xss",
@@ -8347,7 +8396,9 @@ function createAutoReviewPlugin() {
               maxFiles: cfg.maxFilesPerBatch,
               autoFix: "off",
               cascadeOn: "off",
-              maxCascadeDepth: 0
+              maxCascadeDepth: 0,
+              fallbackModels: [...cfg.fallbackModels],
+              fallbackProfile: void 0
             },
             files: filesWithContent,
             activeTodos: ctxTodos,
@@ -8452,7 +8503,9 @@ function createAutoReviewPlugin() {
                 maxFiles: cfg.maxFilesPerBatch,
                 autoFix: "off",
                 cascadeOn: "off",
-                maxCascadeDepth: 0
+                maxCascadeDepth: 0,
+                fallbackModels: [...cfg.fallbackModels],
+                fallbackProfile: void 0
               },
               files: filesWithContent,
               cascadeOn: cfg.cascadeOn,
@@ -8494,23 +8547,31 @@ function createAutoReviewPlugin() {
           if (!p.reviewText) return;
           const cascadeOn = p.bundle.cascadeOn ?? "off";
           if (cascadeOn === "off") return;
-          const severities = parseReviewSeverity(p.reviewText);
+          const parsed = p.parsedReport;
+          const verifiedFindings = parsed?.findings.filter((f) => f.verification?.status === "verified") ?? [];
+          const severities = parsed ? severitiesFromFindings(verifiedFindings) : parseReviewSeverity(p.reviewText);
           const threshold = shouldCascade(cascadeOn, severities);
           if (!threshold) return;
-          const agents = decideCascadeAgents(p.reviewText, severities);
+          const agents = decideCascadeAgents(
+            p.reviewText,
+            severities,
+            parsed ? verifiedFindings : void 0
+          );
           if (agents.length === 0) {
             return;
           }
           const cascadePayload = {
             bundle: p.bundle,
+            ...p.reportId ? { reportId: p.reportId } : {},
             reviewText: p.reviewText,
             severities,
             threshold,
-            agents
+            agents,
+            ...parsed ? { verifiedFindings } : {}
           };
           api.emitCustom("chimera.cascade_needed", cascadePayload);
           api.log.info(
-            `[auto-review] cascade_needed emitted \u2014 ${severities.critical} critical, ${severities.high} high, ${severities.medium} medium; agents: ${agents.join(", ")}`
+            `[auto-review] cascade_needed emitted \u2014 ${severities.critical} critical, ${severities.high} high, ${severities.medium} medium; agents: ${agents.join(", ")}${parsed ? ` (gated on ${verifiedFindings.length} verified finding(s))` : ""}`
           );
         } catch (err) {
           api.log.warn(
@@ -8542,12 +8603,88 @@ init_review_finding_store();
 // src/plugins/review-finding-parser.ts
 init_review_finding_types();
 import { randomUUID as randomUUID5 } from "node:crypto";
+var SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
+var CATEGORIES = /* @__PURE__ */ new Set([
+  "bug",
+  "security",
+  "performance",
+  "type",
+  "contract",
+  "test",
+  "other"
+]);
+var CONFIDENCES = /* @__PURE__ */ new Set(["high", "medium", "low"]);
+var FENCED_BLOCK = /```json[ \t]*\r?\n([\s\S]*?)\r?\n```/gi;
+function extractStructuredFindingsBlock(reportText) {
+  if (!reportText) return null;
+  let best = null;
+  for (const match of reportText.matchAll(FENCED_BLOCK)) {
+    const body = match[1];
+    if (!body?.trim()) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      continue;
+    }
+    if (typeof parsed !== "object" || parsed === null) continue;
+    const findings = parsed.findings;
+    if (!Array.isArray(findings)) continue;
+    const items = [];
+    for (const raw of findings) {
+      const item = normalizeStructuredItem(raw);
+      if (item) items.push(item);
+    }
+    if (findings.length > 0 && items.length === 0) continue;
+    const durationRaw = parsed.durationSeconds;
+    const durationSeconds = typeof durationRaw === "number" && Number.isFinite(durationRaw) && durationRaw > 0 ? Math.floor(durationRaw) : void 0;
+    best = { findings: items, ...durationSeconds !== void 0 ? { durationSeconds } : {} };
+  }
+  return best;
+}
+function normalizeStructuredItem(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const item = raw;
+  const severity = typeof item.severity === "string" ? item.severity.toLowerCase() : "";
+  if (!SEVERITIES.has(severity)) return null;
+  const title = typeof item.title === "string" ? item.title.trim() : "";
+  if (title.length === 0) return null;
+  const file = typeof item.file === "string" && item.file.trim().length > 0 ? item.file.trim() : void 0;
+  const line = typeof item.line === "number" && Number.isInteger(item.line) && item.line >= 1 ? item.line : void 0;
+  const categoryRaw = typeof item.category === "string" ? item.category.toLowerCase() : "";
+  const category = CATEGORIES.has(categoryRaw) ? categoryRaw : void 0;
+  const confidenceRaw = typeof item.confidence === "string" ? item.confidence.toLowerCase() : "";
+  const confidence = CONFIDENCES.has(confidenceRaw) ? confidenceRaw : void 0;
+  return {
+    severity,
+    ...file ? { file } : {},
+    ...line !== void 0 ? { line } : {},
+    ...category ? { category } : {},
+    ...confidence ? { confidence } : {},
+    title,
+    ...typeof item.description === "string" && item.description.trim().length > 0 ? { description: item.description.trim() } : {},
+    ...typeof item.suggestedFix === "string" && item.suggestedFix.trim().length > 0 ? { suggestedFix: item.suggestedFix.trim() } : {}
+  };
+}
 var SUGGEST_LINE = /^\s*(?:→|->|=>)\s*(.+)$/;
 var DURATION_LINE = /^Duration:\s*(\d+)s\s*$/im;
 function parseChimeraReviewReport(reportText, context = {}) {
   if (!reportText || reportText.trim().length === 0) {
     return { findings: [], unparseableCount: 0 };
   }
+  const structured = extractStructuredFindingsBlock(reportText);
+  if (structured) {
+    const reportId2 = context.reportId ?? randomUUID5();
+    const findings2 = structured.findings.map(
+      (item) => buildFindingFromStructuredItem(item, { ...context, reportId: reportId2 })
+    );
+    return {
+      findings: findings2,
+      unparseableCount: 0,
+      ...structured.durationSeconds !== void 0 ? { durationSeconds: structured.durationSeconds } : {},
+      structured: true
+    };
+  }
   const findings = [];
   const reportId = context.reportId ?? randomUUID5();
   let unparseableCount = 0;
@@ -8679,14 +8816,99 @@ function normalizeFindingSource(reviewType) {
       return "chimera";
   }
 }
+function buildFindingFromStructuredItem(item, context) {
+  const file = item.file;
+  const line = item.line;
+  const title = item.title;
+  const description = item.description ?? title;
+  return {
+    id: randomUUID5(),
+    fingerprint: computeFindingFingerprint(file ?? "", line ?? null, title),
+    severity: item.severity,
+    source: normalizeFindingSource(context.reviewType),
+    ...file ? { location: { file, ...line !== void 0 ? { line } : {} } } : {},
+    ...item.category ? { category: item.category } : {},
+    ...item.confidence ? { confidence: item.confidence } : {},
+    title,
+    description,
+    ...item.suggestedFix ? { suggestedFix: item.suggestedFix } : {},
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "active",
+    originReport: {
+      reportId: context.reportId ?? randomUUID5(),
+      sessionId: context.sessionId ?? "",
+      agentId: context.agentId ?? "",
+      reviewerModel: context.reviewerModel ?? ""
+    }
+  };
+}
 
 // src/plugins/review-report-integration.ts
 init_review_finding_store();
+
+// src/plugins/review-finding-integration.ts
+init_review_finding_store();
+function classifyChimeraReviewSource(bundle) {
+  const cascadeDepth = bundle.cascadeDepth ?? 0;
+  if (cascadeDepth > 0) return "cascade";
+  const cascadeOn = bundle.cascadeOn;
+  if (cascadeOn !== void 0 && cascadeOn !== "off") return "auto";
+  return "chimera";
+}
+async function integrateFindings(payload, projectDir, reportId) {
+  if ((!payload.reviewText || payload.reviewText.trim().length === 0) && !payload.parsedReport) {
+    return { created: 0, relinked: 0, reopened: 0, totalFindings: 0, unparseableCount: 0 };
+  }
+  const store = new JsonlFindingStore(projectDir);
+  const source = classifyChimeraReviewSource(payload.bundle);
+  const agentId = payload.bundle.fileProvenance?.find((entry) => entry.agentId)?.agentId ?? "chimera-review";
+  const sessionId = payload.sessionId ?? payload.cwd;
+  const model = payload.bundle.config.model;
+  const parsed = payload.parsedReport ?? parseChimeraReviewReport(payload.reviewText, {
+    sessionId,
+    agentId,
+    reviewerModel: model,
+    reviewType: source,
+    reportId
+  });
+  if (parsed.findings.length === 0) {
+    return {
+      created: 0,
+      relinked: 0,
+      reopened: 0,
+      totalFindings: 0,
+      unparseableCount: parsed.unparseableCount
+    };
+  }
+  const result = await store.upsert(parsed.findings, {
+    sessionId,
+    reportId,
+    agentId,
+    model
+  });
+  return {
+    created: result.created,
+    relinked: result.relinked,
+    reopened: result.reopened,
+    reportId,
+    totalFindings: parsed.findings.length,
+    unparseableCount: parsed.unparseableCount
+  };
+}
+
+// src/plugins/review-report-integration.ts
 init_review_report_store();
+async function updateReviewReportEvidence(reportId, projectDir, evidenceStatus, evidenceChecks) {
+  await new JsonlReportStore(projectDir).updateEvidence(
+    reportId,
+    evidenceStatus,
+    evidenceChecks
+  );
+}
 async function persistReviewReport(payload, reportId, projectDir) {
   const store = new JsonlReportStore(projectDir);
   const existed = await store.get(reportId);
-  const source = classifySource(payload);
+  const source = classifyChimeraReviewSource(payload.bundle);
   const agentId = payload.bundle.fileProvenance?.find((entry) => entry.agentId)?.agentId ?? "chimera-review";
   const sessionId = payload.sessionId ?? payload.cwd;
   const model = payload.bundle.config.model;
@@ -8696,7 +8918,13 @@ async function persistReviewReport(payload, reportId, projectDir) {
     status: f.status
   }));
   const reviewStatus = payload.status === "success" ? "success" : "failed";
-  const parsed = reviewStatus === "success" ? parseChimeraReviewReport(payload.reviewText, { reportId }) : { findings: [], unparseableCount: 0, durationSeconds: void 0 };
+  const parsed = reviewStatus === "success" ? payload.parsedReport ?? parseChimeraReviewReport(payload.reviewText, {
+    sessionId,
+    agentId,
+    reviewerModel: model,
+    reviewType: source,
+    reportId
+  }) : { findings: [], unparseableCount: 0, durationSeconds: void 0 };
   const counts = { critical: 0, high: 0, medium: 0, low: 0 };
   for (const finding of parsed.findings) {
     counts[finding.severity]++;
@@ -8714,7 +8942,12 @@ async function persistReviewReport(payload, reportId, projectDir) {
     unparseableCount: parsed.unparseableCount,
     durationSeconds: parsed.durationSeconds,
     rawText: payload.reviewText,
-    ...cascadeDepth !== void 0 ? { cascadeDepth } : {}
+    ...cascadeDepth !== void 0 ? { cascadeDepth } : {},
+    // P0-3: carry the cascade evidence verification (status + per-check
+    // comparisons) so the persisted report is auditable. Absent on initial
+    // reviews — no cascade step produced evidence yet.
+    ...payload.bundle.evidenceStatus !== void 0 ? { evidenceStatus: payload.bundle.evidenceStatus } : {},
+    ...payload.bundle.evidenceChecks !== void 0 ? { evidenceChecks: payload.bundle.evidenceChecks } : {}
   };
   await store.persist(input);
   if (reviewStatus === "success" && parsed.findings.length === 0 && parsed.unparseableCount === 0 && isExplicitAllClearReview(payload.reviewText)) {
@@ -8777,13 +9010,6 @@ async function syncReportReopen(reportId, projectDir, actor, reason) {
   });
   return { reportId, reopened: true, previousLifecycle: report.lifecycle };
 }
-function classifySource(payload) {
-  const cascadeDepth = payload.bundle.cascadeDepth ?? 0;
-  if (cascadeDepth > 0) return "cascade";
-  const cascadeOn = payload.bundle.cascadeOn;
-  if (cascadeOn !== void 0 && cascadeOn !== "off") return "auto";
-  return "chimera";
-}
 
 // src/plugins/review-finding-commands.ts
 async function executeFindingCommand(args, ctx) {
@@ -9113,6 +9339,18 @@ async function showReport(id, ctx) {
     `**Review status:** ${report.reviewStatus}`,
     ...report.cascadeDepth !== void 0 ? [`**Cascade depth:** ${report.cascadeDepth}`] : [],
     ...report.durationSeconds !== void 0 ? [`**Duration:** ${report.durationSeconds}s`] : [],
+    ...report.evidenceStatus !== void 0 ? [
+      `**Evidence:** ${report.evidenceStatus === "verified" ? "\u2705 verified" : report.evidenceStatus === "failed" ? "\u274C failed" : "\u26A0\uFE0F missing"}`,
+      ...report.evidenceChecks && report.evidenceChecks.length > 0 ? [
+        "",
+        ...report.evidenceChecks.map((check) => {
+          const mark = check.ok ? "\u2713" : "\u2717";
+          const claimed = check.claimedExitCode ?? "\u2014";
+          const actual = check.actualExitCode ?? "\u2014";
+          return `  ${mark} \`${check.name}\` \u2014 \`${check.command}\` (claimed ${claimed}, observed ${actual})`;
+        })
+      ] : []
+    ] : [],
     "",
     "**Severity counts:**",
     `  \u{1F534} Critical: ${report.counts.critical}`,
@@ -9221,7 +9459,9 @@ function resolveChimeraConfig(cfg, sessionProvider, sessionModel) {
     maxFiles: cfg.maxFiles ?? DEFAULT_MAX_FILES,
     autoFix: cfg.autoFix ?? "off",
     cascadeOn: cfg.cascadeOn ?? DEFAULT_CASCADE_ON,
-    maxCascadeDepth: cfg.maxCascadeDepth ?? DEFAULT_MAX_CASCADE_DEPTH2
+    maxCascadeDepth: cfg.maxCascadeDepth ?? DEFAULT_MAX_CASCADE_DEPTH2,
+    fallbackModels: cfg.fallbackModels ? [...cfg.fallbackModels] : [],
+    fallbackProfile: cfg.fallbackProfile
   };
 }
 var CHIMERA_REVIEW_PROMPT = readBundledInstructionText("llm/chimera-review.md");
@@ -10468,55 +10708,262 @@ function dim(s) {
   return `\x1B[2m${s}\x1B[0m`;
 }
 
-// src/plugins/review-finding-integration.ts
-init_review_finding_store();
-async function integrateFindings(payload, projectDir, reportId) {
-  if (!payload.reviewText || payload.reviewText.trim().length === 0) {
-    return { created: 0, relinked: 0, reopened: 0, totalFindings: 0, unparseableCount: 0 };
-  }
-  const store = new JsonlFindingStore(projectDir);
-  const source = (payload.bundle.cascadeDepth ?? 0) > 0 ? "cascade" : payload.bundle.cascadeOn !== void 0 && payload.bundle.cascadeOn !== "off" ? "auto" : "chimera";
-  const agentId = payload.bundle.fileProvenance?.find((entry) => entry.agentId)?.agentId ?? "chimera-review";
-  const sessionId = payload.sessionId ?? payload.cwd;
-  const model = payload.bundle.config.model;
-  const parsed = parseChimeraReviewReport(payload.reviewText, {
-    sessionId,
-    agentId,
-    reviewerModel: model,
-    reviewType: source,
-    reportId
-  });
-  if (parsed.findings.length === 0) {
-    return {
-      created: 0,
-      relinked: 0,
-      reopened: 0,
-      totalFindings: 0,
-      unparseableCount: parsed.unparseableCount
-    };
-  }
-  const result = await store.upsert(parsed.findings, {
-    sessionId,
-    reportId,
-    agentId,
-    model
-  });
-  return {
-    created: result.created,
-    relinked: result.relinked,
-    reopened: result.reopened,
-    reportId,
-    totalFindings: parsed.findings.length,
-    unparseableCount: parsed.unparseableCount
+// src/plugins/review-finding-verification.ts
+import * as fsp6 from "node:fs/promises";
+import * as path22 from "node:path";
+var DEFAULT_ANCHOR_WINDOW = 2;
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "a",
+  "about",
+  "above",
+  "after",
+  "again",
+  "against",
+  "all",
+  "an",
+  "and",
+  "any",
+  "are",
+  "as",
+  "at",
+  "be",
+  "been",
+  "before",
+  "below",
+  "between",
+  "both",
+  "but",
+  "by",
+  "can",
+  "could",
+  "did",
+  "do",
+  "does",
+  "each",
+  "few",
+  "for",
+  "from",
+  "further",
+  "get",
+  "had",
+  "has",
+  "have",
+  "he",
+  "her",
+  "here",
+  "him",
+  "his",
+  "how",
+  "if",
+  "in",
+  "into",
+  "is",
+  "it",
+  "its",
+  "just",
+  "may",
+  "me",
+  "might",
+  "more",
+  "most",
+  "much",
+  "must",
+  "my",
+  "new",
+  "no",
+  "nor",
+  "not",
+  "now",
+  "of",
+  "off",
+  "on",
+  "once",
+  "only",
+  "or",
+  "other",
+  "our",
+  "out",
+  "own",
+  "same",
+  "she",
+  "should",
+  "so",
+  "some",
+  "such",
+  "than",
+  "that",
+  "the",
+  "their",
+  "them",
+  "then",
+  "there",
+  "these",
+  "they",
+  "this",
+  "those",
+  "through",
+  "to",
+  "too",
+  "under",
+  "until",
+  "up",
+  "us",
+  "very",
+  "was",
+  "we",
+  "were",
+  "what",
+  "when",
+  "where",
+  "which",
+  "while",
+  "who",
+  "whom",
+  "why",
+  "will",
+  "with",
+  "would",
+  "you",
+  "your",
+  // Finding-prose generics: common English nouns that are terrible anchors
+  // because they match prose everywhere. Kept deliberately small.
+  "area",
+  "bug",
+  "check",
+  "code",
+  "data",
+  "endpoint",
+  "error",
+  "file",
+  "fix",
+  "issue",
+  "line",
+  "make",
+  "may",
+  "potential",
+  "request",
+  "response",
+  "result",
+  "use",
+  "used",
+  "user",
+  "using",
+  "value"
+]);
+function extractFindingAnchor(title, description) {
+  const text = `${title ?? ""} ${description ?? ""}`;
+  const tokens = text.match(/[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+  if (tokens.length === 0) return void 0;
+  const meaningful = tokens.filter(
+    (t) => t.length >= 3 && !STOPWORDS.has(t.toLowerCase())
+  );
+  if (meaningful.length === 0) return void 0;
+  const codeLike = meaningful.filter((t) => /[a-z][A-Z]/.test(t) || t.includes("_") || t.endsWith("$"));
+  if (codeLike.length > 0) {
+    codeLike.sort((a, b) => b.length - a.length);
+    return codeLike[0];
+  }
+  meaningful.sort((a, b) => b.length - a.length);
+  return meaningful[0];
+}
+function resolveFindingPath(raw, cwd) {
+  const pathMod = process.platform === "win32" ? path22.win32 : path22;
+  const forward = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+  const isAbsolute3 = pathMod.isAbsolute(forward) || /^[a-zA-Z]:\//.test(forward);
+  const relative5 = isAbsolute3 ? pathMod.relative(cwd, forward).replace(/\\/g, "/") : forward;
+  if (relative5 === ".." || relative5.startsWith("../") || pathMod.isAbsolute(relative5)) return null;
+  const resolved = pathMod.resolve(cwd, relative5);
+  const rel = pathMod.relative(cwd, resolved);
+  if (rel === ".." || rel.startsWith("..") || pathMod.isAbsolute(rel)) return null;
+  return resolved;
+}
+async function verifyFindingsAgainstDisk(findings, opts) {
+  const window = opts.anchorWindow ?? DEFAULT_ANCHOR_WINDOW;
+  const cache = /* @__PURE__ */ new Map();
+  const readFile20 = async (abs) => {
+    const cached = cache.get(abs);
+    if (cached) return cached;
+    let result;
+    try {
+      const content = await fsp6.readFile(abs, "utf8");
+      result = { lines: content.split("\n") };
+    } catch (err) {
+      result = { error: err.code === "ENOENT" ? "missing" : "unreadable" };
+    }
+    cache.set(abs, result);
+    return result;
   };
+  return Promise.all(
+    findings.map(async (finding) => {
+      if (!finding.location?.file) return finding;
+      const abs = resolveFindingPath(finding.location.file, opts.cwd);
+      if (abs === null) {
+        return { ...finding, verification: { status: "failed", reason: "outside_workspace" } };
+      }
+      const file = await readFile20(abs);
+      if ("error" in file) {
+        return {
+          ...finding,
+          verification: {
+            status: "failed",
+            reason: file.error === "missing" ? "file_missing" : "unreadable"
+          }
+        };
+      }
+      const anchor = extractFindingAnchor(finding.title, finding.description);
+      if (finding.location.line === void 0) {
+        if (anchor && /[a-z][A-Z]/.test(anchor)) {
+          const hit = file.lines.findIndex((l) => l.includes(anchor));
+          if (hit !== -1) {
+            return {
+              ...finding,
+              verification: {
+                status: "verified",
+                reason: "anchor_found",
+                evidence: trimEvidence(file.lines[hit] ?? "")
+              }
+            };
+          }
+        }
+        return { ...finding, verification: { status: "unverified", reason: "no_line" } };
+      }
+      const line = finding.location.line;
+      if (line < 1 || line > file.lines.length) {
+        return { ...finding, verification: { status: "failed", reason: "line_out_of_range" } };
+      }
+      if (!anchor) {
+        return { ...finding, verification: { status: "unverified", reason: "no_anchor" } };
+      }
+      const from = Math.max(0, line - 1 - window);
+      const to = Math.min(file.lines.length, line - 1 + window + 1);
+      for (let i = from; i < to; i++) {
+        const sourceLine = file.lines[i];
+        if (sourceLine.includes(anchor)) {
+          return {
+            ...finding,
+            verification: {
+              status: "verified",
+              reason: "anchor_found",
+              evidence: trimEvidence(sourceLine)
+            }
+          };
+        }
+      }
+      return { ...finding, verification: { status: "unverified", reason: "anchor_not_found" } };
+    })
+  );
+}
+function trimEvidence(line) {
+  const trimmed = line.trim();
+  return trimmed.length > 200 ? `${trimmed.slice(0, 197)}...` : trimmed;
 }
 
 // src/plugins/review-store-maintenance.ts
 init_atomic_write();
 init_review_finding_store();
 init_review_report_store();
-import * as fsp6 from "node:fs/promises";
-import * as path22 from "node:path";
+import * as fsp7 from "node:fs/promises";
+import * as path23 from "node:path";
 var REVIEW_STORE_COMPACTION_THRESHOLD_BYTES = 8 * 1024 * 1024;
 var REVIEW_STORE_COMPACTION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var REVIEW_STORE_MAINTENANCE_FILE = ".review-store-maintenance.json";
@@ -10524,7 +10971,7 @@ async function maybeCompactReviewStores(projectDir, opts = {}) {
   const thresholdBytes = opts.thresholdBytes ?? REVIEW_STORE_COMPACTION_THRESHOLD_BYTES;
   const intervalMs = opts.intervalMs ?? REVIEW_STORE_COMPACTION_INTERVAL_MS;
   const now = opts.now ?? Date.now();
-  const maintenancePath = path22.join(projectDir, REVIEW_STORE_MAINTENANCE_FILE);
+  const maintenancePath = path23.join(projectDir, REVIEW_STORE_MAINTENANCE_FILE);
   return withFileLock(maintenancePath, async () => {
     const totalBytes = await fileSize(resolveReportStorePath(projectDir)) + await fileSize(resolveFindingStorePath(projectDir));
     if (totalBytes < thresholdBytes) {
@@ -10564,7 +11011,7 @@ function emptyResult(reason, totalBytes) {
 }
 async function fileSize(filePath) {
   try {
-    return (await fsp6.stat(filePath)).size;
+    return (await fsp7.stat(filePath)).size;
   } catch (error) {
     if (error.code === "ENOENT") return 0;
     throw error;
@@ -10572,7 +11019,7 @@ async function fileSize(filePath) {
 }
 async function readMaintenanceState(filePath) {
   try {
-    const parsed = JSON.parse(await fsp6.readFile(filePath, "utf8"));
+    const parsed = JSON.parse(await fsp7.readFile(filePath, "utf8"));
     return typeof parsed.compactedAt === "string" && Number.isFinite(parsed.totalBytesBefore) ? parsed : null;
   } catch (error) {
     if (error.code === "ENOENT" || error instanceof SyntaxError) {
@@ -10584,7 +11031,7 @@ async function readMaintenanceState(filePath) {
 
 // src/plugins/skills-plugin.ts
 import * as os7 from "node:os";
-import * as path27 from "node:path";
+import * as path28 from "node:path";
 
 // src/skills/foreign-sources.ts
 var FOREIGN_SKILL_TOOLS = [
@@ -10767,7 +11214,7 @@ function numField(rec, key) {
 init_errors();
 import { spawn as spawn5 } from "node:child_process";
 import * as fs14 from "node:fs/promises";
-import * as path23 from "node:path";
+import * as path24 from "node:path";
 async function validateSkillNameAvailable(name, loader) {
   const formatViolations = validateSkillName(name);
   const conflicts = loader ? (await loader.listEntries()).filter((e) => e.name === name) : [];
@@ -10845,7 +11292,7 @@ function extractSkillFromPrompt(prompt) {
   const description = paragraphs[0]?.replace(/^#{1,6}\s+/m, "").trim() ?? titleSource;
   const body = paragraphs.slice(1).join("\n\n");
   const quoted = [...text.matchAll(/"([^"]{2,40})"/g)].map((m) => m[1]).filter((q) => typeof q === "string").map((q) => q.toLowerCase());
-  const titleWords = titleSource.split(/\W+/).map((w) => w.toLowerCase()).filter((w) => w.length > 3 && !STOPWORDS.has(w));
+  const titleWords = titleSource.split(/\W+/).map((w) => w.toLowerCase()).filter((w) => w.length > 3 && !STOPWORDS2.has(w));
   const triggerKeywords = dedupe([...quoted, ...titleWords]).slice(0, 8);
   return { suggestedName, description, body, triggerKeywords };
 }
@@ -10891,8 +11338,8 @@ async function writeSkeletonSkill(skillsDir, body, opts = {}) {
       subsystem: "general"
     });
   }
-  const skillDir = path23.join(skillsDir, name);
-  const skillFile = path23.join(skillDir, "SKILL.md");
+  const skillDir = path24.join(skillsDir, name);
+  const skillFile = path24.join(skillDir, "SKILL.md");
   if (!opts.overwrite) {
     try {
       await fs14.access(skillFile);
@@ -10914,7 +11361,7 @@ function bodyLineAdvisory(body) {
   const lines = body.split("\n").length;
   return { lines, over: lines > SKILL_LIMITS.SKILL_BODY_LINE_LIMIT };
 }
-var STOPWORDS = /* @__PURE__ */ new Set([
+var STOPWORDS2 = /* @__PURE__ */ new Set([
   "the",
   "and",
   "for",
@@ -10951,14 +11398,14 @@ function defaultEditor() {
 init_errors();
 init_error();
 import * as fs17 from "node:fs/promises";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 
 // src/skills/github-fetcher.ts
 init_errors();
 import { createWriteStream } from "node:fs";
 import * as fs15 from "node:fs/promises";
 import * as os6 from "node:os";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
@@ -11100,7 +11547,7 @@ async function downloadGitHubTarball(parsed) {
       }
     });
   }
-  const tempDir = await fs15.mkdtemp(path24.join(os6.tmpdir(), "wskill-"));
+  const tempDir = await fs15.mkdtemp(path25.join(os6.tmpdir(), "wskill-"));
   try {
     if (!response.body) {
       throw new WrongStackError({
@@ -11111,7 +11558,7 @@ async function downloadGitHubTarball(parsed) {
       });
     }
     const nodeStream = Readable.fromWeb(response.body);
-    const tarPath = path24.join(tempDir, ".wrongstack-download.tar");
+    const tarPath = path25.join(tempDir, ".wrongstack-download.tar");
     await writeBoundedGzipStream(nodeStream, tarPath, SKILL_LIMITS.MAX_UNCOMPRESSED_TARBALL_SIZE);
     const tarBuf = await fs15.readFile(tarPath);
     try {
@@ -11176,10 +11623,10 @@ async function extractTar(buf, destDir) {
     const fullPath = prefix ? `${prefix}/${name}` : name;
     const relPath = stripTopDir(fullPath);
     if (relPath && relPath !== "." && relPath !== "..") {
-      const destPath = path24.join(destDir, relPath);
-      const resolvedDest = path24.resolve(destPath);
-      const resolvedRoot = path24.resolve(destDir);
-      if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + path24.sep)) {
+      const destPath = path25.join(destDir, relPath);
+      const resolvedDest = path25.resolve(destPath);
+      const resolvedRoot = path25.resolve(destDir);
+      if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + path25.sep)) {
         offset += 512 + Math.ceil(size / 512) * 512;
         continue;
       }
@@ -11189,7 +11636,7 @@ async function extractTar(buf, destDir) {
         }
       }
       if ((typeflag === 48 || typeflag === 0 || typeflag === 0) && size > 0) {
-        const dir = path24.dirname(destPath);
+        const dir = path25.dirname(destPath);
         await fs15.mkdir(dir, { recursive: true });
         const dataStart = offset + 512;
         const dataEnd = dataStart + size;
@@ -11204,7 +11651,7 @@ async function extractTar(buf, destDir) {
 // src/skills/manifest-store.ts
 init_atomic_write();
 import * as fs16 from "node:fs/promises";
-import * as path25 from "node:path";
+import * as path26 from "node:path";
 var SkillManifestStore = class {
   manifestPath;
   cache;
@@ -11227,7 +11674,7 @@ var SkillManifestStore = class {
     return this.cache;
   }
   async write(data) {
-    const dir = path25.dirname(this.manifestPath);
+    const dir = path26.dirname(this.manifestPath);
     await fs16.mkdir(dir, { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(data, null, 2) + "\n");
     this.cache = data;
@@ -11266,8 +11713,8 @@ var SkillManifestStore = class {
 
 // src/skills/skill-installer.ts
 function isInside(resolved, destDir) {
-  const root = path26.resolve(destDir);
-  return resolved === root || resolved.startsWith(root + path26.sep);
+  const root = path27.resolve(destDir);
+  return resolved === root || resolved.startsWith(root + path27.sep);
 }
 var MAX_SKILL_FILE_SIZE = SKILL_LIMITS.MAX_SKILL_FILE_SIZE;
 var SkillInstaller = class {
@@ -11322,13 +11769,13 @@ var SkillInstaller = class {
           this.opts.log?.(`Overwriting existing skill "${skill.name}" (${scope})...`);
           await this.removeSkillFiles(skill.name, scope);
         }
-        const destDir = path26.join(targetDir, skill.name);
+        const destDir = path27.join(targetDir, skill.name);
         await fs17.mkdir(destDir, { recursive: true });
         const copiedFiles = [];
         for (const file of skill.files) {
-          const srcPath = path26.join(skill.baseDir, file);
-          const destPath = path26.join(destDir, file);
-          const resolved2 = path26.resolve(destPath);
+          const srcPath = path27.join(skill.baseDir, file);
+          const destPath = path27.join(destDir, file);
+          const resolved2 = path27.resolve(destPath);
           if (!isInside(resolved2, destDir)) {
             throw new FsError({
               message: `Path traversal detected in skill file: ${file}`,
@@ -11346,7 +11793,7 @@ var SkillInstaller = class {
               context: { skillName: skill.name, fileSize: stat8.size, maxSize: MAX_SKILL_FILE_SIZE }
             });
           }
-          await fs17.mkdir(path26.dirname(destPath), { recursive: true });
+          await fs17.mkdir(path27.dirname(destPath), { recursive: true });
           await fs17.copyFile(srcPath, destPath);
           copiedFiles.push(file);
         }
@@ -11404,7 +11851,7 @@ var SkillInstaller = class {
     const results = [];
     for (const e of entries) {
       if (!await entryIsDirectory(srcDir, e)) continue;
-      const skillMdPath = path26.join(srcDir, e.name, "SKILL.md");
+      const skillMdPath = path27.join(srcDir, e.name, "SKILL.md");
       let content;
       try {
         content = await fs17.readFile(skillMdPath, "utf8");
@@ -11417,15 +11864,15 @@ var SkillInstaller = class {
       if (existing.find((x) => x.scope === scope)) {
         await this.removeSkillFiles(fm.name, scope);
       }
-      const destDir = path26.join(targetDir, fm.name);
+      const destDir = path27.join(targetDir, fm.name);
       await fs17.mkdir(destDir, { recursive: true });
-      const srcSkillDir = path26.join(srcDir, e.name);
+      const srcSkillDir = path27.join(srcDir, e.name);
       const files = await collectFiles(srcSkillDir, srcSkillDir);
       const copiedFiles = [];
       for (const file of files) {
-        const srcPath = path26.join(srcSkillDir, file);
-        const destPath = path26.join(destDir, file);
-        const resolved = path26.resolve(destPath);
+        const srcPath = path27.join(srcSkillDir, file);
+        const destPath = path27.join(destDir, file);
+        const resolved = path27.resolve(destPath);
         if (!isInside(resolved, destDir)) {
           throw new FsError({
             message: `Path traversal detected in skill file: ${file}`,
@@ -11434,7 +11881,7 @@ var SkillInstaller = class {
             context: { reason: "path_traversal", skillName: fm.name }
           });
         }
-        await fs17.mkdir(path26.dirname(destPath), { recursive: true });
+        await fs17.mkdir(path27.dirname(destPath), { recursive: true });
         if (opts?.link) {
           try {
             await fs17.symlink(srcPath, destPath);
@@ -11597,7 +12044,7 @@ var SkillInstaller = class {
    */
   async detectSkills(baseDir) {
     const results = [];
-    const rootSkillMd = path26.join(baseDir, "SKILL.md");
+    const rootSkillMd = path27.join(baseDir, "SKILL.md");
     try {
       await fs17.access(rootSkillMd);
       const content = await fs17.readFile(rootSkillMd, "utf8");
@@ -11612,17 +12059,17 @@ var SkillInstaller = class {
       }
     } catch {
     }
-    const skillsDir = path26.join(baseDir, "skills");
+    const skillsDir = path27.join(baseDir, "skills");
     try {
       const entries = await fs17.readdir(skillsDir, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const skillFile = path26.join(skillsDir, entry.name, "SKILL.md");
+        const skillFile = path27.join(skillsDir, entry.name, "SKILL.md");
         try {
           const content = await fs17.readFile(skillFile, "utf8");
           const fm = parseSkillFrontmatter(content);
           if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
-            const skillDir = path26.join(skillsDir, entry.name);
+            const skillDir = path27.join(skillsDir, entry.name);
             const files = await collectFiles(skillDir, skillDir);
             results.push({
               name: fm.name,
@@ -11655,8 +12102,8 @@ var SkillInstaller = class {
    */
   async removeSkillFiles(name, scope) {
     const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
-    const root = path26.resolve(targetDir);
-    const skillDir = path26.resolve(path26.join(targetDir, name));
+    const root = path27.resolve(targetDir);
+    const skillDir = path27.resolve(path27.join(targetDir, name));
     if (skillDir === root || !isInside(skillDir, root)) {
       throw new FsError({
         message: `Refusing to delete skill files outside the skills directory: ${name}`,
@@ -11700,7 +12147,7 @@ async function entryIsDirectory(dir, entry) {
   if (entry.isDirectory()) return true;
   if (entry.isSymbolicLink()) {
     try {
-      return (await fs17.stat(path26.join(dir, entry.name))).isDirectory();
+      return (await fs17.stat(path27.join(dir, entry.name))).isDirectory();
     } catch {
       return false;
     }
@@ -11711,8 +12158,8 @@ async function collectFiles(dir, baseDir) {
   const results = [];
   const entries = await fs17.readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path26.join(dir, entry.name);
-    const relPath = path26.relative(baseDir, fullPath);
+    const fullPath = path27.join(dir, entry.name);
+    const relPath = path27.relative(baseDir, fullPath);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
       results.push(...await collectFiles(fullPath, baseDir));
@@ -11791,7 +12238,7 @@ function createSkillsPlugin(opts) {
 function makeInstaller(skillLoader, projectRoot, registryAdapters) {
   const paths = resolveWstackPaths({ projectRoot });
   return new SkillInstaller({
-    manifestPath: path27.join(paths.configDir, "installed-skills.json"),
+    manifestPath: path28.join(paths.configDir, "installed-skills.json"),
     projectSkillsDir: paths.inProjectSkills,
     globalSkillsDir: paths.globalSkills,
     projectHash: paths.projectHash,
@@ -12170,7 +12617,7 @@ function resolveImportSourceDir(tool, opts) {
   const entry = IMPORT_SOURCE_TOOLS.find((t) => t.id === tool);
   if (!entry) return void 0;
   const base = opts.global ? opts.homeDir ?? os7.homedir() : opts.projectRoot;
-  return path27.join(base, "." + entry.id, entry.subdir);
+  return path28.join(base, "." + entry.id, entry.subdir);
 }
 function buildSkillImportCommand(skillLoader) {
   return {
@@ -12211,7 +12658,7 @@ function buildSkillImportCommand(skillLoader) {
           };
         }
       } else if (positional) {
-        srcDir = path27.resolve(ctx.projectRoot, positional);
+        srcDir = path28.resolve(ctx.projectRoot, positional);
       } else {
         return {
           message: "Usage: /skill-import <src-dir> | --from <tool> | --from-claude [--global] [--link]"
@@ -12338,14 +12785,14 @@ function truncate(s, max) {
 }
 
 // src/plugins/sync-plugin.ts
-import * as path29 from "node:path";
+import * as path30 from "node:path";
 init_error();
 
 // src/storage/cloud-sync.ts
 init_atomic_write();
 init_errors();
 import * as fs18 from "node:fs/promises";
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 import { createHash as createHash9 } from "node:crypto";
 var ALL_SYNC_CATEGORIES = ["settings", "skills", "prompts", "memory", "history"];
 var CloudSync = class {
@@ -12353,8 +12800,8 @@ var CloudSync = class {
     this.paths = paths;
     this.getConfig = getConfig;
     this.setConfig = setConfig;
-    this.statePath = path28.join(paths.configDir, "sync-state.json");
-    this.getSettingsConfigPath = getSettingsConfigPath ?? (() => path28.join(this.paths.configDir, "config.json"));
+    this.statePath = path29.join(paths.configDir, "sync-state.json");
+    this.getSettingsConfigPath = getSettingsConfigPath ?? (() => path29.join(this.paths.configDir, "config.json"));
   }
   paths;
   getConfig;
@@ -12640,7 +13087,7 @@ var CloudSync = class {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fs18.readFile(file, "utf8");
-            const rel = path28.relative(localPath, file).replace(/\\/g, "/");
+            const rel = path29.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(`${cat}/${rel}\0${content}`);
           }
@@ -12667,7 +13114,7 @@ var CloudSync = class {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
             const content = await fs18.readFile(file, "utf8");
-            const rel = path28.relative(localPath, file).replace(/\\/g, "/");
+            const rel = path29.relative(localPath, file).replace(/\\/g, "/");
             hashes.push(`${cat}/${rel}\0${content}`);
           }
         } else {
@@ -12701,7 +13148,7 @@ var CloudSync = class {
     const entries = await fs18.readdir(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const full = path28.join(dir, entry.name);
+      const full = path29.join(dir, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         results.push(...await this.walkDir(full, base));
@@ -12714,17 +13161,17 @@ var CloudSync = class {
 };
 async function preparePulledDestination(cat, localPath, destPath, remotePath) {
   const directoryBacked = cat === "skills" || cat === "prompts";
-  const rootPath = directoryBacked ? localPath : path28.dirname(localPath);
+  const rootPath = directoryBacked ? localPath : path29.dirname(localPath);
   const rootStat = await lstatIfExists(rootPath);
   if (rootStat?.isSymbolicLink()) {
     throw unsafePulledSymlinkError(remotePath, rootPath);
   }
   if (directoryBacked) {
-    const relativeParent = path28.relative(rootPath, path28.dirname(destPath));
+    const relativeParent = path29.relative(rootPath, path29.dirname(destPath));
     let cursor = rootPath;
     if (relativeParent) {
-      for (const segment of relativeParent.split(path28.sep)) {
-        cursor = path28.join(cursor, segment);
+      for (const segment of relativeParent.split(path29.sep)) {
+        cursor = path29.join(cursor, segment);
         const stat8 = await lstatIfExists(cursor);
         if (stat8?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, cursor);
       }
@@ -12732,7 +13179,7 @@ async function preparePulledDestination(cat, localPath, destPath, remotePath) {
   }
   const destStat = await lstatIfExists(destPath);
   if (destStat?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, destPath);
-  await fs18.mkdir(path28.dirname(destPath), { recursive: true });
+  await fs18.mkdir(path29.dirname(destPath), { recursive: true });
 }
 async function lstatIfExists(filePath) {
   try {
@@ -12762,9 +13209,9 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
     return localPath;
   }
   if (!rel) return localPath;
-  const normalizedRel = path28.normalize(rel);
-  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path28.sep}`);
-  if (path28.isAbsolute(normalizedRel) || traversesUp) {
+  const normalizedRel = path29.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path29.sep}`);
+  if (path29.isAbsolute(normalizedRel) || traversesUp) {
     throw new FsError({
       message: `Refusing CloudSync path traversal: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -12772,10 +13219,10 @@ function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
       context: { reason: "path_traversal", normalizedRel }
     });
   }
-  const dest = path28.resolve(localPath, normalizedRel);
-  const root = path28.resolve(localPath);
-  const relative5 = path28.relative(root, dest);
-  if (relative5.startsWith("..") || path28.isAbsolute(relative5)) {
+  const dest = path29.resolve(localPath, normalizedRel);
+  const root = path29.resolve(localPath);
+  const relative5 = path29.relative(root, dest);
+  if (relative5.startsWith("..") || path29.isAbsolute(relative5)) {
     throw new FsError({
       message: `Refusing CloudSync path outside category root: ${remotePath}`,
       code: ERROR_CODES.FS_DELETE_FAILED,
@@ -12818,7 +13265,7 @@ function createSyncPlugin(opts) {
         api.log.warn("[sync] paths, configStore, or configDir not available \u2014 /sync disabled");
         return;
       }
-      const syncConfigPath = paths.syncConfig ?? path29.join(paths.configDir, "sync.json");
+      const syncConfigPath = paths.syncConfig ?? path30.join(paths.configDir, "sync.json");
       cloud = new CloudSync(
         paths,
         () => {
@@ -12829,7 +13276,7 @@ function createSyncPlugin(opts) {
           await persistSyncConfig(syncConfigPath, cfg, vault);
           configStore?.update({ sync: cfg });
         },
-        () => path29.join(paths.configDir, "config.json")
+        () => path30.join(paths.configDir, "config.json")
       );
       void cloud.loadState();
       api.slashCommands.register(buildSyncCommand(cloud, configStore, vault, syncConfigPath));
@@ -13021,7 +13468,7 @@ Warning: sync completed, but metadata persistence failed: ${toErrorMessage(err)}
 }
 
 // src/plugins/cloud-config-sync-plugin.ts
-import * as path31 from "node:path";
+import * as path32 from "node:path";
 
 // src/security/config-secrets.ts
 function decryptConfigSecrets(cfg, vault, opts) {
@@ -13070,7 +13517,7 @@ function isSecretField(name) {
 init_atomic_write();
 import { createHash as createHash10, randomUUID as nodeRandomUUID } from "node:crypto";
 import * as fs19 from "node:fs/promises";
-import * as path30 from "node:path";
+import * as path31 from "node:path";
 
 // src/storage/cloud-config-sync/sanitize.ts
 var SAGE_TREE = {
@@ -13645,7 +14092,7 @@ var CloudConfigSync = class {
   }
   async saveState(state) {
     this.state = state;
-    await fs19.mkdir(path30.dirname(this.deps.statePath), { recursive: true });
+    await fs19.mkdir(path31.dirname(this.deps.statePath), { recursive: true });
     await atomicWrite(this.deps.statePath, `${JSON.stringify(state, null, 2)}
 `, {
       mode: 384
@@ -13692,8 +14139,8 @@ function createCloudConfigSyncPlugin(opts) {
         );
         return;
       }
-      const profileConfigPath = path31.join(paths.configDir, "config.json");
-      const statePath = path31.join(paths.configDir, "cloud-sync-state.json");
+      const profileConfigPath = path32.join(paths.configDir, "config.json");
+      const statePath = path32.join(paths.configDir, "cloud-sync-state.json");
       const warn = (msg) => api.log.warn(msg);
       const readLocalConfig = async () => {
         const raw = await readJsonObjectFile(profileConfigPath).catch(() => ({}));
@@ -13870,6 +14317,7 @@ export {
   DefaultPluginAPI,
   KERNEL_API_VERSION,
   buildReviewerModelPool,
+  classifyChimeraReviewSource,
   createAutoReviewPlugin,
   createChimeraPlugin,
   createCloudConfigSyncPlugin,
@@ -13894,6 +14342,8 @@ export {
   resolvePluginManifestConfig,
   selectRoundRobinReviewerAssignment,
   unloadPlugins,
-  validatePluginConfigMetadata
+  updateReviewReportEvidence,
+  validatePluginConfigMetadata,
+  verifyFindingsAgainstDisk
 };
 //# sourceMappingURL=index.js.map