codebase-snapshot 0.9.12 → 0.9.14

package/dist/mcp.cjs

@@ -7,7 +7,7 @@ var crypto2 = require('crypto');
 var module$1 = require('module');
 var url = require('url');
 var childProcess = require('child_process');
-require('async_hooks');
+var async_hooks = require('async_hooks');
 require('os');
 var worker_threads = require('worker_threads');
 
@@ -660,13 +660,23 @@ function summarizeTypeScriptSource(relativePath, content) {
     if (ts__default.default.isImportDeclaration(node) && ts__default.default.isStringLiteral(node.moduleSpecifier)) {
       summary.imports.push(node.moduleSpecifier.text);
     }
+    if (ts__default.default.isImportEqualsDeclaration(node) && ts__default.default.isExternalModuleReference(node.moduleReference) && node.moduleReference.expression !== void 0 && ts__default.default.isStringLiteral(node.moduleReference.expression)) {
+      summary.imports.push(node.moduleReference.expression.text);
+    }
+    if (ts__default.default.isCallExpression(node) && node.arguments.length >= 1) {
+      const firstArgument = node.arguments[0];
+      if (firstArgument !== void 0 && ts__default.default.isStringLiteral(firstArgument)) {
+        const isDynamicImport = node.expression.kind === ts__default.default.SyntaxKind.ImportKeyword;
+        const isRequire = ts__default.default.isIdentifier(node.expression) && node.expression.text === "require";
+        if (isDynamicImport || isRequire) summary.imports.push(firstArgument.text);
+      }
+    }
     if (ts__default.default.isExportDeclaration(node)) {
       if (node.moduleSpecifier && ts__default.default.isStringLiteral(node.moduleSpecifier)) {
         summary.imports.push(node.moduleSpecifier.text);
+        summary.reExports.push(node.moduleSpecifier.text);
         if (node.exportClause && ts__default.default.isNamespaceExport(node.exportClause)) {
           summary.exports.push(node.exportClause.name.text);
-        } else if (!node.exportClause) {
-          summary.reExports.push(node.moduleSpecifier.text);
         }
       }
       if (node.exportClause && ts__default.default.isNamedExports(node.exportClause)) {
@@ -811,7 +821,7 @@ function isCapitalizedName(name) {
 }
 
 // src/ast/profiles/cfamily.ts
-var INCLUDE = /^#\s*include\s*[<"]([^>"]+)[>"]/;
+var INCLUDE = /^#\s*include\s*([<"])([^>"]+)[>"]/;
 var DEFINE = /^#\s*define\s+([A-Za-z_]\w*)/;
 var USING = /^using\s+(?:namespace\s+)?([\w:]+)\s*;/;
 var TYPE_DECL = /^(?:typedef\s+)?(?:struct|union|class|enum)\s+([A-Za-z_]\w*)/;
@@ -830,7 +840,7 @@ var cfamilyProfile = {
       }
       const included = INCLUDE.exec(trimmed);
       if (included) {
-        summary.imports.push(included[1]);
+        summary.imports.push(included[1] === '"' ? `./${included[2]}` : included[2]);
         return;
       }
       const used = USING.exec(trimmed);
@@ -1234,7 +1244,15 @@ var pythonProfile = {
       }
       const from = FROM_IMPORT.exec(trimmed);
       if (from) {
-        summary.imports.push(from[1]);
+        const module = from[1];
+        if (/^\.+$/.test(module)) {
+          for (const name of from[2].split(",")) {
+            const imported2 = name.replace(/[()]/g, "").trim().split(/\s+as\s+/)[0].trim();
+            if (/^[A-Za-z_]\w*$/.test(imported2)) summary.imports.push(`${module}${imported2}`);
+          }
+        } else {
+          summary.imports.push(module);
+        }
         routePending = false;
         return;
       }
@@ -1283,7 +1301,8 @@ var pythonProfile = {
 };
 
 // src/ast/profiles/ruby.ts
-var REQUIRE = /^require(?:_relative)?\s+["']([^"']+)["']/;
+var REQUIRE_RELATIVE = /^require_relative\s+["']([^"']+)["']/;
+var REQUIRE = /^require\s+["']([^"']+)["']/;
 var CLASS_OR_MODULE = /^(?:class|module)\s+([A-Z][\w:]*)/;
 var METHOD3 = /^def\s+(?:self\.)?([A-Za-z_]\w*[?!=]?)/;
 var rubyProfile = {
@@ -1294,6 +1313,11 @@ var rubyProfile = {
     eachLine(content, (line) => {
       const trimmed = line.trim();
       if (!trimmed || trimmed.startsWith("#")) return;
+      const relative8 = REQUIRE_RELATIVE.exec(trimmed);
+      if (relative8) {
+        summary.imports.push(`./${relative8[1]}`);
+        return;
+      }
       const required = REQUIRE.exec(trimmed);
       if (required) {
         summary.imports.push(required[1]);
@@ -1384,7 +1408,8 @@ var rustProfile = {
 };
 
 // src/ast/profiles/sfc.ts
-var SCRIPT_BLOCK = /<script[^>]*>([\s\S]*?)<\/script>/gi;
+var SCRIPT_BLOCK = /<script([^>]*)>([\s\S]*?)<\/script>/gi;
+var JSX_LANG = /\blang\s*=\s*["']?[tj]sx\b/i;
 var ASTRO_FRONTMATTER = /^\uFEFF?---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?=\r?\n|$)/;
 function componentName(path14) {
   const base = path14.split("/").pop() ?? path14;
@@ -1395,13 +1420,15 @@ var sfcProfile = {
   extensions: [".vue", ".svelte", ".astro"],
   summarize(path14, content) {
     let script = "";
+    let usesJsx = path14.toLowerCase().endsWith(".astro");
     if (path14.toLowerCase().endsWith(".astro")) {
       const frontmatter = ASTRO_FRONTMATTER.exec(content);
       if (frontmatter) script += `${frontmatter[1]}
 `;
     }
     for (const match of content.matchAll(SCRIPT_BLOCK)) {
-      script += `${match[1]}
+      if (JSX_LANG.test(match[1] ?? "")) usesJsx = true;
+      script += `${match[2]}
 `;
     }
     const name = componentName(path14);
@@ -1413,7 +1440,7 @@ var sfcProfile = {
       }
       return { summary: finalizeSummary(summary2), quality: "heuristic" };
     }
-    const summary = summarizeTypeScriptSource(`${name}.ts`, script);
+    const summary = summarizeTypeScriptSource(`${name}.${usesJsx ? "tsx" : "ts"}`, script);
     summary.reactComponents.push(name);
     summary.exports.push(name);
     return { summary: finalizeSummary(summary), quality: "ast" };
@@ -1847,18 +1874,22 @@ function isBinaryFile(absolutePath) {
 }
 
 // src/ast/imports.ts
+var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
 var TS_SOURCE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 var isTsSource = (relativePath) => {
   const lower = relativePath.toLowerCase();
   return TS_SOURCE_EXTENSIONS.some((extension) => lower.endsWith(extension));
 };
 function importsOfText(relativePath, text) {
+  if (Buffer.byteLength(text, "utf8") > SUMMARY_MAX_SOURCE_BYTES) return [];
   if (isTsSource(relativePath)) return summarizeTypeScriptSource(relativePath, text).imports;
   return summarizeWithProfile(relativePath, text)?.summary.imports ?? [];
 }
 function importsOfFile(relativePath, absolutePath) {
   let buffer;
   try {
+    const stats = fs8__namespace.statSync(absolutePath);
+    if (!stats.isFile() || stats.size > SUMMARY_MAX_SOURCE_BYTES) return [];
     buffer = fs8__namespace.readFileSync(absolutePath);
   } catch {
     return [];
@@ -3103,9 +3134,18 @@ var DEFAULT_SECRET_PATTERNS = [
     // The unquoted twin for YAML, docker-compose and `.env`: those formats never
     // quote their values, so the rules above cannot see them. `valueGroup` keeps
     // `POSTGRES_PASSWORD:` in the output.
+    //
+    // This is the one unquoted rule without `NOT_AFTER_QUOTE`, and the lookbehind is a
+    // string-literal guard rather than a precision rule: a credential assignment *inside* a
+    // literal — `const dsn = "password=hunter2;host=db"`, `curl -d "password=hunter2"` — was
+    // rejected before it could be considered, and a DSN is a credential in a string. What made the
+    // lookbehind redundant is the shape of `UNQUOTED_LITERAL`: a value has to start with a word
+    // character, so `["awsSecret:", "apiKey:"]` — the list of key names the lookbehind was added
+    // for — cannot match here anyway. `redact.ts` still refuses a match whose separator is inside
+    // the literal, which is the case that list actually is.
     rule: "credential-assignment-unquoted",
     pattern: new RegExp(
-      `${NOT_AFTER_QUOTE}${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
+      `${UNQUOTED_STRONG_NAME}\\s{0,8}${ASSIGN}\\s{0,8}${NOT_A_LITERAL_VALUE}${UNQUOTED_LITERAL}`,
       "i"
     ),
     valueGroup: 1
@@ -3140,6 +3180,27 @@ var DEFAULT_SECRET_PATTERNS = [
     pattern: /(?<!["'])(?:api[_-]?key|secret[_-]?key|auth[_-]?token|client[_-]?secret|access[_-]?token|refresh[_-]?token|private[_-]?key|password|passwd|pwd)["']?\s*(?<![=!<>])[:=](?!=)\s*["']([^"'\s]{8,256})["']/i,
     valueGroup: 1
   },
+  {
+    // `${VAR:-fallback}` — a default value in a shell script, a `.env`, docker-compose or a
+    // GitHub Actions workflow.
+    //
+    // This shape defeated every rule above it, and each refusal was individually reasonable:
+    // the quoted rules need a quote after the separator, and the unquoted ones need the value to
+    // begin with a word character — a fallback begins with `$`. So
+    // `POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-MyProdPassword123!}` was emitted whole, `.env` files
+    // and compose files included, which is where that idiom is the norm.
+    //
+    // The **fallback** is what gets masked, not the whole expansion: the variable name is the
+    // readable context, exactly as `POSTGRES_PASSWORD:` is kept by the rule above. A single
+    // interpolation with no operator (`${DB_PASSWORD}`) still does not match — there is nothing
+    // between the braces to mask, and `isTemplateInterpolation` keeps such a value readable.
+    rule: "interpolation-fallback-secret",
+    pattern: new RegExp(
+      `(?:["']${STRONG_CREDENTIAL_NAME}["']|${NOT_AFTER_QUOTE}${STRONG_CREDENTIAL_NAME})\\s{0,8}${ASSIGN}\\s{0,8}["'\`]?\\$\\{[A-Za-z_][A-Za-z0-9_]*:?[-=?+]([^}"'\`\\r\\n]{2,512})\\}["'\`]?`,
+      "i"
+    ),
+    valueGroup: 1
+  },
   {
     // Covers `.env` / shell assignment syntax, which never quotes its values and
     // was therefore invisible to the rule above. Anchored to the line start and
@@ -3167,8 +3228,8 @@ var DEFAULT_SECRET_PATTERNS = [
     valueGroup: 1
   }
 ];
-var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
-var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r?\n[A-Za-z0-9+/=]{4,}[ A-Za-z0-9+/=]*)+/g;
+var PEM_BLOCK_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN)[\s\S])*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/g;
+var PEM_UNTERMINATED_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:\r\n|\n|\r)(?:(?:[ \t]*(?:Proc-Type|DEK-Info|Comment|Version):[^\r\n]*|[ \t]*)(?:\r\n|\n|\r))*(?:[ \t]*[A-Za-z0-9+/=]{8,}[ \t]*(?:\r\n|\n|\r|$))+/g;
 
 // src/security/redact.ts
 var REDACTION_MARKER = "[REDACTED: potential secret-like value omitted from snapshot]";
@@ -3262,6 +3323,20 @@ function toGlobal(rule) {
   return new RegExp(rule.pattern.source, [...flags].join(""));
 }
 var LINE_BREAK = /(\r\n|\n|\r)/;
+var LINE_TERMINATOR = /\r\n|\n|\r/g;
+var COMPILED_RULES = /* @__PURE__ */ new WeakMap();
+function compiledRuleFor(rule) {
+  let compiled = COMPILED_RULES.get(rule);
+  if (compiled === void 0) {
+    compiled = {
+      rule: rule.rule,
+      pattern: toGlobal(rule),
+      ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
+    };
+    COMPILED_RULES.set(rule, compiled);
+  }
+  return compiled;
+}
 function scanAndRedactSecrets(content, rules, filePath) {
   const findings = [];
   let redacted = content;
@@ -3273,18 +3348,15 @@ function scanAndRedactSecrets(content, rules, filePath) {
         blockPattern.lastIndex += 1;
         continue;
       }
-      const line = redacted.slice(0, match.index).split("\n").length;
-      const newlines = (match[0].match(/\n/g) ?? []).length;
+      const before = redacted.slice(0, match.index);
+      const line = (before.match(LINE_TERMINATOR) ?? []).length + 1;
+      const newlines = (match[0].match(LINE_TERMINATOR) ?? []).length;
       findings.push({ rules: ["private-key-block"], line, path: filePath });
-      redacted = redacted.slice(0, match.index) + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
+      redacted = before + PEM_REDACTION_MARKER + "\n".repeat(newlines) + redacted.slice(match.index + match[0].length);
       blockPattern.lastIndex = match.index + PEM_REDACTION_MARKER.length + newlines;
     }
   }
-  const compiled = rules.map((rule) => ({
-    rule: rule.rule,
-    pattern: toGlobal(rule),
-    ...rule.valueGroup === void 0 ? {} : { valueGroup: rule.valueGroup }
-  }));
+  const compiled = rules.map(compiledRuleFor);
   const segments = redacted.split(LINE_BREAK);
   let lineNumber = 1;
   for (let index = 0; index < segments.length; index += 2) {
@@ -3302,8 +3374,10 @@ function scanAndRedactSecrets(content, rules, filePath) {
           }
           const group = valueGroup === void 0 ? void 0 : match.indices?.[valueGroup];
           if (group && isSelfNamingConstant(line, group[0], group[1])) continue;
-          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index)) continue;
-          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index)) {
+          if (valueGroup !== void 0 && startsInsideStringLiteral(line, match.index, group?.[0])) {
+            continue;
+          }
+          if (group && isUnquotedValue(line, group[0]) && isDeclaredBinding(line, match.index, filePath)) {
             continue;
           }
           if (group && isTemplateInterpolation(line, group[0], group[1])) continue;
@@ -3336,14 +3410,20 @@ function expandOverToken(line, start, end) {
   while (right < line.length && TOKEN_CHARS_RIGHT.test(line[right])) right += 1;
   return { start: left, end: right };
 }
-function startsInsideStringLiteral(line, matchIndex) {
+function startsInsideStringLiteral(line, matchIndex, valueStart) {
   let runStart = matchIndex;
   while (runStart > 0 && /[A-Za-z0-9_-]/.test(line[runStart - 1])) runStart -= 1;
   const before = runStart > 0 ? line[runStart - 1] : "";
-  return before === '"' || before === "'" || before === "`";
+  if (before !== '"' && before !== "'" && before !== "`") return false;
+  if (valueStart === void 0) return true;
+  return /["'`]/.test(line.slice(matchIndex, valueStart));
 }
 function isTemplateInterpolation(line, start, end) {
-  return line[start] === "$" && line[start + 1] === "{" && line[end - 1] === "}";
+  if (line[start] !== "$" || line[start + 1] !== "{" || line[end - 1] !== "}") {
+    return false;
+  }
+  const inner = line.slice(start + 2, end - 1).trim();
+  return /^[A-Za-z_$][A-Za-z0-9_$.()[\]]*$/.test(inner);
 }
 function isSelfNamingConstant(line, start, end) {
   const value = line.slice(start, end);
@@ -3368,9 +3448,19 @@ function isUnquotedValue(line, start) {
   const before = start > 0 ? line[start - 1] : "";
   return before !== '"' && before !== "'" && before !== "`";
 }
-var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|declare|export|using)\s+$/;
+var DECLARATION_KEYWORDS = /\b(?:const|let|var|readonly|public|private|protected|static|using)\s+$/;
+var ASSIGNMENT_FILE = /\.(?:sh|bash|zsh|ksh|fish|env|ya?ml|toml|ini|conf|cfg|properties|tf|tfvars|service)$/i;
+var ASSIGNMENT_BASENAME = /^(?:\.env(?:\.[^/]*)?|\.envrc|\.profile|\.bashrc|\.zshrc|\.bash_profile)$/i;
+function isAssignmentFile(filePath) {
+  if (filePath === void 0) return false;
+  const normalised = filePath.replace(/\\/g, "/");
+  if (ASSIGNMENT_FILE.test(normalised)) return true;
+  const base = normalised.slice(normalised.lastIndexOf("/") + 1);
+  return ASSIGNMENT_BASENAME.test(base);
+}
 var DECLARATION_WINDOW = 40;
-function isDeclaredBinding(line, matchIndex) {
+function isDeclaredBinding(line, matchIndex, filePath) {
+  if (isAssignmentFile(filePath)) return false;
   let runStart = matchIndex;
   while (runStart > 0 && /[A-Za-z0-9_$]/.test(line[runStart - 1])) runStart -= 1;
   const from = Math.max(0, runStart - DECLARATION_WINDOW);
@@ -3412,6 +3502,15 @@ function readLinkTarget(linkPath, fallback) {
     return fallback;
   }
 }
+function brokenLinkRecord(linkPath, relativePath, rootReal) {
+  const rawTarget = readLinkTarget(linkPath, linkPath);
+  const resolvedFallback = path10__namespace.resolve(path10__namespace.dirname(linkPath), rawTarget);
+  return isInside(rootReal, resolvedFallback) ? { path: relativePath, reason: "read-error", detail: "broken symlink" } : {
+    path: relativePath,
+    reason: "outside-root",
+    detail: `link target resolves outside the scanned root (target: ${rawTarget}); not followed`
+  };
+}
 function isInside(root, candidate) {
   const relative8 = path10__namespace.relative(root, candidate);
   return relative8 === "" || !relative8.startsWith(`..${path10__namespace.sep}`) && relative8 !== ".." && !path10__namespace.isAbsolute(relative8);
@@ -3501,6 +3600,13 @@ function isSensitivePath(relativePath) {
   return matchesSensitiveList(posixPath, base);
 }
 var GLOBAL_PATTERNS = /* @__PURE__ */ new WeakMap();
+var GLOB_REGEX_CACHE = /* @__PURE__ */ new Map();
+var GITIGNORE_REGEX_CACHE = /* @__PURE__ */ new Map();
+var REGEX_CACHE_LIMIT = 4096;
+function rememberCompiled(cache, key, value) {
+  if (cache.size >= REGEX_CACHE_LIMIT) cache.clear();
+  cache.set(key, value);
+}
 function globalPattern(pattern) {
   let compiled = GLOBAL_PATTERNS.get(pattern);
   if (compiled === void 0) {
@@ -3511,8 +3617,8 @@ function globalPattern(pattern) {
 }
 var DEFAULT_PATH_RULES = [...DEFAULT_SECRET_PATTERNS];
 function pathScanRules(extraRules) {
-  if (extraRules === void 0 || extraRules.length === 0) return DEFAULT_PATH_RULES;
-  return [...DEFAULT_SECRET_PATTERNS, ...extraRules];
+  if (extraRules === void 0) return DEFAULT_PATH_RULES;
+  return extraRules;
 }
 function findSecretInPath(relativePath, extraRules) {
   const posixPath = relativePath.replace(/\\/g, "/");
@@ -3561,11 +3667,22 @@ function maskSkipPaths(records, extraRules) {
   });
 }
 function globToRegExp(glob) {
+  const cached = GLOB_REGEX_CACHE.get(glob);
+  if (cached !== void 0) return cached;
   const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
   const anchored = normalized.startsWith("/");
   const body = anchored ? normalized.slice(1) : normalized;
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
-  return new RegExp(`${prefix}${globBodyToRegExp(body, true)}(?:/.*)?$`);
+  let compiled;
+  try {
+    compiled = new RegExp(`${prefix}${globBodyToRegExp(body, true)}(?:/.*)?$`);
+  } catch (error) {
+    throw new Error(
+      `"${glob}" is not a valid glob: ${error.message}. A character class must be ascending, as in "[a-z]".`
+    );
+  }
+  rememberCompiled(GLOB_REGEX_CACHE, glob, compiled);
+  return compiled;
 }
 function globBodyToRegExp(body, allowBraces) {
   let out = "";
@@ -3677,6 +3794,14 @@ function escapeRegExpChar(character) {
   return /[\\^$.*+?()[\]{}|/]/.test(character) ? `\\${character}` : character;
 }
 function matchGitignorePattern(target, pattern) {
+  let compiled = GITIGNORE_REGEX_CACHE.get(pattern);
+  if (compiled === void 0) {
+    compiled = compileGitignorePattern(pattern);
+    rememberCompiled(GITIGNORE_REGEX_CACHE, pattern, compiled);
+  }
+  return compiled.test(target);
+}
+function compileGitignorePattern(pattern) {
   const anchored = pattern.startsWith("/");
   const body = anchored ? pattern.slice(1) : pattern;
   let source = "";
@@ -3725,7 +3850,11 @@ function matchGitignorePattern(target, pattern) {
     source += escapeRegExpChar(character);
   }
   const prefix = anchored || body.includes("/") ? "^" : "(?:^|.*/)";
-  return new RegExp(`${prefix}${source}(?:/.*)?$`).test(target);
+  try {
+    return new RegExp(`${prefix}${source}(?:/.*)?$`);
+  } catch {
+    return /$^/;
+  }
 }
 function matchesGitignoreRule(rule, scoped, isDirectory) {
   if (!rule.dirOnly) return matchGitignorePattern(scoped, rule.pattern);
@@ -3755,14 +3884,31 @@ function gitignoreVerdict(layers, relativePath, isDirectory) {
   }
   return verdict;
 }
-function defaultIgnoreReason(relativePath) {
+var DEFAULT_TOOL_DIR_NAMES = ["snapshot"];
+function toolDirNamesFor(toolOwnedPaths) {
+  const names = new Set(DEFAULT_TOOL_DIR_NAMES);
+  for (const entry of toolOwnedPaths) {
+    const base = entry.replace(/\\/g, "/").replace(/\/+$/, "").split("/").pop();
+    if (base !== void 0 && base.length > 0) names.add(base);
+  }
+  return [...names];
+}
+function isToolLeftoverName(name, dirNames) {
+  for (const dirName of dirNames) {
+    if (name.startsWith(`${dirName}.backup-`) || name.startsWith(`${dirName}.partial-`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function defaultIgnoreReason(relativePath, toolDirNames = DEFAULT_TOOL_DIR_NAMES) {
   const posixPath = relativePath.replace(/\\/g, "/");
   const parts = posixPath.split("/");
   for (let i = 0; i < parts.length - 1; i++) {
     if (DEFAULT_IGNORED_DIRS.includes(parts[i])) {
       return `built-in ignore: directory "${parts[i]}"`;
     }
-    if (parts[i].startsWith("snapshot.backup-")) {
+    if (isToolLeftoverName(parts[i], toolDirNames)) {
       return `built-in ignore: leftover snapshot backup "${parts[i]}"`;
     }
   }
@@ -3770,6 +3916,9 @@ function defaultIgnoreReason(relativePath) {
   if (DEFAULT_IGNORED_FILES.includes(base)) {
     return `built-in ignore: filename "${base}"`;
   }
+  if (isToolLeftoverName(base, toolDirNames)) {
+    return `built-in ignore: leftover snapshot backup "${base}"`;
+  }
   return null;
 }
 function listIgnoredPaths(cwd) {
@@ -3838,41 +3987,72 @@ function dropLinkedDirectories(cwd, candidates, skipped) {
   }
   const reported = /* @__PURE__ */ new Set();
   const kept = [];
+  const report = (linkedPath, record) => {
+    if (reported.has(linkedPath)) return;
+    reported.add(linkedPath);
+    skipped.push(record);
+  };
   for (const candidate of candidates) {
     const parts = candidate.split("/");
-    let linkedDir = null;
+    let linkedPath = null;
     for (let depth = 1; depth <= parts.length; depth += 1) {
       const prefix = parts.slice(0, depth).join("/");
       if (isLink(path10__namespace.join(cwd, prefix))) {
-        linkedDir = prefix;
+        linkedPath = prefix;
         break;
       }
     }
-    if (linkedDir === null) {
+    if (linkedPath === null) {
       kept.push(candidate);
       continue;
     }
-    if (reported.has(linkedDir)) continue;
-    reported.add(linkedDir);
-    const absolute = path10__namespace.join(cwd, linkedDir);
-    let targetReal = absolute;
+    const absolute = path10__namespace.join(cwd, linkedPath);
+    const rawTarget = readLinkTarget(absolute, absolute);
+    let targetReal = null;
     try {
       targetReal = fs8__namespace.realpathSync(absolute);
     } catch {
+      targetReal = null;
     }
-    const target = readLinkTarget(absolute, targetReal);
-    const what = linkedDir === candidate ? "symbolic link" : "directory link";
-    skipped.push(
-      isInside(rootReal, targetReal) ? {
-        path: linkedDir,
-        reason: "symlink",
-        detail: `${what} not followed (target: ${target})`
-      } : {
-        path: linkedDir,
+    if (targetReal === null) {
+      report(linkedPath, brokenLinkRecord(absolute, linkedPath, rootReal));
+      continue;
+    }
+    if (!isInside(rootReal, targetReal)) {
+      report(linkedPath, {
+        path: linkedPath,
         reason: "outside-root",
-        detail: `link target resolves outside the scanned root (target: ${target}); not followed`
-      }
-    );
+        detail: `link target resolves outside the scanned root (target: ${rawTarget}); not followed`
+      });
+      continue;
+    }
+    let stats = null;
+    try {
+      stats = fs8__namespace.statSync(absolute);
+    } catch {
+      stats = null;
+    }
+    if (stats === null) {
+      report(linkedPath, { path: linkedPath, reason: "read-error", detail: "unreadable symlink" });
+      continue;
+    }
+    if (linkedPath !== candidate || stats.isDirectory()) {
+      report(linkedPath, {
+        path: linkedPath,
+        reason: "symlink",
+        detail: `directory link not followed (target: ${rawTarget})`
+      });
+      continue;
+    }
+    if (!stats.isFile()) {
+      report(linkedPath, {
+        path: linkedPath,
+        reason: "symlink",
+        detail: `link to neither a file nor a directory (target: ${rawTarget})`
+      });
+      continue;
+    }
+    kept.push(candidate);
   }
   return kept;
 }
@@ -3919,6 +4099,7 @@ function collectFiles(cwd, options = {}) {
     (options.toolOwnedPaths ?? []).map((entry) => entry.replace(/\\/g, "/"))
   );
   const isToolOwned = makeToolOwnedDecider(cwd, [...toolOwnedPaths]);
+  const toolDirNames = toolDirNamesFor(toolOwnedPaths);
   let candidates;
   const skipped = [];
   const discovery = options.discovery ?? "auto";
@@ -3947,7 +4128,7 @@ function collectFiles(cwd, options = {}) {
   }
   const files = candidates.filter((file) => {
     if (isToolOwned(file)) return false;
-    const ignored = defaultIgnoreReason(file);
+    const ignored = defaultIgnoreReason(file, toolDirNames);
     if (ignored) {
       skipped.push({ path: file, reason: "default-ignore", detail: ignored });
       return false;
@@ -4002,6 +4183,7 @@ function rootRealFor(root) {
 function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PURE__ */ new Set(), parentGitignoreLayers = []) {
   const results = { files: [], skipped: [] };
   const stack = [];
+  const toolDirNames = toolDirNamesFor(reservedPaths);
   const relativeToBase = (target) => path10__namespace.relative(baseDir, target).replace(/\\/g, "/") || ".";
   const enter = (current, layers) => {
     if (visited.has(current)) return false;
@@ -4046,11 +4228,11 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       });
       continue;
     }
-    if (DEFAULT_IGNORED_FILES.includes(entry.name) || entry.name.startsWith("snapshot.backup-")) {
+    if (DEFAULT_IGNORED_FILES.includes(entry.name) || isToolLeftoverName(entry.name, toolDirNames)) {
       results.skipped.push({
         path: relPath,
         reason: "default-ignore",
-        detail: "built-in ignore: filename"
+        detail: isToolLeftoverName(entry.name, toolDirNames) ? `built-in ignore: leftover snapshot backup "${entry.name}" (not descended)` : "built-in ignore: filename"
       });
       continue;
     }
@@ -4071,7 +4253,7 @@ function walkDirectory(dir, baseDir, rootReal, visited, reservedPaths = /* @__PU
       try {
         targetReal = fs8__namespace.realpathSync(fullPath);
       } catch {
-        results.skipped.push({ path: relPath, reason: "read-error", detail: "broken symlink" });
+        results.skipped.push(brokenLinkRecord(fullPath, relPath, rootReal));
         continue;
       }
       let stats;
@@ -4196,15 +4378,19 @@ function normalizeBudgets(budgets, maxPartBytes) {
 }
 function normalizeResolvedConfig(config) {
   const discovery = isDiscoveryMode(config.discovery) ? config.discovery : "auto";
+  const monolithWanted = config.includeMonolith === true || config.artifacts?.monolith === true;
+  const artifacts = resolveArtifacts(
+    config.artifacts,
+    void 0,
+    monolithWanted,
+    monolithWanted
+  );
   return markResolvedConfig({
     ...config,
     discovery,
+    includeMonolith: artifacts.monolith,
     secretRules: compileSecretRules(config.secretRules),
-    artifacts: resolveArtifacts(
-      config.artifacts,
-      void 0,
-      config.includeMonolith === true
-    ),
+    artifacts,
     include: resolveInclude(config.include),
     preset: typeof config.preset === "string" ? config.preset : "generic",
     presetExclude: [
@@ -4413,6 +4599,16 @@ async function importConfigModule(fullPath) {
   url$1.searchParams.set("codebaseSnapshotLoad", String(moduleConfigLoadToken));
   return await import(url$1.href);
 }
+function attachConfigDir(config, filePath) {
+  if (typeof config === "object" && config !== null) {
+    Object.defineProperty(config, CONFIG_DIR_SYMBOL, {
+      value: path10__namespace.dirname(filePath),
+      enumerable: false,
+      configurable: true
+    });
+  }
+  return config;
+}
 async function loadConfigFileDetailed(cwd) {
   const warnings = [];
   const errors = [];
@@ -4428,7 +4624,7 @@ async function loadConfigFileDetailed(cwd) {
           );
         }
         assertKnownConfigKeys(config, fullPath);
-        return { config, file: fullPath, warnings, errors };
+        return { config: attachConfigDir(config, fullPath), file: fullPath, warnings, errors };
       } catch (err) {
         const raw = err.message;
         const message = raw.includes(fullPath) ? raw : `${fullPath}: ${raw}`;
@@ -4447,7 +4643,7 @@ async function loadConfigFileDetailed(cwd) {
       const imported = await importConfigModule(fullPath);
       const hasDefault = Object.prototype.hasOwnProperty.call(imported, "default");
       const config = readConfigExport(hasDefault ? imported.default : imported, fullPath);
-      return { config, file: fullPath, warnings, errors };
+      return { config: attachConfigDir(config, fullPath), file: fullPath, warnings, errors };
     } catch (err) {
       const message = `Could not load ${fullPath}: ${err.message}`;
       warnings.push(message);
@@ -4465,7 +4661,12 @@ async function loadConfigFileDetailed(cwd) {
           snapshotKey,
           `${pkgJsonPath} (the "snapshot" key)`
         );
-        return { config: snapshotKey, file: pkgJsonPath, warnings, errors };
+        return {
+          config: attachConfigDir(snapshotKey, pkgJsonPath),
+          file: pkgJsonPath,
+          warnings,
+          errors
+        };
       }
       if (snapshotKey !== void 0) {
         const kind = Array.isArray(snapshotKey) ? "array" : typeof snapshotKey;
@@ -4504,7 +4705,7 @@ var DEFAULT_ARTIFACTS = {
 function isArtifactName(value) {
   return ARTIFACT_NAMES.includes(value);
 }
-function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride) {
+function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride, only) {
   const artifacts = {
     ...DEFAULT_ARTIFACTS,
     // `includeMonolith` predates this selection and stays the switch for it.
@@ -4529,6 +4730,21 @@ function resolveArtifacts(requested, skipped, includeMonolith, monolithOverride)
   if (monolithOverride !== void 0) {
     artifacts.monolith = monolithOverride;
   }
+  if (only !== void 0 && only.length > 0) {
+    const keep = /* @__PURE__ */ new Set();
+    for (const name of only) {
+      if (!isArtifactName(name)) {
+        throw new Error(
+          `Unknown artifact "${name}". Expected one of: ${ARTIFACT_NAMES.join(", ")}.`
+        );
+      }
+      keep.add(name);
+    }
+    for (const name of ARTIFACT_NAMES) {
+      artifacts[name] = keep.has(name);
+    }
+    return artifacts;
+  }
   for (const name of skipped ?? []) {
     if (!isArtifactName(name)) {
       throw new Error(
@@ -4829,7 +5045,8 @@ function resolveConfig(userConfig, cliOptions, baseDir) {
     userConfig?.artifacts,
     cliOptions?.skipArtifacts,
     includeMonolith,
-    cliMonolith
+    cliMonolith,
+    cliOptions?.onlyArtifacts
   );
   const explicitMaxPartBytes = cliOptions?.maxPartBytes ?? userConfig?.maxPartBytes;
   const maxPartBytes = boundedBytes(
@@ -5003,7 +5220,18 @@ function configDigest(config) {
     excludePatterns: config.excludePatterns,
     preset: config.preset,
     layersMode: config.layersMode,
-    budgets: config.budgets,
+    // `budgets.byLayer` is a plain object, and `JSON.stringify` preserves insertion order — so
+    // `{ docs, api }` and `{ api, docs }` hashed differently despite being the same settings, and
+    // `validate` reported configuration drift for a snapshot nobody had changed. The keys are
+    // canonicalised here; nothing else about the object is order-dependent.
+    budgets: {
+      default: config.budgets.default,
+      byLayer: Object.fromEntries(
+        Object.entries(config.budgets.byLayer).sort(
+          ([left], [right]) => left < right ? -1 : left > right ? 1 : 0
+        )
+      )
+    },
     // The matcher is what makes a layer a layer. Hashing only the names meant that
     // moving `{ name: "api", match: "src/api/**" }` to `"src/v2/**"` produced the same
     // digest, so `validate` reported "valid and up to date" for a snapshot whose files
@@ -5022,9 +5250,21 @@ function configDigest(config) {
 }
 
 // src/partitioner/preview.ts
+var LINE_ENDINGS = /\r\n|\r/g;
+var normaliseLineEndings = (content) => content.replace(LINE_ENDINGS, "\n");
 function countLines(content) {
   if (content.length === 0) return 0;
-  return content.split("\n").length - (content.endsWith("\n") ? 1 : 0);
+  let breaks = 0;
+  for (let index = 0; index < content.length; index += 1) {
+    const code = content.charCodeAt(index);
+    if (code === 10) {
+      breaks += 1;
+      continue;
+    }
+    if (code === 13 && content.charCodeAt(index + 1) !== 10) breaks += 1;
+  }
+  const last = content.charCodeAt(content.length - 1);
+  return last === 10 || last === 13 ? breaks : breaks + 1;
 }
 function truncateToBytes(content, maxBytes) {
   if (maxBytes <= 0) return { content: "", isTruncated: content.length > 0 };
@@ -5035,17 +5275,18 @@ function truncateToBytes(content, maxBytes) {
   return { content: slice, isTruncated: true };
 }
 function truncatePreview(content, headLines, tailLines) {
-  const lines = content.split("\n");
-  const total = countLines(content);
+  const normalised = normaliseLineEndings(content);
+  const lines = normalised.split("\n");
+  const total = countLines(normalised);
   if (total <= headLines + tailLines) {
     return {
-      content,
+      content: normalised,
       isTruncated: false,
       originalLines: total,
       includedLines: total
     };
   }
-  const window = content.endsWith("\n") ? lines.slice(0, -1) : lines;
+  const window = normalised.endsWith("\n") ? lines.slice(0, -1) : lines;
   const head = window.slice(0, headLines);
   const tail = tailLines > 0 ? window.slice(window.length - tailLines) : [];
   const omitted = total - head.length - tail.length;
@@ -5148,6 +5389,10 @@ var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".mjs",
   ".cjs"
 ]);
+var PYTHON_EXTENSIONS = /* @__PURE__ */ new Set([".py", ".pyi"]);
+var RUBY_EXTENSIONS = /* @__PURE__ */ new Set([".rb", ".rake", ".gemspec"]);
+var C_EXTENSIONS = /* @__PURE__ */ new Set([".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hxx", ".m", ".mm"]);
+var PYTHON_SUFFIXES = [".py", ".pyi", "/__init__.py", "/__init__.pyi"];
 function buildImportResolver(files) {
   const byPath = /* @__PURE__ */ new Map();
   const byPathFolded = /* @__PURE__ */ new Map();
@@ -5174,11 +5419,45 @@ function buildImportResolver(files) {
   return { byPath, byPathFolded, byStem, byStemFolded };
 }
 function resolveSpecifier(fromFile, specifier, resolver) {
+  const extension = path10__namespace.posix.extname(fromFile).toLowerCase();
+  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
+  const firstOf = (candidates) => {
+    for (const candidate of candidates) {
+      const hit = exact(candidate);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  if (PYTHON_EXTENSIONS.has(extension) && specifier.startsWith(".")) {
+    const dots = /^\.+/.exec(specifier)?.[0].length ?? 0;
+    const rest = specifier.slice(dots).replace(/\./g, "/");
+    let base = path10__namespace.posix.dirname(fromFile);
+    for (let up = 1; up < dots; up += 1) base = path10__namespace.posix.dirname(base);
+    const joined2 = rest ? path10__namespace.posix.normalize(path10__namespace.posix.join(base, rest)) : base;
+    return firstOf([joined2, ...PYTHON_SUFFIXES.map((suffix) => `${joined2}${suffix}`)]);
+  }
+  if (RUBY_EXTENSIONS.has(extension) && specifier.startsWith("./")) {
+    const joined2 = path10__namespace.posix.normalize(
+      path10__namespace.posix.join(path10__namespace.posix.dirname(fromFile), specifier)
+    );
+    return firstOf([`${joined2}.rb`, joined2]);
+  }
+  if (C_EXTENSIONS.has(extension) && specifier.startsWith("./")) {
+    const joined2 = path10__namespace.posix.normalize(
+      path10__namespace.posix.join(path10__namespace.posix.dirname(fromFile), specifier)
+    );
+    return exact(joined2);
+  }
+  if (extension === ".dart" && !specifier.includes(":")) {
+    const joined2 = path10__namespace.posix.normalize(
+      path10__namespace.posix.join(path10__namespace.posix.dirname(fromFile), specifier)
+    );
+    return firstOf([joined2, `${joined2}.dart`]);
+  }
   if (!RELATIVE_SPECIFIER.test(specifier)) return null;
   const joined = path10__namespace.posix.normalize(
     path10__namespace.posix.join(path10__namespace.posix.dirname(fromFile), specifier)
   );
-  const exact = (key) => resolver.byPath.get(key) ?? resolver.byPathFolded.get(key.toLowerCase()) ?? null;
   const direct = exact(joined);
   if (direct) return direct;
   for (const suffix of IMPORT_CANDIDATE_SUFFIXES) {
@@ -5289,10 +5568,13 @@ function describeMatcher(matcher) {
   return String(matcher);
 }
 function normalizeTarget(cwd, target) {
-  const absolute = path10__namespace.resolve(cwd, target);
-  const relative8 = path10__namespace.relative(cwd, absolute);
-  if (relative8.startsWith("..") || path10__namespace.isAbsolute(relative8)) return target;
-  return relative8.split(path10__namespace.sep).join("/");
+  const resolvedCwd = path10__namespace.resolve(cwd);
+  const absolute = path10__namespace.resolve(resolvedCwd, target);
+  const relative8 = path10__namespace.relative(resolvedCwd, absolute);
+  if (relative8 === "" || relative8 === ".." || relative8.startsWith(`..${path10__namespace.sep}`) || path10__namespace.isAbsolute(relative8)) {
+    return { relative: target.replace(/\\/g, "/"), outsideRoot: true };
+  }
+  return { relative: relative8.split(path10__namespace.sep).join("/"), outsideRoot: false };
 }
 function findRuleMatch(rules, relativePath) {
   return rules.find(
@@ -5319,9 +5601,19 @@ function readManifest2(config) {
   }
 }
 function explainPath(config, target) {
-  const relative8 = normalizeTarget(config.cwd, target);
-  const absolute = path10__namespace.join(config.cwd, relative8);
+  const normalized = normalizeTarget(config.cwd, target);
+  const relative8 = normalized.relative;
   const maskedPath2 = findSecretInPath(relative8, config.secretRules)?.masked ?? relative8;
+  if (normalized.outsideRoot) {
+    return {
+      path: maskedPath2,
+      exists: false,
+      included: false,
+      reason: "outside-root",
+      detail: "path resolves outside the configured repository root and was not inspected"
+    };
+  }
+  const absolute = path10__namespace.join(config.cwd, relative8);
   const result = {
     path: maskedPath2,
     exists: fs8__namespace.existsSync(absolute),
@@ -5471,41 +5763,62 @@ function renderExplainText(result) {
   );
   return lines.join("\n");
 }
+new async_hooks.AsyncLocalStorage();
+new async_hooks.AsyncLocalStorage();
 
 // src/ast/structured.ts
 function stripJsonComments2(content) {
   const text = content.replace(/^\uFEFF/, "");
+  const withoutComments = stripComments(text);
+  return stripTrailingCommas2(withoutComments);
+}
+function stripComments(text) {
   let out = "";
   let inString = false;
-  let inLineComment = false;
-  let inBlockComment = false;
-  for (let i = 0; i < text.length; i++) {
-    const char = text[i];
-    const next = text[i + 1];
-    if (inLineComment) {
-      if (char === "\n") {
-        inLineComment = false;
-        out += char;
-      }
+  let escaped = false;
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (inString) {
+      out += char;
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
       continue;
     }
-    if (inBlockComment) {
-      if (char === "*" && next === "/") {
-        inBlockComment = false;
-        i += 1;
+    if (char === '"') {
+      inString = true;
+      out += char;
+      continue;
+    }
+    if (char === "/" && text[index + 1] === "/") {
+      while (index < text.length && text[index] !== "\n" && text[index] !== "\r") index += 1;
+      index -= 1;
+      continue;
+    }
+    if (char === "/" && text[index + 1] === "*") {
+      index += 2;
+      while (index < text.length && !(text[index] === "*" && text[index + 1] === "/")) {
+        if (text[index] === "\n" || text[index] === "\r") out += text[index];
+        index += 1;
       }
+      index += 1;
       continue;
     }
+    out += char;
+  }
+  return out;
+}
+function stripTrailingCommas2(text) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
     if (inString) {
       out += char;
-      if (char === "\\") {
-        if (next !== void 0) {
-          out += next;
-          i += 1;
-        }
-      } else if (char === '"') {
-        inString = false;
-      }
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') inString = false;
       continue;
     }
     if (char === '"') {
@@ -5513,15 +5826,10 @@ function stripJsonComments2(content) {
       out += char;
       continue;
     }
-    if (char === "/" && next === "/") {
-      inLineComment = true;
-      i += 1;
-      continue;
-    }
-    if (char === "/" && next === "*") {
-      inBlockComment = true;
-      i += 1;
-      continue;
+    if (char === ",") {
+      let next = index + 1;
+      while (next < text.length && /\s/.test(text[next])) next += 1;
+      if (text[next] === "}" || text[next] === "]") continue;
     }
     out += char;
   }
@@ -5564,31 +5872,45 @@ function summarizeJson(content) {
     };
   }
 }
+function frontMatterEnd(lines) {
+  if (lines.length < 3 || lines[0].trim() !== "---") return 0;
+  for (let index = 1; index < lines.length; index += 1) {
+    const line = lines[index];
+    const candidate = line.trim();
+    if (candidate === "---" || candidate === "...") {
+      return index > 1 ? index : 0;
+    }
+    if (candidate === "") continue;
+    if (/^#(\s|$)/.test(candidate)) continue;
+    if (/^(`{3,}|~{3,})/.test(candidate)) return 0;
+    if (/^#{1,6}\s+\S/.test(candidate)) return 0;
+    const isYamlMapping = /^[A-Za-z0-9_.-]+\s*:(\s|$)/.test(candidate);
+    const isListItem = /^-(?:(\s|$))/.test(candidate);
+    const isIndented = /^[ \t]/.test(line);
+    if (!isYamlMapping && !isListItem && !isIndented) return 0;
+  }
+  return 0;
+}
 function summarizeMarkdown(content) {
   const headings = [];
   const frontmatterKeys = [];
-  const lines = content.replace(/^\uFEFF/, "").split("\n");
+  const lines = content.replace(/^\uFEFF/, "").split(/\r\n|\n|\r/);
   let inFrontmatter = false;
   let fence = null;
-  let closesFrontmatter = false;
-  for (let index = 1; index < lines.length; index++) {
-    if (lines[index].trim() === "---") {
-      closesFrontmatter = true;
-      break;
-    }
-  }
+  const frontMatterEndLine = frontMatterEnd(lines);
   for (let index = 0; index < lines.length; index++) {
     const line = lines[index];
-    if (index === 0 && line.trim() === "---" && closesFrontmatter) {
+    if (index === 0 && frontMatterEndLine > 0) {
       inFrontmatter = true;
       continue;
     }
     if (inFrontmatter) {
-      if (line.trim() === "---") {
+      const trimmedFrontmatter = line.trim();
+      if (trimmedFrontmatter === "---" || trimmedFrontmatter === "...") {
         inFrontmatter = false;
         continue;
       }
-      const match = /^([a-zA-Z0-9_-]+):/.exec(line);
+      const match = /^([A-Za-z0-9_.-]+)\s*:/.exec(line);
       if (match) frontmatterKeys.push(match[1]);
       continue;
     }
@@ -5620,25 +5942,36 @@ function hasCollapsibleBody(node) {
   const body = node.body;
   return body !== void 0 && ts__default.default.isBlock(body);
 }
-function isTsxFileName(fileName) {
-  return fileName.toLowerCase().endsWith(".tsx");
+function scriptKindFor(fileName) {
+  const lower = fileName.toLowerCase();
+  if (lower.endsWith(".tsx")) return ts__default.default.ScriptKind.TSX;
+  if (lower.endsWith(".jsx")) return ts__default.default.ScriptKind.JSX;
+  if (lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".cjs")) {
+    return ts__default.default.ScriptKind.JS;
+  }
+  return ts__default.default.ScriptKind.TS;
 }
 function skeletonizeTypeScript(source, fileName = "file.ts") {
-  const scriptKind = isTsxFileName(fileName) ? ts__default.default.ScriptKind.TSX : ts__default.default.ScriptKind.TS;
   const sourceFile = ts__default.default.createSourceFile(
     fileName,
     source,
     ts__default.default.ScriptTarget.Latest,
-    true,
-    scriptKind
+    // `setParentNodes: false`. Nothing here reads `.parent` — the one `getStart` call is given the
+    // source file explicitly, which is the reason that argument exists. Asking for parent pointers
+    // makes the parser run a second full pass over every node in the file to set them, on top of
+    // the summary parse this same file already pays for.
+    false,
+    scriptKindFor(fileName)
   );
   const spans = [];
   const visit = (node) => {
     if ((ts__default.default.isFunctionDeclaration(node) || ts__default.default.isMethodDeclaration(node) || ts__default.default.isConstructorDeclaration(node) || ts__default.default.isGetAccessorDeclaration(node) || ts__default.default.isSetAccessorDeclaration(node) || ts__default.default.isFunctionExpression(node) || ts__default.default.isArrowFunction(node)) && hasCollapsibleBody(node)) {
       const body = node.body;
-      const start = body.getStart(sourceFile);
-      const end = body.getEnd();
-      if (end > start) spans.push({ start, end });
+      if (body.statements.length > 0) {
+        const start = body.getStart(sourceFile);
+        const end = body.getEnd();
+        if (end > start) spans.push({ start, end });
+      }
     }
     ts__default.default.forEachChild(node, visit);
   };
@@ -5650,16 +5983,21 @@ function skeletonizeTypeScript(source, fileName = "file.ts") {
     if (last && span.start < last.end) continue;
     outermost.push(span);
   }
-  let text = source;
-  for (let index = outermost.length - 1; index >= 0; index -= 1) {
-    const span = outermost[index];
-    text = `${text.slice(0, span.start)}{ /* ... */ }${text.slice(span.end)}`;
+  const chunks = [];
+  let cursor = 0;
+  for (const span of outermost) {
+    chunks.push(source.slice(cursor, span.start), "{ /* ... */ }");
+    cursor = span.end;
   }
-  return { text, collapsed: outermost.length };
+  chunks.push(source.slice(cursor));
+  return { text: chunks.join(""), collapsed: outermost.length };
 }
 function isSkeletonizable(filePath) {
   const lower = filePath.toLowerCase();
-  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts");
+  if (lower.endsWith(".d.ts") || lower.endsWith(".d.mts") || lower.endsWith(".d.cts")) {
+    return false;
+  }
+  return lower.endsWith(".ts") || lower.endsWith(".tsx") || lower.endsWith(".mts") || lower.endsWith(".cts") || lower.endsWith(".js") || lower.endsWith(".jsx") || lower.endsWith(".mjs") || lower.endsWith(".cjs");
 }
 var SARIF_VERSION = "2.1.0";
 var SARIF_SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json";
@@ -5784,23 +6122,55 @@ function truncateWithBudgetMarker(content, maxBytes, budget, originalLines) {
   };
 }
 function partitionFiles(files, maxPartBytes, contentFingerprint) {
-  if (files.length === 0) return [];
-  const budget = Math.max(MIN_SECTION_BUDGET_BYTES + HEADER_RESERVE_BYTES, maxPartBytes);
-  const sectionBudget = budget - HEADER_RESERVE_BYTES;
-  const prepared = files.map((file) => prepareSection(file, sectionBudget));
-  let groups = greedyGroups(prepared, budget);
+  return partitionFilesForBuckets([{ files, budgetBytes: maxPartBytes }], contentFingerprint);
+}
+function partitionFilesForBuckets(buckets, contentFingerprint) {
+  const groups = [];
+  for (const bucket of buckets) {
+    if (bucket.files.length === 0) continue;
+    const budget = Math.max(
+      MIN_SECTION_BUDGET_BYTES + HEADER_RESERVE_BYTES,
+      bucket.budgetBytes
+    );
+    const sectionBudget = budget - HEADER_RESERVE_BYTES;
+    const prepared = bucket.files.map((file) => prepareSection(file, sectionBudget));
+    for (const sections of greedyGroups(prepared, budget)) groups.push({ sections, budget });
+  }
+  if (groups.length === 0) return [];
+  const measurements = /* @__PURE__ */ new Map();
+  const widthOf = (total) => Math.max(3, String(total).length);
+  const measure = (group, index, total) => {
+    const cached = measurements.get(group);
+    const width = widthOf(total);
+    if (cached !== void 0 && cached.index === index && cached.width === width) {
+      return cached.size;
+    }
+    const { content } = assembleGroup(group, index, total, contentFingerprint);
+    const size = Buffer.byteLength(content, "utf8");
+    measurements.set(group, { index, width, size });
+    return size;
+  };
   for (let pass = 0; pass < MAX_SPLIT_PASSES; pass++) {
-    const rendered = renderGroups(groups, budget, contentFingerprint);
-    const oversized = rendered.findIndex((part) => part.metadata.byteSize > budget);
-    if (oversized === -1) return rendered;
+    const total = groups.length;
+    let oversized = -1;
+    for (let index = 0; index < total; index += 1) {
+      const group2 = groups[index];
+      if (measure(group2, index, total) > group2.budget) {
+        oversized = index;
+        break;
+      }
+    }
+    if (oversized === -1) return renderGroups(groups, contentFingerprint);
     const group = groups[oversized];
-    if (group.length > 1) {
-      const moved = group.pop();
-      groups.splice(oversized + 1, 0, [moved]);
+    if (group.sections.length > 1) {
+      const moved = group.sections.pop();
+      groups.splice(oversized + 1, 0, { sections: [moved], budget: group.budget });
+      measurements.delete(group);
       continue;
     }
-    const [section] = group;
-    const overflow = rendered[oversized].metadata.byteSize - budget;
+    const [section] = group.sections;
+    if (section === void 0) return renderGroups(groups, contentFingerprint);
+    const overflow = measure(group, oversized, total) - group.budget;
     const currentContent = section.file.content ?? "";
     const shrinkTo = Math.max(
       0,
@@ -5809,26 +6179,33 @@ function partitionFiles(files, maxPartBytes, contentFingerprint) {
     const shrunk = truncateWithBudgetMarker(
       currentContent,
       shrinkTo,
-      budget,
+      group.budget,
       section.file.originalLines
     );
     if (shrunk.isTruncated) {
       applyTruncatedContent(section.file, shrunk.content);
       section.text = renderFileSection(section.file);
       section.byteSize = Buffer.byteLength(section.text, "utf8");
+      measurements.delete(group);
       continue;
     }
+    const rendered = renderGroups(groups, contentFingerprint);
     const marker = TRUNCATION_MARKER;
-    assertBudgetHoldsMarker(budget);
+    assertBudgetHoldsMarker(group.budget);
     const target = Math.max(
       0,
-      budget - Buffer.byteLength(marker, "utf8") - TOKEN_LINE_SLACK
+      group.budget - Buffer.byteLength(marker, "utf8") - TOKEN_LINE_SLACK
     );
     const clipped = truncateToBytes(rendered[oversized].markdown, target);
-    rendered[oversized] = rehashPart(rendered[oversized], clipped.content + marker);
+    rendered[oversized] = rehashPart(
+      rendered[oversized],
+      clipped.content + marker
+    );
     return rendered;
   }
-  return enforceBudget(renderGroups(groups, budget, contentFingerprint), budget);
+  return renderGroups(groups, contentFingerprint).flatMap(
+    (part) => enforceBudget([part], part.metadata.budgetBytes)
+  );
 }
 var TRUNCATION_MARKER = "\n... [part truncated: cannot fit budget] ...\n";
 function assertBudgetHoldsMarker(budget) {
@@ -5851,69 +6228,7 @@ function enforceBudget(parts, budget) {
     return rehashPart(part, clipped.content + TRUNCATION_MARKER);
   });
 }
-function renumberParts(parts, contentFingerprint) {
-  const total = parts.length;
-  if (total === 0) return [];
-  const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
-  const nameFor = (position) => `part-${zeroPad(position)}.md`;
-  const marker = "## Contents\n";
-  const renumbered = parts.map((part, index) => {
-    const markerIndex = part.markdown.indexOf(marker);
-    const body = markerIndex === -1 ? "" : part.markdown.slice(markerIndex + marker.length);
-    const included = part.metadata.includedFiles;
-    if (markerIndex === -1) {
-      throw new Error(`${part.filename} has no "## Contents" section to re-number.`);
-    }
-    const layerCounts = {};
-    const kindCounts = {};
-    for (const file of included) {
-      layerCounts[file.layer] = (layerCounts[file.layer] || 0) + 1;
-      kindCounts[file.kind] = (kindCounts[file.kind] || 0) + 1;
-    }
-    const pathLines = included.map((file) => displayPath(file.relativePath));
-    const listFence = fenceForText(pathLines.join("\n"), 3);
-    const header = [
-      `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
-      "",
-      `- Previous: ${index === 0 ? "none" : nameFor(index)}`,
-      `- Next: ${index === total - 1 ? "none" : nameFor(index + 2)}`,
-      `- Files: ${included.length}`,
-      `- Content Fingerprint: ${contentFingerprint || "none"}`,
-      `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
-      `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
-      "",
-      UNTRUSTED_CONTENT_NOTICE,
-      "",
-      "## Files",
-      "",
-      `${listFence}text`,
-      ...pathLines,
-      listFence,
-      "",
-      "## Contents",
-      ""
-    ].join("\n");
-    const assembled = (header + body).replace(/\r\n/g, "\n");
-    const estimatedTokens = estimateTokens(assembled);
-    const markdown = insertTokenLine(assembled, estimatedTokens);
-    const metadata = {
-      ...part.metadata,
-      index: index + 1,
-      filename: nameFor(index + 1),
-      byteSize: Buffer.byteLength(markdown, "utf8"),
-      estimatedTokens,
-      sha256: crypto2__namespace.createHash("sha256").update(markdown).digest("hex"),
-      lines: countLines(markdown),
-      fileCount: included.length,
-      layersCovered: Object.keys(layerCounts).sort()
-    };
-    return { filename: metadata.filename, markdown, metadata };
-  });
-  return renumbered.map(
-    (part) => enforceBudget([part], part.metadata.budgetBytes)[0] ?? part
-  );
-}
-var SECTION_TRUNCATION_NOTICE = "\n... [section truncated: metadata alone exceeds the part budget] ...\n";
+var SECTION_TRUNCATION_NOTICE = "... [section truncated: the fixed metadata and a code fence did not fit the part budget] ...";
 var METADATA_VALUE_MAX = 200;
 var DISPLAY_PATH_MAX = 300;
 function capValue(value, max) {
@@ -5955,13 +6270,57 @@ function prepareSection(file, sectionBudget) {
     shrinkBody();
   }
   if (byteSize > sectionBudget) {
-    const target = sectionBudget - Buffer.byteLength(SECTION_TRUNCATION_NOTICE, "utf8");
-    const truncated = truncateToBytes(text, Math.max(0, target));
-    text = truncated.content + SECTION_TRUNCATION_NOTICE;
+    applyTruncatedContent(file, SECTION_TRUNCATION_NOTICE);
+    file.summary = void 0;
+    file.summaryOmitted = true;
+    text = renderFileSection(file);
     byteSize = Buffer.byteLength(text, "utf8");
+    if (byteSize > sectionBudget) {
+      text = truncateRenderedSection(text, sectionBudget, fenceForContent(file.content ?? ""));
+      byteSize = Buffer.byteLength(text, "utf8");
+    }
   }
   return { file, text, byteSize };
 }
+function truncateRenderedSection(text, sectionBudget, fence) {
+  const closing = `
+${SECTION_TRUNCATION_NOTICE}
+${fence}
+`;
+  const bodyRoom = sectionBudget - Buffer.byteLength(closing, "utf8");
+  if (bodyRoom > 0) {
+    const cut2 = truncateToBytes(text, bodyRoom).content;
+    const lastBreak2 = cut2.lastIndexOf("\n");
+    const kept = lastBreak2 >= 0 ? cut2.slice(0, lastBreak2 + 1) : "";
+    if (fenceIsOpen(kept, fence)) return `${kept}${closing}`;
+  }
+  const probe = text.slice(0, 512);
+  const emptyFence = fenceForText(probe.slice(0, Math.max(0, probe.lastIndexOf("\n") + 1)), 4);
+  const block = `
+${emptyFence}
+${SECTION_TRUNCATION_NOTICE}
+${emptyFence}
+`;
+  const prefixRoom = sectionBudget - Buffer.byteLength(block, "utf8");
+  const cut = prefixRoom > 0 ? truncateToBytes(text, prefixRoom).content : "";
+  const lastBreak = cut.lastIndexOf("\n");
+  const prefix = lastBreak >= 0 ? cut.slice(0, lastBreak + 1) : "";
+  return `${dropTrailingOpenFence(prefix, fence)}${block}`;
+}
+function dropTrailingOpenFence(text, fence) {
+  if (!fenceIsOpen(text, fence)) return text;
+  const lines = text.split("\n");
+  const opening = lines.findIndex((line) => line.startsWith(fence));
+  if (opening < 0) return text;
+  return lines.slice(0, opening).join("\n") + (opening > 0 ? "\n" : "");
+}
+function fenceIsOpen(text, fence) {
+  let open = false;
+  for (const line of text.split("\n")) {
+    if (line.startsWith(fence)) open = !open;
+  }
+  return open;
+}
 function applyTruncatedContent(file, content) {
   file.content = content;
   file.isPreviewTruncated = true;
@@ -6009,52 +6368,64 @@ function greedyGroups(sections, budget) {
   if (current.length > 0) groups.push(current);
   return groups;
 }
-function renderGroups(groups, budget, contentFingerprint) {
+function assembleGroup(group, index, total, contentFingerprint) {
+  const width = Math.max(3, String(total).length);
+  const zeroPad = (value) => String(value).padStart(width, "0");
+  const filename = `part-${zeroPad(index + 1)}.md`;
+  const prev = index === 0 ? "none" : `part-${zeroPad(index)}.md`;
+  const next = index === total - 1 ? "none" : `part-${zeroPad(index + 2)}.md`;
+  for (const section of group.sections) {
+    section.file.part = filename;
+  }
+  const layerCounts = {};
+  const kindCounts = {};
+  for (const section of group.sections) {
+    layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
+    kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
+  }
+  const pathLines = group.sections.map((s) => displayPath(s.file.relativePath));
+  const listFence = fenceForText(pathLines.join("\n"), 3);
+  const header = [
+    `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
+    "",
+    `- Previous: ${prev}`,
+    `- Next: ${next}`,
+    `- Files: ${group.sections.length}`,
+    `- Content Fingerprint: ${contentFingerprint || "none"}`,
+    `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
+    `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
+    "",
+    UNTRUSTED_CONTENT_NOTICE,
+    "",
+    "## Files",
+    "",
+    `${listFence}text`,
+    ...pathLines,
+    listFence,
+    "",
+    "## Contents",
+    ""
+  ].join("\n");
+  const assembled = (header + group.sections.map((s) => s.text).join("")).replace(
+    /\r\n|\r/g,
+    "\n"
+  );
+  const estimatedTokens = estimateTokens(assembled);
+  return { filename, content: insertTokenLine(assembled, estimatedTokens), estimatedTokens };
+}
+function renderGroups(groups, contentFingerprint) {
   const total = groups.length;
-  const zeroPad = (index) => String(index).padStart(Math.max(3, String(total).length), "0");
   return groups.map((group, index) => {
-    const filename = `part-${zeroPad(index + 1)}.md`;
-    const prev = index === 0 ? "none" : `part-${zeroPad(index)}.md`;
-    const next = index === total - 1 ? "none" : `part-${zeroPad(index + 2)}.md`;
-    for (const section of group) {
-      section.file.part = filename;
-    }
-    const layersCovered = Array.from(new Set(group.map((s) => s.file.layer))).sort();
-    const layerCounts = {};
-    const kindCounts = {};
-    for (const section of group) {
-      layerCounts[section.file.layer] = (layerCounts[section.file.layer] || 0) + 1;
-      kindCounts[section.file.kind] = (kindCounts[section.file.kind] || 0) + 1;
-    }
-    const pathLines = group.map((s) => displayPath(s.file.relativePath));
-    const listFence = fenceForText(pathLines.join("\n"), 3);
-    const header = [
-      `# Codebase Snapshot Part ${zeroPad(index + 1)} of ${zeroPad(total)}`,
-      "",
-      `- Previous: ${prev}`,
-      `- Next: ${next}`,
-      `- Files: ${group.length}`,
-      `- Content Fingerprint: ${contentFingerprint || "none"}`,
-      `- Layers: ${topEntries(layerCounts, 6) || "none"}`,
-      `- Kinds: ${topEntries(kindCounts, 8) || "none"}`,
-      "",
-      UNTRUSTED_CONTENT_NOTICE,
-      "",
-      "## Files",
-      "",
-      `${listFence}text`,
-      ...pathLines,
-      listFence,
-      "",
-      "## Contents",
-      ""
-    ].join("\n");
-    const assembled = (header + group.map((s) => s.text).join("")).replace(/\r\n/g, "\n");
-    const estimatedTokens = estimateTokens(assembled);
-    const content = insertTokenLine(assembled, estimatedTokens);
+    const { filename, content, estimatedTokens } = assembleGroup(
+      group,
+      index,
+      total,
+      contentFingerprint
+    );
     const byteSize = Buffer.byteLength(content, "utf8");
     const sha256 = crypto2__namespace.createHash("sha256").update(content).digest("hex");
-    const includedFiles = group.map(({ file }) => ({
+    const layersCovered = Array.from(new Set(group.sections.map((s) => s.file.layer))).sort();
+    const includedFiles = group.sections.map(({ file }) => ({
       relativePath: file.relativePath,
       sourceBytes: file.sizeBytes,
       includedBytes: file.includedBytes,
@@ -6067,10 +6438,10 @@ function renderGroups(groups, budget, contentFingerprint) {
       filename,
       byteSize,
       estimatedTokens,
-      budgetBytes: budget,
+      budgetBytes: group.budget,
       sha256,
       lines: countLines(content),
-      fileCount: group.length,
+      fileCount: group.sections.length,
       layersCovered,
       includedFiles
     };
@@ -6078,7 +6449,7 @@ function renderGroups(groups, budget, contentFingerprint) {
   });
 }
 function emittedBody(content) {
-  const normalised = content.replace(/\r\n/g, "\n");
+  const normalised = content.replace(/\r\n|\r/g, "\n");
   return normalised.endsWith("\n") ? normalised.slice(0, -1) : normalised;
 }
 function compactMetadata(file) {
@@ -6146,7 +6517,7 @@ function generateMonolithJson(manifest, filesWithContent) {
 }
 function generateMonolithMarkdown(manifest, filesWithContent) {
   const sections = filesWithContent.map((file) => {
-    const content = (file.content ?? "").replace(/\r\n/g, "\n");
+    const content = (file.content ?? "").replace(/\r\n|\r/g, "\n");
     const fence = fenceForContent(content);
     return [
       `## File: ${escapeControls(file.relativePath)}`,
@@ -6365,9 +6736,13 @@ function describeManifestShapeProblem(value) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
       return 'a "parts" entry is not an object';
     }
-    if (typeof entry.filename !== "string") {
+    const filename = entry.filename;
+    if (typeof filename !== "string" || filename.trim() === "") {
       return 'a "parts" entry has no "filename"';
     }
+    if (filename.includes("/") || filename.includes("\\") || filename.includes("\0") || filename === "." || filename === ".." || path10__namespace.isAbsolute(filename)) {
+      return 'a "parts" entry "filename" must be a bare filename inside parts/';
+    }
   }
   if (!candidate.layers || typeof candidate.layers !== "object" || Array.isArray(candidate.layers)) {
     return 'missing "layers" object';
@@ -6478,7 +6853,7 @@ function validateSnapshot(configInput) {
   });
   for (const diskFile of collection.files) {
     const snapshotHash = manifestFileMap.get(diskFile);
-    if (!snapshotHash) {
+    if (snapshotHash === void 0) {
       const skipReason = skippedReasonOnDisk(diskFile);
       if (skipReason === "unchanged") {
         if (unchangedScope !== null) {
@@ -6492,6 +6867,11 @@ function validateSnapshot(configInput) {
       drift.missingInSnapshot.push(diskFile);
       continue;
     }
+    if (unchangedScope !== null && !unchangedScope.has(diskFile) && !becameDependent(diskFile)) {
+      drift.configMismatches.push(
+        `scope: ${maskedPath(diskFile, config.secretRules)} is in the snapshot but is no longer in the changed-files scope`
+      );
+    }
     let diskHash;
     try {
       diskHash = sha256Hex(fs8__namespace.readFileSync(path10__namespace.join(config.cwd, diskFile)));
@@ -6632,6 +7012,41 @@ function validateSnapshot(configInput) {
         `includeSensitiveFiles: manifest ${recorded.includeSensitiveFiles} vs current ${config.includeSensitiveFiles}`
       );
     }
+    if ((recorded.maxPartTokens ?? void 0) !== (config.maxPartTokens ?? void 0)) {
+      drift.configMismatches.push(
+        `maxPartTokens: manifest ${String(recorded.maxPartTokens ?? "unset")} vs current ${String(config.maxPartTokens ?? "unset")}`
+      );
+    }
+    if ((recorded.maxMonolithBytes ?? null) !== (config.maxMonolithBytes ?? null)) {
+      drift.configMismatches.push(
+        `maxMonolithBytes: manifest ${String(recorded.maxMonolithBytes ?? null)} vs current ${String(config.maxMonolithBytes ?? null)}`
+      );
+    }
+    if (Boolean(recorded.skeleton) !== Boolean(config.skeleton)) {
+      drift.configMismatches.push(
+        `skeleton: manifest ${Boolean(recorded.skeleton)} vs current ${Boolean(config.skeleton)}`
+      );
+    }
+    if (Boolean(recorded.sarif) !== Boolean(config.sarif)) {
+      drift.configMismatches.push(
+        `sarif: manifest ${Boolean(recorded.sarif)} vs current ${Boolean(config.sarif)}`
+      );
+    }
+    if ((recorded.changedSince ?? void 0) !== (config.changedSince ?? void 0)) {
+      drift.configMismatches.push(
+        `changedSince: manifest ${String(recorded.changedSince ?? "unset")} vs current ${String(config.changedSince ?? "unset")}`
+      );
+    }
+    if (Boolean(recorded.staged) !== Boolean(config.staged)) {
+      drift.configMismatches.push(
+        `staged: manifest ${Boolean(recorded.staged)} vs current ${Boolean(config.staged)}`
+      );
+    }
+    if (Boolean(recorded.withDependents) !== Boolean(config.withDependents)) {
+      drift.configMismatches.push(
+        `withDependents: manifest ${Boolean(recorded.withDependents)} vs current ${Boolean(config.withDependents)}`
+      );
+    }
     const effectiveDiscovery = config.discovery ?? "auto";
     const recordedDiscovery = recorded.discovery;
     if (recordedDiscovery !== void 0 && recordedDiscovery !== effectiveDiscovery) {
@@ -6852,7 +7267,7 @@ function validateSnapshot(configInput) {
 
 // src/version.ts
 var GENERATOR_NAME = "codebase-snapshot";
-var GENERATOR_VERSION = "0.9.12";
+var GENERATOR_VERSION = "0.9.14";
 var LEGACY_GENERATOR_NAMES = ["@ankurhalder/codebase-snapshot"];
 function isOurGeneratorName(name) {
   if (typeof name !== "string") return false;
@@ -6873,7 +7288,10 @@ const { parentPort, workerData } = require("node:worker_threads");
       parentPort.postMessage({ ok: false, message: loaded.errors.join("; ") });
       return;
     }
-    const config = mod.resolveConfig(loaded.config, workerData.cliOptions, workerData.cwd);
+    // \`hooks: {}\` is a value, not an absence: the config is applied with the hook list emptied,
+    // so the run is the documented MCP run rather than the CLI run with one setting removed.
+    const base = loaded.config ? { ...loaded.config, hooks: {} } : null;
+    const config = mod.resolveConfig(base, workerData.cliOptions, workerData.cwd);
     const manifest = mod.generateSnapshot(config);
     parentPort.postMessage({
       ok: true,
@@ -6896,14 +7314,15 @@ const { parentPort, workerData } = require("node:worker_threads");
 })();
 `;
 function generateInWorker(cwd, cliOptions) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let settled = false;
+    let worker = null;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve8(result);
+      if (worker !== null) void worker.terminate();
+      resolve9(result);
     };
-    let worker;
     const isCjs = typeof __dirname !== "undefined";
     const directory = isCjs ? __dirname : path10__namespace.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('mcp.cjs', document.baseURI).href))));
     try {
@@ -6936,7 +7355,100 @@ function generateInWorker(cwd, cliOptions) {
 
 // src/index.ts
 var SCHEMA_VERSION = "3.0.0";
-var SUMMARY_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
+var SUMMARY_MAX_SOURCE_BYTES2 = SUMMARY_MAX_SOURCE_BYTES;
+var FILE_DERIVATIONS = /* @__PURE__ */ new Map();
+var FILE_DERIVATION_LIMIT_BYTES = 64 * 1024 * 1024;
+var fileDerivationBytes = 0;
+function takeDerivation(path14, hash, settings) {
+  const cached = FILE_DERIVATIONS.get(path14);
+  if (cached === void 0 || cached.hash !== hash || cached.settings !== settings) return void 0;
+  return cached;
+}
+function rememberDerivation(path14, hash, settings, derivation) {
+  const bodyBytes = derivation.finalContent === derivation.redacted ? derivation.redacted.length : derivation.redacted.length + derivation.finalContent.length;
+  const bytes = bodyBytes * 2 + 512;
+  if (bytes > FILE_DERIVATION_LIMIT_BYTES / 4) return;
+  while (fileDerivationBytes + bytes > FILE_DERIVATION_LIMIT_BYTES) {
+    const oldest = FILE_DERIVATIONS.keys().next();
+    if (oldest.done === true) break;
+    const evicted = FILE_DERIVATIONS.get(oldest.value);
+    FILE_DERIVATIONS.delete(oldest.value);
+    if (evicted !== void 0) fileDerivationBytes -= evicted.bytes;
+  }
+  FILE_DERIVATIONS.set(path14, { ...derivation, hash, settings, bytes });
+  fileDerivationBytes += bytes;
+}
+function derivationSettings(config) {
+  const rules = config.secretRules.map(
+    (rule) => `${rule.rule}\0${rule.pattern.source}\0${rule.pattern.flags}\0${rule.valueGroup ?? ""}`
+  ).join("
");
+  return `${GENERATOR_VERSION}${configDigest(config)}${sha256Hex2(rules)}`;
+}
+function deriveFile(relativePath, rawContent, sizeBytes, config) {
+  const lineCount = countLines(rawContent);
+  const { redacted, findings } = scanAndRedactSecrets(rawContent, config.secretRules, relativePath);
+  const isLarge = sizeBytes > config.largeFileBytes;
+  let finalContent = redacted;
+  let isPreviewTruncated = false;
+  let includedLines = lineCount;
+  let inclusionMode = "full";
+  if (config.skeleton === true && isSkeletonizable(relativePath)) {
+    const skeleton = skeletonizeTypeScript(redacted, relativePath);
+    if (skeleton.collapsed > 0) {
+      finalContent = skeleton.text;
+      inclusionMode = "signatures";
+      includedLines = countLines(skeleton.text);
+    }
+  }
+  if (isLarge && inclusionMode !== "signatures") {
+    const preview = truncatePreview(redacted, config.previewHeadLines, config.previewTailLines);
+    finalContent = preview.content;
+    isPreviewTruncated = preview.isTruncated;
+    includedLines = preview.includedLines;
+    inclusionMode = isPreviewTruncated ? "preview" : "full";
+  }
+  let summary;
+  let summaryQuality;
+  let summarySkip = null;
+  let summaryWarning = null;
+  let dependentImports = null;
+  if (Buffer.byteLength(rawContent, "utf8") > SUMMARY_MAX_SOURCE_BYTES2) {
+    summarySkip = "oversize";
+    dependentImports = [];
+  } else if (isPreviewTruncated && hasStructuralSummary(relativePath)) {
+    summarySkip = "preview";
+    dependentImports = importsOfText(relativePath, rawContent);
+  } else {
+    try {
+      const outcome = summarizeFile(relativePath, rawContent);
+      summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
+      summaryQuality = outcome?.quality;
+      if (isSourceSummary(summary) && summary.parseErrors) {
+        summaryWarning = `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`;
+      }
+    } catch (err) {
+      summaryWarning = `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
+        /\s+/g,
+        " "
+      );
+    }
+  }
+  return {
+    redacted,
+    findings,
+    lineCount,
+    finalContent,
+    inclusionMode,
+    isPreviewTruncated,
+    includedLines,
+    isLarge,
+    summary,
+    summaryQuality,
+    summarySkip,
+    summaryWarning,
+    dependentImports
+  };
+}
 function sha256Hex2(input) {
   return crypto2__namespace.createHash("sha256").update(input).digest("hex");
 }
@@ -7393,23 +7905,14 @@ function partitionByBudget(files, config, fingerprint) {
     if (bucket) bucket.push(file);
     else buckets.set(budget, [file]);
   }
-  if (buckets.size <= 1) {
-    const only = buckets.size === 1 ? Array.from(buckets.keys())[0] : config.maxPartBytes;
-    return partitionFiles(files, only, fingerprint);
-  }
-  const parts = [];
-  for (const budget of Array.from(buckets.keys()).sort((a, b) => a - b)) {
-    parts.push(...partitionFiles(buckets.get(budget) ?? [], budget, fingerprint));
-  }
-  const merged = renumberParts(parts, fingerprint);
-  const byPath = new Map(files.map((file) => [file.relativePath, file]));
-  for (const part of merged) {
-    for (const included of part.metadata.includedFiles) {
-      const file = byPath.get(included.relativePath);
-      if (file) file.part = part.filename;
-    }
+  if (buckets.size === 0) return [];
+  if (buckets.size === 1) {
+    return partitionFiles(files, Array.from(buckets.keys())[0], fingerprint);
   }
-  return merged;
+  return partitionFilesForBuckets(
+    Array.from(buckets.entries()).sort(([left], [right]) => left - right).map(([budgetBytes, bucketFiles]) => ({ files: bucketFiles, budgetBytes })),
+    fingerprint
+  );
 }
 function generateSnapshot(configInput, options) {
   assertUsableConfigInput(configInput);
@@ -7440,6 +7943,7 @@ function generateSnapshot(configInput, options) {
     return false;
   }) : collection.files;
   const files = [];
+  const derivationKey = derivationSettings(config);
   const monolithBodies = /* @__PURE__ */ new Map();
   const skipped = maskSkipRecords([...collection.skipped], config.secretRules);
   const secretFindings = [];
@@ -7452,6 +7956,7 @@ function generateSnapshot(configInput, options) {
   const fileWarnings = [];
   const oversizeSummaryPaths = [];
   const previewSummaryPaths = [];
+  const skippedSummaryImports = /* @__PURE__ */ new Map();
   const layerCounts = {};
   const kindCounts = {};
   let totalLines = 0;
@@ -7516,8 +8021,6 @@ function generateSnapshot(configInput, options) {
     }
     const hashSha256 = sha256Hex2(buffer);
     const rawContent = decoded.text;
-    const lineCount = countLines(rawContent);
-    totalLines += lineCount;
     totalSizeBytes += stats.size;
     if (decoded.encoding !== "utf-8") {
       encodingNotes.push({
@@ -7531,66 +8034,25 @@ function generateSnapshot(configInput, options) {
     const language = detectLanguage(relativePath);
     bump(layerCounts, layer2);
     bump(kindCounts, kind);
-    const { redacted, findings } = scanAndRedactSecrets(
-      rawContent,
-      config.secretRules,
-      relativePath
-    );
-    secretFindings.push(...findings);
-    const isLarge = stats.size > config.largeFileBytes;
-    if (isLarge) largeFileCount += 1;
-    let finalContent = redacted;
-    let isPreviewTruncated = false;
-    let includedLines = lineCount;
-    let inclusionMode = "full";
-    if (config.skeleton === true && isSkeletonizable(relativePath)) {
-      const skeleton = skeletonizeTypeScript(redacted, relativePath);
-      if (skeleton.collapsed > 0) {
-        finalContent = skeleton.text;
-        inclusionMode = "signatures";
-        includedLines = countLines(skeleton.text);
-      }
-    }
-    if (isLarge && inclusionMode !== "signatures") {
-      const preview = truncatePreview(
-        redacted,
-        config.previewHeadLines,
-        config.previewTailLines
-      );
-      finalContent = preview.content;
-      isPreviewTruncated = preview.isTruncated;
-      includedLines = preview.includedLines;
-      inclusionMode = isPreviewTruncated ? "preview" : "full";
-    }
-    if (config.includeMonolith && (isPreviewTruncated || inclusionMode === "signatures")) {
-      monolithBodies.set(relativePath, redacted);
-    }
-    let summary;
-    let summaryQuality;
-    if (Buffer.byteLength(rawContent, "utf8") > SUMMARY_MAX_SOURCE_BYTES) {
-      oversizeSummaryPaths.push(relativePath);
-    } else if (isPreviewTruncated && hasStructuralSummary(relativePath)) {
-      previewSummaryPaths.push(relativePath);
-    } else {
-      try {
-        const outcome = summarizeFile(relativePath, rawContent);
-        summary = outcome?.summary ? maskSummaryStrings(outcome.summary, config.secretRules) : void 0;
-        summaryQuality = outcome?.quality;
-        if (isSourceSummary(summary) && summary.parseErrors) {
-          fileWarnings.push({
-            path: relativePath,
-            message: `Parse errors in ${maskPathText(relativePath, config.secretRules)} (${summary.parseErrors}); its summary is incomplete.`
-          });
-        }
-      } catch (err) {
-        fileWarnings.push({
-          path: relativePath,
-          message: `Summary skipped for ${maskPathText(relativePath, config.secretRules)}: ${err.message}`.replace(
-            /\s+/g,
-            " "
-          )
-        });
-      }
+    const derivation = takeDerivation(absolutePath, hashSha256, derivationKey) ?? (() => {
+      const fresh = deriveFile(relativePath, rawContent, stats.size, config);
+      rememberDerivation(absolutePath, hashSha256, derivationKey, fresh);
+      return fresh;
+    })();
+    const { lineCount } = derivation;
+    totalLines += lineCount;
+    secretFindings.push(...derivation.findings);
+    if (derivation.isLarge) largeFileCount += 1;
+    if (derivation.summarySkip === "oversize") oversizeSummaryPaths.push(relativePath);
+    else if (derivation.summarySkip === "preview") previewSummaryPaths.push(relativePath);
+    if (derivation.dependentImports !== null) {
+      skippedSummaryImports.set(relativePath, derivation.dependentImports);
+    }
+    if (derivation.summaryWarning !== null) {
+      fileWarnings.push({ path: relativePath, message: derivation.summaryWarning });
+    }
+    if (config.includeMonolith && (derivation.isPreviewTruncated || derivation.inclusionMode === "signatures")) {
+      monolithBodies.set(relativePath, derivation.redacted);
     }
     files.push({
       relativePath,
@@ -7601,24 +8063,25 @@ function generateSnapshot(configInput, options) {
       layer: layer2,
       kind,
       language,
-      inclusionMode,
-      isLarge,
-      isPreviewTruncated,
+      inclusionMode: derivation.inclusionMode,
+      isLarge: derivation.isLarge,
+      isPreviewTruncated: derivation.isPreviewTruncated,
       originalLines: lineCount,
-      includedLines,
-      includedBytes: Buffer.byteLength(finalContent, "utf8"),
-      summary,
-      summaryQuality,
+      includedLines: derivation.includedLines,
+      includedBytes: Buffer.byteLength(derivation.finalContent, "utf8"),
+      summary: derivation.summary,
+      summaryQuality: derivation.summaryQuality,
       ...decoded.encoding === "utf-8" ? {} : { encoding: decoded.encoding },
-      content: finalContent
+      content: derivation.finalContent
     });
   }
   if (changedScope !== null && changedPaths !== null && config.withDependents === true) {
     const keep = new Set(changedPaths);
     const resolver = buildImportResolver(files);
     for (const file of files) {
-      if (!isSourceSummary(file.summary)) continue;
-      if (importsChangedFile(file.relativePath, file.summary.imports, changedPaths, resolver)) {
+      const fileImports = isSourceSummary(file.summary) ? file.summary.imports : skippedSummaryImports.get(file.relativePath) ?? [];
+      if (fileImports.length === 0) continue;
+      if (importsChangedFile(file.relativePath, fileImports, changedPaths, resolver)) {
         keep.add(file.relativePath);
       }
     }
@@ -7649,6 +8112,9 @@ function generateSnapshot(configInput, options) {
     for (const path14 of [...monolithBodies.keys()]) {
       if (!keep.has(path14)) monolithBodies.delete(path14);
     }
+    for (const path14 of [...skippedSummaryImports.keys()]) {
+      if (!keep.has(path14)) skippedSummaryImports.delete(path14);
+    }
   }
   if (changedScope !== null) {
     for (const relativePath of unchangedPaths) {
@@ -7684,7 +8150,7 @@ function generateSnapshot(configInput, options) {
     const shown = oversizeSummaryPaths.slice(0, ENCODING_PATHS_SHOWN).map((entry) => maskPathText(entry, config.secretRules));
     const hidden = oversizeSummaryPaths.length - ENCODING_PATHS_SHOWN;
     warnings.push(
-      `${oversizeSummaryPaths.length} file(s) exceed ${Math.round(SUMMARY_MAX_SOURCE_BYTES / (1024 * 1024))} MB and were not parsed for a structural summary: ${shown.join(", ")}${hidden > 0 ? ` and ${hidden} more` : ""}. Their bodies are emitted as head/tail previews.`
+      `${oversizeSummaryPaths.length} file(s) exceed ${Math.round(SUMMARY_MAX_SOURCE_BYTES2 / (1024 * 1024))} MB and were not parsed for a structural summary: ${shown.join(", ")}${hidden > 0 ? ` and ${hidden} more` : ""}. Their bodies are emitted as head/tail previews.`
     );
   }
   for (const [encoding, bucket] of encodingBuckets) {
@@ -7708,11 +8174,13 @@ function generateSnapshot(configInput, options) {
     ).join("\n")
   );
   const fullContents = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    fullContents.set(
-      file.relativePath,
-      monolithBodies.get(file.relativePath) ?? file.content ?? ""
-    );
+  if (config.includeMonolith) {
+    for (const file of files) {
+      fullContents.set(
+        file.relativePath,
+        monolithBodies.get(file.relativePath) ?? file.content ?? ""
+      );
+    }
   }
   const parts = partitionByBudget(files, config, fingerprint);
   const truncatedPreviewCount = files.filter((file) => file.isPreviewTruncated).length;
@@ -8051,12 +8519,35 @@ async function openWorkspace(root, overrides = {}) {
     }
     cliOptions.maxPartBytes = parsed;
   }
+  if (overrides.maxPartTokens !== void 0) {
+    const parsed = parseByteSize(overrides.maxPartTokens);
+    if (parsed === void 0) {
+      return {
+        ok: false,
+        message: '"maxPartTokens" must be a token count, for example 32000 or "32k".'
+      };
+    }
+    cliOptions.maxPartTokens = parsed;
+  }
   if (overrides.outDir !== void 0) {
     if (typeof overrides.outDir !== "string" || overrides.outDir.trim().length === 0) {
       return { ok: false, message: '"outDir" must be a non-empty string.' };
     }
     cliOptions.outDir = overrides.outDir.trim();
   }
+  if (overrides.changedSince !== void 0) {
+    if (typeof overrides.changedSince !== "string" || overrides.changedSince.trim().length === 0) {
+      return {
+        ok: false,
+        message: '"changedSince" must be a git ref such as "main" or "HEAD~3".'
+      };
+    }
+    cliOptions.changedSince = overrides.changedSince.trim();
+  }
+  if (overrides.skeleton === true) cliOptions.skeleton = true;
+  if (overrides.sarif === true) cliOptions.sarif = true;
+  if (overrides.staged === true) cliOptions.staged = true;
+  if (overrides.withDependents === true) cliOptions.withDependents = true;
   try {
     const config = resolveConfig(loaded.config, cliOptions, root);
     return { ok: true, workspace: { root, config, configFile: loaded.file, cliOptions } };
@@ -8068,6 +8559,16 @@ var manifestCache = /* @__PURE__ */ new Map();
 function manifestPathFor(workspace) {
   return path10__namespace.resolve(workspace.root, workspace.config.outDir, "manifest.json");
 }
+function partPathFor(workspace, filename) {
+  if (filename.length === 0 || filename.includes("\0")) return null;
+  const partsDir = path10__namespace.resolve(workspace.root, workspace.config.outDir, "parts");
+  const resolved = path10__namespace.resolve(partsDir, filename);
+  const relative8 = path10__namespace.relative(partsDir, resolved);
+  if (relative8.length === 0 || relative8.includes(path10__namespace.sep) || relative8.includes("/") || relative8.includes("\\") || path10__namespace.isAbsolute(relative8)) {
+    return null;
+  }
+  return resolved;
+}
 function readManifest3(workspace) {
   const file = manifestPathFor(workspace);
   const shown = path10__namespace.relative(workspace.root, file).split(path10__namespace.sep).join("/") || file;
@@ -8138,6 +8639,44 @@ var OUT_DIR_PROPERTY = {
   description: "Snapshot directory, relative to the root. Defaults to the project configuration's outDir."
 };
 var outDirOverride = (args) => ({ outDir: args.outDir });
+var SCOPE_PROPERTIES = {
+  maxPartTokens: {
+    type: "string",
+    description: 'Token ceiling per part, for example 32000 or "32k". Narrower than maxPartBytes; it converts at four bytes per token.'
+  },
+  skeleton: {
+    type: "boolean",
+    description: "Replace every function body with `{ /* ... */ }`, keeping signatures, imports and exports. Applies to TypeScript, JavaScript and JSX."
+  },
+  sarif: {
+    type: "boolean",
+    description: "Also write reports/audit.sarif beside reports/audit.md, for CI code scanning."
+  },
+  changedSince: {
+    type: "string",
+    description: 'Only files changed since this git ref, for example "main" or "HEAD~3".'
+  },
+  staged: {
+    type: "boolean",
+    description: "Only files staged in the git index."
+  },
+  withDependents: {
+    type: "boolean",
+    description: "With staged or changedSince, also include the files that import the changed ones (one hop)."
+  }
+};
+function workspaceOverrides(args) {
+  return {
+    outDir: args.outDir,
+    maxPartBytes: args.maxPartBytes,
+    maxPartTokens: args.maxPartTokens,
+    skeleton: args.skeleton,
+    sarif: args.sarif,
+    changedSince: args.changedSince,
+    staged: args.staged,
+    withDependents: args.withDependents
+  };
+}
 function failure(message) {
   return { text: message, isError: true };
 }
@@ -8168,12 +8707,13 @@ function summarizeDrift(drift) {
 }
 function toRelativePath(root, value) {
   const cleaned = value.trim();
-  if (cleaned.length === 0) return null;
-  if (!path10__namespace.isAbsolute(cleaned)) {
-    return cleaned.replace(/\\/g, "/").replace(/^\.\//, "");
+  if (cleaned.length === 0 || cleaned.includes("\0")) return null;
+  const resolvedRoot = path10__namespace.resolve(root);
+  const absolute = path10__namespace.resolve(resolvedRoot, cleaned);
+  const relative8 = path10__namespace.relative(resolvedRoot, absolute);
+  if (relative8 === "" || relative8 === ".." || relative8.startsWith(`..${path10__namespace.sep}`) || path10__namespace.isAbsolute(relative8)) {
+    return null;
   }
-  const relative8 = path10__namespace.relative(root, cleaned);
-  if (relative8.startsWith("..") || path10__namespace.isAbsolute(relative8)) return null;
   return relative8.split(path10__namespace.sep).join("/");
 }
 function symbolsOf(entry) {
@@ -8309,7 +8849,8 @@ var planTool = {
       maxPartBytes: {
         type: "string",
         description: 'Byte budget per part, for example 307200 or "300k". Defaults to the project configuration.'
-      }
+      },
+      ...SCOPE_PROPERTIES
     },
     additionalProperties: false
   },
@@ -8326,7 +8867,7 @@ var planTool = {
   },
   annotations: READ_ONLY,
   async handler(args, context) {
-    const prepared = await prepare(args, context, { maxPartBytes: args.maxPartBytes, outDir: args.outDir });
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     let manifest;
@@ -8384,7 +8925,8 @@ var generateTool = {
       maxPartBytes: {
         type: "string",
         description: 'Byte budget per part, for example 307200 or "300k". Defaults to the project configuration.'
-      }
+      },
+      ...SCOPE_PROPERTIES
     },
     additionalProperties: false
   },
@@ -8400,10 +8942,7 @@ var generateTool = {
   },
   annotations: WRITES,
   async handler(args, context) {
-    const prepared = await prepare(args, context, {
-      maxPartBytes: args.maxPartBytes,
-      outDir: args.outDir
-    });
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     const result = await generateInWorker(workspace.root, workspace.cliOptions);
@@ -8442,7 +8981,7 @@ var validateTool = {
   description: "Re-read the repository and report whether the snapshot on disk still matches it. Use it before trusting context that came from an earlier session, or after changing the config.",
   inputSchema: {
     type: "object",
-    properties: { root: ROOT_PROPERTY, outDir: OUT_DIR_PROPERTY },
+    properties: { root: ROOT_PROPERTY, outDir: OUT_DIR_PROPERTY, ...SCOPE_PROPERTIES },
     additionalProperties: false
   },
   outputSchema: {
@@ -8454,7 +8993,7 @@ var validateTool = {
   },
   annotations: READ_ONLY,
   async handler(args, context) {
-    const prepared = await prepare(args, context, outDirOverride(args));
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     let result;
@@ -8799,7 +9338,12 @@ var readTool = {
         `${relativePath} is not in the snapshot. Call snapshot_locate to find the path, or snapshot_explain to learn why it was excluded.`
       );
     }
-    const partPath = path10__namespace.resolve(workspace.root, workspace.config.outDir, "parts", entry.part);
+    const partPath = partPathFor(workspace, entry.part);
+    if (partPath === null) {
+      return failure(
+        `${entry.part} is not a part of this snapshot: its name leaves ${workspace.config.outDir}/parts. Run snapshot_generate to rebuild it.`
+      );
+    }
     let partText;
     try {
       partText = fs8__namespace.readFileSync(partPath, "utf8");
@@ -8879,7 +9423,8 @@ var explainTool = {
         description: "Path relative to the repository root. Directories are explained as a whole."
       },
       root: ROOT_PROPERTY,
-      outDir: OUT_DIR_PROPERTY
+      outDir: OUT_DIR_PROPERTY,
+      ...SCOPE_PROPERTIES
     },
     required: ["path"],
     additionalProperties: false
@@ -8894,7 +9439,7 @@ var explainTool = {
   },
   annotations: READ_ONLY,
   async handler(args, context) {
-    const prepared = await prepare(args, context, outDirOverride(args));
+    const prepared = await prepare(args, context, workspaceOverrides(args));
     if (!prepared.ok) return prepared.outcome;
     const workspace = prepared.workspace;
     if (typeof args.path !== "string") return failure('"path" must be a string.');
@@ -9607,7 +10152,7 @@ function buildAgentContract() {
         { key: "preset", type: "string", default: "detected", summary: "Force a preset. Unknown names are an error." },
         { key: "maxPartBytes", type: "number | string", default: 307200, summary: "Per-part byte budget." },
         { key: "maxPartTokens", type: "number | string | null", default: null, summary: "Per-part token ceiling; narrows maxPartBytes. Minimum 1024." },
-        { key: "skeleton", type: "boolean", default: false, summary: "Collapse function bodies to `{ /* ... */ }` in TypeScript files." },
+        { key: "skeleton", type: "boolean", default: false, summary: "Collapse function bodies to `{ /* ... */ }` in TS, JS, TSX and JSX files." },
         { key: "sarif", type: "boolean", default: false, summary: "Also write reports/audit.sarif." },
         { key: "changedSince", type: "string | null", default: null, summary: "Snapshot only files that differ from this git ref." },
         { key: "staged", type: "boolean", default: false, summary: "Snapshot only files staged in the index." },
@@ -9998,9 +10543,9 @@ function buildResourceProvider() {
         const index = Number(partMatch[1]);
         const part = read.manifest.parts.find((candidate) => candidate.index === index);
         if (!part) return null;
-        const text = readFileIfPresent(
-          path10__namespace.resolve(workspace.root, workspace.config.outDir, "parts", part.filename)
-        );
+        const partPath = partPathFor(workspace, part.filename);
+        if (partPath === null) return null;
+        const text = readFileIfPresent(partPath);
         if (text === null) return null;
         return { uri, mimeType: "text/markdown", text: capUtf8(text, MAX_RESOURCE_BYTES).text };
       }
@@ -10032,11 +10577,11 @@ var MAX_LINE_BYTES = 32 * 1024 * 1024;
 function createWriter(output) {
   return {
     write(value) {
-      return new Promise((resolve8, reject) => {
+      return new Promise((resolve9, reject) => {
         output.write(`${JSON.stringify(value)}
 `, (error) => {
           if (error) reject(error);
-          else resolve8();
+          else resolve9();
         });
       });
     }
@@ -10044,6 +10589,7 @@ function createWriter(output) {
 }
 function createLineReader(input, options) {
   let buffer = "";
+  let bufferBytes = 0;
   let discarding = false;
   let discardedBytes = 0;
   const deliver = (line) => {
@@ -10056,6 +10602,13 @@ function createLineReader(input, options) {
     if (trimmed.trim().length === 0) return;
     options.onLine(trimmed);
   };
+  const discardBuffered = () => {
+    discarding = true;
+    discardedBytes += bufferBytes;
+    buffer = "";
+    bufferBytes = 0;
+    options.onOverflow?.(discardedBytes);
+  };
   const drain = () => {
     let index = buffer.indexOf("\n");
     while (index >= 0) {
@@ -10063,42 +10616,57 @@ function createLineReader(input, options) {
       buffer = buffer.slice(index + 1);
       if (discarding) {
         deliver(line);
-      } else if (line.length > MAX_LINE_BYTES) {
-        options.onOverflow?.(line.length);
       } else {
-        deliver(line);
+        const lineBytes = Buffer.byteLength(line, "utf8");
+        if (lineBytes > MAX_LINE_BYTES) options.onOverflow?.(lineBytes);
+        else deliver(line);
       }
       index = buffer.indexOf("\n");
     }
+    bufferBytes = Buffer.byteLength(buffer, "utf8");
+    if (!discarding && bufferBytes > MAX_LINE_BYTES) discardBuffered();
   };
   const onData = (chunk) => {
+    const chunkBytes = Buffer.byteLength(chunk, "utf8");
     if (discarding) {
       const index = chunk.indexOf("\n");
       if (index < 0) {
-        discardedBytes += chunk.length;
+        discardedBytes += chunkBytes;
         return;
       }
       buffer = chunk.slice(index + 1);
+      bufferBytes = Buffer.byteLength(buffer, "utf8");
       deliver("");
       drain();
       return;
     }
-    buffer += chunk;
-    drain();
-    if (buffer.length > MAX_LINE_BYTES) {
+    if (chunk.indexOf("\n") < 0 && bufferBytes + chunkBytes > MAX_LINE_BYTES) {
       discarding = true;
-      discardedBytes = buffer.length;
+      discardedBytes = bufferBytes + chunkBytes;
       buffer = "";
+      bufferBytes = 0;
       options.onOverflow?.(discardedBytes);
       return;
     }
+    buffer += chunk;
+    drain();
   };
   const onEnd = () => {
-    if (buffer.length > 0) {
-      const rest = buffer;
-      buffer = "";
-      deliver(rest);
+    const rest = buffer;
+    const restBytes = bufferBytes || Buffer.byteLength(rest, "utf8");
+    buffer = "";
+    bufferBytes = 0;
+    if (rest.length === 0) return;
+    if (discarding) {
+      discarding = false;
+      discardedBytes = 0;
+      return;
+    }
+    if (restBytes > MAX_LINE_BYTES) {
+      options.onOverflow?.(restBytes);
+      return;
     }
+    deliver(rest);
   };
   input.setEncoding("utf8");
   input.on("data", onData);
@@ -10149,8 +10717,8 @@ async function runStdioServer(options) {
   let inFlight = 0;
   let inputEnded = false;
   let resolveDone = () => void 0;
-  const finished = new Promise((resolve8) => {
-    resolveDone = resolve8;
+  const finished = new Promise((resolve9) => {
+    resolveDone = resolve9;
   });
   const finishIfIdle = () => {
     if (inputEnded && inFlight === 0) resolveDone(0);