etymd 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # etymd
 
+## 0.12.0
+
+### Minor Changes
+
+- 060c50b: screen: forks can exempt upstream-owned files from vocabulary-class patterns
+
+  A fork that syncs from upstream stages hundreds of upstream files; a pattern that
+  matches ordinary wording (a "vocabulary" pattern, e.g. words a leaky _description_
+  would use) then fires on upstream's own already-public docs and blocks the sync
+  commit. This adds:
+
+  - **Pattern classes.** A `# class: vocabulary` directive in the pattern file marks
+    the patterns beneath it as vocabulary; everything else stays `secret`. Files with
+    no directive are unchanged — every pattern absolute.
+  - **Upstream ownership by blob identity.** With `--upstream <remote>` or
+    `git config etymd.upstream <remote>`, a staged/tree file whose content matches any
+    blob at the tips of `refs/remotes/<remote>/*` is upstream-owned, and its
+    vocabulary-class patterns are skipped. Secret-class patterns and the machine-path
+    check stay absolute everywhere. Matching is by blob sha across all upstream refs,
+    so a file copied verbatim to a different path (an adapter lifted from another
+    upstream branch) is still recognised, and a file the fork _modifies_ is screened
+    in full.
+  - **Fails closed and loud.** If the upstream ref cannot be read (a rebuild dropped
+    the remote), nothing is exempted and a one-line notice says so — the config signal
+    persists so the fork still knows it is a fork.
+
+## 0.11.0
+
+### Minor Changes
+
+- 1193d71: Content screen: allow-file entries carry provenance, and the env bypasses are gone
+
+  Every exemption is a hole in the gate, and a hole with no name on it lives forever — nobody can
+  ask "is this still needed?" about an entry nobody signed. Repo-level exceptions now live in
+  `.etymd-screen-allow` (the previous `.artifact-check-allow` is still honoured) as records of
+  labeled lines:
+
+  ```
+  pattern ^/Users/someone
+  reason test fixture for machine-path detector
+  date 2026-08-15
+  author owner
+  ```
+
+  The pattern is the rest of its line, verbatim — it may contain any character, `|` included,
+  without escaping. Delimiting a free-form field in-band would be an ambiguity in the format
+  itself, and every parser-side guard against it only makes the misparses you imagined loud while
+  leaving the rest silent; the line break is the one boundary the field cannot contain.
+
+  An entry naming the repo itself needs no provenance — a bare `^widget$` line is a complete
+  record, the exemption being exactly as wide as the name. Anything else missing a field is
+  reported and does not apply, so an unprovenanced file reads as noise to fix, not as silence to
+  trust.
+
+  The two environment bypasses the generated hooks carried — `CONTENT_GATE_PREPUSH` and
+  `ARTIFACT_CHECK_SKIP` — are removed. They were off-switches invisible in the tree: nothing in
+  the repo records that a gate was skipped, or why. The allow file is the one bypass path left,
+  and every entry in it says who exempted what, when, and for what reason.
+
+  Generated hooks now resolve their screener in a defined order: an explicit `CONTENT_GATE`, then
+  the repo's own `./dist/cli.js` when it builds one, then the `etymd` on PATH. The middle step is
+  the dogfood case — a repo developing the screener must gate on its own unreleased build, or its
+  hooks enforce the last published behaviour against a tree that has moved past it. Repos without
+  a `dist/` resolve exactly as before. Pack v8 — run `etymd gates` to pick it up.
+
+### Patch Changes
+
+- 652a353: Dependency advisories, 2026-08 batch: vitest 2.1.8 → 4.1.10, @changesets/cli 2.27.11 → 2.31.1,
+  tsup 8.3.5 → 8.5.1, plus in-range transitive fixes (js-yaml, nanoid, postcss, tmp)
+
+  Clears the whole advisory list reachable in range, then the vitest 2 → 4 major the rest of it
+  needed — the deliberate migration, not an audit-chased one: all 260 tests pass on 4.1.10
+  unchanged, config needed nothing, and the esbuild/vite/vitest development-server exposure class
+  (file read and execution via a listening dev server) is closed rather than reasoned around.
+
+  What remains is one low: esbuild 0.27.3–0.28.0, arbitrary file read when running a development
+  server on Windows, reached only through tsup (which pins ^0.27.0). Forcing an override past
+  tsup's declared range is audit-chasing a code path this repo never enters — nothing in it
+  starts a listening dev server — so it waits for a tsup release that carries esbuild 0.28.
+
+- 9521732: Content screen: a clean run reports itself, with the file count
+
+  A clean `etymd screen` printed nothing at all — the summary header, file count and binary-skip
+  count only appeared when there were findings. From inside a hook, where the exit code is the
+  only other signal, "silent" and "never looked" were indistinguishable, which is the exact
+  failure the binary-skip disclosure exists to prevent (0.9.1 claimed the count is always
+  reported; on a clean run it never was).
+
+  Every run now prints its summary line — scope, files scanned, binary skipped — and a clean run
+  says so. Hooks gain one line per successful commit; a silent screen remains possible only
+  where the screener is absent, which the tool already reports as inert rather than clean.
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -338,8 +338,29 @@ packaged into a published release while every git-scoped check passes forever.
 
 Every generated hook resolves the screener at run time and **no-ops when it is absent**, so the
 same hook file is safe to commit to a public repo: it carries no patterns and imposes no policy
-on anyone who clones it. A deliberate exception is marked inline with `allow-published-string`,
-visible in the diff rather than hidden in an allowlist.
+on anyone who clones it. A deliberate exception on a line you can edit is marked inline with
+`allow-published-string`, visible in the diff.
+
+Some exemptions cannot live on the line itself: a scanner's own source contains the strings it
+screens for, its tests contain fixtures that must match, and a bundler strips comments so an
+inline marker would not survive into the artifact. Those live in `.etymd-screen-allow` at the
+repo root — one labeled line per field, so the pattern is never delimited:
+
+```
+pattern ^AcmeCorp|BetaCorp$
+reason fixture proving the detector fires on either name
+date 2026-08-15
+author someone
+```
+
+A pattern may contain any character, including the `|` shown above, without escaping: a
+free-form field delimited in-band is an ambiguity in the format itself, and no amount of
+parser-side guarding fixes that class — labels move the boundary to the line break, which the
+field cannot contain. An entry naming the repo itself needs no provenance — a bare `^widget$`
+line is a complete record, the exemption being exactly as wide as the name. Anything else
+missing a field is reported and does not apply: an exemption is a hole in the gate, and a hole
+nobody signed cannot be audited later. The file is read from the repo being screened, never a
+shared location, and it screens itself out (it necessarily contains every string it exempts).
 
 ### The commit subject, if you ask for it
 

package/dist/{approve-6TMXJLOI.js → approve-PP2QJQ3Y.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-WTD2EIMN.js';
-import { VERSION } from './chunk-K34AVLDP.js';
-import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-C7LBUFNU.js';
-import { PACK_VERSION } from './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';
+import { scanProject } from './chunk-MTVEJ33D.js';
+import { VERSION } from './chunk-YFNRDXUY.js';
+import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-JHZ2BN4U.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';
 
 // src/commands/approve.ts
 async function run(opts) {

package/dist/audit-BXHJUTMJ.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+export { run } from './chunk-SWA4NQHB.js';
+import './chunk-O3PHW4OP.js';
+import './chunk-F75Q43BC.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-DWL2IKZH.js';
+import './chunk-5BVKFJWM.js';
+import './chunk-MTVEJ33D.js';
+import './chunk-YFNRDXUY.js';
+import './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';

package/dist/{brief-X64HK325.js → brief-GDLJEG6X.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-WTD2EIMN.js';
-import './chunk-K34AVLDP.js';
-import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
-import './chunk-OIYNP6Y6.js';
-import './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { scanProject } from './chunk-MTVEJ33D.js';
+import './chunk-YFNRDXUY.js';
+import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 async function run(opts) {
   const facts = await scanProject(opts.cwd);

package/dist/{chunk-V2SOHPXF.js → chunk-2VLNI3L2.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readLedger, resolveEntry, writeLedger } from './chunk-OAFYLBVG.js';
+import { readLedger, resolveEntry, writeLedger } from './chunk-3E2IPCRY.js';
 import { print, renderLedger, glyph, theme } from './chunk-5BVKFJWM.js';
 
 // src/commands/ledger.ts

package/dist/{chunk-OAFYLBVG.js → chunk-3E2IPCRY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { readJson } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 function ledgerPath(root) {
   return path.join(root, ".etymd", "ledger.json");

package/dist/{chunk-IV3FYVTS.js → chunk-4VPBP6K6.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { execFile } from 'node:child_process';
-import { promises } from 'node:fs';
-import { promisify } from 'node:util';
+import { execFile } from 'child_process';
+import { promises } from 'fs';
+import 'path';
+import { promisify } from 'util';
 
 var pExecFile = promisify(execFile);
 async function pathExists(p) {

package/dist/{chunk-YVGC3E6U.js → chunk-DWL2IKZH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
-import { pathExists, readText } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
+import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
+import { pathExists, readText } from './chunk-4VPBP6K6.js';
+import path from 'path';
 
 var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {

package/dist/{chunk-IPOAD67U.js → chunk-F75Q43BC.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-YVGC3E6U.js';
-import { readText, wordCount, approxTokens, pathExists } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
+import { readText, wordCount, approxTokens, pathExists } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 var ALWAYS_LOADED = [
   { path: "AGENTS.md", role: "operating contract" },

package/dist/{chunk-EF6BPBG6.js → chunk-GWGKEPRX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { promises } from 'fs';
+import path from 'path';
 
 async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
   const written = [];

package/dist/{chunk-R6CVJ5D7.js → chunk-HRJJQCMT.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-YVGC3E6U.js';
-import { PACK_VERSION } from './chunk-OIYNP6Y6.js';
-import { readText, pathExists } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
-import { createHash } from 'node:crypto';
+import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { readText, pathExists } from './chunk-4VPBP6K6.js';
+import path from 'path';
+import { createHash } from 'crypto';
 
 var GENERATION_MARKER_RE = /^(?:# |<!-- )etymd:generated pack-v\S+ ([0-9a-f]{16})(?: -->)?$/;
 function digestOf(body) {
@@ -132,7 +132,7 @@ ${[
     "md"
   );
 }
-var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(if [ -x ./dist/cli.js ]; then echo ./dist/cli.js; else command -v etymd || true; fi)}"`;
 function localHookCall(hook) {
   return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
 # is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
@@ -280,7 +280,7 @@ ${auditStep}
 # with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
 # never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
 ${CONTENT_GATE_RESOLUTION}
-if [ -x "$GATE" ] && [ "\${CONTENT_GATE_PREPUSH:-1}" = "1" ]; then
+if [ -x "$GATE" ]; then
   "$GATE" screen --tree --advisory || true
 fi
 
@@ -294,14 +294,10 @@ function generateArtifactCheckScript() {
 # Wire it into the irreversible moment:
 #   package.json \u2192 "prepublishOnly": "./scripts/artifact-check.sh"
 #
-# No-op where no checker is installed. Bypass is deliberate and loud: ARTIFACT_CHECK_SKIP=1.
+# The artifact gate is the one check that sees what actually SHIPS \u2014 bypass with
+# .etymd-screen-allow entries (with provenance) if you must exempt a string.
 set -eu
 
-if [ "\${ARTIFACT_CHECK_SKIP:-0}" = "1" ]; then
-  echo "\u203A artifact-check: SKIPPED by ARTIFACT_CHECK_SKIP=1"
-  exit 0
-fi
-
 ${CONTENT_GATE_RESOLUTION}
 [ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
 

package/dist/{chunk-C7LBUFNU.js → chunk-JHZ2BN4U.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { readJson } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 var ETYMD_DIR = ".etymd";
 var CACHE_DIR = path.join(ETYMD_DIR, "cache");

package/dist/{chunk-OIYNP6Y6.js → chunk-LSZGCKIQ.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 // src/pack/version.ts
-var PACK_VERSION = "7";
+var PACK_VERSION = "8";
 
 export { PACK_VERSION };

package/dist/{chunk-WTD2EIMN.js → chunk-MTVEJ33D.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-K34AVLDP.js';
-import { PACK_VERSION } from './chunk-OIYNP6Y6.js';
-import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
-import { promises } from 'node:fs';
+import { VERSION } from './chunk-YFNRDXUY.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-4VPBP6K6.js';
+import path from 'path';
+import { promises } from 'fs';
 
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",

package/dist/{chunk-KQMQJJZK.js → chunk-O3PHW4OP.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-IPOAD67U.js';
-import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-OAFYLBVG.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-YVGC3E6U.js';
-import { scanProject, expandFileGlobs } from './chunk-WTD2EIMN.js';
-import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-C7LBUFNU.js';
-import { PACK_VERSION } from './chunk-OIYNP6Y6.js';
-import { pathExists, readJson, readText, isDirectory, matchesAnyGlob, git, normalizeRelPath, isCiEnvironment, isExecutable } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
+import { measureContext } from './chunk-F75Q43BC.js';
+import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-3E2IPCRY.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-DWL2IKZH.js';
+import { scanProject, expandFileGlobs } from './chunk-MTVEJ33D.js';
+import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-JHZ2BN4U.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { pathExists, readJson, readText, isDirectory, matchesAnyGlob, git, normalizeRelPath, isCiEnvironment, isExecutable } from './chunk-4VPBP6K6.js';
+import path from 'path';
 import YAML from 'yaml';
-import { promises } from 'node:fs';
+import { promises } from 'fs';
 
 // src/engine/finding.ts
 var TIER_ORDER = { risk: 0, gap: 1, polish: 2 };

package/dist/{chunk-SGW7OPHZ.js → chunk-SWA4NQHB.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-KQMQJJZK.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-O3PHW4OP.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-5BVKFJWM.js';
 
 // src/commands/audit.ts

package/dist/{chunk-K34AVLDP.js → chunk-YFNRDXUY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.10.0"};
+  version: "0.12.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-K34AVLDP.js';
-import path from 'node:path';
+import { VERSION } from './chunk-YFNRDXUY.js';
+import path from 'path';
 import { Command } from 'commander';
 import pc from 'picocolors';
 
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-FGDX2AYS.js');
+    const { run } = await import('./audit-BXHJUTMJ.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-YYGRFIHQ.js');
+    const { run } = await import('./init-EKQ33WYS.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,49 +52,49 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-6TMXJLOI.js');
+    const { run } = await import('./approve-PP2QJQ3Y.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-VO776GM7.js');
+    const { run } = await import('./scan-XS4JPS7J.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-W3UZK7KS.js');
+    const { run } = await import('./doctor-7SLSUSVK.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("context").description("Measure the always-loaded context footprint and flag extraction candidates").option("--json", "print the budget as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./context-K6DZNWAV.js');
+    const { run } = await import('./context-F63RSIBH.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-X64HK325.js');
+    const { run } = await import('./brief-GDLJEG6X.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
 program.command("ledger").description("List every tracked finding grouped by status (open \xB7 accepted \xB7 dismissed \xB7 \u2026)").option("--json", "print the raw ledger as JSON").action(
   (opts, cmd) => action(async () => {
-    const { list } = await import('./ledger-B2XGANTH.js');
+    const { list } = await import('./ledger-4FOZ5HAB.js');
     await list({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("dismiss").argument("<finding-id>", "the finding id (from `etymd audit`) to dismiss").description("Dismiss a finding as a false positive / not applicable (hidden from future audits)").requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").action(
   (id, opts, cmd) => action(async () => {
-    const { dismiss } = await import('./ledger-B2XGANTH.js');
+    const { dismiss } = await import('./ledger-4FOZ5HAB.js');
     await dismiss({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
 program.command("accept").argument("<finding-id>", "the finding id (from `etymd audit`) to accept").description("Accept a real finding as a known trade-off (hidden from future audits)").option("--reason <text>", "optional note on why the trade-off is accepted").action(
   (id, opts, cmd) => action(async () => {
-    const { accept } = await import('./ledger-B2XGANTH.js');
+    const { accept } = await import('./ledger-4FOZ5HAB.js');
     await accept({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-4PPNUIDJ.js');
+    const { sweep } = await import('./fleet-5NVOUIZD.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +126,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-4PPNUIDJ.js');
+    const { check } = await import('./fleet-5NVOUIZD.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +136,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-4PPNUIDJ.js');
+    const { add } = await import('./fleet-5NVOUIZD.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -159,7 +159,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-4PPNUIDJ.js');
+    const { dismiss } = await import('./fleet-5NVOUIZD.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -174,29 +174,33 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-4PPNUIDJ.js');
+    const { accept } = await import('./fleet-5NVOUIZD.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
 );
 program.command("screen").description(
   "Content screen: check for text that must never be published. Bring your own patterns \u2014 etymd ships none."
-).option("--staged", "screen what a commit is about to add (default)").option("--tree", "screen every tracked file \u2014 what is about to leave the machine").option("--message <file>", "screen a commit message (the commit-msg hook's $1)").option("--dir <dir>", "screen an unpacked build artifact \u2014 what actually ships").option("--patterns <file>", "pattern file (default: ~/.config/etymd/screen-patterns)").option("--advisory", "report without failing").action(
+).option("--staged", "screen what a commit is about to add (default)").option("--tree", "screen every tracked file \u2014 what is about to leave the machine").option("--message <file>", "screen a commit message (the commit-msg hook's $1)").option("--dir <dir>", "screen an unpacked build artifact \u2014 what actually ships").option("--patterns <file>", "pattern file (default: ~/.config/etymd/screen-patterns)").option("--advisory", "report without failing").option(
+  "--upstream <remote>",
+  "fork's upstream remote: files byte-identical to its refs skip vocabulary-class patterns (secret patterns stay absolute)"
+).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./screen-MOQP6XC7.js');
+    const { run } = await import('./screen-UF7VZ26C.js');
     const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
     await run({
       cwd: resolveCwd(cmd),
       scope,
       target: opts.message ?? opts.dir,
       patterns: opts.patterns,
-      advisory: opts.advisory
+      advisory: opts.advisory,
+      upstream: opts.upstream
     });
   })
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-Q7FMVUQP.js');
+    const { run } = await import('./gates-OS5V3P4C.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/config-XAH6PA5G.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-DWL2IKZH.js';
+import './chunk-JHZ2BN4U.js';
+import './chunk-4VPBP6K6.js';

package/dist/{context-K6DZNWAV.js → context-F63RSIBH.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-IPOAD67U.js';
-import { readConfig } from './chunk-YVGC3E6U.js';
+import { measureContext } from './chunk-F75Q43BC.js';
+import { readConfig } from './chunk-DWL2IKZH.js';
 import { print, renderContext } from './chunk-5BVKFJWM.js';
-import './chunk-C7LBUFNU.js';
-import './chunk-IV3FYVTS.js';
+import './chunk-JHZ2BN4U.js';
+import './chunk-4VPBP6K6.js';
 
 // src/commands/context.ts
 async function run(opts) {

package/dist/doctor-7SLSUSVK.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { run } from './chunk-SWA4NQHB.js';
+import './chunk-O3PHW4OP.js';
+import './chunk-F75Q43BC.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-DWL2IKZH.js';
+import './chunk-5BVKFJWM.js';
+import './chunk-MTVEJ33D.js';
+import './chunk-YFNRDXUY.js';
+import './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';
+
+// src/commands/doctor.ts
+async function run2(opts) {
+  await run({ cwd: opts.cwd, json: opts.json, truth: true });
+}
+
+export { run2 as run };

package/dist/{fleet-4PPNUIDJ.js → fleet-5NVOUIZD.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-import { dismiss, accept } from './chunk-V2SOHPXF.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-KQMQJJZK.js';
-import './chunk-IPOAD67U.js';
-import { readLedger } from './chunk-OAFYLBVG.js';
-import { DEFAULT_CONFIG } from './chunk-YVGC3E6U.js';
+import { dismiss, accept } from './chunk-2VLNI3L2.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-O3PHW4OP.js';
+import './chunk-F75Q43BC.js';
+import { readLedger } from './chunk-3E2IPCRY.js';
+import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-WTD2EIMN.js';
-import './chunk-K34AVLDP.js';
-import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
-import './chunk-OIYNP6Y6.js';
-import { readText, pathExists, git, isDirectory } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
+import { scanProject } from './chunk-MTVEJ33D.js';
+import './chunk-YFNRDXUY.js';
+import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import { readText, pathExists, git, isDirectory } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import os from 'os';
+import path from 'path';
 import { select, isCancel, cancel, text, confirm } from '@clack/prompts';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
 
 var FLEET_TRUST_VALUES = ["public-repo", "public-bound", "private"];
 function isFleetTrust(value) {
@@ -687,9 +687,9 @@ async function checkCorpEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-NLHGTRZB.js');
-  const { scanProject: scanProject2 } = await import('./scan-PJSZGUG7.js');
-  const { readConfig } = await import('./config-TPK5LYDM.js');
+  const { planWorkflow } = await import('./generate-PMCP37DC.js');
+  const { scanProject: scanProject2 } = await import('./scan-N4BKVL5F.js');
+  const { readConfig } = await import('./config-XAH6PA5G.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;