etymd 0.13.0 → 0.14.0

package/dist/index.js

@@ -20,7 +20,7 @@ var __export = (target, all) => {
 var PACK_VERSION;
 var init_version = __esm({
   "src/pack/version.ts"() {
-    PACK_VERSION = "8";
+    PACK_VERSION = "12";
   }
 });
 
@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.13.0",
+      version: "0.14.0",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -1136,15 +1136,36 @@ ${[
     "md"
   );
 }
+function isSelfBuildRepo(facts) {
+  return facts.publishRoute !== "none" && facts.name === SELF_PACKAGE_NAME;
+}
+function contentGateResolution(selfBuild) {
+  if (!selfBuild) return `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+  return `GATE="\${CONTENT_GATE:-$(if [ -x ./dist/cli.js ]; then echo ./dist/cli.js; else command -v etymd || true; fi)}"`;
+}
+function contentScreenCall(opts) {
+  const { args, envVar, blocking, indent } = opts;
+  const hint = `etymd: this checker does not understand 'screen' (needs etymd 0.11+) \u2014 upgrade it, or set ${envVar} to a checker that does.`;
+  return [
+    `${indent}if ! "$GATE" screen ${args}; then`,
+    `${indent}  "$GATE" screen --help >/dev/null 2>&1 ||`,
+    `${indent}    echo "${hint}" >&2`,
+    ...blocking ? [`${indent}  exit 1`] : [],
+    `${indent}fi`
+  ].join("\n");
+}
 function localHookCall(hook) {
   return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
 # is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
+# A guard running tests that build fixture repositories should scrub git's exported GIT_* names
+# first \u2014 a child git inherits them and ignores its cwd, so the suite would hit the real repo:
+#   env $(env | grep -o '^GIT_[A-Za-z0-9_]*' | sed 's/^/-u /') <your command>
 LOCAL="$(dirname "$0")/${hook}.local"
 if [ -x "$LOCAL" ]; then
   "$LOCAL" "$@" || exit 1
 fi`;
 }
-function generatePreCommitHook() {
+function generatePreCommitHook(selfBuild = false) {
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: process gate. Cheap, locally-knowable checks belong here (fast, blocks the commit).
 
@@ -1156,9 +1177,9 @@ ${localHookCall("pre-commit")}
 # commit anywhere, active only where you opted in.
 #
 # Bypass, with a reason: git commit --no-verify
-${CONTENT_GATE_RESOLUTION}
+${contentGateResolution(selfBuild)}
 if [ -x "$GATE" ]; then
-  "$GATE" screen --staged || exit 1
+${contentScreenCall({ args: "--staged", envVar: "CONTENT_GATE", blocking: true, indent: "  " })}
 fi
 
 exit 0
@@ -1199,7 +1220,7 @@ function generateCommitMsgHook(gates) {
 # Bypass, with a reason: git commit --no-verify
 GATE="\${COMMIT_MSG_GATE:-$(command -v etymd || true)}"
 if [ -x "$GATE" ]; then
-  "$GATE" screen --message "$1" || exit 1
+${contentScreenCall({ args: '--message "$1"', envVar: "COMMIT_MSG_GATE", blocking: true, indent: "  " })}
 fi
 ${format}
 ${localHookCall("commit-msg")}
@@ -1210,11 +1231,24 @@ exit 0
 function shellcheckStep() {
   return `
 # Shell correctness. Scripts are discovered by shebang over TRACKED files at push time, so a
-# script added later is covered without regenerating this hook.
+# script added later is covered without regenerating this hook. zsh is NOT in the checked set:
+# the checker cannot parse it (SC1071 is a parser-level error no inline directive can silence),
+# so checking it would fail every push on the parser, not on the script. Excluded \u2014 and said so
+# at run time below, because a coverage hole that is silent is indistinguishable from coverage.
+#
+# "the checker", not its name, on purpose: a comment whose first word is that name is read as
+# a DIRECTIVE, and an unparseable directive is itself an error (SC1072/SC1073). A hook that
+# explains why it skips a shell dialect must not break the checker while doing it.
 if command -v shellcheck >/dev/null 2>&1; then
   scripts=$(git ls-files -z \\
-    | xargs -0 -I{} sh -c 'head -1 "{}" 2>/dev/null | grep -qE "^#!.*[/ ](ba|da|z)?sh( |$)" && echo "{}"' \\
+    | xargs -0 -I{} sh -c 'head -1 "{}" 2>/dev/null | grep -qE "^#!.*[/ ](ba|da)?sh( |$)" && echo "{}"' \\
     | sort)
+  zsh_scripts=$(git ls-files -z \\
+    | xargs -0 -I{} sh -c 'head -1 "{}" 2>/dev/null | grep -qE "^#!.*[/ ]zsh( |$)" && echo "{}"' \\
+    | sort)
+  if [ -n "$zsh_scripts" ]; then
+    echo "\u203A shellcheck: $(printf '%s\\n' "$zsh_scripts" | wc -l | tr -d ' ') zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
+  fi
   if [ -n "$scripts" ]; then
     echo "\u203A shellcheck ($(printf '%s\\n' "$scripts" | wc -l | tr -d ' ') scripts, blocking at severity=warning)"
     printf '%s\\n' "$scripts" | xargs shellcheck -S warning || {
@@ -1234,7 +1268,7 @@ else
   echo "\u203A shellcheck skipped (not on PATH) \u2014 install it to gate this repo's shell scripts"
 fi`;
 }
-function generatePrePushHook(facts, gates) {
+function generatePrePushHook(facts, gates, selfBuild = false) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
   const candidates = gates?.commands?.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
@@ -1243,8 +1277,9 @@ function generatePrePushHook(facts, gates) {
     (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
   ).map((key) => `${run} ${key}`);
   const shellStep = facts.shell?.scripts ? shellcheckStep() : "";
+  const runner = steps.length ? SCRUBBED_RUNNER : "";
   const body = steps.length ? steps.map((s) => `echo "\u203A ${s}"
-${s} || exit 1`).join("\n") : shellStep ? (
+run_gate ${s} || exit 1`).join("\n") : shellStep ? (
     // A repo whose executable surface is shell HAS a correctness command — it just is not in
     // package.json. Claiming "none detected" beside a step that is about to run would be the
     // tool contradicting itself.
@@ -1261,22 +1296,22 @@ fi`;
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
 
-${localHookCall("pre-push")}
+${localHookCall("pre-push")}${runner}
 ${body}${shellStep}
 ${auditStep}
 
 # Content screen, second pass \u2014 the WHOLE TREE rather than one diff. Catches anything committed
 # with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
 # never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
-${CONTENT_GATE_RESOLUTION}
+${contentGateResolution(selfBuild)}
 if [ -x "$GATE" ]; then
-  "$GATE" screen --tree --advisory || true
+${contentScreenCall({ args: "--tree --advisory", envVar: "CONTENT_GATE", blocking: false, indent: "  " })}
 fi
 
 exit 0
 `);
 }
-function generateArtifactCheckScript() {
+function generateArtifactCheckScript(selfBuild = false) {
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: content screen \u2014 the published ARTIFACT, not the repository.
 #
@@ -1287,7 +1322,7 @@ function generateArtifactCheckScript() {
 # .etymd-screen-allow entries (with provenance) if you must exempt a string.
 set -eu
 
-${CONTENT_GATE_RESOLUTION}
+${contentGateResolution(selfBuild)}
 [ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
 
 WORK=$(mktemp -d)
@@ -1300,16 +1335,16 @@ if [ -f package.json ]; then
   tar -xzf "$WORK"/*.tgz -C "$WORK" 2>/dev/null || true
 fi
 
-"$GATE" screen --dir "$WORK" || exit 1
+${contentScreenCall({ args: '--dir "$WORK"', envVar: "CONTENT_GATE", blocking: true, indent: "" })}
 exit 0
 `);
 }
-var GENERATION_MARKER_RE, CONTENT_GATE_RESOLUTION, COMMIT_TYPES, SUBJECT_ADVISORY_LENGTH;
+var GENERATION_MARKER_RE, SELF_PACKAGE_NAME, COMMIT_TYPES, SUBJECT_ADVISORY_LENGTH, SCRUBBED_RUNNER;
 var init_templates = __esm({
   "src/pack/templates.ts"() {
     init_version();
     GENERATION_MARKER_RE = /^(?:# |<!-- )etymd:generated pack-v\S+ ([0-9a-f]{16})(?: -->)?$/;
-    CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(if [ -x ./dist/cli.js ]; then echo ./dist/cli.js; else command -v etymd || true; fi)}"`;
+    SELF_PACKAGE_NAME = "etymd";
     COMMIT_TYPES = [
       "feat",
       "fix",
@@ -1324,6 +1359,14 @@ var init_templates = __esm({
       "revert"
     ];
     SUBJECT_ADVISORY_LENGTH = 72;
+    SCRUBBED_RUNNER = `
+# Gate steps run scrubbed of git's exported GIT_* names: a child git that inherits them ignores
+# its cwd, so a hook-run suite building fixture repositories would operate on the real repo.
+run_gate() (
+  # shellcheck disable=SC2046  # word-splitting is the point: one -u per exported GIT_* name
+  env $(env | grep -o '^GIT_[A-Za-z0-9_]*' | sed 's/^/-u /') "$@"
+)
+`;
   }
 });
 
@@ -1386,7 +1429,13 @@ async function planWorkflow(root, facts, opts) {
   }
   if (opts.gates) {
     const existingPrePush = await readText(path2.join(root, ".githooks", "pre-push"));
-    await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
+    const selfBuild = isSelfBuildRepo(facts);
+    await add(
+      ".githooks/pre-commit",
+      generatePreCommitHook(selfBuild),
+      "Process gate (pre-commit)",
+      true
+    );
     await add(
       ".githooks/commit-msg",
       generateCommitMsgHook(opts.gateConfig),
@@ -1402,14 +1451,14 @@ async function planWorkflow(root, facts, opts) {
     };
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, gateConfig),
+      generatePrePushHook(facts, gateConfig, selfBuild),
       "Correctness gate (pre-push)",
       true
     );
     if (opts.gateConfig?.publishGate ?? opts.publishGate ?? facts.publishable) {
       await add(
         "scripts/artifact-check.sh",
-        generateArtifactCheckScript(),
+        generateArtifactCheckScript(selfBuild),
         "Content screen (published artifact)",
         true
       );
@@ -1446,14 +1495,36 @@ function isAlwaysAppliedCursorRule(text) {
   const frontmatter = fm[1] ?? "";
   return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
 }
+async function inodeKey(abs) {
+  try {
+    const st = await promises.stat(abs);
+    return st.ino ? `${st.dev}:${st.ino}` : null;
+  } catch {
+    return null;
+  }
+}
+function contextFileLabel(file) {
+  return file.aliases?.length ? [file.path, ...file.aliases].join(" \u2192 ") : file.path;
+}
 async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
   const files = [];
+  const byInode = /* @__PURE__ */ new Map();
+  const record = async (rel, role, text) => {
+    const words = wordCount(text);
+    const key = await inodeKey(path2.join(root, rel));
+    const seen = key ? byInode.get(key) : void 0;
+    if (seen) {
+      seen.aliases = [...seen.aliases ?? [], rel];
+      return;
+    }
+    const file = { path: rel, role, words, approxTokens: approxTokens(words) };
+    if (key) byInode.set(key, file);
+    files.push(file);
+  };
   for (const spec of ALWAYS_LOADED) {
-    const abs = path2.join(root, spec.path);
-    const text = await readText(abs);
+    const text = await readText(path2.join(root, spec.path));
     if (text === null) continue;
-    const words = wordCount(text);
-    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
+    await record(spec.path, spec.role, text);
   }
   const rulesDir = path2.join(root, ".cursor", "rules");
   if (await pathExists(rulesDir)) {
@@ -1462,13 +1533,7 @@ async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
         if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
         const text = await readText(path2.join(rulesDir, entry));
         if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
-        const words = wordCount(text);
-        files.push({
-          path: `.cursor/rules/${entry}`,
-          role: "Cursor rule (always applied)",
-          words,
-          approxTokens: approxTokens(words)
-        });
+        await record(`.cursor/rules/${entry}`, "Cursor rule (always applied)", text);
       }
     } catch {
     }
@@ -1525,13 +1590,15 @@ var contextEconomyLens = {
     const budgets = ctx.config?.config.context ?? DEFAULT_CONFIG.context;
     const budget = await measureContext(ctx.root, budgets.perFileWords);
     const findings = [];
+    const aliased = budget.files.filter((f) => f.aliases?.length);
     for (const f of budget.extractionCandidates) {
+      const label = contextFileLabel(f);
       findings.push({
         id: `${LENS_ID}/heavy-file:${f.path}`,
         lens: LENS_ID,
         tier: "gap",
-        claim: `${f.path} loads ${f.words} words (~${f.approxTokens} tokens) into every session`,
-        evidence: [`${f.path}: ${f.words} words`],
+        claim: `${label} loads ${f.words} words (~${f.approxTokens} tokens) into every session`,
+        evidence: [`${label}: ${f.words} words`],
         why: "Reference material that loads every session taxes attention and cost on tasks that never need it.",
         action: "Extract the reference bulk into an on-demand skill/doc and keep a pointer.",
         effort: "M",
@@ -1544,7 +1611,7 @@ var contextEconomyLens = {
         lens: LENS_ID,
         tier: "gap",
         claim: `The always-loaded footprint is ${budget.totalWords} words (~${budget.totalApproxTokens} tokens) \u2014 over the ${budgets.totalWords}-word budget`,
-        evidence: budget.files.slice(0, 5).map((f) => `${f.path}: ${f.words}w`),
+        evidence: budget.files.slice(0, 5).map((f) => `${contextFileLabel(f)}: ${f.words}w`),
         why: "Every session pays this before the task begins; instruction-following degrades as the resident context grows.",
         action: "Run `etymd context` for the per-file breakdown and extract the heaviest block.",
         effort: "M",
@@ -1559,6 +1626,9 @@ var contextEconomyLens = {
       status: "ran",
       disclosures: [
         ...ctx.config?.problems ?? [],
+        ...aliased.map(
+          (f) => `${contextFileLabel(f)} are one file (same inode) \u2014 counted once, at ${f.words} words.`
+        ),
         `Budgets: ${budgets.perFileWords} words/file, ${budgets.totalWords} words total (${budgets.perFileWords === DEFAULT_CONFIG.context.perFileWords && budgets.totalWords === DEFAULT_CONFIG.context.totalWords ? `defaults \u2014 override under \`context\` in ${CONFIG_FILE}` : `set in ${CONFIG_FILE}`}). Scoped Cursor rules excluded.`
       ],
       findings
@@ -1966,6 +2036,73 @@ async function buildGateInventory(root, facts) {
   };
 }
 
+// src/lenses/gate-integrity/screener.ts
+init_util();
+var pExecFile2 = promisify(execFile);
+var HOOK_FILES = ["pre-commit", "pre-push", "commit-msg"];
+var SCREEN_CALL_RE = /"\$GATE"\s+screen\b/;
+var DEV_BUILD_ARM = "[ -x ./dist/cli.js ]";
+async function probeScreener(root, facts) {
+  const absent = {
+    present: false,
+    doors: [],
+    runner: null,
+    source: null,
+    answersScreen: null
+  };
+  const dir = facts.hooks.dir;
+  if (!dir) return absent;
+  const doors = [];
+  let devBuildArm = false;
+  for (const name of HOOK_FILES) {
+    const text = await readText(path2.join(root, dir, name));
+    if (!text || !SCREEN_CALL_RE.test(text)) continue;
+    doors.push(`${dir}/${name}`);
+    if (text.includes(DEV_BUILD_ARM)) devBuildArm = true;
+  }
+  if (!doors.length) return absent;
+  let runner = null;
+  let source = null;
+  const override = process.env.CONTENT_GATE;
+  if (override) {
+    runner = override;
+    source = "CONTENT_GATE";
+  } else if (devBuildArm && await pathExists(path2.join(root, "dist", "cli.js"))) {
+    runner = path2.join(root, "dist", "cli.js");
+    source = "dev-build";
+  } else {
+    runner = "etymd";
+    source = "path";
+  }
+  try {
+    await pExecFile2(runner, ["screen", "--help"], { cwd: root, timeout: 1e4 });
+    return { present: true, doors, runner, source, answersScreen: true };
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      return {
+        present: true,
+        doors,
+        runner: null,
+        source,
+        answersScreen: null,
+        skipped: `no checker named \`${runner}\` is installed \u2014 the screen doors no-op here by design, and nothing was verified.`
+      };
+    }
+    if (e.killed || e.code === "ETIMEDOUT") {
+      return {
+        present: true,
+        doors,
+        runner,
+        source,
+        answersScreen: null,
+        skipped: `\`${runner} screen --help\` did not return within 10s \u2014 the runner was not verified either way.`
+      };
+    }
+    return { present: true, doors, runner, source, answersScreen: false };
+  }
+}
+
 // src/lenses/gate-integrity/lens.ts
 var LENS_ID2 = "gate-integrity";
 var CORRECTNESS_TOOLS = ["typecheck", "lint", "format-check", "test"];
@@ -2108,6 +2245,28 @@ function deriveGateFindings(inv, disclosures = []) {
 function localToolInHook(inv, tool) {
   return inv.local.preCommit.includes(tool) || inv.local.prePush.includes(tool) || inv.local.commitMsg.includes(tool);
 }
+function deriveScreenerFindings(probe, disclosures) {
+  if (!probe.present) return [];
+  if (probe.skipped) {
+    disclosures.push(`Content screen: ${probe.skipped}`);
+    return [];
+  }
+  if (probe.answersScreen !== false) return [];
+  const via = probe.source === "CONTENT_GATE" ? "resolved from the CONTENT_GATE override" : probe.source === "dev-build" ? "resolved to this repo's own ./dist/cli.js build" : "resolved from PATH";
+  return [
+    finding({
+      id: `${LENS_ID2}/content-screen-unrunnable`,
+      tier: "risk",
+      kind: "truth",
+      claim: `The content screen resolves to \`${probe.runner}\`, which does not understand \`screen\` \u2014 the gate cannot run`,
+      evidence: [...probe.doors, `${probe.runner} screen --help \u2192 failed (${via})`],
+      why: "The commit door fails closed on an error that explains nothing, and the push door \u2014 advisory by design \u2014 skips the whole-tree pass in silence, so the repo reads as screened when nothing screened it.",
+      action: "Install or upgrade etymd (`screen` needs 0.11+), or point CONTENT_GATE at a checker that provides it, then re-run `etymd gates` to refresh the hooks.",
+      effort: "S",
+      confidence: "high"
+    })
+  ];
+}
 var gateIntegrityLens = {
   id: LENS_ID2,
   version: "1",
@@ -2148,6 +2307,7 @@ var gateIntegrityLens = {
     if (inv.ci.system === "none")
       disclosures.push("No CI configuration found \u2014 CI\u2194local comparisons skipped.");
     const findings = deriveGateFindings(inv, disclosures);
+    findings.push(...deriveScreenerFindings(await probeScreener(ctx.root, ctx.facts), disclosures));
     return {
       lens: LENS_ID2,
       version: "1",
@@ -2692,8 +2852,23 @@ var KNOWN_DOC_REFS = [
   "DECISIONS.md",
   "GEMINI.md"
 ];
+var PATH_TOKEN_CHARS = /[A-Za-z0-9_.$~/-]/;
 function extractDocRefs(text) {
-  return KNOWN_DOC_REFS.filter((name) => text.includes(name));
+  const refs = [];
+  let tildeSkipped = 0;
+  for (const name of KNOWN_DOC_REFS) {
+    let claimed = false;
+    let at = text.indexOf(name);
+    while (at !== -1) {
+      let head = at;
+      while (head > 0 && PATH_TOKEN_CHARS.test(text[head - 1])) head -= 1;
+      if (text[head] === "~") tildeSkipped += 1;
+      else claimed = true;
+      at = text.indexOf(name, at + name.length);
+    }
+    if (claimed) refs.push(name);
+  }
+  return { refs, tildeSkipped };
 }
 
 // src/lenses/instruction-truth/lens.ts
@@ -2816,6 +2991,7 @@ var instructionTruthLens = {
     const nodeModulesInstalled = await pathExists(path2.join(root, "node_modules"));
     const manifestExists = await pathExists(path2.join(root, "package.json")) || facts.packages.length > 0;
     let totalFilteredSkipped = 0;
+    let totalTildeSkipped = 0;
     let binaryResolved = 0;
     let unverifiableCommands = 0;
     let gitignoredSkipped = 0;
@@ -2905,7 +3081,9 @@ var instructionTruthLens = {
           break;
         }
       }
-      for (const ref of extractDocRefs(file.text)) {
+      const { refs: docRefs, tildeSkipped } = extractDocRefs(file.text);
+      totalTildeSkipped += tildeSkipped;
+      for (const ref of docRefs) {
         if (await pathExists(path2.join(root, ref))) continue;
         findings.push(
           finding2({
@@ -3010,6 +3188,11 @@ var instructionTruthLens = {
         `${placeholderSkipped} path claim(s) are naming stand-ins (e.g. \`my-custom-skill\`) rather than real references; skipped, not flagged.`
       );
     }
+    if (totalTildeSkipped) {
+      disclosures.push(
+        `${totalTildeSkipped} well-known doc mention(s) sit inside \`~/\` home paths (e.g. \`~/.claude/CLAUDE.md\`) \u2014 machine-global files, not this repo's; skipped, not flagged.`
+      );
+    }
     if (stateDocs.length) {
       disclosures.push(
         `Checked ${stateDocs.length} state document(s) for command, path, and decision-reference claims (same skip classes as instruction files); decision ids resolved against ${ledgerSources.length ? ledgerSources.join(", ") : "nothing \u2014 no decisions file with D-NNN entries"}.`
@@ -3037,7 +3220,7 @@ var instructionTruthLens = {
       );
     }
     disclosures.push(
-      `Checked ${files.length} instruction file(s); commands resolved against root + ${facts.packages.length} workspace manifest(s) plus installed binaries; paths matched against root and package roots. Heuristics: workspace-filtered commands skipped (${totalFilteredSkipped}); tokens without a recognized extension treated as prose (a dir claim needs a trailing slash); gitignored claims unverifiable; create-this and stand-in path claims skipped; absolute/globbed/placeholder tokens skipped; framework-pattern staleness not checked.`
+      `Checked ${files.length} instruction file(s); commands resolved against root + ${facts.packages.length} workspace manifest(s) plus installed binaries; paths matched against root and package roots. Heuristics: workspace-filtered commands skipped (${totalFilteredSkipped}); tokens without a recognized extension treated as prose (a dir claim needs a trailing slash); gitignored claims unverifiable; create-this and stand-in path claims skipped; absolute/globbed/placeholder tokens skipped; doc mentions inside \`~/\` home paths skipped; framework-pattern staleness not checked.`
     );
     return {
       lens: LENS_ID4,
@@ -3470,7 +3653,7 @@ async function loadFleetManifest(manifestPath) {
 init_config();
 init_facts();
 init_util();
-var pExecFile2 = promisify(execFile);
+var pExecFile3 = promisify(execFile);
 var FLEET_LENS = "fleet-manifest";
 var FLEET_JSON_SCHEMA = "fleet-experimental-0.2";
 var CORP_WALL_ARTIFACTS = ["PROJECT_CONTEXT.md", "DECISIONS.md"];
@@ -3525,7 +3708,7 @@ function stateBudgetsFor(entry) {
 async function gitGrepFiles(root, needle, mode = "fixed") {
   try {
     const matchFlag = mode === "regex" ? "-E" : "-F";
-    const { stdout } = await pExecFile2("git", ["grep", "-I", "-l", matchFlag, "-e", needle], {
+    const { stdout } = await pExecFile3("git", ["grep", "-I", "-l", matchFlag, "-e", needle], {
       cwd: root,
       timeout: 8e3
     });

package/dist/{init-XJEYU2HC.js → init-AHA7VRRI.js}

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { planWorkflow } from './chunk-HRJJQCMT.js';
-import './chunk-DWL2IKZH.js';
-import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-YXOAPMQH.js';
-import { VERSION } from './chunk-D3R74TJ2.js';
-import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-JHZ2BN4U.js';
-import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { planWorkflow } from './chunk-UFNETE6P.js';
+import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-HI7NWPRA.js';
+import { scanProject } from './chunk-HWC6PKJM.js';
+import { VERSION } from './chunk-623W6KVC.js';
+import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-P6ATKV2R.js';
+import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { git, readText } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';
@@ -57,12 +56,14 @@ async function run(opts) {
   const hasContract = facts.artifacts.some((a) => a.id === "agents" && a.exists);
   let scaffoldAgents = false;
   if (!hasContract) {
-    scaffoldAgents = opts.yes ? true : guard(
-      await confirm({
-        message: "No AGENTS.md found \u2014 scaffold a minimal one from the reckoning?",
-        initialValue: true
-      })
-    );
+    if (opts.withAgents) scaffoldAgents = true;
+    else if (!opts.yes)
+      scaffoldAgents = guard(
+        await confirm({
+          message: "No AGENTS.md found \u2014 scaffold a minimal one from the reckoning?",
+          initialValue: true
+        })
+      );
   }
   let gates = false;
   if (facts.git.isRepo && facts.hooks.source === "none") {

package/dist/ledger-T54JDHGP.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+export { accept, dismiss, list } from './chunk-HOR4M6EC.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-HI7NWPRA.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-4VPBP6K6.js';

package/dist/scan-QRTH6HAP.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-HWC6PKJM.js';
+import './chunk-623W6KVC.js';
+import './chunk-YQZDYDAK.js';
+import './chunk-4VPBP6K6.js';

package/dist/{scan-B24RZAV2.js → scan-TVX3FKK4.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { print, renderFacts, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-YXOAPMQH.js';
-import './chunk-D3R74TJ2.js';
-import { writeCachedFacts } from './chunk-JHZ2BN4U.js';
-import './chunk-LSZGCKIQ.js';
+import { print, renderFacts, theme } from './chunk-HI7NWPRA.js';
+import { scanProject } from './chunk-HWC6PKJM.js';
+import './chunk-623W6KVC.js';
+import { writeCachedFacts } from './chunk-P6ATKV2R.js';
+import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/scan.ts

package/dist/{screen-CS6PSG7U.js → screen-E4FC7W5N.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { print, glyph, theme, section } from './chunk-5BVKFJWM.js';
+import { print, glyph, theme, section } from './chunk-HI7NWPRA.js';
+import './chunk-P6ATKV2R.js';
 import { git, readText, pathExists } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/audit-YRT4SWSQ.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-DSAQ5S5D.js';
-import './chunk-PXRLOEN5.js';
-import './chunk-F75Q43BC.js';
-import './chunk-3E2IPCRY.js';
-import './chunk-DWL2IKZH.js';
-import './chunk-5BVKFJWM.js';
-import './chunk-YXOAPMQH.js';
-import './chunk-D3R74TJ2.js';
-import './chunk-JHZ2BN4U.js';
-import './chunk-LSZGCKIQ.js';
-import './chunk-4VPBP6K6.js';

package/dist/chunk-F75Q43BC.js

@@ -1,59 +0,0 @@
-#!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
-import { readText, wordCount, approxTokens, pathExists } from './chunk-4VPBP6K6.js';
-import { promises } from 'fs';
-import path from 'path';
-
-var ALWAYS_LOADED = [
-  { path: "AGENTS.md", role: "operating contract" },
-  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
-  { path: "CLAUDE.md", role: "Claude Code pointer" },
-  { path: "GEMINI.md", role: "Gemini pointer" },
-  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
-  { path: ".cursorrules", role: "Cursor rules (legacy)" }
-];
-var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
-function isAlwaysAppliedCursorRule(text) {
-  const fm = text.match(/^---\n([\s\S]*?)\n---/);
-  if (!fm) return true;
-  const frontmatter = fm[1] ?? "";
-  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
-}
-async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
-  const files = [];
-  for (const spec of ALWAYS_LOADED) {
-    const abs = path.join(root, spec.path);
-    const text = await readText(abs);
-    if (text === null) continue;
-    const words = wordCount(text);
-    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
-  }
-  const rulesDir = path.join(root, ".cursor", "rules");
-  if (await pathExists(rulesDir)) {
-    try {
-      for (const entry of await promises.readdir(rulesDir)) {
-        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
-        const text = await readText(path.join(rulesDir, entry));
-        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
-        const words = wordCount(text);
-        files.push({
-          path: `.cursor/rules/${entry}`,
-          role: "Cursor rule (always applied)",
-          words,
-          approxTokens: approxTokens(words)
-        });
-      }
-    } catch {
-    }
-  }
-  const totalWords = files.reduce((s, f) => s + f.words, 0);
-  return {
-    files: files.sort((a, b) => b.words - a.words),
-    totalWords,
-    totalApproxTokens: approxTokens(totalWords),
-    perFileWords,
-    extractionCandidates: files.filter((f) => f.words >= perFileWords)
-  };
-}
-
-export { measureContext };