etymd 0.17.0 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # etymd
 
+## 0.19.1
+
+### Patch Changes
+
+- 51ecbc9: Generated pre-push hooks shellcheck every commit in the pushed range, each materialised from
+  git's object store, instead of reading the working tree. A push whose tip is clean but whose
+  earlier commits carry a broken script is now refused; the working tree no longer substitutes
+  for the pushed bytes; a push that creates a branch checks every commit no remote already has;
+  and a commit that cannot be materialised refuses the push rather than passing as unread.
+  Regenerate existing hooks with `etymd gates --yes` to apply the correction.
+
+## 0.19.0
+
+### Minor Changes
+
+- 29c7b31: The Claude Code pointer check follows Claude Code 2.1.277, which reads `AGENTS.md` when a
+  directory has no `CLAUDE.md`. A repo with `AGENTS.md` alone now passes and `fleet add` registers
+  it; it is reported (`claude-pointer-missing`, tier gap) only when the installed Claude Code is
+  older than 2.1.277, and `fleet add` prints a note instead of refusing. A `CLAUDE.md` that exists
+  without importing `@AGENTS.md` stays a risk and a refusal, because Claude Code reads that file
+  instead on every version. The version is read from `claude --version`; `ETYMD_CLAUDE_VERSION`
+  pins it, and `none` means no Claude Code on the machine.
+
+### Patch Changes
+
+- 3dd2683: Dependency advisories cleared inside the declared ranges. `vitest` 4.1.10 → 4.1.11 closes
+  GHSA-82fw-gwwq-j7x9 (moderate: path traversal / arbitrary file read through the `@vitest/mocker`
+  redirect mock), and `js-yaml` 4.3.1 → 4.3.2 with its transitive 3.15.1 → 3.15.2 closes
+  GHSA-2883-xcg3-v3hh (high: `maxTotalMergeKeys` does not limit CPU use for empty merge sources).
+  Both are dev-only — the test runner and the changeset tooling — so the published build is
+  byte-identical; the lockfile also picks up the range-satisfying refresh those two pull in.
+
+  One advisory stays open, and deliberately: GHSA-g7r4-m6w7-qqqr (low: `esbuild` allows an arbitrary
+  file read when its development server runs on Windows) is fixed in esbuild 0.28.1, while `tsup`
+  8.5.1 — the newest release — declares `esbuild: ^0.27.0`, so no in-range version of esbuild carries
+  the fix. The only automatic fix on offer is a downgrade to esbuild 0.27.2, which gives up five
+  patch releases to dodge a dev-server path this repo never takes: the build runs tsup, never an
+  esbuild server. It clears once tsup widens its range.
+
+- 7d4e81f: `core.hooksPath` is read the way git reads it: a repo-relative path, an absolute path and a `~`
+  path can all name one directory, and the directory is the fact. An absolute path to the tracked
+  `.githooks/` now scans as `githooks` (wired) instead of `custom`, and the hooks are read from the
+  directory git actually runs — the literal-string comparison had also joined the absolute path
+  onto the repo root and looked for hooks at a path that does not exist, so a working pre-push gate
+  could read as absent. The fact is recorded repo-relative whenever the directory sits inside the
+  worktree, so a committed baseline never carries a machine path; a hooks directory outside the
+  repo stays absolute and is disclosed as `custom`.
+
+## 0.18.0
+
+### Minor Changes
+
+- 41b91f6: Generated pre-push hooks preserve long filenames, whitespace, quotes, and leading
+  hyphens during shell-script discovery and checking, and a name carrying shell metacharacters
+  reaches the scan as data, never as code. Discovery fails closed instead of reporting success
+  with incomplete coverage: failed enumeration blocks, and a tracked regular file that exists
+  but cannot be read blocks, naming the file. Tracked paths with nothing readable behind them —
+  submodule entries, dangling symlinks, files deleted from the worktree while still tracked —
+  are counted and disclosed as skipped rather than blocking, so a submodule can no longer wedge
+  every push. Shebang reads are bounded to the first 4 KiB of the first line, so a large binary
+  cannot be copied into the gate's scratch file on every push and a shebang embedded deeper in
+  a document no longer drags the whole document into the checker. Regenerate existing hooks
+  with `etymd gates --yes` to apply the correction.
+- 4a92435: The shebang classifier ships as a tracked, shebanged helper beside the hook
+  (`.githooks/discover-shell-scripts.sh`), so the scan it implements finds and checks it too —
+  the gate covers its own classifier, and the hook's most intricate code is lintable on its
+  own lines.
+
 ## 0.17.0
 
 ### Minor Changes

package/README.md

@@ -174,7 +174,7 @@ personal and guarded repos. See [the fleet manifest](#the-fleet-manifest-experim
 | Command                          | What it does                                                                                                                                                                                                                                                        |
 | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                                                                                                          |
-| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                                                                                                        |
+| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**, with its `CLAUDE.md` pointer. Never overwrites.                                                                                                                          |
 | `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                                                                                                          |
 | `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                                                                                                         |
 | `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts — and from the repo's shell surface, where it has one.                                                             |
@@ -188,7 +188,7 @@ personal and guarded repos. See [the fleet manifest](#the-fleet-manifest-experim
 | `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                                                                                                     |
 | `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.                                                                              |
 | `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                                                                                                     |
-| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                                                                            |
+| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field, or a repo whose `AGENTS.md` Claude Code cannot see. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                        |
 | `etymd fleet board`              | Render the fleet board: every project's `MILESTONES.md` (contract key `milestones`, shape-checked by the sweep) plus a ranked initiatives table on one page. `--initiatives <file>`, `--out <file>`, `--json`.                                                      |
 | `etymd propose`                  | Score the sweep's improvement findings + recurring classes against a fleet-authored rubric — stable `proposal/1` records, read-only, deterministic, guarded entries excluded. `--rubric <file>` (required), `--manifest <file>` or `--from <fleet.json>`, `--json`. |
 | `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; guarded findings persist beside the manifest, never in the guarded worktree.                                                                                                                              |
@@ -520,7 +520,11 @@ Two fields the scan can never derive, so the manifest must declare them:
 
 `etymd fleet add <dir>` is the gate that keeps both true: it scans the project, prompts for what
 no scan can derive, and **refuses to write an incomplete entry**. Non-interactive runs (`--yes`,
-CI) must pass every mandatory value as a flag — there is deliberately no default.
+CI) must pass every mandatory value as a flag — there is deliberately no default. It also refuses
+a repo whose `CLAUDE.md` hides its `AGENTS.md`: Claude Code reads `CLAUDE.md` when one exists and
+falls back to `AGENTS.md` (from 2.1.277) only when none does, so a `CLAUDE.md` must import
+`@AGENTS.md` or be a symlink to it — the refusal prints the fix. A repo with `AGENTS.md` alone
+registers; on a Claude Code older than 2.1.277 it gets a note, since that version cannot see it.
 
 How the sweep behaves:
 
@@ -543,8 +547,9 @@ How the sweep behaves:
 - **Wall checks.** Guarded contract files found inside a guarded worktree, unregistered checkouts
   under the fleet root whose remotes match `guardedHosts`, tracked `/Users/` paths in the manifest
   repo, private **needles** — the identifiers the local file holds (labels, dir names, hosts) —
-  inside `trust: "public-repo"` entries, and guarded-host commit emails on personal entries — each
-  a risk finding; each check that cannot run is disclosed.
+  inside `trust: "public-repo"` entries, guarded-host commit emails on personal entries, and
+  repos whose `AGENTS.md` no `CLAUDE.md` pointer or symlink makes visible to Claude Code
+  (`claude-pointer-missing`) — each a risk finding; each check that cannot run is disclosed.
 - **No global pointer.** `--manifest` is required unless the cwd holds `registry.json` — there
   is deliberately no env var and no home-directory pointer.
 - **Milestones and the fleet board.** A project declares its plan in one file — `MILESTONES.md`,

package/dist/{approve-VN4EDBR5.js → approve-J6JU7MBX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-446EZNAQ.js';
-import { VERSION } from './chunk-BUMOGHQA.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import { VERSION } from './chunk-KQFEKOON.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-YQZDYDAK.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/approve.ts

package/dist/audit-5N2TU2X7.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+export { run } from './chunk-GFUDKTC5.js';
+import './chunk-UMKC3OWQ.js';
+import './chunk-WKP72Z3J.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-HI7NWPRA.js';
+import './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-2DRA7S67.js';
+import './chunk-4VPBP6K6.js';

package/dist/{brief-7MWP35UI.js → brief-NHHILXIH.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-446EZNAQ.js';
-import './chunk-BUMOGHQA.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
-import './chunk-YQZDYDAK.js';
+import './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{chunk-YQZDYDAK.js → chunk-2DRA7S67.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 // src/pack/version.ts
-var PACK_VERSION = "12";
+var PACK_VERSION = "15";
 
 export { PACK_VERSION };

package/dist/{chunk-446EZNAQ.js → chunk-6DJMKZGK.js}

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-BUMOGHQA.js';
-import { PACK_VERSION } from './chunk-YQZDYDAK.js';
-import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-4VPBP6K6.js';
+import { VERSION } from './chunk-KQFEKOON.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
+import { normalizeRelPath, isDirectory, pathExists, readText, readJson, git, matchesAnyGlob } from './chunk-4VPBP6K6.js';
 import path from 'path';
+import { execFile } from 'child_process';
 import { promises } from 'fs';
+import { promisify } from 'util';
 
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -265,10 +267,17 @@ async function hasLintStagedConfig(root, pkg) {
   }
   return false;
 }
+function normalizeHooksPath(root, raw) {
+  const abs = path.resolve(root, raw);
+  const rel = path.relative(root, abs);
+  const outside = path.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path.sep}`);
+  return outside ? abs : normalizeRelPath(rel) || ".";
+}
 async function detectHooks(root, hooksPath, pkg) {
   const lintStaged = await hasLintStagedConfig(root, pkg);
   if (hooksPath) {
-    if (hooksPath.replace(/\/+$/, "") === ".husky/_") {
+    const dir = normalizeHooksPath(root, hooksPath);
+    if (dir === ".husky/_") {
       const base2 = path.join(root, ".husky");
       return {
         source: "husky",
@@ -279,10 +288,10 @@ async function detectHooks(root, hooksPath, pkg) {
         lintStaged
       };
     }
-    const base = path.join(root, hooksPath);
+    const base = path.resolve(root, dir);
     return {
-      source: hooksPath === ".githooks" ? "githooks" : "custom",
-      dir: hooksPath,
+      source: dir === ".githooks" ? "githooks" : "custom",
+      dir,
       preCommit: await pathExists(path.join(base, "pre-commit")),
       prePush: await pathExists(path.join(base, "pre-push")),
       commitMsg: await pathExists(path.join(base, "commit-msg")),
@@ -438,6 +447,69 @@ async function detectArtifacts(root) {
   });
   return artifacts;
 }
+var ROOT_POINTER_IMPORT_RE = /^\s*@(\.\/)?AGENTS\.md\s*$/m;
+var DOT_CLAUDE_IMPORT_RE = /^\s*@\.\.\/AGENTS\.md\s*$/m;
+var CLAUDE_AGENTS_FALLBACK_VERSION = "2.1.277";
+var pExecFile = promisify(execFile);
+var claudeVersionMemo;
+function detectClaudeCodeVersion() {
+  const override = process.env.ETYMD_CLAUDE_VERSION;
+  if (override !== void 0) {
+    return Promise.resolve(override === "none" || override === "" ? null : override);
+  }
+  claudeVersionMemo ??= pExecFile("claude", ["--version"], { timeout: 5e3 }).then(({ stdout }) => /(\d+\.\d+\.\d+)/.exec(stdout)?.[1] ?? null).catch(() => null);
+  return claudeVersionMemo;
+}
+function versionBefore(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y) return x < y;
+  }
+  return false;
+}
+async function checkClaudePointer(root, claudeVersion) {
+  const agentsAbs = path.join(root, "AGENTS.md");
+  const claudeAbs = path.join(root, "CLAUDE.md");
+  if (!await pathExists(agentsAbs)) return { ok: true, via: "no-agents" };
+  const statOrNone = async (p) => {
+    try {
+      return await promises.stat(p);
+    } catch {
+      return null;
+    }
+  };
+  const [agentsSt, claudeSt] = await Promise.all([statOrNone(agentsAbs), statOrNone(claudeAbs)]);
+  if (agentsSt && claudeSt && agentsSt.ino !== 0 && agentsSt.ino === claudeSt.ino && agentsSt.dev === claudeSt.dev) {
+    return { ok: true, via: "same-file" };
+  }
+  const rootClaude = await readText(claudeAbs);
+  if (rootClaude !== null && ROOT_POINTER_IMPORT_RE.test(rootClaude)) {
+    return { ok: true, via: "root-import" };
+  }
+  const dotClaude = await readText(path.join(root, ".claude", "CLAUDE.md"));
+  if (dotClaude !== null && DOT_CLAUDE_IMPORT_RE.test(dotClaude)) {
+    return { ok: true, via: "dotclaude-import" };
+  }
+  if (rootClaude !== null || dotClaude !== null) {
+    return {
+      ok: false,
+      kind: "no-import",
+      detail: rootClaude !== null ? "AGENTS.md and CLAUDE.md both present, but CLAUDE.md does not import it" : "AGENTS.md and .claude/CLAUDE.md both present, but .claude/CLAUDE.md does not import it"
+    };
+  }
+  const version = claudeVersion === void 0 ? await detectClaudeCodeVersion() : claudeVersion;
+  if (version !== null && versionBefore(version, CLAUDE_AGENTS_FALLBACK_VERSION)) {
+    return {
+      ok: false,
+      kind: "old-reader",
+      detail: `AGENTS.md present, no CLAUDE.md, and Claude Code ${version} predates the AGENTS.md fallback (${CLAUDE_AGENTS_FALLBACK_VERSION})`
+    };
+  }
+  return { ok: true, via: "native-fallback" };
+}
 async function walkTree(root) {
   const state = { budget: 2e4, truncated: false };
   const countFiles = async (dir) => {
@@ -558,11 +630,12 @@ async function scanProject(root, opts = {}) {
   const [branch, head, hooksPathRaw, authorsRaw, subjectsRaw] = isRepo ? await Promise.all([
     git(abs, ["rev-parse", "--abbrev-ref", "HEAD"]),
     git(abs, ["rev-parse", "--short", "HEAD"]),
-    git(abs, ["config", "--get", "core.hooksPath"]),
+    // `--type=path` expands a leading `~` the way git itself does when it runs the hooks.
+    git(abs, ["config", "--type=path", "--get", "core.hooksPath"]),
     git(abs, ["log", "-200", "--format=%ae"]),
     git(abs, ["log", "-50", "--format=%s"])
   ]) : [null, null, null, null, null];
-  const hooksPath = hooksPathRaw ?? void 0;
+  const hooksPath = hooksPathRaw ? normalizeHooksPath(abs, hooksPathRaw) : void 0;
   const hooks = await detectHooks(abs, hooksPath, rootPkg);
   const shell = await detectShellSurface(abs, isRepo);
   const freshness = await collectFreshness(abs, isRepo, artifacts, opts.upstreamRemote);
@@ -602,4 +675,4 @@ async function scanProject(root, opts = {}) {
   };
 }
 
-export { expandFileGlobs, scanProject };
+export { CLAUDE_AGENTS_FALLBACK_VERSION, checkClaudePointer, expandFileGlobs, scanProject };

package/dist/chunk-7N5JDXQG.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import { isSafeGateCommand, generateAgentsMd, generateClaudePointerMd, isSelfBuildRepo, generatePreCommitHook, generateCommitMsgHook, generatePrePushHook, generateShellDiscoveryScript, generateArtifactCheckScript, fileOrigin } from './chunk-PQISPOB2.js';
+import { DEFAULT_CONFIG } from './chunk-P6ATKV2R.js';
+import { readText, pathExists } from './chunk-4VPBP6K6.js';
+import path from 'path';
+
+function derivedCommands(facts, existingHook) {
+  const c = facts.commands;
+  const base = [c.formatCheck, c.typecheck, c.lint].filter(
+    (k) => Boolean(k) && isSafeGateCommand(c.raw[k])
+  );
+  if (c.test && existingHook && new RegExp(`\\b${c.test}\\b`).test(existingHook)) {
+    base.push(c.test);
+  }
+  return base;
+}
+function riskReachability(facts) {
+  const reasons = [];
+  if (facts.publishRoute !== "none") {
+    reasons.push("an instruction file can name a package script that no longer exists");
+  }
+  if (facts.artifacts.some((a) => a.kind === "state" && a.exists)) {
+    reasons.push("a state doc can fall far enough behind the repo to escalate");
+  }
+  return reasons;
+}
+function deriveFailOn(facts, recorded) {
+  const reachable = riskReachability(facts);
+  if (recorded.explicit) return { failOn: recorded.failOn, source: "config", reachable };
+  if (recorded.failOn === "risk" && reachable.length === 0) {
+    return { failOn: "gap", source: "derived", reachable };
+  }
+  return { failOn: recorded.failOn, source: "default", reachable };
+}
+async function planWorkflow(root, facts, opts) {
+  const out = [];
+  const add = async (rel, contents, label, executable = false) => {
+    const abs = path.join(root, rel);
+    const exists = await pathExists(abs);
+    const existing = exists ? await readText(abs) : null;
+    const differs = exists ? existing !== contents : void 0;
+    const origin = differs && existing !== null ? fileOrigin(existing) : void 0;
+    out.push({
+      path: rel,
+      contents,
+      exists,
+      differs,
+      drift: origin === "pack" ? "stale" : origin,
+      executable,
+      label
+    });
+  };
+  if (opts.agents) {
+    await add("AGENTS.md", generateAgentsMd(facts), "Minimal operating contract (scaffold)");
+    await add("CLAUDE.md", generateClaudePointerMd(), "Claude Code pointer to AGENTS.md");
+  }
+  if (opts.gates) {
+    const existingPrePush = await readText(path.join(root, ".githooks", "pre-push"));
+    const selfBuild = isSelfBuildRepo(facts);
+    await add(
+      ".githooks/pre-commit",
+      generatePreCommitHook(selfBuild),
+      "Process gate (pre-commit)",
+      true
+    );
+    await add(
+      ".githooks/commit-msg",
+      generateCommitMsgHook(opts.gateConfig),
+      "Message gate (content screen, format)",
+      true
+    );
+    const gateConfig = opts.gateConfig?.commands?.length ? opts.gateConfig : {
+      commands: derivedCommands(facts, existingPrePush ?? void 0),
+      failOn: opts.gateConfig?.failOn ?? DEFAULT_CONFIG.gates.failOn,
+      publishGate: opts.gateConfig?.publishGate,
+      commitFormat: opts.gateConfig?.commitFormat,
+      allowWriting: opts.gateConfig?.allowWriting ?? []
+    };
+    const tier = deriveFailOn(facts, {
+      failOn: gateConfig.failOn,
+      explicit: opts.gateFailOnPinned ?? false
+    });
+    await add(
+      ".githooks/pre-push",
+      generatePrePushHook(facts, { ...gateConfig, failOn: tier.failOn }, selfBuild),
+      "Correctness gate (pre-push)",
+      true
+    );
+    if (facts.shell?.scripts) {
+      await add(
+        ".githooks/discover-shell-scripts.sh",
+        generateShellDiscoveryScript(),
+        "Shell discovery (pre-push shellcheck helper)",
+        true
+      );
+    }
+    if (opts.gateConfig?.publishGate ?? opts.publishGate ?? facts.publishable) {
+      await add(
+        "scripts/artifact-check.sh",
+        generateArtifactCheckScript(selfBuild),
+        "Content screen (published artifact)",
+        true
+      );
+    }
+  }
+  return out;
+}
+
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability };

package/dist/{chunk-ANFNXFRI.js → chunk-GFUDKTC5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-WKP7M2B3.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-FNA4R5KT.js';
+import { runAudit } from './chunk-UMKC3OWQ.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-WKP72Z3J.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-HI7NWPRA.js';
 
 // src/commands/audit.ts

package/dist/{chunk-BUMOGHQA.js → chunk-KQFEKOON.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.17.0"};
+  version: "0.19.1"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-LVR2DPR7.js → chunk-M7XDP6FT.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-WKP7M2B3.js';
+import { runAudit } from './chunk-UMKC3OWQ.js';
 import { readLedger } from './chunk-3E2IPCRY.js';
+import { checkClaudePointer, CLAUDE_AGENTS_FALLBACK_VERSION } from './chunk-6DJMKZGK.js';
 import { DEFAULT_CONFIG, ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, git, pathExists } from './chunk-4VPBP6K6.js';
 import os from 'os';
@@ -1005,8 +1006,8 @@ async function checkGuardedEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-FSJQFQPV.js');
-  const { scanProject } = await import('./scan-5SC47FSM.js');
+  const { planWorkflow } = await import('./generate-62GQSCKH.js');
+  const { scanProject } = await import('./scan-F6OW4ANK.js');
   const { readConfig } = await import('./config-724Y3IOB.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
@@ -1066,6 +1067,31 @@ async function checkGateDrift(manifest, findings, disclosures) {
     }
   }
 }
+async function checkClaudePointers(manifest, findings) {
+  for (const entry of manifest.entries) {
+    const root = entry.resolvedRoot;
+    if (!root || !await isDirectory(root)) continue;
+    const check = await checkClaudePointer(root);
+    if (check.ok) continue;
+    findings.push(
+      check.kind === "no-import" ? finding(
+        `${FLEET_LENS}/claude-pointer-missing:${entry.name}`,
+        "risk",
+        `\`${entry.name}\` has a CLAUDE.md that never imports its AGENTS.md`,
+        [`${entry.name}: ${check.detail}`],
+        "Claude Code reads CLAUDE.md when one exists and falls back to AGENTS.md only when none does. A CLAUDE.md without the import shadows AGENTS.md, so the contract looks universal from inside the repo while Claude Code never receives it.",
+        "Add a full-line `@AGENTS.md` import to that CLAUDE.md, symlink either file to the other, or delete the CLAUDE.md if AGENTS.md is the whole contract."
+      ) : finding(
+        `${FLEET_LENS}/claude-pointer-missing:${entry.name}`,
+        "gap",
+        `\`${entry.name}\` relies on the AGENTS.md fallback, which the installed Claude Code predates`,
+        [`${entry.name}: ${check.detail}`],
+        `Claude Code reads AGENTS.md on its own only from ${CLAUDE_AGENTS_FALLBACK_VERSION}; older releases load CLAUDE.md alone, so this repo's contract is invisible to them.`,
+        "Update Claude Code, or create a CLAUDE.md beside AGENTS.md whose only import line is `@AGENTS.md`."
+      )
+    );
+  }
+}
 async function collectWallFindings(manifest) {
   const findings = [];
   const disclosures = [];
@@ -1075,6 +1101,7 @@ async function collectWallFindings(manifest) {
   await checkHygieneNeedles(manifest, findings, disclosures);
   await checkGuardedEmails(manifest, findings, disclosures);
   await checkGateDrift(manifest, findings, disclosures);
+  await checkClaudePointers(manifest, findings);
   return { findings, disclosures };
 }
 function stateAgeDays(facts) {