etymd 0.19.1 → 0.19.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # etymd
 
+## 0.19.2
+
+### Patch Changes
+
+- b46bbb9: Generated pre-push hooks check only the shell scripts each pushed commit changes, instead of
+  every script in every pushed commit's tree. A commit that changes the gate itself, its
+  classifier or a `.shellcheckrc` (deletions included) is still checked whole. So is the commit
+  that installs the gate, which reads a repo's existing scripts once. A commit with no shell
+  script says so. Pointer checks no longer accept an `@AGENTS.md` import inside a fenced code
+  block, an unreadable Claude Code version counts as too old instead of passing, and `init` warns
+  when a `CLAUDE.md` or `.claude/CLAUDE.md` hides `AGENTS.md`. Regenerate existing hooks with
+  `etymd gates --yes` to apply the change.
+
 ## 0.19.1
 
 ### Patch Changes

package/dist/{approve-J6JU7MBX.js → approve-Z4NMEGDM.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
-import { VERSION } from './chunk-KQFEKOON.js';
+import { scanProject } from './chunk-OKHNNWOV.js';
+import { VERSION } from './chunk-W6GGG4LG.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-2DRA7S67.js';
+import { PACK_VERSION } from './chunk-6FT7KSKU.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/approve.ts

package/dist/audit-4PGVS2TW.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+export { run } from './chunk-WYJFZ2MB.js';
+import './chunk-FG5XKFR2.js';
+import './chunk-DWPMANIC.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-HI7NWPRA.js';
+import './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-6FT7KSKU.js';
+import './chunk-4VPBP6K6.js';

package/dist/{brief-NHHILXIH.js → brief-2N6X3CFR.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import { scanProject } from './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{chunk-2DRA7S67.js → chunk-6FT7KSKU.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 // src/pack/version.ts
-var PACK_VERSION = "15";
+var PACK_VERSION = "16";
 
 export { PACK_VERSION };

package/dist/{chunk-WKP72Z3J.js → chunk-DWPMANIC.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { expandFileGlobs } from './chunk-6DJMKZGK.js';
+import { expandFileGlobs } from './chunk-OKHNNWOV.js';
 import { DEFAULT_CONFIG, CONFIG_FILE } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, matchesAnyGlob, normalizeRelPath, readJson, pathExists, git } from './chunk-4VPBP6K6.js';
 import path3 from 'path';

package/dist/{chunk-UMKC3OWQ.js → chunk-FG5XKFR2.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { stateFreshnessLens, rankFindings, listInstructionFiles, buildTruthEnv, emptyCounters, packageManagerUsage, checkDocRefs, listStateDocuments, loadDecisionLedger, checkDecisionRefs, checkTextClaims } from './chunk-WKP72Z3J.js';
+import { stateFreshnessLens, rankFindings, listInstructionFiles, buildTruthEnv, emptyCounters, packageManagerUsage, checkDocRefs, listStateDocuments, loadDecisionLedger, checkDecisionRefs, checkTextClaims } from './chunk-DWPMANIC.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-3E2IPCRY.js';
 import { measureContext, contextFileLabel } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
+import { scanProject } from './chunk-OKHNNWOV.js';
 import { DEFAULT_CONFIG, ETYMD_DIR, writeCachedFacts, readBaseline, readConfig, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE, CONFIG_FILE } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-2DRA7S67.js';
+import { PACK_VERSION } from './chunk-6FT7KSKU.js';
 import { pathExists, readText, readJson, isCiEnvironment, isExecutable } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import YAML from 'yaml';

package/dist/{chunk-6DJMKZGK.js → chunk-OKHNNWOV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-KQFEKOON.js';
-import { PACK_VERSION } from './chunk-2DRA7S67.js';
+import { VERSION } from './chunk-W6GGG4LG.js';
+import { PACK_VERSION } from './chunk-6FT7KSKU.js';
 import { normalizeRelPath, isDirectory, pathExists, readText, readJson, git, matchesAnyGlob } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { execFile } from 'child_process';
@@ -447,8 +447,23 @@ async function detectArtifacts(root) {
   });
   return artifacts;
 }
-var ROOT_POINTER_IMPORT_RE = /^\s*@(\.\/)?AGENTS\.md\s*$/m;
-var DOT_CLAUDE_IMPORT_RE = /^\s*@\.\.\/AGENTS\.md\s*$/m;
+var ROOT_POINTER_IMPORT_RE = /^ {0,3}@(\.\/)?AGENTS\.md[ \t]*$/m;
+var DOT_CLAUDE_IMPORT_RE = /^ {0,3}@\.\.\/AGENTS\.md[ \t]*$/m;
+function withoutFencedCode(text) {
+  const kept = [];
+  let fence = null;
+  for (const line of text.split("\n")) {
+    if (fence === null) {
+      const open = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+      if (open?.[1] && !(open[1][0] === "`" && open[2]?.includes("`"))) fence = open[1];
+      else kept.push(line);
+    } else {
+      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line)?.[1];
+      if (close && close[0] === fence[0] && close.length >= fence.length) fence = null;
+    }
+  }
+  return kept.join("\n");
+}
 var CLAUDE_AGENTS_FALLBACK_VERSION = "2.1.277";
 var pExecFile = promisify(execFile);
 var claudeVersionMemo;
@@ -457,18 +472,20 @@ function detectClaudeCodeVersion() {
   if (override !== void 0) {
     return Promise.resolve(override === "none" || override === "" ? null : override);
   }
-  claudeVersionMemo ??= pExecFile("claude", ["--version"], { timeout: 5e3 }).then(({ stdout }) => /(\d+\.\d+\.\d+)/.exec(stdout)?.[1] ?? null).catch(() => null);
+  claudeVersionMemo ??= pExecFile("claude", ["--version"], { timeout: 5e3 }).then(({ stdout }) => /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?=\s|$)/.exec(stdout)?.[1] ?? null).catch(() => null);
   return claudeVersionMemo;
 }
-function versionBefore(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
-  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-    const x = pa[i] ?? 0;
-    const y = pb[i] ?? 0;
+function mayPredate(a, b) {
+  const parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?$/.exec(v.trim());
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb) return true;
+  for (let i = 1; i <= 3; i++) {
+    const x = Number(pa[i]);
+    const y = Number(pb[i]);
     if (x !== y) return x < y;
   }
-  return false;
+  return pa[4] !== void 0 && pb[4] === void 0;
 }
 async function checkClaudePointer(root, claudeVersion) {
   const agentsAbs = path.join(root, "AGENTS.md");
@@ -486,11 +503,11 @@ async function checkClaudePointer(root, claudeVersion) {
     return { ok: true, via: "same-file" };
   }
   const rootClaude = await readText(claudeAbs);
-  if (rootClaude !== null && ROOT_POINTER_IMPORT_RE.test(rootClaude)) {
+  if (rootClaude !== null && ROOT_POINTER_IMPORT_RE.test(withoutFencedCode(rootClaude))) {
     return { ok: true, via: "root-import" };
   }
   const dotClaude = await readText(path.join(root, ".claude", "CLAUDE.md"));
-  if (dotClaude !== null && DOT_CLAUDE_IMPORT_RE.test(dotClaude)) {
+  if (dotClaude !== null && DOT_CLAUDE_IMPORT_RE.test(withoutFencedCode(dotClaude))) {
     return { ok: true, via: "dotclaude-import" };
   }
   if (rootClaude !== null || dotClaude !== null) {
@@ -501,7 +518,7 @@ async function checkClaudePointer(root, claudeVersion) {
     };
   }
   const version = claudeVersion === void 0 ? await detectClaudeCodeVersion() : claudeVersion;
-  if (version !== null && versionBefore(version, CLAUDE_AGENTS_FALLBACK_VERSION)) {
+  if (version !== null && mayPredate(version, CLAUDE_AGENTS_FALLBACK_VERSION)) {
     return {
       ok: false,
       kind: "old-reader",

package/dist/{chunk-7N5JDXQG.js → chunk-TZGRV7UY.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { isSafeGateCommand, generateAgentsMd, generateClaudePointerMd, isSelfBuildRepo, generatePreCommitHook, generateCommitMsgHook, generatePrePushHook, generateShellDiscoveryScript, generateArtifactCheckScript, fileOrigin } from './chunk-PQISPOB2.js';
+import { isSafeGateCommand, generateAgentsMd, generateClaudePointerMd, isSelfBuildRepo, generatePreCommitHook, generateCommitMsgHook, generatePrePushHook, generateShellDiscoveryScript, generateArtifactCheckScript, fileOrigin } from './chunk-X5GR2EJK.js';
 import { DEFAULT_CONFIG } from './chunk-P6ATKV2R.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';
 import path from 'path';

package/dist/{chunk-KQFEKOON.js → chunk-W6GGG4LG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.19.1"};
+  version: "0.19.2"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-M7XDP6FT.js → chunk-WIBN7PBH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-UMKC3OWQ.js';
+import { runAudit } from './chunk-FG5XKFR2.js';
 import { readLedger } from './chunk-3E2IPCRY.js';
-import { checkClaudePointer, CLAUDE_AGENTS_FALLBACK_VERSION } from './chunk-6DJMKZGK.js';
+import { checkClaudePointer, CLAUDE_AGENTS_FALLBACK_VERSION } from './chunk-OKHNNWOV.js';
 import { DEFAULT_CONFIG, ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, git, pathExists } from './chunk-4VPBP6K6.js';
 import os from 'os';
@@ -1006,8 +1006,8 @@ async function checkGuardedEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-62GQSCKH.js');
-  const { scanProject } = await import('./scan-F6OW4ANK.js');
+  const { planWorkflow } = await import('./generate-S5KGZIIM.js');
+  const { scanProject } = await import('./scan-M7STYIYQ.js');
   const { readConfig } = await import('./config-724Y3IOB.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;

package/dist/{chunk-GFUDKTC5.js → chunk-WYJFZ2MB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-UMKC3OWQ.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-WKP72Z3J.js';
+import { runAudit } from './chunk-FG5XKFR2.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-DWPMANIC.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-HI7NWPRA.js';
 
 // src/commands/audit.ts

package/dist/{chunk-PQISPOB2.js → chunk-X5GR2EJK.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { PACK_VERSION } from './chunk-2DRA7S67.js';
+import { PACK_VERSION } from './chunk-6FT7KSKU.js';
 import { createHash } from 'crypto';
 
 var GENERATION_MARKER_RE = /^(?:# |<!-- )etymd:generated pack-v\S+ ([0-9a-f]{16})(?: -->)?$/;
@@ -269,11 +269,11 @@ function generateShellDiscoveryScript() {
 # that EXISTS but cannot be read is the other branch \u2014 coverage would silently shrink, so it
 # fails, naming the path.
 #
-# The two \`[ "$?" -eq 1 ]\` guards are the match/error protocol: grep reports "no match" as 1
-# and a failure as 2 or more, and only the first is a verdict. Dropping the guard would let a
-# failing matcher pass as "not a shell script" \u2014 the exact silent coverage-shrink the
-# fail-closed rules exist to prevent. The checker does not associate \`$?\` with the enclosing
-# if-condition, which is why this shape survives the pass it serves; keep it that way.
+# The match/error protocol: grep reports "no match" as 1 and a failure as 2 or more, and only
+# the first is a verdict. Letting a failure fall through would pass a broken matcher as "not a
+# shell script" \u2014 the exact silent coverage-shrink the fail-closed rules exist to prevent. The
+# status is captured on the grep's own line (\`|| st=$?\`), so no command added later can come
+# between the grep and the check and silently replace the status being read.
 work=$1
 shift
 for file do
@@ -289,17 +289,22 @@ for file do
     exit 1
   }
   head -n 1 "$work/head-bytes" > "$work/first-line" || exit 1
-  if grep -qE "^#!.*[/ ](ba|da)?sh( |$)" "$work/first-line"; then
-    printf "./%s\\0" "$file" >> "$work/scripts" || exit 1
-    printf . >> "$work/count" || exit 1
-  else
-    [ "$?" -eq 1 ] || exit 1
-    if grep -qE "^#!.*[/ ]zsh( |$)" "$work/first-line"; then
-      printf . >> "$work/zsh-count" || exit 1
-    else
-      [ "$?" -eq 1 ] || exit 1
-    fi
-  fi
+  st=0
+  grep -qE "^#!.*[/ ](ba|da)?sh( |$)" "$work/first-line" || st=$?
+  case $st in
+    (0)
+      printf "./%s\\0" "$file" >> "$work/scripts" || exit 1
+      printf . >> "$work/count" || exit 1 ;;
+    (1)
+      st=0
+      grep -qE "^#!.*[/ ]zsh( |$)" "$work/first-line" || st=$?
+      case $st in
+        (0) printf . >> "$work/zsh-count" || exit 1 ;;
+        (1) ;;
+        (*) exit 1 ;;
+      esac ;;
+    (*) exit 1 ;;
+  esac
 done
 `);
 }
@@ -369,7 +374,13 @@ if command -v shellcheck >/dev/null 2>&1; then
       exit 1
     }
     shas=$(sort -u "$shellcheck_tmp/shas") || exit 1
-    [ -n "$shas" ] || echo "\u203A shellcheck: no commit in the pushed refs (deletes only, or nothing on stdin) \u2014 nothing to check"
+    if [ -n "$shas" ]; then
+      # Said up front: a first push from a fresh clone can carry the whole history, and a long
+      # silent hook reads as a hung one.
+      echo "\u203A shellcheck: $(printf '%s\\n' "$shas" | wc -l | tr -d ' ') commit(s) in the pushed range"
+    else
+      echo "\u203A shellcheck: no commit in the pushed refs (deletes only, or nothing on stdin) \u2014 nothing to check"
+    fi
     # Resolved once, before any cd: the classifier runs inside each materialised tree, and a
     # relative hook path would no longer point at it from there.
     discover="$(cd "$(dirname "$0")" && pwd)/discover-shell-scripts.sh" || exit 1
@@ -395,10 +406,48 @@ if command -v shellcheck >/dev/null 2>&1; then
         exit 1
       fi
       : > "$shellcheck_tmp/scripts" && : > "$shellcheck_tmp/count" && : > "$shellcheck_tmp/zsh-count" && : > "$shellcheck_tmp/skip-count" || exit 1
-      git ls-tree -r -z --name-only "$sha" > "$shellcheck_tmp/tracked" || {
-        echo "etymd: cannot enumerate the tree of $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") for shellcheck" >&2
+      # Only the paths this commit adds, copies, modifies, renames or retypes against its first
+      # parent. A script the commit did not touch has its parent's bytes, and that parent was
+      # either gated when it reached the remote or sits in this range and is checked here; a
+      # merge diffed against its first parent brings in everything the other side added.
+      # Checking every script in every commit multiplied the cost by the range length, so a long
+      # push of a script-heavy repo ran long enough to look hung. Two changes alter the verdict
+      # on bytes nobody touched \u2014 the classifier deciding what is a script, and a .shellcheckrc
+      # deciding what is a finding \u2014 so a commit that touches either, deletion included (a
+      # removed .shellcheckrc re-enables every check it disabled), is checked whole. So is a
+      # commit that adds or changes this hook: a repo adopting the gate after the fact has
+      # scripts no gate ever read, and the commit installing it is where they get read once.
+      short=$(git rev-parse --short "$sha" 2>/dev/null || echo "$sha")
+      if git rev-parse -q --verify "\${sha}^1^{commit}" >/dev/null 2>&1; then
+        git diff-tree -r -z --name-only --no-commit-id "\${sha}^1" "$sha" > "$shellcheck_tmp/touched" \\
+          && git diff-tree -r -z --name-only --no-commit-id --diff-filter=ACMRT "\${sha}^1" "$sha" > "$shellcheck_tmp/tracked"
+      else
+        git diff-tree -r -z --name-only --no-commit-id --root "$sha" > "$shellcheck_tmp/touched" \\
+          && cp "$shellcheck_tmp/touched" "$shellcheck_tmp/tracked"
+      fi || {
+        echo "etymd: cannot enumerate the paths $short changes for shellcheck" >&2
         exit 1
       }
+      where="changed in $short"
+      # Through a file, not a pipe: a pipeline reports only grep's status, and a failing tr would
+      # hand grep nothing \u2014 a "no match" that silently takes the narrow path.
+      tr '\\000' '\\n' < "$shellcheck_tmp/touched" > "$shellcheck_tmp/touched-lines" || exit 1
+      # grep: 1 is "no match", a verdict; anything higher is the matcher failing. The status is
+      # taken on the grep's own line so nothing added later can come between them.
+      st=0
+      grep -qE '(^|/)(\\.shellcheckrc|discover-shell-scripts\\.sh|pre-push)$' "$shellcheck_tmp/touched-lines" || st=$?
+      case $st in
+        (0)
+          where="in $short (whole tree: the gate, its classifier or a .shellcheckrc changed)"
+          git ls-tree -r -z --name-only "$sha" > "$shellcheck_tmp/tracked" || {
+            echo "etymd: cannot enumerate the tree of $short for shellcheck" >&2
+            exit 1
+          } ;;
+        (1) ;;
+        (*)
+          echo "etymd: shell script discovery failed; cannot tell whether $short changes the gate, its classifier or a .shellcheckrc" >&2
+          exit 1 ;;
+      esac
       ( cd "$tree" && xargs -0 "$discover" "$shellcheck_tmp" ) < "$shellcheck_tmp/tracked" || {
         echo "etymd: shell script discovery failed; shellcheck coverage is incomplete" >&2
         exit 1
@@ -412,8 +461,10 @@ if command -v shellcheck >/dev/null 2>&1; then
       if [ "$zsh_count" -gt 0 ]; then
         echo "\u203A shellcheck: $((zsh_count)) zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
       fi
-      if [ "$count" -gt 0 ]; then
-        echo "\u203A shellcheck ($((count)) scripts in $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha"), blocking at severity=warning)"
+      if [ "$count" -eq 0 ]; then
+        echo "\u203A shellcheck: no shell script $where \u2014 nothing to check there"
+      else
+        echo "\u203A shellcheck ($((count)) scripts $where, blocking at severity=warning)"
         ( cd "$tree" && xargs -0 shellcheck -S warning -- < "$shellcheck_tmp/scripts" ) || {
           echo "  fix, or justify inline with '# shellcheck disable=SCxxxx  # why'"
           exit 1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-KQFEKOON.js';
+import { VERSION } from './chunk-W6GGG4LG.js';
 import path from 'path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-5N2TU2X7.js');
+    const { run } = await import('./audit-4PGVS2TW.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if asked").option("-y, --yes", "accept defaults without prompting (never overwrites)").option("--with-agents", "also scaffold a minimal AGENTS.md where none exists (off by default)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-G4XXFXVD.js');
+    const { run } = await import('./init-SL3HEB3H.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes, withAgents: opts.withAgents });
   })
 );
@@ -52,19 +52,19 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-J6JU7MBX.js');
+    const { run } = await import('./approve-Z4NMEGDM.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-PJH32H7C.js');
+    const { run } = await import('./scan-VEHQEEXY.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-264Q5PLY.js');
+    const { run } = await import('./doctor-7YG342YP.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
@@ -76,7 +76,7 @@ program.command("context").description("Measure the always-loaded context footpr
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-NHHILXIH.js');
+    const { run } = await import('./brief-2N6X3CFR.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -90,7 +90,7 @@ program.command("premise").argument("[task]", "the task you are about to hand an
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (task, opts, cmd) => action(async () => {
-    const { run } = await import('./premise-RNMAKMVA.js');
+    const { run } = await import('./premise-62AXRQUK.js');
     await run({
       cwd: resolveCwd(cmd),
       task,
@@ -132,7 +132,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-VT625Q2J.js');
+    const { sweep } = await import('./fleet-XZVQLY53.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -147,7 +147,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-VT625Q2J.js');
+    const { check } = await import('./fleet-XZVQLY53.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -156,7 +156,7 @@ fleet.command("board").description(
   "Render the fleet board: every project's milestones (contract key `milestones`) plus a ranked initiatives table"
 ).option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--initiatives <file>", "the hand-edited initiatives table (rank | id | initiative | \u2026)").option("--out <file>", "write the Markdown board here instead of printing it").option("--json", "print the board as JSON (EXPERIMENTAL)").action(
   (opts, cmd) => action(async () => {
-    const { board } = await import('./fleet-VT625Q2J.js');
+    const { board } = await import('./fleet-XZVQLY53.js');
     const shared = cmd.optsWithGlobals();
     await board({
       cwd: resolveCwd(cmd),
@@ -172,7 +172,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-VT625Q2J.js');
+    const { add } = await import('./fleet-XZVQLY53.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -195,7 +195,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 guarded ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-VT625Q2J.js');
+    const { dismiss } = await import('./fleet-XZVQLY53.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -210,7 +210,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 guarded ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-VT625Q2J.js');
+    const { accept } = await import('./fleet-XZVQLY53.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -225,7 +225,7 @@ program.command("propose").description(
   "the fleet manifest \u2014 runs a read-only sweep now (no delta baseline move)"
 ).option("--from <file>", "read a stored `etymd fleet --json` output instead of sweeping").option("--json", "print the proposal/1 records as JSON (EXPERIMENTAL)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./propose-35JXMEPH.js');
+    const { run } = await import('./propose-4UWLIFWJ.js');
     await run({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -256,7 +256,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-YUMSTKUG.js');
+    const { run } = await import('./gates-633B6G2T.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{doctor-264Q5PLY.js → doctor-7YG342YP.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { run } from './chunk-GFUDKTC5.js';
-import './chunk-UMKC3OWQ.js';
-import './chunk-WKP72Z3J.js';
+import { run } from './chunk-WYJFZ2MB.js';
+import './chunk-FG5XKFR2.js';
+import './chunk-DWPMANIC.js';
 import './chunk-3E2IPCRY.js';
 import './chunk-HI7NWPRA.js';
-import './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/doctor.ts

package/dist/{fleet-VT625Q2J.js → fleet-XZVQLY53.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-HOR4M6EC.js';
-import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-M7XDP6FT.js';
-import './chunk-UMKC3OWQ.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-WKP72Z3J.js';
+import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-WIBN7PBH.js';
+import './chunk-FG5XKFR2.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-DWPMANIC.js';
 import './chunk-3E2IPCRY.js';
-import { generateClaudePointerMd } from './chunk-PQISPOB2.js';
+import { generateClaudePointerMd } from './chunk-X5GR2EJK.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-HI7NWPRA.js';
-import { checkClaudePointer, scanProject } from './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import { checkClaudePointer, scanProject } from './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import { readText, pathExists, git } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import os from 'os';
@@ -240,7 +240,7 @@ async function add(opts) {
     throw new Error(
       `\`${name}\` has a CLAUDE.md that hides its AGENTS.md from Claude Code (${pointer.detail}). Add a full-line \`@AGENTS.md\` import to it, e.g.:
 
-${generateClaudePointerMd().trimEnd().split("\n").join("\n")}
+${generateClaudePointerMd().trimEnd()}
 
 \u2014 or symlink either file to the other, or delete the CLAUDE.md \u2014 then re-run \`etymd fleet add\`.`
     );

package/dist/{gates-YUMSTKUG.js → gates-633B6G2T.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { deriveFailOn, derivedCommands, planWorkflow } from './chunk-7N5JDXQG.js';
-import { runPrefix, isSafeGateCommand } from './chunk-PQISPOB2.js';
+import { deriveFailOn, derivedCommands, planWorkflow } from './chunk-TZGRV7UY.js';
+import { runPrefix, isSafeGateCommand } from './chunk-X5GR2EJK.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import { scanProject } from './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import { readConfig, CONFIG_FILE, configPath } from './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import { readText, git } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{generate-62GQSCKH.js → generate-S5KGZIIM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-7N5JDXQG.js';
-import './chunk-PQISPOB2.js';
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-TZGRV7UY.js';
+import './chunk-X5GR2EJK.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import './chunk-4VPBP6K6.js';

package/dist/index.d.ts

@@ -1127,7 +1127,7 @@ declare const gateIntegrityLens: Lens;
  * Gaps in the sequence are deliberate: a number stays retired even when the change that took it
  * never shipped, so a version cited in a baseline or a record means exactly one pack, ever.
  */
-declare const PACK_VERSION = "15";
+declare const PACK_VERSION = "16";
 
 declare const VERSION: string;
 declare const NAME: string;

package/dist/index.js

@@ -20,7 +20,7 @@ var __export = (target, all) => {
 var PACK_VERSION;
 var init_version = __esm({
   "src/pack/version.ts"() {
-    PACK_VERSION = "15";
+    PACK_VERSION = "16";
   }
 });
 
@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.19.1",
+      version: "0.19.2",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -501,23 +501,40 @@ async function detectArtifacts(root) {
   });
   return artifacts;
 }
+function withoutFencedCode(text) {
+  const kept = [];
+  let fence = null;
+  for (const line of text.split("\n")) {
+    if (fence === null) {
+      const open = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+      if (open?.[1] && !(open[1][0] === "`" && open[2]?.includes("`"))) fence = open[1];
+      else kept.push(line);
+    } else {
+      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line)?.[1];
+      if (close && close[0] === fence[0] && close.length >= fence.length) fence = null;
+    }
+  }
+  return kept.join("\n");
+}
 function detectClaudeCodeVersion() {
   const override = process.env.ETYMD_CLAUDE_VERSION;
   if (override !== void 0) {
     return Promise.resolve(override === "none" || override === "" ? null : override);
   }
-  claudeVersionMemo ??= pExecFile2("claude", ["--version"], { timeout: 5e3 }).then(({ stdout }) => /(\d+\.\d+\.\d+)/.exec(stdout)?.[1] ?? null).catch(() => null);
+  claudeVersionMemo ??= pExecFile2("claude", ["--version"], { timeout: 5e3 }).then(({ stdout }) => /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?=\s|$)/.exec(stdout)?.[1] ?? null).catch(() => null);
   return claudeVersionMemo;
 }
-function versionBefore(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
-  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-    const x = pa[i] ?? 0;
-    const y = pb[i] ?? 0;
+function mayPredate(a, b) {
+  const parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?$/.exec(v.trim());
+  const pa = parse(a);
+  const pb = parse(b);
+  if (!pa || !pb) return true;
+  for (let i = 1; i <= 3; i++) {
+    const x = Number(pa[i]);
+    const y = Number(pb[i]);
     if (x !== y) return x < y;
   }
-  return false;
+  return pa[4] !== void 0 && pb[4] === void 0;
 }
 async function checkClaudePointer(root, claudeVersion) {
   const agentsAbs = path2.join(root, "AGENTS.md");
@@ -535,11 +552,11 @@ async function checkClaudePointer(root, claudeVersion) {
     return { ok: true, via: "same-file" };
   }
   const rootClaude = await readText(claudeAbs);
-  if (rootClaude !== null && ROOT_POINTER_IMPORT_RE.test(rootClaude)) {
+  if (rootClaude !== null && ROOT_POINTER_IMPORT_RE.test(withoutFencedCode(rootClaude))) {
     return { ok: true, via: "root-import" };
   }
   const dotClaude = await readText(path2.join(root, ".claude", "CLAUDE.md"));
-  if (dotClaude !== null && DOT_CLAUDE_IMPORT_RE.test(dotClaude)) {
+  if (dotClaude !== null && DOT_CLAUDE_IMPORT_RE.test(withoutFencedCode(dotClaude))) {
     return { ok: true, via: "dotclaude-import" };
   }
   if (rootClaude !== null || dotClaude !== null) {
@@ -550,7 +567,7 @@ async function checkClaudePointer(root, claudeVersion) {
     };
   }
   const version = await detectClaudeCodeVersion() ;
-  if (version !== null && versionBefore(version, CLAUDE_AGENTS_FALLBACK_VERSION)) {
+  if (version !== null && mayPredate(version, CLAUDE_AGENTS_FALLBACK_VERSION)) {
     return {
       ok: false,
       kind: "old-reader",
@@ -779,8 +796,8 @@ var init_detect = __esm({
     ];
     SHELL_SHEBANG = /^#!\s*\/\S*\b(?:ba|da|z)?sh\b|^#!\s*\/usr\/bin\/env\s+(?:ba|da|z)?sh\b/;
     SHELL_EXT = /\.(?:sh|bash|zsh)$/;
-    ROOT_POINTER_IMPORT_RE = /^\s*@(\.\/)?AGENTS\.md\s*$/m;
-    DOT_CLAUDE_IMPORT_RE = /^\s*@\.\.\/AGENTS\.md\s*$/m;
+    ROOT_POINTER_IMPORT_RE = /^ {0,3}@(\.\/)?AGENTS\.md[ \t]*$/m;
+    DOT_CLAUDE_IMPORT_RE = /^ {0,3}@\.\.\/AGENTS\.md[ \t]*$/m;
     CLAUDE_AGENTS_FALLBACK_VERSION = "2.1.277";
     pExecFile2 = promisify(execFile);
   }
@@ -1331,11 +1348,11 @@ function generateShellDiscoveryScript() {
 # that EXISTS but cannot be read is the other branch \u2014 coverage would silently shrink, so it
 # fails, naming the path.
 #
-# The two \`[ "$?" -eq 1 ]\` guards are the match/error protocol: grep reports "no match" as 1
-# and a failure as 2 or more, and only the first is a verdict. Dropping the guard would let a
-# failing matcher pass as "not a shell script" \u2014 the exact silent coverage-shrink the
-# fail-closed rules exist to prevent. The checker does not associate \`$?\` with the enclosing
-# if-condition, which is why this shape survives the pass it serves; keep it that way.
+# The match/error protocol: grep reports "no match" as 1 and a failure as 2 or more, and only
+# the first is a verdict. Letting a failure fall through would pass a broken matcher as "not a
+# shell script" \u2014 the exact silent coverage-shrink the fail-closed rules exist to prevent. The
+# status is captured on the grep's own line (\`|| st=$?\`), so no command added later can come
+# between the grep and the check and silently replace the status being read.
 work=$1
 shift
 for file do
@@ -1351,17 +1368,22 @@ for file do
     exit 1
   }
   head -n 1 "$work/head-bytes" > "$work/first-line" || exit 1
-  if grep -qE "^#!.*[/ ](ba|da)?sh( |$)" "$work/first-line"; then
-    printf "./%s\\0" "$file" >> "$work/scripts" || exit 1
-    printf . >> "$work/count" || exit 1
-  else
-    [ "$?" -eq 1 ] || exit 1
-    if grep -qE "^#!.*[/ ]zsh( |$)" "$work/first-line"; then
-      printf . >> "$work/zsh-count" || exit 1
-    else
-      [ "$?" -eq 1 ] || exit 1
-    fi
-  fi
+  st=0
+  grep -qE "^#!.*[/ ](ba|da)?sh( |$)" "$work/first-line" || st=$?
+  case $st in
+    (0)
+      printf "./%s\\0" "$file" >> "$work/scripts" || exit 1
+      printf . >> "$work/count" || exit 1 ;;
+    (1)
+      st=0
+      grep -qE "^#!.*[/ ]zsh( |$)" "$work/first-line" || st=$?
+      case $st in
+        (0) printf . >> "$work/zsh-count" || exit 1 ;;
+        (1) ;;
+        (*) exit 1 ;;
+      esac ;;
+    (*) exit 1 ;;
+  esac
 done
 `);
 }
@@ -1431,7 +1453,13 @@ if command -v shellcheck >/dev/null 2>&1; then
       exit 1
     }
     shas=$(sort -u "$shellcheck_tmp/shas") || exit 1
-    [ -n "$shas" ] || echo "\u203A shellcheck: no commit in the pushed refs (deletes only, or nothing on stdin) \u2014 nothing to check"
+    if [ -n "$shas" ]; then
+      # Said up front: a first push from a fresh clone can carry the whole history, and a long
+      # silent hook reads as a hung one.
+      echo "\u203A shellcheck: $(printf '%s\\n' "$shas" | wc -l | tr -d ' ') commit(s) in the pushed range"
+    else
+      echo "\u203A shellcheck: no commit in the pushed refs (deletes only, or nothing on stdin) \u2014 nothing to check"
+    fi
     # Resolved once, before any cd: the classifier runs inside each materialised tree, and a
     # relative hook path would no longer point at it from there.
     discover="$(cd "$(dirname "$0")" && pwd)/discover-shell-scripts.sh" || exit 1
@@ -1457,10 +1485,48 @@ if command -v shellcheck >/dev/null 2>&1; then
         exit 1
       fi
       : > "$shellcheck_tmp/scripts" && : > "$shellcheck_tmp/count" && : > "$shellcheck_tmp/zsh-count" && : > "$shellcheck_tmp/skip-count" || exit 1
-      git ls-tree -r -z --name-only "$sha" > "$shellcheck_tmp/tracked" || {
-        echo "etymd: cannot enumerate the tree of $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") for shellcheck" >&2
+      # Only the paths this commit adds, copies, modifies, renames or retypes against its first
+      # parent. A script the commit did not touch has its parent's bytes, and that parent was
+      # either gated when it reached the remote or sits in this range and is checked here; a
+      # merge diffed against its first parent brings in everything the other side added.
+      # Checking every script in every commit multiplied the cost by the range length, so a long
+      # push of a script-heavy repo ran long enough to look hung. Two changes alter the verdict
+      # on bytes nobody touched \u2014 the classifier deciding what is a script, and a .shellcheckrc
+      # deciding what is a finding \u2014 so a commit that touches either, deletion included (a
+      # removed .shellcheckrc re-enables every check it disabled), is checked whole. So is a
+      # commit that adds or changes this hook: a repo adopting the gate after the fact has
+      # scripts no gate ever read, and the commit installing it is where they get read once.
+      short=$(git rev-parse --short "$sha" 2>/dev/null || echo "$sha")
+      if git rev-parse -q --verify "\${sha}^1^{commit}" >/dev/null 2>&1; then
+        git diff-tree -r -z --name-only --no-commit-id "\${sha}^1" "$sha" > "$shellcheck_tmp/touched" \\
+          && git diff-tree -r -z --name-only --no-commit-id --diff-filter=ACMRT "\${sha}^1" "$sha" > "$shellcheck_tmp/tracked"
+      else
+        git diff-tree -r -z --name-only --no-commit-id --root "$sha" > "$shellcheck_tmp/touched" \\
+          && cp "$shellcheck_tmp/touched" "$shellcheck_tmp/tracked"
+      fi || {
+        echo "etymd: cannot enumerate the paths $short changes for shellcheck" >&2
         exit 1
       }
+      where="changed in $short"
+      # Through a file, not a pipe: a pipeline reports only grep's status, and a failing tr would
+      # hand grep nothing \u2014 a "no match" that silently takes the narrow path.
+      tr '\\000' '\\n' < "$shellcheck_tmp/touched" > "$shellcheck_tmp/touched-lines" || exit 1
+      # grep: 1 is "no match", a verdict; anything higher is the matcher failing. The status is
+      # taken on the grep's own line so nothing added later can come between them.
+      st=0
+      grep -qE '(^|/)(\\.shellcheckrc|discover-shell-scripts\\.sh|pre-push)$' "$shellcheck_tmp/touched-lines" || st=$?
+      case $st in
+        (0)
+          where="in $short (whole tree: the gate, its classifier or a .shellcheckrc changed)"
+          git ls-tree -r -z --name-only "$sha" > "$shellcheck_tmp/tracked" || {
+            echo "etymd: cannot enumerate the tree of $short for shellcheck" >&2
+            exit 1
+          } ;;
+        (1) ;;
+        (*)
+          echo "etymd: shell script discovery failed; cannot tell whether $short changes the gate, its classifier or a .shellcheckrc" >&2
+          exit 1 ;;
+      esac
       ( cd "$tree" && xargs -0 "$discover" "$shellcheck_tmp" ) < "$shellcheck_tmp/tracked" || {
         echo "etymd: shell script discovery failed; shellcheck coverage is incomplete" >&2
         exit 1
@@ -1474,8 +1540,10 @@ if command -v shellcheck >/dev/null 2>&1; then
       if [ "$zsh_count" -gt 0 ]; then
         echo "\u203A shellcheck: $((zsh_count)) zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
       fi
-      if [ "$count" -gt 0 ]; then
-        echo "\u203A shellcheck ($((count)) scripts in $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha"), blocking at severity=warning)"
+      if [ "$count" -eq 0 ]; then
+        echo "\u203A shellcheck: no shell script $where \u2014 nothing to check there"
+      else
+        echo "\u203A shellcheck ($((count)) scripts $where, blocking at severity=warning)"
         ( cd "$tree" && xargs -0 shellcheck -S warning -- < "$shellcheck_tmp/scripts" ) || {
           echo "  fix, or justify inline with '# shellcheck disable=SCxxxx  # why'"
           exit 1

package/dist/{init-G4XXFXVD.js → init-SL3HEB3H.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { planWorkflow } from './chunk-7N5JDXQG.js';
-import './chunk-PQISPOB2.js';
+import { planWorkflow } from './chunk-TZGRV7UY.js';
+import './chunk-X5GR2EJK.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
-import { VERSION } from './chunk-KQFEKOON.js';
+import { scanProject, checkClaudePointer } from './chunk-OKHNNWOV.js';
+import { VERSION } from './chunk-W6GGG4LG.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-2DRA7S67.js';
+import { PACK_VERSION } from './chunk-6FT7KSKU.js';
 import { git, readText } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';
@@ -102,6 +102,13 @@ async function run(opts) {
   section("Onboarded");
   for (const w of result.written) print(`  ${glyph.ok} ${theme.dim("wrote")} ${theme.info(w)}`);
   for (const sk of result.skipped) print(`  ${glyph.bullet} ${theme.dim("kept")} ${theme.dim(sk)}`);
+  const pointer = await checkClaudePointer(opts.cwd);
+  if (!pointer.ok && pointer.kind === "no-import") {
+    const line = pointer.detail.includes(".claude/CLAUDE.md") ? "@../AGENTS.md" : "@AGENTS.md";
+    print(
+      `  ${glyph.partial} ${theme.warn(pointer.detail)} ${theme.dim(`\u2014 Claude Code reads that file instead; add a full-line ${line} import`)}`
+    );
+  }
   print(
     `  ${glyph.ok} ${theme.dim("baseline approved \u2192")} ${theme.info(".etymd/baseline.json")} ${theme.dim("(commit it \u2014 drift is measured against it)")}`
   );

package/dist/{premise-RNMAKMVA.js → premise-62AXRQUK.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, HOSTNAME_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-WKP72Z3J.js';
+import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, HOSTNAME_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-DWPMANIC.js';
 import { print, section, theme, renderFindings } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import { scanProject } from './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { promises } from 'fs';

package/dist/{propose-35JXMEPH.js → propose-4UWLIFWJ.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-M7XDP6FT.js';
-import './chunk-UMKC3OWQ.js';
-import './chunk-WKP72Z3J.js';
+import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-WIBN7PBH.js';
+import './chunk-FG5XKFR2.js';
+import './chunk-DWPMANIC.js';
 import './chunk-3E2IPCRY.js';
 import { print, section, theme, renderFleetNotes } from './chunk-HI7NWPRA.js';
-import './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import { readText } from './chunk-4VPBP6K6.js';
 import path from 'path';
 

package/dist/scan-M7STYIYQ.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
+import './chunk-6FT7KSKU.js';
+import './chunk-4VPBP6K6.js';

package/dist/{scan-PJH32H7C.js → scan-VEHQEEXY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
+import { scanProject } from './chunk-OKHNNWOV.js';
+import './chunk-W6GGG4LG.js';
 import { writeCachedFacts } from './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
+import './chunk-6FT7KSKU.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/scan.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/audit-5N2TU2X7.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-GFUDKTC5.js';
-import './chunk-UMKC3OWQ.js';
-import './chunk-WKP72Z3J.js';
-import './chunk-3E2IPCRY.js';
-import './chunk-HI7NWPRA.js';
-import './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
-import './chunk-P6ATKV2R.js';
-import './chunk-2DRA7S67.js';
-import './chunk-4VPBP6K6.js';

package/dist/scan-F6OW4ANK.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-6DJMKZGK.js';
-import './chunk-KQFEKOON.js';
-import './chunk-2DRA7S67.js';
-import './chunk-4VPBP6K6.js';