etymd 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # etymd
 
+## 0.5.0
+
+### Minor Changes
+
+- e199ccc: `fleet add --profile corp` now records the alias-to-directory mapping too, not just the entry.
+
+  A corp entry in the tracked manifest is deliberately alias-only — no path, no remote — which is
+  what keeps employer names out of a file that gets pushed. It also means the entry resolves to
+  nothing on its own. Registering wrote only that half, so every corp registration ended as a
+  dangling entry that `fleet check` reported immediately and the user had to fix by hand, in the
+  one file the tool otherwise never asks anyone to hand-edit.
+
+  The mapping is written `~`-relative, so the local manifest stays portable between machines, and
+  merged into the existing document so hand-maintained entries survive.
+
+  Two refusals guard it, because this file is the one place real employer directory names are
+  written down. If the local manifest is not gitignored, registration refuses rather than creating
+  a file git would track — a leak the tool creates is worse than a registration it declines to
+  finish. If the file exists but is not valid JSON, it refuses rather than overwriting mappings
+  that cannot be re-derived.
+
+  The mapping is written before the tracked entry. The failure modes are not symmetric: a mapping
+  without an entry is inert, while an entry without a mapping is a broken registration sitting in
+  the file that gets committed.
+
+- 9546979: `fleet add` no longer records a remote URL in the manifest.
+
+  The field was write-only: nothing in the tool ever read it back. It was persisted because it
+  happened to be derivable at registration time, and it stayed because no one asked what consumed
+  it.
+
+  It is also the field that turned a mis-profiled entry into a real disclosure. A raw remote URL
+  carries the host and the internal group path; `path` carries a bare directory name. Removing a
+  field no consumer reads retires that class outright, with no host-matching heuristic, and unlike
+  the corp-host guard it keeps working on a machine that has no local manifest to read corp hosts
+  from. The remote stays derivable from the checkout at any time, which is where it came from.
+
+  Existing entries that already carry a remote are left alone — nothing reads them, and rewriting
+  a hand-maintained manifest to remove inert keys would be a worse trade than leaving them.
+
+## 0.4.2
+
+### Patch Changes
+
+- 52ebca8: Fix: `fleet add --profile corp` was silently ignored, registering employer repos as personal.
+
+  `fleet` declares its own `--profile` (the sweep filter), and commander hands a parent-declared
+  option the value even when it is typed after the subcommand. So `fleet add <dir> --profile corp`
+  left the subcommand's own option undefined, the placement fell back to personal, and the
+  personal branch records `path` and the RAW `remote` — writing the employer host and its internal
+  group structure into a manifest that is tracked and pushed. That is precisely the disclosure the
+  alias convention exists to prevent. The same shadowing class was already fixed for `--manifest`
+  and `--json`; `--profile` was missed.
+
+  Two changes, because the flag alone is not enough. The CLI now reads the merged option view, so
+  the flag works. And `fleet add` refuses outright when the target's remote matches a corp host
+  declared in the local manifest while the profile is not corp — the manifest already knows which
+  hosts are the employer's and the remote has just been read, so the tool has every fact needed to
+  prevent this without anyone remembering a flag. It refuses rather than auto-correcting:
+  placement is the user's decision, but it may not be made by omission.
+
 ## 0.4.1
 
 ### Patch Changes

package/README.md

@@ -96,6 +96,10 @@ _From Greek **étymon** — a word's true, original sense (→ etymology) — cl
   no committed baseline, there is nothing to measure drift against. Everything else runs.
 - **`etymd init` never overwrites an existing `AGENTS.md`.** It scaffolds a minimal one only if
   you have none. The feared overwrite path simply does not exist.
+- **"The shellcheck step announced that it skipped."** That is the intended behaviour, not a
+  misconfiguration: where the binary is absent the hook says so and names the install command,
+  because a check that goes quiet when its tool is missing looks installed everywhere and is
+  installed nowhere.
 
 ---
 
@@ -153,24 +157,24 @@ personal and employer repos. See [the fleet manifest](#the-fleet-manifest-experi
 
 ## Commands
 
-| Command                          | What it does                                                                                                                                                                             |
-| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                               |
-| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                             |
-| `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                               |
-| `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                              |
-| `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts.                                        |
-| `etymd screen`                   | Content screen: find text that must never be published. Four scopes — `--staged`, `--message`, `--tree`, `--dir`. Bring your own patterns; etymd ships none.                             |
-| `etymd scan`                     | The deterministic reckoning behind everything. `--json`.                                                                                                                                 |
-| `etymd brief`                    | A grounded briefing your in-repo agent completes to author the semantic layer.                                                                                                           |
-| `etymd approve`                  | Refresh the committed baseline non-interactively after intentional structural changes.                                                                                                   |
-| `etymd ledger`                   | The findings memory: every tracked finding with status and history.                                                                                                                      |
-| `etymd dismiss`                  | `dismiss <id> --reason <text>` — a dismissed finding never resurfaces without regressing.                                                                                                |
-| `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                          |
-| `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.   |
-| `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                          |
-| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`. |
-| `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; corp findings persist beside the manifest, never in the corp worktree.                                                         |
+| Command                          | What it does                                                                                                                                                                                            |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                                              |
+| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                                            |
+| `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                                              |
+| `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                                             |
+| `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts — and from the repo's shell surface, where it has one. |
+| `etymd screen`                   | Content screen: find text that must never be published. Four scopes — `--staged`, `--message`, `--tree`, `--dir`. Bring your own patterns; etymd ships none.                                            |
+| `etymd scan`                     | The deterministic reckoning behind everything. `--json`.                                                                                                                                                |
+| `etymd brief`                    | A grounded briefing your in-repo agent completes to author the semantic layer.                                                                                                                          |
+| `etymd approve`                  | Refresh the committed baseline non-interactively after intentional structural changes.                                                                                                                  |
+| `etymd ledger`                   | The findings memory: every tracked finding with status and history.                                                                                                                                     |
+| `etymd dismiss`                  | `dismiss <id> --reason <text>` — a dismissed finding never resurfaces without regressing.                                                                                                               |
+| `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                                         |
+| `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.                  |
+| `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                                         |
+| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                |
+| `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; corp findings persist beside the manifest, never in the corp worktree.                                                                        |
 
 `--cwd <dir>` targets another directory. Read-only probing of any repo leaves **zero trace**
 (`audit --no-ledger` writes nothing).
@@ -252,8 +256,9 @@ request diff like any other change. Keep `.etymd` out of your formatter's reach
 [the files Etymd keeps](#the-files-etymd-keeps)).
 
 A check that runs only in CI is itself a finding: the failure surfaces after the agent finished.
-`etymd gates` installs the local pre-commit / pre-push mirror built from your own check scripts,
-and the `gate-integrity` lens flags whatever still runs in CI alone.
+`etymd gates` installs the local pre-commit / pre-push mirror built from your own check scripts —
+and from the repo's shell scripts, which usually have no check of their own — while the
+`gate-integrity` lens flags whatever still runs in CI alone.
 
 ### Your own checks, beside the generated ones
 
@@ -282,6 +287,24 @@ was edited or went stale, never that you added a check of your own. Delete the c
 checks stop running — that is what deleting a file means, and etymd does not police a file it
 does not own.
 
+### The shell surface
+
+Package scripts are not the only executable surface a repo has, and in some repos they are not
+the main one — a tools or infra repo can be entirely `bootstrap/*.sh` plus `.githooks/*` with no
+`package.json` at all. Those repos were told "no correctness commands detected", which reads as
+"nothing to check" when it means "nothing was looked at". Where a repo has tracked shell scripts,
+the generated pre-push now carries a `shellcheck` step. Three properties are deliberate:
+
+- **Scripts are re-discovered by shebang at push time**, never baked into the hook as a list. A
+  generated list is correct the day it is written and silently wrong the first time someone adds
+  a script.
+- **A missing `shellcheck` binary is a loud skip that names the install command**, never a quiet
+  pass. A check that goes silent when its tool is absent looks installed on every machine and is
+  installed on one.
+- **Only `warning` severity and above blocks**; style and info print as advice afterwards. A gate
+  with a high false-positive rate does not make a repo careful — it teaches everyone the bypass
+  flag, and that flag is shared with the checks that must never be bypassed.
+
 ### The content screen (`etymd screen`)
 
 A separate question from "are the instructions true?": **does this repo carry text that must

package/dist/{approve-DTYNGGXH.js → approve-ASWRO6OD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-RH2UAS25.js';
-import { VERSION } from './chunk-KIMFKLJB.js';
+import { scanProject } from './chunk-4KOP36RD.js';
+import { VERSION } from './chunk-OJVQXB5Z.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-R74SJ7HS.js';
 import { PACK_VERSION } from './chunk-IGHES6AK.js';
 import './chunk-YLNQQZ5F.js';

package/dist/{audit-UJU3336P.js → audit-LPZOGOHE.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-export { run } from './chunk-XER37MLS.js';
-import './chunk-OWNWN2KF.js';
+export { run } from './chunk-CYSEGWIW.js';
+import './chunk-QJRPKZPA.js';
 import './chunk-LT67FU2Y.js';
 import './chunk-WWBF4Y7K.js';
 import './chunk-NMZ3RHWW.js';
 import './chunk-TADKOW6P.js';
-import './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
+import './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
 import './chunk-R74SJ7HS.js';
 import './chunk-IGHES6AK.js';
 import './chunk-YLNQQZ5F.js';

package/dist/{brief-5UZLZ3CW.js → brief-HWD7CILP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
+import { scanProject } from './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
 import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
 import './chunk-IGHES6AK.js';
 import './chunk-YLNQQZ5F.js';

package/dist/{chunk-RH2UAS25.js → chunk-4KOP36RD.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-KIMFKLJB.js';
+import { VERSION } from './chunk-OJVQXB5Z.js';
 import { PACK_VERSION } from './chunk-IGHES6AK.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';

package/dist/{chunk-XER37MLS.js → chunk-CYSEGWIW.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-OWNWN2KF.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-QJRPKZPA.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-TADKOW6P.js';
 
 // src/commands/audit.ts

package/dist/{chunk-KIMFKLJB.js → chunk-OJVQXB5Z.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.4.1"};
+  version: "0.5.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-OWNWN2KF.js → chunk-QJRPKZPA.js}

@@ -2,7 +2,7 @@
 import { measureContext } from './chunk-LT67FU2Y.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-WWBF4Y7K.js';
 import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-NMZ3RHWW.js';
-import { scanProject, expandFileGlobs } from './chunk-RH2UAS25.js';
+import { scanProject, expandFileGlobs } from './chunk-4KOP36RD.js';
 import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-R74SJ7HS.js';
 import { PACK_VERSION } from './chunk-IGHES6AK.js';
 import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-YLNQQZ5F.js';

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-KIMFKLJB.js';
+import { VERSION } from './chunk-OJVQXB5Z.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-UJU3336P.js');
+    const { run } = await import('./audit-LPZOGOHE.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-7GNB74BE.js');
+    const { run } = await import('./init-AVE2GDJ6.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,19 +52,19 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-DTYNGGXH.js');
+    const { run } = await import('./approve-ASWRO6OD.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-6YOKI3JW.js');
+    const { run } = await import('./scan-5DSECI43.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-W6DW3OK6.js');
+    const { run } = await import('./doctor-MJ6RBZ2Q.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
@@ -76,7 +76,7 @@ program.command("context").description("Measure the always-loaded context footpr
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-5UZLZ3CW.js');
+    const { run } = await import('./brief-HWD7CILP.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-77SSSFZO.js');
+    const { sweep } = await import('./fleet-SAFXVN44.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +126,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-77SSSFZO.js');
+    const { check } = await import('./fleet-SAFXVN44.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +136,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-77SSSFZO.js');
+    const { add } = await import('./fleet-SAFXVN44.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -144,7 +144,12 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
       target: dir,
       name: opts.name,
       kind: opts.kind,
-      profile: opts.profile,
+      // `fleet` declares its own --profile (the sweep filter), and commander hands a
+      // parent-declared option the value even when it is typed AFTER the subcommand — so
+      // `fleet add <dir> --profile corp` left opts.profile undefined and the flag silently
+      // did nothing, registering employer repos as personal. Reading the merged view is what
+      // makes the flag work; the corp-remote guard in add() is what makes forgetting it safe.
+      profile: opts.profile ?? shared.profile,
       trust: opts.trust,
       yes: opts.yes
     });
@@ -154,7 +159,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-77SSSFZO.js');
+    const { dismiss } = await import('./fleet-SAFXVN44.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -169,7 +174,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-77SSSFZO.js');
+    const { accept } = await import('./fleet-SAFXVN44.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -191,7 +196,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-LTM5PE7R.js');
+    const { run } = await import('./gates-D5SBAVXB.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{doctor-W6DW3OK6.js → doctor-MJ6RBZ2Q.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { run } from './chunk-XER37MLS.js';
-import './chunk-OWNWN2KF.js';
+import { run } from './chunk-CYSEGWIW.js';
+import './chunk-QJRPKZPA.js';
 import './chunk-LT67FU2Y.js';
 import './chunk-WWBF4Y7K.js';
 import './chunk-NMZ3RHWW.js';
 import './chunk-TADKOW6P.js';
-import './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
+import './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
 import './chunk-R74SJ7HS.js';
 import './chunk-IGHES6AK.js';
 import './chunk-YLNQQZ5F.js';

package/dist/{fleet-77SSSFZO.js → fleet-SAFXVN44.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-MMPV67FW.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-OWNWN2KF.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-QJRPKZPA.js';
 import './chunk-LT67FU2Y.js';
 import { readLedger } from './chunk-WWBF4Y7K.js';
 import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
+import { scanProject } from './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
 import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
 import './chunk-IGHES6AK.js';
 import { readText, pathExists, git, isDirectory } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { select, isCancel, cancel, text, confirm } from '@clack/prompts';
-import os from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
@@ -688,7 +688,7 @@ async function checkCorpEmails(manifest, findings, disclosures) {
 }
 async function checkGateDrift(manifest, findings, disclosures) {
   const { planWorkflow } = await import('./generate-CBMTNN7P.js');
-  const { scanProject: scanProject2 } = await import('./scan-XZH57E4I.js');
+  const { scanProject: scanProject2 } = await import('./scan-ES7IOXOC.js');
   const { readConfig } = await import('./config-MX7OYI7F.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
@@ -1077,6 +1077,35 @@ async function check(opts) {
   renderFindings(findings);
   renderFleetNotes([], disclosures);
 }
+async function recordCorpMapping(manifest, name, absTarget) {
+  const home = os.homedir();
+  const value = absTarget === home || absTarget.startsWith(home + path.sep) ? `~${absTarget.slice(home.length)}` : absTarget;
+  const insideRepo = await git(manifest.dir, ["rev-parse", "--is-inside-work-tree"]) === "true";
+  if (insideRepo) {
+    const ignored = await git(manifest.dir, ["check-ignore", "-q", manifest.localPath]) !== null;
+    if (!ignored) {
+      throw new Error(
+        `${path.basename(manifest.localPath)} is not gitignored \u2014 refusing to write employer directory names into a file git would track. Add it to .gitignore, then re-run.`
+      );
+    }
+  }
+  const existing = await readText(manifest.localPath);
+  let doc = {};
+  if (existing) {
+    try {
+      doc = JSON.parse(existing);
+    } catch {
+      throw new Error(
+        `${path.basename(manifest.localPath)} is not valid JSON \u2014 fix it before registering, so the mapping is not written over hand-maintained entries that cannot be re-derived.`
+      );
+    }
+  }
+  const dirs = doc.dirs ?? {};
+  dirs[name] = value;
+  doc.dirs = dirs;
+  await promises.writeFile(manifest.localPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
+  return value;
+}
 async function add(opts) {
   const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
   if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
@@ -1177,6 +1206,12 @@ async function add(opts) {
   } else if (opts.trust) {
     throw new Error("corp entries take no `trust` \u2014 `profile: corp` already implies it");
   }
+  const corpHost = remote ? manifest.corpHosts.find((h) => remote.includes(h)) : void 0;
+  if (corpHost && profile !== "corp") {
+    throw new Error(
+      `\`${name}\` has a remote on the corp host \`${corpHost}\`, but --profile is \`${profile}\`. A personal entry records its path and raw remote in the TRACKED manifest \u2014 register it with \`--profile corp\` (alias-only, machine-pinned), or move it out of the fleet root.`
+    );
+  }
   const entry = profile === "corp" ? { name, kind, profile, private: true } : {
     name,
     kind,
@@ -1184,10 +1219,14 @@ async function add(opts) {
     path: path.relative(manifest.root ?? manifest.dir, absTarget),
     trust,
     contract: {},
-    links: {},
-    // The scan does not collect remotes (they are not a workflow fact), so read it here —
-    // recorded when present, simply absent when the repo has no origin yet.
-    ...remote ? { remote } : {}
+    links: {}
+    // The remote is deliberately NOT recorded. Nothing reads it — it was persisted only
+    // because it happened to be derivable — and it is the field that turns a mis-profiled
+    // entry into a disclosure: a raw URL carries the host AND the internal group path,
+    // while `path` carries a bare directory name. Removing a field no consumer reads
+    // retires that whole class without any host-matching guess, and keeps working on a
+    // machine that has no local manifest for the corp-host guard above to read.
+    // It stays derivable at any time from the checkout itself, which is where it came from.
   };
   print(`  ${glyph.bullet} ${theme.dim("entry")}`);
   print(
@@ -1202,11 +1241,20 @@ async function add(opts) {
       return;
     }
   }
+  let mappedTo;
+  if (profile === "corp") {
+    mappedTo = await recordCorpMapping(manifest, name, absTarget);
+  }
   const doc = JSON.parse(raw);
   if (!Array.isArray(doc.projects)) throw new Error("manifest has no `projects` array to append to");
   doc.projects.push(entry);
   await promises.writeFile(manifest.manifestPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
   print(`  ${glyph.ok} ${theme.dim("registered")} ${theme.info(name)}`);
+  if (mappedTo) {
+    print(
+      `  ${glyph.ok} ${theme.dim("mapped")} ${theme.info(`${name} \u2192 ${mappedTo}`)} ${theme.dim(`in ${path.basename(manifest.localPath)} (gitignored)`)}`
+    );
+  }
   print(`  ${theme.dim(`verify with \`etymd fleet check --manifest ${manifest.manifestPath}\``)}`);
 }
 async function resolveFleetFinding(opts, status) {

package/dist/{gates-LTM5PE7R.js → gates-D5SBAVXB.js}

@@ -3,8 +3,8 @@ import { applyFiles } from './chunk-EF6BPBG6.js';
 import { derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-OX3LUOZR.js';
 import { readConfig, CONFIG_FILE, configPath } from './chunk-NMZ3RHWW.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
+import { scanProject } from './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
 import './chunk-R74SJ7HS.js';
 import './chunk-IGHES6AK.js';
 import { readText, git } from './chunk-YLNQQZ5F.js';

package/dist/index.js

@@ -29,7 +29,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.4.1",
+      version: "0.5.0",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",

package/dist/{init-7GNB74BE.js → init-AVE2GDJ6.js}

@@ -3,8 +3,8 @@ import { applyFiles } from './chunk-EF6BPBG6.js';
 import { planWorkflow } from './chunk-OX3LUOZR.js';
 import './chunk-NMZ3RHWW.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-RH2UAS25.js';
-import { VERSION } from './chunk-KIMFKLJB.js';
+import { scanProject } from './chunk-4KOP36RD.js';
+import { VERSION } from './chunk-OJVQXB5Z.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-R74SJ7HS.js';
 import { PACK_VERSION } from './chunk-IGHES6AK.js';
 import { git, readText } from './chunk-YLNQQZ5F.js';

package/dist/{scan-6YOKI3JW.js → scan-5DSECI43.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
+import { scanProject } from './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
 import { writeCachedFacts } from './chunk-R74SJ7HS.js';
 import './chunk-IGHES6AK.js';
 import './chunk-YLNQQZ5F.js';

package/dist/scan-ES7IOXOC.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-4KOP36RD.js';
+import './chunk-OJVQXB5Z.js';
+import './chunk-IGHES6AK.js';
+import './chunk-YLNQQZ5F.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/scan-XZH57E4I.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-RH2UAS25.js';
-import './chunk-KIMFKLJB.js';
-import './chunk-IGHES6AK.js';
-import './chunk-YLNQQZ5F.js';