etymd 0.4.2 → 0.6.0

package/dist/{chunk-6G3JJMZ3.js → chunk-OESQNO2J.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-LT67FU2Y.js';
-import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-WWBF4Y7K.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-NMZ3RHWW.js';
-import { scanProject, expandFileGlobs } from './chunk-HX5IYDCU.js';
-import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-R74SJ7HS.js';
-import { PACK_VERSION } from './chunk-IGHES6AK.js';
-import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-YLNQQZ5F.js';
+import { measureContext } from './chunk-OKU3HXIH.js';
+import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-OAFYLBVG.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-K7QBTANO.js';
+import { scanProject, expandFileGlobs } from './chunk-ULEWJ3ZK.js';
+import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-C7LBUFNU.js';
+import { PACK_VERSION } from './chunk-6DUDIVIC.js';
+import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath, isExecutable } from './chunk-IV3FYVTS.js';
 import path from 'node:path';
 import YAML from 'yaml';
 import { promises } from 'node:fs';
@@ -302,13 +302,43 @@ function parseGithubWorkflow(text, file, scripts) {
   }
   return { jobs, parseErrors };
 }
+async function companionOf(root, hooksDir, hook, hookText, scripts) {
+  const rel = path.posix.join(hooksDir.split(path.sep).join("/"), `${hook}.local`);
+  if (!hookText.includes(`${hook}.local`)) return null;
+  const abs = path.join(root, hooksDir, `${hook}.local`);
+  const text = await readText(abs);
+  if (text === null) return null;
+  const [executable, hookExecutable] = await Promise.all([
+    isExecutable(abs),
+    isExecutable(path.join(root, hooksDir, hook))
+  ]);
+  if (executable === false && hookExecutable === true) return { rel, tools: [], state: "inert" };
+  return {
+    rel,
+    tools: matchTools(text, scripts),
+    state: executable === true ? "counted" : "unverified"
+  };
+}
 async function localHookTools(root, facts, scripts) {
   const hooks = facts.hooks;
   const empty = [];
+  const companions = [];
+  const unverifiedCompanions = [];
+  const inertCompanions = [];
   const readHook = async (name) => {
     if (!hooks.dir) return empty;
     const text = await readText(path.join(root, hooks.dir, name));
-    return text ? matchTools(text, scripts) : empty;
+    if (!text) return empty;
+    const tools = new Set(matchTools(text, scripts));
+    const companion = await companionOf(root, hooks.dir, name, text, scripts);
+    if (companion) {
+      if (companion.state === "inert") inertCompanions.push(companion.rel);
+      else {
+        (companion.state === "counted" ? companions : unverifiedCompanions).push(companion.rel);
+        for (const t of companion.tools) tools.add(t);
+      }
+    }
+    return [...tools];
   };
   let preCommit = [];
   let prePush = [];
@@ -352,7 +382,17 @@ async function localHookTools(root, facts, scripts) {
     }
   }
   const wired = hooks.source === "custom" || hooks.source === "husky" || hooks.source === "husky-legacy" ? true : hooks.source === "githooks" ? facts.git.hooksPath === hooks.dir : false;
-  return { source: hooks.source, wired, preCommit, prePush, commitMsg, lintStaged };
+  return {
+    source: hooks.source,
+    wired,
+    preCommit,
+    prePush,
+    commitMsg,
+    lintStaged,
+    companions,
+    unverifiedCompanions,
+    inertCompanions
+  };
 }
 async function detectThresholds(root, scripts, ciJobs) {
   const sonarConfigured = await pathExists(path.join(root, "sonar-project.properties")) || ciJobs.some((j) => j.tools.includes("sonar"));
@@ -485,6 +525,24 @@ function deriveGateFindings(inv, disclosures = []) {
       );
     }
   }
+  if (inv.local.inertCompanions?.length) {
+    const files = inv.local.inertCompanions;
+    findings.push(
+      finding({
+        id: `${LENS_ID2}/companion-not-executable`,
+        tier: "gap",
+        kind: "truth",
+        claim: `${files.join(", ")} ${files.length === 1 ? "is" : "are"} called by a hook but not executable \u2014 the checks inside never run`,
+        evidence: files,
+        why: "The hook guards the call with `[ -x ]`, so it skips the file in silence \u2014 the repo looks guarded and is not, on every clone that carries the same mode bit.",
+        // chmod alone does not survive a fresh clone: git tracks exactly one permission bit, so
+        // the fix has to reach the index or the dead gate propagates to everyone else.
+        action: `Run \`chmod +x ${files[0]}\` and commit the mode with \`git update-index --chmod=+x ${files[0]}\`.`,
+        effort: "S",
+        confidence: "high"
+      })
+    );
+  }
   for (const tool of CORRECTNESS_TOOLS) {
     if (!enforcedCiTools.has(tool) || localTools.has(tool)) continue;
     const jobs = enforcedCiJobs.filter((j) => j.tools.includes(tool));
@@ -585,6 +643,16 @@ var gateIntegrityLens = {
     }
     if (inv.ci.parseErrors.length)
       disclosures.push(...inv.ci.parseErrors.map((e) => `CI parse: ${e}`));
+    if (inv.local.companions.length) {
+      disclosures.push(
+        `Checks in ${inv.local.companions.join(", ")} are counted as locally enforced \u2014 the generated hook calls the companion, and etymd reads it without owning it.`
+      );
+    }
+    if (inv.local.unverifiedCompanions.length) {
+      disclosures.push(
+        `Checks in ${inv.local.unverifiedCompanions.join(", ")} are counted as locally enforced, but the execute bit could not be judged here (no POSIX mode bits, or the hook beside it is not executable either) \u2014 whether ${inv.local.unverifiedCompanions.length === 1 ? "it runs" : "they run"} was not verified.`
+      );
+    }
     if (inv.ci.system === "none")
       disclosures.push("No CI configuration found \u2014 CI\u2194local comparisons skipped.");
     const findings = deriveGateFindings(inv, disclosures);

package/dist/{chunk-LT67FU2Y.js → chunk-OKU3HXIH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
-import { readText, wordCount, approxTokens, pathExists } from './chunk-YLNQQZ5F.js';
+import { DEFAULT_CONFIG } from './chunk-K7QBTANO.js';
+import { readText, wordCount, approxTokens, pathExists } from './chunk-IV3FYVTS.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/{chunk-HX5IYDCU.js → chunk-ULEWJ3ZK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-WWV5W2MM.js';
-import { PACK_VERSION } from './chunk-IGHES6AK.js';
-import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-YLNQQZ5F.js';
+import { VERSION } from './chunk-HLWCODYX.js';
+import { PACK_VERSION } from './chunk-6DUDIVIC.js';
+import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-IV3FYVTS.js';
 import path from 'node:path';
 import { promises } from 'node:fs';
 

package/dist/{chunk-MMPV67FW.js → chunk-V2SOHPXF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { readLedger, resolveEntry, writeLedger } from './chunk-WWBF4Y7K.js';
-import { print, renderLedger, glyph, theme } from './chunk-TADKOW6P.js';
+import { readLedger, resolveEntry, writeLedger } from './chunk-OAFYLBVG.js';
+import { print, renderLedger, glyph, theme } from './chunk-5BVKFJWM.js';
 
 // src/commands/ledger.ts
 async function list(opts) {

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-WWV5W2MM.js';
+import { VERSION } from './chunk-HLWCODYX.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-GUG2QFZM.js');
+    const { run } = await import('./audit-ICT2JK7A.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-Q5Q7IGZS.js');
+    const { run } = await import('./init-IPUPP4GB.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,49 +52,49 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-FISVPFL2.js');
+    const { run } = await import('./approve-ZLOW4A7R.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-UVNX52J5.js');
+    const { run } = await import('./scan-6L4L2GXT.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-SOLNC37X.js');
+    const { run } = await import('./doctor-PORXFSYT.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("context").description("Measure the always-loaded context footprint and flag extraction candidates").option("--json", "print the budget as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./context-4DGXO7JR.js');
+    const { run } = await import('./context-ZEUI5ESZ.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-UF6KV7SG.js');
+    const { run } = await import('./brief-PDUGGMLI.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
 program.command("ledger").description("List every tracked finding grouped by status (open \xB7 accepted \xB7 dismissed \xB7 \u2026)").option("--json", "print the raw ledger as JSON").action(
   (opts, cmd) => action(async () => {
-    const { list } = await import('./ledger-TMIV45AA.js');
+    const { list } = await import('./ledger-B2XGANTH.js');
     await list({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("dismiss").argument("<finding-id>", "the finding id (from `etymd audit`) to dismiss").description("Dismiss a finding as a false positive / not applicable (hidden from future audits)").requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").action(
   (id, opts, cmd) => action(async () => {
-    const { dismiss } = await import('./ledger-TMIV45AA.js');
+    const { dismiss } = await import('./ledger-B2XGANTH.js');
     await dismiss({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
 program.command("accept").argument("<finding-id>", "the finding id (from `etymd audit`) to accept").description("Accept a real finding as a known trade-off (hidden from future audits)").option("--reason <text>", "optional note on why the trade-off is accepted").action(
   (id, opts, cmd) => action(async () => {
-    const { accept } = await import('./ledger-TMIV45AA.js');
+    const { accept } = await import('./ledger-B2XGANTH.js');
     await accept({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-UTFZKYNH.js');
+    const { sweep } = await import('./fleet-JHNQOLSY.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +126,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-UTFZKYNH.js');
+    const { check } = await import('./fleet-JHNQOLSY.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +136,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-UTFZKYNH.js');
+    const { add } = await import('./fleet-JHNQOLSY.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -159,7 +159,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-UTFZKYNH.js');
+    const { dismiss } = await import('./fleet-JHNQOLSY.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -174,7 +174,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-UTFZKYNH.js');
+    const { accept } = await import('./fleet-JHNQOLSY.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -183,7 +183,7 @@ program.command("screen").description(
   "Content screen: check for text that must never be published. Bring your own patterns \u2014 etymd ships none."
 ).option("--staged", "screen what a commit is about to add (default)").option("--tree", "screen every tracked file \u2014 what is about to leave the machine").option("--message <file>", "screen a commit message (the commit-msg hook's $1)").option("--dir <dir>", "screen an unpacked build artifact \u2014 what actually ships").option("--patterns <file>", "pattern file (default: ~/.config/etymd/screen-patterns)").option("--advisory", "report without failing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./screen-U7JMWZPS.js');
+    const { run } = await import('./screen-6R6NXDSY.js');
     const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
     await run({
       cwd: resolveCwd(cmd),
@@ -196,7 +196,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-YUUV7YI4.js');
+    const { run } = await import('./gates-KHC7HPIF.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/config-UJRSCDMD.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-K7QBTANO.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-IV3FYVTS.js';

package/dist/{context-4DGXO7JR.js → context-ZEUI5ESZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-LT67FU2Y.js';
-import { readConfig } from './chunk-NMZ3RHWW.js';
-import { print, renderContext } from './chunk-TADKOW6P.js';
-import './chunk-R74SJ7HS.js';
-import './chunk-YLNQQZ5F.js';
+import { measureContext } from './chunk-OKU3HXIH.js';
+import { readConfig } from './chunk-K7QBTANO.js';
+import { print, renderContext } from './chunk-5BVKFJWM.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-IV3FYVTS.js';
 
 // src/commands/context.ts
 async function run(opts) {

package/dist/doctor-PORXFSYT.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { run } from './chunk-BQGCLPHS.js';
+import './chunk-OESQNO2J.js';
+import './chunk-OKU3HXIH.js';
+import './chunk-OAFYLBVG.js';
+import './chunk-K7QBTANO.js';
+import './chunk-5BVKFJWM.js';
+import './chunk-ULEWJ3ZK.js';
+import './chunk-HLWCODYX.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-6DUDIVIC.js';
+import './chunk-IV3FYVTS.js';
+
+// src/commands/doctor.ts
+async function run2(opts) {
+  await run({ cwd: opts.cwd, json: opts.json, truth: true });
+}
+
+export { run2 as run };

package/dist/{fleet-UTFZKYNH.js → fleet-JHNQOLSY.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
-import { dismiss, accept } from './chunk-MMPV67FW.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-6G3JJMZ3.js';
-import './chunk-LT67FU2Y.js';
-import { readLedger } from './chunk-WWBF4Y7K.js';
-import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
-import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-HX5IYDCU.js';
-import './chunk-WWV5W2MM.js';
-import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
-import './chunk-IGHES6AK.js';
-import { readText, pathExists, git, isDirectory } from './chunk-YLNQQZ5F.js';
+import { dismiss, accept } from './chunk-V2SOHPXF.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-OESQNO2J.js';
+import './chunk-OKU3HXIH.js';
+import { readLedger } from './chunk-OAFYLBVG.js';
+import { DEFAULT_CONFIG } from './chunk-K7QBTANO.js';
+import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-5BVKFJWM.js';
+import { scanProject } from './chunk-ULEWJ3ZK.js';
+import './chunk-HLWCODYX.js';
+import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
+import './chunk-6DUDIVIC.js';
+import { readText, pathExists, git, isDirectory } from './chunk-IV3FYVTS.js';
 import { promises } from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { select, isCancel, cancel, text, confirm } from '@clack/prompts';
-import os from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
@@ -687,9 +687,9 @@ async function checkCorpEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-CBMTNN7P.js');
-  const { scanProject: scanProject2 } = await import('./scan-NWZ65YWB.js');
-  const { readConfig } = await import('./config-MX7OYI7F.js');
+  const { planWorkflow } = await import('./generate-UTKQ4GE6.js');
+  const { scanProject: scanProject2 } = await import('./scan-D4M7JXE3.js');
+  const { readConfig } = await import('./config-UJRSCDMD.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;
@@ -709,7 +709,14 @@ async function checkGateDrift(manifest, findings, disclosures) {
     const { config } = await readConfig(root);
     const planned = (await planWorkflow(root, facts, { agents: false, gates: true, gateConfig: config.gates })).filter((f) => f.executable);
     const missing = planned.filter((f) => !f.exists).map((f) => f.path);
-    const stale = planned.filter((f) => f.exists && f.differs).map((f) => f.path);
+    const differing = planned.filter((f) => f.exists && f.differs);
+    const stale = differing.filter((f) => f.drift !== "edited").map((f) => f.path);
+    const edited = differing.filter((f) => f.drift === "edited").map((f) => f.path);
+    if (edited.length) {
+      disclosures.push(
+        `${entry.name}: ${edited.join(", ")} edited since etymd generated ${edited.length === 1 ? "it" : "them"} \u2014 a customisation, not drift; etymd will not overwrite ${edited.length === 1 ? "it" : "them"}`
+      );
+    }
     if (missing.length) {
       findings.push(
         finding(
@@ -729,8 +736,8 @@ async function checkGateDrift(manifest, findings, disclosures) {
           "polish",
           `\`${entry.name}\` has ${stale.length} gate${stale.length === 1 ? "" : "s"} that differ from what its own inputs generate`,
           stale.map((s) => `${entry.name}: ${s}`),
-          "A hand-edited or outdated hook drifts from the pack silently \u2014 the repo believes it runs checks the file no longer contains.",
-          "Re-run `etymd gates` (it asks before overwriting), or record the intent in .etymd/config.json."
+          "An outdated hook drifts from the pack silently \u2014 the repo believes it runs checks the file no longer contains.",
+          "Re-run `etymd gates` in that repo \u2014 it regenerates a gate it provably wrote and asks before touching anything else."
         )
       );
     }
@@ -1077,6 +1084,35 @@ async function check(opts) {
   renderFindings(findings);
   renderFleetNotes([], disclosures);
 }
+async function recordCorpMapping(manifest, name, absTarget) {
+  const home = os.homedir();
+  const value = absTarget === home || absTarget.startsWith(home + path.sep) ? `~${absTarget.slice(home.length)}` : absTarget;
+  const insideRepo = await git(manifest.dir, ["rev-parse", "--is-inside-work-tree"]) === "true";
+  if (insideRepo) {
+    const ignored = await git(manifest.dir, ["check-ignore", "-q", manifest.localPath]) !== null;
+    if (!ignored) {
+      throw new Error(
+        `${path.basename(manifest.localPath)} is not gitignored \u2014 refusing to write employer directory names into a file git would track. Add it to .gitignore, then re-run.`
+      );
+    }
+  }
+  const existing = await readText(manifest.localPath);
+  let doc = {};
+  if (existing) {
+    try {
+      doc = JSON.parse(existing);
+    } catch {
+      throw new Error(
+        `${path.basename(manifest.localPath)} is not valid JSON \u2014 fix it before registering, so the mapping is not written over hand-maintained entries that cannot be re-derived.`
+      );
+    }
+  }
+  const dirs = doc.dirs ?? {};
+  dirs[name] = value;
+  doc.dirs = dirs;
+  await promises.writeFile(manifest.localPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
+  return value;
+}
 async function add(opts) {
   const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
   if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
@@ -1190,10 +1226,14 @@ async function add(opts) {
     path: path.relative(manifest.root ?? manifest.dir, absTarget),
     trust,
     contract: {},
-    links: {},
-    // The scan does not collect remotes (they are not a workflow fact), so read it here —
-    // recorded when present, simply absent when the repo has no origin yet.
-    ...remote ? { remote } : {}
+    links: {}
+    // The remote is deliberately NOT recorded. Nothing reads it — it was persisted only
+    // because it happened to be derivable — and it is the field that turns a mis-profiled
+    // entry into a disclosure: a raw URL carries the host AND the internal group path,
+    // while `path` carries a bare directory name. Removing a field no consumer reads
+    // retires that whole class without any host-matching guess, and keeps working on a
+    // machine that has no local manifest for the corp-host guard above to read.
+    // It stays derivable at any time from the checkout itself, which is where it came from.
   };
   print(`  ${glyph.bullet} ${theme.dim("entry")}`);
   print(
@@ -1208,11 +1248,20 @@ async function add(opts) {
       return;
     }
   }
+  let mappedTo;
+  if (profile === "corp") {
+    mappedTo = await recordCorpMapping(manifest, name, absTarget);
+  }
   const doc = JSON.parse(raw);
   if (!Array.isArray(doc.projects)) throw new Error("manifest has no `projects` array to append to");
   doc.projects.push(entry);
   await promises.writeFile(manifest.manifestPath, JSON.stringify(doc, null, 2) + "\n", "utf8");
   print(`  ${glyph.ok} ${theme.dim("registered")} ${theme.info(name)}`);
+  if (mappedTo) {
+    print(
+      `  ${glyph.ok} ${theme.dim("mapped")} ${theme.info(`${name} \u2192 ${mappedTo}`)} ${theme.dim(`in ${path.basename(manifest.localPath)} (gitignored)`)}`
+    );
+  }
   print(`  ${theme.dim(`verify with \`etymd fleet check --manifest ${manifest.manifestPath}\``)}`);
 }
 async function resolveFleetFinding(opts, status) {

package/dist/{gates-YUUV7YI4.js → gates-KHC7HPIF.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-EF6BPBG6.js';
-import { derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-OX3LUOZR.js';
-import { readConfig, CONFIG_FILE, configPath } from './chunk-NMZ3RHWW.js';
-import { section, print, glyph, theme, renderPlan } from './chunk-TADKOW6P.js';
-import { scanProject } from './chunk-HX5IYDCU.js';
-import './chunk-WWV5W2MM.js';
-import './chunk-R74SJ7HS.js';
-import './chunk-IGHES6AK.js';
-import { readText, git } from './chunk-YLNQQZ5F.js';
+import { derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-KTIEYKFK.js';
+import { readConfig, CONFIG_FILE, configPath } from './chunk-K7QBTANO.js';
+import { section, print, glyph, theme, renderPlan } from './chunk-5BVKFJWM.js';
+import { scanProject } from './chunk-ULEWJ3ZK.js';
+import './chunk-HLWCODYX.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-6DUDIVIC.js';
+import { readText, git } from './chunk-IV3FYVTS.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 import { confirm, isCancel, cancel, select, multiselect } from '@clack/prompts';
@@ -185,7 +185,7 @@ async function run(opts) {
     return files.filter((f) => f.executable);
   };
   let gateFiles = await plan();
-  renderPlan(gateFiles);
+  renderPlan(gateFiles, { regeneratesStale: true });
   printGateSummary(gateConfig, facts, configSource);
   if (!opts.yes) {
     const choice = await select({
@@ -217,13 +217,13 @@ async function run(opts) {
   const overwrite = /* @__PURE__ */ new Set();
   for (const f of gateFiles) {
     if (!f.exists) continue;
-    if (!f.differs) {
+    if (!f.differs || f.drift === "stale") {
       overwrite.add(f.path);
       continue;
     }
     if (opts.yes) continue;
     const ow = await confirm({
-      message: `${f.path} exists with different content (hand-edited?). Overwrite with the pack version?`,
+      message: f.drift === "edited" ? `${f.path} has been edited since etymd generated it. Overwrite with the pack version?` : `${f.path} carries no etymd generation stamp, so it may be hand-written. Overwrite with the pack version?`,
       initialValue: false
     });
     if (isCancel(ow)) {
@@ -236,8 +236,16 @@ async function run(opts) {
   await git(opts.cwd, ["config", "core.hooksPath", ".githooks"]);
   section("Done");
   for (const w of result.written) print(`  ${glyph.ok} ${theme.dim("wrote")} ${theme.info(w)}`);
-  for (const sk of result.skipped)
-    print(`  ${glyph.bullet} ${theme.dim("kept (hand-edited)")} ${theme.dim(sk)}`);
+  for (const sk of result.skipped) {
+    const drift = gateFiles.find((f) => f.path === sk)?.drift;
+    const reason = drift === "edited" ? "kept (edited since generated)" : "kept (no etymd stamp)";
+    print(`  ${glyph.bullet} ${theme.dim(reason)} ${theme.dim(sk)}`);
+    if (opts.yes) {
+      print(
+        `    ${theme.dim("its content differs from what this repo now generates \u2014 re-run without --yes to review and overwrite")}`
+      );
+    }
+  }
   print(`  ${glyph.ok} ${theme.dim("set")} ${theme.code("core.hooksPath = .githooks")}`);
   const wrotePublishGate = result.written.includes(PUBLISH_GATE_SCRIPT);
   if (wrotePublishGate) {

package/dist/generate-UTKQ4GE6.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+export { derivedCommands, planWorkflow } from './chunk-KTIEYKFK.js';
+import './chunk-K7QBTANO.js';
+import './chunk-C7LBUFNU.js';
+import './chunk-6DUDIVIC.js';
+import './chunk-IV3FYVTS.js';

package/dist/index.d.ts

@@ -256,8 +256,15 @@ interface GeneratedFile {
     contents: string;
     /** Present on disk already — apply will skip or ask before overwriting. */
     exists: boolean;
-    /** The existing file's content differs from what the pack would generate (hand-edited or stale). */
+    /** The existing file's content differs from what the pack would generate. */
     differs?: boolean;
+    /**
+     * WHY it differs, when it does — the two cases pull in opposite directions and must not share
+     * a bucket. `stale` is provably etymd's own output against inputs that have since moved (an
+     * older pack, a renamed script, a changed package manager): regenerating it destroys nothing.
+     * `edited` and `unstamped` may hold someone's work, so they are kept.
+     */
+    drift?: "stale" | "edited" | "unstamped";
     /** Hooks need the executable bit. */
     executable?: boolean;
     label: string;
@@ -745,6 +752,18 @@ interface GateInventory {
         prePush: GateTool[];
         commitMsg: GateTool[];
         lintStaged: GateTool[];
+        /** Companion files the hooks call and whose checks ARE counted above. */
+        companions: string[];
+        /**
+         * Counted, but the execute bit could not be judged here — no POSIX mode bits, or a hook that
+         * is not itself executable, which means this filesystem's bits prove nothing either way.
+         */
+        unverifiedCompanions: string[];
+        /**
+         * Companions a hook calls that exist and provably lack the execute bit while the hook beside
+         * them has it. NOT counted: the call skips them on every run.
+         */
+        inertCompanions: string[];
     };
     ci: {
         system: ProjectFacts["ci"]["system"];
@@ -769,7 +788,7 @@ declare const gateIntegrityLens: Lens;
  * change meaning. Stamped into facts, baselines, and generated artifacts so drift against the
  * pack is computable and `harvest` has something to diff.
  */
-declare const PACK_VERSION = "5";
+declare const PACK_VERSION = "6";
 
 declare const VERSION: string;
 declare const NAME: string;