finitemonkey 0.1.0-next.13 → 0.1.0-next.15

package/dist/finitemonkey.mjs

@@ -1620,8 +1620,8 @@ var shannonEntropy = (text6) => {
   const counts = /* @__PURE__ */ new Map();
   for (const char of text6) counts.set(char, (counts.get(char) ?? 0) + 1);
   let entropy = 0;
-  for (const count3 of counts.values()) {
-    const p = count3 / text6.length;
+  for (const count4 of counts.values()) {
+    const p = count4 / text6.length;
     entropy -= p * Math.log2(p);
   }
   return entropy;
@@ -1670,6 +1670,35 @@ var defineRule = (spec2) => ({
   skipTestPaths: spec2.skipTestPaths ?? false,
   placeholders: spec2.placeholders ?? true
 });
+var isWarning = (finding3) => finding3.severity === "warning";
+var blocking = (findings) => findings.filter((finding3) => !isWarning(finding3));
+
+// src/secrets/rules/exposure.ts
+var ARGUMENT_CONTEXT = String.raw`(?:^|\n)[ \t-]*(?:command|entrypoint|CMD|ENTRYPOINT|RUN|ExecStart(?:Pre|Post)?|ExecReload)\b[^\n]*?`;
+var SECRET_FLAG = String.raw`(?<=[\s"'\[,])--?[A-Za-z0-9_-]*(?:password|passwd|pass|secret|token|requirepass|api-?key)`;
+var EXPOSURE_RULES = [
+  defineRule({
+    id: "secret-in-process-args",
+    summary: "Literal password, token or key passed as a command-line argument in compose, a Dockerfile or a systemd unit (visible in ps and docker inspect)",
+    kind: "practice",
+    severity: "warning",
+    keywords: ["command", "entrypoint", "cmd", "run", "execstart", "execreload"],
+    source: String.raw`${ARGUMENT_CONTEXT}${SECRET_FLAG}(?:=["']?|["'][ \t]*,[ \t]*["']|[ \t]+["']?)(?<secret>[^\s"',\]$\x60/][^\s"',\]\x60]{3,127})`,
+    flags: "i",
+    minLength: 4
+  }),
+  defineRule({
+    id: "tls-disabled",
+    summary: "TLS verification turned off in code: sslmode set to disable, rejectUnauthorized or InsecureSkipVerify set to skip checks, Python verify set to False, NODE_TLS_REJECT_UNAUTHORIZED set to 0",
+    kind: "practice",
+    severity: "warning",
+    keywords: ["sslmode", "rejectunauthorized", "verify", "insecureskipverify", "node_tls_reject_unauthorized"],
+    source: String.raw`(?<secret>\bsslmode[ \t]*=[ \t]*["']?disable\b|\brejectUnauthorized["']?[ \t]*:[ \t]*false\b|\bverify[ \t]*=[ \t]*False\b|\bInsecureSkipVerify[ \t]*:[ \t]*true\b|\bNODE_TLS_REJECT_UNAUTHORIZED["']?[ \t]*(?:=|:)[ \t]*["']?0\b)`,
+    minLength: 1,
+    placeholders: false,
+    skipTestPaths: true
+  })
+];
 
 // src/secrets/rules/providers.ts
 var PROVIDER_RULES = [
@@ -1893,7 +1922,7 @@ var STRUCTURAL_RULES = [
 ];
 
 // src/secrets/rules/catalog.ts
-var RULES = [...PROVIDER_RULES, ...STRUCTURAL_RULES];
+var RULES = [...PROVIDER_RULES, ...STRUCTURAL_RULES, ...EXPOSURE_RULES];
 var CREDENTIAL_RULES = RULES.filter((rule) => rule.kind === "credential");
 var ruleById = (id) => RULES.find((rule) => rule.id === id);
 
@@ -2227,8 +2256,28 @@ var reportMarkdown = (env, ctx, envelope) => {
 };
 var reportPath = (env) => toAbsolutePath(join5(env.root, ...REPORTS_DIR.split("/"), `doctor-${stamp(env.runtime.now())}.md`));
 
-// src/doctor/settings.ts
+// src/install/plugin-yield.ts
 import { join as join6 } from "node:path";
+var PLUGIN_VIA = "plugin";
+var YIELD_STDOUT = `${JSON.stringify({ continue: true })}
+`;
+var projectOwnsHooks = (ctx) => {
+  const root = ctx.env["CLAUDE_PROJECT_DIR"] ?? ctx.cwd;
+  const text6 = ctx.runtime.readText(toAbsolutePath(join6(root, ...SETTINGS_FILE.split("/"))));
+  if (!text6.ok) return false;
+  const parsed = parseJsonObject(text6.value);
+  return parsed.ok && ownHandlersIn(parsed.value) > 0;
+};
+
+// src/install/plugin-hooks.ts
+var PLUGIN_NAME = "finitemonkey";
+var MARKETPLACE_NAME = "finitemonkey";
+var NEXT_MARKETPLACE_NAME = "finitemonkey-next";
+var STABLE_PLUGIN_ID = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
+var NEXT_PLUGIN_ID = `${PLUGIN_NAME}@${NEXT_MARKETPLACE_NAME}`;
+
+// src/doctor/settings.ts
+import { join as join7 } from "node:path";
 var MANAGED = {
   darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
   linux: "/etc/claude-code/managed-settings.json",
@@ -2237,7 +2286,7 @@ var MANAGED = {
 var userSettingsPath = ({ env, runtime }) => {
   const configDir = env["CLAUDE_CONFIG_DIR"];
   return toAbsolutePath(
-    configDir === void 0 ? join6(runtime.homeDir(), ".claude", "settings.json") : join6(configDir, "settings.json")
+    configDir === void 0 ? join7(runtime.homeDir(), ".claude", "settings.json") : join7(configDir, "settings.json")
   );
 };
 var settingsPaths = (env) => {
@@ -2245,8 +2294,8 @@ var settingsPaths = (env) => {
   return [
     ...managed === void 0 ? [] : [{ scope: "managed", path: toAbsolutePath(managed) }],
     { scope: "user", path: userSettingsPath(env) },
-    { scope: "project", path: toAbsolutePath(join6(env.root, ".claude", "settings.json")) },
-    { scope: "local", path: toAbsolutePath(join6(env.root, ".claude", "settings.local.json")) }
+    { scope: "project", path: toAbsolutePath(join7(env.root, ".claude", "settings.json")) },
+    { scope: "local", path: toAbsolutePath(join7(env.root, ".claude", "settings.local.json")) }
   ];
 };
 var readSettings = (env) => settingsPaths(env).flatMap(({ scope: scope2, path }) => {
@@ -2358,6 +2407,21 @@ var cleanupPeriod = (env, all) => {
     )
   ];
 };
+var PRECEDENCE = ["user", "project", "local", "managed"];
+var pluginOn = (all, id) => {
+  const ordered = PRECEDENCE.flatMap((scope2) => all.filter((item) => item.scope === scope2));
+  const values = ordered.map(({ settings }) => settings["enabledPlugins"]).map((plugins) => isRecord(plugins) ? plugins[id] : void 0).filter((value) => typeof value === "boolean");
+  return values.at(-1) === true;
+};
+var pluginChannels = (all) => pluginOn(all, STABLE_PLUGIN_ID) && pluginOn(all, NEXT_PLUGIN_ID) ? [
+  finding(
+    "settings.plugin_channels",
+    "fail",
+    "doctor.settings.plugin_channels",
+    { stable: STABLE_PLUGIN_ID, next: NEXT_PLUGIN_ID },
+    "doctor.settings.fix_plugin_channels"
+  )
+] : [];
 var checkClaudeSettings = (env) => {
   const all = readSettings(env);
   const plugins = enabledPlugins(all);
@@ -2367,6 +2431,7 @@ var checkClaudeSettings = (env) => {
       all,
       plugins.some((id) => id.startsWith("finitemonkey@"))
     ),
+    ...pluginChannels(all),
     ...agentTeams(env, all),
     ...loopPlugins(plugins),
     ...cleanupPeriod(env, all)
@@ -2374,7 +2439,7 @@ var checkClaudeSettings = (env) => {
 };
 
 // src/doctor/environment.ts
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var AUTH_VARIABLES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_AUTH_TOKEN",
@@ -2412,7 +2477,7 @@ var pathDirs = ({ env, platform }) => {
 var copiesOnPath = (env) => {
   const names = EXECUTABLES[env.platform] ?? ["finitemonkey"];
   const found = pathDirs(env).flatMap(
-    (dir) => names.map((name) => toAbsolutePath(join7(dir, name))).filter((path) => env.runtime.stat(path)?.kind === "file").map((path) => env.runtime.realpath(path))
+    (dir) => names.map((name) => toAbsolutePath(join8(dir, name))).filter((path) => env.runtime.stat(path)?.kind === "file").map((path) => env.runtime.realpath(path))
   );
   const byDir = new Map(found.map((path) => [path.replace(/\.(cmd|exe|ps1)$/i, ""), path]));
   return [...byDir.values()];
@@ -2446,7 +2511,7 @@ var checkAuthVariables = ({ env, platform }) => {
 };
 
 // src/doctor/hooks.ts
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 
 // src/hooks/events.ts
 var HOOK_EVENTS = [
@@ -3126,9 +3191,9 @@ var skipOptions = (args, wrapper) => {
   }
   return index + wrapper.positionals;
 };
-var shift = (stage, count3, name) => ({
+var shift = (stage, count4, name) => ({
   ...stage,
-  argv: stage.argv.slice(count3),
+  argv: stage.argv.slice(count4),
   via: [...stage.via, name]
 });
 var envCommand = (stage) => {
@@ -3509,7 +3574,7 @@ var selfGuard = (input) => {
 };
 
 // src/guards/tests/hook.ts
-import { join as join8, relative as relative3 } from "node:path";
+import { join as join9, relative as relative3 } from "node:path";
 
 // src/guards/tests/patterns.ts
 var JS_TEST = /(^|\/)(__tests__|__test__)\/|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)tests?\/.*\.[cm]?[jt]sx?$/;
@@ -3699,7 +3764,7 @@ var shellViolations = (input, root) => {
   return parseShell(command).flatMap(
     (simple) => writtenPaths(simple).flatMap((path) => {
       const local = localPath(root, path);
-      const exists = input.runtime.stat(toAbsolutePath(join8(root, local))) !== void 0;
+      const exists = input.runtime.stat(toAbsolutePath(join9(root, local))) !== void 0;
       if (!exists) return [];
       if (isProtectedConfig(local)) return [{ kind: "config_changed", path: local }];
       return isTestFile(local) ? [{ kind: "test_removed", path: local }] : [];
@@ -3719,17 +3784,17 @@ var testsGuard = (input) => {
 };
 
 // src/gate/hooks/config.ts
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // src/gate/hooks/common.ts
-import { dirname as dirname5, join as join9 } from "node:path";
+import { dirname as dirname5, join as join10 } from "node:path";
 var DEFAULT_GATE_BUDGET_MS = 3e5;
 var sessionCwd = (input) => input.payload.cwd === void 0 ? input.cwd : toAbsolutePath(input.payload.cwd, input.cwd);
 var MAX_DEPTH2 = 64;
 var findRepoRoot = (runtime, start) => {
   let current = start;
   for (let depth = 0; depth < MAX_DEPTH2; depth += 1) {
-    if (runtime.stat(toAbsolutePath(join9(current, ".git"))) !== void 0) return current;
+    if (runtime.stat(toAbsolutePath(join10(current, ".git"))) !== void 0) return current;
     const parent = toAbsolutePath(dirname5(current));
     if (parent === current) return void 0;
     current = parent;
@@ -3766,9 +3831,9 @@ var censusOf = (text6) => {
   return { hooks: countIn(parsed.value["hooks"]), disabled: parsed.value["disableAllHooks"] === true };
 };
 var settingsFiles = (paths, env) => [
-  toAbsolutePath(join10(paths.root, ".claude", "settings.json")),
-  toAbsolutePath(join10(paths.root, ".claude", "settings.local.json")),
-  ...env["HOME"] === void 0 ? [] : [toAbsolutePath(join10(env["HOME"], ".claude", "settings.json"))]
+  toAbsolutePath(join11(paths.root, ".claude", "settings.json")),
+  toAbsolutePath(join11(paths.root, ".claude", "settings.local.json")),
+  ...env["HOME"] === void 0 ? [] : [toAbsolutePath(join11(env["HOME"], ".claude", "settings.json"))]
 ];
 var read2 = (runtime, path) => {
   const text6 = runtime.readText(path);
@@ -3912,7 +3977,93 @@ var implicitContract = (files) => {
 };
 
 // src/gate/prepare.ts
-import { join as join11 } from "node:path";
+import { join as join14 } from "node:path";
+
+// src/git/project-config.ts
+import { join as join12 } from "node:path";
+var CONFIG_FILE3 = ".finitemonkey/config.yml";
+var unquote = (value) => value.trim().replace(/^(["'])(.*)\1$/s, "$2");
+var stripComment = (line2) => {
+  let quote;
+  for (let index = 0; index < line2.length; index += 1) {
+    const char = line2.charAt(index);
+    if (quote === void 0 && (char === '"' || char === "'")) quote = char;
+    else if (char === quote) quote = void 0;
+    else if (quote === void 0 && char === "#" && (index === 0 || /\s/.test(line2.charAt(index - 1)))) {
+      return line2.slice(0, index);
+    }
+  }
+  return line2;
+};
+var flowList = (value) => {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return void 0;
+  return trimmed.slice(1, -1).split(",").map(unquote).filter((item) => item !== "");
+};
+var keyValue = (body2) => {
+  const match = /^("[^"]*"|'[^']*'|[^:]+?)\s*:(?:\s+(.*))?$/.exec(body2);
+  if (match === null) return void 0;
+  return { key: unquote(match[1] ?? ""), value: match[2] ?? "" };
+};
+var addItem = (frame, item) => {
+  if (frame.key === void 0) return;
+  const parent = frame.tree[frame.key];
+  if (Array.isArray(parent)) parent.push(item);
+  else frame.tree[frame.key] = [item];
+};
+var placeLine = (stack, indent, body2) => {
+  while (stack.length > 1 && (stack[stack.length - 1]?.indent ?? 0) >= indent && !body2.startsWith("- ")) stack.pop();
+  const top = stack[stack.length - 1];
+  if (top === void 0) return;
+  if (body2.startsWith("- ")) {
+    addItem(top, unquote(body2.slice(2)));
+    return;
+  }
+  const pair = keyValue(body2);
+  if (pair === void 0) return;
+  const parentTree = top.key === void 0 ? top.tree : ensureTree(top.tree, top.key);
+  if (pair.value === "") {
+    stack.push({ indent, tree: parentTree, key: pair.key });
+    return;
+  }
+  parentTree[pair.key] = flowList(pair.value) ?? unquote(pair.value);
+};
+var ensureTree = (tree, key) => {
+  const existing = tree[key];
+  if (existing !== void 0 && typeof existing !== "string" && !Array.isArray(existing)) return existing;
+  const fresh3 = {};
+  tree[key] = fresh3;
+  return fresh3;
+};
+var parseConfigYaml = (text6) => {
+  const root = {};
+  const stack = [{ indent: -1, tree: root, key: void 0 }];
+  for (const raw of text6.split(/\r?\n/)) {
+    const line2 = stripComment(raw).trimEnd();
+    if (line2.trim() === "" || line2.trim() === "---") continue;
+    const indent = line2.length - line2.trimStart().length;
+    placeLine(stack, indent, line2.trim());
+  }
+  return root;
+};
+var isTree = (node) => typeof node === "object" && !Array.isArray(node);
+var configAt = (tree, ...path) => path.reduce((node, key) => isTree(node) ? node[key] : void 0, tree);
+var configList = (tree, ...path) => {
+  const node = configAt(tree, ...path);
+  if (typeof node === "string") return node === "" ? [] : [node];
+  return Array.isArray(node) ? node.filter((item) => typeof item === "string") : [];
+};
+var configMap = (tree, ...path) => {
+  const node = configAt(tree, ...path);
+  if (!isTree(node)) return {};
+  return Object.fromEntries(
+    Object.entries(node).filter((entry2) => typeof entry2[1] === "string")
+  );
+};
+var loadProjectConfig = (runtime, root) => {
+  const text6 = runtime.readText(toAbsolutePath(join12(root, CONFIG_FILE3)));
+  return text6.ok ? parseConfigYaml(text6.value) : {};
+};
 
 // src/core/yaml/scalar.ts
 var ESCAPES = {
@@ -4060,7 +4211,7 @@ var parseValue = (text6) => {
 
 // src/core/yaml/parse.ts
 var BOM = new RegExp(`^${String.fromCharCode(65279)}`);
-var stripComment = (text6) => {
+var stripComment2 = (text6) => {
   for (let index = 0; index < text6.length; index += 1) {
     const char = text6[index];
     if (char === '"' || char === "'") {
@@ -4075,7 +4226,7 @@ var toLines = (source) => {
   const lines3 = [];
   const raw = source.replace(BOM, "").split(/\r?\n/);
   for (const [index, full] of raw.entries()) {
-    const text6 = stripComment(full).trimEnd();
+    const text6 = stripComment2(full).trimEnd();
     const body2 = text6.trimStart();
     if (body2 === "" || body2 === "---" && lines3.length === 0) continue;
     const indentText = text6.slice(0, text6.length - body2.length);
@@ -4183,7 +4334,8 @@ var CHECK_KINDS = [
   "worktree",
   "merge",
   "prod",
-  "prose"
+  "prose",
+  "review"
 ];
 var GIT_REQUIREMENTS = ["committed", "pushed", "pr_open"];
 var SIZES = ["S", "M", "L"];
@@ -4389,6 +4541,9 @@ var readBaseline = (runtime, paths) => {
 };
 var writeBaseline = (runtime, paths, treeHash2, checks) => writeJsonFile(runtime, paths.cache(BASELINE_FILE), { treeHash: treeHash2, checks: { ...checks } }).ok;
 
+// src/gate/diff-shape.ts
+import { join as join13 } from "node:path";
+
 // src/gate/git.ts
 var EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 var GIT_TIMEOUT_MS = 15e3;
@@ -4488,10 +4643,20 @@ var numstat = (git, base) => {
 };
 var dirtyPaths = (git) => nulFields(git.out(["status", "--porcelain", "-z", "--", ".", EXCLUDE_FM]) ?? "").map((entry2) => entry2.slice(3));
 var aheadOfUpstream = (git) => {
-  const count3 = git.out(["rev-list", "--count", "@{u}..HEAD"])?.trim();
-  return count3 === void 0 ? void 0 : Number(count3);
+  const count4 = git.out(["rev-list", "--count", "@{u}..HEAD"])?.trim();
+  return count4 === void 0 ? void 0 : Number(count4);
 };
 
+// src/gate/diff-shape.ts
+var untrackedLines = (runtime, root, changes) => changes.filter((change) => change.status === "A").reduce((sum, change) => {
+  const text6 = runtime.readText(toAbsolutePath(join13(root, change.path)));
+  return sum + (text6.ok ? text6.value.split("\n").length : 0);
+}, 0);
+var diffShape = (runtime, git, base, changes) => ({
+  files: changes.map((change) => change.path),
+  lines: numstat(git, base).lines + untrackedLines(runtime, git.cwd, changes)
+});
+
 // src/gate/pr-parse.ts
 var FAILED = /* @__PURE__ */ new Set(["FAILURE", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE", "ERROR"]);
 var PENDING = /* @__PURE__ */ new Set(["IN_PROGRESS", "QUEUED", "PENDING", "WAITING", "REQUESTED", "EXPECTED"]);
@@ -4582,13 +4747,118 @@ var conflictFiles = (git, base) => {
   return [];
 };
 
+// src/core/glob.ts
+var escape = (char) => /[.+^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+var globToRegExp = (glob) => {
+  const pattern = glob.replace(/^\.\//, "");
+  let out = "";
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index] ?? "";
+    if (char === "*" && pattern[index + 1] === "*") {
+      const slash = pattern[index + 2] === "/";
+      out += slash ? "(?:.*/)?" : ".*";
+      index += slash ? 2 : 1;
+    } else if (char === "*") out += "[^/]*";
+    else if (char === "?") out += "[^/]";
+    else out += escape(char);
+  }
+  return new RegExp(`^${out}${pattern.endsWith("/") ? ".*" : ""}$`);
+};
+var matchesAny = (path, globs) => {
+  const normalized = toPosixPath(path);
+  return globs.some((glob) => globToRegExp(glob).test(normalized));
+};
+
+// src/gate/size.ts
+var DEFAULT_SENSITIVE = [
+  "**/*payment*",
+  "**/*payment*/**",
+  "**/*billing*",
+  "**/*billing*/**",
+  "**/*checkout*/**",
+  "**/auth/**",
+  "**/*auth.*",
+  "**/oauth*",
+  "**/migrations/**",
+  "**/migration/**",
+  "**/*.sql",
+  "**/openapi*.*",
+  "**/swagger*.*",
+  "**/*.proto",
+  "**/*.graphql",
+  "**/*stripe*",
+  "**/*openai*",
+  "**/*anthropic*"
+];
+var DEFAULT_SIZE_CONFIG = {
+  m: { files: 5, lines: 150 },
+  l: { files: 20, lines: 600 },
+  sensitive: DEFAULT_SENSITIVE
+};
+var count2 = (tree, fallback, ...path) => {
+  const value = configAt(tree, ...path);
+  const parsed = typeof value === "string" ? Number(value) : Number.NaN;
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+};
+var threshold = (tree, key, fallback) => ({
+  files: count2(tree, fallback.files, "size", key, "files"),
+  lines: count2(tree, fallback.lines, "size", key, "lines")
+});
+var sizeConfig = (tree) => {
+  const declared = configAt(tree, "size", "sensitive");
+  return {
+    m: threshold(tree, "m", DEFAULT_SIZE_CONFIG.m),
+    l: threshold(tree, "l", DEFAULT_SIZE_CONFIG.l),
+    sensitive: declared === void 0 ? DEFAULT_SENSITIVE : configList(tree, "size", "sensitive")
+  };
+};
+var reaches = (shape, limit) => shape.files.length >= limit.files || shape.lines >= limit.lines;
+var rank = (size) => SIZES.indexOf(size);
+var larger = (a, b) => rank(a) >= rank(b) ? a : b;
+var computeSize = (shape, config) => {
+  const sensitive = shape.files.filter((file) => matchesAny(file, config.sensitive));
+  const byVolume = reaches(shape, config.l) ? "L" : reaches(shape, config.m) ? "M" : "S";
+  const computed = sensitive.length > 0 ? larger(byVolume, "M") : byVolume;
+  return { computed, files: shape.files.length, lines: shape.lines, sensitive };
+};
+var sizeVerdict = (declared, shape, config) => {
+  const result = computeSize(shape, config);
+  return { ...result, declared, effective: larger(declared, result.computed) };
+};
+var upgraded = (verdict) => rank(verdict.effective) > rank(verdict.declared);
+
+// src/gate/size-contract.ts
+var REVIEW_CHECK = "size-review";
+var INVENTORY_CHECK = "size-inventory";
+var DECISION_CHECK = "size-decision";
+var INVENTORY = "inventory of the files, behaviours and callers the change touches";
+var DECISION = "a recorded decision on the approach for a change this large";
+var reviewChecks = (verdict) => verdict.effective === "S" ? [] : [{ id: REVIEW_CHECK, kind: "review" }];
+var largeChecks = (verdict) => verdict.effective === "L" && verdict.declared !== "S" ? [
+  { id: INVENTORY_CHECK, kind: "manual", description: INVENTORY },
+  { id: DECISION_CHECK, kind: "manual", description: DECISION }
+] : [];
+var sizeRequirements = (verdict) => [
+  ...reviewChecks(verdict),
+  ...largeChecks(verdict)
+];
+var applySize = (contract, verdict) => {
+  if (contract.implicit) return contract;
+  const declaredIds = new Set(contract.acceptance.map((check2) => check2.id));
+  const declaredKinds = new Set(contract.acceptance.map((check2) => check2.kind));
+  const extra = sizeRequirements(verdict).filter(
+    (check2) => !declaredIds.has(check2.id) && !(check2.kind === "review" && declaredKinds.has("review"))
+  );
+  return extra.length === 0 && !upgraded(verdict) ? contract : { ...contract, size: verdict.effective, acceptance: [...contract.acceptance, ...extra] };
+};
+
 // src/gate/prepare.ts
 var diskFiles = (runtime, root) => ({
   read: (relative9) => {
-    const text6 = runtime.readText(toAbsolutePath(join11(root, relative9)));
+    const text6 = runtime.readText(toAbsolutePath(join14(root, relative9)));
     return text6.ok ? text6.value : void 0;
   },
-  exists: (relative9) => runtime.stat(toAbsolutePath(join11(root, relative9))) !== void 0
+  exists: (relative9) => runtime.stat(toAbsolutePath(join14(root, relative9))) !== void 0
 });
 var baseFiles = (git, base, disk) => ({
   read: (relative9) => base === EMPTY_TREE ? disk.read(relative9) : fileAt(git, base, relative9),
@@ -4620,6 +4890,7 @@ var skipReason = (runtime, paths, loaded, changes, tree, sessionId) => {
   const session = readSession(runtime, paths);
   return session !== void 0 && session.sessionId === sessionId && session.startTree === tree ? "no_session_edits" : void 0;
 };
+var measureSize = (runtime, git, base, changes, contract) => sizeVerdict(contract.size, diffShape(runtime, git, base, changes), sizeConfig(loadProjectConfig(runtime, git.cwd)));
 var prepareGate = (options) => {
   const probe = gitAt(options.runtime, options.cwd);
   const root = gitRoot(probe);
@@ -4639,11 +4910,13 @@ var prepareGate = (options) => {
   const skip = options.noSkip === true ? void 0 : skipReason(options.runtime, paths, loaded.value, changes, tree, options.sessionId);
   if (skip !== void 0) return { kind: "skipped", reason: skip };
   const pr = memo(() => prStatus(options.runtime, git, paths));
+  const size = measureSize(options.runtime, git, base, changes, loaded.value.contract);
   const ctx = {
     runtime: options.runtime,
     git,
     paths,
-    contract: loaded.value.contract,
+    contract: applySize(loaded.value.contract, size),
+    size,
     trusted: loaded.value.trusted,
     treeHash: tree,
     base,
@@ -5006,6 +5279,8 @@ var en_default = {
   "doctor.settings.fix_managed_hooks_only": "Ask the administrator of the managed settings to add the Finite Monkey hooks there, or to turn allowManagedHooksOnly off",
   "doctor.settings.plugin_only": "strictPluginOnlyCustomization is on ({scopes}) and the finitemonkey plugin is not enabled; the project hooks do not load",
   "doctor.settings.fix_plugin_only": "Install the plugin: finitemonkey init --marketplace --yes, then /plugin install finitemonkey@finitemonkey in Claude Code",
+  "doctor.settings.plugin_channels": "Both {stable} and {next} are enabled. They share the plugin name, so Claude Code keeps only one set of hooks",
+  "doctor.settings.fix_plugin_channels": "To stay on stable run claude plugin disable {next}; to test next run claude plugin disable {stable}",
   "doctor.settings.agent_teams": "{name} is on; teammates run in their own sessions, and Finite Monkey does not check their work before they report done",
   "doctor.settings.fix_agent_teams": "Run `finitemonkey gate` before accepting a teammate's result, or unset the variable",
   "doctor.settings.loop_plugins": "{names} enabled: it sends the agent back to work at Stop, and its loop has no guard of its own",
@@ -5420,7 +5695,18 @@ var en_default = {
   "history.pattern.no_verify": "{count, plural, one {# git command} other {# git commands}} with --no-verify",
   "history.pattern.force_push": "{count, plural, one {# force push} other {# force pushes}}",
   "history.pattern.test_skip": "{count, plural, one {# test edit} other {# test edits}} that added .skip, .only or a skip marker",
-  "history.estimate": "These are estimates from pattern matching, not evidence; nothing was saved and nothing left this machine."
+  "history.estimate": "These are estimates from pattern matching, not evidence; nothing was saved and nothing left this machine.",
+  "gate.require.review": "a reviewer subagent read the change at its current state",
+  "gate.size.declared": "size {effective}: {files, plural, one {# file} other {# files}}, {lines, plural, one {# line} other {# lines}}",
+  "gate.size.grew": "declared {declared}, the diff makes it {effective}: {files, plural, one {# file} other {# files}}, {lines, plural, one {# line} other {# lines}}",
+  "gate.size.sensitive": "sensitive path touched: {file}",
+  "gate.review.missing": "no review of the current state: run a reviewer subagent on the diff, or the person writes `fm: approve {check} <reason>` in the chat",
+  "gate.review.done": "reviewed by {agent} at {at}",
+  "secrets.warn.write": "Finite Monkey warning (the write went through): {found}. A secret passed as a command-line argument shows in ps and docker inspect; disabled TLS verification lets anyone on the path read the traffic. Move the value to an environment variable or a secret file, and keep TLS checks on outside tests.",
+  "gate.secrets.warning": "warning: {rule} at {file}:{line}",
+  "doctor.secrets.remote_credential": "git remote {remotes} has a credential in its URL, stored in plain text in .git/config",
+  "doctor.secrets.fix_remote_credential": "run `git remote set-url {remote} <url without user:token@>`, use a credential helper or SSH, and rotate the token",
+  "secrets.session.remote_credential": "git remote {remotes} has a credential in its URL (plain text in .git/config). Ask the person to run `git remote set-url {remote} <url without user:token@>` and rotate the token; do not print the URL."
 };
 
 // src/i18n/es.json
@@ -5517,6 +5803,8 @@ var es_default = {
   "doctor.settings.fix_managed_hooks_only": "Pide al administrador de los settings gestionados que añada allí los hooks de Finite Monkey, o que desactive allowManagedHooksOnly",
   "doctor.settings.plugin_only": "strictPluginOnlyCustomization está activado ({scopes}) y el plugin finitemonkey no está activo; los hooks del proyecto no se cargan",
   "doctor.settings.fix_plugin_only": "Instala el plugin: finitemonkey init --marketplace --yes, después /plugin install finitemonkey@finitemonkey en Claude Code",
+  "doctor.settings.plugin_channels": "{stable} y {next} están activos a la vez. Comparten el nombre del plugin, así que Claude Code se queda con un solo conjunto de hooks",
+  "doctor.settings.fix_plugin_channels": "Para quedarte en la versión estable ejecuta claude plugin disable {next}; para probar next ejecuta claude plugin disable {stable}",
   "doctor.settings.agent_teams": "{name} está activado; los compañeros de equipo corren en sesiones propias, y Finite Monkey no revisa su trabajo antes de que digan que terminaron",
   "doctor.settings.fix_agent_teams": "Ejecuta `finitemonkey gate` antes de aceptar el resultado de un compañero, o quita la variable",
   "doctor.settings.loop_plugins": "{names} activo: devuelve al agente al trabajo en Stop, y su bucle no tiene guardia propia",
@@ -5931,7 +6219,18 @@ var es_default = {
   "history.pattern.no_verify": "{count, plural, one {# comando git} other {# comandos git}} con --no-verify",
   "history.pattern.force_push": "{count, plural, one {# push forzado} other {# push forzados}}",
   "history.pattern.test_skip": "{count, plural, one {# edición} other {# ediciones}} de pruebas que añadieron .skip, .only o una marca para saltar",
-  "history.estimate": "Son estimaciones por patrones de texto, no evidencia; no se guardó nada y nada salió de esta máquina."
+  "history.estimate": "Son estimaciones por patrones de texto, no evidencia; no se guardó nada y nada salió de esta máquina.",
+  "gate.require.review": "un subagente revisor leyó el cambio en su estado actual",
+  "gate.size.declared": "tamaño {effective}: {files, plural, one {# archivo} other {# archivos}}, {lines, plural, one {# línea} other {# líneas}}",
+  "gate.size.grew": "declarada {declared}, el diff la vuelve {effective}: {files, plural, one {# archivo} other {# archivos}}, {lines, plural, one {# línea} other {# líneas}}",
+  "gate.size.sensitive": "ruta sensible tocada: {file}",
+  "gate.review.missing": "ninguna revisión del estado actual: ejecuta un subagente revisor sobre el diff, o la persona escribe `fm: approve {check} <motivo>` en el chat",
+  "gate.review.done": "revisado por {agent} en {at}",
+  "secrets.warn.write": "Aviso de Finite Monkey (la escritura se hizo): {found}. Un secreto pasado como argumento de línea de comandos aparece en ps y en docker inspect; la verificación TLS desactivada deja que cualquiera en el camino lea el tráfico. Lleva el valor a una variable de entorno o a un archivo de secreto y mantén el TLS verificado fuera de las pruebas.",
+  "gate.secrets.warning": "aviso: {rule} en {file}:{line}",
+  "doctor.secrets.remote_credential": "el remoto git {remotes} tiene una credencial en la URL, guardada en texto plano en .git/config",
+  "doctor.secrets.fix_remote_credential": "ejecuta `git remote set-url {remote} <url sin usuario:token@>`, usa un credential helper o SSH y rota el token",
+  "secrets.session.remote_credential": "el remoto git {remotes} tiene una credencial en la URL (texto plano en .git/config). Pide a la persona que ejecute `git remote set-url {remote} <url sin usuario:token@>` y rote el token; no imprimas la URL."
 };
 
 // src/i18n/pt-BR.json
@@ -6028,6 +6327,8 @@ var pt_BR_default = {
   "doctor.settings.fix_managed_hooks_only": "Peça ao administrador dos settings gerenciados para incluir os hooks do Finite Monkey lá, ou para desligar allowManagedHooksOnly",
   "doctor.settings.plugin_only": "strictPluginOnlyCustomization está ligado ({scopes}) e o plugin finitemonkey não está ativo; os hooks do projeto não carregam",
   "doctor.settings.fix_plugin_only": "Instale o plugin: finitemonkey init --marketplace --yes, depois /plugin install finitemonkey@finitemonkey no Claude Code",
+  "doctor.settings.plugin_channels": "{stable} e {next} estão ativos ao mesmo tempo. Os dois têm o mesmo nome de plugin, então o Claude Code fica com só um conjunto de hooks",
+  "doctor.settings.fix_plugin_channels": "Para ficar no estável rode claude plugin disable {next}; para testar o next rode claude plugin disable {stable}",
   "doctor.settings.agent_teams": "{name} está ligado; os colegas de equipe rodam em sessões próprias, e o Finite Monkey não confere o trabalho deles antes de dizerem que terminaram",
   "doctor.settings.fix_agent_teams": "Rode `finitemonkey gate` antes de aceitar o resultado de um colega, ou remova a variável",
   "doctor.settings.loop_plugins": "{names} ativo: ele manda o agente de volta ao trabalho no Stop, e o laço dele não tem guarda própria",
@@ -6442,7 +6743,18 @@ var pt_BR_default = {
   "history.pattern.no_verify": "{count, plural, one {# comando git} other {# comandos git}} com --no-verify",
   "history.pattern.force_push": "{count, plural, one {# push forçado} other {# pushes forçados}}",
   "history.pattern.test_skip": "{count, plural, one {# edição} other {# edições}} de teste que acrescentaram .skip, .only ou marcador de pular",
-  "history.estimate": "São estimativas por padrão de texto, não evidência; nada foi salvo e nada saiu desta máquina."
+  "history.estimate": "São estimativas por padrão de texto, não evidência; nada foi salvo e nada saiu desta máquina.",
+  "gate.require.review": "um subagente revisor leu a mudança no estado atual",
+  "gate.size.declared": "tamanho {effective}: {files, plural, one {# arquivo} other {# arquivos}}, {lines, plural, one {# linha} other {# linhas}}",
+  "gate.size.grew": "declarada {declared}, o diff a torna {effective}: {files, plural, one {# arquivo} other {# arquivos}}, {lines, plural, one {# linha} other {# linhas}}",
+  "gate.size.sensitive": "caminho sensível alterado: {file}",
+  "gate.review.missing": "nenhuma revisão do estado atual: rode um subagente revisor no diff, ou a pessoa escreve `fm: approve {check} <motivo>` no chat",
+  "gate.review.done": "revisado por {agent} em {at}",
+  "secrets.warn.write": "Aviso do Finite Monkey (a escrita foi feita): {found}. Segredo passado como argumento de linha de comando aparece no ps e no docker inspect; verificação TLS desligada deixa qualquer um no caminho ler o tráfego. Leve o valor para uma variável de ambiente ou um arquivo de segredo e mantenha o TLS verificado fora dos testes.",
+  "gate.secrets.warning": "aviso: {rule} em {file}:{line}",
+  "doctor.secrets.remote_credential": "o remoto git {remotes} tem uma credencial na URL, guardada em texto puro no .git/config",
+  "doctor.secrets.fix_remote_credential": "rode `git remote set-url {remote} <url sem usuario:token@>`, use um credential helper ou SSH e rotacione o token",
+  "secrets.session.remote_credential": "o remoto git {remotes} tem uma credencial na URL (texto puro no .git/config). Peça para a pessoa rodar `git remote set-url {remote} <url sem usuario:token@>` e rotacionar o token; não imprima a URL."
 };
 
 // src/i18n/review.json
@@ -6540,6 +6852,8 @@ var review_default = {
     "doctor.settings.fix_managed_hooks_only": "machine",
     "doctor.settings.plugin_only": "machine",
     "doctor.settings.fix_plugin_only": "machine",
+    "doctor.settings.plugin_channels": "machine",
+    "doctor.settings.fix_plugin_channels": "machine",
     "doctor.settings.agent_teams": "machine",
     "doctor.settings.fix_agent_teams": "machine",
     "doctor.settings.loop_plugins": "machine",
@@ -6954,7 +7268,18 @@ var review_default = {
     "history.pattern.no_verify": "machine",
     "history.pattern.force_push": "machine",
     "history.pattern.test_skip": "machine",
-    "history.estimate": "machine"
+    "history.estimate": "machine",
+    "gate.require.review": "machine",
+    "gate.size.declared": "machine",
+    "gate.size.grew": "machine",
+    "gate.size.sensitive": "machine",
+    "gate.review.missing": "machine",
+    "gate.review.done": "machine",
+    "secrets.warn.write": "machine",
+    "gate.secrets.warning": "machine",
+    "doctor.secrets.remote_credential": "machine",
+    "doctor.secrets.fix_remote_credential": "machine",
+    "secrets.session.remote_credential": "machine"
   },
   es: {
     "command.init.summary": "machine",
@@ -7049,6 +7374,8 @@ var review_default = {
     "doctor.settings.fix_managed_hooks_only": "machine",
     "doctor.settings.plugin_only": "machine",
     "doctor.settings.fix_plugin_only": "machine",
+    "doctor.settings.plugin_channels": "machine",
+    "doctor.settings.fix_plugin_channels": "machine",
     "doctor.settings.agent_teams": "machine",
     "doctor.settings.fix_agent_teams": "machine",
     "doctor.settings.loop_plugins": "machine",
@@ -7463,7 +7790,18 @@ var review_default = {
     "history.pattern.no_verify": "machine",
     "history.pattern.force_push": "machine",
     "history.pattern.test_skip": "machine",
-    "history.estimate": "machine"
+    "history.estimate": "machine",
+    "gate.require.review": "machine",
+    "gate.size.declared": "machine",
+    "gate.size.grew": "machine",
+    "gate.size.sensitive": "machine",
+    "gate.review.missing": "machine",
+    "gate.review.done": "machine",
+    "secrets.warn.write": "machine",
+    "gate.secrets.warning": "machine",
+    "doctor.secrets.remote_credential": "machine",
+    "doctor.secrets.fix_remote_credential": "machine",
+    "secrets.session.remote_credential": "machine"
   }
 };
 
@@ -7586,7 +7924,7 @@ var buildReport = (input) => {
     );
     return fromEvidence(check2.id, check2.kind, entry2, hasStale(ledger, check2.id, treeHash2));
   });
-  const count3 = (status) => items.filter((item) => item.status === status).length;
+  const count4 = (status) => items.filter((item) => item.status === status).length;
   return {
     schema: GATE_SCHEMA,
     task: contract.id,
@@ -7597,7 +7935,7 @@ var buildReport = (input) => {
     source: input.source,
     contractEdited: input.contractEdited,
     verdict: verdictOf(items),
-    counts: { passed: count3("passed"), failed: count3("failed"), unverified: count3("unverified") },
+    counts: { passed: count4("passed"), failed: count4("failed"), unverified: count4("unverified") },
     items,
     decisionsNeeded: contract.decisionsNeeded,
     fastPath: input.fastPath
@@ -7721,6 +8059,27 @@ var preCompact = (input) => {
   return { kind: "allow" };
 };
 
+// src/gate/review.ts
+var REVIEWS_FILE = "reviews.json";
+var REVIEWER_AGENT = /(^|:)[\w-]*reviewer$/i;
+var KEEP = 50;
+var toReview = (value) => {
+  if (!isRecord(value)) return void 0;
+  const { treeHash: treeHash2, agent, at } = value;
+  return typeof treeHash2 === "string" && typeof agent === "string" && typeof at === "string" ? { treeHash: treeHash2, agent, at } : void 0;
+};
+var readReviews = (runtime, paths) => {
+  const raw = readJsonFile(runtime, paths.cache(REVIEWS_FILE))?.["reviews"];
+  return Array.isArray(raw) ? raw.flatMap((item) => {
+    const review2 = toReview(item);
+    return review2 === void 0 ? [] : [review2];
+  }) : [];
+};
+var recordReview = (runtime, paths, treeHash2, agent) => {
+  const reviews = [...readReviews(runtime, paths), { treeHash: treeHash2, agent, at: runtime.now() }].slice(-KEEP);
+  return writeJsonFile(runtime, paths.cache(REVIEWS_FILE), { reviews: reviews.map((review2) => ({ ...review2 })) }).ok;
+};
+
 // src/gate/test-summary.ts
 var ANSI2 = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
 var COUNTERS = [
@@ -7860,44 +8219,14 @@ var runShellCheck = (check2, run4, ctx) => {
 };
 var commandCheck = (check2, ctx) => check2.run === void 0 ? unverified("not_implemented") : runShellCheck(check2, check2.run, ctx);
 
-// src/gate/checks/diff.ts
-import { join as join12 } from "node:path";
-
-// src/core/glob.ts
-var escape = (char) => /[.+^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
-var globToRegExp = (glob) => {
-  const pattern = glob.replace(/^\.\//, "");
-  let out = "";
-  for (let index = 0; index < pattern.length; index += 1) {
-    const char = pattern[index] ?? "";
-    if (char === "*" && pattern[index + 1] === "*") {
-      const slash = pattern[index + 2] === "/";
-      out += slash ? "(?:.*/)?" : ".*";
-      index += slash ? 2 : 1;
-    } else if (char === "*") out += "[^/]*";
-    else if (char === "?") out += "[^/]";
-    else out += escape(char);
-  }
-  return new RegExp(`^${out}${pattern.endsWith("/") ? ".*" : ""}$`);
-};
-var matchesAny = (path, globs) => {
-  const normalized = toPosixPath(path);
-  return globs.some((glob) => globToRegExp(glob).test(normalized));
-};
-
 // src/gate/checks/diff.ts
 var MAX_LISTED = 10;
-var untrackedLines = (ctx) => ctx.changes.filter((change) => change.status === "A").reduce((sum, change) => {
-  const text6 = ctx.runtime.readText(toAbsolutePath(join12(ctx.paths.root, change.path)));
-  return sum + (text6.ok ? text6.value.split("\n").length : 0);
-}, 0);
 var diffCheck = (_check, ctx) => {
   const { paths, diffBudget } = ctx.contract.scope;
   if (paths.length === 0 && diffBudget === void 0) return passed([note("gate.diff.no_scope")]);
   const outside = paths.length === 0 ? [] : ctx.changes.filter((change) => !matchesAny(change.path, paths));
-  const stat = numstat(ctx.git, ctx.base);
   const files = ctx.changes.length;
-  const lines3 = stat.lines + untrackedLines(ctx);
+  const lines3 = diffShape(ctx.runtime, ctx.git, ctx.base, ctx.changes).lines;
   const notes2 = [
     ...outside.slice(0, MAX_LISTED).map((change) => note("gate.diff.outside", { file: change.path })),
     ...diffBudget?.files !== void 0 && files > diffBudget.files ? [note("gate.diff.too_many_files", { count: files, max: diffBudget.files })] : [],
@@ -7947,13 +8276,13 @@ var manualCheck = (check2, ctx) => {
 };
 
 // src/gate/checks/placeholders.ts
-import { join as join13 } from "node:path";
+import { join as join15 } from "node:path";
 var MAX_LISTED2 = 10;
 var SKIP_FILES = /\.(md|mdx|txt|rst|lock|snap|svg|png|jpg|gif|json)$|(^|\/)(CHANGELOG|LICENSE)/i;
 var PLACEHOLDER = /\b(TODO|FIXME|XXX)\b|not implemented|NotImplementedError|unimplemented!|todo!\(|lorem ipsum/i;
 var findPlaceholders = (lines3) => lines3.filter((line2) => !isTestFile(line2.path) && !SKIP_FILES.test(line2.path) && PLACEHOLDER.test(line2.text));
 var untrackedAdded = (ctx) => ctx.changes.filter((change) => change.status === "A" && !SKIP_FILES.test(change.path)).flatMap((change) => {
-  const text6 = ctx.runtime.readText(toAbsolutePath(join13(ctx.paths.root, change.path)));
+  const text6 = ctx.runtime.readText(toAbsolutePath(join15(ctx.paths.root, change.path)));
   return text6.ok ? text6.value.split("\n").map((line2, index) => ({ path: change.path, line: index + 1, text: line2 })) : [];
 });
 var placeholdersCheck = (_check, ctx) => {
@@ -8465,10 +8794,10 @@ var hit = (rule, units, index, weight) => {
   return { rule, unit: index, line: unit?.line ?? 0, weight, excerpt: unit?.text ?? "" };
 };
 var isProse = (unit) => unit?.kind === "sentence";
-var samePara = (units, from, count3) => {
+var samePara = (units, from, count4) => {
   const first = units[from];
   if (!isProse(first)) return false;
-  return units.slice(from, from + count3).every((unit) => isProse(unit) && unit.paragraph === first.paragraph);
+  return units.slice(from, from + count4).every((unit) => isProse(unit) && unit.paragraph === first.paragraph);
 };
 var runsOf = (units, size, matches) => {
   const starts = [];
@@ -8525,13 +8854,13 @@ var emoji = (units) => units.flatMap(
 var dashes = (units) => {
   const perParagraph = /* @__PURE__ */ new Map();
   for (const unit of units) {
-    const count3 = unit.text.split("—").length - 1;
-    perParagraph.set(unit.paragraph, (perParagraph.get(unit.paragraph) ?? 0) + count3);
+    const count4 = unit.text.split("—").length - 1;
+    perParagraph.set(unit.paragraph, (perParagraph.get(unit.paragraph) ?? 0) + count4);
   }
-  return [...perParagraph].flatMap(([paragraph, count3]) => {
-    if (count3 === 0) return [];
+  return [...perParagraph].flatMap(([paragraph, count4]) => {
+    if (count4 === 0) return [];
     const index = units.findIndex((unit) => unit.paragraph === paragraph && unit.text.includes("—"));
-    const weight = count3 >= 2 ? STRUCTURE_WEIGHTS.dashSeries : STRUCTURE_WEIGHTS.dash;
+    const weight = count4 >= 2 ? STRUCTURE_WEIGHTS.dashSeries : STRUCTURE_WEIGHTS.dash;
     return [hit("em-dash-series", units, index, weight)];
   });
 };
@@ -8559,11 +8888,11 @@ var windowEnd = (units, from, size) => {
   return to;
 };
 var windowScore = (hits, window) => hits.filter((item) => item.unit >= window.from && item.unit <= window.to).reduce((sum, item) => sum + item.weight, 0);
-var hotWindows = (hits, units, size, threshold) => {
+var hotWindows = (hits, units, size, threshold2) => {
   const windows = [];
   for (let from = 0; from < units.length; from += 1) {
     const window = { from, to: windowEnd(units, from, size) };
-    if (windowScore(hits, window) >= threshold) windows.push(window);
+    if (windowScore(hits, window) >= threshold2) windows.push(window);
   }
   return windows;
 };
@@ -8590,10 +8919,10 @@ var byPosition = (left, right) => left.unit - right.unit || left.line - right.li
 var scoreProse = (text6, options = {}) => {
   const { units, allowed: allowed2 } = extractProse(text6);
   const size = options.window ?? DENSITY_WINDOW;
-  const threshold = options.threshold ?? DENSITY_THRESHOLD;
+  const threshold2 = options.threshold ?? DENSITY_THRESHOLD;
   const catalog = options.context === "record" ? [...phraseRules(), ...recordRules()] : phraseRules();
   const hits = [...phraseHits(units, catalog), ...structureHits(units)].sort(byPosition);
-  const spans = mergeSpans(hits, hotWindows(hits, units, size, threshold));
+  const spans = mergeSpans(hits, hotWindows(hits, units, size, threshold2));
   return { hits, spans, allowed: allowed2 };
 };
 var isFlagged = (report2) => report2.spans.length > 0;
@@ -8643,22 +8972,55 @@ var MAX_LISTED3 = 10;
 var rulesOf = (span) => [...new Set(span.hits.map((hit3) => hit3.rule))].join(", ");
 var proseOutcome = (status) => {
   if (!status.ok) return unverified("tool_missing", [note("gate.prose.unavailable")]);
-  const { files, flagged, blocking } = status.value;
-  const key = blocking ? "gate.prose.finding" : "gate.prose.warning";
+  const { files, flagged, blocking: blocking2 } = status.value;
+  const key = blocking2 ? "gate.prose.finding" : "gate.prose.warning";
   const notes2 = flagged.flatMap((item) => item.report.spans.map((span) => ({ file: item.file, span }))).slice(0, MAX_LISTED3).map(({ file, span }) => note(key, { file, line: span.startLine, rules: rulesOf(span) }));
   if (notes2.length === 0) return passed([note("gate.prose.clean", { count: files.length })]);
-  return blocking ? failed(notes2) : passed(notes2);
+  return blocking2 ? failed(notes2) : passed(notes2);
 };
 var proseCheck = (_check, ctx) => proseOutcome(proseGateStatus(ctx.runtime, ctx.paths.root));
 
+// src/gate/checks/review.ts
+var MAX_SENSITIVE = 5;
+var sizeNotes = (ctx) => {
+  const size = ctx.size;
+  if (size === void 0) return [];
+  return [
+    note(size.declared === size.effective ? "gate.size.declared" : "gate.size.grew", {
+      declared: size.declared,
+      effective: size.effective,
+      files: size.files,
+      lines: size.lines
+    }),
+    ...size.sensitive.slice(0, MAX_SENSITIVE).map((file) => note("gate.size.sensitive", { file }))
+  ];
+};
+var reviewCheck = (check2, ctx) => {
+  const review2 = readReviews(ctx.runtime, ctx.paths).findLast((entry2) => entry2.treeHash === ctx.treeHash);
+  if (review2 !== void 0) {
+    return { status: "passed", notes: [note("gate.review.done", { agent: review2.agent, at: review2.at })] };
+  }
+  const approval = readApprovals(ctx.runtime, ctx.paths).findLast(
+    (item) => item.task === ctx.contract.id && item.check === check2.id
+  );
+  if (approval !== void 0) {
+    return {
+      status: "passed",
+      notes: [note("gate.manual.approved", { at: approval.at, reason: approval.reason })],
+      releasedBy: `person@${approval.at}`
+    };
+  }
+  return failed([...sizeNotes(ctx), note("gate.review.missing", { check: check2.id })]);
+};
+
 // src/secrets/baseline.ts
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 var BASELINE_FILE2 = ".finitemonkey/findings/baseline.json";
 var BASELINE_SCHEMA = "finitemonkey/secrets-baseline@1";
 var BASELINE_STATES = ["aceito", "falso-positivo"];
 var EXCEPTION_MAX_DAYS = 90;
 var EMPTY_BASELINE = { schema: BASELINE_SCHEMA, entries: [] };
-var baselinePath = (root) => toAbsolutePath(join14(root, BASELINE_FILE2));
+var baselinePath = (root) => toAbsolutePath(join16(root, BASELINE_FILE2));
 var text5 = (record2, key) => {
   const value = record2[key];
   return typeof value === "string" && value !== "" ? value : void 0;
@@ -8718,14 +9080,14 @@ var withoutFixed = (baseline, fixed) => {
 var acceptedFingerprints = (baseline, now) => new Set(baseline.entries.filter((entry2) => entry2.expiresAt >= now).map((entry2) => entry2.fingerprint));
 
 // src/secrets/incidents.ts
-import { join as join15 } from "node:path";
+import { join as join17 } from "node:path";
 var INCIDENTS_DIR = ".finitemonkey/incidents";
 var INCIDENT_STATES = ["aberto", "exposicao-local", "rotacionado", "fechado"];
 var INCIDENT_SOURCES = ["tool-output", "prompt", "history", "scan"];
 var ID = /^inc-[0-9a-f]{12}$/;
 var incidentId = (rule, fingerprint) => `inc-${sha256Hex(`${rule}\0${fingerprint}`).slice(0, 12)}`;
-var incidentsDir = (root) => toAbsolutePath(join15(root, INCIDENTS_DIR));
-var incidentFile = (root, id) => toAbsolutePath(join15(incidentsDir(root), `${id}.json`));
+var incidentsDir = (root) => toAbsolutePath(join17(root, INCIDENTS_DIR));
+var incidentFile = (root, id) => toAbsolutePath(join17(incidentsDir(root), `${id}.json`));
 var pick2 = (options, value) => options.find((option) => option === value);
 var str2 = (record2, key) => {
   const value = record2[key];
@@ -8780,7 +9142,7 @@ var listIncidents = (runtime, root) => {
   return names.value.filter((name) => name.endsWith(".json")).map((name) => readIncident(runtime, root, name.slice(0, -".json".length))).flatMap((parsed) => parsed.ok ? [parsed.value] : []).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
 };
 var saveIncident = (runtime, root, incident) => {
-  const ignore = runtime.writeText(toAbsolutePath(join15(incidentsDir(root), ".gitignore")), "*\n");
+  const ignore = runtime.writeText(toAbsolutePath(join17(incidentsDir(root), ".gitignore")), "*\n");
   if (!ignore.ok) return ignore;
   return runtime.writeText(incidentFile(root, incident.id), `${JSON.stringify(incident, null, 2)}
 `);
@@ -8827,7 +9189,7 @@ var moveIncident = (incident, to, now, by) => ({
 var isRotated = (incident) => incident.state === "rotacionado" || incident.state === "fechado";
 
 // src/secrets/scan.ts
-import { join as join16, relative as relative4 } from "node:path";
+import { join as join18, relative as relative4 } from "node:path";
 
 // src/secrets/located.ts
 var findingId = (ruleId, file, fingerprint) => `fm-${sha256Hex(`${ruleId}\0${file}\0${fingerprint}`).slice(0, 16)}`;
@@ -8927,7 +9289,7 @@ var listed2 = (runtime, root, target) => {
   const base = toAbsolutePath(target, root);
   const walked = runtime.walkFiles(base);
   if (!walked.ok) return walked;
-  return accept(walked.value.map((name) => toPosixPath(relative4(root, join16(base, toPosixPath(name))))));
+  return accept(walked.value.map((name) => toPosixPath(relative4(root, join18(base, toPosixPath(name))))));
 };
 var scanFile = (runtime, root, file) => {
   const text6 = runtime.readText(toAbsolutePath(file, root));
@@ -8987,15 +9349,17 @@ var secretsCheck = (_check, ctx) => {
   const status = secretsGateStatus(ctx.runtime, ctx.paths.root, sinceOf(ctx));
   if (!status.ok) return unverified("tool_missing", [note("gate.secrets.unavailable")]);
   const { findings, openIncidents } = status.value;
+  const warnings = findings.filter(isWarning).slice(0, MAX_LISTED4).map((finding3) => note("gate.secrets.warning", { file: finding3.file, line: finding3.line, rule: finding3.ruleId }));
   const notes2 = [
-    ...findings.slice(0, MAX_LISTED4).map((finding3) => note("gate.secrets.finding", { file: finding3.file, line: finding3.line, rule: finding3.ruleId })),
+    ...blocking(findings).slice(0, MAX_LISTED4).map((finding3) => note("gate.secrets.finding", { file: finding3.file, line: finding3.line, rule: finding3.ruleId })),
     ...openIncidents.slice(0, MAX_LISTED4).map((incident) => note("gate.secrets.incident", { id: incident.id, state: incident.state }))
   ];
-  return notes2.length > 0 ? failed(notes2) : passed([note("gate.secrets.clean")]);
+  if (notes2.length > 0) return failed([...notes2, ...warnings]);
+  return passed(warnings.length > 0 ? warnings : [note("gate.secrets.clean")]);
 };
 
 // src/gate/checks/tests.ts
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 
 // src/guards/tests/tree.ts
 var outOfScope = (input, change) => input.testsProtected && input.scopePaths.length > 0 && change.status !== "A" && isTestFile(change.path) && !matchesAny(change.path, input.scopePaths) ? [{ kind: "out_of_scope", path: change.path }] : [];
@@ -9027,7 +9391,7 @@ var treeViolations = (ctx) => {
     changes: relevant,
     before: (path) => fileAt(ctx.git, ctx.base, path),
     after: (path) => {
-      const text6 = ctx.runtime.readText(toAbsolutePath(join17(ctx.paths.root, path)));
+      const text6 = ctx.runtime.readText(toAbsolutePath(join19(ctx.paths.root, path)));
       return text6.ok ? text6.value : void 0;
     },
     acceptedConfigs: ctx.trust.configs,
@@ -9048,7 +9412,7 @@ var testsCheck = (check2, ctx) => {
 };
 
 // src/git/tree.ts
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 
 // src/secrets/guards/paths.ts
 var SAFE_ENV = /^\.env\.(?:example|sample|template|dist|defaults|schema)$/i;
@@ -9087,7 +9451,7 @@ var dropSensitive = (runtime, repo, env, options) => {
   return removed.ok ? accept(void 0) : removed;
 };
 var withTempIndex = (runtime, repo, options, work) => {
-  const path = toAbsolutePath(join18(repo.gitDir, `finitemonkey-${options.stamp}.index`));
+  const path = toAbsolutePath(join20(repo.gitDir, `finitemonkey-${options.stamp}.index`));
   const env = { GIT_INDEX_FILE: path, GIT_OPTIONAL_LOCKS: "0" };
   try {
     return work(env);
@@ -9320,7 +9684,7 @@ var entryOf2 = (kind, xy, path) => ({
   staged: kind !== "untracked" && !xy.startsWith("."),
   unstaged: kind === "untracked" || xy.charAt(1) !== "."
 });
-var afterFields = (record2, count3) => record2.split(" ").slice(count3).join(" ");
+var afterFields = (record2, count4) => record2.split(" ").slice(count4).join(" ");
 var parsePorcelainV2 = (stdout) => {
   const records = stdout.split("\0");
   const out = [];
@@ -9338,94 +9702,8 @@ var parsePorcelainV2 = (stdout) => {
   return out.filter((entry2) => entry2.path !== "" && !entry2.path.startsWith(STATE_PREFIX));
 };
 
-// src/git/project-config.ts
-import { join as join19 } from "node:path";
-var CONFIG_FILE3 = ".finitemonkey/config.yml";
-var unquote = (value) => value.trim().replace(/^(["'])(.*)\1$/s, "$2");
-var stripComment2 = (line2) => {
-  let quote;
-  for (let index = 0; index < line2.length; index += 1) {
-    const char = line2.charAt(index);
-    if (quote === void 0 && (char === '"' || char === "'")) quote = char;
-    else if (char === quote) quote = void 0;
-    else if (quote === void 0 && char === "#" && (index === 0 || /\s/.test(line2.charAt(index - 1)))) {
-      return line2.slice(0, index);
-    }
-  }
-  return line2;
-};
-var flowList = (value) => {
-  const trimmed = value.trim();
-  if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return void 0;
-  return trimmed.slice(1, -1).split(",").map(unquote).filter((item) => item !== "");
-};
-var keyValue = (body2) => {
-  const match = /^("[^"]*"|'[^']*'|[^:]+?)\s*:(?:\s+(.*))?$/.exec(body2);
-  if (match === null) return void 0;
-  return { key: unquote(match[1] ?? ""), value: match[2] ?? "" };
-};
-var addItem = (frame, item) => {
-  if (frame.key === void 0) return;
-  const parent = frame.tree[frame.key];
-  if (Array.isArray(parent)) parent.push(item);
-  else frame.tree[frame.key] = [item];
-};
-var placeLine = (stack, indent, body2) => {
-  while (stack.length > 1 && (stack[stack.length - 1]?.indent ?? 0) >= indent && !body2.startsWith("- ")) stack.pop();
-  const top = stack[stack.length - 1];
-  if (top === void 0) return;
-  if (body2.startsWith("- ")) {
-    addItem(top, unquote(body2.slice(2)));
-    return;
-  }
-  const pair = keyValue(body2);
-  if (pair === void 0) return;
-  const parentTree = top.key === void 0 ? top.tree : ensureTree(top.tree, top.key);
-  if (pair.value === "") {
-    stack.push({ indent, tree: parentTree, key: pair.key });
-    return;
-  }
-  parentTree[pair.key] = flowList(pair.value) ?? unquote(pair.value);
-};
-var ensureTree = (tree, key) => {
-  const existing = tree[key];
-  if (existing !== void 0 && typeof existing !== "string" && !Array.isArray(existing)) return existing;
-  const fresh3 = {};
-  tree[key] = fresh3;
-  return fresh3;
-};
-var parseConfigYaml = (text6) => {
-  const root = {};
-  const stack = [{ indent: -1, tree: root, key: void 0 }];
-  for (const raw of text6.split(/\r?\n/)) {
-    const line2 = stripComment2(raw).trimEnd();
-    if (line2.trim() === "" || line2.trim() === "---") continue;
-    const indent = line2.length - line2.trimStart().length;
-    placeLine(stack, indent, line2.trim());
-  }
-  return root;
-};
-var isTree = (node) => typeof node === "object" && !Array.isArray(node);
-var configAt = (tree, ...path) => path.reduce((node, key) => isTree(node) ? node[key] : void 0, tree);
-var configList = (tree, ...path) => {
-  const node = configAt(tree, ...path);
-  if (typeof node === "string") return node === "" ? [] : [node];
-  return Array.isArray(node) ? node.filter((item) => typeof item === "string") : [];
-};
-var configMap = (tree, ...path) => {
-  const node = configAt(tree, ...path);
-  if (!isTree(node)) return {};
-  return Object.fromEntries(
-    Object.entries(node).filter((entry2) => typeof entry2[1] === "string")
-  );
-};
-var loadProjectConfig = (runtime, root) => {
-  const text6 = runtime.readText(toAbsolutePath(join19(root, CONFIG_FILE3)));
-  return text6.ok ? parseConfigYaml(text6.value) : {};
-};
-
 // src/git/merge/dropped.ts
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/git/merge/lines.ts
 var normalizeLine = (line2) => line2.replace(/\r$/, "").trim().replace(/\s*,$/, "");
@@ -9505,7 +9783,7 @@ var parseDropped = (text6) => {
   return accept({ items, invalid });
 };
 var loadDropped = (runtime, root, file) => {
-  const path = toAbsolutePath(file ?? join20(root, DROPPED_FILE), root);
+  const path = toAbsolutePath(file ?? join21(root, DROPPED_FILE), root);
   const text6 = runtime.readText(path);
   if (!text6.ok) return file === void 0 ? accept({ items: [], invalid: [] }) : reject(`${file}: ${text6.error}`);
   return parseDropped(text6.value);
@@ -9515,7 +9793,7 @@ var isDropped = (finding3, items) => items.some(
 );
 
 // src/git/merge/generated.ts
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var LOCKFILES3 = /* @__PURE__ */ new Set([
   "package-lock.json",
   "npm-shrinkwrap.json",
@@ -9578,7 +9856,7 @@ var verifyGenerated = (runtime, repo, inputs, paths, generators) => {
   if (declared.length === 0) return accept([]);
   const commit2 = resultCommit(runtime, repo, inputs);
   if (!commit2.ok) return commit2;
-  const dir = join21(repo.gitDir, `finitemonkey-generate-${runtime.now().replace(/[:.]/g, "-")}`);
+  const dir = join22(repo.gitDir, `finitemonkey-generate-${runtime.now().replace(/[:.]/g, "-")}`);
   if (!runtime.git(["worktree", "add", "--detach", dir, commit2.value], repo.root).ok)
     return reject("could not check out the merge result");
   try {
@@ -9588,7 +9866,7 @@ var verifyGenerated = (runtime, repo, inputs, paths, generators) => {
     }
     return accept(
       declared.flatMap(({ path }) => {
-        const fresh3 = runtime.readText(toAbsolutePath(join21(dir, path)));
+        const fresh3 = runtime.readText(toAbsolutePath(join22(dir, path)));
         const merged = blobText(runtime, repo, commit2.value, path);
         if (fresh3.ok && fresh3.value === merged) return [];
         return [{ kind: "generated-differs", file: path, side: void 0, line: void 0, text: path, weak: false }];
@@ -9874,19 +10152,19 @@ var verifyMerge = (runtime, repo, options = {}) => {
 };
 
 // src/git/ownership.ts
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var OWNERSHIP_DIR = ".finitemonkey/git";
 var ownerKey = (raw) => {
   const cleaned = (raw ?? "").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80);
   return cleaned === "" ? "unknown" : cleaned;
 };
-var fileOf = (repo, kind, owner) => toAbsolutePath(join22(repo.root, OWNERSHIP_DIR, kind, `${ownerKey(owner)}.json`));
+var fileOf = (repo, kind, owner) => toAbsolutePath(join23(repo.root, OWNERSHIP_DIR, kind, `${ownerKey(owner)}.json`));
 var readDirty = (runtime, root) => {
   const status = runtime.git(["status", "--porcelain=v2", "-z", "--untracked-files=all"], root);
   return status.ok ? parsePorcelainV2(status.stdout) : void 0;
 };
 var hashDirty = (runtime, repo, entries) => {
-  const present2 = entries.filter((entry2) => runtime.stat(toAbsolutePath(join22(repo.root, entry2.path)))?.kind === "file");
+  const present2 = entries.filter((entry2) => runtime.stat(toAbsolutePath(join23(repo.root, entry2.path)))?.kind === "file");
   const hashed = present2.length === 0 ? void 0 : runtime.gitWith(["hash-object", "--stdin-paths"], repo.root, {
     input: `${present2.map((entry2) => entry2.path).join("\n")}
 `
@@ -10138,7 +10416,8 @@ var DEFAULT_CHECKS = {
   secrets: secretsCheck,
   prose: proseCheck,
   worktree: worktreeCheck,
-  merge: mergeCheck
+  merge: mergeCheck,
+  review: reviewCheck
 };
 
 // src/gate/run.ts
@@ -10318,10 +10597,21 @@ var isOwnWorktree = (input) => {
   const main2 = findRepoRoot(runtime, input.cwd);
   return front !== void 0 && main2 !== void 0 && front !== main2;
 };
-var subagentStopGate = (input) => isOwnWorktree(input) ? stopGate(input) : { kind: "allow" };
+var noteReview = (input) => {
+  const agent = textField(input.payload.raw, "agent_type") ?? "";
+  if (!REVIEWER_AGENT.test(agent)) return;
+  const root = findRepoRoot(input.runtime, sessionCwd(input));
+  if (root === void 0) return;
+  const tree = treeHash(gitAt(input.runtime, root));
+  if (tree !== void 0) recordReview(input.runtime, fmPaths(root), tree, agent);
+};
+var subagentStopGate = (input) => {
+  noteReview(input);
+  return isOwnWorktree(input) ? stopGate(input) : { kind: "allow" };
+};
 
 // src/gate/hooks/subagent.ts
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var NO_CONTRACT_AGENTS = /(^|:)(reviewer|verifier|explore|plan|claude-code-guide|statusline-setup)$/i;
 var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "command",
@@ -10334,7 +10624,8 @@ var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "secrets",
   "prose",
   "worktree",
-  "merge"
+  "merge",
+  "review"
 ]);
 var requirementText = (t, check2) => {
   const key = `gate.require.${check2.kind}`;
@@ -10355,12 +10646,12 @@ var subagentStart = (input) => {
   const active = readState(runtime, paths).active;
   if (active === void 0) return { kind: "allow" };
   const disk = (relative9) => {
-    const text6 = runtime.readText(toAbsolutePath(join23(paths.root, relative9)));
+    const text6 = runtime.readText(toAbsolutePath(join24(paths.root, relative9)));
     return text6.ok ? text6.value : void 0;
   };
   const loaded = loadTask(runtime, paths, { disk, base: () => void 0 }, active);
   if (!loaded.ok) return { kind: "allow" };
-  const briefing = runtime.stat(toAbsolutePath(join23(paths.dir, "briefing.md"))) !== void 0;
+  const briefing = runtime.stat(toAbsolutePath(join24(paths.dir, "briefing.md"))) !== void 0;
   return { kind: "allow", output: contextOutput("SubagentStart", contractFacts(t, loaded.value.contract, briefing)) };
 };
 
@@ -10377,7 +10668,7 @@ var PORTAO_HANDLERS = {
 };
 
 // src/prod/guard.ts
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 
 // src/git/command-text.ts
 var MAX_SHOWN = 160;
@@ -10719,7 +11010,7 @@ var remoteHostsOf = (command) => {
 };
 
 // src/prod/targets.ts
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 var DEPLOY_FILES = [
   "deploy.sh",
   "scripts/deploy.sh",
@@ -10743,12 +11034,12 @@ var hostsInText = (text6) => {
   return [...urls, ...keyed, ...commands].filter((host) => host !== "" && !host.includes("$"));
 };
 var workflowFiles = (runtime, root) => {
-  const listed4 = runtime.listDir(toAbsolutePath(join24(root, ".github", "workflows")));
+  const listed4 = runtime.listDir(toAbsolutePath(join25(root, ".github", "workflows")));
   if (!listed4.ok) return [];
   return listed4.value.filter((name) => /deploy/i.test(name) && /\.ya?ml$/i.test(name)).map((name) => `.github/workflows/${name}`);
 };
 var detectedHosts = (runtime, root, files) => files.flatMap((file) => {
-  const text6 = runtime.readText(toAbsolutePath(join24(root, file)));
+  const text6 = runtime.readText(toAbsolutePath(join25(root, file)));
   return text6.ok ? hostsInText(text6.value) : [];
 });
 var loadProdTargets = (runtime, root, config) => {
@@ -10760,7 +11051,7 @@ var loadProdTargets = (runtime, root, config) => {
     ...detectedHosts(runtime, root, deployFiles)
   ];
   const declaredDeploy = configAt(config, "prod", "deploy");
-  const existing = deployFiles.find((file) => runtime.stat(toAbsolutePath(join24(root, file))) !== void 0);
+  const existing = deployFiles.find((file) => runtime.stat(toAbsolutePath(join25(root, file))) !== void 0);
   return {
     hosts: new Set(hosts.map(hostKey).filter((host) => host !== "")),
     kubeContexts: configList(config, "prod", "kube_contexts"),
@@ -10937,8 +11228,8 @@ var recordEvidence = (runtime, root, owner, reads) => {
     ] : []
   );
   if (lines3.length === 0) return;
-  const path = toAbsolutePath(join25(root, EVIDENCE_FILE));
-  runtime.mkdir(toAbsolutePath(join25(root, ".finitemonkey")));
+  const path = toAbsolutePath(join26(root, EVIDENCE_FILE));
+  runtime.mkdir(toAbsolutePath(join26(root, ".finitemonkey")));
   const before = runtime.readText(path);
   const text6 = before.ok ? before.value : "";
   runtime.writeAtomic(path, `${text6}${text6 === "" || text6.endsWith("\n") ? "" : "\n"}${lines3.join("\n")}
@@ -11750,10 +12041,10 @@ var listWorktrees = (runtime, cwd) => {
 };
 
 // src/git/journal.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 var JOURNAL_FILE = ".finitemonkey/git-journal.jsonl";
 var JOURNAL_SCHEMA = "finitemonkey/git-journal@1";
-var journalPath = (root) => toAbsolutePath(join26(root, JOURNAL_FILE));
+var journalPath = (root) => toAbsolutePath(join27(root, JOURNAL_FILE));
 var headsOf = (value) => isRecord(value) ? Object.fromEntries(
   Object.entries(value).filter((entry2) => typeof entry2[1] === "string")
 ) : {};
@@ -11789,7 +12080,7 @@ var readJournal = (runtime, root) => {
 };
 var appendJournal = (runtime, root, entry2) => {
   const path = journalPath(root);
-  const made = runtime.mkdir(toAbsolutePath(join26(root, ".finitemonkey")));
+  const made = runtime.mkdir(toAbsolutePath(join27(root, ".finitemonkey")));
   if (!made.ok) return made;
   const previous = runtime.readText(path);
   const before = previous.ok ? previous.value : "";
@@ -12291,10 +12582,10 @@ var textOf2 = (input, found) => {
   }
   return accept(parts.join("\n\n"));
 };
-var decisionFor = (input, found, blocking) => {
+var decisionFor = (input, found, blocking2) => {
   const text6 = textOf2(input, found);
   if (!text6.ok) {
-    return blocking ? { kind: "block", reason: input.t("prose.block.unreadable", { ...text6.error }) } : void 0;
+    return blocking2 ? { kind: "block", reason: input.t("prose.block.unreadable", { ...text6.error }) } : void 0;
   }
   const report2 = scoreProse(text6.value, { context: "record" });
   if (report2.allowed || report2.spans.length === 0) return void 0;
@@ -12303,7 +12594,7 @@ var decisionFor = (input, found, blocking) => {
     spans: describeSpans(input.t, report2.spans),
     fixes: describeFixes(input.t, report2.spans)
   };
-  if (blocking) return { kind: "block", reason: input.t("prose.block.command", params2) };
+  if (blocking2) return { kind: "block", reason: input.t("prose.block.command", params2) };
   const additionalContext = `finitemonkey: ${input.t("prose.warn.command", params2)}`;
   return { kind: "allow", output: { hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext } } };
 };
@@ -12311,9 +12602,9 @@ var proseCommandGuard = (input) => {
   if (!SHELLS3.has(toolName2(input.payload))) return ALLOW4;
   const found = proseInCommand(optionalString(toolInput2(input.payload), "command") ?? "");
   if (found.length === 0) return ALLOW4;
-  const blocking = projectPreset(input.runtime, projectRoot(input)) === "gabriel";
+  const blocking2 = projectPreset(input.runtime, projectRoot(input)) === "gabriel";
   for (const item of found) {
-    const decision = decisionFor(input, item, blocking);
+    const decision = decisionFor(input, item, blocking2);
     if (decision !== void 0) return decision;
   }
   return ALLOW4;
@@ -12477,11 +12768,24 @@ var relativeFile = (cwd, file) => {
   const rel = relative7(cwd, file).split("\\").join("/");
   return rel.startsWith("..") || rel === "" ? file : rel;
 };
+var warningDecision = (t, warnings) => {
+  if (warnings.length === 0) return ALLOW5;
+  const context = t("secrets.warn.write", { found: describeFindings(t, warnings) });
+  return { kind: "allow", output: { hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: context } } };
+};
 var writeDecision = (input, tool) => {
   const { t } = input;
+  const warnings = [];
   for (const written of writtenTexts(tool, toolInput2(input.payload))) {
     const file = relativeFile(input.cwd, written.file);
-    const found = scanText(written.text, { path: file });
+    const all = scanText(written.text, { path: file });
+    warnings.push(
+      ...all.filter(isWarning).map((finding3) => ({
+        ruleId: finding3.ruleId,
+        where: t("secrets.where.file", { file, line: finding3.line, column: finding3.column })
+      }))
+    );
+    const found = blocking(all);
     if (found.length === 0) continue;
     const items = found.map((finding3) => ({
       ruleId: finding3.ruleId,
@@ -12489,7 +12793,7 @@ var writeDecision = (input, tool) => {
     }));
     return { kind: "block", reason: t("secrets.block.write", { file, found: describeFindings(t, items) }) };
   }
-  return ALLOW5;
+  return warningDecision(t, warnings);
 };
 var bashMessage = (t, finding3) => {
   switch (finding3.kind) {
@@ -12503,8 +12807,9 @@ var bashMessage = (t, finding3) => {
 };
 var commitDecision = (input, includeUnstaged) => {
   const staged = scanStaged(input.runtime, input.cwd, includeUnstaged);
-  if (!staged.ok || staged.value.length === 0) return ALLOW5;
-  const items = staged.value.map((finding3) => ({
+  const found = staged.ok ? blocking(staged.value) : [];
+  if (found.length === 0) return ALLOW5;
+  const items = found.map((finding3) => ({
     ruleId: finding3.ruleId,
     where: input.t("secrets.where.file", { file: finding3.file, line: finding3.line, column: finding3.column })
   }));
@@ -12516,7 +12821,7 @@ var bashDecision = (input) => {
   const segments = segmentsOf(command);
   const [first] = bashFindings(command, segments);
   if (first !== void 0) return { kind: "block", reason: bashMessage(input.t, first) };
-  const found = scanText(command);
+  const found = blocking(scanText(command));
   if (found.length > 0) {
     const items = found.map((finding3) => ({ ruleId: finding3.ruleId, where: lineWhere(input.t, finding3) }));
     return { kind: "block", reason: input.t("secrets.block.bash", { found: describeFindings(input.t, items) }) };
@@ -12541,6 +12846,44 @@ var secretsPreToolUse = (input) => {
   return ALLOW5;
 };
 
+// src/secrets/remotes.ts
+var USER_AND_SECRET = /^[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@/i;
+var USERINFO = /^[a-z][a-z0-9+.-]*:\/\/(?<user>[^\s/@]+)@/i;
+var hasCredential = (url) => {
+  if (USER_AND_SECRET.test(url)) return true;
+  const user = USERINFO.exec(url)?.groups?.["user"];
+  return user !== void 0 && scanText(user, { rules: CREDENTIAL_RULES }).length > 0;
+};
+var parseRemotes = (output) => {
+  const remotes = /* @__PURE__ */ new Map();
+  for (const line2 of output.split(/\r?\n/)) {
+    const [name, url] = line2.trim().split(/\s+/);
+    if (name === void 0 || url === void 0 || name === "") continue;
+    remotes.set(name, [...remotes.get(name) ?? [], url]);
+  }
+  return remotes;
+};
+var remotesWithCredentials = (runtime, root) => {
+  const listed4 = runtime.git(["remote", "-v"], root);
+  if (!listed4.ok) return [];
+  return [...parseRemotes(listed4.stdout)].filter(([, urls]) => urls.some(hasCredential)).map(([name]) => name).sort();
+};
+
+// src/secrets/guards/session.ts
+var secretsSessionStart = (input) => {
+  const remotes = remotesWithCredentials(input.runtime, input.cwd);
+  if (remotes.length === 0) return { kind: "allow" };
+  const params2 = { remotes: remotes.join(", "), remote: remotes[0] ?? "origin" };
+  const text6 = input.t("secrets.session.remote_credential", params2);
+  return {
+    kind: "allow",
+    output: {
+      systemMessage: `finitemonkey: ${text6}`,
+      hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: text6 }
+    }
+  };
+};
+
 // src/hooks/handlers.ts
 var allow = () => ({ kind: "allow" });
 var DECISION_RANK = { allow: 0, defer: 0, ask: 1, deny: 2 };
@@ -12594,7 +12937,8 @@ var mergeHandlers = (...sets) => {
 var SECRETS_HANDLERS = {
   PreToolUse: [secretsPreToolUse],
   UserPromptSubmit: [secretsUserPromptSubmit],
-  PostToolUse: [secretsPostToolUse]
+  PostToolUse: [secretsPostToolUse],
+  SessionStart: [secretsSessionStart]
 };
 var DEFAULT_HANDLERS = mergeHandlers(
   SECRETS_HANDLERS,
@@ -13012,7 +13356,7 @@ var hookSchemaProblems = (hooks, claude) => {
 };
 
 // src/doctor/hook-sources.ts
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 var entriesOf = (source, hooks, own) => Object.entries(asRecord(hooks)).flatMap(
   ([event, groups]) => asList(groups).flatMap((group) => {
     const record2 = asRecord(group);
@@ -13025,7 +13369,7 @@ var projectHookFiles = (env) => readSettings(env).flatMap(({ scope: scope2, path
   const source = PROJECT_SCOPES[scope2];
   return source === void 0 || !("hooks" in settings) ? [] : [{ source, path, hooks: settings["hooks"] }];
 });
-var pluginsDir = ({ env, runtime }) => join27(env["CLAUDE_CONFIG_DIR"] ?? join27(runtime.homeDir(), ".claude"), "plugins");
+var pluginsDir = ({ env, runtime }) => join28(env["CLAUDE_CONFIG_DIR"] ?? join28(runtime.homeDir(), ".claude"), "plugins");
 var installRecord = (value, root) => {
   const records = Array.isArray(value) ? value.filter(isRecord) : isRecord(value) ? [value] : [];
   return records.find((record2) => record2["projectPath"] === root) ?? records[0];
@@ -13036,13 +13380,13 @@ var readJson = (env, path) => {
   return parsed?.ok === true ? parsed.value : void 0;
 };
 var installedPlugin = (env) => {
-  const index = readJson(env, toAbsolutePath(join27(pluginsDir(env), "installed_plugins.json")));
+  const index = readJson(env, toAbsolutePath(join28(pluginsDir(env), "installed_plugins.json")));
   const record2 = installRecord(asRecord(index?.["plugins"])[PLUGIN_ID], env.root);
   const installPath = record2 === void 0 ? void 0 : optionalString(record2, "installPath");
   if (record2 === void 0 || installPath === void 0) return void 0;
   const root = toAbsolutePath(installPath);
-  const manifest = readJson(env, toAbsolutePath(join27(root, ".claude-plugin", "plugin.json")));
-  const hooksPath = toAbsolutePath(join27(root, "hooks", "hooks.json"));
+  const manifest = readJson(env, toAbsolutePath(join28(root, ".claude-plugin", "plugin.json")));
+  const hooksPath = toAbsolutePath(join28(root, "hooks", "hooks.json"));
   const text6 = env.runtime.readText(hooksPath);
   const parsed = text6.ok ? parseJsonObject(text6.value) : void 0;
   return {
@@ -13052,10 +13396,10 @@ var installedPlugin = (env) => {
     hooksText: text6.ok ? text6.value : void 0
   };
 };
-var PRECEDENCE = ["managed", "local", "project", "user"];
+var PRECEDENCE2 = ["managed", "local", "project", "user"];
 var pluginEnabled = (env) => {
   const all = readSettings(env);
-  for (const scope2 of PRECEDENCE) {
+  for (const scope2 of PRECEDENCE2) {
     const value = asRecord(all.find((item) => item.scope === scope2)?.settings["enabledPlugins"])[PLUGIN_ID];
     if (typeof value === "boolean") return { value, scope: scope2 };
   }
@@ -13087,7 +13431,7 @@ var schemaFindings = (env, plugin, claude) => {
   const files = [...projectHookFiles(env), ...plugin?.hooksFile === void 0 ? [] : [plugin.hooksFile]];
   const invalidJson = [
     ...unreadableProjectFiles(env),
-    ...plugin?.hooksText !== void 0 && plugin.hooksFile === void 0 ? [toAbsolutePath(join28(plugin.root, "hooks", "hooks.json"))] : []
+    ...plugin?.hooksText !== void 0 && plugin.hooksFile === void 0 ? [toAbsolutePath(join29(plugin.root, "hooks", "hooks.json"))] : []
   ];
   return [
     ...invalidJson.flatMap((file) => schemaFinding(file, ["not valid JSON"], label2)),
@@ -13108,7 +13452,7 @@ var pluginFindings = (env, projectOwn) => {
   ];
 };
 var coverageFindings = (env, entries) => {
-  const installed = env.runtime.stat(toAbsolutePath(join28(env.root, ...LOCK_FILE.split("/")))) !== void 0;
+  const installed = env.runtime.stat(toAbsolutePath(join29(env.root, ...LOCK_FILE.split("/")))) !== void 0;
   if (entries.length === 0 && !installed) {
     return [finding("hooks.registered", "warn", "doctor.hooks.none", {}, "doctor.hooks.fix_none")];
   }
@@ -13160,17 +13504,17 @@ var checkHooks = (env) => {
 };
 
 // src/doctor/instructions.ts
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 var INSTRUCTION_LINE_CEILING = 200;
 var TOP_INSTRUCTIONS = ["AGENTS.md", "CLAUDE.md", ".claude/CLAUDE.md", "CLAUDE.local.md"];
 var RULES_DIR = ".claude/rules";
 var SHOWN = 3;
 var readProjectFile = (env, relative9) => {
-  const text6 = env.runtime.readText(toAbsolutePath(join29(env.root, ...relative9.split("/"))));
+  const text6 = env.runtime.readText(toAbsolutePath(join30(env.root, ...relative9.split("/"))));
   return text6.ok ? text6.value : void 0;
 };
 var instructionFiles = (env) => {
-  const listed4 = env.runtime.listDir(toAbsolutePath(join29(env.root, ...RULES_DIR.split("/"))));
+  const listed4 = env.runtime.listDir(toAbsolutePath(join30(env.root, ...RULES_DIR.split("/"))));
   const rules = listed4.ok ? listed4.value.filter((name) => name.endsWith(".md")).map((name) => `${RULES_DIR}/${name}`) : [];
   return [...TOP_INSTRUCTIONS, ...rules].flatMap((path) => {
     const text6 = readProjectFile(env, path);
@@ -13275,12 +13619,12 @@ var checkInstructions = (env) => {
 };
 
 // src/doctor/line-endings.ts
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 var LF_RULE = /^\*\s.*\beol=lf\b/m;
 var checkLineEndings = ({ root, runtime }) => {
   const autocrlf = runtime.git(["config", "--get", "core.autocrlf"], root);
   if (!autocrlf.ok || autocrlf.stdout.trim().toLowerCase() !== "true") return [];
-  const attributes = runtime.readText(toAbsolutePath(join30(root, ".gitattributes")));
+  const attributes = runtime.readText(toAbsolutePath(join31(root, ".gitattributes")));
   if (attributes.ok && LF_RULE.test(attributes.value)) return [];
   return [
     finding("git.autocrlf", "warn", "doctor.git.autocrlf", { file: ".gitattributes" }, "doctor.git.fix_autocrlf")
@@ -13288,7 +13632,7 @@ var checkLineEndings = ({ root, runtime }) => {
 };
 
 // src/doctor/memory.ts
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 var ceilingOf = (config) => {
   const value = configAt(parseConfigYaml(config ?? ""), "memory", "maxLines");
   const parsed = typeof value === "string" ? Number.parseInt(value, 10) : Number.NaN;
@@ -13296,9 +13640,9 @@ var ceilingOf = (config) => {
 };
 var lineCount2 = (text6) => text6.replace(/\r?\n$/, "").split(/\r?\n/).length;
 var checkAgentsFile = ({ root, runtime }) => {
-  const text6 = runtime.readText(toAbsolutePath(join31(root, AGENTS_FILE)));
+  const text6 = runtime.readText(toAbsolutePath(join32(root, AGENTS_FILE)));
   if (!text6.ok) return [];
-  const config = runtime.readText(toAbsolutePath(join31(root, CONFIG_FILE)));
+  const config = runtime.readText(toAbsolutePath(join32(root, CONFIG_FILE)));
   const max = ceilingOf(config.ok ? config.value : void 0);
   const lines3 = lineCount2(text6.value);
   const params2 = { file: AGENTS_FILE, lines: lines3, max };
@@ -13306,7 +13650,7 @@ var checkAgentsFile = ({ root, runtime }) => {
 };
 
 // src/doctor/project-files.ts
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 var variants = (base, extensions) => extensions.map((extension) => `${base}${extension}`);
 var SCRIPT = [".js", ".cjs", ".mjs", ".ts", ".cts", ".mts"];
 var DATA = ["", ".json", ".yml", ".yaml"];
@@ -13337,7 +13681,7 @@ var CONFIG_GROUPS = [
     files: [...variants("commitlint.config", SCRIPT), ...variants(".commitlintrc", [...DATA, ".js"])]
   }
 ];
-var present = (env, files) => files.filter((file) => env.runtime.stat(toAbsolutePath(join32(env.root, file)))?.kind === "file");
+var present = (env, files) => files.filter((file) => env.runtime.stat(toAbsolutePath(join33(env.root, file)))?.kind === "file");
 var crowded = (env, groups, build) => groups.flatMap(({ name, files }) => {
   const found = present(env, files);
   return found.length > 1 ? [build(name, found.join(", "))] : [];
@@ -13361,6 +13705,22 @@ var checkProjectFiles = (env) => [
   )
 ];
 
+// src/doctor/remotes.ts
+var checkRemoteCredentials = ({ root, runtime }) => {
+  const remotes = remotesWithCredentials(runtime, root);
+  if (remotes.length === 0) return [];
+  const params2 = { remotes: remotes.join(", "), remote: remotes[0] ?? "origin" };
+  return [
+    finding(
+      "secrets.remote_credential",
+      "warn",
+      "doctor.secrets.remote_credential",
+      params2,
+      "doctor.secrets.fix_remote_credential"
+    )
+  ];
+};
+
 // src/doctor/run.ts
 var DOCTOR_SCHEMA = "finitemonkey/doctor@1";
 var CHECKS = [
@@ -13376,6 +13736,7 @@ var CHECKS = [
   checkInstructions,
   checkProjectFiles,
   checkLineEndings,
+  checkRemoteCredentials,
   checkAgentsFile,
   checkHooks
 ];
@@ -13403,7 +13764,7 @@ var toItem = (ctx, finding3) => ({
   detail: ctx.t(finding3.messageKey, finding3.params),
   ...finding3.fixKey === void 0 ? {} : { fix: ctx.t(finding3.fixKey, finding3.params) }
 });
-var count2 = (items, status) => items.filter((item) => item.status === status).length;
+var count3 = (items, status) => items.filter((item) => item.status === status).length;
 var hookItems = (ctx, findings) => findings.flatMap(
   (finding3) => finding3.hook === void 0 ? [] : [
     {
@@ -13419,7 +13780,7 @@ var buildReport2 = (ctx, findings) => {
     schema: DOCTOR_SCHEMA,
     checks,
     hooks: hookItems(ctx, findings),
-    summary: { ok: count2(checks, "ok"), warn: count2(checks, "warn"), fail: count2(checks, "fail") }
+    summary: { ok: count3(checks, "ok"), warn: count3(checks, "warn"), fail: count3(checks, "fail") }
   };
 };
 
@@ -13736,7 +14097,7 @@ var resultOf = (ctx, checked) => {
     const problem4 = gitProblem("merge_unanalyzable", "git.error.merge_unanalyzable", detail, "git status");
     return failureFrom(ctx.t, { ...problem4, exitCode: ExitCode.Usage, data }, human2);
   }
-  const lost = checked.reduce((count3, item) => count3 + item.report.findings.length, 0);
+  const lost = checked.reduce((count4, item) => count4 + item.report.findings.length, 0);
   if (lost === 0) return success(data, human2);
   return failureFrom(
     ctx.t,
@@ -13903,7 +14264,7 @@ var rescueCommand = {
 };
 
 // src/git/undo.ts
-import { basename as basename3, dirname as dirname8, join as join33 } from "node:path";
+import { basename as basename3, dirname as dirname8, join as join34 } from "node:path";
 var INDEX_SUBJECT = "finitemonkey index:";
 var gitLine = (runtime, repo, args) => {
   const result = runtime.git(args, repo.root);
@@ -13946,7 +14307,7 @@ var findSnapshot = (views, wanted) => {
 };
 var stampOf2 = (iso) => iso.replace(/[:.]/g, "-");
 var worktreePath = (runtime, repo) => {
-  const base = join33(dirname8(repo.root), `${basename3(repo.root)}-undo-${stampOf2(runtime.now())}`);
+  const base = join34(dirname8(repo.root), `${basename3(repo.root)}-undo-${stampOf2(runtime.now())}`);
   return toAbsolutePath(runtime.stat(toAbsolutePath(base)) === void 0 ? base : `${base}-2`);
 };
 var intoWorktree = (runtime, repo, view2) => {
@@ -14134,19 +14495,6 @@ var helpCommand = {
   )
 };
 
-// src/install/plugin-yield.ts
-import { join as join34 } from "node:path";
-var PLUGIN_VIA = "plugin";
-var YIELD_STDOUT = `${JSON.stringify({ continue: true })}
-`;
-var projectOwnsHooks = (ctx) => {
-  const root = ctx.env["CLAUDE_PROJECT_DIR"] ?? ctx.cwd;
-  const text6 = ctx.runtime.readText(toAbsolutePath(join34(root, ...SETTINGS_FILE.split("/"))));
-  if (!text6.ok) return false;
-  const parsed = parseJsonObject(text6.value);
-  return parsed.ok && ownHandlersIn(parsed.value) > 0;
-};
-
 // src/commands/hook.ts
 var hookCommand = {
   path: ["hook"],
@@ -14280,17 +14628,17 @@ var rulesFor = (locale) => {
 var branchFor = (node, value, locale) => {
   const { branches } = node;
   if (node.kind === "select") return branches[String(value)] ?? branches["other"];
-  const count3 = typeof value === "number" ? value : Number(value);
-  if (!Number.isFinite(count3)) return branches["other"];
-  return branches[`=${String(count3)}`] ?? branches[rulesFor(locale).select(count3)] ?? branches["other"];
+  const count4 = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(count4)) return branches["other"];
+  return branches[`=${String(count4)}`] ?? branches[rulesFor(locale).select(count4)] ?? branches["other"];
 };
-var render = (nodes, params2, locale, count3) => nodes.map((node) => {
+var render = (nodes, params2, locale, count4) => nodes.map((node) => {
   if (node.kind === "text") return node.text;
-  if (node.kind === "count") return count3 === void 0 ? "#" : String(count3);
+  if (node.kind === "count") return count4 === void 0 ? "#" : String(count4);
   const value = params2[node.name];
   if (node.kind === "arg") return value === void 0 ? `{${node.name}}` : String(value);
   const branch = branchFor(node, value, locale) ?? [];
-  return render(branch, params2, locale, node.kind === "plural" ? value : count3);
+  return render(branch, params2, locale, node.kind === "plural" ? value : count4);
 }).join("");
 var formatMessage = (source, params2, locale) => render(parseMessage(source), params2, locale, void 0);
 var walk = (nodes, visit2) => {
@@ -14320,7 +14668,7 @@ var choicesOf = (source) => {
 var requiredPluralBranches = (locale) => {
   const rules = rulesFor(locale);
   const seen = /* @__PURE__ */ new Set(["other"]);
-  for (let count3 = 0; count3 <= 1e3; count3 += 1) seen.add(rules.select(count3));
+  for (let count4 = 0; count4 <= 1e3; count4 += 1) seen.add(rules.select(count4));
   return [...seen].sort();
 };
 
@@ -14633,6 +14981,7 @@ var lookBack = (runtime, root, env) => {
 
 // src/install/diff.ts
 var MAX_DIFF_LINES = 120;
+var MAX_LCS_CELLS = 4e6;
 var table = (a, b) => {
   const rows = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
   for (let i = a.length - 1; i >= 0; i -= 1) {
@@ -14667,8 +15016,27 @@ var walk2 = (a, b) => {
   return ops;
 };
 var splitLines = (text6) => text6 === "" ? [] : text6.replace(/\r?\n$/, "").split(/\r?\n/);
+var sharedPrefix = (a, b) => {
+  let count4 = 0;
+  while (count4 < a.length && count4 < b.length && a[count4] === b[count4]) count4 += 1;
+  return count4;
+};
+var sharedSuffix = (a, b, prefix) => {
+  let count4 = 0;
+  while (count4 < a.length - prefix && count4 < b.length - prefix && a[a.length - 1 - count4] === b[b.length - 1 - count4])
+    count4 += 1;
+  return count4;
+};
+var changedOps = (a, b) => {
+  const prefix = sharedPrefix(a, b);
+  const suffix = sharedSuffix(a, b, prefix);
+  const left = a.slice(prefix, a.length - suffix);
+  const right = b.slice(prefix, b.length - suffix);
+  if (left.length * right.length <= MAX_LCS_CELLS) return walk2(left, right).filter(([op]) => op !== "=");
+  return [...left.map((line2) => ["-", line2]), ...right.map((line2) => ["+", line2])];
+};
 var lineDiff = (path, before, after) => {
-  const changes = walk2(splitLines(before), splitLines(after)).filter(([op]) => op !== "=");
+  const changes = changedOps(splitLines(before), splitLines(after));
   if (changes.length === 0) return [];
   const lines3 = changes.map(([op, line2]) => `${op} ${line2}`);
   const shown3 = lines3.slice(0, MAX_DIFF_LINES);
@@ -15241,7 +15609,7 @@ var humanOf2 = (ctx, data) => [
 ];
 var resultOf3 = (ctx, data) => {
   const human2 = humanOf2(ctx, data);
-  const failing = data.summary.new + data.summary.expired;
+  const failing = data.findings.filter((item) => item.status !== "known" && item.severity !== "warning").length;
   if (failing === 0) return success(data, human2);
   return failureFrom(
     ctx.t,