githits 0.4.2 → 0.4.4

package/dist/cli.js

@@ -32,6 +32,7 @@ import {
   PackageIntelligenceValidationError,
   PackageIntelligenceVersionNotFoundError,
   PromptServiceImpl,
+  clearAutoLoginAuthSessionMetadata,
   createAuthCommandDependencies,
   createAuthStatusDependencies,
   createContainer,
@@ -42,6 +43,7 @@ import {
   formatUpdateNotice,
   getCodeNavigationUrl,
   isTelemetryEnabled,
+  loadAutoLoginAuthSessionMetadata,
   refreshExpiredToken,
   setClientMode,
   setMcpClientVersionProvider,
@@ -49,11 +51,11 @@ import {
   shouldRunUpdateCheck,
   startTelemetrySpan,
   withTelemetrySpan
-} from "./shared/chunk-v8sths32.js";
+} from "./shared/chunk-tfqxat16.js";
 import {
   __require,
   version
-} from "./shared/chunk-jdygt0ra.js";
+} from "./shared/chunk-96tjsv6y.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -914,7 +916,7 @@ var GREP_REPO_PATTERN_NOTE = "Text grep over indexed source files. `literal` (de
 function buildGrepRepoParams(input) {
   const pattern = input.pattern ?? "";
   if (pattern.length === 0 || pattern.trim().length === 0) {
-    throw new InvalidPackageSpecError("`pattern` is required — pass the text to search for.");
+    throw new InvalidPackageSpecError("`pattern` is required — pass the text to search for. If you are trying to list files or count files in scope, use `code_files` instead.");
   }
   if (Buffer.byteLength(pattern, "utf8") > PATTERN_MAX) {
     throw new InvalidPackageSpecError(`\`pattern\` must be ≤ ${PATTERN_MAX} UTF-8 bytes.`);
@@ -1057,7 +1059,13 @@ function normalizeWaitTimeoutMs(value) {
   }
   return value;
 }
+// src/shared/shell-quote.ts
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+
 // src/shared/grep-repo-response.ts
+var UTF8_ENCODER = new TextEncoder;
 function buildGrepRepoSuccessPayload(result, options) {
   const envelope = {
     pattern: options.pattern,
@@ -1369,7 +1377,7 @@ function renderVerboseLine(line, gutterWidth, useColors) {
     if (line.symbolHint) {
       const hintIndent = " ".repeat(2 + gutterWidth + 2);
       return `${matchRow}
-${hintIndent}${dim(`↳ in: ${line.symbolHint}`, useColors)}`;
+${hintIndent}${dim(`in: ${line.symbolHint}`, useColors)}`;
     }
     return matchRow;
   }
@@ -1388,8 +1396,9 @@ function formatSymbolHint(symbol) {
     parts.push("public");
   if (symbol.arity !== undefined)
     parts.push(`arity=${symbol.arity}`);
-  if (symbol.callerCount !== undefined)
+  if (symbol.callerCount !== undefined) {
     parts.push(`callers=${symbol.callerCount}`);
+  }
   if (symbol.startLine !== undefined && symbol.endLine !== undefined) {
     parts.push(`L${symbol.startLine}-${symbol.endLine}`);
   }
@@ -1426,9 +1435,6 @@ function shouldSuggestNarrowingScope(envelope) {
 function formatCount(count, singular, plural = `${singular}s`) {
   return `${count} ${count === 1 ? singular : plural}`;
 }
-function shellQuote(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
 function padLeft(text, width) {
   return text.length >= width ? text : `${" ".repeat(width - text.length)}${text}`;
 }
@@ -1449,7 +1455,21 @@ function mergeRanges(existing, incoming) {
   return merged;
 }
 function clampCharacterOffset(text, offset) {
-  return Math.max(0, Math.min(text.length, offset));
+  if (offset <= 0)
+    return 0;
+  let byteOffset = 0;
+  for (let index = 0;index < text.length; ) {
+    const codePoint = text.codePointAt(index);
+    if (codePoint === undefined)
+      break;
+    const char = String.fromCodePoint(codePoint);
+    const nextByteOffset = byteOffset + UTF8_ENCODER.encode(char).length;
+    if (nextByteOffset > offset)
+      return index;
+    byteOffset = nextByteOffset;
+    index += char.length;
+  }
+  return text.length;
 }
 // src/shared/grep-repo-text.ts
 var SEP = " | ";
@@ -1509,33 +1529,8 @@ function buildHeader(envelope) {
     flags.push("case-sensitive");
   if (flags.length > 0)
     parts.push(flags.join(","));
-  const filterEcho = buildFilterEcho(envelope);
-  if (filterEcho)
-    parts.push(filterEcho);
   return parts.join(SEP);
 }
-function buildFilterEcho(envelope) {
-  const filter = envelope.filter;
-  if (!filter)
-    return "";
-  const parts = [];
-  if (filter.path)
-    parts.push(`path=${quote2(filter.path)}`);
-  if (filter.pathPrefix)
-    parts.push(`path_prefix=${quote2(filter.pathPrefix)}`);
-  if (filter.globs?.length)
-    parts.push(`globs=${filter.globs.join(",")}`);
-  if (filter.extensions?.length) {
-    parts.push(`exts=${filter.extensions.join(",")}`);
-  }
-  if (typeof filter.maxMatches === "number") {
-    parts.push(`max_matches=${filter.maxMatches}`);
-  }
-  if (typeof filter.maxMatchesPerFile === "number") {
-    parts.push(`max_matches_per_file=${filter.maxMatchesPerFile}`);
-  }
-  return parts.join(" ");
-}
 function buildTrailer(envelope) {
   const lines = [];
   if (envelope.truncatedReason) {
@@ -1701,7 +1696,7 @@ function buildHeader2(envelope) {
   ];
   if (identity)
     parts.push(identity);
-  const filter = buildFilterEcho2(envelope);
+  const filter = buildFilterEcho(envelope);
   if (filter)
     parts.push(filter);
   return parts.join(SEP2);
@@ -1716,7 +1711,7 @@ function buildIdentity(envelope) {
   }
   return "";
 }
-function buildFilterEcho2(envelope) {
+function buildFilterEcho(envelope) {
   const parts = [];
   if (envelope.filter?.path) {
     parts.push(`path=${quote3(envelope.filter.path)}`);
@@ -1910,6 +1905,8 @@ function formatListPackageDocsTerminal(envelope, options) {
       lines.push(...meta);
     lines.push("");
   }
+  lines.push(dim("Read a page: githits docs read '<pageId>'", options.useColors));
+  lines.push("");
   if (envelope.nextCursor) {
     lines.push(dim(`Next cursor: ${envelope.nextCursor}`, options.useColors));
   }
@@ -1923,7 +1920,7 @@ function formatListPackageDocsTerminal(envelope, options) {
 }
 function buildSummaryHeader(envelope, useColors) {
   const target = envelope.registry && envelope.name ? `${envelope.registry}:${envelope.name}${envelope.version ? `@${envelope.version}` : ""}` : "package docs";
-  const summary = `${target} · ${envelope.pages.length} page${envelope.pages.length === 1 ? "" : "s"}`;
+  const summary = `${target} | ${envelope.pages.length} page${envelope.pages.length === 1 ? "" : "s"}`;
   const suffix = envelope.total !== undefined ? ` of ${envelope.total}` : "";
   return `${colorize(summary, "bold", useColors)}${dim(suffix, useColors)}`;
 }
@@ -2022,7 +2019,7 @@ var SUPPORTED_DEPS_REGISTRIES = new Set([
   "RUBYGEMS",
   "GO"
 ]);
-var SUPPORTED_DEPS_REGISTRIES_HUMAN = "npm, pypi, hex, crates, vcpkg, zig, rubygems, and go";
+var SUPPORTED_DEPS_REGISTRIES_LIST = PKGSEER_REGISTRY_ARGS.filter((arg) => SUPPORTED_DEPS_REGISTRIES.has(toPkgseerRegistry(arg))).join(", ");
 function supportsDependenciesRegistry(registry) {
   return SUPPORTED_DEPS_REGISTRIES.has(registry);
 }
@@ -2037,7 +2034,7 @@ function buildPackageDependenciesParams(input) {
   }
   const registry = toPkgseerRegistry(normalisedRegistryArg);
   if (!supportsDependenciesRegistry(registry)) {
-    throw new UnsupportedDependenciesRegistryError(`pkg deps only supports ${SUPPORTED_DEPS_REGISTRIES_HUMAN}. Got: ${normalisedRegistryArg}.`);
+    throw new UnsupportedDependenciesRegistryError(`pkg deps only supports ${SUPPORTED_DEPS_REGISTRIES_LIST}. Got: ${normalisedRegistryArg}.`);
   }
   const version2 = normaliseVersion(input.version);
   const canonicalLifecycles = resolveLifecycles(input.lifecycle);
@@ -2415,7 +2412,7 @@ function formatPackageDependenciesTerminal(report, options = {}) {
     const issues = formatConflictsAndCycles(payload, verbose, useColors);
     if (issues)
       blocks.push(issues);
-  } else {
+  } else if (!showGroups) {
     blocks.push(formatDirectDepsList(payload, verbose, useColors));
   }
   if (showGroups) {
@@ -2429,7 +2426,7 @@ function formatPackageDependenciesTerminal(report, options = {}) {
 function formatHeaderBlock(payload, useColors, showGroups, options) {
   const name = colorize(payload.name, "bold", useColors);
   const lines = [
-    `${name} @ ${payload.version} · ${payload.registry}`
+    `${name} @ ${payload.version} | ${payload.registry}`
   ];
   if (payload.requestedVersion) {
     lines.push(dim(`(requested ${payload.requestedVersion})`, useColors));
@@ -2469,13 +2466,13 @@ function formatSummaryRow(payload, useColors, showGroups, options) {
       countParts.push(colorize(`${cycleCount} ${noun}`, "red", useColors));
     }
   }
-  const countLine = countParts.join(" · ");
+  const countLine = countParts.join(" | ");
   if (showGroups)
     return countLine;
   const hidden = collectHiddenGroupNames(payload);
   if (hidden.length === 0)
     return countLine;
-  const hiddenLine = dim(`Hidden groups: ${hidden.join(", ")} — ${options.hiddenGroupsHint ?? "use --lifecycle all."}`, useColors);
+  const hiddenLine = dim(`Hidden groups: ${hidden.join(", ")} - ${options.hiddenGroupsHint ?? "use --lifecycle all."}`, useColors);
   return `${countLine}
 ${hiddenLine}`;
 }
@@ -2490,18 +2487,21 @@ function formatDirectDepsList(payload, verbose, useColors) {
   if (!runtime || runtime.count === 0)
     return "";
   const sorted = sortAlphabetically(runtime.items, (i) => i.name);
+  const lines = ["Runtime dependencies:", ""];
   if (!verbose) {
-    return sorted.map((item) => `  ${formatDepLabel(item)}`).join(`
+    lines.push(...sorted.map((item) => `  ${formatDepLabel(item)}`));
+    return lines.join(`
 `);
   }
   const rootLabel = `${payload.name}@${payload.version}`;
-  return sorted.map((item) => {
+  lines.push(...sorted.map((item) => {
     const head = `  ${formatDepLabel(item)}`;
     const constraintLabel = item.constraint ?? "*";
     const line = dim(`    - ${constraintLabel} required by ${rootLabel}`, useColors);
     return `${head}
 ${line}`;
-  }).join(`
+  }));
+  return lines.join(`
 `);
 }
 function formatDepLabel(item) {
@@ -2516,11 +2516,13 @@ function formatTransitiveDepsList(payload, verbose, useColors) {
   if (packages.length === 0)
     return "";
   const sorted = [...packages].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const lines = ["Transitive packages:", ""];
   if (!verbose) {
-    return sorted.map((pkg) => `  ${formatPackageLabel(pkg)}`).join(`
+    lines.push(...sorted.map((pkg) => `  ${formatPackageLabel(pkg)}`));
+    return lines.join(`
 `);
   }
-  return sorted.map((pkg) => {
+  lines.push(...sorted.map((pkg) => {
     const head = `  ${formatPackageLabel(pkg)}`;
     const importers = pkg.importers ?? [];
     if (importers.length === 0)
@@ -2528,7 +2530,8 @@ function formatTransitiveDepsList(payload, verbose, useColors) {
     const bullets = formatImporterBullets(importers, useColors);
     return `${head}
 ${bullets}`;
-  }).join(`
+  }));
+  return lines.join(`
 `);
 }
 function formatPackageLabel(pkg) {
@@ -2583,7 +2586,7 @@ function formatConflictsAndCycles(payload, verbose, useColors) {
       lines.push("");
     lines.push(colorize(`Circular dependencies (${cycles.length}):`, "red", useColors));
     for (const c of cycles)
-      lines.push(`  ${c.cycle.join(" → ")}`);
+      lines.push(`  ${c.cycle.join(" -> ")}`);
   }
   return lines.join(`
 `);
@@ -2598,6 +2601,8 @@ function formatGroupsBlock(payload, verbose, useColors) {
   }
   const summary = summariseGroupsByLifecycle(groups.items);
   const groupNoun = groups.items.length === 1 ? "group" : "groups";
+  lines.push("Dependency groups:");
+  lines.push("");
   lines.push(colorize(`${groups.items.length} ${groupNoun} (${summary}):`, "bold", useColors));
   lines.push("");
   if (verbose && groups.environmentMarkers && groups.environmentMarkers.length > 0) {
@@ -2622,9 +2627,7 @@ function formatGroupsBlock(payload, verbose, useColors) {
     } else {
       const nameWidth = Math.max(...deps.map((d) => d.name.length));
       for (const dep of deps) {
-        const name = dep.name.padEnd(nameWidth);
-        const constraint = dep.constraint ?? "";
-        lines.push(`    ${name}  ${constraint}`.trimEnd());
+        lines.push(`    ${formatGroupDependencyRow(dep, group, payload, nameWidth)}`);
       }
     }
     lines.push("");
@@ -2632,6 +2635,20 @@ function formatGroupsBlock(payload, verbose, useColors) {
   return lines.join(`
 `).trimEnd();
 }
+function formatGroupDependencyRow(dep, group, payload, nameWidth) {
+  const constraint = dep.constraint ?? "";
+  if (group.lifecycle !== "runtime") {
+    const name = dep.name.padEnd(nameWidth);
+    return `${name}  ${constraint}`.trimEnd();
+  }
+  const resolvedVersion = payload.runtime?.items.find((item) => item.name === dep.name)?.version;
+  if (!resolvedVersion) {
+    const name = dep.name.padEnd(nameWidth);
+    return `${name}  ${constraint}`.trimEnd();
+  }
+  const versionedName = `${dep.name}@${resolvedVersion}`.padEnd(nameWidth);
+  return `${versionedName}  ${constraint}`.trimEnd();
+}
 function formatEnvironmentMarker(marker) {
   if (marker.type && marker.value)
     return `${marker.type}: ${marker.value}`;
@@ -2900,12 +2917,6 @@ function buildPackageSummarySuccessPayload(summary) {
   const github = buildGithub(pkg.githubRepository);
   if (github)
     payload.github = github;
-  if (summary.quickstart?.installCommand) {
-    payload.install = summary.quickstart.installCommand;
-  }
-  const usage = normaliseUsage(summary.quickstart?.usageExample);
-  if (usage)
-    payload.usage = usage;
   const vulns = buildVulnerabilities(summary.security);
   if (vulns)
     payload.vulnerabilities = vulns;
@@ -2964,20 +2975,12 @@ function buildGithub(github) {
     result.lastPushedAt = lastPushedAt;
   return Object.keys(result).length > 0 ? result : undefined;
 }
-function normaliseUsage(usage) {
-  if (!usage)
-    return;
-  const cleaned = usage.replace(/\r\n/g, `
-`).replace(/\r/g, `
-`);
-  return cleaned.length > 0 ? cleaned : undefined;
-}
 function buildVulnerabilities(security) {
   if (!security)
     return;
-  const total = security.vulnerabilityCount ?? 0;
-  if (total === 0)
+  if (typeof security.vulnerabilityCount !== "number")
     return;
+  const total = security.vulnerabilityCount;
   const result = {
     total,
     affectsLatest: security.hasCurrentVulnerabilities ?? false
@@ -3033,7 +3036,7 @@ function pickChangelogSummary(entry) {
   const firstLine = entry.body.split(/\r?\n/).map((line) => stripMarkdownHeading(line.trim())).find((line) => line.length > 0);
   if (!firstLine)
     return;
-  return firstLine.length > 120 ? `${firstLine.slice(0, 120).trimEnd()}…` : firstLine;
+  return firstLine.length > 120 ? `${firstLine.slice(0, 117).trimEnd()}...` : firstLine;
 }
 function stripMarkdownHeading(line) {
   return line.replace(/^#{1,6}\s+/, "").trim();
@@ -3044,7 +3047,7 @@ function formatPackageSummaryTerminal(summary, options = {}) {
   const width = resolveWidth(options.terminalWidth);
   const now = options.now ?? new Date;
   const sections = [];
-  const header = lean.license ? `${colorize(lean.name, "bold", useColors)} @ ${lean.version} · ${lean.license}` : `${colorize(lean.name, "bold", useColors)} @ ${lean.version}`;
+  const header = lean.license ? `${colorize(lean.name, "bold", useColors)} @ ${lean.version} | ${lean.license}` : `${colorize(lean.name, "bold", useColors)} @ ${lean.version}`;
   sections.push(header);
   if (lean.description) {
     sections.push(wrapText(lean.description, width));
@@ -3054,9 +3057,6 @@ function formatPackageSummaryTerminal(summary, options = {}) {
     sections.push(fields.join(`
 `));
   }
-  if (lean.vulnerabilities) {
-    sections.push(formatVulnFooter(lean.vulnerabilities, useColors));
-  }
   if (options.verbose) {
     const verbose = buildVerboseSections(lean, useColors);
     if (verbose.length > 0)
@@ -3101,10 +3101,19 @@ function wrapText(text, width) {
 function buildFieldList(lean, summary, useColors, now) {
   const fields = [];
   if (lean.repository) {
+    const repositoryParts = [dim(lean.repository, useColors)];
+    const githubPopularity = formatGithubPopularity(lean.github);
+    if (githubPopularity)
+      repositoryParts.push(`(${githubPopularity})`);
     fields.push({
       label: "Repository",
-      value: dim(lean.repository, useColors)
+      value: repositoryParts.join(" ")
     });
+  } else {
+    const githubPopularity = formatGithubPopularity(lean.github);
+    if (githubPopularity) {
+      fields.push({ label: "GitHub", value: githubPopularity });
+    }
   }
   if (lean.homepage) {
     fields.push({ label: "Homepage", value: dim(lean.homepage, useColors) });
@@ -3124,54 +3133,53 @@ function buildFieldList(lean, summary, useColors, now) {
       value: `${formatCompactNumber(lean.downloads.total)} total`
     });
   }
-  if (lean.github) {
-    fields.push({ label: "GitHub", value: formatGithubLine(lean.github) });
-  }
-  if (lean.install) {
-    fields.push({ label: "Install", value: lean.install });
+  if (lean.vulnerabilities) {
+    fields.push({
+      label: "Vulnerabilities",
+      value: formatVulnerabilityStatus(lean.vulnerabilities)
+    });
   }
   const labelWidth = Math.max(10, ...fields.map((field) => field.label.length));
   return fields.map((field) => `${field.label.padEnd(labelWidth)}  ${field.value}`);
 }
-function formatGithubLine(github) {
+function formatGithubPopularity(github) {
+  if (!github)
+    return;
   const parts = [];
+  if (github.archived) {
+    parts.push("[ARCHIVED]");
+  }
   if (github.stars !== undefined) {
-    parts.push(`★ ${formatCompactNumber(github.stars)}`);
+    parts.push(`${formatCompactNumber(github.stars)} stars`);
   }
   if (github.forks !== undefined) {
     parts.push(`${formatCompactNumber(github.forks)} forks`);
   }
   if (github.openIssues !== undefined) {
-    parts.push(`${formatCompactNumber(github.openIssues)} open issues`);
-  }
-  if (github.archived) {
-    parts.push("archived");
+    parts.push(`${formatCompactNumber(github.openIssues)} issues`);
   }
-  return parts.join(" · ");
+  return parts.length > 0 ? parts.join(", ") : undefined;
 }
-function formatVulnFooter(vulns, useColors) {
+function formatVulnerabilityStatus(vulns) {
+  if (vulns.total === 0) {
+    return "No active vulnerabilities in latest published version";
+  }
   const noun = vulns.total === 1 ? "vulnerability" : "vulnerabilities";
-  const base = `${vulns.total} known ${noun}`;
-  const full = vulns.affectsLatest ? `${base} · latest affected` : base;
-  return colorize(full, "yellow", useColors);
+  if (vulns.affectsLatest) {
+    return `${vulns.total} active ${noun}; latest affected`;
+  }
+  return `${vulns.total} known ${noun}; latest not affected`;
 }
 function buildVerboseSections(lean, useColors) {
   const blocks = [];
-  if (lean.usage) {
-    blocks.push([
-      highlight("Usage", useColors),
-      lean.usage.split(`
-`).map((line) => `  ${line}`).join(`
-`)
-    ].join(`
-`));
+  if (lean.github) {
+    const github = formatVerboseGithub(lean.github, useColors);
+    if (github)
+      blocks.push(github);
   }
   if (lean.vulnerabilities?.recent && lean.vulnerabilities.recent.length > 0) {
     blocks.push(formatVerboseAdvisories(lean.vulnerabilities.recent, useColors));
   }
-  if (lean.github?.topics && lean.github.topics.length > 0) {
-    blocks.push(`${"Topics".padEnd(10)}  ${lean.github.topics.join(", ")}`);
-  }
   if (lean.recentChanges && lean.recentChanges.length > 0) {
     blocks.push(formatVerboseChanges(lean.recentChanges, useColors));
   }
@@ -3179,6 +3187,23 @@ function buildVerboseSections(lean, useColors) {
 
 `);
 }
+function formatVerboseGithub(github, useColors) {
+  const fields = [];
+  if (github.language)
+    fields.push({ label: "Language", value: github.language });
+  if (github.lastPushedAt) {
+    fields.push({ label: "Last pushed", value: github.lastPushedAt });
+  }
+  if (github.topics && github.topics.length > 0) {
+    fields.push({ label: "Topics", value: github.topics.join(", ") });
+  }
+  const labelWidth = Math.max(10, ...fields.map((field) => field.label.length));
+  return fields.length > 0 ? [
+    highlight("GitHub", useColors),
+    ...fields.map((field) => `  ${field.label.padEnd(labelWidth)}  ${field.value}`)
+  ].join(`
+`) : undefined;
+}
 function formatVerboseAdvisories(advisories, useColors) {
   const labelWidth = Math.max(...advisories.map((a) => (a.severityLabel ?? "").length));
   const lines = [highlight("Recent advisories", useColors)];
@@ -3228,12 +3253,22 @@ var SUPPORTED_VULN_REGISTRIES = new Set([
   "NPM",
   "PYPI",
   "HEX",
-  "CRATES"
+  "CRATES",
+  "NUGET",
+  "MAVEN",
+  "PACKAGIST",
+  "RUBYGEMS",
+  "GO"
 ]);
-var SUPPORTED_VULN_REGISTRIES_HUMAN = "npm, pypi, hex, and crates";
+var SUPPORTED_VULN_REGISTRIES_HUMAN = "npm, pypi, hex, crates, nuget, maven, packagist, rubygems, and go";
 function supportsVulnerabilitiesRegistry(registry) {
   return SUPPORTED_VULN_REGISTRIES.has(registry);
 }
+var ADVISORY_SCOPE_TO_GRAPHQL = {
+  affected: "AFFECTED",
+  non_affecting: "NON_AFFECTING",
+  all: "ALL"
+};
 function buildPackageVulnerabilitiesParams(input) {
   const trimmedName = input.packageName?.trim() ?? "";
   if (!trimmedName) {
@@ -3247,22 +3282,27 @@ function buildPackageVulnerabilitiesParams(input) {
   if (!supportsVulnerabilitiesRegistry(registry)) {
     throw new UnsupportedVulnerabilitiesRegistryError(`pkg vulns only supports ${SUPPORTED_VULN_REGISTRIES_HUMAN}. Got: ${normalisedRegistryArg}.`);
   }
-  const minSeverity = resolveMinSeverity(input.minSeverity);
+  const severityLabel2 = resolveMinSeverityLabel(input.minSeverity);
+  const minSeverity = severityLabel2 !== undefined ? SEVERITY_LABEL_TO_CVSS[severityLabel2] : undefined;
   const trimmedVersion = input.version?.trim();
   if (trimmedVersion && /^v\d/i.test(trimmedVersion)) {
     throw new InvalidPackageSpecError(`Invalid version '${trimmedVersion}'. Use the canonical package version without a leading 'v' (for example '4.18.0', not 'v4.18.0').`);
   }
+  const advisoryScope = resolveAdvisoryScope(input.advisoryScope);
+  const filterWithScope = buildFilterEcho2(severityLabel2, input.includeWithdrawn, advisoryScope);
   return {
     params: {
       registry,
       packageName: trimmedName,
       version: trimmedVersion && trimmedVersion.length > 0 ? trimmedVersion : undefined,
       minSeverity,
-      includeWithdrawn: input.includeWithdrawn
-    }
+      includeWithdrawn: input.includeWithdrawn,
+      advisoryScope: advisoryScope ? ADVISORY_SCOPE_TO_GRAPHQL[advisoryScope] : undefined
+    },
+    ...filterWithScope ? { filter: filterWithScope } : {}
   };
 }
-function resolveMinSeverity(raw) {
+function resolveMinSeverityLabel(raw) {
   if (raw === undefined)
     return;
   const trimmed = raw.trim();
@@ -3272,12 +3312,36 @@ function resolveMinSeverity(raw) {
   if (!isSeverityLabel(lower)) {
     throw new InvalidPackageSpecError(`Unsupported severity '${raw}'. Expected one of: low, medium, high, critical.`);
   }
-  return SEVERITY_LABEL_TO_CVSS[lower];
+  return lower;
+}
+function buildFilterEcho2(minSeverity, includeWithdrawn, advisoryScope) {
+  const filter = {};
+  if (minSeverity !== undefined)
+    filter.minSeverity = minSeverity;
+  if (includeWithdrawn === true)
+    filter.includeWithdrawn = true;
+  if (advisoryScope !== undefined && advisoryScope !== "affected") {
+    filter.advisoryScope = advisoryScope;
+  }
+  return Object.keys(filter).length > 0 ? filter : undefined;
+}
+function resolveAdvisoryScope(raw) {
+  if (raw === undefined)
+    return;
+  const trimmed = raw.trim();
+  if (trimmed.length === 0)
+    return;
+  const lower = trimmed.toLowerCase().replace(/-/g, "_");
+  if (lower === "affected" || lower === "non_affecting" || lower === "all") {
+    return lower;
+  }
+  throw new InvalidPackageSpecError(`Unsupported advisory scope '${raw}'. Expected one of: affected, non_affecting, all.`);
 }
 function isSeverityLabel(value) {
   return value === "low" || value === "medium" || value === "high" || value === "critical";
 }
 // src/shared/package-vulnerabilities-response.ts
+var DEFAULT_ADVISORY_CAP = 5;
 function buildPackageVulnerabilitiesSuccessPayload(report, options = {}) {
   const pkg = report.package;
   const security = report.security;
@@ -3293,11 +3357,12 @@ function buildPackageVulnerabilitiesSuccessPayload(report, options = {}) {
   if (requestedEcho !== undefined) {
     payload.requestedVersion = requestedEcho;
   }
-  if (total > 0) {
-    const sortedAdvisories = sortAdvisories(dedupedAdvisories.map(buildAdvisory));
-    if (sortedAdvisories.length > 0) {
-      payload.advisories = sortedAdvisories;
-    }
+  if (options.filter !== undefined) {
+    payload.filter = options.filter;
+  }
+  const sortedAdvisories = sortAdvisories(dedupedAdvisories.map(buildAdvisory));
+  if (sortedAdvisories.length > 0) {
+    payload.advisories = sortedAdvisories;
   }
   const upgradePaths = security?.upgradePaths;
   if (upgradePaths && upgradePaths.length > 0) {
@@ -3343,7 +3408,7 @@ function buildSummary(total, security, dedupedAdvisories) {
   if (typeof security?.currentVersionAffected === "boolean") {
     summary.affected = security.currentVersionAffected;
   }
-  if (total === 0)
+  if (dedupedAdvisories.length === 0)
     return summary;
   const bySeverity = computeBySeverity(dedupedAdvisories);
   const anyCounted = Object.values(bySeverity).some((n) => n > 0);
@@ -3731,17 +3796,25 @@ function lowerRegistry3(value) {
 }
 function formatPackageVulnerabilitiesTerminal(report, options = {}) {
   const payload = buildPackageVulnerabilitiesSuccessPayload(report, {
-    requestedVersion: options.requestedVersion
+    requestedVersion: options.requestedVersion,
+    filter: options.filter
   });
   const useColors = options.useColors ?? false;
   const verbose = options.verbose ?? false;
+  const surface = options.surface ?? "cli";
   const headerLine = formatHeader(payload, useColors);
   const requestedLine = payload.requestedVersion ? dim(`(requested ${payload.requestedVersion})`, useColors) : undefined;
+  const filterLines = formatFilterLines(payload.filter);
   if (payload.summary.total === 0) {
     const lines = [headerLine];
     if (requestedLine)
       lines.push(requestedLine);
+    lines.push(...filterLines);
     lines.push(formatNoAffectedVulnerabilitiesLine(payload));
+    if (payload.advisories && payload.advisories.length > 0) {
+      const rangeLimit = resolveAffectedRangesLimit(options.terminalWidth);
+      lines.push("", formatAdvisoryList(payload.advisories, verbose, useColors, rangeLimit, surface));
+    }
     return `${lines.join(`
 `)}
 `;
@@ -3750,15 +3823,21 @@ function formatPackageVulnerabilitiesTerminal(report, options = {}) {
   const headerBlock = [headerLine];
   if (requestedLine)
     headerBlock.push(requestedLine);
+  headerBlock.push(...filterLines);
   headerBlock.push(formatSummaryLine(payload, useColors));
-  const breakdown = formatBreakdownLine(payload.summary, useColors);
+  const selectedAdvisoryCount = payload.advisories?.length ?? 0;
+  const scope = payload.filter?.advisoryScope;
+  const selectedCountLine = formatSelectedAdvisoryCountLine(selectedAdvisoryCount, scope);
+  if (selectedCountLine)
+    headerBlock.push(selectedCountLine);
+  const breakdown = scope === undefined ? formatBreakdownLine(payload.summary, useColors) : undefined;
   if (breakdown)
     headerBlock.push(breakdown);
   blocks.push(headerBlock.join(`
 `));
   if (payload.advisories && payload.advisories.length > 0) {
     const rangeLimit = resolveAffectedRangesLimit(options.terminalWidth);
-    blocks.push(formatAdvisoryList(payload.advisories, verbose, useColors, rangeLimit));
+    blocks.push(formatAdvisoryList(payload.advisories, verbose, useColors, rangeLimit, surface));
   }
   const upgradeFooter = formatUpgradeFooter(payload.upgradePaths);
   if (upgradeFooter)
@@ -3770,7 +3849,29 @@ function formatPackageVulnerabilitiesTerminal(report, options = {}) {
 }
 function formatHeader(payload, useColors) {
   const name = colorize(payload.name, "bold", useColors);
-  return `${name} @ ${payload.version} · ${payload.registry}`;
+  return `${name} @ ${payload.version} | ${payload.registry}`;
+}
+function formatFilterLines(filter) {
+  if (!filter)
+    return [];
+  const lines = [];
+  if (filter.advisoryScope) {
+    lines.push(`Scope   ${formatAdvisoryScope(filter.advisoryScope)}`);
+  }
+  if (filter.minSeverity) {
+    lines.push(`Filter  severity >= ${filter.minSeverity}`);
+  }
+  if (filter.includeWithdrawn === true) {
+    lines.push("Filter  include withdrawn");
+  }
+  return lines;
+}
+function formatAdvisoryScope(scope) {
+  if (scope === "non_affecting")
+    return "historical advisories only";
+  if (scope === "all")
+    return "all package advisories";
+  return scope;
 }
 function formatSummaryLine(payload, useColors) {
   const n = payload.summary.total;
@@ -3786,13 +3887,41 @@ function formatSummaryLine(payload, useColors) {
   return base;
 }
 function formatNoAffectedVulnerabilitiesLine(payload) {
+  const selectedAdvisoryCount = payload.advisories?.length ?? 0;
+  if (payload.filter?.advisoryScope === "non_affecting") {
+    if (selectedAdvisoryCount > 0) {
+      return "No active vulnerabilities affect this version; historical advisories are listed below.";
+    }
+    return "No active vulnerabilities affect this version; no historical advisories match the current filter.";
+  }
+  if (payload.filter?.advisoryScope === "all") {
+    if (selectedAdvisoryCount > 0) {
+      return "No active vulnerabilities affect this version; package advisories are listed below.";
+    }
+    return "No active vulnerabilities affect this version; no package advisories match the current filter.";
+  }
+  if (payload.filter !== undefined) {
+    return "No vulnerabilities matching the filter affect this version.";
+  }
   const historical = payload.summary.nonAffectingVulnerabilityCount ?? 0;
   if (historical > 0) {
     const noun = historical === 1 ? "historical advisory" : "historical advisories";
     const verb = historical === 1 ? "does" : "do";
-    return `No vulnerabilities affect this version (${historical} ${noun} ${verb} not apply).`;
+    return `No active vulnerabilities affect this version (${historical} ${noun} ${verb} not apply).`;
+  }
+  return "No active vulnerabilities affect this version.";
+}
+function formatSelectedAdvisoryCountLine(count, scope) {
+  if (scope === undefined)
+    return;
+  const noun = count === 1 ? "advisory" : "advisories";
+  if (scope === "non_affecting") {
+    return `  showing ${count} historical ${noun} that do not affect this version`;
+  }
+  if (scope === "all") {
+    return `  showing ${count} package ${noun} across affected and historical scopes`;
   }
-  return "No known vulnerabilities affect this version.";
+  return;
 }
 function formatBreakdownLine(summary, useColors) {
   if (summary.total <= 1)
@@ -3818,22 +3947,31 @@ function formatBreakdownLine(summary, useColors) {
   }
   if (parts.length === 0)
     return;
-  return `  ${parts.join(" · ")}`;
+  return `  ${parts.join(" | ")}`;
 }
-function formatAdvisoryList(advisories, verbose, useColors, rangeLimit) {
-  const labelWidth = Math.max(...advisories.map((a) => severityColumnLabel(a).length));
+function formatAdvisoryList(advisories, verbose, useColors, rangeLimit, surface) {
+  const renderedAdvisories = verbose ? advisories : advisories.slice(0, DEFAULT_ADVISORY_CAP);
+  const labelWidth = Math.max(...renderedAdvisories.map((a) => severityColumnLabel(a).length));
   const lines = [];
-  for (const advisory of advisories) {
-    lines.push(...formatAdvisoryLines(advisory, labelWidth, verbose, useColors, rangeLimit));
+  for (const advisory of renderedAdvisories) {
+    lines.push(...formatAdvisoryLines(advisory, labelWidth, verbose, useColors, rangeLimit, surface));
     lines.push("");
   }
+  const hidden = advisories.length - renderedAdvisories.length;
+  if (hidden > 0) {
+    lines.push(dim(formatAdvisoryCapHint(hidden, surface), useColors));
+  }
   return lines.join(`
 `).trimEnd();
 }
+function formatAdvisoryCapHint(hidden, surface) {
+  const hint = surface === "mcp" ? "use verbose=true or format=json" : "use -v";
+  return `... (+${hidden} more; ${hint})`;
+}
 function severityColumnLabel(advisory) {
   if (advisory.isMalicious === true) {
     if (advisory.severityLabel)
-      return `MALWARE · ${advisory.severityLabel}`;
+      return `MALWARE | ${advisory.severityLabel}`;
     return "MALWARE";
   }
   return advisory.severityLabel ?? "unrated";
@@ -3862,7 +4000,7 @@ function severityColumnColor(advisory, useColors, padded) {
       return dim(padded, useColors);
   }
 }
-function formatAdvisoryLines(advisory, labelWidth, verbose, useColors, rangeLimit) {
+function formatAdvisoryLines(advisory, labelWidth, verbose, useColors, rangeLimit, surface) {
   const rawLabel = severityColumnLabel(advisory);
   const padded = rawLabel.padEnd(labelWidth);
   const colouredLabel = severityColumnColor(advisory, useColors, padded);
@@ -3879,7 +4017,7 @@ function formatAdvisoryLines(advisory, labelWidth, verbose, useColors, rangeLimi
     lines.push(`    ${label.padEnd(detailWidth)} ${value}`);
   };
   if (advisory.affectedRanges && advisory.affectedRanges.length > 0) {
-    pushRow("affected", formatRangeList(advisory.affectedRanges, verbose, useColors, rangeLimit, advisory.affectedVersionRangesCount, advisory.affectedVersionRangesTruncated));
+    pushRow("affected", formatRangeList(advisory.affectedRanges, verbose, useColors, rangeLimit, surface, advisory.affectedVersionRangesCount, advisory.affectedVersionRangesTruncated));
   }
   if (advisory.fixedIn && advisory.fixedIn.length > 0) {
     pushRow("fixed in", advisory.fixedIn.join(", "));
@@ -3906,12 +4044,12 @@ function formatAdvisoryLines(advisory, labelWidth, verbose, useColors, rangeLimi
   }
   return lines;
 }
-function formatRangeList(ranges, verbose, useColors, limit, totalCount, backendTruncated) {
+function formatRangeList(ranges, verbose, useColors, limit, surface, totalCount, backendTruncated) {
   const actualTotal = Math.max(totalCount ?? ranges.length, ranges.length);
   const backendHidden = backendTruncated === true ? actualTotal - ranges.length : 0;
   const appendBackendHint = (shown2) => {
     if (backendHidden > 0) {
-      const hint2 = dim(`… (+${backendHidden} ranges omitted by service)`, useColors);
+      const hint2 = dim(`... (+${backendHidden} ranges omitted by service)`, useColors);
       return shown2.length > 0 ? `${shown2}, ${hint2}` : hint2;
     }
     return shown2;
@@ -3921,7 +4059,8 @@ function formatRangeList(ranges, verbose, useColors, limit, totalCount, backendT
   }
   const shown = ranges.slice(0, limit).join(", ");
   const localHidden = ranges.length - limit;
-  const hintText = backendHidden > 0 ? `… (+${localHidden} more with -v; +${backendHidden} omitted by service)` : `… (+${localHidden} more; use -v)`;
+  const localHint = surface === "mcp" ? "use verbose=true" : "use -v";
+  const hintText = backendHidden > 0 ? `... (+${localHidden} more with ${localHint}; +${backendHidden} omitted by service)` : `... (+${localHidden} more; ${localHint})`;
   const hint = dim(hintText, useColors);
   return `${shown}, ${hint}`;
 }
@@ -3972,16 +4111,144 @@ function requirePositiveInteger(raw, label) {
   }
   return parsed;
 }
+// src/shared/read-file-response.ts
+function buildReadFileSuccessPayload(result, options) {
+  const envelope = {
+    path: result.filePath ?? options.requestedFilePath
+  };
+  if (options.registry)
+    envelope.registry = options.registry;
+  if (options.name)
+    envelope.name = options.name;
+  if (options.repoUrl)
+    envelope.repoUrl = options.repoUrl;
+  if (options.gitRef)
+    envelope.gitRef = options.gitRef;
+  if (result.language != null)
+    envelope.language = result.language;
+  if (result.totalLines != null)
+    envelope.totalLines = result.totalLines;
+  if (result.startLine != null)
+    envelope.startLine = result.startLine;
+  if (result.endLine != null)
+    envelope.endLine = result.endLine;
+  if (result.isBinary) {
+    envelope.isBinary = true;
+  } else if (result.content != null) {
+    envelope.content = result.content;
+  }
+  return envelope;
+}
+function formatReadFileTerminal(envelope, options) {
+  const verbose = options.verbose ?? false;
+  if (envelope.isBinary) {
+    return formatBinary(envelope, options, verbose);
+  }
+  if (envelope.content == null) {
+    return formatNoContent(envelope, options, verbose);
+  }
+  if (!verbose) {
+    return envelope.content;
+  }
+  return formatVerboseBody(envelope, options);
+}
+function formatBinary(envelope, options, verbose) {
+  const sentinel = dim("Binary file — cannot display as text.", options.useColors);
+  if (verbose) {
+    return `${buildHeader4(envelope, options)}
+
+${sentinel}
+`;
+  }
+  return `${sentinel}
+`;
+}
+function formatNoContent(envelope, options, verbose) {
+  const sentinel = dim("(no content returned)", options.useColors);
+  if (verbose) {
+    return `${buildHeader4(envelope, options)}
+
+${sentinel}
+`;
+  }
+  return `${sentinel}
+`;
+}
+function formatVerboseBody(envelope, options) {
+  const lines = [];
+  lines.push(buildHeader4(envelope, options));
+  lines.push("");
+  const bodyLines = splitReadFileContentLines(envelope);
+  const startLine = envelope.startLine ?? 1;
+  const endLine = startLine + bodyLines.length - 1;
+  const gutterWidth = String(endLine).length;
+  for (let i = 0;i < bodyLines.length; i++) {
+    const lineNumber = startLine + i;
+    const gutter = dim(String(lineNumber).padStart(gutterWidth, " "), options.useColors);
+    lines.push(`${gutter}  ${bodyLines[i]}`);
+  }
+  if (envelope.hint) {
+    lines.push("");
+    lines.push(dim(envelope.hint, options.useColors));
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+function splitReadFileContentLines(envelope) {
+  if (!envelope.content)
+    return [];
+  const bodyLines = envelope.content.split(`
+`);
+  const expectedCount = expectedLineCount(envelope);
+  if (expectedCount === undefined) {
+    if (bodyLines[bodyLines.length - 1] === "")
+      bodyLines.pop();
+    return bodyLines;
+  }
+  while (bodyLines.length > 0 && bodyLines[bodyLines.length - 1] === "" && bodyLines.length > expectedCount) {
+    bodyLines.pop();
+  }
+  return bodyLines;
+}
+function expectedLineCount(envelope) {
+  if (envelope.startLine === undefined || envelope.endLine === undefined) {
+    return;
+  }
+  if (envelope.endLine < envelope.startLine)
+    return;
+  return envelope.endLine - envelope.startLine + 1;
+}
+function buildHeader4(envelope, options) {
+  const parts = [envelope.path];
+  if (envelope.language)
+    parts.push(envelope.language);
+  const rangeLabel = buildRangeLabel(envelope);
+  if (rangeLabel)
+    parts.push(rangeLabel);
+  return colorize(parts.join(" · "), "bold", options.useColors);
+}
+function buildRangeLabel(envelope) {
+  const { startLine, endLine, totalLines } = envelope;
+  if (startLine != null && endLine != null) {
+    return totalLines != null ? `lines ${startLine}-${endLine} of ${totalLines}` : `lines ${startLine}-${endLine}`;
+  }
+  if (totalLines != null) {
+    return `${totalLines} lines`;
+  }
+  return;
+}
+
 // src/shared/read-file-text.ts
 var SEP4 = " | ";
 function renderReadFileText(envelope) {
   const lines = [];
-  lines.push(buildHeader4(envelope));
+  lines.push(buildHeader5(envelope));
   lines.push("");
   if (envelope.isBinary) {
     lines.push("Binary file - cannot display as text.");
   } else if (envelope.content) {
-    appendNumberedContent(lines, envelope.content, envelope.startLine ?? 1);
+    appendNumberedContent(lines, envelope.content, envelope.startLine ?? 1, envelope.endLine);
   } else {
     lines.push("(no content returned)");
   }
@@ -3992,7 +4259,7 @@ function renderReadFileText(envelope) {
   return lines.join(`
 `);
 }
-function buildHeader4(envelope) {
+function buildHeader5(envelope) {
   const parts = [`code_read${SEP4}${envelope.path}`];
   if (envelope.language)
     parts.push(envelope.language);
@@ -4009,14 +4276,10 @@ function buildRange(envelope) {
     return `${envelope.totalLines} lines`;
   return;
 }
-function appendNumberedContent(lines, content, startLine) {
-  const bodyLines = content.split(`
-`);
-  if (bodyLines.length > 0 && bodyLines[bodyLines.length - 1] === "") {
-    bodyLines.pop();
-  }
-  const endLine = startLine + bodyLines.length - 1;
-  const width = String(endLine).length;
+function appendNumberedContent(lines, content, startLine, endLine) {
+  const bodyLines = splitReadFileContentLines({ content, startLine, endLine });
+  const renderedEndLine = startLine + bodyLines.length - 1;
+  const width = String(renderedEndLine).length;
   for (let i = 0;i < bodyLines.length; i += 1) {
     lines.push(`${String(startLine + i).padStart(width, " ")}  ${bodyLines[i]}`);
   }
@@ -4112,7 +4375,7 @@ function formatReadPackageDocTerminal(envelope, options) {
     return envelope.content ?? "";
   }
   const lines = [];
-  lines.push(buildHeader5(envelope, options.useColors));
+  lines.push(buildHeader6(envelope, options.useColors));
   lines.push(`pageId: ${envelope.pageId}`);
   if (envelope.sourceUrl)
     lines.push(`source: ${envelope.sourceUrl}`);
@@ -4132,7 +4395,7 @@ function formatReadPackageDocTerminal(envelope, options) {
 `)}
 `;
 }
-function buildHeader5(envelope, useColors) {
+function buildHeader6(envelope, useColors) {
   const badge = envelope.sourceKind === "repo" ? "[repo]" : "[crawled]";
   const title = envelope.title ?? envelope.pageId;
   const prefix = envelope.registry && envelope.name ? `${envelope.registry}:${envelope.name}${envelope.version ? `@${envelope.version}` : ""}` : "documentation";
@@ -4142,7 +4405,7 @@ function buildHeader5(envelope, useColors) {
 var SEP5 = " | ";
 function renderReadPackageDocText(envelope) {
   const lines = [];
-  lines.push(buildHeader6(envelope));
+  lines.push(buildHeader7(envelope));
   if (envelope.sourceUrl)
     lines.push(`source: ${envelope.sourceUrl}`);
   if (envelope.filePath) {
@@ -4159,7 +4422,7 @@ function renderReadPackageDocText(envelope) {
   return lines.join(`
 `);
 }
-function buildHeader6(envelope) {
+function buildHeader7(envelope) {
   const parts = [`docs_read${SEP5}${envelope.pageId}`];
   if (envelope.title)
     parts.push(envelope.title);
@@ -4479,6 +4742,7 @@ var AUTO_LOGIN_ELIGIBLE_COMMANDS = new Set([
   "pkg deps",
   "pkg changelog"
 ]);
+var AUTH_METADATA_TRUST_WINDOW_MS = 10 * 60 * 1000;
 function getCommandPath(command) {
   const names = [];
   let current = command;
@@ -4511,10 +4775,15 @@ async function maybeAutoLoginBeforeCommand(command, deps) {
   })) {
     return { status: "skipped" };
   }
+  const metadata = await deps.loadAuthSessionMetadata?.();
+  if (metadata && isUnexpiredAuthSessionMetadata(metadata, new Date)) {
+    return { status: "already-authenticated" };
+  }
   const container = await deps.createContainer();
   if (container.hasValidToken) {
     return { status: "already-authenticated" };
   }
+  await deps.clearAuthSessionMetadata?.();
   const result = await deps.loginFlow({}, container);
   switch (result.status) {
     case "success":
@@ -4525,6 +4794,20 @@ async function maybeAutoLoginBeforeCommand(command, deps) {
       return { status: "failed", message: result.message };
   }
 }
+function isUnexpiredAuthSessionMetadata(metadata, now) {
+  const updatedAtMs = Date.parse(metadata.updatedAt);
+  if (Number.isNaN(updatedAtMs))
+    return false;
+  if (now.getTime() - updatedAtMs > AUTH_METADATA_TRUST_WINDOW_MS) {
+    return false;
+  }
+  if (metadata.expiresAt === null)
+    return true;
+  const expiresAtMs = Date.parse(metadata.expiresAt);
+  if (Number.isNaN(expiresAtMs))
+    return false;
+  return now.getTime() < expiresAtMs;
+}
 
 // src/shared/root-cli-pre-action.ts
 function createRootCliPreAction(deps) {
@@ -4615,11 +4898,11 @@ function buildUnifiedSearchParams(input) {
 }
 function resolveTargets(target, targets) {
   if (target && targets) {
-    throw new InvalidArgumentError("Provide either target or targets, not both.");
+    throw new InvalidArgumentError("Provide either `target` for one search target or `targets` for multiple, not both.");
   }
   const resolved = target ? [target] : targets ?? [];
   if (resolved.length === 0) {
-    throw new InvalidArgumentError("At least one target is required.");
+    throw new InvalidArgumentError("Provide either `target` for one search target or `targets` for multiple; neither was set.");
   }
   const deduped = [];
   const seen = new Set;
@@ -4738,7 +5021,7 @@ function combineWarnings(parserWarnings, sourceStatus, hits = [], progress) {
   out.push(...buildHitFreshnessWarnings(hits));
   out.push(...buildProgressFreshnessWarnings(progress));
   out.push(...buildSourceStatusWarnings(sourceStatus));
-  return out;
+  return Array.from(new Set(out));
 }
 function buildUnifiedSearchErrorPayload(error2) {
   const mapped = mapCodeNavigationError(error2);
@@ -5171,7 +5454,7 @@ var SUMMARY_WRAP_WIDTH = 76;
 var SEP6 = " | ";
 function renderUnifiedSearchSuccess(payload) {
   const lines = [];
-  lines.push(buildHeader7(payload));
+  lines.push(buildHeader8(payload));
   lines.push("");
   if (payload.results.length === 0) {
     lines.push(payload.completed ? "No hits." : "No hits yet - indexing.");
@@ -5202,7 +5485,7 @@ function renderUnifiedSearchError(payload) {
   return lines.join(`
 `);
 }
-function buildHeader7(payload) {
+function buildHeader8(payload) {
   const count = payload.results.length;
   const status = payload.completed ? `${count} hit${count === 1 ? "" : "s"}` : `${count} partial`;
   const parts = [`search${SEP6}${status}`];
@@ -5220,7 +5503,7 @@ function appendUnifiedSearchHits(lines, hits) {
   });
 }
 function appendHit(lines, index, hit) {
-  const headerParts = [hit.target, shortType(hit.type)];
+  const headerParts = [formatHitPrimary(hit), shortType(hit.type)];
   lines.push(`[${index}] ${headerParts.join("  ")}`);
   const locator = buildLocatorLine(hit);
   if (locator)
@@ -5234,6 +5517,26 @@ function appendHit(lines, index, hit) {
     }
   }
 }
+function formatHitPrimary(hit) {
+  const loc = hit.locator;
+  if (hit.type === "documentation_page" && loc.pageId) {
+    const target = formatDocsPageTarget(loc, hit.target);
+    return target ? `${loc.pageId} ${target}` : loc.pageId;
+  }
+  if (hit.type === "repository_doc" && loc.filePath) {
+    return `${hit.target} ${loc.filePath}${formatLineRange(loc.startLine, loc.endLine)}`;
+  }
+  return hit.target;
+}
+function formatDocsPageTarget(locator, fallbackTarget) {
+  return locator.registry && locator.packageName ? `${locator.registry}:${locator.packageName}` : stripVersionFromTarget(fallbackTarget);
+}
+function stripVersionFromTarget(value) {
+  if (!value)
+    return "";
+  const atIndex = value.lastIndexOf("@");
+  return atIndex > 0 ? value.slice(0, atIndex) : value;
+}
 function shortType(type) {
   switch (type) {
     case "repository_code":
@@ -5402,7 +5705,7 @@ function wrapText2(text, width) {
 var SEP7 = " | ";
 function renderUnifiedSearchStatusText(payload) {
   const lines = [];
-  lines.push(buildHeader8(payload));
+  lines.push(buildHeader9(payload));
   if (!payload.completed && payload.progress) {
     lines.push(formatProgress(payload.progress));
     if (payload.progress.targets?.length) {
@@ -5426,7 +5729,7 @@ function renderUnifiedSearchStatusText(payload) {
   return lines.join(`
 `);
 }
-function buildHeader8(payload) {
+function buildHeader9(payload) {
   const state = payload.completed ? "complete" : "indexing";
   const parts = [`search_status${SEP7}${state}`];
   if (payload.searchRef)
@@ -5999,8 +6302,8 @@ function looksLikeMissingNavpackMessage(message) {
   const lower = message.toLowerCase();
   return lower.includes("has no navpack for this ref") || lower.includes("navpack was pruned") || lower.includes("indexedrepository row still claims current state");
 }
-function handleCodeNavCommandError(error2, json, terminalRenderer, exitCode = 1) {
-  const mapped = mapCodeNavigationError(error2);
+function handleCodeNavCommandError(error2, json, terminalRenderer, exitCode = 1, mapMappedError = (mapped) => mapped) {
+  const mapped = mapMappedError(mapCodeNavigationError(error2));
   if (json) {
     console.error(JSON.stringify({
       error: mapped.message,
@@ -6271,7 +6574,7 @@ grep run. --symbol-field hydrates enclosing symbol metadata (appears under each
 match in --verbose output; full payload in --json).`;
 function registerCodeGrepCommand(pkgCommand) {
   return pkgCommand.command("grep").summary("Deterministic text grep over indexed dependency source").description(PKG_GREP_DESCRIPTION).argument("[spec-or-pattern]", "Spec mode: package spec (e.g. npm:express). Repo mode (with --repo-url): the pattern.").argument("[pattern-or-prefix]", "Spec mode: the pattern. Repo mode: optional path-prefix.").argument("[path-prefix]", "Spec mode only: optional path-prefix. Ignored with --repo-url.").option("--repo-url <url>", "Repository URL addressing (requires --git-ref)").option("--git-ref <ref>", "Tag, commit, branch, or HEAD. Required with --repo-url.").option("--path <path>", "Exact file path to grep").option("--glob <glob>", "Glob scope (repeatable)", collectRepeatable2, []).option("--ext <ext>", "Extension filter without leading dot (repeatable)", collectRepeatable2, []).option("--regex", "Interpret the pattern as RE2 regex").option("--case-sensitive", "Enable ASCII case-sensitive matching").option("-C, --context <n>", "Context lines before and after each match (0-10)").option("-B, --before-context <n>", "Context lines before each match (0-10)").option("-A, --after-context <n>", "Context lines after each match (0-10)").option("--exclude-docs", "Skip files classified as documentation").option("--exclude-tests", "Skip files classified as tests").option("--limit <n>", "Max matches to return on this page (1-1000, default 50)").option("--per-file-limit <n>", "Cap matches per file within this page (0-1000, 0 = unlimited)").option("--cursor <cursor>", "Opaque nextCursor from a previous grep result").option("--symbol-field <field>", `Repeatable; surfaces in --json and under each --verbose match. ${GREP_REPO_SYMBOL_FIELDS_NOTE}`, collectRepeatable2, []).option("--wait <ms>", `Indexing wait timeout (0-${MAX_WAIT_TIMEOUT_MS}, default ${DEFAULT_WAIT_TIMEOUT_MS})`).option("-v, --verbose", "Render grouped output with file headers").option("--json", "Emit the JSON envelope").action(async (arg1, arg2, arg3, options) => {
-    const { createContainer: createContainer2 } = await import("./shared/chunk-q2mre780.js");
+    const { createContainer: createContainer2 } = await import("./shared/chunk-k35egwwf.js");
     const deps = await createContainer2();
     await pkgGrepAction(arg1, arg2, arg3, options, {
       codeNavigationService: deps.codeNavigationService,
@@ -6282,6 +6585,36 @@ function registerCodeGrepCommand(pkgCommand) {
   });
 }
 
+// src/shared/read-file-error.ts
+function withReadFileRecovery(mapped, requestedPath) {
+  if (mapped.code !== "FILE_NOT_FOUND" && mapped.code !== "NOT_FOUND") {
+    return mapped;
+  }
+  return {
+    ...mapped,
+    details: {
+      ...mapped.details,
+      action: buildReadFileNotFoundAction(requestedPath)
+    }
+  };
+}
+function buildReadFileNotFoundAction(requestedPath) {
+  const prefix = buildPathPrefixSuggestion(requestedPath);
+  return "`code_read` reads files only, not directories. " + `Use \`code_files\` with \`path_prefix: ${JSON.stringify(prefix)}\` ` + "to list candidate files, then pass an emitted `path` back to `code_read`.";
+}
+function buildPathPrefixSuggestion(requestedPath) {
+  const trimmed = requestedPath.trim();
+  if (trimmed === "")
+    return "";
+  if (trimmed.endsWith("/"))
+    return trimmed;
+  const slash = trimmed.lastIndexOf("/");
+  const basename = slash === -1 ? trimmed : trimmed.slice(slash + 1);
+  if (!basename.includes("."))
+    return `${trimmed}/`;
+  return slash === -1 ? "" : trimmed.slice(0, slash + 1);
+}
+
 // src/shared/read-file-request.ts
 var WAIT_MIN3 = 0;
 var WAIT_MAX2 = 60000;
@@ -6290,6 +6623,9 @@ function buildReadFileParams(input) {
   if (!filePath) {
     throw new InvalidPackageSpecError("`file_path` is required — pass the path to the file within the package or repo.");
   }
+  if (filePath.endsWith("/")) {
+    throw new InvalidPackageSpecError(`\`file_path\` must be an exact file path, not a directory prefix. Use \`code_files\` with \`path_prefix: ${JSON.stringify(filePath)}\` to list files, then pass an emitted \`path\` to \`code_read\`.`);
+  }
   const startLine = normaliseLine(input.startLine, "start_line");
   const endLine = normaliseLine(input.endLine, "end_line");
   if (startLine !== undefined && endLine !== undefined && startLine > endLine) {
@@ -6323,118 +6659,10 @@ function normaliseWaitTimeoutMs2(raw) {
   return raw;
 }
 
-// src/shared/read-file-response.ts
-function buildReadFileSuccessPayload(result, options) {
-  const envelope = {
-    path: result.filePath ?? options.requestedFilePath
-  };
-  if (options.registry)
-    envelope.registry = options.registry;
-  if (options.name)
-    envelope.name = options.name;
-  if (options.repoUrl)
-    envelope.repoUrl = options.repoUrl;
-  if (options.gitRef)
-    envelope.gitRef = options.gitRef;
-  if (result.language != null)
-    envelope.language = result.language;
-  if (result.totalLines != null)
-    envelope.totalLines = result.totalLines;
-  if (result.startLine != null)
-    envelope.startLine = result.startLine;
-  if (result.endLine != null)
-    envelope.endLine = result.endLine;
-  if (result.isBinary) {
-    envelope.isBinary = true;
-  } else if (result.content != null) {
-    envelope.content = result.content;
-  }
-  return envelope;
-}
-function formatReadFileTerminal(envelope, options) {
-  const verbose = options.verbose ?? false;
-  if (envelope.isBinary) {
-    return formatBinary(envelope, options, verbose);
-  }
-  if (envelope.content == null) {
-    return formatNoContent(envelope, options, verbose);
-  }
-  if (!verbose) {
-    return envelope.content;
-  }
-  return formatVerboseBody(envelope, options);
-}
-function formatBinary(envelope, options, verbose) {
-  const sentinel = dim("Binary file — cannot display as text.", options.useColors);
-  if (verbose) {
-    return `${buildHeader9(envelope, options)}
-
-${sentinel}
-`;
-  }
-  return `${sentinel}
-`;
-}
-function formatNoContent(envelope, options, verbose) {
-  const sentinel = dim("(no content returned)", options.useColors);
-  if (verbose) {
-    return `${buildHeader9(envelope, options)}
-
-${sentinel}
-`;
-  }
-  return `${sentinel}
-`;
-}
-function formatVerboseBody(envelope, options) {
-  const lines = [];
-  lines.push(buildHeader9(envelope, options));
-  lines.push("");
-  const content = envelope.content ?? "";
-  const bodyLines = content.split(`
-`);
-  if (bodyLines.length > 0 && bodyLines[bodyLines.length - 1] === "") {
-    bodyLines.pop();
-  }
-  const startLine = envelope.startLine ?? 1;
-  const endLine = startLine + bodyLines.length - 1;
-  const gutterWidth = String(endLine).length;
-  for (let i = 0;i < bodyLines.length; i++) {
-    const lineNumber = startLine + i;
-    const gutter = dim(String(lineNumber).padStart(gutterWidth, " "), options.useColors);
-    lines.push(`${gutter}  ${bodyLines[i]}`);
-  }
-  if (envelope.hint) {
-    lines.push("");
-    lines.push(dim(envelope.hint, options.useColors));
-  }
-  lines.push("");
-  return lines.join(`
-`);
-}
-function buildHeader9(envelope, options) {
-  const parts = [envelope.path];
-  if (envelope.language)
-    parts.push(envelope.language);
-  const rangeLabel = buildRangeLabel(envelope);
-  if (rangeLabel)
-    parts.push(rangeLabel);
-  return colorize(parts.join(" · "), "bold", options.useColors);
-}
-function buildRangeLabel(envelope) {
-  const { startLine, endLine, totalLines } = envelope;
-  if (startLine != null && endLine != null) {
-    return totalLines != null ? `lines ${startLine}-${endLine} of ${totalLines}` : `lines ${startLine}-${endLine}`;
-  }
-  if (totalLines != null) {
-    return `${totalLines} lines`;
-  }
-  return;
-}
-
 // src/commands/code/read.ts
 async function pkgReadAction(firstArg, secondArg, options, deps) {
   requireAuth(deps);
+  let requestedFilePath = "";
   try {
     if (!deps.codeNavigationUrl || !deps.codeNavigationService) {
       throw new InvalidPackageSpecError("Code navigation is not configured for this environment.");
@@ -6446,6 +6674,7 @@ async function pkgReadAction(firstArg, secondArg, options, deps) {
     }
     const target = resolveCliCodeNavTarget(spec, options);
     const pathWithRange = parsePathWithOptionalRange(path.trim());
+    requestedFilePath = pathWithRange.filePath;
     const range = resolveLineRange(options, pathWithRange);
     const wait = parseIntCliOption(options.wait, "--wait", 0, MAX_WAIT_TIMEOUT_MS);
     const build = buildReadFileParams({
@@ -6472,7 +6701,7 @@ async function pkgReadAction(firstArg, secondArg, options, deps) {
       verbose: options.verbose ?? false
     }));
   } catch (error2) {
-    handleCodeNavCommandError(error2, options.json ?? false, formatFileErrorWithFilesHint);
+    handleCodeNavCommandError(error2, options.json ?? false, formatFileErrorWithFilesHint, 1, (mapped) => withReadFileRecovery(mapped, requestedFilePath));
   }
 }
 function resolvePositionals3(firstArg, secondArg, hasRepoUrl) {
@@ -6805,7 +7034,7 @@ function registerExampleCommand(program) {
   });
 }
 async function loadContainer() {
-  const { createContainer: createContainer2 } = await import("./shared/chunk-q2mre780.js");
+  const { createContainer: createContainer2 } = await import("./shared/chunk-k35egwwf.js");
   return createContainer2();
 }
 // src/commands/feedback.ts
@@ -6833,17 +7062,25 @@ async function feedbackAction(solutionId, options, deps) {
     process.exit(1);
   }
 }
-var FEEDBACK_DESCRIPTION = `Submit feedback on a search result.
+var FEEDBACK_DESCRIPTION = `Submit feedback on a tool result or the GitHits experience.
+
+Two modes:
+  - Solution-tied: pass the [solution_id] from a prior 'githits example'
+    result (shown at the bottom of the markdown / under 'solution_id'
+    in --json) to anchor feedback to that specific result.
+  - Generic: omit [solution_id] to send feedback about any command
+    (search, pkg, docs, code) or the overall experience. A --message
+    is strongly recommended here.
 
-Rate whether a code example was helpful. Use --accept for positive
-feedback or --reject for negative. Optionally add a message.
+Use --accept for positive feedback or --reject for negative.
 
 Examples:
   githits feedback abc123 --accept
   githits feedback abc123 --reject -m "Example was outdated"
-  githits feedback abc123 --accept --message "Solved my problem" --json`;
+  githits feedback --accept -m "code_grep regex is fast on npm:lodash"
+  githits feedback --reject -m "search missing kotlin support"`;
 function registerFeedbackCommand(program) {
-  program.command("feedback").summary("Submit feedback on a search result").description(FEEDBACK_DESCRIPTION).argument("<solution_id>", "Solution ID from search result").addOption(new Option2("--accept", "Mark as helpful").conflicts("reject")).addOption(new Option2("--reject", "Mark as unhelpful").conflicts("accept")).option("-m, --message <text>", "Feedback explanation").option("--json", "Output as JSON for piping").action(async (solutionId, options) => {
+  program.command("feedback").summary("Submit feedback on a tool result or the GitHits experience").description(FEEDBACK_DESCRIPTION).argument("[solution_id]", "Solution ID from a prior 'githits example' result (omit for generic feedback)").addOption(new Option2("--accept", "Mark as helpful").conflicts("reject")).addOption(new Option2("--reject", "Mark as unhelpful").conflicts("accept")).option("-m, --message <text>", "Feedback explanation").option("--json", "Output as JSON for piping").action(async (solutionId, options) => {
     try {
       const deps = await createContainer();
       await feedbackAction(solutionId, options, deps);
@@ -7053,6 +7290,39 @@ function mergeServerConfig(existingContent, serversKey, serverName, serverConfig
 `
   };
 }
+function removeServerConfig(existingContent, serversKey, serverName) {
+  const parsedConfig = parseConfigObject(existingContent);
+  if (parsedConfig.format === "invalid") {
+    return {
+      status: "parse_error",
+      error: parsedConfig.error
+    };
+  }
+  const config = parsedConfig.value;
+  const servers = config[serversKey];
+  if (servers === undefined) {
+    return { status: "not_configured" };
+  }
+  if (typeof servers !== "object" || servers === null || Array.isArray(servers)) {
+    return {
+      status: "parse_error",
+      error: `"${serversKey}" is not a JSON object`
+    };
+  }
+  const serversObj = servers;
+  const matchingKeys = getMatchingServerKeys(serversObj, serverName);
+  if (matchingKeys.length === 0) {
+    return { status: "not_configured" };
+  }
+  for (const key of matchingKeys) {
+    delete serversObj[key];
+  }
+  return {
+    status: "removed",
+    content: `${JSON.stringify(config, null, 2)}
+`
+  };
+}
 function formatSetupPreview(config) {
   if (config.method === "cli") {
     return config.commands.map((cmd) => `Will run: ${cmd.command} ${cmd.args.join(" ")}`).join(`
@@ -7063,6 +7333,13 @@ function formatSetupPreview(config) {
 
 ${snippet}`;
 }
+function formatUninstallPreview(config) {
+  if (config.method === "cli") {
+    return config.commands.map((cmd) => `Will run: ${cmd.command} ${cmd.args.join(" ")}`).join(`
+`);
+  }
+  return `Will remove ${config.serverName} from ${config.configPath}`;
+}
 async function isAlreadyConfigured(config, fs) {
   try {
     const content = await fs.readFile(config.configPath);
@@ -7085,16 +7362,48 @@ async function isAlreadyConfigured(config, fs) {
     return false;
   }
 }
+async function getConfigUninstallCheckStatus(config, fs) {
+  try {
+    const content = await fs.readFile(config.configPath);
+    const parsedConfig = parseConfigObject(content);
+    if (parsedConfig.format === "invalid") {
+      return {
+        status: "failed",
+        message: `Cannot parse ${config.configPath}: ${parsedConfig.error}. File left unchanged.`
+      };
+    }
+    const servers = parsedConfig.value[config.serversKey];
+    if (servers === undefined) {
+      return { status: "not_configured" };
+    }
+    if (typeof servers !== "object" || servers === null || Array.isArray(servers)) {
+      return {
+        status: "failed",
+        message: `Cannot parse ${config.configPath}: "${config.serversKey}" is not a JSON object. File left unchanged.`
+      };
+    }
+    const hasEntry = getMatchingServerKeys(servers, config.serverName).length > 0;
+    return { status: hasEntry ? "configured" : "not_configured" };
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      return { status: "not_configured" };
+    }
+    return {
+      status: "failed",
+      message: `Cannot read ${config.configPath}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
 async function getCliCheckStatus(check, execService) {
   try {
     const result = await execService.exec(check.command, check.args);
-    if (check.requireExitCodeZero && result.exitCode !== 0) {
-      return "probe_failed";
-    }
     const combined = `${result.stdout} ${result.stderr}`;
     if (check.notConfiguredPattern?.test(combined)) {
       return "not_configured";
     }
+    if (check.requireExitCodeZero && result.exitCode !== 0) {
+      return "probe_failed";
+    }
     if (check.configuredPattern) {
       return check.configuredPattern.test(combined) ? "configured" : "not_configured";
     }
@@ -7112,9 +7421,18 @@ var ALREADY_EXISTS_PATTERNS = [
   /already added/i,
   /extension\s+"githits"\s+is\s+already\s+installed/i
 ];
+var ALREADY_ABSENT_PATTERNS = [
+  /(?:plugin|extension|server|mcp server)\s+["']?githits["']?\s+(?:was\s+)?not\s+found/i,
+  /["']?githits["']?\s+(?:plugin|extension|server)?\s*(?:does\s+not\s+exist|is\s+not\s+installed|not\s+installed)/i,
+  /unknown\s+(?:plugin|extension|server)\s+["']?githits["']?/i,
+  /marketplace\s+["']?githits-plugins["']?\s+(?:was\s+)?not\s+found/i
+];
 function isAlreadyConfiguredOutput(output) {
   return ALREADY_EXISTS_PATTERNS.some((pattern) => pattern.test(output));
 }
+function isAlreadyAbsentOutput(output) {
+  return ALREADY_ABSENT_PATTERNS.some((pattern) => pattern.test(output));
+}
 async function executeCliCommand(cmd, execService) {
   try {
     const result = await execService.exec(cmd.command, cmd.args);
@@ -7146,6 +7464,37 @@ async function executeCliCommand(cmd, execService) {
     };
   }
 }
+async function executeCliUninstallCommand(cmd, execService) {
+  try {
+    const result = await execService.exec(cmd.command, cmd.args);
+    const combined = `${result.stdout} ${result.stderr}`;
+    if (result.exitCode === 0) {
+      return { status: "removed", message: "Removed successfully" };
+    }
+    if (isAlreadyAbsentOutput(combined)) {
+      return {
+        status: "not_configured",
+        message: `GitHits not configured via ${cmd.command}`
+      };
+    }
+    const detail = result.stderr.trim() || result.stdout.trim();
+    return {
+      status: "failed",
+      message: `Command exited with code ${result.exitCode}${detail ? `: ${detail}` : ""}`
+    };
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      return {
+        status: "failed",
+        message: `"${cmd.command}" not found on PATH. Install it or remove GitHits manually.`
+      };
+    }
+    return {
+      status: "failed",
+      message: `Failed to run command: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
 async function executeCliSetup(setup, execService) {
   let anyAlreadyConfigured = false;
   for (const cmd of setup.commands) {
@@ -7165,6 +7514,52 @@ async function executeCliSetup(setup, execService) {
   }
   return { status: "success", message: "Configured successfully" };
 }
+async function executeCliUninstall(uninstall, execService) {
+  if (uninstall.commands.length === 0) {
+    return {
+      status: "failed",
+      message: "No uninstall commands configured."
+    };
+  }
+  let anyRemoved = false;
+  let anyNotConfigured = false;
+  const warnings = [];
+  for (let index = 0;index < uninstall.commands.length; index += 1) {
+    const cmd = uninstall.commands[index];
+    const result = await executeCliUninstallCommand(cmd, execService);
+    if (result.status === "failed") {
+      if (anyRemoved) {
+        warnings.push(result.message);
+        continue;
+      }
+      return result;
+    }
+    if (result.status === "removed") {
+      anyRemoved = true;
+    }
+    if (result.status === "not_configured") {
+      if (anyRemoved) {
+        warnings.push(result.message);
+        continue;
+      }
+      anyNotConfigured = true;
+    }
+  }
+  if (anyRemoved) {
+    return {
+      status: "removed",
+      message: "Removed successfully",
+      warnings: warnings.length > 0 ? warnings : undefined
+    };
+  }
+  if (anyNotConfigured) {
+    return {
+      status: "not_configured",
+      message: `GitHits not configured via ${uninstall.commands[0]?.command}`
+    };
+  }
+  return { status: "removed", message: "Removed successfully" };
+}
 async function executeConfigFileSetup(setup, fs) {
   try {
     const parentDir = fs.getDirname(setup.configPath);
@@ -7208,6 +7603,51 @@ async function executeConfigFileSetup(setup, fs) {
     };
   }
 }
+async function executeConfigFileUninstall(setup, fs) {
+  try {
+    let existingContent = "";
+    try {
+      existingContent = await fs.readFile(setup.configPath);
+    } catch (err) {
+      if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+        return {
+          status: "not_configured",
+          message: `GitHits not configured in ${setup.configPath}`
+        };
+      }
+      return {
+        status: "failed",
+        message: `Cannot read ${setup.configPath}: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    const result = removeServerConfig(existingContent, setup.serversKey, setup.serverName);
+    if (result.status === "not_configured") {
+      return {
+        status: "not_configured",
+        message: `GitHits not configured in ${setup.configPath}`
+      };
+    }
+    if (result.status === "parse_error") {
+      return {
+        status: "failed",
+        message: `Cannot parse ${setup.configPath}: ${result.error}. File left unchanged.`
+      };
+    }
+    await fs.atomicWriteFile(setup.configPath, result.content);
+    return { status: "removed", message: "Removed successfully" };
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "EACCES") {
+      return {
+        status: "failed",
+        message: `Permission denied writing to ${setup.configPath}. Check file permissions.`
+      };
+    }
+    return {
+      status: "failed",
+      message: `Failed to uninstall: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
 
 // src/commands/init/agent-definitions.ts
 var GITHITS_SERVER_NAME = "GitHits";
@@ -7217,6 +7657,10 @@ var GITHITS_MCP_INVOCATION = [
   GITHITS_MCP_COMMAND,
   ...GITHITS_MCP_ARGS
 ];
+var CLAUDE_GITHITS_PLUGIN = "githits";
+var CLAUDE_GITHITS_MARKETPLACE = "githits-plugins";
+var CLAUDE_GITHITS_PLUGIN_REF = `${CLAUDE_GITHITS_PLUGIN}@${CLAUDE_GITHITS_MARKETPLACE}`;
+var CLAUDE_GITHITS_MARKETPLACE_SOURCE = "githits-com/githits-cli";
 function getAppDataPath(fs, appName) {
   const home = fs.getHomeDir();
   switch (process.platform) {
@@ -7274,18 +7718,36 @@ var claudeCode = {
     commands: [
       {
         command: "claude",
-        args: ["plugin", "marketplace", "add", "githits-com/githits-cli"]
+        args: [
+          "plugin",
+          "marketplace",
+          "add",
+          CLAUDE_GITHITS_MARKETPLACE_SOURCE
+        ]
       },
       {
         command: "claude",
-        args: ["plugin", "install", "githits@githits-plugins"]
+        args: ["plugin", "install", CLAUDE_GITHITS_PLUGIN_REF]
       }
     ],
     checkCommand: {
       command: "claude",
       args: ["plugin", "list"],
-      configuredPattern: /githits/i
+      configuredPattern: /(^|\s)githits@githits-plugins\b/i
     }
+  }),
+  getUninstallConfig: () => ({
+    method: "cli",
+    commands: [
+      {
+        command: "claude",
+        args: ["plugin", "uninstall", CLAUDE_GITHITS_PLUGIN]
+      },
+      {
+        command: "claude",
+        args: ["plugin", "marketplace", "remove", CLAUDE_GITHITS_MARKETPLACE]
+      }
+    ]
   })
 };
 var cursor = {
@@ -7371,8 +7833,17 @@ var codexCli = {
     checkCommand: {
       command: "codex",
       args: ["mcp", "list"],
-      configuredPattern: /githits/i
+      configuredPattern: /^\s*githits\b/im
     }
+  }),
+  getUninstallConfig: () => ({
+    method: "cli",
+    commands: [
+      {
+        command: "codex",
+        args: ["mcp", "remove", "githits"]
+      }
+    ]
   })
 };
 var vscode = {
@@ -7440,6 +7911,15 @@ var geminiCli = {
       notConfiguredPattern: /not installed/i,
       requireExitCodeZero: true
     }
+  }),
+  getUninstallConfig: () => ({
+    method: "cli",
+    commands: [
+      {
+        command: "gemini",
+        args: ["extensions", "uninstall", "githits"]
+      }
+    ]
   })
 };
 async function isGeminiExtensionInstalledFromFilesystem(fs) {
@@ -7591,6 +8071,90 @@ async function verifyAgentConfigured(agent, fileSystemService, execService) {
     message: `${agent.name} verification failed: agent not detected after setup.`
   };
 }
+async function verifyAgentUnconfigured(agent, fileSystemService, execService) {
+  const postCheck = await scanAgents([agent], fileSystemService, execService);
+  if (postCheck.needsSetup.some((a) => a.id === agent.id)) {
+    return { ok: true };
+  }
+  if (postCheck.notDetected.some((a) => a.id === agent.id)) {
+    return {
+      ok: false,
+      message: `${agent.name} verification failed: agent was not detected after uninstall, so removal could not be confirmed.`
+    };
+  }
+  return {
+    ok: false,
+    message: `${agent.name} verification failed: still configured after uninstall.`
+  };
+}
+async function scanCliAgentForUninstall(agent, fileSystemService, execService) {
+  const config = agent.getSetupConfig(fileSystemService);
+  if (config.method !== "cli" || !config.checkCommand) {
+    return {
+      status: "failed",
+      message: `${agent.name} does not have a verified uninstall check command.`
+    };
+  }
+  const checkStatus = await getCliCheckStatus(config.checkCommand, execService);
+  if (checkStatus === "configured") {
+    return "configured";
+  }
+  if (checkStatus === "not_configured") {
+    return "not_configured";
+  }
+  if (agent.id === "gemini-cli" && await isGeminiExtensionInstalledFromFilesystem(fileSystemService)) {
+    return "configured";
+  }
+  return {
+    status: "failed",
+    message: `Cannot inspect ${agent.name}: ${config.checkCommand.command} ${config.checkCommand.args.join(" ")} failed.`
+  };
+}
+async function scanAgentsForUninstall(fileSystemService, execService) {
+  const setupScan = await scanAgents(agentDefinitions, fileSystemService, execService);
+  const result = {
+    configured: [],
+    notConfigured: [],
+    notDetected: setupScan.notDetected,
+    failed: []
+  };
+  for (const agent of [
+    ...setupScan.alreadyConfigured,
+    ...setupScan.needsSetup
+  ]) {
+    const config = agent.getSetupConfig(fileSystemService);
+    if (config.method === "config-file") {
+      const check = await getConfigUninstallCheckStatus(config, fileSystemService);
+      if (check.status === "configured") {
+        result.configured.push(agent);
+      } else if (check.status === "failed") {
+        result.failed.push({
+          id: agent.id,
+          name: agent.name,
+          status: "failed",
+          message: check.message
+        });
+      } else {
+        result.notConfigured.push(agent);
+      }
+    } else {
+      const check = await scanCliAgentForUninstall(agent, fileSystemService, execService);
+      if (check === "configured") {
+        result.configured.push(agent);
+      } else if (check === "not_configured") {
+        result.notConfigured.push(agent);
+      } else {
+        result.failed.push({
+          id: agent.id,
+          name: agent.name,
+          status: "failed",
+          message: check.message
+        });
+      }
+    }
+  }
+  return result;
+}
 async function initAction(options, deps) {
   const useColors = shouldUseColors();
   const { fileSystemService, promptService, execService, createLoginDeps } = deps;
@@ -7756,6 +8320,147 @@ async function initAction(options, deps) {
   }
   console.log();
 }
+async function initUninstallAction(options, deps) {
+  const useColors = shouldUseColors();
+  const { fileSystemService, promptService, execService } = deps;
+  console.log(`
+  ${colorize("GitHits", "bold", useColors)} — Remove MCP server from your coding agents
+`);
+  console.log(`  Scanning for configured agents...
+`);
+  const scan = await scanAgentsForUninstall(fileSystemService, execService);
+  for (const agent of scan.configured) {
+    console.log(`    ${colorize(`● ${agent.name} — configured`, "cyan", useColors)}`);
+  }
+  for (const agent of scan.notConfigured) {
+    console.log(`    ${warning(`${agent.name} — not configured`, useColors)}`);
+  }
+  for (const outcome of scan.failed) {
+    console.log(`    ${error(`${outcome.name} — cannot inspect config`, useColors)}`);
+  }
+  for (const agent of scan.notDetected) {
+    console.log(`    ${colorize(`${agent.name} — not detected`, "dim", useColors)}`);
+  }
+  console.log();
+  if (scan.configured.length === 0 && scan.failed.length === 0) {
+    console.log(`  No GitHits MCP configurations found. Nothing to uninstall.
+`);
+    return;
+  }
+  const outcomes = [...scan.failed];
+  let alwaysMode = options.yes ?? false;
+  for (const agent of scan.configured) {
+    console.log(`  Uninstalling from ${colorize(agent.name, "bold", useColors)}...
+`);
+    const setupConfig = agent.getSetupConfig(fileSystemService);
+    const uninstallConfig = setupConfig.method === "config-file" ? setupConfig : agent.getUninstallConfig?.(fileSystemService);
+    if (!uninstallConfig) {
+      outcomes.push({
+        id: agent.id,
+        name: agent.name,
+        status: "failed",
+        message: `${agent.name} does not have a verified uninstall command.`
+      });
+      console.log(`    ${error(`${agent.name} does not have a verified uninstall command.`, useColors)}
+`);
+      continue;
+    }
+    const preview = formatUninstallPreview(uninstallConfig);
+    for (const line of preview.split(`
+`)) {
+      console.log(`    ${line}`);
+    }
+    console.log();
+    if (!alwaysMode) {
+      let choice;
+      try {
+        choice = await promptService.confirm3("Proceed?");
+      } catch (err) {
+        if (err instanceof ExitPromptError) {
+          console.log(`
+  Uninstall cancelled.
+`);
+          return;
+        }
+        throw err;
+      }
+      if (choice === "no") {
+        outcomes.push({ id: agent.id, name: agent.name, status: "skipped" });
+        console.log();
+        continue;
+      }
+      if (choice === "always") {
+        alwaysMode = true;
+      }
+    }
+    let result = uninstallConfig.method === "cli" ? await executeCliUninstall(uninstallConfig, execService) : await executeConfigFileUninstall(uninstallConfig, fileSystemService);
+    if (result.status === "removed") {
+      const verification = await verifyAgentUnconfigured(agent, fileSystemService, execService);
+      if (!verification.ok) {
+        result = {
+          status: "failed",
+          message: verification.message ?? `${agent.name} verification failed after uninstall.`,
+          warnings: result.warnings
+        };
+      }
+    }
+    outcomes.push({
+      id: agent.id,
+      name: agent.name,
+      status: result.status,
+      message: result.status === "failed" ? result.message : undefined,
+      warnings: result.warnings
+    });
+    if (result.status === "removed") {
+      console.log(`    ${success(`${agent.name} removed`, useColors)}
+`);
+      for (const warn of result.warnings ?? []) {
+        console.log(`    ${warning(`Warning: ${warn}`, useColors)}`);
+      }
+    } else if (result.status === "not_configured") {
+      console.log(`    ${warning(`${agent.name} was not configured`, useColors)}
+`);
+    } else {
+      console.log(`    ${error(result.message, useColors)}
+`);
+      for (const warn of result.warnings ?? []) {
+        console.log(`    ${warning(`Warning: ${warn}`, useColors)}`);
+      }
+    }
+  }
+  const removed = outcomes.filter((o) => o.status === "removed").length;
+  const notConfigured = outcomes.filter((o) => o.status === "not_configured").length + scan.notConfigured.length;
+  const failed = outcomes.filter((o) => o.status === "failed").length;
+  const skipped = outcomes.filter((o) => o.status === "skipped").length;
+  if (failed > 0) {
+    console.log("  Uninstall completed with errors.");
+  } else if (removed > 0) {
+    console.log("  Done! GitHits MCP configuration was removed.");
+  } else if (skipped > 0) {
+    console.log("  Uninstall skipped.");
+  } else if (notConfigured > 0) {
+    console.log("  No GitHits MCP configurations were active. Nothing to remove.");
+  }
+  if (removed > 0) {
+    console.log(`  ${removed} agent${removed !== 1 ? "s" : ""} removed.`);
+  }
+  if (notConfigured > 0) {
+    console.log(`  ${notConfigured} agent${notConfigured !== 1 ? "s" : ""} not configured.`);
+  }
+  if (skipped > 0) {
+    console.log(`  ${skipped} agent${skipped !== 1 ? "s" : ""} skipped.`);
+  }
+  if (failed > 0) {
+    console.log(`  ${failed} agent${failed !== 1 ? "s" : ""} failed to uninstall.`);
+    for (const outcome of outcomes.filter((o) => o.status === "failed")) {
+      console.log(`    - ${outcome.name}: ${outcome.message ?? "Unknown error"}`);
+      for (const warn of outcome.warnings ?? []) {
+        console.log(`      Warning: ${warn}`);
+      }
+    }
+  }
+  console.log();
+}
 function printAuthRecoveryHint() {
   console.log("    You can still configure MCP, but GitHits tools will require auth.");
   console.log("    Recovery steps:");
@@ -7775,8 +8480,13 @@ and sets up unconfigured ones with your confirmation.
 Supports CLI-based setup (Claude Code, Codex, Gemini CLI) and config
 file editing (Cursor, Windsurf, VS Code, Cline, Claude Desktop,
 Google Antigravity) with atomic writes.`;
+var INIT_UNINSTALL_DESCRIPTION = `Remove GitHits MCP server configuration from your coding agents.
+
+Scans for available agents that currently have GitHits configured, then removes
+only the GitHits MCP/plugin configuration with your confirmation. Authentication
+tokens are not removed; use \`githits logout\` to remove stored credentials.`;
 function registerInitCommand(program) {
-  program.command("init").summary("Set up MCP server for your coding agents").description(INIT_DESCRIPTION).option("-y, --yes", "Skip prompts, configure all detected agents").option("--skip-login", "Skip authentication step").action(async (options) => {
+  const initCommand = program.command("init").summary("Set up MCP server for your coding agents").description(INIT_DESCRIPTION).option("-y, --yes", "Skip prompts, configure all detected agents").option("--skip-login", "Skip authentication step").action(async (options) => {
     const fileSystemService = new FileSystemServiceImpl;
     const promptService = new PromptServiceImpl;
     const execService = new ExecServiceImpl;
@@ -7787,6 +8497,16 @@ function registerInitCommand(program) {
       createLoginDeps: () => createAuthCommandDependencies()
     });
   });
+  initCommand.command("uninstall").summary("Remove MCP server from your coding agents").description(INIT_UNINSTALL_DESCRIPTION).option("-y, --yes", "Skip prompts, uninstall from all configured agents").action(async (options) => {
+    const fileSystemService = new FileSystemServiceImpl;
+    const promptService = new PromptServiceImpl;
+    const execService = new ExecServiceImpl;
+    await initUninstallAction(options, {
+      fileSystemService,
+      promptService,
+      execService
+    });
+  });
 }
 // src/commands/languages.ts
 async function languagesAction(query, options, deps) {
@@ -7908,13 +8628,17 @@ function classify3(operation, error2) {
 
 // src/tools/feedback.ts
 var schema = {
-  solution_id: z.string().min(1).describe("The solution ID from a previous search result (shown in the result)"),
-  accepted: z.boolean().describe("True if the example was helpful/good, False if unhelpful/bad"),
-  feedback_text: z.string().optional().describe('Optional text explaining why (e.g., "This solved problem X" or "Example was outdated")')
+  solution_id: z.string().min(1).optional().describe("Optional. Pass the `solution_id` from a prior `get_example` response (shown on the trailing line of the markdown result, or under the `solution_id` key in JSON mode) to anchor feedback to that specific result. Omit for generic feedback about any tool (code/package navigation, search, docs) or the overall experience."),
+  accepted: z.boolean().describe("True for positive feedback (helpful/good), False for negative (unhelpful/bad). Always required."),
+  feedback_text: z.string().optional().describe('Optional context (e.g., "This solved problem X" or "code_grep regex over npm:lodash missed Foo function"). Strongly recommended when `solution_id` is omitted, since there is no specific result to anchor to.')
 };
-var DESCRIPTION = `Submit feedback on a GitHits example result.
+var DESCRIPTION = `Submit feedback on a tool result or the GitHits experience.
 
-Call after \`get_example\` to record whether the returned example was used. \`accepted=true\` when it solved the problem or was useful; \`accepted=false\` when it was irrelevant or wrong. Use \`feedback_text\` to add a short reason. Feeds back into ranking quality.`;
+Two modes:
+1. **Solution-tied** — pass the \`solution_id\` from a prior \`get_example\` response to rate that specific result.
+2. **Generic** — omit \`solution_id\` to send feedback about any tool (\`search\`, \`code_grep\`, \`code_read\`, \`code_files\`, \`docs_*\`, \`pkg_*\`) or the overall experience.
+
+\`accepted\` is always required (true = positive, false = negative). Add \`feedback_text\` for context — strongly recommended in generic mode. Feeds ranking and product quality.`;
 function createFeedbackTool(service) {
   return {
     name: "feedback",
@@ -7938,7 +8662,7 @@ var schema2 = {
   query: z2.string().min(1).describe("Natural-language example-search query for canonical code examples."),
   language: z2.string().min(1).optional().describe("Optional programming language. If omitted, GitHits tries to infer it automatically. Use search_language first only when you need to force a specific language and the exact name is uncertain."),
   license_mode: z2.enum(["strict", "yolo", "custom"]).optional().describe("License filtering mode: strict (default), yolo, or custom."),
-  format: z2.enum(["json", "text", "text-v1"]).optional().describe("Response format. Default `text-v1` returns markdown directly with a trailing `solution_id` line when available. Pass `json` for `{result, solution_id?}`.")
+  format: z2.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` returns markdown directly with a trailing `solution_id` line when available. Pass `format: "json"` for `{result, solution_id?}`.')
 };
 var DESCRIPTION2 = `Get verified, canonical code examples from global open source.
 
@@ -8044,7 +8768,7 @@ function invalidTargetResult(message) {
 // src/tools/grep-repo.ts
 var schema3 = {
   target: codeTargetSchema,
-  pattern: z4.string().describe(GREP_REPO_PATTERN_NOTE),
+  pattern: z4.string().optional().describe(GREP_REPO_PATTERN_NOTE),
   path: z4.string().optional().describe("Exact file path to grep. Shares the same path vocabulary as `code_read`."),
   path_prefix: z4.string().optional().describe("Literal directory prefix to scope grep, matching `code_files` / `search` naming."),
   globs: z4.array(z4.string()).optional().describe("Repeatable glob scopes with real glob semantics (e.g. `src/**/*.ts`)."),
@@ -8063,7 +8787,7 @@ var schema3 = {
   wait_timeout_ms: z4.number().optional(),
   format: z4.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact line-oriented output (matches grouped by file with grep -A/-B notation for context). Pass `format: "json"` for the structured envelope. `text` is an alias for `text-v1`. Errors stay JSON-formatted in either mode for now.')
 };
-var DESCRIPTION3 = "Deterministic text grep over indexed dependency and repository source files. " + "Use this when you know the text pattern you want; use `search` for discovery. " + "Whole-target grep is the default — narrow with `path`, `path_prefix`, `globs`, or `extensions` to keep responses small. " + 'Default response is a compact line-oriented listing (`format: "text-v1"`); pass `format: "json"` for the structured envelope. ' + "Matches chain directly into `code_read` (the `path` and `line` from each match feed straight into `start_line` / `end_line`).";
+var DESCRIPTION3 = "Deterministic text or regex grep over indexed dependency and repository source files. " + 'Use this when you know the pattern (literal by default; pass `pattern_type: "regex"` for RE2). ' + "Use `search` for discovery instead. " + "Whole-target grep is the default — narrow with `path`, `path_prefix`, `globs`, or `extensions` to keep responses small. " + "Each match's `filePath` (or text file heading) chains into `code_read.path`; pick a window around `match.line` for `code_read.start_line` / `end_line`.";
 function createGrepRepoTool(service) {
   return {
     name: "code_grep",
@@ -8156,9 +8880,9 @@ var schema4 = {
   include_hidden: z5.boolean().optional(),
   limit: z5.number().optional().describe("Max entries to return (1–1000, default 200). Out-of-range values return an `INVALID_ARGUMENT` envelope."),
   wait_timeout_ms: z5.number().optional().describe("Max milliseconds to wait for indexing (0–60000, default 20000). On an `INDEXING` error envelope, retry with a longer timeout or pass a version from `details.availableVersions`."),
-  format: z5.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact paths-only listing tuned for agent context efficiency. Pass `format: "json"` for the structured envelope. `text` is an alias for `text-v1`. Errors stay JSON-formatted in either mode for now.')
+  format: z5.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact paths-only listing. Pass `format: "json"` for the structured envelope. `text` is an alias for `text-v1`. Errors stay JSON-formatted in either mode for now.')
 };
-var DESCRIPTION4 = "List files in an indexed dependency. Default response is a compact " + 'paths-only listing (`format: "text-v1"`); pass `format: "json"` ' + "for the structured envelope `{total, hasMore, files: [{path, name, " + "language, fileType, byteSize}], resolution, indexedVersion}`. " + "Address via `target.registry` + `target.package_name` (package " + "scope) or `target.repo_url` + `target.git_ref` (repo scope), " + "mutually exclusive. Narrow with `path`, `path_prefix`, `globs`, " + "`extensions`, `file_types`, `languages`, or file-intent filters. " + "The returned paths feed directly into `code_read` and help scope " + "`code_grep`. Returns an `INDEXING` error envelope when the " + "dependency is being indexed on-demand — retry with a longer " + "`wait_timeout_ms` or use a version from `details.availableVersions`.";
+var DESCRIPTION4 = "List files in an indexed dependency. First choice for file/path " + "enumeration tasks such as files under a directory; use " + "`path_prefix` for directory prefixes (e.g. `lib/`) and optional " + "`extensions` for language filtering. Use this to discover paths " + "before `code_read` (when `code_read` returns `FILE_NOT_FOUND` or " + "you don't yet know the path) and to scope `code_grep`. Address " + "via `target.registry` + `target.package_name` (package scope) or " + "`target.repo_url` + `target.git_ref` (repo scope), mutually " + "exclusive. Narrow with `path`, `path_prefix`, `globs`, " + "`extensions`, `file_types`, `languages`, or file-intent filters. " + "JSON envelope shape: `{total, hasMore, files: [{path, name, " + "language, fileType, byteSize}], resolution, indexedVersion}`. " + "Returns an `INDEXING` error envelope when the dependency is being " + "indexed on-demand — retry with a longer `wait_timeout_ms` or use " + "a version from `details.availableVersions`.";
 function createListFilesTool(service) {
   return {
     name: "code_files",
@@ -8237,7 +8961,7 @@ var schema5 = {
   after: z6.string().optional().describe("Pagination cursor from a prior response."),
   format: z6.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact page list with ready-to-call `docs_read` follow-ups. Pass `format: "json"` for the structured envelope.')
 };
-var DESCRIPTION5 = "List mixed package documentation pages from hosted docs and repository-backed docs. " + "Every entry includes a stable `pageId`, `sourceKind` (`crawled` or `repo`), and source URL; repo-backed entries also expose `repoUrl` / `gitRef` / `filePath` for exact file reads. " + "Pass a returned `pageId` to `docs_read`. Use this to browse before reading a full page.";
+var DESCRIPTION5 = "List mixed package documentation pages from hosted docs and repository-backed docs. " + 'This browses available pages; for topic search, use `search` with `sources: ["docs"]` and pass the returned `pageId` to `docs_read`. ' + "Every entry includes a stable `pageId`, `sourceKind` (`crawled` or `repo`), and source URL; repo-backed entries also expose `repoUrl` / `gitRef` / `filePath` for exact file reads. " + "Pass a returned `pageId` to `docs_read`. Use this to browse before reading a full page.";
 function createListPackageDocsTool(service) {
   return {
     name: "docs_list",
@@ -8451,11 +9175,11 @@ function formatPackageChangelogTerminal(envelope, options) {
   const dateWidth = 10;
   for (const entry of envelope.entries.items) {
     const version2 = entry.version ?? "(unversioned)";
-    const date = entry.publishedAt ? formatDate(entry.publishedAt) : dim("—", options.useColors);
+    const date = entry.publishedAt ? formatDate(entry.publishedAt) : dim("-", options.useColors);
     const url = entry.htmlUrl ? dim(entry.htmlUrl, options.useColors) : dim("(no link)", options.useColors);
     const padded = padColumn(version2, versionWidth);
     const datePadded = padColumn(date, dateWidth);
-    lines.push(`${colorize(padded, "bold", options.useColors)}  ${datePadded}  ${url}`);
+    lines.push(`${highlight(`${padded}  ${datePadded}`, options.useColors)}  ${url}`);
     if (entry.body != null) {
       appendBodyLines(lines, entry.body, options);
     }
@@ -8472,28 +9196,28 @@ function appendBodyLines(lines, body, options) {
   }
   const bodyLines = body.split(`
 `);
-  const cap = options.verbose ? bodyLines.length : DEFAULT_BODY_PREVIEW_LINES;
+  const cap = options.verbose ? bodyLines.length : options.bodyPreviewLines ?? DEFAULT_BODY_PREVIEW_LINES;
   const visible = bodyLines.slice(0, cap);
   for (const bodyLine of visible) {
-    lines.push(`  ${dim(bodyLine, options.useColors)}`);
+    lines.push(`  ${bodyLine}`);
   }
   const hidden = bodyLines.length - visible.length;
   if (hidden > 0) {
-    lines.push(`  ${dim(`… (+${hidden} more line${hidden === 1 ? "" : "s"} — ${options.fullBodyHint ?? "use --verbose for the full body"})`, options.useColors)}`);
+    lines.push(`  ${dim(`... (+${hidden} more line${hidden === 1 ? "" : "s"} - ${options.fullBodyHint ?? "use --verbose for the full body"})`, options.useColors)}`);
   }
 }
 function buildSummaryLine(envelope, options) {
-  const identity = envelope.registry && envelope.name ? `${envelope.name} · ${envelope.registry}` : envelope.repoUrl ?? "(unknown)";
+  const identity = envelope.registry && envelope.name ? `${envelope.name} | ${envelope.registry}` : envelope.repoUrl ?? "(unknown)";
   const sourceLabel = envelope.source ? humanizeSource(envelope.source) : "package versions";
   const modeLabel = envelope.mode === "range" ? rangeLabel(envelope) : latestLabel(envelope);
   const countLabel = `${envelope.entries.count} ${plural2("entry", "entries", envelope.entries.count)}`;
   const parts = [identity, `source: ${sourceLabel}`, modeLabel, countLabel];
-  return colorize(parts.join(" · "), "bold", options.useColors);
+  return colorize(parts.join(" | "), "bold", options.useColors);
 }
 function rangeLabel(envelope) {
   const from = envelope.filter?.fromVersion ?? "earliest";
   const to = envelope.filter?.toVersion ?? "latest";
-  return `range ${from} → ${to}`;
+  return `range ${from} -> ${to}`;
 }
 function latestLabel(envelope) {
   if (envelope.filter?.toVersion) {
@@ -8552,9 +9276,11 @@ var schema6 = {
   limit: z7.number().optional().describe("Latest-mode cap on entry count (1–50, default 10). Rejected with `INVALID_ARGUMENT` when `from_version` is also set or when out of range."),
   git_ref: z7.string().optional().describe("Git branch or tag for CHANGELOG.md source (no effect on GitHub Releases or HexDocs). Defaults to the repository's default branch."),
   include_bodies: z7.boolean().optional().describe("When false, each entry in `entries.items[]` omits its `body` field. Default true. Set false when you only need the version / date / URL timeline — drops 10 KB+ per entry on large release notes."),
-  format: z7.enum(["json", "text", "text-v1"]).optional().describe("Response format. Default `text-v1` is compact for agents. Pass `json` for the structured envelope.")
+  verbose: z7.boolean().optional().describe("Text output only. Show full body previews. Mutually exclusive with include_bodies:false and body_lines."),
+  body_lines: z7.number().optional().describe("Text output only. Number of body lines to preview per entry (1-50, default 10). Ignored for format=json and include_bodies:false. Mutually exclusive with verbose:true."),
+  format: z7.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact entry timeline with body previews. Pass `format: "json"` for the structured envelope with full markdown bodies.')
 };
-var DESCRIPTION6 = "Release notes for a package or GitHub repo, newest-first. Default " + "latest mode returns the ten most recent entries (`limit` 1–50). " + "With `from_version`, returns every entry in the " + "`[from_version, to_version]` range (range mode, no count cap). " + "Address via `registry` + `package_name` or `repo_url` (mutually " + 'exclusive). Response includes optional `source` (`"releases"` / ' + '`"changelog_file"` / `"hexdocs"`) when a concrete changelog source ' + 'exists, `mode` (`"latest"` or `"range"`), ' + 'and entries with markdown body previews. Pass `format: "json"` ' + "for the structured envelope with full markdown bodies. Set " + "`include_bodies: false` for a version / date / URL timeline only. " + "Package-version entries without changelog text succeed with `source` " + "omitted; no-source plus no entries returns `NOT_FOUND`. Supports npm, " + "PyPI, Hex, Crates, vcpkg, Zig, NuGet, Maven, Packagist, RubyGems, Go.";
+var DESCRIPTION6 = "Release notes for a package or GitHub repo, newest-first. Default " + "latest mode returns the ten most recent entries (`limit` 1–50). " + "With `from_version`, returns every entry in the " + "`[from_version, to_version]` range (range mode, no count cap). " + "Address via `registry` + `package_name` or `repo_url` (mutually " + 'exclusive). Response includes optional `source` (`"releases"` / ' + '`"changelog_file"` / `"hexdocs"`) when a concrete changelog source ' + 'exists, `mode` (`"latest"` or `"range"`), and entries with ' + "markdown body previews. Example: " + '`{"registry":"npm","package_name":"express","limit":2}`. ' + "Text output previews 10 body lines by default; use `body_lines` " + "to tune the preview or `verbose:true` for full text bodies. Set " + "`include_bodies: false` for a version / date / URL timeline only; " + 'pass `format: "json"` for the complete structured envelope. ' + "Package-version entries without changelog " + "text succeed with `source` omitted; no-source plus no entries " + "returns `NOT_FOUND`. Supports npm, PyPI, Hex, Crates, NuGet, " + "Maven, Zig, vcpkg, Packagist, RubyGems, and Go.";
 function createPackageChangelogTool(service) {
   return {
     name: "pkg_changelog",
@@ -8563,6 +9289,8 @@ function createPackageChangelogTool(service) {
     annotations: { readOnlyHint: true },
     handler: async (args) => {
       try {
+        const textFormat = isTextFormat5(args.format);
+        const bodyPreviewLines = textFormat ? validateTextOptions(args) : undefined;
         const { params, explicitFilterFields } = buildPackageChangelogParams({
           registry: args.registry,
           packageName: args.package_name,
@@ -8585,11 +9313,12 @@ function createPackageChangelogTool(service) {
           limit: params.limit,
           gitRef: params.gitRef
         });
-        if (isTextFormat5(args.format)) {
+        if (textFormat) {
           return textResult(formatPackageChangelogTerminal(payload, {
             useColors: false,
-            verbose: false,
-            fullBodyHint: 'pass format="json" for full bodies'
+            verbose: args.verbose ?? false,
+            bodyPreviewLines,
+            fullBodyHint: 'pass verbose=true, body_lines=<n>, or format="json" for full bodies'
           }).trimEnd());
         }
         return textResult(JSON.stringify(payload));
@@ -8613,22 +9342,36 @@ function createPackageChangelogTool(service) {
     }
   };
 }
+function validateTextOptions(args) {
+  if (args.include_bodies === false && args.verbose === true) {
+    throw new InvalidPackageSpecError("verbose:true conflicts with include_bodies:false because bodies are omitted. Drop one of the two options.");
+  }
+  if (args.verbose === true && args.body_lines !== undefined) {
+    throw new InvalidPackageSpecError("body_lines conflicts with verbose:true because verbose already shows full bodies. Drop one of the two options.");
+  }
+  if (args.body_lines === undefined)
+    return;
+  if (!Number.isInteger(args.body_lines) || args.body_lines < 1 || args.body_lines > 50) {
+    throw new InvalidPackageSpecError(`body_lines must be an integer between 1 and 50. Got ${args.body_lines}.`);
+  }
+  return args.body_lines;
+}
 function isTextFormat5(format) {
   return format === undefined || format === "text" || format === "text-v1";
 }
 // src/tools/package-dependencies.ts
 import { z as z8 } from "zod";
 var schema7 = {
-  registry: z8.string().describe(`Package registry. Dependency data is available on ${SUPPORTED_DEPS_REGISTRIES_HUMAN}.`),
+  registry: z8.string().describe(`Package registry. Dependency data is available on ${SUPPORTED_DEPS_REGISTRIES_LIST}.`),
   package_name: z8.string().describe("Package name (scoped names ok: @types/node)."),
   version: z8.string().optional().describe("Specific version to inspect. Defaults to latest when omitted. Tag-style inputs with a leading `v` (for example `v4.18.0`) are rejected — pass the canonical version (`4.18.0`)."),
   lifecycle: z8.union([z8.string(), z8.array(z8.string())]).optional().describe("Lifecycle breadth. Omit for runtime-only. Use `runtime` for explicit runtime-only, a concrete non-runtime lifecycle (`development`, `build`, `peer`, `optional`) for runtime plus matching groups, or `all` for runtime plus all available groups. Accepts a single value, a comma-separated string, or an array; `all` cannot be combined with other values. Uppercase is tolerated."),
   include_transitive: z8.boolean().optional().describe("When true the response gains a `transitive` block with aggregate counts (`edges`, `uniquePackages`), the preprocessed `packages[]` list (each `{name, version}` — the complete install footprint), plus typed `conflicts[]` (`{name, requiredVersions}`) and `circularDependencies[]` (`{cycle: string[]}`) when the backend reported any. Off by default."),
   include_importers: z8.boolean().optional().describe("Requires `include_transitive: true`. When true, each entry in `transitive.packages[]` also carries an `importers` array — every upstream package that pulls it in, with that importer's own resolved version and the constraint it declared. Off by default because adding provenance roughly quadruples the envelope size on heavy graphs. Turn on when you need to trace why a specific transitive dep is present."),
   max_depth: z8.number().int().min(1).max(10).optional().describe("Cap the transitive traversal at this depth (1–10). Omit to get the backend's full graph. Requires `include_transitive: true` — passing `max_depth` without the transitive flag is rejected with `INVALID_ARGUMENT`."),
-  format: z8.enum(["json", "text", "text-v1"]).optional().describe("Response format. Default `text-v1` is compact for agents. Pass `json` for the structured envelope.")
+  format: z8.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact dependency listing. Pass `format: "json"` for the structured envelope.')
 };
-var DESCRIPTION7 = "Analyze a package's dependency graph. Default output is compact " + "text listing direct runtime dependencies with resolved versions; " + 'pass `format: "json"` for the structured envelope. Non-runtime ' + "groups are omitted by default for token efficiency. Use `lifecycle` " + "with a concrete value for runtime plus matching groups, or `all` " + "for runtime plus all available groups. Set " + "`include_transitive: true` to add a `transitive` block with the " + "full install footprint, conflict detection, and circular-" + "dependency flags; layer `include_importers: true` on top when you " + "also need per-package provenance. Supports npm, PyPI, Hex, Crates, " + "RubyGems, Go, vcpkg, and Zig.";
+var DESCRIPTION7 = "Analyze a package's dependency graph. Lists direct runtime " + "dependencies with resolved versions; non-runtime groups are " + "omitted by default. Use `lifecycle` with a concrete value for " + "matching dependency groups, or `all` for every available group. " + "Runtime group rows include resolved versions when available. " + "Set `include_transitive: true` to add a " + "`transitive` block with the full install footprint, conflict " + "detection, and circular-dependency flags; layer " + "`include_importers: true` on top when you also need per-package " + "provenance. Supports npm, PyPI, Hex, Crates, Zig, vcpkg, RubyGems, " + "and Go.";
 function createPackageDependenciesTool(service) {
   return {
     name: "pkg_deps",
@@ -8701,9 +9444,10 @@ import { z as z9 } from "zod";
 var schema8 = {
   registry: z9.string().describe(`Package registry. One of: ${PKGSEER_REGISTRY_LIST}.`),
   package_name: z9.string().describe("Package name (scoped names ok: @types/node)."),
-  format: z9.enum(["json", "text", "text-v1"]).optional().describe("Response format. Default `text-v1` is compact for agents. Pass `json` for the structured envelope.")
+  verbose: z9.boolean().optional().describe("Text only. Adds GitHub language/topics/last-pushed, recent advisories, and recent changes. Ignored for format=json."),
+  format: z9.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact package overview. Pass `format: "json"` for the structured envelope.')
 };
-var DESCRIPTION8 = "Get a package overview — latest version, license, description, " + "repository, downloads, GitHub stars, install command, recent " + "changes, and a count of known vulnerabilities. Use before " + "recommending a package or to orient on what a dependency is. " + 'Default output is compact text; pass `format: "json"` for the ' + "structured envelope. " + "Works across npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, " + "RubyGems, Go, vcpkg, and Zig. Always returns data for the latest published " + "version.";
+var DESCRIPTION8 = "Latest-version package overview for dependency triage. Provide " + "`registry` and `package_name` (for example `npm` + `express`). " + "Default text returns license, description, repository popularity " + "(stars/forks/issues and [ARCHIVED] when applicable), downloads, " + "publish age, and vulnerability status. Set `verbose: true` for " + "GitHub language/topics/last-pushed, recent advisories, and recent " + 'changes. Pass `format: "json"` for structured fields. Use ' + "`pkg_vulns` for version-specific vulnerability details.";
 function createPackageSummaryTool(service) {
   return {
     name: "pkg_info",
@@ -8720,6 +9464,7 @@ function createPackageSummaryTool(service) {
         const payload = buildPackageSummarySuccessPayload(summary);
         if (isTextFormat7(args.format)) {
           return textResult(formatPackageSummaryTerminal(summary, {
+            verbose: args.verbose,
             useColors: false
           }).trimEnd());
         }
@@ -8750,14 +9495,16 @@ function isTextFormat7(format) {
 // src/tools/package-vulnerabilities.ts
 import { z as z10 } from "zod";
 var schema9 = {
-  registry: z10.string().describe("Package registry. Vulnerability data available on npm, pypi, hex, and crates only."),
+  registry: z10.string().describe("Package registry. Vulnerability data is unavailable for vcpkg and zig."),
   package_name: z10.string().describe("Package name (scoped names ok: @types/node)."),
   version: z10.string().optional().describe("Specific version to check. Defaults to latest when omitted."),
   min_severity: z10.string().optional().describe("Only return advisories at or above this severity (`low`, `medium`, `high`, `critical`; uppercase tolerated). Omit to see all, including null-severity advisories."),
   include_withdrawn: z10.boolean().optional().describe("Include retracted advisories (default: false)."),
-  format: z10.enum(["json", "text", "text-v1"]).optional().describe("Response format. Default `text-v1` is compact for agents. Pass `json` for the structured envelope.")
+  advisory_scope: z10.string().optional().describe("Advisory rows to return: `affected` (default), `non_affecting` for historical advisories that do not affect the inspected version, or `all` for both affected and historical advisories. Counts always include affected/non-affecting/all totals."),
+  verbose: z10.boolean().optional().describe("Text output only. Show every advisory and full detail rows; format=json always returns the complete structured envelope."),
+  format: z10.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact advisory summary. Pass `format: "json"` for the structured envelope.')
 };
-var DESCRIPTION9 = "Check known vulnerabilities for a package on npm, PyPI, Hex, or " + "Crates (other registries are not yet supported for vulnerability " + "data). Returns a count summary, each advisory with OSV ID, " + "severity, affected ranges, and fix versions. Malicious-package advisories surface in a separate " + "bucket. Pass `version` to inspect a specific release; otherwise " + "the latest is checked. Use `min_severity` to filter to a threshold " + "(`low`, `medium`, `high`, `critical`) and `include_withdrawn` to " + "also see retracted advisories. Default output is compact text; " + 'pass `format: "json"` for the structured envelope.';
+var DESCRIPTION9 = "Check known vulnerabilities for a package on npm, PyPI, Hex, " + "Crates, NuGet, Maven, Packagist, RubyGems, or Go (vcpkg and Zig " + "are not supported for vulnerability data). Returns a count summary, each advisory with OSV ID, " + "severity, affected ranges, and fix versions. Malicious-package " + "advisories surface in a separate bucket. Example: " + '`{"registry":"npm","package_name":"lodash","version":"4.17.20","min_severity":"high"}`. ' + "Pass `version` to inspect " + "a pinned release; omit it for latest. Default text is capped for " + "readability; use `verbose:true` for all selected advisory rows or " + '`format:"json"` for the complete envelope. Use ' + "`min_severity` to filter to a threshold (`low`, `medium`, `high`, " + "`critical`) and `include_withdrawn` to also see retracted " + 'advisories. Use `advisory_scope:"non_affecting"` to list ' + "historical advisories that do not affect the inspected version, or " + '`advisory_scope:"all"` to list affected and historical advisories together.';
 function createPackageVulnerabilitiesTool(service) {
   return {
     name: "pkg_vulns",
@@ -8766,21 +9513,26 @@ function createPackageVulnerabilitiesTool(service) {
     annotations: { readOnlyHint: true },
     handler: async (args) => {
       try {
-        const { params } = buildPackageVulnerabilitiesParams({
+        const { params, filter } = buildPackageVulnerabilitiesParams({
           registry: args.registry,
           packageName: args.package_name,
           version: args.version,
           minSeverity: args.min_severity,
-          includeWithdrawn: args.include_withdrawn
+          includeWithdrawn: args.include_withdrawn,
+          advisoryScope: args.advisory_scope
         });
         const report = await service.packageVulnerabilities(params);
         const payload = buildPackageVulnerabilitiesSuccessPayload(report, {
-          requestedVersion: args.version
+          requestedVersion: args.version,
+          filter
         });
         if (isTextFormat8(args.format)) {
           return textResult(formatPackageVulnerabilitiesTerminal(report, {
             useColors: false,
-            requestedVersion: args.version
+            requestedVersion: args.version,
+            filter,
+            verbose: args.verbose,
+            surface: "mcp"
           }).trimEnd());
         }
         return textResult(JSON.stringify(payload));
@@ -8812,13 +9564,13 @@ import { z as z11 } from "zod";
 var MCP_READ_MAX_SPAN = 150;
 var schema10 = {
   target: codeTargetSchema,
-  path: z11.string().describe("Path to the file. Package addressing: package-relative. Repo addressing: repo-relative. This is the same `path` key that `code_files` emits for each entry, so chaining needs no renaming."),
+  path: z11.string().describe("Exact file path to read, not a directory. Package addressing: package-relative. Repo addressing: repo-relative. Use `code_files` with `path_prefix` to list directories, then pass an emitted `path` here."),
   start_line: z11.number().optional().describe(`Starting line (1-indexed). Omit to start at line 1. The MCP surface caps any single read at ${MCP_READ_MAX_SPAN} lines — pick a focused window from your prior \`search\` / \`code_grep\` hit.`),
   end_line: z11.number().optional().describe(`Ending line (inclusive). Must be ≥ \`start_line\` when both are set. Omitting it implies \`start_line + ${MCP_READ_MAX_SPAN - 1}\` because the MCP surface caps each read at ${MCP_READ_MAX_SPAN} lines.`),
   wait_timeout_ms: z11.number().optional().describe("Max milliseconds to wait for indexing (0–60000, default 20000). On an `INDEXING` error envelope, retry with a longer timeout or pass a version from `details.availableVersions`."),
   format: z11.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — line-numbered source content. Pass `format: "json"` for the structured envelope.')
 };
-var DESCRIPTION10 = "Read a file from an indexed dependency. **MCP cap: " + `${MCP_READ_MAX_SPAN} lines per call** — broader requests (or no ` + `range) silently truncate to the first ${MCP_READ_MAX_SPAN} lines ` + "from your start, with a `hint` describing what was returned vs. " + "requested. Pick a focused window from a `search` / `code_grep` " + "match. Response: `{path, language, totalLines, startLine, endLine, " + "content, isBinary, hint?}`. Binary files set `isBinary: true` and " + "omit `content`. Pass the same `path` emitted by `code_files`. " + "Address via `target.registry` + `target.package_name` (package " + "scope) or `target.repo_url` + `target.git_ref` (repo scope), " + "mutually exclusive. On `INDEXING` retry with a longer " + "`wait_timeout_ms`. On `NOT_FOUND` / `FILE_NOT_FOUND` call " + "`code_files` to discover the actual path.";
+var DESCRIPTION10 = "Read one exact file from an indexed dependency; it does not list " + "directories. Use `code_files` with `path_prefix` for file/path " + "enumeration. **MCP cap: " + `${MCP_READ_MAX_SPAN} lines per call** — broader requests (or no ` + `range) silently truncate to the first ${MCP_READ_MAX_SPAN} lines ` + "from your start, with a `hint` describing what was returned vs. " + "requested. Pick a focused window from a `search` / `code_grep` " + "match. Response: `{path, language, totalLines, startLine, endLine, " + "content, isBinary, hint?}`. Binary files set `isBinary: true` and " + "omit `content`. Pass the same `path` emitted by `code_files`. " + "Address via `target.registry` + `target.package_name` (package " + "scope) or `target.repo_url` + `target.git_ref` (repo scope), " + "mutually exclusive. On `INDEXING` retry with a longer " + "`wait_timeout_ms`. On `NOT_FOUND` / `FILE_NOT_FOUND` call " + "`code_files` to discover the actual path.";
 function deriveBoundedRange(startLine, endLine) {
   const start = startLine ?? 1;
   if (endLine === undefined) {
@@ -8873,7 +9625,7 @@ function createReadFileTool(service) {
         }
         return textResult(JSON.stringify(payload));
       } catch (error2) {
-        const mapped = mapCodeNavigationError(error2);
+        const mapped = withReadFileRecovery(mapCodeNavigationError(error2), args.path);
         return errorResult(JSON.stringify({
           error: mapped.message,
           code: mapped.code,
@@ -8900,7 +9652,8 @@ function shouldEmitCappedHint(bounded, payload) {
 }
 function buildCappedHint(payload, originalStart, originalEnd) {
   const requested = describeRequest(originalStart, originalEnd);
-  return `Returned lines ${payload.startLine}-${payload.endLine}/${payload.totalLines} ` + `(MCP cap: ${MCP_READ_MAX_SPAN} lines per call; you requested ${requested}). ` + `Pick a focused start_line/end_line window — typical 80-150 lines around a search/code_grep match. ` + `Each retry also costs context, so aim for one well-sized read.`;
+  const continuation = payload.endLine !== undefined ? ` To continue, retry with start_line=${payload.endLine + 1}.` : "";
+  return `Returned lines ${payload.startLine}-${payload.endLine}/${payload.totalLines} ` + `(MCP cap: ${MCP_READ_MAX_SPAN} lines per call; you requested ${requested}).` + `${continuation} ` + `Pick a focused start_line/end_line window — typical 80-150 lines around a search/code_grep match. ` + `Each retry also costs context, so aim for one well-sized read.`;
 }
 function describeRequest(originalStart, originalEnd) {
   if (originalStart === undefined && originalEnd === undefined) {
@@ -9031,9 +9784,9 @@ var schema12 = {
   limit: z13.coerce.number().int().min(1).max(100).optional().describe("Maximum results to return (default 10, max 100)."),
   offset: z13.coerce.number().int().min(0).optional(),
   wait_timeout_ms: z13.coerce.number().int().min(0).max(60000).optional(),
-  format: z13.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact line-oriented output tuned for agent context efficiency. Pass `format: "json"` for the structured envelope (programmatic consumers, parity testing). `text` is an alias for `text-v1`. The text format is a public, snapshot-tested contract.')
+  format: z13.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact line-oriented output. Pass `format: "json"` for the structured envelope. `text` is an alias for `text-v1`. The text format is a public, snapshot-tested contract.')
 };
-var DESCRIPTION12 = "Search indexed dependency and repository code, docs, and explicit symbols. " + "Provide either `target` for one target or `targets` for many; omit `sources` to use backend AUTO. " + "The query field uses GitHits discovery syntax (AND/OR/parens/qualifiers; see the parameter description). " + "Structured parameters combine with that query using AND semantics. " + "Results are complete by default — if indexing is still running, the response carries a `searchRef` and no hits; pass it to `search_status` to follow up. " + "Set `allow_partial_results: true` to opt into hits from sources that finished while others continue indexing. " + "Each hit's `type` tells you the follow-up tool: `documentation_page` and `repository_doc` → `docs_read` with `locator.pageId`; `repository_code` and `repository_symbol` → `code_read` with `locator.filePath` (and `locator.startLine`/`endLine` when present).";
+var DESCRIPTION12 = "Search indexed dependency and repository code, docs, and explicit symbols. " + "Provide either `target` for one target or `targets` for many; omit `sources` to use backend AUTO. " + "Structured parameters combine with the `query` using AND semantics. " + "Complete by default — if indexing is still running, the response carries a `searchRef` and no hits; pass it to `search_status` to follow up. " + "Set `allow_partial_results: true` to opt into hits from sources that finished while others continue indexing. " + "Each hit's `type` tells you the follow-up tool: `documentation_page` and `repository_doc` → `docs_read` with `locator.pageId`; `repository_code` and `repository_symbol` → `code_read` with `locator.filePath` (and `locator.startLine`/`endLine` when present).";
 function createSearchTool(service) {
   return {
     name: "search",
@@ -9137,7 +9890,7 @@ function isTextFormat11(format) {
 import { z as z14 } from "zod";
 var schema13 = {
   query: z14.string().min(1).describe('Language name or partial name to search for (e.g., "python", "type", "java")'),
-  format: z14.enum(["json", "text", "text-v1"]).optional().describe("Response format. Default `text-v1` returns one language per line. Pass `json` for the structured array.")
+  format: z14.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` returns one language per line. Pass `format: "json"` for the structured array.')
 };
 var DESCRIPTION13 = `Find the correct language name for \`get_example\` when it is uncertain. Returns up to 5 matching languages by name, display name, or alias. Default output is one language per line; pass \`format: "json"\` for the structured array.`;
 function createSearchLanguageTool(service) {
@@ -9173,10 +9926,10 @@ function renderLanguageMatches(matches) {
 // src/tools/search-status.ts
 import { z as z15 } from "zod";
 var schema14 = {
-  search_ref: z15.string().min(1).describe("Search reference returned by search."),
+  search_ref: z15.string().min(1).describe("The `searchRef` field from a prior `search` response (camelCase in the response, snake_case as this parameter). Pass it through unchanged."),
   format: z15.enum(["json", "text", "text-v1"]).optional().describe('Response format. Default `text-v1` — compact line-oriented output matching `search`. Pass `format: "json"` for the structured envelope.')
 };
-var DESCRIPTION14 = "Check progress, fetch partial hits when the original request used allow_partial_results: true, or fetch final results for a prior unified search. " + "Pass the search_ref returned by `search` when the original request did not complete within the wait window.";
+var DESCRIPTION14 = "Check progress, fetch partial hits (when the original request used `allow_partial_results: true`), or fetch final results for a prior `search` that returned a `searchRef`. " + "Pass the `searchRef` from that response as `search_ref` here (response field is camelCase; this parameter is snake_case).";
 function createSearchStatusTool(service) {
   return {
     name: "search_status",
@@ -9201,50 +9954,54 @@ function isTextFormat13(format) {
   return format === undefined || format === "text" || format === "text-v1";
 }
 // src/commands/mcp-instructions.ts
-var CORE_BLOCK = `GitHits provides verified, canonical code examples from global open source. Use it for global solution synthesis and canonical examples when you're stuck, repeated attempts failed, you need up-to-date API usage, the question is comparative across OSS projects (e.g. "how does X vs Y handle Z"), the answer requires reading how a real codebase implements a feature, or the user mentions GitHits.
+var CORE_BLOCK = `GitHits provides verified, canonical code examples from global open source for AI agents. Pick a path:
+
+- Need a canonical example or cross-project pattern with no specific package pinned (you're stuck, repeated attempts failed, the user wants up-to-date API usage, or the user mentioned GitHits) — call \`get_example\` for global solution synthesis.
+- Inspecting a specific known dependency or repository (stack trace points there, verifying how a particular library works, evaluating an upgrade) — call \`search\` plus the indexed code, docs, and package tools listed below.
+- Question is comparative across OSS projects (e.g. "how does X vs Y handle Z") or requires reading how a real codebase implements a feature — combine the two: \`search\` for known targets, \`get_example\` for cross-project synthesis.
+- Rate a result or share tool/UX feedback — call \`feedback\` with a \`solution_id\` from a prior \`get_example\` response (solution-tied) or omit it for generic feedback about any tool (\`search\`, \`code_*\`, \`docs_*\`, \`pkg_*\`) or the overall experience.
 
-Example workflow: call \`get_example\` with one focused question; pass \`language\` only when you know the exact language name, otherwise call \`search_language\` first. Default output is markdown with a trailing \`solution_id\`; send \`feedback\` on that solution_id. Reuse prior results before searching again. For dependency-specific grounding, use package-scoped \`search\` before global \`get_example\`.`;
+\`get_example\` workflow: pass \`language\` only when you know the exact name; otherwise call \`search_language\` first. Default output is markdown with a trailing \`solution_id\`. Reuse prior results before searching again. For dependency-specific grounding, prefer package-scoped \`search\` before global \`get_example\`.`;
 var PACKAGE_TOOLS_PREAMBLE = `Indexed package/source tools inspect third-party dependency source, docs, and registry metadata. Use them when a stack trace points into a dependency, you need to verify how a library works, or you're evaluating whether to add or upgrade a package.
 
 Package spec: \`registry:name[@version]\`. Default outputs are compact \`text-v1\` for agent context efficiency; pass \`format: "json"\` only when you need structured fields for programmatic parsing.`;
-var PKG_INFO_BULLET = '- `pkg_info` — compact package overview: latest version, license, downloads, quickstart, and active advisory count. Pass `format: "json"` for the structured envelope.';
-var DOCS_LIST_BULLET = "- `docs_list` — browse hosted and repository-backed package docs. Entries include stable pageIds, source URLs, and repo-file follow-up metadata when available.";
-var DOCS_READ_BULLET = "- `docs_read` — read a documentation page by pageId. Works for both hosted docs and repo-backed docs.";
-var PKG_VULNS_BULLET = '- `pkg_vulns` — compact known CVE / OSV advisory summary for npm, PyPI, Hex, or Crates packages, optionally pinned to `version`. Filter with `min_severity`; include retracted advisories with `include_withdrawn`. Pass `format: "json"` for per-advisory structured fields.';
-var PKG_DEPS_BULLET = '- `pkg_deps` — compact direct runtime deps by default. Use `lifecycle: "runtime"` for explicit runtime-only, a concrete lifecycle for runtime plus matching non-runtime deps, or `lifecycle: "all"` for all groups. Use `include_transitive` for the full graph and `include_importers` for provenance. Pass `format: "json"` for the structured envelope.';
-var PKG_CHANGELOG_BULLET = '- `pkg_changelog` — compact release notes for a package or GitHub repo, newest-first. Default latest mode returns recent entries with markdown body previews; `from_version` switches to range mode. Set `include_bodies: false` for a compact timeline or pass `format: "json"` for full bodies.';
+var MULTI_TURN_TIP = '**Delegate multi-call work to a sub-agent.** Code-navigation work (`search`, `code_grep`, `code_read`, `code_files`) often takes 3-10 calls. For cross-project comparisons, codebase mapping, pattern surveys, or "how does X actually work" investigations, spawn a sub-task/sub-agent and ask for a compact synthesis. Do it inline only when the raw snippet belongs in the main conversation.';
 var SEARCH_BULLET = '- `search` — unified search across indexed dependency code, docs, and symbols. Omit `sources` for AUTO. Use `sources:["code"]` for implementation/examples/tests text, `sources:["symbol"]` for precise API/entity lookup, and `sources:["docs"]` for guides/reference/changelogs. Default output is compact `text-v1` with ready-to-call follow-up arguments; pass `format: "json"` for structured locators, highlights, and source status. Complete by default; opt into partial hits with `allow_partial_results: true`. Incomplete responses carry a `searchRef`.';
 var SEARCH_STATUS_BULLET = "- `search_status` — follow up a prior `search` by `searchRef` to check progress, fetch partial hits, or fetch final results.";
-var CODE_FILES_BULLET = '- `code_files` — list files in an indexed dependency. `path`, `path_prefix`, and `globs` are OR-ed selectors; extensions, language, file type, and file-intent filters intersect on top. Returned paths feed into `code_read` and help scope `code_grep`; pass `format: "json"` for language/type/size metadata.';
-var CODE_READ_BULLET = "- `code_read` — read a dependency file by `path`. **MCP cap: 150 lines per call**; choose focused `start_line` / `end_line` windows from `search` or `code_grep`. Binary files set `isBinary: true` and omit `content`. On `FILE_NOT_FOUND` / `NOT_FOUND`, call `code_files` for the actual path.";
-var CODE_GREP_BULLET = "- `code_grep` — deterministic text or regex grep over indexed source. Use it when you know the pattern; use `search` for discovery. Narrow with `path`, `path_prefix`, `globs`, or `extensions`. Each match's `path:line` chains into `code_read`.";
-var SEARCH_VS_SYMBOLS_TIP = 'Use code-first grounding for behavioral claims: source, symbols, tests, examples, and call sites beat docs prose. Prefer unified `search` for indexed dependency and repository discovery; use `sources:["symbol"]` when you want symbol-shaped results. Prefer `get_example` for global canonical example retrieval after package-scoped grounding. Use `code_grep` for deterministic text matching and `code_read` for focused-window inspection of a known file.';
-var REFERENCE_FIRST_TIP = "Strategy — reference-first, content-second. Locate symbols and lines with `search` / `code_grep` first, then read only the needed window with `code_read` using explicit `start_line` / `end_line` values, typically 80-150 lines around the match. The MCP `code_read` surface caps each call at 150 lines.";
-var MULTI_TURN_TIP = '**Delegate multi-call work to a sub-agent.** Code-navigation work (`search`, `code_grep`, `code_read`, `code_files`) often takes 3-10 calls. For cross-project comparisons, codebase mapping, pattern surveys, or "how does X actually work" investigations, spawn a sub-task/sub-agent and ask for a compact synthesis. Do it inline only when the raw snippet belongs in the main conversation.';
+var CODE_GREP_BULLET = "- `code_grep` — deterministic text or regex grep over indexed source. Use it when you know the pattern; use `search` for discovery. Narrow with `path`, `path_prefix`, `globs`, or `extensions`. Each match's `filePath`/file heading plus line number chains into `code_read`.";
+var CODE_READ_BULLET = "- `code_read` — read one exact dependency file by `path`; do not use it to probe/list directories like `lib` or `lib/`. **MCP cap: 150 lines per call**. When you already have an exact path (e.g. from a stack trace), call this directly; otherwise locate it first with `search`, `code_grep`, or `code_files` and pick a focused `start_line` / `end_line` window. Binary files set `isBinary: true` and omit `content`. On `FILE_NOT_FOUND` / `NOT_FOUND`, follow `details.action` or call `code_files` for the actual path.";
+var CODE_FILES_BULLET = '- `code_files` — list or discover file paths in an indexed dependency. First choice for file-listing/path-enumeration tasks such as "files under lib/" (`path_prefix: "lib/"`, optional `extensions: ["js"]`); do not use `code_read` to probe directories and do not use `code_grep` with empty or generic patterns to list files. `path`, `path_prefix`, and `globs` are OR-ed selectors; extensions, language, file type, and file-intent filters intersect on top. Returned paths feed into `code_read` and help scope `code_grep`; pass `format: "json"` for language/type/size metadata.';
+var DOCS_LIST_BULLET = '- `docs_list` — browse hosted and repository-backed package docs when you need the available pages. It is not topic search; for "find docs about X", call `search` with `sources:["docs"]`, then pass the returned `pageId` to `docs_read`. Entries include stable pageIds, source URLs, and repo-file follow-up metadata when available.';
+var DOCS_READ_BULLET = "- `docs_read` — read a documentation page by pageId. Works for both hosted docs and repo-backed docs. Prefer focused `start_line` / `end_line` windows from `search` hits or prior `docs_read` `totalLines` metadata instead of rereading large pages.";
+var PKG_INFO_BULLET = '- `pkg_info` — latest-version package triage by `registry` + `package_name` (e.g. `npm` + `express`): license, repository popularity, downloads, publish age, and vulnerability status. Set `verbose: true` for GitHub language/topics/last-pushed, recent advisories, and recent changes; pass `format: "json"` for structured fields.';
+var PKG_VULNS_BULLET = '- `pkg_vulns` — compact known CVE / OSV advisory summary for npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, or Go packages; vcpkg and Zig are not supported. Optionally pin `version` (e.g. `npm` + `lodash` + `4.17.20`). Filter with `min_severity`; include retracted advisories with `include_withdrawn`; set `advisory_scope: "non_affecting"` for historical advisories or `"all"` for affected + historical rows. Default text is capped; use `verbose: true` for all selected rows or `format: "json"` for the complete per-advisory envelope.';
+var PKG_DEPS_BULLET = '- `pkg_deps` — compact direct runtime deps by default. Use `lifecycle: "runtime"` for explicit runtime-only, a concrete lifecycle for runtime plus matching non-runtime deps, or `lifecycle: "all"` for all groups. Use `include_transitive` for the full graph and `include_importers` for provenance. Pass `format: "json"` for the structured envelope.';
+var PKG_CHANGELOG_BULLET = '- `pkg_changelog` — compact release notes for a package or GitHub repo, newest-first (e.g. `npm` + `express` + `limit: 2`). Default latest mode returns recent entries with 10-line markdown previews; `from_version` switches to range mode. Set `body_lines` to tune text previews, `verbose: true` for full text bodies, `include_bodies: false` for a compact timeline, or `format: "json"` for the complete envelope.';
+var STRATEGY_TIP = 'Strategy — reference-first. For file/path enumeration, call `code_files` directly; never test directory paths with `code_read`. For behavioral claims, locate symbols and lines with `search` or `code_grep` first, then read the needed window with `code_read` using explicit `start_line` / `end_line` (typical 80-150 lines around the match; the MCP `code_read` surface caps each call at 150 lines). Source, symbols, tests, and call sites beat docs prose; use `sources:["symbol"]` when you want symbol-shaped results, `code_grep` for deterministic text matching, and `get_example` for global canonical examples after package-scoped grounding.';
 function buildMcpInstructions(_deps) {
-  const sections = [CORE_BLOCK];
-  const bullets = [];
-  bullets.push(DOCS_LIST_BULLET);
-  bullets.push(DOCS_READ_BULLET);
-  bullets.push(PKG_INFO_BULLET);
-  bullets.push(PKG_VULNS_BULLET);
-  bullets.push(PKG_DEPS_BULLET);
-  bullets.push(PKG_CHANGELOG_BULLET);
-  bullets.push(SEARCH_BULLET);
-  bullets.push(SEARCH_STATUS_BULLET);
-  bullets.push(CODE_FILES_BULLET);
-  bullets.push(CODE_READ_BULLET);
-  bullets.push(CODE_GREP_BULLET);
-  const parts = [PACKAGE_TOOLS_PREAMBLE];
-  parts.push(MULTI_TURN_TIP);
-  parts.push(bullets.join(`
-`));
-  parts.push(REFERENCE_FIRST_TIP);
-  parts.push(SEARCH_VS_SYMBOLS_TIP);
-  sections.push(parts.join(`
+  const bullets = [
+    SEARCH_BULLET,
+    SEARCH_STATUS_BULLET,
+    CODE_FILES_BULLET,
+    CODE_GREP_BULLET,
+    CODE_READ_BULLET,
+    DOCS_LIST_BULLET,
+    DOCS_READ_BULLET,
+    PKG_INFO_BULLET,
+    PKG_VULNS_BULLET,
+    PKG_DEPS_BULLET,
+    PKG_CHANGELOG_BULLET
+  ];
+  const packageSection = [
+    PACKAGE_TOOLS_PREAMBLE,
+    MULTI_TURN_TIP,
+    bullets.join(`
+`),
+    STRATEGY_TIP
+  ].join(`
 
-`));
-  return sections.join(`
+`);
+  return [CORE_BLOCK, packageSection].join(`
 
 `);
 }
@@ -9339,14 +10096,14 @@ Authenticated tool calls require a valid GitHits token.`).action(async () => {
       showMcpSetupInstructions();
       return;
     }
-    const deps = await createContainer();
+    const deps = await createContainer({ resolveStoredToken: false });
     await startMcpServer(deps);
   });
   mcpCommand.command("start").summary("Start MCP server (stdio mode)").description(`Start the MCP server using STDIO transport.
 
 This command explicitly starts the server and is intended for use
 in MCP configuration files. Use 'githits mcp' for interactive setup.`).action(async () => {
-    const deps = await createContainer();
+    const deps = await createContainer({ resolveStoredToken: false });
     await startMcpServer(deps);
   });
 }
@@ -9443,7 +10200,7 @@ function formatChangelogTerminalError(mapped) {
   if (available && available.length > 0) {
     const sample = available.slice(0, 5).join(", ");
     const more = available.length - 5;
-    const suffix = more > 0 ? `, … (+${more} more)` : "";
+    const suffix = more > 0 ? `, ... (+${more} more)` : "";
     lines.push(`  available: ${sample}${suffix}`);
   }
   return lines.join(`
@@ -9577,13 +10334,12 @@ function formatDepsTerminalError(mapped) {
 var PKG_DEPS_DESCRIPTION = `Analyze package dependencies. By default shows the flat list of
 direct runtime dependencies. Use --lifecycle all for the structured view
 (dev / peer / build / optional, plus registry-specific feature / TFM
-groups). Concrete --lifecycle values include runtime plus matching groups.
+groups). Runtime group rows include resolved versions when available.
 --transitive opts into aggregate edge / unique-package counts,
 conflict detection, and circular-dependency flags.
 
 Package spec: <registry>:<name>[@<version>]. Supported registries:
-npm, pypi, hex, crates, vcpkg, zig, rubygems, go. Omit @<version> for the latest
-release.`;
+${SUPPORTED_DEPS_REGISTRIES_LIST}. Omit @<version> for the latest release.`;
 function registerPkgDepsCommand(pkgCommand) {
   return pkgCommand.command("deps").summary("Analyze dependencies for a package").description(PKG_DEPS_DESCRIPTION).argument("<spec>", "Package spec, e.g. npm:express or npm:express@4.18.0").option("-l, --lifecycle <phases>", "Dependency lifecycle breadth (runtime, development, build, peer, optional, all; comma-separated for multi-select except all).").option("-t, --transitive", "Include aggregate transitive counts, conflicts, and circular dependencies").option("--depth <n>", "Cap transitive traversal depth (1-10). Omit for the full graph.").option("-v, --verbose", "Show conditionType / selectionMode / environmentConstraints metadata in the groups view").option("--json", "Emit the lean JSON envelope").action(async (spec, options) => {
     const deps = await createContainer();
@@ -9640,16 +10396,20 @@ function handlePkgInfoCommandError(error2, json) {
   console.error(formatMappedErrorForTerminal(mapped));
   process.exit(1);
 }
-var PKG_INFO_DESCRIPTION = `Get a package overview — latest version, license, description,
-repository, downloads, GitHub stars, install command, and known
-vulnerabilities. Use before picking a dependency or to orient on what
-a package is.
+var PKG_INFO_DESCRIPTION = `Latest-version package overview for dependency triage.
+
+Default output shows license, description, repository popularity
+(stars/forks/issues and [ARCHIVED] when applicable), downloads,
+publish age, and vulnerability status. --verbose adds GitHub
+language/topics/last-pushed, recent advisories, and recent changes.
 
 Package spec: <registry>:<name>. Supported registries: ${PKGSEER_REGISTRY_LIST}.
 
+Example: githits pkg info npm:express
+
 Always returns data for the latest published version.`;
 function registerPkgInfoCommand(pkgCommand) {
-  return pkgCommand.command("info").summary("Show a package overview").description(PKG_INFO_DESCRIPTION).argument("<spec>", "Package spec, e.g. npm:express or pypi:requests").option("-v, --verbose", "Show advisories, install usage, topics, and recent changes").option("--json", "Emit the lean JSON envelope").action(async (spec, options) => {
+  return pkgCommand.command("info").summary("Show a package overview").description(PKG_INFO_DESCRIPTION).argument("<spec>", "Package spec, e.g. npm:express or pypi:requests").option("-v, --verbose", "Show GitHub language/topics/last-pushed, recent advisories, and recent changes").option("--json", "Emit the lean JSON envelope").action(async (spec, options) => {
     const deps = await createContainer();
     await pkgInfoAction(spec, options, {
       packageIntelligenceService: deps.packageIntelligenceService,
@@ -9668,17 +10428,19 @@ async function pkgVulnsAction(spec, options, deps) {
       throw new InvalidPackageSpecError("Package intelligence is not configured for this environment.");
     }
     const parsed = parsePackageSpec(spec);
-    const { params } = buildPackageVulnerabilitiesParams({
+    const { params, filter } = buildPackageVulnerabilitiesParams({
       registry: parsed.registry,
       packageName: parsed.name,
       version: parsed.version,
       minSeverity: options.severity,
-      includeWithdrawn: options.includeWithdrawn
+      includeWithdrawn: options.includeWithdrawn,
+      advisoryScope: options.scope
     });
     const report = await deps.packageIntelligenceService.packageVulnerabilities(params);
     if (options.json) {
       const payload = buildPackageVulnerabilitiesSuccessPayload(report, {
-        requestedVersion: parsed.version
+        requestedVersion: parsed.version,
+        filter
       });
       console.log(JSON.stringify(payload));
       return;
@@ -9687,6 +10449,8 @@ async function pkgVulnsAction(spec, options, deps) {
       verbose: options.verbose,
       useColors: shouldUseColors(),
       requestedVersion: parsed.version,
+      filter,
+      surface: "cli",
       terminalWidth: process.stdout.columns
     });
     process.stdout.write(output);
@@ -9729,24 +10493,30 @@ function formatVulnsTerminalError(mapped) {
   if (available && available.length > 0) {
     const sample = available.slice(0, 5).join(", ");
     const more = available.length - 5;
-    const suffix = more > 0 ? `, … (+${more} more)` : "";
+    const suffix = more > 0 ? `, ... (+${more} more)` : "";
     lines.push(`  available: ${sample}${suffix}`);
   }
   return lines.join(`
 `);
 }
 var PKG_VULNS_DESCRIPTION = `Show known vulnerabilities for a package. Lists CVE / OSV advisories
-with severity, affected version ranges, and fix versions.
-Malicious-package advisories are flagged prominently.
+with severity, affected version ranges, and fix versions. Default text is
+capped for readability; use --verbose for all selected advisory rows or --json
+for the complete structured envelope.
 
 Package spec: <registry>:<name>[@<version>]. Supported registries:
-npm, pypi, hex, crates. Omit @<version> to check the latest release.
+npm, pypi, hex, crates, nuget, maven, packagist, rubygems, go. vcpkg and zig are not supported.
+Omit @<version> to check the latest release.
+Example: githits pkg vulns npm:lodash@4.17.20 --severity high
 
 Severity filter (--severity) and withdrawn-advisory visibility
 (--include-withdrawn) are passed through to the backend; the
-returned count reflects whatever survived the filter.`;
+returned count reflects whatever survived the filter and active filters
+are echoed in text and JSON output. Use --scope non_affecting to list
+historical advisories that do not affect the inspected version, or --scope all
+to list affected and historical package advisories together.`;
 function registerPkgVulnsCommand(pkgCommand) {
-  return pkgCommand.command("vulns").summary("List known vulnerabilities for a package").description(PKG_VULNS_DESCRIPTION).argument("<spec>", "Package spec, e.g. npm:express or npm:express@4.18.0").option("-s, --severity <level>", "Only show advisories at or above this severity (low, medium, high, critical). Omit to see all.").option("--include-withdrawn", "Include retracted advisories (default: off)").option("-v, --verbose", "Show aliases, modified/withdrawn dates, and malicious-advisory markers").option("--json", "Emit the lean JSON envelope").action(async (spec, options) => {
+  return pkgCommand.command("vulns").summary("List known vulnerabilities for a package").description(PKG_VULNS_DESCRIPTION).argument("<spec>", "Package spec, e.g. npm:express or npm:express@4.18.0").option("-s, --severity <level>", "Only show advisories at or above this severity (low, medium, high, critical). Omit to see all.").option("--scope <scope>", "Advisory rows to return: affected, non_affecting, all (default: affected)").option("--include-withdrawn", "Include retracted advisories (default: off)").option("-v, --verbose", "Show aliases, modified/withdrawn dates, and malicious-advisory markers").option("--json", "Emit the lean JSON envelope").action(async (spec, options) => {
     const deps = await createContainer();
     await pkgVulnsAction(spec, options, {
       packageIntelligenceService: deps.packageIntelligenceService,
@@ -9763,7 +10533,7 @@ async function registerPkgCommandGroup(program, options = {}) {
   if (!registration.shouldRegister) {
     return;
   }
-  const pkgCommand = program.command("pkg").summary("Package metadata: info, vulnerabilities, dependencies, changelog").description("Inspect package metadata from npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, vcpkg, and Zig: overviews, advisories, dependency graphs, and changelogs. For source-level operations inside a dependency, use `githits code`.");
+  const pkgCommand = program.command("pkg").summary("Package metadata: info, vulnerabilities, dependencies, changelog").description("Inspect package metadata from npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, vcpkg, and Zig: overviews, advisories, dependency graphs, and changelogs. Advisory data is unavailable for vcpkg and Zig. For source-level operations inside a dependency, use `githits code`.");
   registerPkgInfoCommand(pkgCommand);
   registerPkgVulnsCommand(pkgCommand);
   registerPkgDepsCommand(pkgCommand);
@@ -9887,7 +10657,7 @@ function requireSearchService(deps) {
   return deps.codeNavigationService;
 }
 async function loadContainer2() {
-  const { createContainer: createContainer2 } = await import("./shared/chunk-q2mre780.js");
+  const { createContainer: createContainer2 } = await import("./shared/chunk-k35egwwf.js");
   return createContainer2();
 }
 function parseTargetSpecs(specs) {
@@ -9997,13 +10767,13 @@ function formatUnifiedSearchTerminal(payload) {
 `).trimEnd();
   }
   const { display, duplicatesFolded } = dedupeSearchResultsForDisplay(payload.results);
-  const baseCount = `${display.length} result(s)`;
+  const baseCount = `${display.length} result${display.length === 1 ? "" : "s"}`;
   const countSuffix = [
     payload.hasMore ? " (more available)" : "",
     duplicatesFolded > 0 ? ` (+${duplicatesFolded} near-duplicate folded)` : ""
   ].join("");
-  lines.push(`${highlight(baseCount, useColors)}${dim(countSuffix, useColors)}`);
-  lines.push(dim(formatUnifiedSearchTypeSummary(display), useColors));
+  const typeSummary = formatUnifiedSearchTypeSummary(display);
+  lines.push(`${highlight(baseCount, useColors)}${dim(countSuffix, useColors)}${typeSummary ? dim(` | ${typeSummary}`, useColors) : ""}`);
   lines.push("");
   for (const entry of display) {
     const location = formatUnifiedSearchLocation(entry.locator);
@@ -10153,7 +10923,7 @@ function formatUnifiedSearchTypeSummary(results) {
   for (const result of results) {
     counts.set(result.type, (counts.get(result.type) ?? 0) + 1);
   }
-  return Array.from(counts.entries()).map(([type, count]) => formatUnifiedSearchCountLabel(type, count)).join(" · ");
+  return Array.from(counts.entries()).map(([type, count]) => formatUnifiedSearchCountLabel(type, count)).join(", ");
 }
 function formatUnifiedSearchResultLabel(type) {
   switch (type) {
@@ -10206,11 +10976,33 @@ function formatUnifiedSearchLocation(locator) {
   return `${locator.filePath}:${locator.startLine}${locator.endLine && locator.endLine !== locator.startLine ? `-${locator.endLine}` : ""}`;
 }
 function formatUnifiedSearchHeader(entry, useColors, location, rawQuery) {
+  if (entry.type === "documentation_page") {
+    return formatDocumentationPageHeader(entry, useColors);
+  }
   const primary = formatUnifiedSearchPrimary(entry.type, entry.target, location, rawQuery, useColors);
   const badge = `[${formatUnifiedSearchResultLabel(entry.type)}]`;
   const title = entry.title ? highlightRanges(entry.title, entry.highlights?.title, useColors) : undefined;
   return `${primary} ${dim(badge, useColors)}${title ? ` - ${title}` : ""}`;
 }
+function formatDocumentationPageHeader(entry, useColors) {
+  const pageId = entry.locator.pageId ?? "unknown";
+  const title = entry.title ? highlightRanges(entry.title, entry.highlights?.title, useColors) : "Untitled documentation page";
+  const source = entry.locator.sourceUrl ? ` - ${formatDisplayUrl(entry.locator.sourceUrl)}` : "";
+  const target = formatDocsPageTarget2(entry.locator, entry.target);
+  return `${highlight(pageId, useColors)} ${dim("[docs page]", useColors)}${target ? ` ${dim(target, useColors)}` : ""} - ${title}${dim(source, useColors)}`;
+}
+function formatDisplayUrl(value) {
+  return value.replace(/^https?:\/\//, "");
+}
+function formatDocsPageTarget2(locator, fallbackTarget) {
+  return locator.registry && locator.packageName ? `${locator.registry}:${locator.packageName}` : stripVersionFromTarget2(fallbackTarget);
+}
+function stripVersionFromTarget2(value) {
+  if (!value)
+    return "";
+  const atIndex = value.lastIndexOf("@");
+  return atIndex > 0 ? value.slice(0, atIndex) : value;
+}
 function formatUnifiedSearchPrimary(type, target, location, rawQuery, useColors) {
   const formattedTarget = highlight(target, useColors);
   if (type === "documentation_page" || !location) {
@@ -10318,14 +11110,8 @@ function formatUnifiedSearchMetadata(entry, useColors) {
     return [];
   }
   const lines = [];
-  if (entry.locator.pageId) {
-    if (entry.type === "documentation_page") {
-      lines.push(`  ${dim("pageId:", useColors)} ${entry.locator.pageId}`);
-    }
-  }
-  const sourceBadge = entry.locator.sourceKind?.toLowerCase() === "repository" ? "[repo]" : entry.locator.sourceKind?.toLowerCase() === "crawled" ? "[crawled]" : undefined;
-  if (entry.locator.sourceUrl && entry.type === "documentation_page") {
-    lines.push(`  ${dim("source:", useColors)} ${sourceBadge ? `${sourceBadge} ` : ""}${entry.locator.sourceUrl}`);
+  if (entry.type === "documentation_page") {
+    return lines;
   }
   return lines;
 }
@@ -10364,6 +11150,8 @@ if (isTelemetryEnabled()) {
 }
 var rootCliPreAction = createRootCliPreAction({
   createContainer,
+  loadAuthSessionMetadata: loadAutoLoginAuthSessionMetadata,
+  clearAuthSessionMetadata: clearAutoLoginAuthSessionMetadata,
   loginFlow: (options, deps) => loginFlow(options, deps, stderrLoginOutput)
 });
 program.name("githits").description("Code examples from global open source for your AI assistant").version(version).option("--no-color", "Disable colored output").hook("preAction", async (thisCommand, actionCommand) => {