halfcycle 0.4.6 → 0.4.7

package/bin/bin.bundle.mjs

@@ -2266,8 +2266,8 @@ var Doc = class {
     const lines = content.split("\n").filter((x) => x);
     const minIndent = Math.min(...lines.map((x) => x.length - x.trimStart().length));
     const dedented = lines.map((x) => x.slice(minIndent)).map((x) => " ".repeat(this.indent * 2) + x);
-    for (const line of dedented) {
-      this.content.push(line);
+    for (const line2 of dedented) {
+      this.content.push(line2);
     }
   }
   compile() {
@@ -14572,14 +14572,14 @@ function unquote(value) {
 }
 function parseEnvText(raw) {
   const out = {};
-  for (const line of raw.split("\n")) {
-    const eq = line.indexOf("=");
+  for (const line2 of raw.split("\n")) {
+    const eq = line2.indexOf("=");
     if (eq === -1)
       continue;
-    const key = line.slice(0, eq).replace(/^\s*export\s+/, "").trim();
+    const key = line2.slice(0, eq).replace(/^\s*export\s+/, "").trim();
     if (key === "" || key.startsWith("#"))
       continue;
-    out[key] = unquote(line.slice(eq + 1));
+    out[key] = unquote(line2.slice(eq + 1));
   }
   return out;
 }
@@ -14588,13 +14588,13 @@ function reconcileEnvText(existing, values, keys) {
     const value = values[k];
     return [k, value === void 0 ? "" : value];
   }));
-  const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
+  const line2 = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
   const written = keys.filter((k) => desired.get(k) !== null);
   if (existing === null) {
     if (written.length === 0)
       return "";
     return `${ENGAGEMENT_ENV_HEADER}
-` + written.map(line).join("\n") + "\n";
+` + written.map(line2).join("\n") + "\n";
   }
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -14615,13 +14615,13 @@ function reconcileEnvText(existing, values, keys) {
     seen.add(key);
     if (desired.get(key) === null)
       continue;
-    out.push(`${prefix}${line(key)}`);
+    out.push(`${prefix}${line2(key)}`);
   }
   const missing = written.filter((k) => !seen.has(k));
   if (missing.length > 0) {
     const header = existing.includes(ENGAGEMENT_ENV_HEADER) ? "" : `${ENGAGEMENT_ENV_HEADER}
 `;
-    const block = header + missing.map(line).join("\n");
+    const block = header + missing.map(line2).join("\n");
     const trailingBlank = out.length > 0 && out[out.length - 1] === "";
     if (trailingBlank)
       out.splice(out.length - 1, 0, block);
@@ -14662,6 +14662,7 @@ var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
 var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
 var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var USER_PROMPT_SCOPE_REL = ".claude/hooks/user-prompt-scope.sh";
 var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
 var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
 function hookCommand(script, verb) {
@@ -14690,6 +14691,13 @@ var HALFCYCLE_HOOK_WIRING = [
     command: hookCommand(USER_PROMPT_REMINDER_REL),
     script: USER_PROMPT_REMINDER_REL
   },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 10,
+    command: hookCommand(USER_PROMPT_SCOPE_REL),
+    script: USER_PROMPT_SCOPE_REL
+  },
   {
     event: "PostToolUse",
     matcher: WRITE_CAPABLE_TOOLS.join("|"),
@@ -14765,6 +14773,98 @@ function looksLikeSecret(text) {
 var MCP_REGISTRATION_REL = ".mcp.json";
 var MCP_SERVER_KEY = "halfcycle";
 
+// ../core/dist/shell-quote.js
+function quoteForShell(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+var HALFCYCLE_COMMAND = "npx halfcycle@latest";
+
+// ../core/dist/shown-plans.js
+var SHOWN_PLANS_FILENAME = "shown-plans.json";
+var SHOWN_PLANS_FORMAT = 1;
+var RECORD_KEYS = ["entries", "format"];
+var ENTRY_KEYS = ["number", "phase", "shownAt", "version"];
+function parseShownPlans(text) {
+  try {
+    if (typeof text !== "string")
+      return [];
+    const parsed = JSON.parse(text);
+    if (!isPlainObject2(parsed) || !hasExactKeys(parsed, RECORD_KEYS))
+      return [];
+    if (parsed["format"] !== SHOWN_PLANS_FORMAT)
+      return [];
+    const rawEntries = parsed["entries"];
+    if (!Array.isArray(rawEntries))
+      return [];
+    const entries = [];
+    for (const raw of rawEntries) {
+      const entry = readEntry(raw);
+      if (entry === null)
+        return [];
+      entries.push(entry);
+    }
+    return hasDuplicates(entries) ? [] : entries;
+  } catch {
+    return [];
+  }
+}
+function readEntry(raw) {
+  if (!isPlainObject2(raw) || !hasExactKeys(raw, ENTRY_KEYS))
+    return null;
+  const phase = raw["phase"];
+  const number4 = raw["number"];
+  const version2 = raw["version"];
+  const shownAt = raw["shownAt"];
+  if (typeof phase !== "string" || phase === "")
+    return null;
+  if (!isPositiveInteger(number4) || !isPositiveInteger(version2))
+    return null;
+  if (!isIsoInstant(shownAt))
+    return null;
+  return { phase, number: number4, version: version2, shownAt };
+}
+function isPlainObject2(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function hasExactKeys(value, keys) {
+  const own = Object.keys(value).sort();
+  return own.length === keys.length && own.every((key, i) => key === keys[i]);
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+}
+function isIsoInstant(value) {
+  if (typeof value !== "string")
+    return false;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) && new Date(ms).toISOString() === value;
+}
+function hasDuplicates(entries) {
+  const phases = new Set(entries.map((entry) => entry.phase));
+  const numbers = new Set(entries.map((entry) => entry.number));
+  return phases.size !== entries.length || numbers.size !== entries.length;
+}
+
+// ../core/dist/phase-reference.js
+var TYPED_NUMBER = /^(?:0|[1-9][0-9]*)$/;
+function resolvePhaseReference(typed, phases) {
+  if (typeof typed !== "string" || typed === "")
+    return null;
+  const byIdentity = phases.filter((entry) => entry.phase === typed);
+  if (byIdentity.length > 0)
+    return byIdentity.length === 1 ? byIdentity[0] : null;
+  if (!TYPED_NUMBER.test(typed))
+    return null;
+  const byNumber = phases.filter((entry) => Number.isInteger(entry.number) && String(entry.number) === typed);
+  return byNumber.length === 1 ? byNumber[0] : null;
+}
+
+// ../core/dist/release-version.js
+var RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
 function resolveControlOrigin(env) {
@@ -14830,6 +14930,9 @@ function readMcpServerUrl() {
   const raw = process.env["CLAUDE_CODE_MCP_SERVER_URL"];
   return raw ? raw : void 0;
 }
+function readSessionAttended(env = process.env) {
+  return env["CLAUDE_CODE_SESSION_ATTENDED"] === "1";
+}
 function readExcerptConfig() {
   const raw = process.env["HALFCYCLE_SOURCE_EXCERPTS"];
   const enabled = (raw ?? "").trim().toLowerCase() !== "false";
@@ -15040,14 +15143,25 @@ var wireErrorSchema = external_exports.object({
   message: external_exports.string()
 }).strict();
 
+// ../events/dist/lone-surrogates.js
+var LONE_SURROGATE = /\p{Cs}/u;
+function hasLoneSurrogate(text) {
+  return LONE_SURROGATE.test(text);
+}
+var LONE_SURROGATE_MESSAGE = "must be valid text: it holds half of a character pair with no other half";
+
 // ../events/dist/state.js
 var utcIso8601 = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var STATE_RECORD_FORMAT = "halfcycle-state-record/v1";
 var stepIdSchema = external_exports.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
-var methodVersionSchema = external_exports.string().regex(/^\d+\.\d+\.\d+$/);
+var methodVersionSchema = external_exports.string().regex(RELEASE_VERSION_PATTERN);
 var anchorPathRegex = /^(?!\/)(?!.*#)(?!method\/)(?!(.*\/)?docs\/method\/).+$/;
 var recordKindSchema = external_exports.enum(["artefact", "step-run", "gate", "intervention"]);
 var methodLayerSchema = external_exports.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
+var PHASE_SCOPED_LAYERS = ["l4", "l5"];
+function isPhaseScopedLayer(layer) {
+  return PHASE_SCOPED_LAYERS.includes(layer);
+}
 var evidenceKindSchema = external_exports.enum(["anchor", "diff", "repro", "question-answer", "no-op"]);
 var declarableEvidenceKindSchema = external_exports.enum(["anchor", "diff", "repro", "question-answer"]);
 var dispositionSchema = external_exports.enum([
@@ -15295,6 +15409,683 @@ function describeIdentity(identity) {
   return `(a ${typeof identity})`;
 }
 
+// ../events/dist/build-record.js
+var BUILD_RECORD_V2_FORMAT = "halfcycle-build-record/v2";
+var STATEMENT_MAX = 2e3;
+var DEVIATION_MAX = 500;
+var DEVIATIONS_MAX = 20;
+var ACTOR_MAX = 200;
+var FINDING_MAX = 500;
+var FINDINGS_SHOWN_MAX = 50;
+var PHASE_CLOSE_REASON_MAX = 1900;
+var closeCommitSchema = external_exports.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, "must be a full commit hash: 40 or 64 lowercase hex characters");
+var walkVerdictSchema = external_exports.enum(["clean", "defects"]);
+var closeDecisionSchema = external_exports.enum(["done-when-met", "override"]);
+function plainText(max) {
+  const base = max === void 0 ? external_exports.string() : external_exports.string().max(max);
+  return base.refine((v) => !hasControlCharacter(v), {
+    message: "must be one line with no control characters (no line breaks, tabs or NUL)"
+  }).refine((v) => !hasLoneSurrogate(v), { message: LONE_SURROGATE_MESSAGE });
+}
+function statementText(max) {
+  return plainText(max).refine((v) => !looksLikeSecret(v), {
+    message: "looks like a password or key \u2014 rephrase it"
+  });
+}
+var closeActorSchema = plainText(ACTOR_MAX);
+var PHASE_NAME_RULE = `must be a phase name: not empty, no slash or backslash, not starting with a dot, no control characters, at most ${PHASE_NAME_MAX_BYTES} bytes`;
+var phaseNameSchema = external_exports.string().refine((v) => isValidPhaseIdentity(v), {
+  message: PHASE_NAME_RULE
+});
+var phaseIdentitySchema = external_exports.union([external_exports.string(), external_exports.number()], { error: "must be a phase name or a whole number" }).refine((v) => isValidPhaseIdentity(v), { message: PHASE_NAME_RULE });
+var closeStatementsSchema = external_exports.object({
+  thesis: statementText(STATEMENT_MAX).nullable(),
+  outcome: statementText(STATEMENT_MAX).nullable(),
+  deviations: external_exports.array(statementText(DEVIATION_MAX)).max(DEVIATIONS_MAX),
+  closeCommit: closeCommitSchema.nullable()
+}).strict();
+var closedBySchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("account"), email: plainText().nullable() }).strict(),
+  external_exports.object({ kind: external_exports.literal("no-account") }).strict(),
+  external_exports.object({ kind: external_exports.literal("account-removed") }).strict(),
+  external_exports.object({ kind: external_exports.literal("not-recorded") }).strict()
+]);
+var STEP_NAME_MAX = 200;
+var stepNameSchema = plainText(STEP_NAME_MAX).refine((v) => v.trim().length > 0, {
+  message: "must not be blank"
+});
+var unfinishedStepSchema = external_exports.object({
+  stepId: plainText(),
+  state: external_exports.enum(["parked", "failed"]),
+  name: stepNameSchema.optional()
+}).strict();
+var crossedSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("none") }).strict(),
+  external_exports.object({ kind: external_exports.literal("unfinished-steps"), steps: external_exports.array(unfinishedStepSchema).min(1) }).strict(),
+  external_exports.object({ kind: external_exports.literal("clean-over-findings"), findings: external_exports.number().int().min(1) }).strict(),
+  external_exports.object({ kind: external_exports.literal("not-recorded") }).strict()
+]);
+var seatCoverageSchema = external_exports.object({
+  enrolled: external_exports.number().int().nonnegative(),
+  conformant: external_exports.number().int().nonnegative()
+}).strict().refine((c) => c.conformant <= c.enrolled, {
+  message: "conformant cannot exceed enrolled",
+  path: ["conformant"]
+});
+var observedCloseSchema = external_exports.object({
+  sequence: external_exports.number().int().min(1),
+  closedAt: utcIso8601,
+  closedBy: closedBySchema,
+  crossed: crossedSchema,
+  seatCoverage: seatCoverageSchema.nullable()
+}).strict();
+var couldNotRunCheckSchema = external_exports.object({
+  check: plainText(),
+  description: plainText().nullable(),
+  reason: plainText()
+}).strict();
+var firedCheckSchema = external_exports.object({
+  check: plainText(),
+  description: plainText().nullable(),
+  severity: severitySchema,
+  explanation: plainText().nullable(),
+  occurrences: external_exports.number().int().min(1)
+}).strict();
+var phaseChecksSchema = external_exports.discriminatedUnion("state", [
+  external_exports.object({ state: external_exports.literal("not-observed") }).strict(),
+  external_exports.object({
+    state: external_exports.literal("nothing-fired"),
+    runs: external_exports.number().int().min(1),
+    couldNotRun: external_exports.array(couldNotRunCheckSchema)
+  }).strict(),
+  external_exports.object({
+    state: external_exports.literal("fired"),
+    runs: external_exports.number().int().min(1),
+    couldNotRun: external_exports.array(couldNotRunCheckSchema),
+    fired: external_exports.array(firedCheckSchema).min(1)
+  }).strict()
+]);
+var observedSchema = external_exports.object({
+  engagementId: plainText(),
+  methodVersion: methodVersionSchema,
+  closes: external_exports.array(observedCloseSchema).min(1),
+  checks: phaseChecksSchema
+}).strict().superRefine((o, ctx) => {
+  o.closes.forEach((close, i) => {
+    if (close.sequence !== i + 1) {
+      ctx.addIssue({
+        code: "custom",
+        message: "closes must be numbered 1, 2, 3 \u2026 in order with no gap",
+        path: ["closes", i, "sequence"]
+      });
+    }
+  });
+});
+var attestedWalkSchema = external_exports.object({
+  verdict: walkVerdictSchema,
+  findings: external_exports.array(plainText(FINDING_MAX)).max(FINDINGS_SHOWN_MAX),
+  findingsNotShown: external_exports.number().int().nonnegative()
+}).strict();
+var attestedStatementsSchema = external_exports.object({
+  thesis: plainText(STATEMENT_MAX).nullable(),
+  outcome: plainText(STATEMENT_MAX).nullable(),
+  deviations: external_exports.array(plainText(DEVIATION_MAX)).max(DEVIATIONS_MAX)
+}).strict();
+var attestedCloseSchema = external_exports.object({
+  sequence: external_exports.number().int().min(1),
+  decision: closeDecisionSchema,
+  actor: plainText(ACTOR_MAX).nullable(),
+  reason: plainText(PHASE_CLOSE_REASON_MAX).nullable(),
+  walk: attestedWalkSchema.nullable(),
+  closeCommit: closeCommitSchema.nullable(),
+  statements: attestedStatementsSchema
+}).strict();
+var attestedSchema = external_exports.object({
+  closes: external_exports.array(attestedCloseSchema)
+}).strict();
+var buildRecordV2Schema = external_exports.object({
+  format: external_exports.literal(BUILD_RECORD_V2_FORMAT),
+  phase: phaseNameSchema,
+  observed: observedSchema,
+  attested: attestedSchema
+}).strict().superRefine((record2, ctx) => {
+  const observedBySequence = new Map(record2.observed.closes.map((c) => [c.sequence, c]));
+  const attestedSequences = record2.attested.closes.map((c) => c.sequence);
+  const sameSet = attestedSequences.length === observedBySequence.size && new Set(attestedSequences).size === attestedSequences.length && attestedSequences.every((s) => observedBySequence.has(s));
+  if (!sameSet) {
+    ctx.addIssue({
+      code: "custom",
+      message: "attested closes must match the observed closes one for one, by sequence",
+      path: ["attested", "closes"]
+    });
+  }
+  record2.attested.closes.forEach((close, i) => {
+    if (close.decision === "override" !== (close.reason !== null)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "reason is given exactly when the decision is override",
+        path: ["attested", "closes", i, "reason"]
+      });
+    }
+    const observed = observedBySequence.get(close.sequence);
+    if (observed !== void 0 && observed.closedBy.kind === "account-removed" !== (close.actor === null)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "actor is empty exactly when the closing account was removed",
+        path: ["attested", "closes", i, "actor"]
+      });
+    }
+  });
+});
+
+// ../events/dist/human-agent.js
+var HUMAN_AGENT = "Human";
+
+// ../events/dist/build-snapshot.js
+var buildTaskStateSchema = external_exports.enum([
+  "pending",
+  "in-flight",
+  "completed",
+  "failed",
+  "blocked"
+]);
+var BUILD_TASK_TITLE_MAX = 240;
+var BUILD_SNAPSHOT_TASK_LIMIT = 500;
+var buildTaskSchema = external_exports.object({
+  // The task's own id, as the coordinator's graph names it.
+  id: external_exports.string().min(1).max(64),
+  // What the task is, in the coordinator's words. A description of the work,
+  // bounded and scanned — never an excerpt of anybody's code.
+  title: external_exports.string().min(1).max(BUILD_TASK_TITLE_MAX),
+  // What the task is doing right now.
+  state: buildTaskStateSchema,
+  // Who holds it — a bare callsign, or the value naming a person when the work is
+  // a person's. Absent when nothing has been dispatched to it yet.
+  agent: external_exports.string().min(1).max(32).optional(),
+  // The kind of work the holder does. Present exactly when an agent holds it.
+  discipline: external_exports.string().min(1).max(64).optional(),
+  // How much thinking the holder brings. Present exactly when an agent holds it,
+  // and there is no field naming the supplier behind it.
+  tier: external_exports.string().min(1).max(32).optional(),
+  // The tasks this one cannot start before. Always present; empty means it waits
+  // on nothing, which is different from not having been computed.
+  dependsOn: external_exports.array(external_exports.string().min(1).max(64)).max(BUILD_SNAPSHOT_TASK_LIMIT),
+  // The one task this task checks, when it is a check on other work. Absent on a
+  // task that is doing the work rather than checking it.
+  reviews: external_exports.string().min(1).max(64).optional(),
+  // Which wave of the phase this task belongs to — the wave that writes the
+  // specifications, or the wave that builds them. Absent when the graph does not
+  // record it, which is different from the task belonging to neither.
+  layer: methodLayerSchema.optional(),
+  // When it was picked up, and when it settled. A reader computes how long it
+  // took; neither this row nor this payload carries a duration.
+  startedAt: utcIso8601.optional(),
+  settledAt: utcIso8601.optional()
+}).strict().superRefine((task, ctx) => {
+  if (task.reviews !== void 0 && task.reviews === task.id) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["reviews"],
+      message: `'${task.id}' reviews itself \u2014 a review names the OTHER task it checks.`
+    });
+  }
+  if (task.layer !== void 0 && !isPhaseScopedLayer(task.layer)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["layer"],
+      message: `'${task.layer}' is not a wave a phase runs \u2014 expected one of ${PHASE_SCOPED_LAYERS.join(", ")}.`
+    });
+  }
+  const profiled = task.agent !== void 0 && task.agent !== HUMAN_AGENT;
+  for (const field of ["discipline", "tier"]) {
+    if (profiled && task[field] === void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `'${field}' is required on a task an agent holds.`
+      });
+    }
+    if (!profiled && task[field] !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: task.agent === void 0 ? `'${field}' must be absent on a task nobody holds.` : `'${field}' must be absent on work a person holds.`
+      });
+    }
+  }
+});
+var buildPhaseSchema = external_exports.string().min(1).max(128);
+var BUILD_PHASE_TITLE_MAX = 160;
+var buildPhaseTitleSchema = external_exports.string().min(1).max(BUILD_PHASE_TITLE_MAX);
+var buildTaskListSchema = external_exports.array(buildTaskSchema).max(BUILD_SNAPSHOT_TASK_LIMIT).superRefine((tasks, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, task] of tasks.entries()) {
+    if (seen.has(task.id)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [index, "id"],
+        message: `duplicate task id '${task.id}' \u2014 one graph names each task once.`
+      });
+    }
+    seen.add(task.id);
+  }
+});
+var buildSnapshotSchema = external_exports.object({
+  // Which phase this graph belongs to.
+  phase: buildPhaseSchema,
+  // That phase's name in words, when the project gives it one.
+  phaseTitle: buildPhaseTitleSchema.optional(),
+  // Every task on it. Never a partial graph and never a change since last time.
+  tasks: buildTaskListSchema,
+  // When this graph was last reported.
+  reportedAt: utcIso8601,
+  // When work on this phase was first reported with no approval of its scope in force.
+  builtWithoutApproval: utcIso8601.optional()
+}).strict();
+var buildPhaseEntrySchema = external_exports.object({
+  // Which phase has a stored graph.
+  phase: buildPhaseSchema,
+  // That phase's name in words, when the project gave it one.
+  phaseTitle: buildPhaseTitleSchema.optional(),
+  // When that phase's graph was last reported.
+  reportedAt: utcIso8601,
+  // Present when work on this phase was reported with no approval of its scope in force.
+  builtWithoutApproval: external_exports.literal(true).optional()
+}).strict();
+var buildSnapshotReportSchema = external_exports.object({
+  // Which phase this graph belongs to.
+  phase: buildPhaseSchema,
+  // That phase's name in words, when the project gives it one.
+  phaseTitle: buildPhaseTitleSchema.optional(),
+  // The whole graph, every time. Reporting a change instead of the graph is the
+  // one thing this route does not accept.
+  tasks: buildTaskListSchema
+}).strict();
+var buildSnapshotReportResultSchema = external_exports.object({
+  // What happened. One outcome today; a refusal travels as the shared wire error.
+  outcome: external_exports.literal("recorded"),
+  // Which phase the graph was recorded against.
+  phase: buildPhaseSchema,
+  // When it was recorded.
+  reportedAt: utcIso8601
+}).strict();
+
+// ../events/dist/system-description.js
+var SYSTEM_DESCRIPTION_FORMAT = 1;
+var SYSTEM_PARTS_MAX = 60;
+var SYSTEM_CONNECTIONS_MAX = 400;
+var SYSTEM_SLOT_MAX = 11;
+var SYSTEM_OWNS_MAX = 20;
+var SYSTEM_OWNED_PATTERN_MAX = 200;
+var SYSTEM_PART_NAME_MAX = 60;
+var SYSTEM_PART_DESCRIPTION_MAX = 160;
+var SYSTEM_CONNECTION_LABEL_MAX = 60;
+var SYSTEM_PART_ID_PATTERN = /^[a-z][a-z0-9-]{0,39}$/;
+var SYSTEM_LANES = ["clients", "edge", "services", "data", "external"];
+var systemLaneSchema = external_exports.enum(SYSTEM_LANES, {
+  error: `must be one of ${SYSTEM_LANES.join(", ")}`
+});
+var SYSTEM_CONNECTION_KINDS = ["call", "event", "write", "external"];
+var systemConnectionKindSchema = external_exports.enum(SYSTEM_CONNECTION_KINDS, {
+  error: `must be one of ${SYSTEM_CONNECTION_KINDS.join(", ")}`
+});
+var LINE_SEPARATOR = /[\u2028\u2029]/;
+function descriptionText(max) {
+  return statementText(max).refine((v) => v.trim().length > 0, { message: "must not be empty or only spaces" }).refine((v) => !LINE_SEPARATOR.test(v), {
+    message: "must be one line: it holds a line or paragraph separator"
+  });
+}
+var systemPartIdSchema = external_exports.string().regex(SYSTEM_PART_ID_PATTERN, {
+  message: "must be a short id: a lowercase letter, then lowercase letters, digits or hyphens, 40 characters at most"
+}).refine((v) => !looksLikeSecret(v), { message: "looks like a password or key; choose another id" });
+function hasEmptySegment(pattern) {
+  return pattern.split("/").some((segment) => segment.length === 0);
+}
+function hasDotSegment(pattern) {
+  return pattern.split("/").some((segment) => segment === "." || segment === "..");
+}
+function hasPartialDoubleStar(pattern) {
+  return pattern.split("/").some((segment) => segment.includes("**") && segment !== "**");
+}
+var SEGMENT_CHARACTERS = /^[A-Za-z0-9._\-*]*$/;
+function hasForeignCharacter(pattern) {
+  return pattern.split("/").some((segment) => !SEGMENT_CHARACTERS.test(segment));
+}
+var systemOwnedPatternSchema = external_exports.string().max(SYSTEM_OWNED_PATTERN_MAX, { message: `must be at most ${SYSTEM_OWNED_PATTERN_MAX} characters` }).refine((v) => !hasEmptySegment(v), {
+  message: "must not start or end with a slash, or have two slashes together"
+}).refine((v) => !hasDotSegment(v), { message: 'must not have a "." or ".." folder in it' }).refine((v) => !hasPartialDoubleStar(v), { message: '"**" must stand alone between slashes' }).refine((v) => !hasForeignCharacter(v), {
+  message: 'may use only letters, digits, ".", "_", "-" and "*" between slashes'
+}).refine((v) => !looksLikeSecret(v), {
+  message: "this path looks like a credential; list a shorter folder above it"
+});
+var systemPartSchema = external_exports.object({
+  id: systemPartIdSchema,
+  name: descriptionText(SYSTEM_PART_NAME_MAX),
+  description: descriptionText(SYSTEM_PART_DESCRIPTION_MAX),
+  lane: systemLaneSchema,
+  slot: external_exports.number({ error: `must be a whole number from 0 to ${SYSTEM_SLOT_MAX}` }).int({ error: `must be a whole number from 0 to ${SYSTEM_SLOT_MAX}` }).min(0, { error: `must be a whole number from 0 to ${SYSTEM_SLOT_MAX}` }).max(SYSTEM_SLOT_MAX, { error: `must be a whole number from 0 to ${SYSTEM_SLOT_MAX}` }),
+  outside: external_exports.boolean(),
+  owns: external_exports.array(systemOwnedPatternSchema).max(SYSTEM_OWNS_MAX, { message: `can list at most ${SYSTEM_OWNS_MAX} paths` })
+}).strict();
+var systemConnectionSchema = external_exports.object({
+  from: systemPartIdSchema,
+  to: systemPartIdSchema,
+  kind: systemConnectionKindSchema,
+  label: descriptionText(SYSTEM_CONNECTION_LABEL_MAX)
+}).strict();
+var systemDescriptionSchema = external_exports.object({
+  format: external_exports.literal(SYSTEM_DESCRIPTION_FORMAT, { error: `must be ${SYSTEM_DESCRIPTION_FORMAT}` }),
+  parts: external_exports.array(systemPartSchema).min(1, { message: "must list at least one part" }).max(SYSTEM_PARTS_MAX, { message: `can hold at most ${SYSTEM_PARTS_MAX} parts (five lanes of twelve slots)` }),
+  connections: external_exports.array(systemConnectionSchema).max(SYSTEM_CONNECTIONS_MAX, { message: `can hold at most ${SYSTEM_CONNECTIONS_MAX} connections` })
+}).strict();
+var systemDescriptionProblemSchema = external_exports.object({
+  path: external_exports.string(),
+  message: external_exports.string()
+}).strict();
+var systemReportRecordedSchema = external_exports.object({
+  outcome: external_exports.literal("recorded"),
+  version: external_exports.number().int().min(1),
+  reportedAt: utcIso8601
+}).strict();
+var systemReportRefusedSchema = external_exports.object({
+  outcome: external_exports.literal("refused"),
+  problems: external_exports.array(systemDescriptionProblemSchema).min(1)
+}).strict();
+var systemReportUnavailableSchema = external_exports.object({
+  outcome: external_exports.literal("unavailable")
+}).strict();
+var systemReportResultSchema = external_exports.discriminatedUnion("outcome", [
+  systemReportRecordedSchema,
+  systemReportRefusedSchema,
+  systemReportUnavailableSchema
+]);
+var SYSTEM_DRAW_SVG_MAX_BYTES = 2 * 1024 * 1024;
+var SYSTEM_DRAW_MERMAID_MAX_BYTES = 256 * 1024;
+var SYSTEM_DRAW_PNG_MAX_BYTES = 8 * 1024 * 1024;
+var systemDrawArchitectureRequestSchema = external_exports.object({
+  picture: external_exports.literal("architecture"),
+  version: external_exports.number().int().min(1)
+}).strict();
+var systemDrawPhaseRequestSchema = external_exports.object({
+  picture: external_exports.literal("phase"),
+  phase: phaseIdentitySchema,
+  planVersion: external_exports.number().int().min(1)
+}).strict();
+var systemDrawRequestSchema = external_exports.discriminatedUnion("picture", [
+  systemDrawArchitectureRequestSchema,
+  systemDrawPhaseRequestSchema
+]);
+function utf8ByteLength2(text) {
+  let bytes = 0;
+  for (let i = 0; i < text.length; i++) {
+    const unit = text.charCodeAt(i);
+    if (unit < 128)
+      bytes += 1;
+    else if (unit < 2048)
+      bytes += 2;
+    else if (unit >= 55296 && unit <= 56319 && i + 1 < text.length) {
+      const next = text.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        i++;
+      } else {
+        bytes += 3;
+      }
+    } else
+      bytes += 3;
+  }
+  return bytes;
+}
+var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+function base64DecodedLength(text) {
+  const padding = text.endsWith("==") ? 2 : text.endsWith("=") ? 1 : 0;
+  return text.length / 4 * 3 - padding;
+}
+var systemPictureSchema = external_exports.object({
+  svg: external_exports.string().min(1).refine((v) => utf8ByteLength2(v) <= SYSTEM_DRAW_SVG_MAX_BYTES, { message: "the picture is larger than 2 MB" }),
+  png: external_exports.string().min(1).refine((v) => v.length % 4 === 0 && BASE64.test(v), { message: "the image is not valid base64" }).refine((v) => base64DecodedLength(v) <= SYSTEM_DRAW_PNG_MAX_BYTES, { message: "the image is larger than 8 MB" })
+}).strict();
+var systemDrawRefusedSchema = external_exports.object({
+  outcome: external_exports.literal("refused"),
+  reason: external_exports.string().min(1)
+}).strict();
+var systemDrawUnavailableSchema = external_exports.object({
+  outcome: external_exports.literal("unavailable")
+}).strict();
+
+// ../events/dist/phase-plan.js
+var PHASE_PLAN_FORMAT = 1;
+var PHASE_PLAN_CHANGES_MAX = 60;
+var PHASE_PLAN_SUMMARY_MAX = 160;
+var SCOPE_NOTE_MAX = 500;
+var PHASE_PLAN_PHASE_MAX = buildPhaseSchema.maxLength ?? 0;
+var PHASE_PLAN_CHANGE_KINDS = ["add", "change", "remove"];
+var phasePlanChangeSchema = external_exports.enum(PHASE_PLAN_CHANGE_KINDS, {
+  error: `must be one of ${PHASE_PLAN_CHANGE_KINDS.join(", ")}`
+});
+var phasePlanPhaseSchema = phaseIdentitySchema.refine((v) => !isValidPhaseIdentity(v) || buildPhaseSchema.safeParse(String(v)).success, { message: `must be at most ${PHASE_PLAN_PHASE_MAX} characters` });
+var phasePlanSummarySchema = descriptionText(PHASE_PLAN_SUMMARY_MAX);
+var phasePlanEntrySchema = external_exports.object({
+  part: systemPartIdSchema,
+  change: phasePlanChangeSchema,
+  summary: phasePlanSummarySchema
+}).strict();
+var phasePlanSchema = external_exports.object({
+  format: external_exports.literal(PHASE_PLAN_FORMAT, { error: `must be ${PHASE_PLAN_FORMAT}` }),
+  phase: phasePlanPhaseSchema,
+  changes: external_exports.array(phasePlanEntrySchema).min(1, { message: "must list at least one part" }).max(PHASE_PLAN_CHANGES_MAX, { message: `can list at most ${PHASE_PLAN_CHANGES_MAX} parts` })
+}).strict();
+var scopePhaseSchema = buildPhaseSchema.refine((v) => isValidPhaseIdentity(v), {
+  message: "must be a phase name"
+});
+var SCOPE_STATE_NAMES = [
+  "not-planned",
+  "waiting",
+  "sent-back",
+  "approved",
+  "partly-stale",
+  "withdrawn"
+];
+var scopeStateNameSchema = external_exports.enum(SCOPE_STATE_NAMES);
+var plannedScopeStateSchema = scopeStateNameSchema.exclude(["not-planned"]);
+var SCOPE_PART_STATUSES = ["approved", "waiting"];
+var scopePartStatusSchema = external_exports.enum(SCOPE_PART_STATUSES);
+var SCOPE_ACTS = ["approve", "send-back", "withdraw"];
+var scopeActSchema = external_exports.enum(SCOPE_ACTS);
+var SCOPE_GIVEN_IN = ["console", "chat"];
+var scopeGivenInSchema = external_exports.enum(SCOPE_GIVEN_IN);
+var scopeNoteSchema = descriptionText(SCOPE_NOTE_MAX);
+var scopeNoteWireSchema = external_exports.string().max(SCOPE_NOTE_MAX);
+var SCOPE_PART_VERDICTS = ["ok", "change"];
+var scopePartVerdictSchema = external_exports.enum(SCOPE_PART_VERDICTS);
+var scopeDecisionPartSchema = external_exports.object({
+  part: systemPartIdSchema,
+  verdict: scopePartVerdictSchema,
+  note: scopeNoteWireSchema.optional()
+}).strict();
+var planVersionSchema = external_exports.number().int().min(1);
+var phasePlanRequestSchema = external_exports.object({
+  descriptionVersion: external_exports.number().int().min(1),
+  plan: external_exports.unknown()
+}).strict();
+var phasePlanRecordedSchema = external_exports.object({
+  outcome: external_exports.literal("recorded"),
+  version: planVersionSchema,
+  phaseNumber: external_exports.number().int().min(1),
+  state: plannedScopeStateSchema,
+  changedParts: external_exports.array(systemPartIdSchema).max(PHASE_PLAN_CHANGES_MAX),
+  typedApprovalOffered: external_exports.boolean(),
+  reportedAt: utcIso8601
+}).strict();
+var phasePlanRefusedSchema = external_exports.object({
+  outcome: external_exports.literal("refused"),
+  problems: external_exports.array(systemDescriptionProblemSchema).min(1)
+}).strict();
+var phasePlanUnavailableSchema = external_exports.object({
+  outcome: external_exports.literal("unavailable")
+}).strict();
+var phasePlanResultSchema = external_exports.discriminatedUnion("outcome", [
+  phasePlanRecordedSchema,
+  phasePlanRefusedSchema,
+  phasePlanUnavailableSchema
+]);
+var scopeApproveRequestSchema = external_exports.object({
+  act: external_exports.literal("approve"),
+  planVersion: planVersionSchema,
+  parts: external_exports.array(scopeDecisionPartSchema).max(PHASE_PLAN_CHANGES_MAX)
+}).strict();
+var scopeSendBackRequestSchema = external_exports.object({
+  act: external_exports.literal("send-back"),
+  planVersion: planVersionSchema,
+  parts: external_exports.array(scopeDecisionPartSchema).max(PHASE_PLAN_CHANGES_MAX),
+  note: scopeNoteWireSchema.optional()
+}).strict();
+var scopeWithdrawRequestSchema = external_exports.object({
+  act: external_exports.literal("withdraw"),
+  planVersion: planVersionSchema
+}).strict();
+var scopeDecisionRequestSchema = external_exports.discriminatedUnion("act", [
+  scopeApproveRequestSchema,
+  scopeSendBackRequestSchema,
+  scopeWithdrawRequestSchema
+]);
+var scopeDecisionRecordedSchema = external_exports.object({
+  outcome: external_exports.literal("recorded"),
+  act: scopeActSchema,
+  phase: scopePhaseSchema,
+  planVersion: planVersionSchema,
+  state: plannedScopeStateSchema,
+  decidedAt: utcIso8601
+}).strict();
+var scopeDecisionAlreadyApprovedSchema = external_exports.object({
+  outcome: external_exports.literal("already-approved"),
+  replanNeeded: external_exports.boolean(),
+  reason: external_exports.string().min(1)
+}).strict();
+var scopeDecisionRefusedSchema = external_exports.object({
+  outcome: external_exports.literal("refused"),
+  problems: external_exports.array(systemDescriptionProblemSchema).min(1)
+}).strict();
+var scopeDecisionUnavailableSchema = external_exports.object({
+  outcome: external_exports.literal("unavailable")
+}).strict();
+function reasonOutcome(outcome) {
+  return external_exports.object({ outcome: external_exports.literal(outcome), reason: external_exports.string().min(1) }).strict();
+}
+var scopeDecisionResultSchema = external_exports.discriminatedUnion("outcome", [
+  scopeDecisionRecordedSchema,
+  scopeDecisionAlreadyApprovedSchema,
+  scopeDecisionRefusedSchema,
+  scopeDecisionUnavailableSchema,
+  reasonOutcome("not-owner"),
+  reasonOutcome("no-owner"),
+  reasonOutcome("plan-changed"),
+  reasonOutcome("nothing-to-withdraw"),
+  reasonOutcome("build-started")
+]);
+var scopeReadPartSchema = external_exports.object({
+  part: systemPartIdSchema,
+  name: systemPartSchema.shape.name,
+  change: phasePlanChangeSchema,
+  summary: phasePlanSummarySchema,
+  status: scopePartStatusSchema,
+  changed: external_exports.boolean()
+}).strict();
+var scopeReadDecisionSchema = external_exports.object({
+  act: scopeActSchema,
+  planVersion: planVersionSchema,
+  givenIn: scopeGivenInSchema,
+  at: utcIso8601,
+  parts: external_exports.array(scopeDecisionPartSchema).max(PHASE_PLAN_CHANGES_MAX),
+  note: scopeNoteWireSchema.optional()
+}).strict();
+var scopeReadNotPlannedSchema = external_exports.object({
+  phase: scopePhaseSchema,
+  state: external_exports.literal("not-planned"),
+  canDecide: external_exports.boolean()
+}).strict();
+var scopeReadPlannedSchema = external_exports.object({
+  phase: scopePhaseSchema,
+  state: plannedScopeStateSchema,
+  phaseNumber: external_exports.number().int().min(1),
+  planVersion: planVersionSchema,
+  parts: external_exports.array(scopeReadPartSchema).min(1).max(PHASE_PLAN_CHANGES_MAX),
+  decisions: external_exports.array(scopeReadDecisionSchema),
+  canDecide: external_exports.boolean(),
+  replanLine: external_exports.string().min(1).optional()
+}).strict();
+var scopeReadSchema = external_exports.union([scopeReadNotPlannedSchema, scopeReadPlannedSchema]);
+
+// ../events/dist/client-version.js
+var CLIENT_VERSION_HEADER = "x-halfcycle-client";
+var TYPED_APPROVAL_OFF_SENTENCE = "Approving by typing is switched off for now.";
+var CLIENT_UPDATE_SENTENCE = `To approve by typing in a session, Halfcycle needs updating: run \`${HALFCYCLE_COMMAND}\` in this project's folder, then reopen your session and ask again.`;
+
+// ../events/dist/scope-notices.js
+var scopePartNameSchema = external_exports.string().min(1).max(SYSTEM_PART_NAME_MAX);
+var scopeNoteEntrySchema = external_exports.object({
+  part: scopePartNameSchema.optional(),
+  note: external_exports.string().min(1).max(SCOPE_NOTE_MAX)
+}).strict();
+var scopeSentBackSchema = external_exports.object({
+  phase: scopePhaseSchema,
+  number: external_exports.number().int().min(1),
+  notes: external_exports.array(scopeNoteEntrySchema).min(1).max(PHASE_PLAN_CHANGES_MAX + 1)
+}).strict().superRefine((entry, ctx) => {
+  entry.notes.forEach((n, i) => {
+    if (n.part === void 0 && i !== entry.notes.length - 1) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["notes", i],
+        message: "the note on the whole phase comes after every note on a part"
+      });
+    }
+  });
+});
+var scopeWaitingSchema = external_exports.object({
+  phase: scopePhaseSchema,
+  number: external_exports.number().int().min(1),
+  changedParts: external_exports.array(scopePartNameSchema).max(PHASE_PLAN_CHANGES_MAX)
+}).strict();
+var scopeNoticesSchema = external_exports.object({
+  sentBack: external_exports.array(scopeSentBackSchema),
+  waiting: external_exports.array(scopeWaitingSchema),
+  typedApprovalOffered: external_exports.boolean()
+}).strict().refine((v) => v.sentBack.length > 0 || v.waiting.length > 0, {
+  message: "carried only when a phase was sent back or waits for the owner"
+});
+function quotedParts(parts) {
+  return parts.map((p) => `"${p}"`).join(", ");
+}
+function approvalSentence(phase, offerTyping) {
+  if (offerTyping === "off")
+    return TYPED_APPROVAL_OFF_SENTENCE;
+  if (offerTyping === "update")
+    return CLIENT_UPDATE_SENTENCE;
+  return `In their own Claude Code session, they ask to see the plan, check each part, and then type: approve ${phase}`;
+}
+function sentBackNotice(entry) {
+  return [
+    `Before anything else: the project's owner sent the scope of phase ${entry.number}, "${entry.phase}", back with these notes.`,
+    ...entry.notes.map((n) => n.part === void 0 ? `- ${n.note}` : `- "${n.part}": ${n.note}`),
+    `Change the plan to answer every note, then send it again with \`${HALFCYCLE_COMMAND} plan ${quoteForShell(entry.phase)}\`.`
+  ].join("\n");
+}
+function waitingNotice(entry, offerTyping) {
+  return [
+    ...entry.changedParts.length > 0 ? [`These parts changed since the owner last decided on this phase, and wait for their approval: ${quotedParts(entry.changedParts)}.`] : [],
+    `The scope of phase ${entry.number}, "${entry.phase}", is waiting for the project's owner to approve it.`,
+    approvalSentence(entry.phase, offerTyping)
+  ].join(" ");
+}
+function scopeNoticeText(scope, options) {
+  const omit2 = options.omitActivePhase === true ? options.activePhase : void 0;
+  return {
+    sentBack: scope.sentBack.map(sentBackNotice),
+    waiting: scope.waiting.filter((w) => omit2 === void 0 || w.phase !== omit2).map((w) => waitingNotice(w, options.offerTyping))
+  };
+}
+
 // ../events/dist/credential-wire.js
 var engagementCredentialResponseSchema = external_exports.object({
   engagementId: external_exports.string(),
@@ -15324,12 +16115,60 @@ var NOT_THIS_ACCOUNT_SENTENCE = `Halfcycle is not connected: this project belong
 var UPDATE_CLAUDE_CODE_SENTENCE = "Halfcycle is not connected: this Claude Code version does not name the server it connects to, so no credential was sent. Update Claude Code, then reopen.";
 var CANNOT_REACH_SENTENCE = "Halfcycle is not connected: its server could not be reached, so its tools are unavailable in this session. Check your network, then reopen the project.";
 var SERVICE_PROBLEM_SENTENCE = "Halfcycle is not connected: its service had a problem just now, so nothing in this session is being checked. Reopen the project to try again.";
+var SCOPE_UNCHECKED_SENTENCE = "If this project needs approval before building, that cannot be checked either, so work done now shows as built without approval unless already approved.";
 var PLACEHOLDER_SENTENCES = Object.freeze({
   [NO_CREDENTIAL_PLACEHOLDER]: NO_CREDENTIAL_SENTENCE,
   [NOT_THIS_ACCOUNT_PLACEHOLDER]: NOT_THIS_ACCOUNT_SENTENCE,
   [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
 });
 
+// ../events/dist/scope-chat.js
+var chatScopeApproveRequestSchema = external_exports.object({
+  act: external_exports.literal("approve"),
+  reference: phaseIdentitySchema,
+  planVersion: planVersionSchema
+}).strict();
+var chatScopeSendBackRequestSchema = external_exports.object({
+  act: external_exports.literal("send-back"),
+  reference: phaseIdentitySchema,
+  planVersion: planVersionSchema,
+  note: scopeNoteWireSchema.optional()
+}).strict();
+var chatScopeRequestSchema = external_exports.discriminatedUnion("act", [
+  chatScopeApproveRequestSchema,
+  chatScopeSendBackRequestSchema
+]);
+var CHAT_SCOPE_ACTS = ["approve", "send-back"];
+var chatScopeRecordedSchema = external_exports.object({
+  outcome: external_exports.literal("recorded"),
+  act: external_exports.enum(CHAT_SCOPE_ACTS),
+  phase: scopePhaseSchema,
+  planVersion: planVersionSchema
+}).strict();
+var chatScopeAlreadyApprovedSchema = external_exports.object({
+  outcome: external_exports.literal("already-approved"),
+  replanNeeded: external_exports.boolean()
+}).strict();
+var chatScopeRefusedSchema = external_exports.object({
+  outcome: external_exports.literal("refused"),
+  problems: external_exports.array(systemDescriptionProblemSchema).min(1)
+}).strict();
+function bareOutcome(outcome) {
+  return external_exports.object({ outcome: external_exports.literal(outcome) }).strict();
+}
+var chatScopeResultSchema = external_exports.discriminatedUnion("outcome", [
+  chatScopeRecordedSchema,
+  chatScopeAlreadyApprovedSchema,
+  chatScopeRefusedSchema,
+  bareOutcome("show-first"),
+  bareOutcome("plan-changed"),
+  bareOutcome("build-started"),
+  bareOutcome("not-owner"),
+  bareOutcome("no-owner"),
+  bareOutcome("not-offered"),
+  bareOutcome("unavailable")
+]);
+
 // dist/hook-protocol.js
 import { writeSync } from "node:fs";
 function emitBlock(reason) {
@@ -15915,16 +16754,16 @@ function detectEnvReads(diffContent, jsComments) {
     if (raw.startsWith("-") && !raw.startsWith("---"))
       continue;
     const isSource = raw.startsWith("+") && !raw.startsWith("+++") || raw.startsWith(" ");
-    const line = jsComments && isSource ? raw.slice(1) : raw;
-    const comment = jsComments && isSource ? commentedOut(line) : void 0;
+    const line2 = jsComments && isSource ? raw.slice(1) : raw;
+    const comment = jsComments && isSource ? commentedOut(line2) : void 0;
     const live = (match) => comment === void 0 || !comment(match.index, match.index + match[0].length);
-    for (const match of line.matchAll(dotPattern))
+    for (const match of line2.matchAll(dotPattern))
       if (live(match))
         found.add(match[1]);
-    for (const match of line.matchAll(bracketPattern))
+    for (const match of line2.matchAll(bracketPattern))
       if (live(match))
         found.add(match[1]);
-    for (const destructure of line.matchAll(destructurePattern)) {
+    for (const destructure of line2.matchAll(destructurePattern)) {
       if (!live(destructure))
         continue;
       for (const part of destructure[1].split(",")) {
@@ -15937,25 +16776,25 @@ function detectEnvReads(diffContent, jsComments) {
   return found;
 }
 var LINE_TERMINATOR = /[\r\u2028\u2029]/g;
-function commentedOut(line) {
-  const lead = line.length - line.trimStart().length;
+function commentedOut(line2) {
+  const lead = line2.length - line2.trimStart().length;
   let body;
   let close;
   let expression;
-  if (line.startsWith("//", lead)) {
+  if (line2.startsWith("//", lead)) {
     body = lead + 2;
     LINE_TERMINATOR.lastIndex = body;
-    close = LINE_TERMINATOR.exec(line)?.index ?? line.length;
+    close = LINE_TERMINATOR.exec(line2)?.index ?? line2.length;
     expression = "{";
-  } else if (line.startsWith("/*", lead) || line.startsWith("{/*", lead)) {
-    body = lead + (line[lead] === "{" ? 3 : 2);
-    const found = line.indexOf("*/", body);
-    close = found === -1 ? line.length : found;
-    expression = line[lead] === "{" ? "${" : "{";
+  } else if (line2.startsWith("/*", lead) || line2.startsWith("{/*", lead)) {
+    body = lead + (line2[lead] === "{" ? 3 : 2);
+    const found = line2.indexOf("*/", body);
+    close = found === -1 ? line2.length : found;
+    expression = line2[lead] === "{" ? "${" : "{";
   } else {
     return void 0;
   }
-  const opened = line.indexOf(expression, body);
+  const opened = line2.indexOf(expression, body);
   return (start, end) => start >= body && end <= close && (opened === -1 || opened >= start || opened >= close);
 }
 function collectDeclarationFiles(context) {
@@ -16034,8 +16873,8 @@ function flyTomlSectionHas(name, content, sectionHeader) {
   const lines = content.split("\n");
   let inSection = false;
   const keyPattern = new RegExp(`^${name}\\s*=`);
-  for (const line of lines) {
-    const trimmed = line.trim();
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
     if (trimmed === sectionHeader) {
       inSection = true;
       continue;
@@ -16086,10 +16925,10 @@ function extractSqlWrites(diffContent) {
     seen.add(key);
     writes.push(write);
   };
-  for (const line of diffContent.split("\n")) {
-    if (isRemovedLine(line) || isContextLine(line) || isDiffHeader(line))
+  for (const line2 of diffContent.split("\n")) {
+    if (isRemovedLine(line2) || isContextLine(line2) || isDiffHeader(line2))
       continue;
-    const code = stripComments(stripDiffPrefix(line));
+    const code = stripComments(stripDiffPrefix(line2));
     push(parseRawSql(code));
     push(parseQueryBuilder(code));
     push(parseOrmCall(code));
@@ -16099,23 +16938,23 @@ function extractSqlWrites(diffContent) {
   }
   return writes;
 }
-function isRemovedLine(line) {
-  return line.startsWith("-") && !line.startsWith("---");
+function isRemovedLine(line2) {
+  return line2.startsWith("-") && !line2.startsWith("---");
 }
-function isContextLine(line) {
-  return line.startsWith(" ");
+function isContextLine(line2) {
+  return line2.startsWith(" ");
 }
-function isDiffHeader(line) {
-  return line.startsWith("+++") || line.startsWith("---");
+function isDiffHeader(line2) {
+  return line2.startsWith("+++") || line2.startsWith("---");
 }
-function stripDiffPrefix(line) {
-  if (line.startsWith("+") && !line.startsWith("+++"))
-    return line.slice(1);
-  if (line.startsWith("-") && !line.startsWith("---"))
-    return line.slice(1);
-  if (line.startsWith(" "))
-    return line.slice(1);
-  return line;
+function stripDiffPrefix(line2) {
+  if (line2.startsWith("+") && !line2.startsWith("+++"))
+    return line2.slice(1);
+  if (line2.startsWith("-") && !line2.startsWith("---"))
+    return line2.slice(1);
+  if (line2.startsWith(" "))
+    return line2.slice(1);
+  return line2;
 }
 function assembleStatements(diffContent) {
   const statements = [];
@@ -16128,16 +16967,16 @@ function assembleStatements(diffContent) {
     buffer = [];
     hasAddedLine = false;
   };
-  for (const line of diffContent.split("\n")) {
-    if (line.startsWith("@@") || isDiffHeader(line)) {
+  for (const line2 of diffContent.split("\n")) {
+    if (line2.startsWith("@@") || isDiffHeader(line2)) {
       flush(true);
       continue;
     }
-    if (isRemovedLine(line)) {
+    if (isRemovedLine(line2)) {
       flush(false);
       continue;
     }
-    const rawContent = stripDiffPrefix(line);
+    const rawContent = stripDiffPrefix(line2);
     if (rawContent.trim() === "") {
       flush(true);
       continue;
@@ -16145,7 +16984,7 @@ function assembleStatements(diffContent) {
     const content = stripComments(rawContent);
     if (content.trim() === "")
       continue;
-    if (line.startsWith("+"))
+    if (line2.startsWith("+"))
       hasAddedLine = true;
     buffer.push(content.trim());
     if (content.includes(";"))
@@ -16162,44 +17001,44 @@ function normaliseTable(raw) {
   return name.toLowerCase();
 }
 var TABLE_IDENT = String.raw`((?:"[^"]+"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\.(?:"[^"]+"|[a-zA-Z_][a-zA-Z0-9_]*))?)`;
-function parseRawSql(line) {
-  if (/\bON\s+CONFLICT\b/i.test(line)) {
-    const m = line.match(new RegExp(String.raw`INSERT\s+INTO\s+${TABLE_IDENT}`, "i"));
+function parseRawSql(line2) {
+  if (/\bON\s+CONFLICT\b/i.test(line2)) {
+    const m = line2.match(new RegExp(String.raw`INSERT\s+INTO\s+${TABLE_IDENT}`, "i"));
     if (m)
       return { kind: "upsert", table: normaliseTable(m[1]), whereColumns: [] };
   }
-  const upsertM = line.match(new RegExp(String.raw`UPSERT\s+INTO\s+${TABLE_IDENT}`, "i"));
+  const upsertM = line2.match(new RegExp(String.raw`UPSERT\s+INTO\s+${TABLE_IDENT}`, "i"));
   if (upsertM)
     return { kind: "upsert", table: normaliseTable(upsertM[1]), whereColumns: [] };
-  const insertM = line.match(new RegExp(String.raw`INSERT\s+INTO\s+${TABLE_IDENT}`, "i"));
+  const insertM = line2.match(new RegExp(String.raw`INSERT\s+INTO\s+${TABLE_IDENT}`, "i"));
   if (insertM)
     return { kind: "insert", table: normaliseTable(insertM[1]), whereColumns: [] };
-  const updateM = line.match(new RegExp(String.raw`\bUPDATE\s+${TABLE_IDENT}\s+[\s\S]*?\bSET\b`, "i"));
+  const updateM = line2.match(new RegExp(String.raw`\bUPDATE\s+${TABLE_IDENT}\s+[\s\S]*?\bSET\b`, "i"));
   if (updateM) {
     return {
       kind: "update",
       table: normaliseTable(updateM[1]),
-      whereColumns: extractWhereColumns(line)
+      whereColumns: extractWhereColumns(line2)
     };
   }
-  const deleteM = line.match(new RegExp(String.raw`DELETE\s+FROM\s+${TABLE_IDENT}`, "i"));
+  const deleteM = line2.match(new RegExp(String.raw`DELETE\s+FROM\s+${TABLE_IDENT}`, "i"));
   if (deleteM) {
     return {
       kind: "delete",
       table: normaliseTable(deleteM[1]),
-      whereColumns: extractWhereColumns(line)
+      whereColumns: extractWhereColumns(line2)
     };
   }
   return null;
 }
 function parseQueryBuilder(rawLine) {
-  const line = stripDiffPrefix(rawLine);
-  const m = line.match(/(?<!\bcreate(?:Hash|Hmac|Sign|Verify|Cipheriv|Decipheriv)\s*\([^)]*)['"]([\w]+)['"]\s*\)\s*\.(insert|update|upsert|delete)\s*\(/i);
+  const line2 = stripDiffPrefix(rawLine);
+  const m = line2.match(/(?<!\bcreate(?:Hash|Hmac|Sign|Verify|Cipheriv|Decipheriv)\s*\([^)]*)['"]([\w]+)['"]\s*\)\s*\.(insert|update|upsert|delete)\s*\(/i);
   if (m) {
     const kind = m[2].toLowerCase();
     return { kind, table: m[1].toLowerCase(), whereColumns: [] };
   }
-  const fromM = line.match(/\.(?:from|into|table)\s*\(\s*['"]([\w]+)['"]\s*\)\s*\.(insert|update|upsert|delete)\s*\(/i);
+  const fromM = line2.match(/\.(?:from|into|table)\s*\(\s*['"]([\w]+)['"]\s*\)\s*\.(insert|update|upsert|delete)\s*\(/i);
   if (fromM) {
     const kind = fromM[2].toLowerCase();
     return { kind, table: fromM[1].toLowerCase(), whereColumns: [] };
@@ -16223,11 +17062,11 @@ var TYPEORM_KIND = {
   delete: "delete"
 };
 function parseOrmCall(rawLine) {
-  const line = stripDiffPrefix(rawLine);
-  return parsePrisma(line) ?? parseTypeorm(line) ?? parseDrizzle(line);
+  const line2 = stripDiffPrefix(rawLine);
+  return parsePrisma(line2) ?? parseTypeorm(line2) ?? parseDrizzle(line2);
 }
-function parsePrisma(line) {
-  const m = line.match(/\b[\w$]+\.([a-zA-Z_$][\w$]*)\.(create|createMany|update|updateMany|upsert|delete|deleteMany)\s*\(/);
+function parsePrisma(line2) {
+  const m = line2.match(/\b[\w$]+\.([a-zA-Z_$][\w$]*)\.(create|createMany|update|updateMany|upsert|delete|deleteMany)\s*\(/);
   if (!m)
     return null;
   const kind = PRISMA_KIND[m[2].toLowerCase()];
@@ -16235,29 +17074,29 @@ function parsePrisma(line) {
     return null;
   return { kind, table: m[1].toLowerCase(), whereColumns: [] };
 }
-function parseDrizzle(line) {
-  const upd = line.match(/\b[\w$]+\.update\s*\(\s*['"]?([\w$]+)['"]?\s*\)\s*\.set\s*\(/);
+function parseDrizzle(line2) {
+  const upd = line2.match(/\b[\w$]+\.update\s*\(\s*['"]?([\w$]+)['"]?\s*\)\s*\.set\s*\(/);
   if (upd)
     return { kind: "update", table: upd[1].toLowerCase(), whereColumns: [] };
-  const ins = line.match(/\b[\w$]+\.insert\s*\(\s*['"]?([\w$]+)['"]?\s*\)/);
+  const ins = line2.match(/\b[\w$]+\.insert\s*\(\s*['"]?([\w$]+)['"]?\s*\)/);
   if (ins)
     return { kind: "insert", table: ins[1].toLowerCase(), whereColumns: [] };
-  const del = line.match(/\b[\w$]+\.delete\s*\(\s*['"]?([\w$]+)['"]?\s*\)/);
+  const del = line2.match(/\b[\w$]+\.delete\s*\(\s*['"]?([\w$]+)['"]?\s*\)/);
   if (del)
     return { kind: "delete", table: del[1].toLowerCase(), whereColumns: [] };
   return null;
 }
-function parseTypeorm(line) {
-  const qb = line.match(/\.createQueryBuilder\s*\([^)]*\)[\s\S]*?\.update\s*\(\s*([a-zA-Z_$][\w$]*)/);
+function parseTypeorm(line2) {
+  const qb = line2.match(/\.createQueryBuilder\s*\([^)]*\)[\s\S]*?\.update\s*\(\s*([a-zA-Z_$][\w$]*)/);
   if (qb)
     return { kind: "update", table: qb[1].toLowerCase(), whereColumns: [] };
-  const saveUpsert = line.match(/(?:^|[^.\w$])([a-zA-Z_$][\w$]*)\.(save|upsert)\s*\(/);
+  const saveUpsert = line2.match(/(?:^|[^.\w$])([a-zA-Z_$][\w$]*)\.(save|upsert)\s*\(/);
   if (saveUpsert) {
     const kind = TYPEORM_KIND[saveUpsert[2].toLowerCase()];
     if (kind)
       return { kind, table: saveUpsert[1].toLowerCase(), whereColumns: [] };
   }
-  const repo = line.match(/(?:^|[^.\w$])([a-zA-Z_$][\w$]*(?:repo|repository))\.(insert|update|delete)\s*\(/i);
+  const repo = line2.match(/(?:^|[^.\w$])([a-zA-Z_$][\w$]*(?:repo|repository))\.(insert|update|delete)\s*\(/i);
   if (repo) {
     const kind = TYPEORM_KIND[repo[2].toLowerCase()];
     if (kind)
@@ -16265,8 +17104,8 @@ function parseTypeorm(line) {
   }
   return null;
 }
-function extractWhereColumns(line) {
-  const whereM = line.match(/\bWHERE\s+(.+)/i);
+function extractWhereColumns(line2) {
+  const whereM = line2.match(/\bWHERE\s+(.+)/i);
   if (!whereM)
     return [];
   const fragment = whereM[1].replace(/\s+(?:ORDER|LIMIT|GROUP|HAVING)\b.*/i, "");
@@ -16282,17 +17121,17 @@ function extractSchemaConstraints(diffContent) {
   const results = [];
   const seen = /* @__PURE__ */ new Set();
   let currentTable;
-  for (const line of diffContent.split("\n")) {
-    if (line.startsWith("-") && !line.startsWith("---")) {
+  for (const line2 of diffContent.split("\n")) {
+    if (line2.startsWith("-") && !line2.startsWith("---")) {
       currentTable = void 0;
       continue;
     }
-    if (line.startsWith("@@")) {
+    if (line2.startsWith("@@")) {
       currentTable = void 0;
       continue;
     }
-    const isAdded = line.startsWith("+") && !line.startsWith("+++");
-    const raw = stripDiffPrefix2(line);
+    const isAdded = line2.startsWith("+") && !line2.startsWith("+++");
+    const raw = stripDiffPrefix2(line2);
     if (raw.trim() === "") {
       currentTable = void 0;
       continue;
@@ -16316,22 +17155,22 @@ function extractSchemaConstraints(diffContent) {
   }
   return results;
 }
-function stripDiffPrefix2(line) {
-  if (line.startsWith("+") && !line.startsWith("+++"))
-    return line.slice(1);
-  if (line.startsWith(" "))
-    return line.slice(1);
-  return line;
+function stripDiffPrefix2(line2) {
+  if (line2.startsWith("+") && !line2.startsWith("+++"))
+    return line2.slice(1);
+  if (line2.startsWith(" "))
+    return line2.slice(1);
+  return line2;
 }
-function parseConstraintLine(line, trackedTable) {
-  const alterTable = extractAlterTableName(line) ?? trackedTable ?? "unknown";
-  const createUniqueIndex = line.match(new RegExp(String.raw`CREATE\s+UNIQUE\s+INDEX\s+(?:CONCURRENTLY\s+)?(?:(?:IF\s+NOT\s+EXISTS\s+)?(\w+)\s+)?ON\s+${TABLE_IDENT2}`, "i"));
+function parseConstraintLine(line2, trackedTable) {
+  const alterTable = extractAlterTableName(line2) ?? trackedTable ?? "unknown";
+  const createUniqueIndex = line2.match(new RegExp(String.raw`CREATE\s+UNIQUE\s+INDEX\s+(?:CONCURRENTLY\s+)?(?:(?:IF\s+NOT\s+EXISTS\s+)?(\w+)\s+)?ON\s+${TABLE_IDENT2}`, "i"));
   if (createUniqueIndex) {
     const constraintName = createUniqueIndex[1] ?? void 0;
     const table = normaliseTable2(createUniqueIndex[2]);
     return { table, kind: "unique", ...constraintName ? { constraintName } : {} };
   }
-  const addConstraint = line.match(/ADD\s+CONSTRAINT\s+(\w+)\s+(CHECK|UNIQUE|FOREIGN\s+KEY)\b/i);
+  const addConstraint = line2.match(/ADD\s+CONSTRAINT\s+(\w+)\s+(CHECK|UNIQUE|FOREIGN\s+KEY)\b/i);
   if (addConstraint) {
     const constraintName = addConstraint[1];
     const kindRaw = addConstraint[2].toUpperCase();
@@ -16345,22 +17184,22 @@ function parseConstraintLine(line, trackedTable) {
     }
     return { table: alterTable, kind, constraintName };
   }
-  const addCheck = line.match(/ADD\s+CHECK\s*\(/i);
+  const addCheck = line2.match(/ADD\s+CHECK\s*\(/i);
   if (addCheck) {
     return { table: alterTable, kind: "check" };
   }
-  const addUnique = line.match(/ADD\s+UNIQUE\s*\(/i);
+  const addUnique = line2.match(/ADD\s+UNIQUE\s*\(/i);
   if (addUnique) {
     return { table: alterTable, kind: "unique" };
   }
-  const addForeignKey = line.match(/ADD\s+FOREIGN\s+KEY\s*\(/i);
+  const addForeignKey = line2.match(/ADD\s+FOREIGN\s+KEY\s*\(/i);
   if (addForeignKey) {
     return { table: alterTable, kind: "foreignKey" };
   }
   return null;
 }
-function extractAlterTableName(line) {
-  const m = line.match(new RegExp(String.raw`ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?${TABLE_IDENT2}`, "i"));
+function extractAlterTableName(line2) {
+  const m = line2.match(new RegExp(String.raw`ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?${TABLE_IDENT2}`, "i"));
   return m ? normaliseTable2(m[1]) : void 0;
 }
 var TABLE_IDENT2 = String.raw`((?:"[^"]+"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\.(?:"[^"]+"|[a-zA-Z_][a-zA-Z0-9_]*))?)`;
@@ -16381,10 +17220,10 @@ function detectBlastRadiusMarkers(filePath, diffContent) {
       markerKind: "patch-every-field-path"
     });
   }
-  for (const line of diffContent.split("\n")) {
-    if (line.startsWith("-") && !line.startsWith("---"))
+  for (const line2 of diffContent.split("\n")) {
+    if (line2.startsWith("-") && !line2.startsWith("---"))
       continue;
-    const symbolMatch = line.match(/\bUPDATABLE_FIELDS(?:_FOR_(\w+))?\b/);
+    const symbolMatch = line2.match(/\bUPDATABLE_FIELDS(?:_FOR_(\w+))?\b/);
     if (symbolMatch) {
       const table = symbolMatch[1] ? symbolMatch[1].toLowerCase() : "unknown";
       markers.push({ table, markerKind: "updatable-fields-symbol" });
@@ -16398,10 +17237,10 @@ import { readFileSync as readFileSync2, readdirSync } from "node:fs";
 import { join } from "node:path";
 function extractNumericColumns(diffContent, context = {}) {
   const addedLines = [];
-  for (const line of diffContent.split("\n")) {
-    if (line.startsWith("-") && !line.startsWith("---"))
+  for (const line2 of diffContent.split("\n")) {
+    if (line2.startsWith("-") && !line2.startsWith("---"))
       continue;
-    addedLines.push(stripDiffPrefix3(line));
+    addedLines.push(stripDiffPrefix3(line2));
   }
   const columnDecls = extractColumnDeclarations(addedLines);
   if (columnDecls.length === 0)
@@ -16480,19 +17319,19 @@ function walkForRegistrations(dir, repoRoot, acc) {
       acc.add(m[1]);
   }
 }
-function stripDiffPrefix3(line) {
-  if (line.startsWith("+") && !line.startsWith("+++"))
-    return line.slice(1);
-  if (line.startsWith(" "))
-    return line.slice(1);
-  return line;
+function stripDiffPrefix3(line2) {
+  if (line2.startsWith("+") && !line2.startsWith("+++"))
+    return line2.slice(1);
+  if (line2.startsWith(" "))
+    return line2.slice(1);
+  return line2;
 }
 function extractColumnDeclarations(lines) {
   const decls = [];
   let currentTable = null;
   let insideCreateTable = false;
-  for (const line of lines) {
-    const trimmed = line.trim();
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
     const alterAdd = trimmed.match(/ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(\w+)\s+ADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?(\w+)\s+(NUMERIC|BIGINT|DECIMAL)(?:\s*\([^)]*\))?/i);
     if (alterAdd) {
       const table = alterAdd[1].toLowerCase();
@@ -16519,8 +17358,8 @@ function extractColumnDeclarations(lines) {
   }
   return decls;
 }
-function checkInlineColumn(line, table, decls) {
-  const colMatch = line.match(/^\s*(\w+)\s+(NUMERIC|BIGINT|DECIMAL)(?:\s*\([^)]*\))?(?:\s|,|$)/i);
+function checkInlineColumn(line2, table, decls) {
+  const colMatch = line2.match(/^\s*(\w+)\s+(NUMERIC|BIGINT|DECIMAL)(?:\s*\([^)]*\))?(?:\s|,|$)/i);
   if (colMatch) {
     const name = colMatch[1].toUpperCase();
     if (SQL_KEYWORDS.has(name))
@@ -16559,8 +17398,8 @@ function resolveWireFields(lines, decls) {
     existing.push(decl);
     colToDecls.set(decl.column, existing);
   }
-  for (const line of lines) {
-    const trimmed = line.trim();
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
     const assignment = trimmed.match(/^(\w+)\s*:\s*(?:\w+\.)?(\w+)\s*[,;]?\s*(?:\/\/.*)?$/);
     if (assignment) {
       const wireField = assignment[1];
@@ -16678,10 +17517,10 @@ function extractThirdPartyEndpoints(diffContent, context = {}) {
 }
 function detectEndpointMarkers(diffContent) {
   const detected = [];
-  for (const line of diffContent.split("\n")) {
-    if (line.startsWith("-") && !line.startsWith("---"))
+  for (const line2 of diffContent.split("\n")) {
+    if (line2.startsWith("-") && !line2.startsWith("---"))
       continue;
-    const stripped = stripDiffPrefix4(line).trim();
+    const stripped = stripDiffPrefix4(line2).trim();
     const decoratorSimple = stripped.match(/@ThirdParty(?:Endpoint)?\s*\(\s*['"]([^'"]+)['"]\s*\)/);
     if (decoratorSimple) {
       detected.push({ signature: decoratorSimple[1] });
@@ -16728,12 +17567,12 @@ function detectEndpointMarkers(diffContent) {
   }
   return detected;
 }
-function stripDiffPrefix4(line) {
-  if (line.startsWith("+") && !line.startsWith("+++"))
-    return line.slice(1);
-  if (line.startsWith(" "))
-    return line.slice(1);
-  return line;
+function stripDiffPrefix4(line2) {
+  if (line2.startsWith("+") && !line2.startsWith("+++"))
+    return line2.slice(1);
+  if (line2.startsWith(" "))
+    return line2.slice(1);
+  return line2;
 }
 
 // dist/changeset.js
@@ -17358,6 +18197,9 @@ function writeRefreshedToken(opts) {
 // dist/credential-refresh.js
 var CONTROL_TIMEOUT_MS = 5e3;
 var CONNECTION_CHECK_DEADLINE_MS = 3e3;
+var SCOPE_NOTICE_DEADLINE_MS = 1500;
+var SESSION_START_HOOK_TIMEOUT_MS = 1e4;
+var SESSION_START_MARGIN_MS = 1500;
 var UNAUTHORIZED = 401;
 async function probeAccount(controlOrigin, credential, fetchFn = globalThis.fetch) {
   const controller = new AbortController();
@@ -17649,7 +18491,7 @@ function readSeatConfiguration(repoRoot) {
     paths: readPathStates(projectDir, repoRoot)
   };
 }
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readSettingsFile(projectDir, rel) {
@@ -17667,12 +18509,12 @@ function readSettingsFile(projectDir, rel) {
   } catch {
     return { path: rel, state: "unreadable", hooks: [] };
   }
-  if (!isPlainObject2(parsed))
+  if (!isPlainObject3(parsed))
     return { path: rel, state: "unreadable", hooks: [] };
   return { path: rel, state: "read", hooks: ourHooks(parsed["hooks"]) };
 }
 function ourHooks(hooks) {
-  if (!isPlainObject2(hooks))
+  if (!isPlainObject3(hooks))
     return [];
   const rows = [];
   const seen = /* @__PURE__ */ new Set();
@@ -17680,7 +18522,7 @@ function ourHooks(hooks) {
     if (!Array.isArray(entries))
       continue;
     for (const entry of entries) {
-      if (!isPlainObject2(entry))
+      if (!isPlainObject3(entry))
         continue;
       let matcher = null;
       if (Object.hasOwn(entry, "matcher")) {
@@ -17692,7 +18534,7 @@ function ourHooks(hooks) {
       if (!Array.isArray(commands))
         continue;
       for (const hook of commands) {
-        if (!isPlainObject2(hook))
+        if (!isPlainObject3(hook))
           continue;
         const command = hook["command"];
         if (typeof command !== "string" || !HALFCYCLE_HOOK_COMMANDS.has(command))
@@ -18138,18 +18980,233 @@ async function runStop() {
   await runSessionDiff(input, "stop");
 }
 
-// dist/resolve-engagement.js
-import { existsSync as existsSync6, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
-import { join as join8, sep as sep2 } from "node:path";
+// dist/hooks/user-prompt-submit.js
+import { readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
+import { join as join8 } from "node:path";
+
+// dist/hooks/scope-phrase.js
+var APPROVE_PREFIX = /^approve /i;
+var SEND_BACK_PREFIX = /^send back /i;
+var LINE_BREAK = /[\n\r\u000b\u000c\u0085\u2028\u2029]/;
+function scopePhraseShape(prompt) {
+  if (typeof prompt !== "string")
+    return null;
+  const line2 = prompt.trim();
+  if (LINE_BREAK.test(line2))
+    return null;
+  const approve = APPROVE_PREFIX.exec(line2);
+  if (approve)
+    return { act: "approve", rest: line2.slice(approve[0].length) };
+  const sendBack = SEND_BACK_PREFIX.exec(line2);
+  if (sendBack)
+    return { act: "send-back", rest: line2.slice(sendBack[0].length) };
+  return null;
+}
+function matchScopePhraseShape(shape, shown) {
+  if (shape.act === "approve") {
+    const entry = resolvePhaseReference(shape.rest, shown);
+    return entry === null ? { kind: "show-first", act: "approve" } : { kind: "approve", entry, reference: shape.rest };
+  }
+  for (let colon = shape.rest.lastIndexOf(":"); colon > 0; colon = shape.rest.lastIndexOf(":", colon - 1)) {
+    const reference = shape.rest.slice(0, colon);
+    const entry = resolvePhaseReference(reference, shown);
+    if (entry !== null) {
+      return { kind: "send-back", entry, reference, note: shape.rest.slice(colon + 1).trim() };
+    }
+  }
+  return { kind: "show-first", act: "send-back" };
+}
+
+// dist/hooks/user-prompt-submit-lines.js
+var TELL_THE_PERSON = "Tell the person.";
+function line(text) {
+  return `${text} ${TELL_THE_PERSON}`;
+}
+function nothingDone(act) {
+  return act === "approve" ? "Nothing was approved" : "Nothing was sent back";
+}
+function showCommand(phase) {
+  return `\`${HALFCYCLE_COMMAND} plan ${quoteForShell(phase)} --show\``;
+}
+function recordedLine(act, phase, planVersion) {
+  return act === "approve" ? line(`Approved ${phase}, plan version ${planVersion}, in your session.`) : line(`Sent ${phase} back with your note, plan version ${planVersion}, in your session. The note is given first to the next session that asks what to do.`);
+}
+function notAttendedLine(act) {
+  return line(`${nothingDone(act)}: approving or sending back by typing counts only when a person types it into an open session.`);
+}
+function notSignedInLine(act) {
+  return line(`${nothingDone(act)}: this project is not signed in on this computer. ${HOOK_REMEDY}`);
+}
+function showFirstLine(act) {
+  return line(`${nothingDone(act)}: that phase has not been listed here. List its parts first with \`${HALFCYCLE_COMMAND} plan <phase> --show\`, then type the line again.`);
+}
+function tooOldLine(act, phase) {
+  return line(`${nothingDone(act)}: ${phase} was listed an hour or more ago. List it again with ${showCommand(phase)}, then type the line again within the hour.`);
+}
+function noteNeededLine() {
+  return line("Nothing was sent back: a send-back needs a note after the colon saying what should change.");
+}
+function noteLooksSecretLine() {
+  return line("Nothing was sent back: the note looks like it holds a password or key, so it never left this computer. Type the send-back again without it.");
+}
+function noteTooLongLine() {
+  return line("Nothing was sent back: the note is too long. Shorten it and type the send-back again.");
+}
+function noteRefusedLine() {
+  return line("Nothing was sent back: the note was not accepted. Reword it in plain words and type the send-back again.");
+}
+function approveRefusedLine() {
+  return line(`${nothingDone("approve")}: Halfcycle did not accept the request. ${CLIENT_UPDATE_SENTENCE}`);
+}
+function cannotReachLine(act) {
+  return line(`${nothingDone(act)}: Halfcycle could not be reached just now. Type the line again in a minute.`);
+}
+function lineForAnswer(act, phase, answer) {
+  switch (answer.outcome) {
+    case "recorded":
+      return recordedLine(answer.act, answer.phase, answer.planVersion);
+    case "show-first":
+      return showFirstLine(act);
+    case "plan-changed":
+      return line(`${nothingDone(act)}: the plan for ${phase} changed after it was listed here. List it again with ${showCommand(phase)}, check the parts, then type the line again.`);
+    case "already-approved":
+      return answer.replanNeeded ? line(`${phase} is already approved, so nothing changed. Some parts wait because the description of the system changed since the plan was written: write the plan for ${phase} again, run ${showCommand(phase)}, then approve the new version.`) : line(`${phase} is already approved, so nothing changed.`);
+    case "build-started":
+      return line(`${nothingDone(act)}: tasks in ${phase} have started, so its scope can no longer be sent back. A built part goes back at the phase's review.`);
+    case "not-owner":
+      return line(`${nothingDone(act)}: only the project's owner can approve or send back this scope.`);
+    case "no-owner":
+      return line(`${nothingDone(act)}: this project has no owner, so nobody can approve or send back its scope.`);
+    case "not-offered":
+      return line(`${nothingDone(act)}. ${TYPED_APPROVAL_OFF_SENTENCE}`);
+    case "refused":
+      return act === "approve" ? approveRefusedLine() : noteRefusedLine();
+    case "unavailable":
+      return cannotReachLine(act);
+    default: {
+      const unreachable = answer;
+      return unreachable;
+    }
+  }
+}
+
+// dist/hooks/user-prompt-submit.js
+var CHAT_REQUEST_TIMEOUT_MS = 6e3;
+var SHOWN_ENTRY_MAX_AGE_MS = 60 * 60 * 1e3;
+async function runUserPromptSubmit(opts) {
+  let act = null;
+  try {
+    const prompt = promptOf(opts.input);
+    const shape = scopePhraseShape(prompt);
+    if (shape === null)
+      return "";
+    act = shape.act;
+    return `${await decide(shape, opts)}
+`;
+  } catch {
+    return act === null ? "" : `${cannotReachLine(act)}
+`;
+  }
+}
+async function decide(shape, opts) {
+  const { act } = shape;
+  const env = opts.env ?? process.env;
+  if (!readSessionAttended(env))
+    return notAttendedLine(act);
+  const read = readConfig(env);
+  if (read.config === null)
+    return notSignedInLine(act);
+  const { guardServiceToken, guardEngagementId } = read.config;
+  const shown = readShownPlans(guardEngagementId, opts.home);
+  const match = matchScopePhraseShape(shape, shown);
+  if (match.kind === "show-first")
+    return showFirstLine(act);
+  const { entry } = match;
+  if (!shownRecently(entry, (opts.now ?? Date.now)()))
+    return tooOldLine(act, entry.phase);
+  let candidate;
+  if (match.kind === "send-back") {
+    if (match.note === "")
+      return noteNeededLine();
+    if (!scopeNoteWireSchema.safeParse(match.note).success)
+      return noteTooLongLine();
+    if (looksLikeSecret(match.note))
+      return noteLooksSecretLine();
+    candidate = { act: "send-back", reference: match.reference, planVersion: entry.version, note: match.note };
+  } else {
+    candidate = { act: "approve", reference: match.reference, planVersion: entry.version };
+  }
+  const request = chatScopeRequestSchema.safeParse(candidate);
+  if (!request.success)
+    return showFirstLine(act);
+  return post(act, entry, request.data, guardEngagementId, guardServiceToken, env, opts.fetchFn);
+}
+function promptOf(input) {
+  try {
+    const parsed = JSON.parse(input);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+      return void 0;
+    return parsed["prompt"];
+  } catch {
+    return void 0;
+  }
+}
+function readShownPlans(engagementId, home) {
+  if (!isEngagementId(engagementId))
+    return [];
+  let text;
+  try {
+    text = readFileSync8(join8(home ?? homedir4(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, SHOWN_PLANS_FILENAME), "utf-8");
+  } catch {
+    return [];
+  }
+  return parseShownPlans(text);
+}
+function shownRecently(entry, now) {
+  const age = now - Date.parse(entry.shownAt);
+  return Number.isFinite(age) && age >= 0 && age < SHOWN_ENTRY_MAX_AGE_MS;
+}
+async function post(act, entry, request, engagementId, credential, env, fetchFn = globalThis.fetch) {
+  const url2 = `${readControlOrigin(env).origin}/engagements/${encodeURIComponent(engagementId)}/phases/${encodeURIComponent(entry.phase)}/scope/chat`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CHAT_REQUEST_TIMEOUT_MS);
+  try {
+    const response = await fetchFn(url2, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${credential}`, "Content-Type": "application/json" },
+      body: JSON.stringify(request),
+      signal: controller.signal
+    });
+    if (response.status === 401)
+      return notSignedInLine(act);
+    if (response.status === 429 || response.status >= 500)
+      return cannotReachLine(act);
+    const parsed = chatScopeResultSchema.safeParse(await response.json());
+    if (!parsed.success)
+      return cannotReachLine(act);
+    if (parsed.data.outcome === "recorded" && response.status !== 200)
+      return cannotReachLine(act);
+    return lineForAnswer(act, entry.phase, parsed.data);
+  } catch {
+    return cannotReachLine(act);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// dist/resolve-engagement.js
+import { existsSync as existsSync6, readFileSync as readFileSync9, realpathSync as realpathSync3 } from "node:fs";
+import { join as join9, sep as sep2 } from "node:path";
+import { homedir as homedir5 } from "node:os";
 function defaultRegistryPath() {
-  return join8(homedir4(), ".halfcycle", "registry.json");
+  return join9(homedir5(), ".halfcycle", "registry.json");
 }
 function readRegistry(registryPath = defaultRegistryPath()) {
   if (!existsSync6(registryPath))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync8(registryPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync9(registryPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const out = {};
@@ -18197,18 +19254,21 @@ function runResolveEngagement(cwd, registryPath) {
 }
 
 // dist/refresh-credential.js
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 
 // dist/mcp-headers.js
-import { readFileSync as readFileSync9 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { readFileSync as readFileSync10 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
 import { dirname as dirname4, resolve as resolve2 } from "node:path";
 function defaultWriteErr(text) {
   process.stderr.write(text);
 }
-function headerLine(bearer) {
-  return `${JSON.stringify({ Authorization: `Bearer ${bearer}` })}
+function headerLine(bearer, clientVersion) {
+  const header = { Authorization: `Bearer ${bearer}` };
+  if (clientVersion !== void 0)
+    header[CLIENT_VERSION_HEADER] = clientVersion;
+  return `${JSON.stringify(header)}
 `;
 }
 function projectRootFromBinary(binaryPath) {
@@ -18218,7 +19278,7 @@ function projectRootFromBinary(binaryPath) {
 function readPinnedId(root) {
   let raw;
   try {
-    raw = readFileSync9(resolve2(root, BUNDLE_PIN_REL), "utf-8");
+    raw = readFileSync10(resolve2(root, BUNDLE_PIN_REL), "utf-8");
   } catch {
     return { problem: "no-pin" };
   }
@@ -18231,6 +19291,22 @@ function readPinnedId(root) {
   const id = typeof pin === "object" && pin !== null ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
   return typeof id === "string" && id !== "" ? { id } : { problem: "no-id" };
 }
+function readPinnedVersion(root) {
+  let raw;
+  try {
+    raw = readFileSync10(resolve2(root, BUNDLE_PIN_REL), "utf-8");
+  } catch {
+    return void 0;
+  }
+  let pin;
+  try {
+    pin = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const version2 = typeof pin === "object" && pin !== null ? pin["version"] : void 0;
+  return typeof version2 === "string" && version2 !== "" ? version2 : void 0;
+}
 function resolveStore(root, home) {
   const pinned = readPinnedId(root);
   if ("problem" in pinned)
@@ -18255,7 +19331,7 @@ function shownUrl(url2) {
   return url2.replace(/[^\x21-\x7e]/g, "").slice(0, 200);
 }
 function sentences(lines) {
-  return lines.map((line) => `halfcycle: ${line}
+  return lines.map((line2) => `halfcycle: ${line2}
 `).join("");
 }
 function badIdSentence(root) {
@@ -18312,7 +19388,7 @@ async function refreshWithinDeadline(source, opts, writeErr) {
 }
 async function chooseBearer(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr;
-  const home = opts.home ?? homedir5();
+  const home = opts.home ?? homedir6();
   const root = projectRootFromBinary(opts.binaryPath);
   const environmentToken = opts.environmentTokenFirst ? readEnvironmentToken() : void 0;
   const store = resolveStore(root, home);
@@ -18376,6 +19452,7 @@ async function chooseBearer(opts) {
 }
 async function mcpHeaders(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr;
+  const root = projectRootFromBinary(opts.binaryPath);
   try {
     return headerLine(await chooseBearer({
       ...opts,
@@ -18383,7 +19460,7 @@ async function mcpHeaders(opts) {
       requestedUrl: readMcpServerUrl(),
       renewal: "renew-here",
       environmentTokenFirst: true
-    }));
+    }), readPinnedVersion(root));
   } catch (err) {
     try {
       writeErr(sentences([
@@ -18391,9 +19468,9 @@ async function mcpHeaders(opts) {
         `run "npx halfcycle" in this repository to rewrite this machine's credential.`
       ]));
     } catch {
-      return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+      return headerLine(NO_CREDENTIAL_PLACEHOLDER, readPinnedVersion(root));
     }
-    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+    return headerLine(NO_CREDENTIAL_PLACEHOLDER, readPinnedVersion(root));
   }
 }
 
@@ -18441,7 +19518,7 @@ var INITIALIZE_BODY = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initializ
 function registeredMcpUrl(projectRoot) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync10(resolve3(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
+    parsed = JSON.parse(readFileSync11(resolve3(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
   } catch {
     return void 0;
   }
@@ -18535,16 +19612,83 @@ async function checkConnection(renewedToken, opts) {
     environmentTokenFirst: false
   });
   if (CREDENTIAL_PLACEHOLDERS.includes(bearer)) {
-    return PLACEHOLDER_SENTENCES[bearer];
+    return { sentence: PLACEHOLDER_SENTENCES[bearer], url: url2, bearer };
   }
   const outcome = await probeDelivery(url2, bearer, opts.fetchFn ?? globalThis.fetch, opts.checkDeadlineMs ?? CONNECTION_CHECK_DEADLINE_MS);
-  return outcome ?? CONNECTED_SENTENCE;
+  return { sentence: outcome ?? CONNECTED_SENTENCE, url: url2, bearer };
+}
+function positionRequestBody(engagementId) {
+  return JSON.stringify({
+    jsonrpc: "2.0",
+    id: 1,
+    method: "tools/call",
+    params: { name: "halfcycle_position", arguments: { engagementId } }
+  });
+}
+async function fetchScopeNotices(url2, bearer, engagementId, fetchFn, deadlineMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deadlineMs);
+  try {
+    let res;
+    try {
+      res = await fetchFn(url2, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${bearer}` },
+        body: positionRequestBody(engagementId),
+        redirect: "manual",
+        signal: controller.signal
+      });
+    } catch {
+      return void 0;
+    }
+    if (res.status < 200 || res.status > 299) {
+      discardBody(res);
+      return void 0;
+    }
+    let text;
+    try {
+      text = await res.text();
+    } catch {
+      return void 0;
+    }
+    let rpc;
+    try {
+      rpc = JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+    const result = typeof rpc === "object" && rpc !== null ? rpc["result"] : void 0;
+    if (typeof result !== "object" || result === null || result["isError"] === true) {
+      return void 0;
+    }
+    const content = result["content"];
+    const first = Array.isArray(content) ? content[0] : void 0;
+    const bodyText = typeof first === "object" && first !== null ? first["text"] : void 0;
+    if (typeof bodyText !== "string")
+      return void 0;
+    let body;
+    try {
+      body = JSON.parse(bodyText);
+    } catch {
+      return void 0;
+    }
+    const scope = typeof body === "object" && body !== null ? body["scope"] : void 0;
+    const parsed = scopeNoticesSchema.safeParse(scope);
+    return parsed.success ? parsed.data : void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function scopeNoticeLines(scope) {
+  const text = scopeNoticeText(scope, { offerTyping: scope.typedApprovalOffered ? "yes" : "off" });
+  return [...text.sentBack, ...text.waiting];
 }
 function defaultWriteErr2(text) {
   process.stderr.write(text);
 }
 async function runRefreshCredential(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr2;
+  const startedAt = Date.now();
   try {
     const renewalSaid = [];
     let renewalOpen = true;
@@ -18558,9 +19702,24 @@ async function runRefreshCredential(opts) {
     renewalOpen = false;
     const parts = [];
     if (CHECKED_SOURCES.has(input["source"])) {
-      const outcome = await checkConnection(renewedToken, { ...opts, writeErr });
-      if (outcome !== void 0)
-        parts.push(outcome);
+      const connection = await checkConnection(renewedToken, { ...opts, writeErr });
+      if (connection !== void 0) {
+        parts.push(connection.sentence);
+        if (connection.sentence === CONNECTED_SENTENCE) {
+          const engagementId = readConfig().config?.guardEngagementId;
+          if (engagementId !== void 0) {
+            const remainingForMargin = SESSION_START_HOOK_TIMEOUT_MS - SESSION_START_MARGIN_MS - (Date.now() - startedAt);
+            const positionDeadline = Math.min(opts.scopeNoticeDeadlineMs ?? SCOPE_NOTICE_DEADLINE_MS, remainingForMargin);
+            if (positionDeadline > 0) {
+              const scope = await fetchScopeNotices(connection.url, connection.bearer, engagementId, opts.fetchFn ?? globalThis.fetch, positionDeadline);
+              if (scope !== void 0)
+                parts.push(...scopeNoticeLines(scope));
+            }
+          }
+        } else if (connection.sentence === CANNOT_REACH_SENTENCE || connection.sentence === SERVICE_PROBLEM_SENTENCE) {
+          parts.push(SCOPE_UNCHECKED_SENTENCE);
+        }
+      }
     }
     if (readConfig().config === null) {
       const remedySaid = parts.some(namesTheSignInCommand);
@@ -18588,7 +19747,7 @@ async function runRefreshCredential(opts) {
 import { fileURLToPath } from "node:url";
 
 // dist/capture.js
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync7 } from "node:fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync7 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -18656,7 +19815,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync11(fromFile, "utf-8");
+    return readFileSync12(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -18681,8 +19840,8 @@ async function main() {
     return;
   }
   if (cmd === "mcp-headers") {
-    const line = await mcpHeaders({ binaryPath: fileURLToPath(import.meta.url) });
-    process.stdout.write(line, () => process.exit(0));
+    const line2 = await mcpHeaders({ binaryPath: fileURLToPath(import.meta.url) });
+    process.stdout.write(line2, () => process.exit(0));
     return;
   }
   if (cmd === "resolve-engagement") {
@@ -18738,8 +19897,18 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
       process.exit(process.exitCode ?? 0);
       return;
     }
+    if (sub === "user-prompt-submit") {
+      let reply = "";
+      try {
+        reply = await runUserPromptSubmit({ input: await readStdin2() });
+      } catch {
+        reply = "";
+      }
+      process.stdout.write(reply, () => process.exit(0));
+      return;
+    }
     process.stderr.write(`halfcycle-runner: unknown hook "${sub ?? ""}"
-  Valid hooks: post-tool-use, stop, subagent-stop
+  Valid hooks: post-tool-use, stop, subagent-stop, user-prompt-submit
 `);
     process.exit(1);
     return;
@@ -18749,6 +19918,7 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
          halfcycle-runner hook post-tool-use
          halfcycle-runner hook stop
          halfcycle-runner hook subagent-stop
+         halfcycle-runner hook user-prompt-submit
          halfcycle-runner refresh-credential
          halfcycle-runner mcp-headers
          halfcycle-runner resolve-engagement <cwd>