loki-mode 11.17.82 → 11.17.84

package/packages/control-plane/dist/server.js

@@ -10002,6 +10002,18 @@ async function zeroOnBase(cands, baseDir, repoDir, run, note) {
   }
   return zero;
 }
+function addedSymlinkNotes(rawDiff, planText) {
+  const asks = (w) => [...(planText ?? "").matchAll(new RegExp(`\\b${w}s?\\b`, "gi"))].some((m) => !/\b(?:no|not|never|without|avoid|don'?t|cannot|can'?t)\b[^.\n]{0,40}$/i.test(planText.slice(Math.max(0, m.index - 45), m.index)));
+  const out2 = [];
+  for (let i = 0;i + 1 < rawDiff.length; i += 2) {
+    const f = rawDiff[i].trim().split(" "), oldMode = f[0].replace(/^:/, ""), st = f[f.length - 1], p = rawDiff[i + 1];
+    if (f[1] === "120000" && (st === "A" || st === "T" && oldMode !== "120000") && !asks("symlink"))
+      out2.push(`symlink added by the change (a link can stand in for missing work; the plan did not ask for one): ${p}`);
+    else if (f[1] === "160000" && (st === "A" || st === "T") && !asks("submodule"))
+      out2.push(`submodule pointer added by the change (it can stand in for missing work; the plan did not ask for one): ${p}`);
+  }
+  return out2;
+}
 var WALK_BOUND = 50000, REPO_LINK_FILE;
 var init_base_guard = __esm(() => {
   init_check_result();
@@ -13890,6 +13902,258 @@ var init_secure_scan = __esm(() => {
 // ../../loki-ts/src/runner/retry_class.ts
 var init_retry_class = () => {};
 
+// ../../loki-ts/src/project_model/conventions.ts
+import { existsSync as existsSync33, readdirSync as readdirSync19, readFileSync as readFileSync42 } from "fs";
+import { basename as basename22, dirname as dirname19, isAbsolute as isAbsolute8, join as join53, relative as relative8, resolve as resolve17 } from "path";
+function parseJsonc(text2) {
+  let out2 = "", i = 0;
+  while (i < text2.length) {
+    const c = text2[i], n2 = text2[i + 1];
+    if (c === '"') {
+      let j = i + 1;
+      while (j < text2.length && text2[j] !== '"')
+        j += text2[j] === "\\" ? 2 : 1;
+      out2 += text2.slice(i, j + 1);
+      i = j + 1;
+    } else if (c === "/" && n2 === "/") {
+      while (i < text2.length && text2[i] !== `
+`)
+        i++;
+    } else if (c === "/" && n2 === "*") {
+      const e = text2.indexOf("*/", i + 2);
+      i = e < 0 ? text2.length : e + 2;
+    } else {
+      out2 += c;
+      i++;
+    }
+  }
+  return JSON.parse(out2.replace(/,(\s*[}\]])/g, "$1"));
+}
+function moduleOf(file, depth = 0) {
+  const j = readJson5(file);
+  if (!j || depth > 4)
+    return null;
+  const m = j.compilerOptions?.module;
+  if (typeof m === "string")
+    return m.toLowerCase();
+  const ext = typeof j.extends === "string" ? j.extends : null;
+  if (!ext || !ext.startsWith("."))
+    return null;
+  const next = join53(dirname19(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  return existsSync33(next) ? moduleOf(next, depth + 1) : null;
+}
+function readPackageConventions(pkgDir, runner = null) {
+  let names = [];
+  try {
+    names = readdirSync19(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
+  } catch {
+    return null;
+  }
+  let packageType = null, tsModule = null;
+  for (const n2 of names) {
+    const j = readJson5(join53(pkgDir, n2));
+    if (!j)
+      continue;
+    if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
+      packageType = j.type;
+    if (tsModule === null && j.compilerOptions !== undefined)
+      tsModule = moduleOf(join53(pkgDir, n2));
+  }
+  if (packageType === null && tsModule === null)
+    return null;
+  const esmType = packageType === "module";
+  const moduleSystem = tsModule === null || tsModule === "node16" || tsModule === "nodenext" ? esmType ? "esm" : "commonjs" : /^(commonjs|amd|umd|system)$/.test(tsModule) ? "commonjs" : "esm";
+  return { moduleSystem, packageType, tsModule, runner };
+}
+function conventionsBrief(c) {
+  if (!c)
+    return "";
+  const decl = `manifest type: ${c.packageType ?? "(unset)"}, compiler module: ${c.tsModule ?? "(unset)"}${c.runner ? `, test runner: ${c.runner}` : ""}`;
+  return c.moduleSystem === "commonjs" ? `Package conventions (${decl}): this package compiles as CommonJS. Never use import.meta or top-level await (TS1470, the package's own tsc rejects them); use __dirname and __filename for paths. In files the package's own compiler processes write import statements (they compile to CommonJS) and never require(): a package lint config commonly forbids require() and runs over your file; use require() only in plain .js or .cjs files.` : `Package conventions (${decl}): this package is ES modules. Use import syntax; use import.meta.url for file locations; never use require(), __dirname or __filename.`;
+}
+function conventionViolation(c, fileName, content) {
+  if (!c || c.moduleSystem !== "commonjs" || !/\.[cm]?[jt]sx?$/.test(fileName) || /\.m[jt]s$/.test(fileName))
+    return null;
+  const code = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/(["'`])(?:\\.|(?!\1)[^\\\n])*\1/g, '""');
+  return /\bimport\.meta\b/.test(code) ? "import.meta is not allowed in a CommonJS package (TS1470)" : null;
+}
+function outOfRepoTarget(content) {
+  const code = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/(^|\s)#.*$/gm, "$1");
+  const lines2 = code.split(`
+`), at = lines2.findIndex((l) => /\bprocess\.env\.(HOME|USERPROFILE)\s*=(?!=)|\benv\[\s*["'](HOME|USERPROFILE)["']\s*\]\s*=(?!=)|^\s*(export\s+)?(HOME|USERPROFILE)=|\bexport\s+(HOME|USERPROFILE)\b|\bsetenv\(\s*["'](HOME|USERPROFILE)["']|\benv\s*:\s*\{[^}]*\b(HOME|USERPROFILE)\s*:|\bpatch\.dict\([^)]*["'](HOME|USERPROFILE)["']/.test(l));
+  const home = /\bhomedir\s*\(|\bPath\.home\s*\(|\bexpanduser\s*\(|\$\{?HOME\b|\$\{?USERPROFILE\b|\bprocess\.env\.(HOME|USERPROFILE)\b|["'`]~\//;
+  const HOMELIT = String.raw`(?:file:\/\/)?(?:\/(?:Users|home|root)\/|[A-Za-z]:\\+Users\\)`;
+  const literalTarget = new RegExp(String.raw`\b(?:from|import|require)\s*\(?\s*["'` + "`" + String.raw`]${HOMELIT}|^\s*(?:source|\.)\s+["']?${HOMELIT}`);
+  const locates = /["'`\/]\.[A-Za-z][\w-]*(?:[\/"'`]|$)|\b(?:import|require|source|spawn\w*|exec\w*|pathToFileURL|readFile\w*)\b/;
+  for (const line2 of lines2.slice(0, at < 0 ? lines2.length : at)) {
+    if (/^\s*(?:await\s+)?(?:expect|assert\w*)\b/.test(line2))
+      continue;
+    if (home.test(line2) && locates.test(line2) || literalTarget.test(line2))
+      return "resolves the code under test outside the repo via a home-directory path; target repo-relative paths (relative to this test file or the repo root) so the check exercises the change";
+  }
+  return null;
+}
+function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
+  if (!/\.[cm]?[jt]sx?$/.test(fileName))
+    return [];
+  const code = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/\(\s+/g, "(").replace(/\s+\)/g, ")").replace(/,\s*\n\s*/g, ", ").replace(/=\s*\n\s*/g, "= ");
+  let pkg = testDir;
+  while (pkg !== repoDir && pkg !== dirname19(pkg) && !MANIFESTS.some((m) => existsSync33(join53(pkg, m))))
+    pkg = dirname19(pkg);
+  const split2 = (s) => {
+    const out2 = [];
+    let d = 0, q = "", cur = "";
+    for (let i = 0;i < s.length; i++) {
+      const c = s[i];
+      if (q) {
+        cur += c;
+        if (c === "\\")
+          cur += s[++i] ?? "";
+        else if (c === q)
+          q = "";
+      } else if (c === '"' || c === "'" || c === "`") {
+        q = c;
+        cur += c;
+      } else if ("([{".includes(c)) {
+        d++;
+        cur += c;
+      } else if (")]}".includes(c)) {
+        d--;
+        cur += c;
+      } else if (c === "," && d === 0) {
+        out2.push(cur);
+        cur = "";
+      } else
+        cur += c;
+    }
+    if (cur.trim())
+      out2.push(cur);
+    return out2;
+  };
+  const close = (line2, at) => {
+    let d = 0;
+    for (let j = at;j < line2.length; j++) {
+      if (line2[j] === "(")
+        d++;
+      else if (line2[j] === ")" && --d === 0)
+        return j;
+    }
+    return -1;
+  };
+  const scan = (cwd) => {
+    const vars = new Map, reports = new Map, created = [];
+    let ln = 0;
+    const ev = (raw2, report) => {
+      const e = raw2.trim().replace(/^await\s+/, "").replace(/\s+as\s+\w+$/, "").replace(/!$/, "");
+      if (/^import\.meta\.(dir|dirname)$|^__dirname$/.test(e))
+        return testDir;
+      if (e === "process.cwd()")
+        return cwd;
+      const env = /^process\.env(?:\.[\w$]+|\[[^\]]+\])\s*(?:\?\?|\|\|)\s*([\s\S]+)$/.exec(e);
+      if (env)
+        return ev(env[1], report);
+      if (e === "fileURLToPath(import.meta.url)" || e === "__filename")
+        return join53(testDir, "__self__");
+      const url = /^fileURLToPath\(new URL\((["'])([^"']*)\1\s*,\s*import\.meta\.url\)\)$/.exec(e);
+      if (url)
+        return resolve17(testDir, url[2]);
+      const lit = /^(["'`])((?:\\.|(?!\1)[^\\])*)\1$/.exec(e);
+      if (lit)
+        return lit[2].includes("${") ? null : lit[2];
+      if (/^[A-Za-z_$][\w$]*$/.test(e))
+        return vars.get(e) ?? null;
+      const call = /^(?:path\.)?(join|resolve|dirname)\(([\s\S]*)\)$/.exec(e);
+      if (!call)
+        return null;
+      const parts = split2(call[2]), args = parts.map((a) => ev(a, report));
+      if (args.some((a) => a === null))
+        return null;
+      if (call[1] === "dirname")
+        return dirname19(args[0]);
+      const out2 = resolve17(...args);
+      if (report && relative8(testDir, out2).startsWith("..") && parts.some((a) => /^\s*["'`]/.test(a)))
+        reports.set(`${ln}|${e}`, { out: out2, rel: relative8(repoDir, out2) });
+      return out2;
+    };
+    for (const line2 of code.split(`
+`)) {
+      ln++;
+      for (const m of line2.matchAll(CREATORS)) {
+        const j = close(line2, m.index + m[0].length - 1);
+        if (j > 0)
+          for (const a of split2(line2.slice(m.index + m[0].length, j))) {
+            const v = ev(a, false);
+            if (v)
+              created.push(v);
+          }
+      }
+      const skip = /^\s*(?:await\s+)?(?:expect|assert\w*)\b|\b(?:write\w*|mkdir\w*|rm\w*|cp\w*|copy\w*|rename\w*|symlink\w*|mkdtemp\w*|tmpdir|outputFile|touch)\b/.test(line2);
+      const asg = /^\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(.+?);?\s*$/.exec(line2);
+      if (asg) {
+        const v = ev(asg[2], !skip);
+        if (v !== null)
+          vars.set(asg[1], v);
+        continue;
+      }
+      if (skip)
+        continue;
+      for (const m of line2.matchAll(/(?:path\.)?(?:join|resolve)\(/g)) {
+        const j = close(line2, m.index + m[0].length - 1);
+        if (j > 0)
+          ev(line2.slice(m.index, j + 1), true);
+      }
+    }
+    return { reports, created };
+  };
+  const runs2 = [...new Set([pkg, repoDir])].map(scan);
+  const planned = (rel) => !!planText && rel.split("/").some((_, i, a) => {
+    const pre = a.slice(0, i + 1).join("/");
+    return (i > 0 || a.length === 1) && !existsSync33(join53(repoDir, pre)) && new RegExp(`(?<![\\w-])${pre.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`).test(planText);
+  });
+  const phantom = (r, created) => {
+    const rel = r.rel;
+    if (!rel || rel.startsWith("..") || isAbsolute8(rel) || /(^|\/)(node_modules|\.git|\.loki|dist|build|coverage|tmp)(\/|$)/.test(rel) || existsSync33(r.out) || planned(rel))
+      return false;
+    if (created.some((c) => c === r.out || c.startsWith(r.out + "/") || r.out.startsWith(c + "/")))
+      return false;
+    return safeGitSpawn(repoDir, ["check-ignore", "-q", "--", rel], { timeout: 5000 }).status !== 0;
+  };
+  const missing = [];
+  for (const [k, r] of runs2[0].reports)
+    if (runs2.every((x) => x.reports.has(k) && phantom(x.reports.get(k), x.created)) && !missing.includes(r.rel))
+      missing.push(r.rel);
+  return missing.slice(0, 3);
+}
+function phantomReason(miss, repoFiles) {
+  if (miss.length === 0)
+    return null;
+  const hint = (m) => {
+    const n2 = basename22(m), near = [...new Set(repoFiles.flatMap((f) => {
+      const s = f.split("/"), k = s.indexOf(n2);
+      return k >= 0 && s.slice(0, k + 1).join("/") !== m ? [s.slice(0, k + 1).join("/")] : [];
+    }))].slice(0, 3);
+    return near.length ? `${m} (a path named ${n2} exists at ${near.join(", ")})` : m;
+  };
+  return `references repo path(s) that do not exist in the repository and that the plan does not create: ${miss.map(hint).join("; ")}. Locate the real code by searching the repository; do not copy a name from the task text as a path`;
+}
+var readJson5 = (p) => {
+  try {
+    const v = parseJsonc(readFileSync42(p, "utf8"));
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}, outOfRepoReask = (lead, bad) => [`${lead} Each was rejected:
+${bad.map((b) => `- ${b.name}: ${b.why}`).join(`
+`)}`, `Point every reference at the repository code with repo-relative paths (for example join(import.meta.dir, "..", "<repo path>") or the equivalent for this runner). Do not read the home directory, $HOME or an environment variable that falls back to one. Write nothing else.`].join(`
+
+`), MANIFESTS, CREATORS;
+var init_conventions = __esm(() => {
+  init_safe_git();
+  MANIFESTS = ["package.json", "pyproject.toml", "go.mod", "Cargo.toml"];
+  CREATORS = /\b(?:mkdirSync|writeFileSync|appendFileSync|cpSync|copyFileSync|renameSync|symlinkSync|mkdir|writeFile|appendFile|cp|copyFile|rename|outputFile|ensureDir|mkdirp)\(/g;
+});
+
 // ../../loki-ts/src/version.ts
 var init_version = __esm(() => {
   init_paths();
@@ -13986,9 +14250,9 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn8 } from "child_process";
 import { createHash as createHash14, randomBytes as randomBytes6 } from "crypto";
-import { existsSync as existsSync33, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync19, readFileSync as readFileSync42, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync20, readFileSync as readFileSync43, writeFileSync as writeFileSync24 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname19, isAbsolute as isAbsolute8, join as join53, normalize as normalize3, relative as relative8, sep as sep13 } from "path";
+import { dirname as dirname20, isAbsolute as isAbsolute9, join as join54, normalize as normalize3, relative as relative9, sep as sep13 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -13998,7 +14262,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join53(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join54(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -14009,16 +14273,16 @@ function checkScreens(runDir, screens) {
   for (const s of screens) {
     if (typeof s?.path !== "string" || typeof s.sha256 !== "string")
       return "evidence_screens entry is malformed";
-    if (isAbsolute8(s.path) || normalize3(s.path).startsWith(".."))
+    if (isAbsolute9(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join53(runDir, s.path);
+    const file = join54(runDir, s.path);
     let cur = runDir;
     for (const seg of normalize3(s.path).split(sep13)) {
-      cur = join53(cur, seg);
+      cur = join54(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
-    if (!existsSync33(file))
+    if (!existsSync34(file))
       return `evidence screenshot is missing: ${s.path}`;
     if (!isRegularFile(file))
       return `evidence screenshot is not a regular file: ${s.path}`;
@@ -14061,11 +14325,11 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join53(repoDir, f);
-    if (!existsSync33(p))
+    const p = join54(repoDir, f);
+    if (!existsSync34(p))
       continue;
     try {
-      const txt = readFileSync42(p, "utf8");
+      const txt = readFileSync43(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -14079,24 +14343,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join53(runDir, relDir, "e2e");
+    const dir = join54(runDir, relDir, "e2e");
     mkdirSync21(dir, { recursive: true });
-    writeFileSync24(join53(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync24(join53(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync24(join54(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync24(join54(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join53(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join54(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
-      for (const e of readdirSync19(d, { withFileTypes: true })) {
-        const full = join53(d, e.name);
+      for (const e of readdirSync20(d, { withFileTypes: true })) {
+        const full = join54(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join53(relDir, "e2e", relative8(dir, full)));
+          rels.push(join54(relDir, "e2e", relative9(dir, full)));
       }
     };
-    walk(join53(dir, "out"));
+    walk(join54(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -14175,22 +14439,22 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join53(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join53(appDir, "package.json");
+    const appDir = boot ? join54(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join54(appDir, "package.json");
     let script = null;
     if (!boot) {
-      if (!existsSync33(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync33(join53(repoDir, d, "package.json")));
+      if (!existsSync34(pkgPath)) {
+        const subs = ["backend", "frontend"].filter((d) => existsSync34(join54(repoDir, d, "package.json")));
         const has2 = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync42(join53(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync43(join54(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has2(d))));
       }
-      script = pickScript(JSON.parse(readFileSync42(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync43(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -14217,20 +14481,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join53(runDir, "evidence");
+    const evRoot = join54(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync21(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join53("evidence", randomBytes6(6).toString("hex"));
-      mkdirSync21(join53(runDir, rel0));
+      const rel0 = join54("evidence", randomBytes6(6).toString("hex"));
+      mkdirSync21(join54(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join53(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join53(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join53(runDir, rel)) && existsSync33(join53(runDir, rel)))
+        const rel = join54(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join54(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join54(runDir, rel)) && existsSync34(join54(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -14255,9 +14519,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join53(evRoot, randomBytes6(6).toString("hex"));
+    const hdir = join54(evRoot, randomBytes6(6).toString("hex"));
     mkdirSync21(hdir);
-    writeFileSync24(join53(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync24(join54(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -14284,14 +14548,14 @@ async function sealEvidence(repoDir, runDir, o, notProven, signal, emit) {
 function receiptScreensProblem(receiptPath, receipt) {
   if (visualGateEnabled() && typeof receipt["evidence_failed"] === "string")
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
-  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname19(receiptPath), receipt["evidence_screens"]);
+  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname20(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync42(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join53(repoDir, "node_modules", ".bin", "playwright");
-  return existsSync33(bin) ? bin : null;
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync43(p)).digest("hex"), playwrightBin = (repoDir) => {
+  const bin = join54(repoDir, "node_modules", ".bin", "playwright");
+  return existsSync34(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join53(repoDir, "node_modules", "@playwright", "test");
-  return existsSync33(join53(d, "package.json")) ? d : null;
+  const d = join54(repoDir, "node_modules", "@playwright", "test");
+  return existsSync34(join54(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -14337,7 +14601,7 @@ var init_outbox = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/pr.ts
-import { join as join54 } from "path";
+import { join as join55 } from "path";
 var DEFAULT_PUSH_SH, DEFAULT_PUSH_GITLAB_SH;
 var init_pr = __esm(() => {
   init_types();
@@ -14356,20 +14620,20 @@ var init_pr = __esm(() => {
   init_receipt_surface();
   init_yaml_key();
   init_outbox();
-  DEFAULT_PUSH_SH = join54(REPO_ROOT, "autonomy/lib/engine10-push.sh");
-  DEFAULT_PUSH_GITLAB_SH = join54(REPO_ROOT, "autonomy/lib/engine10-push-gitlab.sh");
+  DEFAULT_PUSH_SH = join55(REPO_ROOT, "autonomy/lib/engine10-push.sh");
+  DEFAULT_PUSH_GITLAB_SH = join55(REPO_ROOT, "autonomy/lib/engine10-push-gitlab.sh");
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync43, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
-import { dirname as dirname20, join as join55 } from "path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync44, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
+import { dirname as dirname21, join as join56 } from "path";
 import { createHash as createHash15 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
-  if (!existsSync34(p))
+  if (!existsSync35(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync43(p, "utf-8"));
+    const j = JSON.parse(readFileSync44(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -14377,7 +14641,7 @@ function loadLessons(repoDir) {
 }
 function save(repoDir, lessons) {
   const p = lessonsPath(repoDir);
-  mkdirSync22(dirname20(p), { recursive: true });
+  mkdirSync22(dirname21(p), { recursive: true });
   atomicWriteJson(p, { version: 2, lessons });
 }
 function appendReceiptFact(repoDir, f, now2 = () => new Date) {
@@ -14411,7 +14675,7 @@ function recordRunVerdict(repoDir, runId2, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join55(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join56(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   init_safe_git();
@@ -14437,8 +14701,8 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync35, readFileSync as readFileSync44 } from "fs";
-import { resolve as resolvePath, dirname as dirname21 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync45 } from "fs";
+import { resolve as resolvePath, dirname as dirname22 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function claudeFlagSupported(flag, helpText) {
   const txt = helpText ?? _claudeHelpCache;
@@ -14485,14 +14749,14 @@ function leanReviewerFlags(opts = {}) {
 }
 function designArchetypesText() {
   try {
-    const moduleDir = dirname21(fileURLToPath5(import.meta.url));
+    const moduleDir = dirname22(fileURLToPath5(import.meta.url));
     for (const rel of [
       ["..", "..", "..", "references", "design-archetypes.md"],
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
-      if (existsSync35(p))
-        return readFileSync44(p, "utf8");
+      if (existsSync36(p))
+        return readFileSync45(p, "utf8");
     }
   } catch {}
   return "";
@@ -14577,14 +14841,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync36, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync45, writeFileSync as writeFileSync26 } from "fs";
-import { join as join56 } from "path";
+import { existsSync as existsSync37, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync46, writeFileSync as writeFileSync26 } from "fs";
+import { join as join57 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join56(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync36(p) || !lstatSync13(p).isFile())
+    const p = join57(runDir, ROUTE_RECORD_FILE);
+    if (!existsSync37(p) || !lstatSync13(p).isFile())
       return;
-    const v = JSON.parse(readFileSync45(p, "utf8"));
+    const v = JSON.parse(readFileSync46(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -14645,6 +14909,7 @@ var init_implement_route = __esm(() => {
 var init_implement = __esm(() => {
   init_install();
   init_lean_prefix();
+  init_conventions();
   init_pr_lessons();
   init_context();
   init_model_downgrades();
@@ -14732,14 +14997,14 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
-import { copyFileSync as copyFileSync3, existsSync as existsSync37, lstatSync as lstatSync14, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync27 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync38, lstatSync as lstatSync14, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname22, join as join57 } from "path";
+import { dirname as dirname23, join as join58 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync9(join57(tmpdir10(), "loki-deep-council-"));
+    const cwd = mkdtempSync9(join58(tmpdir10(), "loki-deep-council-"));
     try {
-      writeFileSync27(join57(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync27(join58(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -14809,7 +15074,7 @@ ${r.stderr}`), lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ rep
 async function runAppBoot(ctx, opts, checks, notProven) {
   let r;
   try {
-    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join57(ctx.repoDir, ".loki"));
+    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join58(ctx.repoDir, ".loki"));
   } catch (err) {
     r = { checks: [{ name: "app boot", cmd: "autonomy/app-runner.sh", result: "not_run", duration_s: 0, reason: `app probe threw: ${err.message}` }], pid: null, url: null };
   }
@@ -14855,12 +15120,12 @@ async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notP
   }
 }
 async function secureScanChanged(repoDir, changed, opts) {
-  const dir = mkdtempSync9(join57(tmpdir10(), "loki-deep-secure-"));
+  const dir = mkdtempSync9(join58(tmpdir10(), "loki-deep-secure-"));
   try {
     for (const f of changed)
-      if (existsSync37(join57(repoDir, f)) && lstatSync14(join57(repoDir, f)).isFile()) {
-        mkdirSync24(dirname22(join57(dir, f)), { recursive: true });
-        copyFileSync3(join57(repoDir, f), join57(dir, f));
+      if (existsSync38(join58(repoDir, f)) && lstatSync14(join58(repoDir, f)).isFile()) {
+        mkdirSync24(dirname23(join58(dir, f)), { recursive: true });
+        copyFileSync3(join58(repoDir, f), join58(dir, f));
       }
     return await runSecureScan(dir, { ...opts.secureScanPath ? { scriptPath: opts.secureScanPath } : {}, timeoutMs: 60000 });
   } finally {
@@ -14869,7 +15134,7 @@ async function secureScanChanged(repoDir, changed, opts) {
 }
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
   const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd2 = "secret-scan.sh + secure-scan.py";
-  if (!existsSync37(scriptPath)) {
+  if (!existsSync38(scriptPath)) {
     checks.push({ name, cmd: cmd2, result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
@@ -14880,7 +15145,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join57(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join58(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const sec = await secureScanChanged(ctx.repoDir, changed, opts), gaps = [], reasons = [];
   const hits = r.exitCode === 3 ? [] : r.stdout.split(`
 `).map((l) => l.trim()).filter(Boolean), high = sec.findings.filter((f) => String(f.severity).toUpperCase() === "HIGH");
@@ -14921,7 +15186,7 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
     mkdirSync24(ctx.runDir, { recursive: true });
-    const bodyFile = join57(ctx.runDir, "deep-comment.md");
+    const bodyFile = join58(ctx.runDir, "deep-comment.md");
     writeFileSync27(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
@@ -14976,7 +15241,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync24(ctx.runDir, { recursive: true });
-  writeFileSync27(join57(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync27(join58(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -15012,9 +15277,9 @@ var init_deep = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync38, mkdtempSync as mkdtempSync10, rmSync as rmSync18 } from "fs";
+import { existsSync as existsSync39, mkdtempSync as mkdtempSync10, rmSync as rmSync18 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
-import { isAbsolute as isAbsolute9, join as join58, relative as relative9 } from "path";
+import { isAbsolute as isAbsolute10, join as join59, relative as relative10 } from "path";
 async function runOnce2(cmd2, args, cwd, signal, opts) {
   if (!Bun.which(cmd2, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
     return { ok: false, missing: true, cut: false, out: "" };
@@ -15088,7 +15353,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   const zc = zeroOk ? un.filter(({ c, t }) => c.result === "not_run" && !c.owner && (c.reason ?? "").startsWith(NO_TESTS_REASON) && !wall.has(c.name) && !rel.has(c.name) && !isHoldoutCheck(c.name) && !changed.includes(t.path)) : [];
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length || zc.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync10(join58(tmpdir11(), "e10-base-"));
+  const dir = mkdtempSync10(join59(tmpdir11(), "e10-base-"));
   const git4 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -15127,7 +15392,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync38(join58(repoDir, "scripts", "select-tests.sh"));
+  return existsSync39(join59(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -15149,9 +15414,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync38(join58(g.cwd, "tsconfig.json")))
+    if (existsSync39(join59(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["--no-install", "tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync38(join58(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync39(join59(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["--no-install", "eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["--no-install", "eslint"], g.cwd, g.rel, co))
         pre.push(c.name);
@@ -15166,7 +15431,7 @@ var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name),
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
-    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative9(ctx.repoDir, join58(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
+    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative10(ctx.repoDir, join59(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -15231,7 +15496,7 @@ var init_verify = __esm(() => {
       const impacted = ctx.tests.impacted(map, changed);
       const changedTestFiles = map.tests.filter((t) => changed.includes(t.path));
       const wall = ctx.outputs().wall ?? {};
-      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute9(f.path) ? relative9(ctx.repoDir, f.path) : f.path));
+      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute10(f.path) ? relative10(ctx.repoDir, f.path) : f.path));
       const intake = ctx.outputs().intake, repoMap = loadRepoMap(intake?.repomap_ref), relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", repoMap));
       const harness = map.runners.length === 0 ? harnessRunners(map.runners, repoMap?.files ?? [])[0] : undefined, wallTests = [...map.tests.filter((t) => wallPaths.has(t.path)), ...harness ? [...wallPaths].filter((p) => /[._](?:test|spec)\.[cm]?[jt]sx?$/.test(p) && !map.tests.some((t) => t.path === p)).map((path) => ({ runner: harness, path })) : []];
       const tests = failedFirst(dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]), ctx.outputs().verify?.checks);
@@ -15338,111 +15603,11 @@ ${x}` : c.cmd };
   };
 });
 
-// ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync39, readdirSync as readdirSync20, readFileSync as readFileSync46 } from "fs";
-import { dirname as dirname23, join as join59 } from "path";
-function parseJsonc(text2) {
-  let out2 = "", i = 0;
-  while (i < text2.length) {
-    const c = text2[i], n2 = text2[i + 1];
-    if (c === '"') {
-      let j = i + 1;
-      while (j < text2.length && text2[j] !== '"')
-        j += text2[j] === "\\" ? 2 : 1;
-      out2 += text2.slice(i, j + 1);
-      i = j + 1;
-    } else if (c === "/" && n2 === "/") {
-      while (i < text2.length && text2[i] !== `
-`)
-        i++;
-    } else if (c === "/" && n2 === "*") {
-      const e = text2.indexOf("*/", i + 2);
-      i = e < 0 ? text2.length : e + 2;
-    } else {
-      out2 += c;
-      i++;
-    }
-  }
-  return JSON.parse(out2.replace(/,(\s*[}\]])/g, "$1"));
-}
-function moduleOf(file, depth = 0) {
-  const j = readJson5(file);
-  if (!j || depth > 4)
-    return null;
-  const m = j.compilerOptions?.module;
-  if (typeof m === "string")
-    return m.toLowerCase();
-  const ext = typeof j.extends === "string" ? j.extends : null;
-  if (!ext || !ext.startsWith("."))
-    return null;
-  const next = join59(dirname23(file), ext.endsWith(".json") ? ext : `${ext}.json`);
-  return existsSync39(next) ? moduleOf(next, depth + 1) : null;
-}
-function readPackageConventions(pkgDir, runner = null) {
-  let names = [];
-  try {
-    names = readdirSync20(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
-  } catch {
-    return null;
-  }
-  let packageType = null, tsModule = null;
-  for (const n2 of names) {
-    const j = readJson5(join59(pkgDir, n2));
-    if (!j)
-      continue;
-    if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
-      packageType = j.type;
-    if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join59(pkgDir, n2));
-  }
-  if (packageType === null && tsModule === null)
-    return null;
-  const esmType = packageType === "module";
-  const moduleSystem = tsModule === null || tsModule === "node16" || tsModule === "nodenext" ? esmType ? "esm" : "commonjs" : /^(commonjs|amd|umd|system)$/.test(tsModule) ? "commonjs" : "esm";
-  return { moduleSystem, packageType, tsModule, runner };
-}
-function conventionsBrief(c) {
-  if (!c)
-    return "";
-  const decl = `manifest type: ${c.packageType ?? "(unset)"}, compiler module: ${c.tsModule ?? "(unset)"}${c.runner ? `, test runner: ${c.runner}` : ""}`;
-  return c.moduleSystem === "commonjs" ? `Package conventions (${decl}): this package compiles as CommonJS. Never use import.meta or top-level await (TS1470, the package's own tsc rejects them); use __dirname and __filename for paths. In files the package's own compiler processes write import statements (they compile to CommonJS) and never require(): a package lint config commonly forbids require() and runs over your file; use require() only in plain .js or .cjs files.` : `Package conventions (${decl}): this package is ES modules. Use import syntax; use import.meta.url for file locations; never use require(), __dirname or __filename.`;
-}
-function conventionViolation(c, fileName, content) {
-  if (!c || c.moduleSystem !== "commonjs" || !/\.[cm]?[jt]sx?$/.test(fileName) || /\.m[jt]s$/.test(fileName))
-    return null;
-  const code = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/(["'`])(?:\\.|(?!\1)[^\\\n])*\1/g, '""');
-  return /\bimport\.meta\b/.test(code) ? "import.meta is not allowed in a CommonJS package (TS1470)" : null;
-}
-function outOfRepoTarget(content) {
-  const code = content.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/(^|\s)#.*$/gm, "$1");
-  if (/\bprocess\.env\.(HOME|USERPROFILE)\s*=(?!=)|\benv\[\s*["'](HOME|USERPROFILE)["']\s*\]\s*=(?!=)|^\s*(export\s+)?(HOME|USERPROFILE)=|\bexport\s+(HOME|USERPROFILE)\b|\bsetenv\(\s*["'](HOME|USERPROFILE)["']|\benv\s*:\s*\{[^}]*\b(HOME|USERPROFILE)\s*:|\bpatch\.dict\([^)]*["'](HOME|USERPROFILE)["']/m.test(code))
-    return null;
-  const home = /\bhomedir\s*\(|\bPath\.home\s*\(|\bexpanduser\s*\(|\$\{?HOME\b|\$\{?USERPROFILE\b|\bprocess\.env\.(HOME|USERPROFILE)\b|["'`]~\/|["'`](?:file:\/\/)?\/(?:Users|home|root)\//;
-  const locates = /["'`\/]\.[A-Za-z][\w-]*(?:[\/"'`]|$)|\b(?:import|require|source|spawn\w*|exec\w*|pathToFileURL|readFile\w*)\b/;
-  for (const line2 of code.split(`
-`)) {
-    if (/^\s*(?:await\s+)?(?:expect|assert\w*)\b/.test(line2))
-      continue;
-    if (home.test(line2) && locates.test(line2))
-      return "resolves the code under test outside the repo via a home-directory path; target repo-relative paths (relative to this test file or the repo root) so the check exercises the change";
-  }
-  return null;
-}
-var readJson5 = (p) => {
-  try {
-    const v = parseJsonc(readFileSync46(p, "utf8"));
-    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
-  } catch {
-    return null;
-  }
-};
-var init_conventions = () => {};
-
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync7 } from "child_process";
 import { existsSync as existsSync40, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync47, readdirSync as readdirSync21, rmSync as rmSync19, writeFileSync as writeFileSync28 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
-import { dirname as dirname24, join as join60, relative as relative10 } from "path";
+import { dirname as dirname24, join as join60, relative as relative11 } from "path";
 
 class RealBaseTestRunner {
   api;
@@ -15553,7 +15718,7 @@ async function wallAuthor(ctx, signal, retry) {
     return done({ status: "skipped", data: { size: sz.size, files: [], no_interpreter: true, not_proven: ["Wall skipped: no project test interpreter"] }, reason: "Wall skipped: no project test interpreter" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative10(ctx.repoDir, targetDir)}/x`);
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative11(ctx.repoDir, targetDir)}/x`);
   const conv2 = readPackageConventions(join60(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
   const cwd = mkdtempSync11(join60(tmpdir12(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
@@ -15574,17 +15739,14 @@ async function wallAuthor(ctx, signal, retry) {
     rmSync19(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
+  const planText = typeof prior.plan?.plan === "string" ? prior.plan.plan : null, repoFiles = repoMap?.files ?? [];
   const oor = () => readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)).flatMap((name) => {
-    const why = outOfRepoTarget(readFileSync47(join60(cwd, name), "utf8"));
+    const text2 = readFileSync47(join60(cwd, name), "utf8"), why = outOfRepoTarget(text2) ?? phantomReason(phantomRepoPaths(text2, name, targetDir, ctx.repoDir, planText), repoFiles);
     return why ? [{ name, why }] : [];
   });
   const bad1 = oor();
   if (bad1.length > 0 && !signal.aborted)
-    await ctx.sessions.run({ stage: "wall", brief: withStagePrefix([`Rewrite these Wall files in place, keeping the same names and acceptance coverage. Each was rejected:
-${bad1.map((b) => `- ${b.name}: ${b.why}`).join(`
-`)}`, `Point every reference at the repository code with repo-relative paths (for example join(import.meta.dir, "..", "<repo path>") or the equivalent for this runner). Do not read the home directory, $HOME or an environment variable that falls back to one. Write nothing else.`].join(`
-
-`)), tier: "development", model, iterationId: `${iterationId}-oor`, limitS: wallLimitS(sz.size), signal, cwd });
+    await ctx.sessions.run({ stage: "wall", brief: withStagePrefix(outOfRepoReask("Rewrite these Wall files in place, keeping the same names and acceptance coverage.", bad1)), tier: "development", model, iterationId: `${iterationId}-oor`, limitS: wallLimitS(sz.size), signal, cwd });
   const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !oorBad.has(n2) && !conventionViolation(conv2, n2, readFileSync47(join60(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
   const sealedDir = join60(ctx.runDir, "wall");
   if (generated.length > 0)
@@ -15627,7 +15789,7 @@ function* installCore(ctx, a, baseDir, opts) {
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
-      wallTests.push({ runner, path: relative10(ctx.repoDir, dest) });
+      wallTests.push({ runner, path: relative11(ctx.repoDir, dest) });
   }
   ctx.wallSealed = true;
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
@@ -15712,9 +15874,9 @@ var init_wall = __esm(() => {
 
 // ../../loki-ts/src/e10ext/discard.ts
 import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync15, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync48, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname25, join as join61, relative as relative11, sep as sep14 } from "path";
+import { dirname as dirname25, join as join61, relative as relative12, sep as sep14 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync23(repoDir), fp = join61(root, f), rel = relative11(root, dirname25(fp));
+  const root = realpathSync23(repoDir), fp = join61(root, f), rel = relative12(root, dirname25(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
@@ -15839,7 +16001,7 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename23, dirname as dirname27 } from "path";
+import { basename as basename24, dirname as dirname27 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -15854,7 +16016,7 @@ function outsideScope(o, staged) {
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
   const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname27(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename23(f)) && !plannedDirs.has(dirname27(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename24(f)) && !plannedDirs.has(dirname27(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -16481,7 +16643,7 @@ var init_seal_group = __esm(() => {
 
 // ../../loki-ts/src/supply/supply_guard.ts
 import { existsSync as existsSync46, readFileSync as readFileSync54, statSync as statSync22 } from "fs";
-import { basename as basename24, join as join68 } from "path";
+import { basename as basename25, join as join68 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -16493,7 +16655,7 @@ function supplyVerdict(verdict, r) {
   return r.blocked && verdict === "VERIFIED" ? "FAILED" : verdict;
 }
 function isManifestPath(path) {
-  return MANIFESTS.test(basename24(path));
+  return MANIFESTS2.test(basename25(path));
 }
 function readDeclared(repoDir) {
   const p = join68(repoDir, ".loki", DECLARED_FILE);
@@ -16691,7 +16853,7 @@ async function supplyGuard(repoDir, changedFiles2, declared, env, opts = {}) {
   }
   return { block: { guard: "v2", warn_age_days: MIN_AGE_DAYS, fail_age_days: failAge, declared: declared.deps.length, entries }, notProven, blocked };
 }
-var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50, MAX_DECLARED = 200, MAX_FILE_BYTES, DAY_MS = 86400000, MANIFESTS, ECO, NAME2, defaultResolver = async (dep, cwd) => {
+var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50, MAX_DECLARED = 200, MAX_FILE_BYTES, DAY_MS = 86400000, MANIFESTS2, ECO, NAME2, defaultResolver = async (dep, cwd) => {
   const argv = {
     npm: ["npm", "view", dep.name, "time.created", "--json"],
     pypi: ["pip", "index", "versions", "--pre", "--ignore-requires-python", dep.name],
@@ -16717,7 +16879,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
 var init_supply_guard = __esm(() => {
   init_shell();
   MAX_FILE_BYTES = 64 * 1024;
-  MANIFESTS = /^(package\.json|package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|requirements.*\.txt|pyproject\.toml|poetry\.lock|uv\.lock|Pipfile|Pipfile\.lock|go\.mod|go\.sum|Cargo\.toml|Cargo\.lock|Gemfile|Gemfile\.lock|composer\.json|composer\.lock|pom\.xml|build\.gradle(\.kts)?)$/;
+  MANIFESTS2 = /^(package\.json|package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|requirements.*\.txt|pyproject\.toml|poetry\.lock|uv\.lock|Pipfile|Pipfile\.lock|go\.mod|go\.sum|Cargo\.toml|Cargo\.lock|Gemfile|Gemfile\.lock|composer\.json|composer\.lock|pom\.xml|build\.gradle(\.kts)?)$/;
   ECO = { npm: "npm", node: "npm", pypi: "pypi", pip: "pypi", python: "pypi", cargo: "cargo", crates: "cargo", go: "go", golang: "go" };
   NAME2 = /^[A-Za-z0-9@][A-Za-z0-9@._/~+-]{0,213}$/;
   PUBLIC_HOSTS = new Set(["registry.npmjs.org", "registry.npmjs.com", "registry.yarnpkg.com", "npmjs.com", "npmjs.org", "pypi.org", "pypi.python.org", "files.pythonhosted.org", "crates.io", "index.crates.io", "static.crates.io", "proxy.golang.org", "golang.org", "pkg.go.dev"]);
@@ -16726,7 +16888,7 @@ var init_supply_guard = __esm(() => {
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash18 } from "crypto";
 import { existsSync as existsSync47, readdirSync as readdirSync24, mkdirSync as mkdirSync31, readFileSync as readFileSync55 } from "fs";
-import { basename as basename25, isAbsolute as isAbsolute11, join as join69, relative as relative12 } from "path";
+import { basename as basename26, isAbsolute as isAbsolute12, join as join69, relative as relative13 } from "path";
 function receiptSha256(r) {
   const { verification: _v, receipt_sha256: _h, ...body } = r;
   return sha2562(canonicalJson(body));
@@ -16798,8 +16960,8 @@ function renderReceiptMd(r) {
 `);
 }
 var SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str4 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
-  const r = relative12(ctx.repoDir, join69(ctx.runDir, "receipt.json"));
-  return r.startsWith("..") || isAbsolute11(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
+  const r = relative13(ctx.repoDir, join69(ctx.runDir, "receipt.json"));
+  return r.startsWith("..") || isAbsolute12(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
   const b = o.wall?.base_run ?? {};
   return typeof b.pass === "number" && b.pass > 0 && b.fail === 0 && (typeof b.not_run === "number" ? b.not_run : 0) === 0;
@@ -16834,6 +16996,7 @@ var init_seal = __esm(() => {
   init_hooks();
   init_atomic();
   init_safe_git();
+  init_base_guard();
   commitStage = {
     name: "commit",
     ...STAGE_BUDGETS.commit,
@@ -16888,7 +17051,7 @@ var init_seal = __esm(() => {
       for (let i = 0;i + 1 < rawDiff.length; i += 2)
         if ((rawDiff[i].trim().split(" ").pop() ?? "") !== "A" && isTestFile(rawDiff[i + 1]))
           weakTests.push(rawDiff[i + 1]);
-      const rcNotes = diffOk ? runnerConfigNotes(ctx.repoDir, ctx.baseSha, head, rawDiff.filter((_, i) => i % 2 === 1), signal) : [];
+      const rcNotes = diffOk ? [...runnerConfigNotes(ctx.repoDir, ctx.baseSha, head, rawDiff.filter((_, i) => i % 2 === 1), signal), ...addedSymlinkNotes(rawDiff, str4(o.plan?.plan))] : [];
       const grp = sealGroup(ctx.runDir, receiptSha256);
       const vraw = Array.isArray(o.verify?.checks) ? o.verify.checks : [], executed = hasExecutedProof(vraw), proof = process.env["LOKI_EXOGENOUS_PROOF"] === "0" ? executed : hasExogenousProof(vraw, pctx);
       const uncoveredAfterLimit = o.implement?.exit === "killed" ? strs2(o.verify?.uncovered_changed) : [];
@@ -16917,7 +17080,7 @@ var init_seal = __esm(() => {
         notProven.add(`Wall test not executed: ${wallNotRun} file(s), no reason recorded`);
       if (wallNotRun > 0) {
         try {
-          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename25(String(f.path))));
+          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename26(String(f.path))));
           for (const n3 of readdirSync24(join69(ctx.runDir, "wall")).sort())
             if (!kept.has(n3))
               notProven.add(`wall test discarded: ${n3} (not_run)`);
@@ -17093,7 +17256,7 @@ var init_seal = __esm(() => {
 
 // ../../loki-ts/src/util/composite_seal.ts
 import { existsSync as existsSync48, readFileSync as readFileSync56 } from "fs";
-import { basename as basename26, dirname as dirname31, join as join70 } from "path";
+import { basename as basename27, dirname as dirname31, join as join70 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
@@ -17216,7 +17379,7 @@ var init_keys_cmd = __esm(() => {
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
 import { existsSync as existsSync49, readFileSync as readFileSync57, renameSync as renameSync14, statSync as statSync24, writeFileSync as writeFileSync33 } from "fs";
-import { basename as basename27, dirname as dirname32, join as join71 } from "path";
+import { basename as basename28, dirname as dirname32, join as join71 } from "path";
 import { createHash as createHash19, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -17399,7 +17562,7 @@ var init_verify_cmd = __esm(() => {
 
 // src/server/app.ts
 import { existsSync as existsSync51, readFileSync as readFileSync60, statSync as statSync25 } from "fs";
-import { join as join74, resolve as resolve17, sep as sep16 } from "path";
+import { join as join74, resolve as resolve18, sep as sep16 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -28490,8 +28653,8 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve17(uiDir);
-    const f = resolve17(root, `.${p}`);
+    const root = resolve18(uiDir);
+    const f = resolve18(root, `.${p}`);
     if (f.startsWith(root + sep16) && existsSync51(f) && statSync25(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))