loki-mode 11.40.0 → 11.42.0

package/packages/control-plane/dist/server.js

@@ -7895,6 +7895,24 @@ var init_provider_cost = __esm(() => {
 });
 
 // ../../loki-ts/src/providers/model_routes.ts
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname8, resolve as resolve10 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function inferenceGeoTable() {
+  try {
+    const p = resolve10(dirname8(fileURLToPath2(import.meta.url)), "..", "..", "data", "model-pricing.json");
+    const t = JSON.parse(readFileSync21(p, "utf8")).inference_geo_multipliers;
+    if (t && typeof t === "object")
+      return t;
+  } catch {}
+  return { us: INFERENCE_GEO_US_FALLBACK };
+}
+function inferenceGeoMultiplier(env = process.env) {
+  const geo = (env["LOKI_INFERENCE_GEO"] ?? "").trim().toLowerCase();
+  const m = geo ? inferenceGeoTable()[geo] : undefined;
+  return typeof m === "number" && Number.isFinite(m) && m > 0 ? m : 1;
+}
+var INFERENCE_GEO_US_FALLBACK = 1.1;
 var init_model_routes = () => {};
 
 // ../../loki-ts/src/engine10/hooks.ts
@@ -7915,7 +7933,7 @@ function routerMode(env = process.env) {
 var routerEnabled = (env = process.env) => routerMode(env) === "on";
 
 // ../../loki-ts/src/engine10/cost.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync21 } from "fs";
+import { readdirSync as readdirSync11, readFileSync as readFileSync22 } from "fs";
 import { join as join28 } from "path";
 function routerTelemetryOn(env = process.env) {
   return routerEnabled(env);
@@ -7955,7 +7973,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
   const parsed = new Map;
   for (const iter of iterations) {
     try {
-      parsed.set(iter, JSON.parse(readFileSync21(resultCostPath(lokiRoot, iter), "utf8")));
+      parsed.set(iter, JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")));
     } catch {}
   }
   const own = new Set(iterations);
@@ -7964,7 +7982,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
     if (own.has(iter))
       continue;
     try {
-      lookup.push({ iter, rec: JSON.parse(readFileSync21(resultCostPath(lokiRoot, iter), "utf8")) });
+      lookup.push({ iter, rec: JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")) });
     } catch {}
   }
   const verdicts = hooks.costRecords?.resumeVerdicts(lookup) ?? { ambiguous: [], separate: [] };
@@ -8087,9 +8105,9 @@ import {
   writeFileSync as writeFileSync11,
   writeSync as writeSync3
 } from "fs";
-import { dirname as dirname8 } from "path";
+import { dirname as dirname9 } from "path";
 function durableWriteThenRename(target, body) {
-  mkdirSync8(dirname8(target), { recursive: true });
+  mkdirSync8(dirname9(target), { recursive: true });
   const tmp = tmpPathFor(target);
   const fd = openSync5(tmp, "w");
   try {
@@ -8104,7 +8122,7 @@ function durableWriteThenRename(target, body) {
 function fsyncParentDir(target) {
   let dfd = null;
   try {
-    dfd = openSync5(dirname8(target), "r");
+    dfd = openSync5(dirname9(target), "r");
     fsyncSync2(dfd);
   } catch {} finally {
     if (dfd !== null) {
@@ -8123,7 +8141,7 @@ function tmpPathFor(target) {
 }
 function atomicWriteText(target, body, opts = {}) {
   if (opts.durable === false) {
-    mkdirSync8(dirname8(target), { recursive: true });
+    mkdirSync8(dirname9(target), { recursive: true });
     const tmp = tmpPathFor(target);
     writeFileSync11(tmp, body);
     renameSync5(tmp, target);
@@ -8148,7 +8166,7 @@ function isProcessAlive(pid) {
 function tryAcquire(lockFile) {
   let fd = null;
   try {
-    mkdirSync8(dirname8(lockFile), { recursive: true });
+    mkdirSync8(dirname9(lockFile), { recursive: true });
     fd = openSync5(lockFile, "wx");
     writeSync3(fd, `${process.pid}
 `);
@@ -8257,32 +8275,32 @@ var init_atomic = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/budget.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync22, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname9, join as join29, resolve as resolve10 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname10, join as join29, resolve as resolve11 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function loadDefaultMaxCostUsd(dataDirs = [["..", "..", "data"], ["..", "data"]]) {
-  const here = dirname9(fileURLToPath2(import.meta.url));
+  const here = dirname10(fileURLToPath3(import.meta.url));
   for (const rel of dataDirs) {
     try {
-      const j = JSON.parse(readFileSync22(resolve10(here, ...rel, "model-pricing.json"), "utf8"));
+      const j = JSON.parse(readFileSync23(resolve11(here, ...rel, "model-pricing.json"), "utf8"));
       if (typeof j.default_max_cost_usd === "number" && Number.isFinite(j.default_max_cost_usd) && j.default_max_cost_usd > 0)
         return j.default_max_cost_usd;
     } catch {}
   }
   if (!pricingFallbackWarned) {
     pricingFallbackWarned = true;
-    process.stderr.write(`loki: warning: model-pricing.json is missing or unreadable (looked in ${dataDirs.map((r) => resolve10(here, ...r)).join(", ")}); using fallback default max cost $${DEFAULT_FALLBACK_USD}
+    process.stderr.write(`loki: warning: model-pricing.json is missing or unreadable (looked in ${dataDirs.map((r) => resolve11(here, ...r)).join(", ")}); using fallback default max cost $${DEFAULT_FALLBACK_USD}
 `);
   }
   return DEFAULT_FALLBACK_USD;
 }
 function _loadPricing() {
   try {
-    const moduleDir = dirname9(fileURLToPath2(import.meta.url));
-    const jsonPath = resolve10(moduleDir, "..", "..", "data", "model-pricing.json");
+    const moduleDir = dirname10(fileURLToPath3(import.meta.url));
+    const jsonPath = resolve11(moduleDir, "..", "..", "data", "model-pricing.json");
     if (!existsSync17(jsonPath))
       return _FALLBACK_PRICING;
-    const raw2 = JSON.parse(readFileSync22(jsonPath, "utf8"));
+    const raw2 = JSON.parse(readFileSync23(jsonPath, "utf8"));
     const pricing2 = raw2["pricing"];
     if (!pricing2 || typeof pricing2 !== "object")
       return _FALLBACK_PRICING;
@@ -8329,8 +8347,9 @@ function exactIdKey(m) {
   }
   return best;
 }
-function calculateCostFromRecords(records) {
+function calculateCostFromRecords(records, env = process.env) {
   let total = 0;
+  const geo = inferenceGeoMultiplier(env);
   for (const d of records) {
     if (typeof d.cost_usd === "number" && Number.isFinite(d.cost_usd)) {
       total += d.cost_usd;
@@ -8343,13 +8362,14 @@ function calculateCostFromRecords(records) {
     const cWrite = typeof d.cache_creation_tokens === "number" ? d.cache_creation_tokens : 0;
     const readRate = p.cache_read ?? p.input;
     const writeRate = p.cache_write ?? p.input;
-    total += inp / 1e6 * p.input + out2 / 1e6 * p.output + cRead / 1e6 * readRate + cWrite / 1e6 * writeRate;
+    total += (inp / 1e6 * p.input + out2 / 1e6 * p.output + cRead / 1e6 * readRate + cWrite / 1e6 * writeRate) * geo;
   }
   return round4(total);
 }
 var DEFAULT_FALLBACK_USD = 100, pricingFallbackWarned = false, _FALLBACK_PRICING, PRICING, DEFAULT_PRICING_KEY = "sonnet", warnedCorruptBudget;
 var init_budget = __esm(() => {
   init_atomic();
+  init_model_routes();
   init_paths();
   init_cost();
   _FALLBACK_PRICING = {
@@ -8591,8 +8611,8 @@ var init_schema = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history_store.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync23, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync24, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "fs";
+import { resolve as resolve12 } from "path";
 function validRun(v) {
   if (typeof v !== "object" || v === null)
     return false;
@@ -8600,14 +8620,14 @@ function validRun(v) {
   return typeof r["shape"] === "string" && typeof r["executor"] === "string" && EXECUTORS.includes(r["executor"]) && typeof r["verdict"] === "string" && VERDICTS.includes(r["verdict"]) && (r["owner"] === null || typeof r["owner"] === "string" && OWNERS.includes(r["owner"])) && typeof r["escalated"] === "boolean" && typeof r["usd"] === "number" && Number.isFinite(r["usd"]) && typeof r["wallS"] === "number" && Number.isFinite(r["wallS"]);
 }
 function historyPath(key, cacheRoot) {
-  return resolve11(repoCacheDir(key, cacheRoot), HISTORY_FILE);
+  return resolve12(repoCacheDir(key, cacheRoot), HISTORY_FILE);
 }
 function readRunHistory(key, cacheRoot) {
   const path = historyPath(key, cacheRoot);
   if (!existsSync19(path))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync23(path, "utf8"));
+    const parsed = JSON.parse(readFileSync24(path, "utf8"));
     const runs2 = parsed?.runs;
     return Array.isArray(runs2) ? runs2.filter(validRun) : [];
   } catch {
@@ -8645,8 +8665,8 @@ var init_history_store = __esm(() => {
 
 // ../../loki-ts/src/project_model/gather.ts
 import { createHash as createHash7 } from "crypto";
-import { closeSync as closeSync6, lstatSync as lstatSync7, openSync as openSync6, readFileSync as readFileSync24, readSync as readSync5 } from "fs";
-import { dirname as dirname10, join as join31 } from "path";
+import { closeSync as closeSync6, lstatSync as lstatSync7, openSync as openSync6, readFileSync as readFileSync25, readSync as readSync5 } from "fs";
+import { dirname as dirname11, join as join31 } from "path";
 function listShallow(repoDir) {
   try {
     const out2 = safeGit(repoDir, ["ls-files", "-z"], { maxBuffer: 256 * 1024 * 1024 });
@@ -8656,7 +8676,7 @@ function listShallow(repoDir) {
   }
 }
 function shallowDirs(repoDir) {
-  return [...new Set(listShallow(repoDir).map((p) => dirname10(p)))].sort();
+  return [...new Set(listShallow(repoDir).map((p) => dirname11(p)))].sort();
 }
 function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
   const h = createHash7("sha256");
@@ -8674,7 +8694,7 @@ function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
       else {
         const abs = join31(repoDir, f);
         const size = lstatSync7(abs).size;
-        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync24(abs) : `too-large:${size}`);
+        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync25(abs) : `too-large:${size}`);
       }
     } catch {
       h.update("missing");
@@ -8731,8 +8751,8 @@ var init_engine_origin = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history.ts
-import { dirname as dirname11, join as join32, resolve as resolve12 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname12, join as join32, resolve as resolve13 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 function shapeKey(model) {
   if (!model || model.status !== "ok")
     return null;
@@ -8763,7 +8783,7 @@ var init_history = __esm(() => {
   init_cache();
   init_engine_origin();
   init_history_store();
-  SHAPE_DEFAULTS_FILE = resolve12(dirname11(fileURLToPath3(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
+  SHAPE_DEFAULTS_FILE = resolve13(dirname12(fileURLToPath4(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
 });
 
 // ../../loki-ts/src/runner/router/unit_model.ts
@@ -8856,7 +8876,7 @@ var init_model_rank = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/sizing.ts
-import { existsSync as existsSync20, readFileSync as readFileSync25 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync26 } from "fs";
 import { basename as basename9 } from "path";
 function namedFiles(task, map) {
   return (map?.files ?? []).filter((f) => task.toLowerCase().includes(basename9(f).toLowerCase()));
@@ -8878,7 +8898,7 @@ function sizeTask(task, map, tests) {
 }
 function loadRepoMap(repomapRef) {
   try {
-    return repomapRef && existsSync20(repomapRef) ? JSON.parse(readFileSync25(repomapRef, "utf8")) : null;
+    return repomapRef && existsSync20(repomapRef) ? JSON.parse(readFileSync26(repomapRef, "utf8")) : null;
   } catch {
     return null;
   }
@@ -8940,14 +8960,14 @@ var init_model_downgrades = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/discover.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync26, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync27, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
 import { join as join34 } from "path";
 function projectModelEnabled(env = process.env) {
   return env["LOKI_E10_PROJECT_MODEL"] !== "0";
 }
 function loadCached(repoDir, now2 = Date.now()) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync26(join34(repoDir, PROJECT_FILE), "utf8")), now2);
+    return parseCached(repoDir, JSON.parse(readFileSync27(join34(repoDir, PROJECT_FILE), "utf8")), now2);
   } catch {
     return null;
   }
@@ -8962,7 +8982,7 @@ function loadCommitted(repoDir) {
   };
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync26(join34(repoDir, PROJECT_FILE), "utf8"));
+    raw2 = JSON.parse(readFileSync27(join34(repoDir, PROJECT_FILE), "utf8"));
   } catch (e) {
     return ignore(`unreadable JSON (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -9103,8 +9123,8 @@ var init_test_file_text = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/testmap.ts
-import { existsSync as existsSync22, readFileSync as readFileSync27, realpathSync as realpathSync15 } from "fs";
-import { basename as basename11, dirname as dirname12, extname, isAbsolute as isAbsolute2, join as join36, relative, sep as sep10 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync28, realpathSync as realpathSync15 } from "fs";
+import { basename as basename11, dirname as dirname13, extname, isAbsolute as isAbsolute2, join as join36, relative, sep as sep10 } from "path";
 function projectInterpreter(root) {
   const ve = process.env["VIRTUAL_ENV"], inRepo = (p) => {
     try {
@@ -9127,8 +9147,8 @@ var init_testmap = __esm(() => {
 // ../../loki-ts/src/util/check_result.ts
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync28, realpathSync as realpathSync16, renameSync as renameSync7, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "fs";
-import { basename as basename12, dirname as dirname13, isAbsolute as isAbsolute3, join as join37, relative as relative2 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync29, realpathSync as realpathSync16, renameSync as renameSync7, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "fs";
+import { basename as basename12, dirname as dirname14, isAbsolute as isAbsolute3, join as join37, relative as relative2 } from "path";
 function plainTestEnv(base = process.env) {
   const e = {};
   for (const [k, v] of Object.entries(tokenFreeEnv(base)))
@@ -9559,7 +9579,7 @@ function publishableWall(repoDir, runDir, o, env = process.env) {
     if (!hit || rel.startsWith("..") || isAbsolute3(rel) || rel.startsWith(".loki/") || !basename12(rel).startsWith("loki_wall_"))
       continue;
     try {
-      const bytes = readFileSync28(join37(runDir, "wall", basename12(rel)));
+      const bytes = readFileSync29(join37(runDir, "wall", basename12(rel)));
       if (createHash8("sha256").update(bytes).digest("hex") !== w["sha256"])
         throw new Error("hash");
       out2.files.push({ rel, bytes, cmd: String(hit["cmd"]) });
@@ -9598,7 +9618,7 @@ function diffFiles(repoDir, baseSha, skip) {
       return f;
     let n2 = 0;
     try {
-      n2 = readFileSync28(join37(repoDir, path), "utf8").split(`
+      n2 = readFileSync29(join37(repoDir, path), "utf8").split(`
 `).length;
     } catch {}
     return { path, added: n2, deleted: 0, status: "added" };
@@ -9621,7 +9641,7 @@ function diffFiles(repoDir, baseSha, skip) {
     let text2 = added.get(f.path) ?? "";
     if (!text2 && f.status === "added") {
       try {
-        text2 = readFileSync28(join37(repoDir, f.path), "utf8");
+        text2 = readFileSync29(join37(repoDir, f.path), "utf8");
       } catch {}
     }
     const rule = criticalRuleFor(f.path, text2, rules);
@@ -9633,7 +9653,7 @@ function diffFiles(repoDir, baseSha, skip) {
       continue;
     try {
       const oldText = f.status === "added" ? "" : safeGit(repoDir, ["show", `${baseSha}:${f.path}`]);
-      const newText = readFileSync28(join37(repoDir, f.path), "utf8");
+      const newText = readFileSync29(join37(repoDir, f.path), "utf8");
       const patch = f.status === "added" ? newText.split(`
 `).map((l) => `+${l}`).join(`
 `) : safeGit(repoDir, ["diff", "-U0", baseSha, "--", f.path]);
@@ -9798,13 +9818,13 @@ async function mapPool(items, jobs, fn, stop = () => false) {
   return out2;
 }
 function spawnCollect(cmd, args, o) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     let out2 = "", err = "", error = false, done = false;
     const MAX = 1024 * 1024;
     const fin = (status) => {
       if (!done) {
         done = true;
-        resolve13({ status: error ? null : status, output: `${out2}
+        resolve14({ status: error ? null : status, output: `${out2}
 ${err}` });
       }
     };
@@ -9860,7 +9880,7 @@ function runnerCmd(t, repoDir) {
     case "npm":
       return ["npm", ["test", "--silent"]];
     case "go":
-      return ["go", ["test", "-json", `./${dirname13(t.path)}`]];
+      return ["go", ["test", "-json", `./${dirname14(t.path)}`]];
     case "cargo":
       return ["cargo", ["test"]];
   }
@@ -9916,11 +9936,11 @@ async function publishWall(git, runId, repoDir, files, done) {
   for (const f of files) {
     const abs = join37(repoDir, f.rel);
     try {
-      if (!realpathSync16(dirname13(abs)).startsWith(realpathSync16(repoDir)))
+      if (!realpathSync16(dirname14(abs)).startsWith(realpathSync16(repoDir)))
         return false;
     } catch {}
     rmSync8(abs, { force: true });
-    mkdirSync12(dirname13(abs), { recursive: true });
+    mkdirSync12(dirname14(abs), { recursive: true });
     writeFileSync15(abs, f.bytes);
   }
   if ((await git(["--literal-pathspecs", "add", "--", ...rels])).code !== 0 || (await git(["--literal-pathspecs", "commit", "-q", "-m", "test: loki acceptance checks (Wall)", "-m", `Loki-Wall-Publish: ${runId}
@@ -9936,7 +9956,7 @@ var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could n
 `), tailLines = (out2) => out2.split(`
 `).filter((x) => x.trim()).slice(-12), GO_PKG_RE, EXIT_CODED_COUNT = "n/a (exit-coded check, not a test runner)", FRAMEWORK_RE, SCRIPT_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, REVIEWER_ITEM = "one reviewer", PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), DEEP_ITEMS, NOT_SELECTED = "not selected by risk tier: ", MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, SEM_RULES, DOC_FILE, readOr = (p) => {
   try {
-    return readFileSync28(p, "utf8");
+    return readFileSync29(p, "utf8");
   } catch {
     return null;
   }
@@ -10013,10 +10033,10 @@ var init_check_result = __esm(() => {
 
 // ../../loki-ts/src/util/receipt_signer.ts
 import { createHash as createHash9, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign, verify as verify2 } from "crypto";
-import { chmodSync as chmodSync4, linkSync, mkdirSync as mkdirSync13, readdirSync as readdirSync14, readFileSync as readFileSync29, renameSync as renameSync8, statSync as statSync15, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
+import { chmodSync as chmodSync4, linkSync, mkdirSync as mkdirSync13, readdirSync as readdirSync14, readFileSync as readFileSync30, renameSync as renameSync8, statSync as statSync15, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir8 } from "os";
 import { spawnSync as spawnSync2 } from "child_process";
-import { dirname as dirname14, join as join38 } from "path";
+import { dirname as dirname15, join as join38 } from "path";
 function canonicalJson(x) {
   const walk = (v) => {
     if (Array.isArray(v))
@@ -10039,9 +10059,9 @@ function loadSigningKey(generate = true) {
       const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
       const file = given || join38(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
       try {
-        pem = readFileSync29(file);
+        pem = readFileSync30(file);
         if (!given) {
-          for (const [f, m] of [[file, 384], [dirname14(file), 448]])
+          for (const [f, m] of [[file, 384], [dirname15(file), 448]])
             if (statSync15(f).mode & 63)
               chmodSync4(f, m);
         }
@@ -10050,8 +10070,8 @@ function loadSigningKey(generate = true) {
           lastProblem = `signing key file unreadable (${e.code ?? "error"})`;
         if (e.code !== "ENOENT" || !generate)
           return null;
-        mkdirSync13(dirname14(dirname14(file)), { recursive: true, mode: 448 });
-        mkdirSync13(dirname14(file), { recursive: true, mode: 448 });
+        mkdirSync13(dirname15(dirname15(file)), { recursive: true, mode: 448 });
+        mkdirSync13(dirname15(file), { recursive: true, mode: 448 });
         const tmp = `${file}.${randomBytes3(6).toString("hex")}.tmp`;
         writeFileSync16(tmp, generateKeyPairSync("ed25519").privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: 384 });
         try {
@@ -10062,7 +10082,7 @@ function loadSigningKey(generate = true) {
         } finally {
           unlinkSync5(tmp);
         }
-        pem = readFileSync29(file);
+        pem = readFileSync30(file);
       }
     }
     stage = "parse";
@@ -10195,12 +10215,12 @@ var init_stop_restore = __esm(() => {
 });
 
 // ../../loki-ts/src/util/base_guard.ts
-import { existsSync as existsSync24, readdirSync as readdirSync15, readFileSync as readFileSync30, readlinkSync, realpathSync as realpathSync17, symlinkSync } from "fs";
-import { basename as basename13, join as join39, relative as relative3, resolve as resolve13, sep as sep11 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync24, readdirSync as readdirSync15, readFileSync as readFileSync31, readlinkSync, realpathSync as realpathSync17, symlinkSync } from "fs";
+import { basename as basename13, join as join39, relative as relative3, resolve as resolve14, sep as sep11 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 function insideAny(p, roots) {
   const under = (q) => roots.some((r) => q === r || q.startsWith(r + sep11));
-  if (under(resolve13(p)))
+  if (under(resolve14(p)))
     return true;
   try {
     return under(realpathSync17(p));
@@ -10213,12 +10233,12 @@ function namedPaths(file, text2) {
   if (basename13(file) !== "direct_url.json")
     return out2;
   const url = JSON.parse(text2).url;
-  return typeof url === "string" && url.startsWith("file:") ? [...out2, fileURLToPath4(url)] : out2;
+  return typeof url === "string" && url.startsWith("file:") ? [...out2, fileURLToPath5(url)] : out2;
 }
 function depsSeeHead(pkgDir, repoDir) {
   let roots;
   try {
-    roots = [...new Set([resolve13(repoDir), realpathSync17(repoDir)])];
+    roots = [...new Set([resolve14(repoDir), realpathSync17(repoDir)])];
   } catch {
     return true;
   }
@@ -10229,7 +10249,7 @@ function depsSeeHead(pkgDir, repoDir) {
         return true;
       const p = join39(dir, e.name);
       if (e.isSymbolicLink()) {
-        const t = resolve13(dir, readlinkSync(p));
+        const t = resolve14(dir, readlinkSync(p));
         let rt = t;
         try {
           rt = realpathSync17(t);
@@ -10240,7 +10260,7 @@ function depsSeeHead(pkgDir, repoDir) {
         if (walk(p, own))
           return true;
       } else if (REPO_LINK_FILE.test(e.name)) {
-        const text2 = readFileSync30(p, "utf8");
+        const text2 = readFileSync31(p, "utf8");
         if (roots.some((r) => text2.includes(r)) || namedPaths(p, text2).some((n2) => insideAny(n2, roots)))
           return true;
       }
@@ -10251,7 +10271,7 @@ function depsSeeHead(pkgDir, repoDir) {
     return ["node_modules", ".venv"].some((d) => {
       try {
         const top = join39(pkgDir, d);
-        return walk(top, [...new Set([resolve13(top), realpathSync17(top)])]);
+        return walk(top, [...new Set([resolve14(top), realpathSync17(top)])]);
       } catch (e) {
         if (e.code === "ENOENT")
           return false;
@@ -11151,8 +11171,8 @@ var init_state = __esm(() => {
 
 // ../../loki-ts/src/runner/repo_profile.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync31, mkdirSync as mkdirSync14, readdirSync as readdirSync16, renameSync as renameSync9, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "fs";
-import { basename as basename14, join as join40, resolve as resolve14, isAbsolute as isAbsolute4 } from "path";
+import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync32, mkdirSync as mkdirSync14, readdirSync as readdirSync16, renameSync as renameSync9, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "fs";
+import { basename as basename14, join as join40, resolve as resolve15, isAbsolute as isAbsolute4 } from "path";
 function detectFormatters(repoDir) {
   const out2 = [];
   const has = (...fs2) => fs2.some((f) => existsSync25(join40(repoDir, f)));
@@ -11191,7 +11211,7 @@ function runFormatters(repoDir, files, env) {
 }
 function loadProfile(repoDir) {
   try {
-    const p = JSON.parse(readFileSync31(commandProfilePath(repoDir), "utf8"));
+    const p = JSON.parse(readFileSync32(commandProfilePath(repoDir), "utf8"));
     return p?.version === 1 && Array.isArray(p.commands) && p.baseline ? p : null;
   } catch {
     return null;
@@ -11295,7 +11315,7 @@ async function staticPreExisting(tool, prefix, files, io) {
 }
 var commandProfilePath = (repoDir) => join40(repoDir, ".loki", "state", "repo-profile.json"), read = (p) => {
   try {
-    return readFileSync31(p, "utf8");
+    return readFileSync32(p, "utf8");
   } catch {
     return "";
   }
@@ -11341,7 +11361,7 @@ var init_context = __esm(() => {
 });
 
 // ../../loki-ts/src/util/steer.ts
-import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync17, lstatSync as lstatSync11, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync32, readSync as readSync7, renameSync as renameSync10, statSync as statSync16, lutimesSync, rmSync as rmSync10, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18, existsSync as existsSync26 } from "fs";
+import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync17, lstatSync as lstatSync11, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync33, readSync as readSync7, renameSync as renameSync10, statSync as statSync16, lutimesSync, rmSync as rmSync10, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18, existsSync as existsSync26 } from "fs";
 import { createHash as createHash10, randomBytes as randomBytes4 } from "crypto";
 import { basename as basename15, join as join41 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
@@ -11559,7 +11579,7 @@ function recordRevisions(repoDir, text2, archived, at) {
   const file = join41(repoDir, ".loki", "intent-revisions.jsonl");
   let last = 0;
   try {
-    for (const l of readFileSync32(file, "utf8").split(`
+    for (const l of readFileSync33(file, "utf8").split(`
 `)) {
       try {
         last = Math.max(last, Number(JSON.parse(l).rev) || 0);
@@ -11625,8 +11645,8 @@ var init_steer = __esm(() => {
 
 // ../../loki-ts/src/util/run_outputs.ts
 import { createHash as createHash11 } from "crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync16, readdirSync as readdirSync18, readFileSync as readFileSync33, statSync as statSync17, writeFileSync as writeFileSync19 } from "fs";
-import { join as join42, resolve as resolve15 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync16, readdirSync as readdirSync18, readFileSync as readFileSync34, statSync as statSync17, writeFileSync as writeFileSync19 } from "fs";
+import { join as join42, resolve as resolve16 } from "path";
 function intentRevisionsBlock(revs) {
   const r = (revs ?? []).filter((r2) => r2.unapplied !== true).map(({ rev, source, actor, sha: sha2 }) => ({ rev, source, actor, sha: sha2 }));
   return r.length ? { intent_revisions: r } : {};
@@ -11634,11 +11654,11 @@ function intentRevisionsBlock(revs) {
 function seededCorpusBlock(env = process.env) {
   const dir = env["LOKI_SEEDED_DEFECTS_DIR"] || join42(REPO_ROOT, "benchmarks", "seeded-defects");
   try {
-    const bytes = readFileSync33(join42(dir, "manifest.json")), version2 = createHash11("sha256").update(bytes).digest("hex");
+    const bytes = readFileSync34(join42(dir, "manifest.json")), version2 = createHash11("sha256").update(bytes).digest("hex");
     const ids = (JSON.parse(bytes.toString("utf8")).defects ?? []).map((d) => d.id);
     let rate = null;
     try {
-      const res = JSON.parse(readFileSync33(join42(dir, "results", "wrong-pass.json"), "utf8"));
+      const res = JSON.parse(readFileSync34(join42(dir, "results", "wrong-pass.json"), "utf8"));
       const runs2 = res.manifest_sha256 === version2 && Array.isArray(res.runs) ? res.runs : [];
       const complete = (o) => !!o && Object.keys(o).length === ids.length && ids.every((id) => typeof id === "string" && (o[id] === "SEALED" || o[id] === "NOT_SEALED"));
       const top = runs2.filter((r) => r.setup === "top"), floor = runs2.filter((r) => r.setup === "floor");
@@ -11922,7 +11942,7 @@ var init_registry2 = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync34 } from "fs";
+import { readFileSync as readFileSync35 } from "fs";
 function pae(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -11999,7 +12019,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId2) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync34(receiptPath, "utf8")), runId2);
+    return envelopeRunIdProblem(JSON.parse(readFileSync35(receiptPath, "utf8")), runId2);
   } catch {
     return null;
   }
@@ -12128,9 +12148,9 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, rmSync as rmSync11, symlinkSync as symlinkSync2, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync36, rmSync as rmSync11, symlinkSync as symlinkSync2, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename16, dirname as dirname15, isAbsolute as isAbsolute6, join as join44, relative as relative5 } from "path";
+import { basename as basename16, dirname as dirname16, isAbsolute as isAbsolute6, join as join44, relative as relative5 } from "path";
 function mutationProof(i) {
   const rels = i.wallFiles.map((f) => isAbsolute6(f.path) ? relative5(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
@@ -12158,8 +12178,8 @@ function mutationProof(i) {
       const sealed = join44(i.runDir, "wall", basename16(rel)), src = existsSync28(sealed) ? sealed : join44(i.repoDir, rel);
       if (!existsSync28(src))
         return np(`Wall file missing: ${rel}`);
-      mkdirSync17(dirname15(join44(wt, rel)), { recursive: true });
-      writeFileSync20(join44(wt, rel), readFileSync35(src));
+      mkdirSync17(dirname16(join44(wt, rel)), { recursive: true });
+      writeFileSync20(join44(wt, rel), readFileSync36(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
@@ -12343,7 +12363,7 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants3, existsSync as existsSync29, mkdtempSync as mkdtempSync4, readFileSync as readFileSync36, realpathSync as realpathSync19, rmSync as rmSync12, statSync as statSync18 } from "fs";
+import { accessSync, constants as constants3, existsSync as existsSync29, mkdtempSync as mkdtempSync4, readFileSync as readFileSync37, realpathSync as realpathSync19, rmSync as rmSync12, statSync as statSync18 } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
@@ -12701,7 +12721,7 @@ var init_wall_manifest = __esm(() => {
 
 // ../../loki-ts/src/features/wall_manifest_wire.ts
 import { createHash as createHash13 } from "crypto";
-import { basename as basename17, dirname as dirname16 } from "path";
+import { basename as basename17, dirname as dirname17 } from "path";
 function blobEntries(ls) {
   const out2 = [];
   for (const raw2 of ls.toString("latin1").split("\x00")) {
@@ -12731,7 +12751,7 @@ function wallManifestFor(repoDir, tree, task, env = process.env) {
       return null;
     const low = task.toLowerCase().replace(/\\/g, "/");
     const token = (n2) => new RegExp(`(?<![A-Za-z0-9_])${n2.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`).test(low);
-    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename17(e.path)) && e.path.includes("/") && token(dirname16(e.path));
+    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename17(e.path)) && e.path.includes("/") && token(dirname17(e.path));
     const matched = all.filter((e) => SOURCE.test(e.path) && (token(basename17(e.path)) || token(e.path) || token(basename17(e.path).replace(/\.[^.]*$/, "")) || dirModule(e)));
     const spans = (p) => [...low.matchAll(new RegExp(`(?<![A-Za-z0-9_])${p.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`, "g"))].map((m) => [m.index, m.index + m[0].length]);
     const occ = new Map(matched.map((e) => [e, spans(e.path)]));
@@ -12793,7 +12813,7 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 
 // ../../loki-ts/src/util/holdout.ts
 import { createHash as createHash14 } from "crypto";
-import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync37, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "fs";
+import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync38, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
 import { basename as basename18, join as join45, relative as relative6 } from "path";
 function wallHoldoutRatio(env = process.env) {
@@ -12828,7 +12848,7 @@ function stashHoldout(o) {
   const files = held.map((name) => {
     copyFileSync2(join45(o.srcDir, name), join45(dir, name));
     rmSync13(join45(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync37(join45(dir, name), "utf8")) };
+    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync38(join45(dir, name), "utf8")) };
   });
   writeFileSync21(join45(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
@@ -12837,14 +12857,14 @@ function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync37(join45(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync38(join45(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
     return { tests, missing: [`holdout store unreadable: ${basename18(dir)}`], cleanup: () => {} };
   mkdirSync18(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
     const src = join45(dir, f.name);
-    if (!existsSync30(src) || sha2(readFileSync37(src, "utf8")) !== f.sha256) {
+    if (!existsSync30(src) || sha2(readFileSync38(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
@@ -13172,8 +13192,8 @@ var init_install = __esm(() => {
 });
 
 // ../../loki-ts/src/features/runner_config.ts
-import { readFileSync as readFileSync38 } from "fs";
-import { dirname as dirname17, join as join48, normalize as normalize2 } from "path";
+import { readFileSync as readFileSync39 } from "fs";
+import { dirname as dirname18, join as join48, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
     while (/\s/.test(s[i] ?? "x"))
@@ -13448,7 +13468,7 @@ function referenced(cfg, text2) {
       if (v && !/[$*]/.test(v))
         raw2.push(v);
     }
-  const dir = dirname17(cfg), explicit = ROOT_DIR.exec(text2), roots = [dir];
+  const dir = dirname18(cfg), explicit = ROOT_DIR.exec(text2), roots = [dir];
   if (explicit)
     roots.push("", ...explicit[1] ? [join48(dir, explicit[1])] : []);
   return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join48(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join48(dir, t)))];
@@ -13499,7 +13519,7 @@ function runnerConfigNotes(repoDir, baseSha, head, changed, signal) {
       bad = true;
     }
     if (bad) {
-      const dir = dirname17(cfg), loaded = [...ch].find((c) => c !== cfg && (dir === "." || c.startsWith(dir + "/")) && !NON_SOURCE.test(c));
+      const dir = dirname18(cfg), loaded = [...ch].find((c) => c !== cfg && (dir === "." || c.startsWith(dir + "/")) && !NON_SOURCE.test(c));
       if (ch.has(cfg) || loaded)
         notes.add(`runner config unparseable, trust capped: ${cfg}${loaded ? ` (${loaded} changed and may be loaded by it)` : ""}`);
     }
@@ -13531,7 +13551,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync38(join48(dir, f), "utf8");
+    return readFileSync39(join48(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -13571,7 +13591,7 @@ var init_runner_config = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync39, rmSync as rmSync15 } from "fs";
+import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync40, rmSync as rmSync15 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
 import { join as join49 } from "path";
 import { basename as basename20 } from "path";
@@ -13614,7 +13634,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync39(join49(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync40(join49(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -13843,11 +13863,11 @@ var init_wall_owned = __esm(() => {
 
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync40, renameSync as renameSync11, writeFileSync as writeFileSync22 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync41, renameSync as renameSync11, writeFileSync as writeFileSync22 } from "fs";
 import { join as join51 } from "path";
 function readJson4(p) {
   try {
-    const v = JSON.parse(readFileSync40(p, "utf8"));
+    const v = JSON.parse(readFileSync41(p, "utf8"));
     return v && typeof v === "object" ? v : null;
   } catch {
     return null;
@@ -13879,7 +13899,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]), noApp = m[4] === "1";
-    const pidTxt = existsSync31(join51(dir, "app.pid")) ? readFileSync40(join51(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync31(join51(dir, "app.pid")) ? readFileSync41(join51(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
     const st = readJson4(join51(dir, "state.json"));
     url = typeof st?.["url"] === "string" ? st["url"] : null;
@@ -13956,10 +13976,10 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync41, realpathSync as realpathSync21, rmSync as rmSync16, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync42, realpathSync as realpathSync21, rmSync as rmSync16, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
 import { randomBytes as randomBytes5 } from "crypto";
 import { tmpdir as tmpdir9 } from "os";
-import { basename as basename21, dirname as dirname18, join as join52, resolve as resolve16, sep as sep12 } from "path";
+import { basename as basename21, dirname as dirname19, join as join52, resolve as resolve17, sep as sep12 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
 }
@@ -14149,7 +14169,7 @@ async function scanAddedLines(repoDir, opts = {}) {
         continue;
       }
       const lines2 = new Map;
-      readFileSync41(join52(repoDir, p), "utf8").split(`
+      readFileSync42(join52(repoDir, p), "utf8").split(`
 `).forEach((t, i) => lines2.set(i + 1, t));
       added.set(p, lines2);
     } catch {}
@@ -14158,14 +14178,14 @@ async function scanAddedLines(repoDir, opts = {}) {
     return { ok: true, findings: skipped2 };
   const mirror = mkdtempSync7(join52(tmpdir9(), "loki-secure-added-"));
   try {
-    const root = resolve16(mirror) + sep12;
+    const root = resolve17(mirror) + sep12;
     const chunkMap = new Map;
     const chunkRoot = `.loki-chunks-${randomBytes5(6).toString("hex")}`;
     let chunkSeq = 0;
     for (const [p, lines2] of added) {
       if (lines2.size === 0)
         continue;
-      const dest = resolve16(mirror, p);
+      const dest = resolve17(mirror, p);
       if (!dest.startsWith(root))
         continue;
       let max = 0;
@@ -14203,11 +14223,11 @@ async function scanAddedLines(repoDir, opts = {}) {
       const whole = chunks.length === 1;
       for (const c of chunks) {
         const rel = whole ? p : join52(chunkRoot, String(chunkSeq++), basename21(p));
-        const out2 = whole ? dest : resolve16(mirror, rel);
+        const out2 = whole ? dest : resolve17(mirror, rel);
         if (!out2.startsWith(root))
           break;
         chunkMap.set(rel, { file: p, lines: c.orig });
-        mkdirSync20(dirname18(out2), { recursive: true });
+        mkdirSync20(dirname19(out2), { recursive: true });
         writeFileSync23(out2, c.body.join(`
 `) + `
 `);
@@ -14257,8 +14277,8 @@ var init_secure_scan = __esm(() => {
 var init_retry_class = () => {};
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync33, readdirSync as readdirSync19, readFileSync as readFileSync42 } from "fs";
-import { basename as basename22, dirname as dirname19, isAbsolute as isAbsolute9, join as join53, relative as relative9, resolve as resolve17 } from "path";
+import { existsSync as existsSync33, readdirSync as readdirSync19, readFileSync as readFileSync43 } from "fs";
+import { basename as basename22, dirname as dirname20, isAbsolute as isAbsolute9, join as join53, relative as relative9, resolve as resolve18 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -14293,7 +14313,7 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join53(dirname19(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  const next = join53(dirname20(file), ext.endsWith(".json") ? ext : `${ext}.json`);
   return existsSync33(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
@@ -14364,8 +14384,8 @@ function nearestPackageRoot(testDir, repoDir, fileName) {
     }
   };
   let pkg = testDir;
-  while (pkg !== repoDir && pkg !== dirname19(pkg) && !shaped(pkg))
-    pkg = dirname19(pkg);
+  while (pkg !== repoDir && pkg !== dirname20(pkg) && !shaped(pkg))
+    pkg = dirname20(pkg);
   return pkg;
 }
 function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
@@ -14435,7 +14455,7 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
         return join53(testDir, "__self__");
       const url = /^fileURLToPath\(new URL\((["'])([^"']*)\1\s*,\s*import\.meta\.url\)\)$/.exec(e);
       if (url)
-        return resolve17(testDir, url[2]);
+        return resolve18(testDir, url[2]);
       const lit = /^(["'`])((?:\\.|(?!\1)[^\\])*)\1$/.exec(e);
       if (lit)
         return lit[2].includes("${") ? null : lit[2];
@@ -14448,8 +14468,8 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
       if (args.some((a) => a === null))
         return null;
       if (call[1] === "dirname")
-        return dirname19(args[0]);
-      const out2 = resolve17(...args);
+        return dirname20(args[0]);
+      const out2 = resolve18(...args);
       const first = parts.slice(1).map((a) => /^\s*["'`]([^"'`]*)["'`]\s*$/.exec(a)?.[1]).find((x) => x), viaWalk = !!first && walk.has(parts[0].trim()) && [pkg, repoDir].some((d) => existsSync33(join53(d, first.split("/").filter(Boolean)[0] ?? "\x00")));
       if (report && (viaWalk || !parts.some((a) => walk.has(a.trim()) || taint.has(a.trim())) && (relative9(testDir, out2).startsWith("..") || strayInTestDir(out2))) && parts.some((a) => /^\s*["'`]/.test(a)))
         reports.set(`${ln}|${e}`, { out: out2, rel: relative9(repoDir, out2), tail: viaWalk ? join53(...args.slice(1)) : undefined });
@@ -14512,9 +14532,9 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
         for (let i = 0;i < 64; i++) {
           if (existsSync33(join53(d, r.tail)))
             return true;
-          if (d === repoDir || d === dirname19(d))
+          if (d === repoDir || d === dirname20(d))
             return false;
-          d = dirname19(d);
+          d = dirname20(d);
         }
         return false;
       };
@@ -14552,7 +14572,7 @@ function phantomReason(miss, repoFiles, testDir = "", pkgRoot = "") {
 }
 var readJson5 = (p) => {
   try {
-    const v = parseJsonc(readFileSync42(p, "utf8"));
+    const v = parseJsonc(readFileSync43(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -14591,10 +14611,10 @@ var init_preexisting_dirty = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/commit_filter.ts
-import { dirname as dirname20 } from "path";
+import { dirname as dirname21 } from "path";
 function dropSet(repoDir, staged, preexistingDirty, env = process.env, installCreated) {
   const owned = installOwned(repoDir, installCreated, env), made = installCreated?.files ?? {};
-  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f })), staged.filter(({ f }) => owned(f)).map(({ f }) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || WALL_FILE.test(f) || st === "A" && !Object.hasOwn(made, f) && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname20(m) === dirname20(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
+  return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f })), staged.filter(({ f }) => owned(f)).map(({ f }) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || WALL_FILE.test(f) || st === "A" && !Object.hasOwn(made, f) && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname21(m) === dirname21(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
 }
 var WALL_FILE, parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []), formatChanged = (repoDir, staged, dropped2, env = process.env) => runFormatters(repoDir, staged.filter(({ st, f }) => (st === "A" || st === "M") && !dropped2.has(f) && !f.startsWith(".loki/")).map(({ f }) => f), tokenFreeEnv(env));
 var init_commit_filter = __esm(() => {
@@ -14716,9 +14736,9 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn8 } from "child_process";
 import { createHash as createHash15, randomBytes as randomBytes6 } from "crypto";
-import { existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync20, readFileSync as readFileSync43, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync20, readFileSync as readFileSync44, writeFileSync as writeFileSync24 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname21, isAbsolute as isAbsolute10, join as join54, normalize as normalize3, relative as relative10, sep as sep13 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute10, join as join54, normalize as normalize3, relative as relative10, sep as sep13 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -14795,7 +14815,7 @@ function openapiPaths(repoDir) {
     if (!existsSync34(p))
       continue;
     try {
-      const txt = readFileSync43(p, "utf8");
+      const txt = readFileSync44(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -14913,14 +14933,14 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
         const subs = ["backend", "frontend"].filter((d) => existsSync34(join54(repoDir, d, "package.json")));
         const has2 = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync43(join54(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync44(join54(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has2(d))));
       }
-      script = pickScript(JSON.parse(readFileSync43(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync44(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -15014,9 +15034,9 @@ async function sealEvidence(repoDir, runDir, o, notProven, signal, emit) {
 function receiptScreensProblem(receiptPath, receipt) {
   if (visualGateEnabled() && typeof receipt["evidence_failed"] === "string")
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
-  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname21(receiptPath), receipt["evidence_screens"]);
+  return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname22(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash15("sha256").update(readFileSync43(p)).digest("hex"), playwrightBin = (repoDir) => {
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash15("sha256").update(readFileSync44(p)).digest("hex"), playwrightBin = (repoDir) => {
   const bin = join54(repoDir, "node_modules", ".bin", "playwright");
   return existsSync34(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
@@ -15093,15 +15113,15 @@ var init_pr = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync44, rmSync as rmSync17, writeFileSync as writeFileSync25 } from "fs";
-import { dirname as dirname22, join as join56 } from "path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync45, rmSync as rmSync17, writeFileSync as writeFileSync25 } from "fs";
+import { dirname as dirname23, join as join56 } from "path";
 import { createHash as createHash16 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
   if (!existsSync35(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync44(p, "utf-8"));
+    const j = JSON.parse(readFileSync45(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -15109,7 +15129,7 @@ function loadLessons(repoDir) {
 }
 function save(repoDir, lessons) {
   const p = lessonsPath(repoDir);
-  mkdirSync22(dirname22(p), { recursive: true });
+  mkdirSync22(dirname23(p), { recursive: true });
   atomicWriteJson(p, { version: 2, lessons });
 }
 function appendReceiptFact(repoDir, f, now2 = () => new Date) {
@@ -15169,9 +15189,9 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync36, readFileSync as readFileSync45 } from "fs";
-import { resolve as resolvePath, dirname as dirname23 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { existsSync as existsSync36, readFileSync as readFileSync46 } from "fs";
+import { resolve as resolvePath, dirname as dirname24 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 function claudeFlagSupported(flag, helpText) {
   const txt = helpText ?? _claudeHelpCache;
   if (txt === null || txt === undefined) {
@@ -15217,14 +15237,14 @@ function leanReviewerFlags(opts = {}) {
 }
 function designArchetypesText() {
   try {
-    const moduleDir = dirname23(fileURLToPath5(import.meta.url));
+    const moduleDir = dirname24(fileURLToPath6(import.meta.url));
     for (const rel of [
       ["..", "..", "..", "references", "design-archetypes.md"],
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
       if (existsSync36(p))
-        return readFileSync45(p, "utf8");
+        return readFileSync46(p, "utf8");
     }
   } catch {}
   return "";
@@ -15300,14 +15320,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync37, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync46, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync37, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync47, writeFileSync as writeFileSync26 } from "fs";
 import { join as join57 } from "path";
 function loadRouteRecord(runDir) {
   try {
     const p = join57(runDir, ROUTE_RECORD_FILE);
     if (!existsSync37(p) || !lstatSync13(p).isFile())
       return;
-    const v = JSON.parse(readFileSync46(p, "utf8"));
+    const v = JSON.parse(readFileSync47(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -15451,7 +15471,7 @@ __export(exports_deep, {
 });
 import { copyFileSync as copyFileSync3, existsSync as existsSync38, lstatSync as lstatSync14, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync9, rmSync as rmSync18, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname24, join as join58 } from "path";
+import { dirname as dirname25, join as join58 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
     const cwd = mkdtempSync9(join58(tmpdir10(), "loki-deep-council-"));
@@ -15576,7 +15596,7 @@ async function secureScanChanged(repoDir, changed, opts) {
   try {
     for (const f of changed)
       if (existsSync38(join58(repoDir, f)) && lstatSync14(join58(repoDir, f)).isFile()) {
-        mkdirSync24(dirname24(join58(dir, f)), { recursive: true });
+        mkdirSync24(dirname25(join58(dir, f)), { recursive: true });
         copyFileSync3(join58(repoDir, f), join58(dir, f));
       }
     return await runSecureScan(dir, { ...opts.secureScanPath ? { scriptPath: opts.secureScanPath } : {}, timeoutMs: 60000 });
@@ -16054,9 +16074,9 @@ ${x}` : c.cmd };
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import { existsSync as existsSync40, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync47, readdirSync as readdirSync21, rmSync as rmSync20, writeFileSync as writeFileSync28 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync48, readdirSync as readdirSync21, rmSync as rmSync20, writeFileSync as writeFileSync28 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
-import { dirname as dirname25, join as join60, relative as relative12 } from "path";
+import { dirname as dirname26, join as join60, relative as relative12 } from "path";
 
 class RealBaseTestRunner {
   api;
@@ -16124,7 +16144,7 @@ function loadTaskText(ctx, fromPrior) {
   const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join60(ctx.runDir, "issue.json");
   if (existsSync40(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync47(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync48(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -16136,7 +16156,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join60(repoDir, dirname25(first.path)) : join60(repoDir, "tests");
+  return first ? join60(repoDir, dirname26(first.path)) : join60(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -16191,20 +16211,20 @@ async function wallAuthor(ctx, signal, retry) {
   }
   const planText = typeof prior.plan?.plan === "string" ? prior.plan.plan : null, repoFiles = repoMap?.files ?? [];
   const oor = () => readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)).flatMap((name) => {
-    const text2 = readFileSync47(join60(cwd, name), "utf8"), why = outOfRepoTarget(text2) ?? phantomReason(phantomRepoPaths(text2, name, targetDir, ctx.repoDir, planText), repoFiles, relative12(ctx.repoDir, targetDir), pkg?.root ?? "");
+    const text2 = readFileSync48(join60(cwd, name), "utf8"), why = outOfRepoTarget(text2) ?? phantomReason(phantomRepoPaths(text2, name, targetDir, ctx.repoDir, planText), repoFiles, relative12(ctx.repoDir, targetDir), pkg?.root ?? "");
     return why ? [{ name, why }] : [];
   });
   const bad1 = oor();
   if (bad1.length > 0 && !signal.aborted && !ctx.overCap?.())
     await ctx.sessions.run({ stage: "wall", brief: withStagePrefix(outOfRepoReask("Rewrite these Wall files in place, keeping the same names and acceptance coverage.", bad1)), tier: "development", model, iterationId: `${iterationId}-oor`, limitS: wallLimitS(sz.size), signal, cwd });
-  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !oorBad.has(n2) && !conventionViolation(conv2, n2, readFileSync47(join60(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !oorBad.has(n2) && !conventionViolation(conv2, n2, readFileSync48(join60(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
   const sealedDir = join60(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync25(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync47(join60(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
+    const content = readFileSync48(join60(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
     writeFileSync28(join60(sealedDir, name), content, "utf8");
     if (oorWhy)
       discarded.push({ file: name, reason: `${oorWhy}; wall test discarded after one rewrite request` });
@@ -16323,10 +16343,10 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync15, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync48, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname26, join as join61, relative as relative13, sep as sep14 } from "path";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync15, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync49, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
+import { dirname as dirname27, join as join61, relative as relative13, sep as sep14 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync23(repoDir), fp = join61(root, f), rel = relative13(root, dirname26(fp));
+  const root = realpathSync23(repoDir), fp = join61(root, f), rel = relative13(root, dirname27(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
@@ -16348,7 +16368,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync48(fp).equals(want)) {
+  if (st?.isFile() && readFileSync49(fp).equals(want)) {
     chmodSync5(fp, mode);
     return;
   }
@@ -16420,7 +16440,7 @@ var init_discard = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename24, dirname as dirname27 } from "path";
+import { basename as basename24, dirname as dirname28 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -16434,8 +16454,8 @@ function outsideScope(o, staged) {
   const text2 = `${plan}
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
-  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname27(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename24(f)) && !plannedDirs.has(dirname27(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname28(r)).filter((d) => d !== "."));
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename24(f)) && !plannedDirs.has(dirname28(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -16450,14 +16470,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync41, readdirSync as readdirSync22, readFileSync as readFileSync49 } from "fs";
+import { existsSync as existsSync41, readdirSync as readdirSync22, readFileSync as readFileSync50 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join62 } from "path";
 function agentDirs(repoDir, env = process.env) {
   return [env["LOKI_AGENTS_PROJECT_DIR"] || join62(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join62(env["XDG_CONFIG_HOME"] || join62(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync49(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync50(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -16577,14 +16597,14 @@ var init_colors = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync28, readFileSync as readFileSync50, renameSync as renameSync12, statSync as statSync20, writeFileSync as writeFileSync30 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync28, readFileSync as readFileSync51, renameSync as renameSync12, statSync as statSync20, writeFileSync as writeFileSync30 } from "fs";
 import { join as join64 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
     const p = join64(repoDir, ".loki", "state", "risk-tier.json");
     if (statSync20(p).mtimeMs < sinceMs)
       return null;
-    const r = JSON.parse(readFileSync50(p, "utf8"));
+    const r = JSON.parse(readFileSync51(p, "utf8"));
     return r && typeof r === "object" ? r : null;
   } catch {
     return null;
@@ -16600,7 +16620,7 @@ var init_run_summary = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync43, readFileSync as readFileSync51 } from "fs";
+import { existsSync as existsSync43, readFileSync as readFileSync52 } from "fs";
 import { join as join65 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
@@ -16618,7 +16638,7 @@ function explicitReview(repoDir, env) {
     if (!existsSync43(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync51(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync52(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -16813,8 +16833,8 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync44, lstatSync as lstatSync16, mkdirSync as mkdirSync29, readFileSync as readFileSync52, rmSync as rmSync21, writeFileSync as writeFileSync31 } from "fs";
-import { dirname as dirname28, join as join66 } from "path";
+import { existsSync as existsSync44, lstatSync as lstatSync16, mkdirSync as mkdirSync29, readFileSync as readFileSync53, rmSync as rmSync21, writeFileSync as writeFileSync31 } from "fs";
+import { dirname as dirname29, join as join66 } from "path";
 import { createHash as createHash17 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -16862,7 +16882,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync52(p);
+    raw2 = readFileSync53(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -16937,8 +16957,8 @@ var init_contract = __esm(() => {
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash18 } from "crypto";
-import { existsSync as existsSync45, mkdirSync as mkdirSync30, readdirSync as readdirSync23, readFileSync as readFileSync53, renameSync as renameSync13, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname29, join as join67 } from "path";
+import { existsSync as existsSync45, mkdirSync as mkdirSync30, readdirSync as readdirSync23, readFileSync as readFileSync54, renameSync as renameSync13, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
+import { dirname as dirname30, join as join67 } from "path";
 function sealGroup(runDir, rh) {
   const manifestPath = join67(runDir, "group", "manifest.json");
   if (!existsSync45(manifestPath))
@@ -16968,7 +16988,7 @@ function sealGroup(runDir, rh) {
     const dir = join67(unitsDir(runDir), id), rp = join67(dir, "receipt.json"), ep = join67(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync53(rp);
+      bytes = readFileSync54(rp);
     } catch {
       return fail2(`unit ${id} sub-receipt missing`);
     }
@@ -16985,7 +17005,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub2["receipt_sha256"],
-      events_file_sha256: existsSync45(ep) ? sha3(readFileSync53(ep)) : null,
+      events_file_sha256: existsSync45(ep) ? sha3(readFileSync54(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -17005,7 +17025,7 @@ function capGroupVerdict(v, g) {
   return !g.allUnitsPass && (v === "VERIFIED" || v === "ALREADY_SATISFIED") ? "PARTIAL" : v;
 }
 async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
-  const runDir = dirname29(receiptPath);
+  const runDir = dirname30(receiptPath);
   const signed = isObj10(receipt["verification"]) && typeof receipt["verification"]["jwt"] === "string";
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
@@ -17029,13 +17049,13 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     try {
       if (!statSync21(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
-      bytes = readFileSync53(rp);
+      bytes = readFileSync54(rp);
     } catch {
       return bad(`unit ${id} sub-receipt missing`);
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync45(ep) ? sha3(readFileSync53(ep)) : null;
+    const evSha = existsSync45(ep) ? sha3(readFileSync54(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
     const sub2 = readJson6(rp);
@@ -17060,7 +17080,7 @@ function compositeVerdict(childVerdicts) {
 }
 var ID_RE, PASSING, sha3 = (b) => createHash18("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join67(runDir, "group", "units"), readJson6 = (p) => {
   try {
-    return JSON.parse(readFileSync53(p, "utf8"));
+    return JSON.parse(readFileSync54(p, "utf8"));
   } catch {
     return;
   }
@@ -17078,7 +17098,7 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync46, readFileSync as readFileSync54, statSync as statSync22 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync55, statSync as statSync22 } from "fs";
 import { basename as basename25, join as join68 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
@@ -17100,7 +17120,7 @@ function readDeclared(repoDir) {
   try {
     if (statSync22(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync54(p, "utf8"));
+    const j = JSON.parse(readFileSync55(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -17124,7 +17144,7 @@ function readAllowlist(repoDir) {
   if (!existsSync46(p))
     return new Set;
   try {
-    return new Set(readFileSync54(p, "utf8").split(`
+    return new Set(readFileSync55(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -17307,7 +17327,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync22(p).size <= MAX_FILE_BYTES ? readFileSync54(p, "utf8") : "";
+    return statSync22(p).size <= MAX_FILE_BYTES ? readFileSync55(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -17323,7 +17343,7 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash19 } from "crypto";
-import { existsSync as existsSync47, readdirSync as readdirSync24, mkdirSync as mkdirSync31, readFileSync as readFileSync55 } from "fs";
+import { existsSync as existsSync47, readdirSync as readdirSync24, mkdirSync as mkdirSync31, readFileSync as readFileSync56 } from "fs";
 import { basename as basename26, isAbsolute as isAbsolute13, join as join69, relative as relative14 } from "path";
 function receiptSha256(r) {
   const { verification: _v, receipt_sha256: _h, ...body } = r;
@@ -17649,7 +17669,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync47(eventsPath) ? readFileSync55(eventsPath) : ""),
+        events_sha256: sha2562(existsSync47(eventsPath) ? readFileSync56(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         toolchain: collectToolchain(),
@@ -17704,14 +17724,14 @@ var init_seal = __esm(() => {
 });
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync48, readFileSync as readFileSync56 } from "fs";
-import { basename as basename27, dirname as dirname31, join as join70 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync57 } from "fs";
+import { basename as basename27, dirname as dirname32, join as join70 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync56(join70(runDir, "integration.log"));
+    b = readFileSync57(join70(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -17726,7 +17746,7 @@ function integrationProblem(integ) {
   return null;
 }
 async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
-  const runDir = dirname31(receiptPath);
+  const runDir = dirname32(receiptPath);
   const signed = isObj10(receipt["verification"]) && typeof receipt["verification"]["jwt"] === "string";
   const bad = (reason) => ({ problem: { verdict: "TAMPERED", reason: `composite: ${reason}` }, verdict: "FAILED" });
   const kids = receipt["children"];
@@ -17734,7 +17754,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync56(join70(runDir, "integration.json"));
+    ibytes = readFileSync57(join70(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
@@ -17778,7 +17798,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     const rp = join70(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync56(rp);
+      bytes = readFileSync57(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -17827,8 +17847,8 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync49, readFileSync as readFileSync57, renameSync as renameSync14, statSync as statSync24, writeFileSync as writeFileSync34 } from "fs";
-import { basename as basename28, dirname as dirname32, join as join71 } from "path";
+import { existsSync as existsSync49, readFileSync as readFileSync58, renameSync as renameSync14, statSync as statSync24, writeFileSync as writeFileSync34 } from "fs";
+import { basename as basename28, dirname as dirname33, join as join71 } from "path";
 import { createHash as createHash20, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -17836,7 +17856,7 @@ function pubFor(kid, given) {
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey4(readFileSync57(f))];
+      return [createPublicKey4(readFileSync58(f))];
     } catch {
       return [];
     }
@@ -17880,10 +17900,10 @@ function checkEventLog(receiptPath, receipt) {
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join71(dirname32(receiptPath), "events.jsonl");
+  const path = join71(dirname33(receiptPath), "events.jsonl");
   if (!existsSync49(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync57(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
+  const raw2 = readFileSync58(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
 `).filter((l) => l.trim() !== "");
   if (events2.length !== lines2.length || events2.some((e, i) => e.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -17899,7 +17919,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join71(dirname32(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join71(dirname33(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -17907,7 +17927,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync57(path, "utf8").split(`
+  const lines2 = readFileSync58(path, "utf8").split(`
 `).filter((l) => l.trim() !== ""), sha4 = createHash20("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
@@ -17921,7 +17941,7 @@ async function verifyReceipt(receiptPath, deps = {}) {
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync57(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync58(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -18010,8 +18030,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync51, readFileSync as readFileSync60, statSync as statSync25 } from "fs";
-import { join as join74, resolve as resolve18, sep as sep16 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync61, statSync as statSync25 } from "fs";
+import { join as join74, resolve as resolve19, sep as sep16 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -28322,7 +28342,7 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync58, realpathSync as realpathSync25 } from "fs";
+import { readFileSync as readFileSync59, realpathSync as realpathSync25 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
 import { join as join72, sep as sep15 } from "path";
 init_verify_cmd();
@@ -28374,7 +28394,7 @@ function mount21(ctx) {
         sha4 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf(JSON.parse(readFileSync58(file, "utf8")));
+        outcome = outcomeOf(JSON.parse(readFileSync59(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -28436,7 +28456,7 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync50, readFileSync as readFileSync59 } from "fs";
+import { existsSync as existsSync50, readFileSync as readFileSync60 } from "fs";
 import { join as join73 } from "path";
 
 // src/server/legacy/routes.ts
@@ -28818,7 +28838,7 @@ var repoVersion = () => {
   for (const f of [join73(import.meta.dir, "../../../../../VERSION")]) {
     try {
       if (existsSync50(f))
-        return readFileSync59(f, "utf8").trim();
+        return readFileSync60(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -29032,7 +29052,7 @@ function createApp(opts) {
     for (const f of [process.env.LOKI_VERSION_FILE, join74(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync60(f, "utf8").trim() || "unknown";
+          return readFileSync61(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -29141,8 +29161,8 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve18(uiDir);
-    const f = resolve18(root, `.${p}`);
+    const root = resolve19(uiDir);
+    const f = resolve19(root, `.${p}`);
     if (f.startsWith(root + sep16) && existsSync51(f) && statSync25(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))