mancode 0.3.1 → 0.3.3

package/dist/cli.js

@@ -9,7 +9,7 @@ import { program } from "commander";
 // src/commands/init.ts
 import { promises as fs2 } from "fs";
 import path13 from "path";
-import process3 from "process";
+import process4 from "process";
 
 // src/installers/claude-code.ts
 import {
@@ -295,14 +295,15 @@ var HEAD_COACH_AGENT = {
 - \u5E94\u7528 YAGNI \u539F\u5219\uFF1A\u5DF2\u5B58\u5728 \u2192 \u590D\u7528 \u2192 \u6807\u51C6\u5E93 \u2192 \u5DF2\u88C5\u4F9D\u8D56 \u2192 \u4E00\u884C \u2192 \u6700\u5C0F\u5B9E\u73B0
 
 **\u4FEE\u590D\u9636\u6BB5**\uFF08Film Analyst \u53CD\u9988\u540E\uFF09\uFF1A
-- \u53EA\u4FEE\u590D\u53CD\u9988\u6307\u51FA\u7684\u95EE\u9898
+- \u6C47\u603B\u6240\u9700\u5BA1\u67E5\u9886\u57DF\u7684 blocker\uFF0C\u53EA\u505A\u4E00\u8F6E\u4FEE\u590D\u5E76\u901A\u8FC7 review ledger \u8BB0\u5F55
+- \u53EA\u4FEE\u590D\u53CD\u9988\u6307\u51FA\u7684 blocker\uFF1B\u{1F7E1}/\u{1F7E2} \u53EA\u8BB0\u5F55\u6743\u8861\uFF0C\u4E0D\u81EA\u52A8\u6269\u5927 diff
 - **\u4E0D\u5728\u539F\u4EE3\u7801\u4E0A\u8FC7\u5EA6\u4FEE\u590D**
 - \u4F18\u5148\u7EA7\uFF1A\u{1F534} \u5FC5\u4FEE > \u{1F7E1} \u5EFA\u8BAE > \u{1F7E2} \u53EF\u9009
 
 **\u6536\u5C3E\u9636\u6BB5**\uFF1A
-- \u4FEE\u590D Film #2 \u7684\u5168\u90E8 \u{1F534} \u95EE\u9898\uFF0C\u518D\u91CD\u8DD1 build/lint/typecheck/test \u548C\u5FC5\u8981 smoke test\u3002
-- \u751F\u6210 summary\uFF1A\u6539\u52A8/\u65B0\u5EFA\u6587\u4EF6\u3001\u590D\u7528\u8D44\u6E90\u3001\u9A8C\u8BC1\u7ED3\u679C\u3001\u53CC\u5BA1\u95EE\u9898\u5904\u7F6E\u3001\u8DF3\u8FC7\u6B65\u9AA4\u548C\u6B8B\u4F59\u98CE\u9669\u3002
-- \u53EA\u6709\u9A8C\u8BC1\u901A\u8FC7\u4E14 \u{1F534} \u6E05\u96F6\u624D\u5EFA\u8BAE \`completed\`\uFF1B\u5426\u5219\u5199 \`blocked\` \u4E0E\u660E\u786E blockingReason\u3002
+- \u4E00\u8F6E\u4FEE\u590D\u540E\u91CD\u8DD1\u53D7\u5F71\u54CD\u7684 build/lint/typecheck/test \u548C\u5FC5\u8981 smoke test\uFF0C\u4E0D\u91CD\u590D\u8FD0\u884C\u5DF2\u5B8C\u6210 reviewer\u3002
+- \u751F\u6210 summary\uFF1A\u6539\u52A8/\u65B0\u5EFA\u6587\u4EF6\u3001\u590D\u7528\u8D44\u6E90\u3001\u9A8C\u8BC1\u7ED3\u679C\u3001\u5BA1\u67E5\u6DF1\u5EA6\u3001\u95EE\u9898\u5904\u7F6E\u3001\u8DF3\u8FC7\u6B65\u9AA4\u548C\u6B8B\u4F59\u98CE\u9669\u3002
+- \u53EA\u6709\u9A8C\u8BC1\u901A\u8FC7\u3001\u6240\u9700\u5BA1\u67E5\u9886\u57DF\u5B8C\u6210\u4E14 blocker \u6E05\u96F6\u624D\u5EFA\u8BAE \`completed\`\uFF1B\u5426\u5219\u5199 \`blocked\` \u4E0E\u660E\u786E blockingReason\u3002
 - \u5C06\u5173\u952E\u51B3\u7B56\u4EA4\u7ED9\u8C03\u7528\u65B9 appendTeamDecision\uFF0C\u5E76\u66F4\u65B0 Active Plans\u3002
 - \u5408\u5E76 worktree \u524D\u53D6\u5F97\u7528\u6237\u786E\u8BA4\uFF1B\u6E05\u7406\u4E34\u65F6\u6587\u4EF6\u3002
 
@@ -331,6 +332,8 @@ var FILM_ANALYST_OFFENSE_AGENT = {
   - \u{1F7E1} \u5EFA\u8BAE\uFF08\u5E94\u8BE5\u4FEE\uFF09
   - \u{1F7E2} \u53EF\u9009\uFF08\u53EF\u4EE5\u4E0D\u4FEE\uFF09
 - \u6700\u540E\u7ED9\u8BC4\u5206\uFF081-10\uFF09+ \u901A\u8FC7 / \u4E0D\u901A\u8FC7
+- \u53EA\u5BA1\u67E5\u672C\u6B21 diff\u3001\u7528\u6237\u9700\u6C42\u548C\u76F4\u63A5\u53D7\u5F71\u54CD\u8DEF\u5F84\uFF1B\u6700\u591A 3 \u4E2A\u65B0\u95EE\u9898
+- \u6BCF\u4E2A\u95EE\u9898\u5FC5\u987B\u5305\u542B\u6539\u52A8\u884C\u3001\u53EF\u6838\u67E5\u8BC1\u636E\u548C\u7528\u6237\u5F71\u54CD\u3002\u6CA1\u6709\u8BC1\u636E\u7684 checklist \u9879\u4E0D\u8F93\u51FA
 
 ## \u4F60\u4E0D\u5199\u4EE3\u7801
 
@@ -388,6 +391,8 @@ var FILM_ANALYST_OFFENSE_AGENT = {
 - \u4E0D\u8981\u5EFA\u8BAE**\u4E0E\u9879\u76EE\u98CE\u683C\u4E0D\u7B26**\u7684\u6539\u52A8
 - \u4E0D\u8981\u5EFA\u8BAE**\u63A8\u6D4B\u6027\u529F\u80FD**\u6216**\u8FC7\u5EA6\u62BD\u8C61**
 - \u4E0D\u8981"\u987A\u4FBF\u5EFA\u8BAE"\u548C\u5F53\u524D\u4EFB\u52A1\u65E0\u5173\u7684\u4E8B
+- \u4E0D\u8981\u56E0\u4E3A\u7F3A\u5C11\u901A\u7528 loading\u3001\u9519\u8BEF\u683C\u5F0F\u6216\u56DE\u5F52\u6D4B\u8BD5\u800C\u673A\u68B0\u8BC4\u8BBA\uFF1B\u53EA\u6709\u672C\u6B21\u884C\u4E3A\u786E\u5B9E\u5F15\u5165\u76F8\u5E94\u8DEF\u5F84\u4E14\u6709\u8BC1\u636E\u65F6\u624D\u62A5\u544A
+- \u540C\u4E00\u6839\u56E0\u53EA\u62A5\u4E00\u6B21\uFF1B\u{1F534} \u4F7F\u7528\u7A33\u5B9A ID\uFF08Q1\u3001Q2\u2026\u2026\uFF09\uFF0C\u4F9B review ledger \u53BB\u91CD\u548C\u6536\u5C3E
 
 \u6536\u5230\u4EE3\u7801\u540E\u7ACB\u5373\u5F00\u59CB\u5BA1\u67E5\u3002\u62A5\u544A\u5B8C\u6574\u5373\u53EF\u3002`
 };
@@ -411,6 +416,8 @@ var FILM_ANALYST_DEFENSE_AGENT = {
   - \u{1F7E2} \u53EF\u9009\uFF08\u52A0\u56FA\u5EFA\u8BAE\uFF09
 - **\u5B89\u5168\u95EE\u9898\u4E00\u5F8B \u{1F534}**
 - \u6700\u540E\u7ED9\u8BC4\u5206\uFF081-10\uFF09+ \u901A\u8FC7 / \u4E0D\u901A\u8FC7
+- \u53EA\u5BA1\u67E5\u672C\u6B21 diff\u3001\u7528\u6237\u9700\u6C42\u548C\u76F4\u63A5\u53D7\u5F71\u54CD\u8DEF\u5F84\uFF1B\u6700\u591A 3 \u4E2A\u65B0\u95EE\u9898
+- \u6BCF\u4E2A\u95EE\u9898\u5FC5\u987B\u5305\u542B\u6539\u52A8\u884C\u3001\u53EF\u6838\u67E5\u8BC1\u636E\u548C\u7528\u6237\u5F71\u54CD
 
 ## \u4F60\u4E0D\u5199\u4EE3\u7801
 
@@ -462,8 +469,7 @@ var FILM_ANALYST_DEFENSE_AGENT = {
 
 ## \u4E0D\u8981\u91CD\u590D Film Analyst #1 \u7684\u53CD\u9988
 
-\u5982\u679C #1 \u5DF2\u7ECF\u6307\u51FA\u7684\u53EF\u8BFB\u6027 / DRY / \u590D\u6742\u5EA6\u95EE\u9898\uFF0C**\u4E0D\u8981\u518D\u8BF4**\u3002
-\u4F60\u4E13\u6CE8\u8FB9\u754C\u3001\u5B89\u5168\u3001\u6027\u80FD\u3001\u8D44\u6E90\u3002
+\u5F00\u59CB\u524D\u5FC5\u987B\u8BFB\u53D6 \`review-scope.md\` \u548C \`film-report-1.md\`\u3002\u5982\u679C #1 \u5DF2\u7ECF\u6307\u51FA\u76F8\u540C\u6839\u56E0\uFF0C\u6807\u8BB0\u4E3A \`duplicate\` \u5E76\u4E14\u4E0D\u8981\u91CD\u65B0\u8F93\u51FA\u4E3A finding\u3002\u4F60\u53EA\u4E13\u6CE8\u8FB9\u754C\u3001\u5B89\u5168\u3001\u6027\u80FD\u3001\u8D44\u6E90\uFF1B\u{1F534} \u4F7F\u7528\u7A33\u5B9A ID\uFF08D1\u3001D2\u2026\u2026\uFF09\u3002
 
 ## \u7EA2\u7EBF
 
@@ -504,215 +510,229 @@ function yamlString(s) {
 }
 
 // src/templates/inline.ts
-var SESSION_START_HOOK = `#!/bin/bash
-# .mancode/hooks/session-start.sh
-# mancode SessionStart hook - \u52A0\u8F7D\u9879\u76EE\u4E0A\u4E0B\u6587
-# \u7CFB\u7EDF\u4F9D\u8D56\uFF1Abash\u3001git\u3001\uFF08\u53EF\u9009\uFF09jq
-set -uo pipefail
-
-PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")"
-STATE_FILE="$PROJECT_ROOT/.mancode/state.json"
-PROFILE_FILE="$PROJECT_ROOT/.mancode/project-profile.json"
-
-HAS_JQ=0
-if [ "\${MANCODE_DISABLE_JQ:-0}" != "1" ]; then
-    command -v jq >/dev/null 2>&1 && HAS_JQ=1
-fi
-
-json_get() {
-    local key="$1"
-    local file="$2"
-    if [ "$HAS_JQ" = "1" ]; then
-        jq -r ".$key // empty" "$file" 2>/dev/null || true
-    else
-        grep "\\"$key\\"" "$file" 2>/dev/null | sed -E 's/.*: *"([^"]*)".*/\\1/' || true
-    fi
-}
-
-json_any_get() {
-    local key="$1"
-    local file="$2"
-    if [ "$HAS_JQ" = "1" ]; then
-        jq -r ".$key // empty" "$file" 2>/dev/null || true
-    else
-        grep "\\"$key\\"" "$file" 2>/dev/null | head -n 1 | sed -E 's/.*: *"?([^",}]*)"?[,]?.*/\\1/' || true
-    fi
-}
-
-if [ ! -f "$STATE_FILE" ]; then
-    echo "\u2139\uFE0F mancode \u672A\u521D\u59CB\u5316\u3002\u8FD0\u884C \\\`mancode init\\\` \u5F00\u59CB\u3002"
-    exit 0
-fi
-
-# \u6E05\u6D17\u51FD\u6570\uFF1A\u53BB\u6362\u884C\u3001\u9650\u5236\u957F\u5EA6\uFF08\u9632\u6B62\u810F\u6570\u636E\u6C61\u67D3 prompt\uFF09
-sanitize() {
-    printf '%s' "$1" | tr '\\n\\r' ' ' | head -c 200
-}
-
-MODE=$(json_get "currentMode" "$STATE_FILE")
-TECH_STACK=$(json_get "techStack" "$STATE_FILE")
-UI_LIBRARY=$(json_get "uiLibrary" "$STATE_FILE")
-TEAM_AUTO=$(json_any_get "teamModeAutoDetected" "$STATE_FILE")
-CONTRIBUTORS=$(json_any_get "contributors" "$STATE_FILE")
-
-echo "mancode_mode: \${MODE:-solo}"
-echo "project_type: $(sanitize "$TECH_STACK")"
-echo "ui_library: $(sanitize "$UI_LIBRARY")"
-echo ""
-
-echo "## mancode \xB7 \${MODE:-solo} mode"
-echo ""
-echo "\u4F60\u6B63\u5728\u4F7F\u7528 mancode \${MODE:-solo} \u6A21\u5F0F\u3002"
-echo ""
-echo "### \u6838\u5FC3\u539F\u5219"
-echo "1. **\u4F18\u5148\u590D\u7528\u9879\u76EE\u5DF2\u6709\u4EE3\u7801**"
-echo "   - \u68C0\u67E5\u5DF2\u68C0\u6D4B\u5230\u7684\u6E90\u7801\u76EE\u5F55\u548C\u5DF2\u6709\u7C7B\u4F3C\u5B9E\u73B0"
-echo "   - \u590D\u7528\u73B0\u6709\u7EC4\u4EF6\u3001\u51FD\u6570\u3001\u6837\u5F0F"
-echo ""
-if [ "$(json_get "uiAssets" "$PROFILE_FILE")" = "detected" ]; then
-    echo "2. **\u5E94\u7528\u9879\u76EE\u5BA1\u7F8E token**\uFF08\u4EC5\u5728\u9879\u76EE profile \u786E\u8BA4\u6709 UI \u8D44\u4EA7\u4E14\u4EFB\u52A1\u6D89\u53CA UI \u65F6\uFF09"
-    echo "   - UI library: $(sanitize "$UI_LIBRARY")"
-    echo "   - \u4F7F\u7528\u9879\u76EE\u5DF2\u6709\u7684\u8BBE\u8BA1 token"
-else
-    echo "2. **\u6309\u9879\u76EE\u80FD\u529B\u5DE5\u4F5C**"
-    echo "   - \u4E0D\u5047\u5B9A\u5B58\u5728 UI\u3001\u6D4F\u89C8\u5668\u6216\u7279\u5B9A\u6280\u672F\u6808"
-    echo "   - \u5148\u8BFB\u53D6 project-profile \u4E0E\u9879\u76EE\u73B0\u6709\u9A8C\u8BC1\u65B9\u5F0F"
-fi
-echo ""
-echo "3. **\u6700\u5C0F\u6539\u52A8**"
-echo "   - \u53EA\u6539\u7528\u6237\u8981\u6C42\u7684\u90E8\u5206"
-echo "   - \u4E0D\u91CD\u6784\u65E0\u5173\u4EE3\u7801"
-
-if [ "$TEAM_AUTO" = "true" ] && [ "\${MODE:-solo}" = "solo" ]; then
-    echo ""
-    echo "### \u56E2\u961F\u534F\u4F5C\u63D0\u9192"
-    echo "\u68C0\u6D4B\u5230\u56E2\u961F\u9879\u76EE\uFF08contributors: \${CONTRIBUTORS:-2}\uFF09\u3002"
-    echo '- \u6D89\u53CA\u591A\u4EBA\u534F\u4F5C\u3001\u4EA4\u63A5\u3001PR\u3001\u5171\u4EAB\u6A21\u5757\u65F6\uFF0C\u4F18\u5148\u4F7F\u7528 /manteam <task>\u3002'
-    echo '- \u53EA\u505A\u4E2A\u4EBA\u5C0F\u6539\u52A8\u65F6\uFF0C\u53EF\u4EE5\u7EE7\u7EED solo\uFF1B\u9700\u8981\u9000\u51FA\u6D41\u7A0B\u7528 /mansolo\u3002'
-fi
+var SESSION_START_HOOK = String.raw`#!/usr/bin/env node
+// .mancode/hooks/session-start.mjs
+// mancode SessionStart hook - cross-platform project context
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const projectRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../..',
+);
+const state = readJson(path.join(projectRoot, '.mancode', 'state.json'));
+const profile =
+  readJson(path.join(projectRoot, '.mancode', 'project-profile.json')) || {};
+
+if (!state) {
+  console.log('ℹ️ mancode 未初始化。运行 mancode init 开始。');
+  process.exit(0);
+}
+
+const mode = text(state.currentMode) || 'solo';
+const techStack = sanitize(state.techStack);
+const uiLibrary = sanitize(state.uiLibrary);
+const output = [
+  'mancode_mode: ' + mode,
+  'project_type: ' + techStack,
+  'ui_library: ' + uiLibrary,
+  '',
+  '## mancode · ' + mode + ' mode',
+  '',
+  '你正在使用 mancode ' + mode + ' 模式。',
+  '',
+  '### 核心原则',
+  '1. **优先复用项目已有代码**',
+  '   - 检查已检测到的源码目录和已有类似实现',
+  '   - 复用现有组件、函数、样式',
+  '',
+];
+
+if (profile.uiAssets === 'detected') {
+  output.push(
+    '2. **应用项目审美 token**（仅在项目 profile 确认有 UI 资产且任务涉及 UI 时）',
+    '   - UI library: ' + uiLibrary,
+    '   - 使用项目已有的设计 token',
+  );
+} else {
+  output.push(
+    '2. **按项目能力工作**',
+    '   - 不假定存在 UI、浏览器或特定技术栈',
+    '   - 先读取 project-profile 与项目现有验证方式',
+  );
+}
+
+output.push(
+  '',
+  '3. **最小改动**',
+  '   - 只改用户要求的部分',
+  '   - 不重构无关代码',
+);
+
+if (state.teamModeAutoDetected === true && mode === 'solo') {
+  output.push(
+    '',
+    '### 团队协作提醒',
+    '检测到团队项目（contributors: ' +
+      (Number.isFinite(state.contributors) ? state.contributors : 2) +
+      '）。',
+    '- 涉及多人协作、交接、PR、共享模块时，优先使用 /manteam <task>。',
+    '- 只做个人小改动时，可以继续 solo；需要退出流程用 /mansolo。',
+  );
+}
+
+console.log(output.join('\n'));
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function text(value) {
+  return typeof value === 'string' ? value : '';
+}
+
+function sanitize(value) {
+  return String(value ?? '').replace(/[\r\n]/g, ' ').slice(0, 200);
+}
 `;
-var USER_PROMPT_SUBMIT_HOOK = `#!/bin/bash
-# .mancode/hooks/user-prompt-submit.sh
-# mancode UserPromptSubmit hook - \u6CE8\u5165 6 \u95EE\u8FFD\u95EE + \u5BA1\u7F8E token
-set -uo pipefail
-
-PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")"
-STATE_FILE="$PROJECT_ROOT/.mancode/state.json"
-AESTHETICS_FILE="$PROJECT_ROOT/.mancode/aesthetics/style-tokens.json"
-
-HAS_JQ=0
-if [ "\${MANCODE_DISABLE_JQ:-0}" != "1" ]; then
-    command -v jq >/dev/null 2>&1 && HAS_JQ=1
-fi
-
-json_get() {
-    local key="$1"
-    local file="$2"
-    if [ "$HAS_JQ" = "1" ]; then
-        jq -r ".$key // empty" "$file" 2>/dev/null || true
-    else
-        grep "\\"$key\\"" "$file" 2>/dev/null | sed -E 's/.*: *"([^"]*)".*/\\1/' || true
-    fi
-}
-
-# \u6E05\u6D17\u6CE8\u5165\u5230 prompt \u7684\u52A8\u6001\u503C\uFF1A\u53BB\u6362\u884C\u3001\u9650\u5236\u957F\u5EA6\uFF0C\u907F\u514D\u810F token \u6C61\u67D3\u4E0A\u4E0B\u6587\u7ED3\u6784
-sanitize() {
-    printf '%s' "$1" | tr '\\n\\r' ' ' | head -c 200
-}
-
-MODE=$(json_get "currentMode" "$STATE_FILE")
-
-# \u53EA\u5728 solo \u6A21\u5F0F\u4E0B\u8F93\u51FA 6 \u95EE
-if [ "$MODE" = "solo" ]; then
-    echo "## \u52A8\u624B\u524D\uFF0C\u5148\u60F3\u516D\u4E2A\u95EE\u9898\uFF1A"
-    echo ""
-    echo "1. **\u4E3A\u4EC0\u4E48\u505A\uFF1F**"
-    echo "   - \u8FD9\u4E2A\u6539\u52A8\u89E3\u51B3\u4EC0\u4E48\u95EE\u9898\uFF1F"
-    echo ""
-    echo "2. **\u5DF2\u7ECF\u6709\u4EC0\u4E48\uFF1F**"
-    echo "   - \u9879\u76EE\u91CC\u6709\u6CA1\u6709\u7C7B\u4F3C\u7684\u5B9E\u73B0\u53EF\u4EE5\u590D\u7528\uFF1F"
-    echo ""
-    echo "3. **\u6700\u5C11\u6539\u591A\u5C11\uFF1F**"
-    echo "   - \u80FD\u7528\u4E00\u884C\u89E3\u51B3\u5417\uFF1F\u80FD\u590D\u7528\u73B0\u6709\u4EE3\u7801\u5417\uFF1F"
-    echo ""
-    echo "4. **\u80FD\u4E0D\u80FD\u4E0D\u62C6\u65B0\u7CFB\u7EDF\uFF1F**"
-    echo "   - \u4E0D\u65B0\u5EFA\u6587\u4EF6\u6216\u6A21\u5757\u80FD\u5B8C\u6210\u5417\uFF1F"
-    echo ""
-    echo "5. **\u975E\u5E73\u51E1\u903B\u8F91\u600E\u6837\u6700\u5C0F\u8FD0\u884C\u9A8C\u8BC1\uFF1F**"
-    echo ""
-    echo "6. **\u6709\u4EC0\u4E48\u6CA1\u628A\u63E1\u7684\uFF1F**"
-    echo "   - \u5148\u81EA\u884C\u67E5\u4EE3\u7801\u6216\u6587\u6863\uFF0C\u6700\u591A 2 \u6B21\u5DE5\u5177\u8C03\u7528\uFF1B\u4ECD\u4E0D\u786E\u5B9A\u518D\u95EE\u7528\u6237\u3002"
-    echo ""
-fi
-
-# Claude Code \u901A\u8FC7 stdin \u4F20\u5165 JSON: {"prompt": "...", ...}
-# \u5148\u8BFB\u53D6\u5B8C\u6574\u8F93\u5165\uFF0C\u518D\u89E3\u6790
-INPUT=$(cat)
-
-if [ "$HAS_JQ" = "1" ]; then
-    USER_PROMPT=$(echo "$INPUT" | jq -r '.prompt // ""' 2>/dev/null)
-    # jq \u5931\u8D25\u6216\u8FD4\u56DE\u7A7A\uFF0Cfallback \u5230\u539F\u59CB\u8F93\u5165
-    if [ -z "$USER_PROMPT" ]; then
-        USER_PROMPT="$INPUT"
-    fi
-else
-    # \u65E0 jq: \u4F7F\u7528 sed \u63D0\u53D6 JSON \u4E2D\u7684 prompt \u5B57\u6BB5
-    USER_PROMPT=$(echo "$INPUT" | sed -n 's/.*"prompt"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
-    # sed \u5931\u8D25\uFF0Cfallback \u5230\u539F\u59CB\u8F93\u5165
-    if [ -z "$USER_PROMPT" ]; then
-        USER_PROMPT="$INPUT"
-    fi
-fi
-
-if [ "$MODE" = "solo" ] && echo "$USER_PROMPT" | grep -qiE "\u5148(\u522B|\u4E0D\u8981|\u770B|\u770B\u770B|\u8C03\u7814|\u5206\u6790|\u8BC4\u4F30)|\u7ED9.*\u65B9\u6848|\u7ED9.*\u8BA1\u5212|\u600E\u4E48.*\u505A|\u5982\u4F55.*\u505A|\u600E\u4E48.*\u5B9E\u73B0|\u5982\u4F55.*\u5B9E\u73B0|\u5E94\u8BE5\u600E\u4E48|\u600E\u4E48.*\u62C6|\u62C6\u5206|\u53EA\u7ED9.*\u8BA1\u5212|\u4E0D\u8981.*\u6539\u4EE3\u7801|\u522B.*\u6539\u4EE3\u7801|\u4E0D\u8981.*\u52A8\u4EE3\u7801|\u522B.*\u52A8\u4EE3\u7801|\u8BC4\u4F30.*\u98CE\u9669|\u98CE\u9669.*\u8BC4\u4F30|\u8BBE\u8BA1.*\u65B9\u6848|\u67B6\u6784|\u8FC1\u79FB|\u96C6\u6210|\\b(plan|planning|research|investigate|approach|proposal|architecture|risk|migration|integration)\\b|how (should|would|to)|do not (edit|modify|change)|don.t (edit|modify|change)|no code changes|without changing code"; then
-    echo "## mancode \u81EA\u52A8\u8DEF\u7531"
-    echo ""
-    echo "\u8FD9\u4E2A\u8BF7\u6C42\u662F\u89C4\u5212/\u8C03\u7814\u7C7B\u4EFB\u52A1\u3002\u4E0D\u8981\u76F4\u63A5\u8FDB\u5165 solo \u5B9E\u65BD\u3002"
-    echo "\u5FC5\u987B\u5148\u8C03\u7528 Skill tool\uFF0Cskill='man'\uFF0C\u628A\u7528\u6237\u539F\u59CB\u8BF7\u6C42\u4F5C\u4E3A task\uFF0C\u6267\u884C Scout \u8C03\u7814\u3001\u6F84\u6E05\u548C Plan Coach plan\u3002"
-    echo "\u7528\u6237\u53EA\u8981\u8BA1\u5212\u65F6\uFF0C\u5728 Step 4 \u9009\u62E9\u201C\u53EA\u8981\u8BA1\u5212\u201D\uFF1B\u4E0D\u8981\u5207\u5230\u53E6\u4E00\u4E2A\u547D\u4EE4\u3002"
-    echo ""
-fi
-
-# UI token \u4EC5\u5728 profile \u786E\u8BA4\u5B58\u5728 UI \u8D44\u4EA7\u4E14\u4EFB\u52A1\u660E\u786E\u6D89\u53CA UI \u65F6\u6CE8\u5165\u3002
-PROFILE_FILE="$PROJECT_ROOT/.mancode/project-profile.json"
-UI_ASSETS=""
-if [ -f "$PROFILE_FILE" ]; then
-    UI_ASSETS=$(json_get "uiAssets" "$PROFILE_FILE")
-fi
-if [ "$UI_ASSETS" = "detected" ] && echo "$USER_PROMPT" | grep -qiE "\\b(button|component|page|style|ui|design|layout|css|color|font|theme|card|input|modal|dialog|header|footer|sidebar|dropdown|tooltip|toast|avatar|badge)\\b|\u754C\u9762|\u9875\u9762|\u6309\u94AE|\u6837\u5F0F|\u989C\u8272|\u5B57\u4F53|\u5E03\u5C40|\u7EC4\u4EF6|\u5F39\u7A97|\u5BFC\u822A|\u5361\u7247|\u8F93\u5165\u6846|\u4E3B\u9898|\u7F8E\u5316|\u4F18\u5316.*\u754C\u9762|\u8C03\u6574.*\u6837\u5F0F"; then
-    if [ -f "$AESTHETICS_FILE" ]; then
-        MATCH_LEVEL=$(json_get "matchLevel" "$AESTHETICS_FILE")
-
-        if [ "$MATCH_LEVEL" = "high" ]; then
-            if [ "$HAS_JQ" = "1" ]; then
-            # \u63D0\u53D6\u6458\u8981 + cap\uFF08docs/07 \xA74.1\uFF1Acolors \u22648, fonts \u22644, \u603B < 800 tokens\uFF09
-            UI=$(jq -r '.uiLibrary // empty' "$AESTHETICS_FILE" 2>/dev/null)
-            DARK=$(jq -r '.darkMode // empty' "$AESTHETICS_FILE" 2>/dev/null)
-            MATCH=$(jq -r '.matchLevel // empty' "$AESTHETICS_FILE" 2>/dev/null)
-            COLORS=$(jq -r '.colors | to_entries | map(select(.key | test("^[A-Za-z0-9_-]{1,80}$"))) | .[0:8] | map("\\(.key)=\\(.value)") | join(", ")' "$AESTHETICS_FILE" 2>/dev/null)
-            FONTS=$(jq -r '.fonts | to_entries | map(select(.key | test("^[A-Za-z0-9_-]{1,80}$"))) | .[0:4] | map("\\(.key)=\\(.value | first)") | join(", ")' "$AESTHETICS_FILE" 2>/dev/null)
-            COMPONENTS=$(jq -r '(.components // []) | map(select(test("^[A-Z][A-Za-z0-9]{0,79}$"))) | .[0:8] | join(", ")' "$AESTHETICS_FILE" 2>/dev/null)
-            CSS_VARS=$(jq -r '(.cssVariables // {}) | to_entries | map(select(.key | test("^[A-Za-z0-9_-]{1,80}$"))) | .[0:8] | map("--\\(.key)=\\(.value)") | join(", ")' "$AESTHETICS_FILE" 2>/dev/null)
-
-            echo "## \u5BA1\u7F8E token \u6458\u8981"
-            [ -n "$UI" ] && echo "UI: $(sanitize "$UI")"
-            [ -n "$DARK" ] && echo "Dark: $(sanitize "$DARK")"
-            [ -n "$MATCH" ] && echo "Match: $(sanitize "$MATCH")"
-            [ -n "$COLORS" ] && echo "Colors (\u524D 8): $(sanitize "$COLORS")"
-            [ -n "$FONTS" ] && echo "Fonts (\u524D 4): $(sanitize "$FONTS")"
-            [ -n "$COMPONENTS" ] && echo "Components (\u524D 8): $(sanitize "$COMPONENTS")"
-            [ -n "$CSS_VARS" ] && echo "CSS variables (\u524D 8): $(sanitize "$CSS_VARS")"
-            echo "\u5B8C\u6574 token: .mancode/aesthetics/style-tokens.json"
-            echo ""
-        else
-            # \u65E0 jq: \u53EA\u8F93\u51FA\u6307\u9488\uFF08cap \u65E0\u6CD5\u4E25\u683C\u6267\u884C\uFF09
-            echo "## \u5BA1\u7F8E token"
-            echo "\u8BFB\u53D6 .mancode/aesthetics/style-tokens.json"
-            echo ""
-        fi
-    fi
-fi
-fi
+var USER_PROMPT_SUBMIT_HOOK = String.raw`#!/usr/bin/env node
+// .mancode/hooks/user-prompt-submit.mjs
+// mancode UserPromptSubmit hook - cross-platform prompt and style context
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const projectRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../..',
+);
+const mancodeDir = path.join(projectRoot, '.mancode');
+const state = readJson(path.join(mancodeDir, 'state.json')) || {};
+const profile = readJson(path.join(mancodeDir, 'project-profile.json')) || {};
+const mode = typeof state.currentMode === 'string' ? state.currentMode : '';
+const output = [];
+
+if (mode === 'solo') {
+  output.push(
+    '## 动手前，先想六个问题：',
+    '',
+    '1. **为什么做？**',
+    '   - 这个改动解决什么问题？',
+    '',
+    '2. **已经有什么？**',
+    '   - 项目里有没有类似的实现可以复用？',
+    '',
+    '3. **最少改多少？**',
+    '   - 能用一行解决吗？能复用现有代码吗？',
+    '',
+    '4. **能不能不拆新系统？**',
+    '   - 不新建文件或模块能完成吗？',
+    '',
+    '5. **非平凡逻辑怎样最小运行验证？**',
+    '',
+    '6. **有什么没把握的？**',
+    '   - 先自行查代码或文档，最多 2 次工具调用；仍不确定再问用户。',
+    '',
+  );
+}
+
+const rawInput = readFileSync(0, 'utf8');
+const userPrompt = readPrompt(rawInput);
+const planningPattern = /先(?:别|不要|看|看看|调研|分析|评估)|给.*方案|给.*计划|怎么.*做|如何.*做|怎么.*实现|如何.*实现|应该怎么|怎么.*拆|拆分|只给.*计划|不要.*改代码|别.*改代码|不要.*动代码|别.*动代码|评估.*风险|风险.*评估|设计.*方案|架构|迁移|集成|\b(?:plan|planning|research|investigate|approach|proposal|architecture|risk|migration|integration)\b|how (?:should|would|to)|do not (?:edit|modify|change)|don.t (?:edit|modify|change)|no code changes|without changing code/iu;
+
+if (mode === 'solo' && planningPattern.test(userPrompt)) {
+  output.push(
+    '## mancode 自动路由',
+    '',
+    '这个请求是规划/调研类任务。不要直接进入 solo 实施。',
+    "必须先调用 Skill tool，skill='man'，把用户原始请求作为 task，执行 Scout 调研、澄清和 Plan Coach plan。",
+    '用户只要计划时，在 Step 4 选择“只要计划”；不要切到另一个命令。',
+    '',
+  );
+}
+
+const uiPattern = /\b(?:button|component|page|style|ui|design|layout|css|color|font|theme|card|input|modal|dialog|header|footer|sidebar|dropdown|tooltip|toast|avatar|badge)\b|界面|页面|按钮|样式|颜色|字体|布局|组件|弹窗|导航|卡片|输入框|主题|美化|优化.*界面|调整.*样式/iu;
+
+if (profile.uiAssets === 'detected' && uiPattern.test(userPrompt)) {
+  appendAestheticSummary(
+    output,
+    readJson(path.join(mancodeDir, 'aesthetics', 'style-tokens.json')),
+  );
+}
+
+if (output.length > 0) console.log(output.join('\n'));
+
+function appendAestheticSummary(lines, tokens) {
+  if (!tokens || tokens.matchLevel !== 'high') return;
+
+  const colors = safeEntries(tokens.colors, 8).map(
+    ([key, value]) => key + '=' + String(value),
+  );
+  const fonts = safeEntries(tokens.fonts, 4)
+    .filter(([, value]) => Array.isArray(value) && value.length > 0)
+    .map(([key, value]) => key + '=' + String(value[0]));
+  const components = Array.isArray(tokens.components)
+    ? tokens.components
+        .filter(
+          (value) =>
+            typeof value === 'string' && /^[A-Z][A-Za-z0-9]{0,79}$/.test(value),
+        )
+        .slice(0, 8)
+    : [];
+  const cssVariables = safeEntries(tokens.cssVariables, 8).map(
+    ([key, value]) => '--' + key + '=' + String(value),
+  );
+
+  lines.push('## 审美 token 摘要');
+  appendValue(lines, 'UI', tokens.uiLibrary);
+  appendValue(lines, 'Dark', tokens.darkMode);
+  appendValue(lines, 'Match', tokens.matchLevel);
+  appendValue(lines, 'Colors (前 8)', colors.join(', '));
+  appendValue(lines, 'Fonts (前 4)', fonts.join(', '));
+  appendValue(lines, 'Components (前 8)', components.join(', '));
+  appendValue(lines, 'CSS variables (前 8)', cssVariables.join(', '));
+  lines.push('完整 token: .mancode/aesthetics/style-tokens.json', '');
+}
+
+function safeEntries(value, limit) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return [];
+  return Object.entries(value)
+    .filter(([key]) => /^[A-Za-z0-9_-]{1,80}$/.test(key))
+    .slice(0, limit);
+}
+
+function appendValue(lines, label, value) {
+  const clean = sanitize(value);
+  if (clean) lines.push(label + ': ' + clean);
+}
+
+function readPrompt(input) {
+  try {
+    const parsed = JSON.parse(input);
+    return typeof parsed.prompt === 'string' && parsed.prompt
+      ? parsed.prompt
+      : input;
+  } catch {
+    return input;
+  }
+}
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function sanitize(value) {
+  return String(value ?? '').replace(/[\r\n]/g, ' ').slice(0, 200);
+}
 `;
 var SOLO_SKILL = `# mancode \xB7 solo mode
 
@@ -757,23 +777,19 @@ var SOLO_SKILL = `# mancode \xB7 solo mode
 4. \u4EE5\u9879\u76EE\u65E2\u6709\u7684\u65E0\u969C\u788D\u3001\u54CD\u5E94\u5F0F\u4E0E\u53CD\u9988\u65B9\u5F0F\u4E3A\u51C6
 
 ### \u754C\u9762\u8D28\u91CF\u68C0\u67E5\uFF08\u6761\u4EF6\u6267\u884C\uFF09
-UI \u8F93\u51FA\u524D\u81EA\u68C0\uFF1A
-- \u662F\u5426\u590D\u7528\u4E86\u9879\u76EE\u5B9E\u9645\u7684\u5C42\u7EA7\u3001\u95F4\u8DDD\u3001\u989C\u8272\u3001\u5B57\u4F53\u4E0E\u4EA4\u4E92\u53CD\u9988\uFF1F
-- \u4FE1\u606F\u5C42\u7EA7\u3001\u7A7A/\u52A0\u8F7D/\u9519\u8BEF\u72B6\u6001\u548C\u952E\u76D8/\u8BFB\u5C4F\u53EF\u8FBE\u6027\u662F\u5426\u6E05\u695A\uFF1F
-- \u662F\u5426\u4E3A\u4E86\u201C\u597D\u770B\u201D\u5F15\u5165\u4E0E\u73B0\u6709\u4EA7\u54C1\u65E0\u5173\u7684\u88C5\u9970\u3001\u52A8\u753B\u6216\u7EC4\u4EF6\uFF1F
+\u53EA\u68C0\u67E5\u672C\u6B21 diff \u65B0\u589E\u6216\u6539\u53D8\u7684\u754C\u9762\u884C\u4E3A\uFF1A\u590D\u7528\u5DF2\u6709\u5C42\u7EA7\u3001token \u548C\u7EC4\u4EF6\uFF1B\u65B0\u589E\u5F02\u6B65\u6216\u4EA4\u4E92\u8DEF\u5F84\u65F6\u624D\u68C0\u67E5\u5BF9\u5E94\u7684\u52A0\u8F7D\u3001\u5931\u8D25\u548C\u53EF\u8FBE\u6027\u72B6\u6001\u3002\u4E0D\u8981\u501F UI \u81EA\u68C0\u5DE1\u67E5\u672A\u6539\u52A8\u9875\u9762\u6216\u8865\u9F50\u63A8\u6D4B\u6027\u72B6\u6001\u3002
 
 ### \u9A8C\u8BC1
 \u4EE3\u7801\u5B8C\u6210\u540E\uFF1A
-1. \u8FD0\u884C build\uFF08\u5982\u6709\uFF09
-2. \u8FD0\u884C lint\uFF08\u5982\u6709\uFF09
-3. \u8FD0\u884C test\uFF08\u5982\u6709\uFF09
-4. \u786E\u8BA4\u901A\u8FC7\u540E\u624D\u58F0\u79F0\u5B8C\u6210
+1. \u9009\u62E9\u4E0E\u672C\u6B21\u6539\u52A8\u76F4\u63A5\u76F8\u5173\u7684\u6700\u7A84 test\u3001lint\u3001typecheck\u3001build \u6216 smoke check
+2. \u6587\u6848\u3001\u6CE8\u91CA\u6216\u7EAF\u9759\u6001\u8D44\u6E90\u6539\u52A8\u4E0D\u5F3A\u5236\u8FD0\u884C\u5B8C\u6574\u6D4B\u8BD5\u77E9\u9635
+3. \u786E\u8BA4\u5B9E\u9645\u6267\u884C\u7ED3\u679C\u540E\u624D\u58F0\u79F0\u5B8C\u6210
 
-### \u5B8C\u6210\u540E\u81EA\u5BA1\u4E0E\u6A21\u5F0F\u63A8\u8350
-- \u9A8C\u8BC1\u7C7B\u95EE\u9898\uFF08build/lint/test \u5931\u8D25\u3001\u9057\u7559 debug\uFF09\u76F4\u63A5\u4FEE\u590D\u5E76\u590D\u9A8C\u3002
-- \u98CE\u683C\u7C7B\u95EE\u9898\uFF08\u547D\u540D\u3001\u53EF\u8BFB\u6027\u3001DRY\uFF09\u53EA\u63D0\u793A\uFF0C\u4E0D\u4E3A\u6B64\u6269\u5927\u65E0\u5173\u6539\u52A8\u3002
-- \u52A8\u624B\u524D\u82E5\u6D89\u53CA 3 \u4E2A\u4EE5\u4E0A\u6587\u4EF6\u3001\u65B0\u6A21\u5757\u6216\u67B6\u6784\u53D8\u52A8\uFF0C\u7528\u4E00\u53E5\u8BDD\u5EFA\u8BAE\u7528\u6237\u5148\u7528 \`/man\`\uFF1B\u7528\u6237\u8BF4\u201C\u7EE7\u7EED solo\u201D\u5373\u53EF\u8DF3\u8FC7\u3002
-- \u81EA\u5BA1\u53D1\u73B0 3 \u4E2A\u4EE5\u4E0A\u95EE\u9898\u65F6\uFF0C\u5EFA\u8BAE \`/manps\` \u6216 \`/man\`\u3002
+### \u5B8C\u6210\u540E\u7684\u4E00\u6B21\u53D7\u9650\u81EA\u68C0
+- \u53EA\u505A\u4E00\u6B21\uFF0C\u53EA\u770B\u672C\u6B21 diff\u3001\u9700\u6C42\u548C\u76F4\u63A5\u53D7\u5F71\u54CD\u8DEF\u5F84\uFF1B\u4E0D\u8C03\u7528\u989D\u5916 reviewer\uFF0C\u4E0D\u751F\u6210\u5BA1\u67E5\u62A5\u544A\uFF0C\u4E0D\u91CD\u590D\u5DE1\u68C0\u3002
+- \u9A8C\u8BC1\u5931\u8D25\u3001\u884C\u4E3A\u56DE\u5F52\u6216\u9057\u7559 debug \u53EF\u76F4\u63A5\u4FEE\u590D\u5E76\u590D\u9A8C\uFF1B\u590D\u9A8C\u4E0D\u662F\u65B0\u4E00\u8F6E review\u3002
+- \u547D\u540D\u3001\u53EF\u8BFB\u6027\u3001DRY\u3001loading/error \u5F62\u5F0F\u7B49\u5EFA\u8BAE\u4E0D\u81EA\u52A8\u6269\u5927\u6539\u52A8\uFF1B\u4E0E\u9700\u6C42\u65E0\u5173\u65F6\u4E0D\u8F93\u51FA\u3002
+- \u53EA\u6709\u9274\u6743\u3001\u652F\u4ED8\u3001\u654F\u611F\u6570\u636E\u3001\u8FC1\u79FB/\u5220\u9664\u3001\u516C\u5F00 API\u3001\u672A\u53EF\u4FE1\u8F93\u5165\u3001\u5E76\u53D1\u6216\u57FA\u7840\u8BBE\u65BD\u7B49\u786C\u98CE\u9669\u51FA\u73B0\u65F6\uFF0C\u624D\u7528\u4E00\u53E5\u8BDD\u5EFA\u8BAE \`/man\`\uFF1B\u7528\u6237\u8BF4\u201C\u7EE7\u7EED solo\u201D\u5373\u53EF\u7EE7\u7EED\u3002
 
 ## \u4F60\u7684\u98CE\u683C
 
@@ -833,21 +849,24 @@ var MAN_SKILL = {
 
 \u8FD0\u884C\u5B9E\u9645 build/lint/typecheck/test \u548C smoke test\u3002\u76F8\u540C\u4EE3\u7801\u3001\u73AF\u5883\u3001\u547D\u4EE4\u4E0B\u76F8\u540C\u9519\u8BEF\u7B7E\u540D\u5931\u8D25\u4E24\u6B21\uFF0C\u505C\u6B62\u76F2\u8BD5\u5E76\u8BCA\u65AD\u6839\u56E0\u3002\u9700\u8981\u771F\u5B9E\u6D4F\u89C8\u5668\u3001\u590D\u6742\u590D\u73B0\u6216\u56DE\u5F52\u65F6\uFF0C\u7528 \`mancode workflow create mamba "<\u95EE\u9898>" --parent-task <taskId> --json\` \u521B\u5EFA\u5B50 workflow\uFF1B\u7236\u4EFB\u52A1\u4FDD\u6301 Step 6\u3002\u5B50\u4EFB\u52A1 fixed/verified/no_repro \u540E\u6062\u590D\u672C\u4EFB\u52A1\uFF1B\u82E5\u7236\u66FE\u56E0\u8BE5\u5B50\u4EFB\u52A1 blocked\uFF0C\u5148\u901A\u8FC7 \`workflow update --status in_progress\` \u6062\u590D\uFF0C\u518D\u66F4\u65B0\u81F3 Step 7\u3002blocked \u6216 manual_test_required \u4F1A\u7531 CLI \u81EA\u52A8\u963B\u585E\u7236\u4EFB\u52A1\uFF0C\u4E0D\u5F97\u624B\u6539\u7236 metadata\uFF0C\u4E5F\u4E0D\u5F97\u81EA\u52A8\u8D8A\u8FC7\u4EBA\u5DE5\u9A8C\u8BC1\u8981\u6C42\u3002
 
+\u9A8C\u8BC1\u540E\u57FA\u4E8E**\u5B9E\u9645 diff**\u5199 \`review-scope.md\`\uFF1Abase\u3001\u6539\u52A8\u6587\u4EF6\u3001\u9700\u6C42\u3001\u5DF2\u8DD1\u9A8C\u8BC1\u3001\u786C\u98CE\u9669\u548C\u5BA1\u67E5\u6DF1\u5EA6\u3002\u9274\u6743\u3001\u652F\u4ED8\u3001\u654F\u611F\u6570\u636E\u3001\u8FC1\u79FB/\u5220\u9664\u3001\u516C\u5F00 API\u3001\u672A\u53EF\u4FE1\u8F93\u5165\u3001\u5E76\u53D1\u3001\u8DE8\u670D\u52A1\u6216\u57FA\u7840\u8BBE\u65BD\u547D\u4E2D\u4EFB\u4E00\u9879\u65F6\u7528\u5B8C\u6574\u5BA1\u67E5 \`full\`\uFF1B\u5426\u5219\u7528\u5B9A\u5411\u5BA1\u67E5 \`targeted\`\u3002\u8FD0\u884C \`mancode workflow review <taskId> init --review-depth targeted --review-domain quality\` \u6216 \`--review-depth full\`\u3002\u7528\u6237\u660E\u786E\u8DF3\u8FC7\u5BA1\u67E5\u65F6\u624D\u628A \`review\` \u5199\u5165\u7D2F\u8BA1 skippedSteps\uFF0C\u5E76\u8BB0\u5F55\u6B8B\u4F59\u98CE\u9669\u3002
+
 ### Step 7: Film #1 \u4EE3\u7801\u8D28\u91CF\u5BA1\u67E5\u4E0E\u4FEE\u590D
 
-\u8C03\u7528 \`film-analyst-offense\` \u5BA1\u67E5\u8D28\u91CF\u3001\u590D\u7528\u3001\u590D\u6742\u5EA6\u548C\u6D4B\u8BD5\uFF0C\u5199 \`film-report-1.md\`\uFF1BHead Coach \u4FEE\u590D \u{1F534}\uFF0C\u5BF9 \u{1F7E1} \u5199\u4FEE\u590D\u6216\u6743\u8861\u3002\u5B8C\u6210\u540E\u66F4\u65B0\u81F3 Step 8\u3002
+\u672A\u8DF3\u8FC7 review \u65F6\u8C03\u7528 \`film-analyst-offense\`\uFF0C\u53EA\u5BA1\u67E5\u672C\u6B21 diff \u7684\u884C\u4E3A\u6B63\u786E\u6027\u3001\u590D\u7528\u3001\u590D\u6742\u5EA6\u548C\u6D4B\u8BD5\uFF0C\u5199 \`film-report-1.md\`\u3002\u6BCF\u6761 finding \u5FC5\u987B\u5F15\u7528\u6539\u52A8\u884C\u3001\u7ED9\u51FA\u8BC1\u636E\u548C\u7528\u6237\u5F71\u54CD\uFF1B\u6700\u591A 3 \u4E2A\u65B0 finding\u3002\u7528\u7A33\u5B9A ID\uFF08\u5982 Q1\uFF09\u6807\u8BB0 \u{1F534} blocker\uFF0C\u5E76\u8FD0\u884C \`mancode workflow review <taskId> complete --review-domain quality --report film-report-1.md --blockers Q1,Q2\`\uFF1B\u6CA1\u6709 blocker \u65F6\u4F20\u7A7A\u5B57\u7B26\u4E32\u3002\u6B64\u65F6\u4E0D\u4FEE\u590D\uFF0C\u5148\u5B8C\u6210\u6240\u9700\u5BA1\u67E5\u9886\u57DF\uFF0C\u518D\u66F4\u65B0\u81F3 Step 8\u3002
 
 ### Step 8: Film #2 \u5B89\u5168\u4E0E\u8FB9\u754C\u5BA1\u67E5
 
-\u8C03\u7528 \`film-analyst-defense\` \u5BA1\u67E5\u5B89\u5168\u3001\u6743\u9650\u3001\u9519\u8BEF\u8DEF\u5F84\u3001\u517C\u5BB9\u6027\u548C\u8FB9\u754C\uFF0C\u5199 \`film-report-2.md\`\u3002\u53CC\u5BA1\u9ED8\u8BA4\u6267\u884C\uFF1B\u7528\u6237\u660E\u786E\u8981\u6C42\u624D\u53EF\u8DF3\u8FC7\uFF0C\u901A\u8FC7 CLI \u5199\u5165\u7D2F\u8BA1 skippedSteps \u548C\u6B8B\u4F59\u98CE\u9669\u3002\u5B8C\u6210\u540E\u66F4\u65B0\u81F3 Step 9\u3002
+\`full\` \u624D\u8C03\u7528 \`film-analyst-defense\`\uFF1B\u5B83\u5FC5\u987B\u5148\u8BFB \`review-scope.md\` \u548C \`film-report-1.md\`\uFF0C\u53EA\u5BA1\u67E5\u5B89\u5168\u3001\u6743\u9650\u3001\u9519\u8BEF\u8DEF\u5F84\u3001\u517C\u5BB9\u6027\u3001\u8D44\u6E90\u548C\u8FB9\u754C\u3002\u76F8\u540C\u6839\u56E0\u6807\u8BB0 \`duplicate\`\uFF0C\u4E0D\u5F97\u91CD\u65B0\u62A5\u544A\u3002\u5199 \`film-report-2.md\` \u540E\u4EE5 D1 \u7B49\u7A33\u5B9A blocker ID \u8FD0\u884C \`mancode workflow review <taskId> complete --review-domain security --report film-report-2.md --blockers D1\`\u3002\`targeted\` \u4E0D\u6267\u884C\u7B2C\u4E8C\u5BA1\uFF0C\u4E5F\u4E0D\u628A\u5B83\u63CF\u8FF0\u6210\u201C\u8DF3\u8FC7\u201D\uFF1B\u5B8C\u6210\u540E\u66F4\u65B0\u81F3 Step 9\u3002
 
 ### Step 9: \u589E\u5F3A\u6536\u5C3E
 
-1. \u4FEE\u590D Film #2 \u7684 \u{1F534} \u5E76\u91CD\u8DD1\u9A8C\u8BC1\u3002
-2. \u5199 \`summary.md\`\uFF1A\u6539\u52A8\u3001\u65B0\u5EFA\u3001\u590D\u7528\u3001\u9A8C\u8BC1\u3001\u53CC\u5BA1\u548C\u8DF3\u8FC7\u6B65\u9AA4\u3002
-3. \u9A8C\u8BC1\u901A\u8FC7\u4E14 \u{1F534} \u6E05\u96F6\u624D\u7528 CLI \u5199 \`completed\`\uFF1B\u5426\u5219\u7528 \`--status blocked --blocking-reason "<\u539F\u56E0>"\`\u3002
-4. \u5173\u952E\u51B3\u7B56 appendTeamDecision \u5230 \`decisions.md\`\uFF0C\u66F4\u65B0 Active Plans\u3002
-5. worktree \u5408\u5E76\u524D\u53D6\u5F97\u7528\u6237\u786E\u8BA4\uFF1B\u7EC8\u6001\u5199\u5165\u6210\u529F\u540E state \u56DE solo \u5E76\u6E05\u7A7A workflow \u6307\u9488\u3002
+1. \u5B58\u5728 open blocker \u65F6\uFF0CHead Coach \u4E00\u6B21\u6027\u4FEE\u590D\u5168\u90E8 blocker\uFF0C\u5E76\u7528 \`mancode workflow review <taskId> remediate --resolved Q1,D1\` \u8BB0\u5F55\u552F\u4E00\u4E00\u8F6E\u4FEE\u590D\uFF1B\u6CA1\u6709 blocker \u65F6\u4E0D\u8FD0\u884C remediate\u3002\u4E0D\u8981\u4E3A \u{1F7E1}/\u{1F7E2} \u6269\u5927\u6539\u52A8\u3002
+2. \u91CD\u8DD1\u53D7\u5F71\u54CD\u9A8C\u8BC1\uFF0C\u4E0D\u91CD\u65B0\u8FD0\u884C\u5DF2\u5B8C\u6210\u7684 reviewer\u3002\u4FEE\u590D\u82E5\u5F15\u5165\u65B0\u7684\u9AD8\u98CE\u9669\u9762\u5219\u6807\u8BB0 blocked\uFF0C\u4E0D\u80FD\u5F00\u542F\u65E0\u754C review \u5FAA\u73AF\u3002
+3. \u5199 \`summary.md\`\uFF1A\u6539\u52A8\u3001\u65B0\u5EFA\u3001\u590D\u7528\u3001\u9A8C\u8BC1\u3001\u5BA1\u67E5\u6DF1\u5EA6\u3001findings \u5904\u7F6E\u3001\u8DF3\u8FC7\u6B65\u9AA4\u548C\u6B8B\u4F59\u98CE\u9669\u3002
+4. CLI \u786E\u8BA4\u6240\u9700\u5BA1\u67E5\u9886\u57DF\u5B8C\u6210\u4E14 blocker \u6E05\u96F6\u540E\u624D\u5199 \`completed\`\uFF1B\u5426\u5219\u7528 \`--status blocked --blocking-reason "<\u539F\u56E0>"\`\u3002
+5. \u5173\u952E\u51B3\u7B56 appendTeamDecision \u5230 \`decisions.md\`\uFF0C\u66F4\u65B0 Active Plans\u3002
+6. worktree \u5408\u5E76\u524D\u53D6\u5F97\u7528\u6237\u786E\u8BA4\uFF1B\u7EC8\u6001\u5199\u5165\u6210\u529F\u540E state \u56DE solo \u5E76\u6E05\u7A7A workflow \u6307\u9488\u3002
 
 \u4EFB\u4F55 step/status/outcome/planVersion \u53D8\u5316\u90FD\u5FC5\u987B\u7ECF\u8FC7 workflow CLI\uFF1BCLI \u62D2\u7EDD\u65F6\u4FDD\u7559\u5F53\u524D state \u5E76\u62A5\u544A\u539F\u56E0\uFF0C\u4E0D\u53EF\u7ED5\u8FC7\u6821\u9A8C\u76F4\u63A5\u6539 metadata.json\u3002
 
@@ -1174,9 +1193,9 @@ var MANTEAM_SKILL = {
 4. \u8BA1\u5212\u5173\u5361\uFF1A\u7528\u6237\u53EF\u53EA\u4FDD\u7559\u8BA1\u5212\u3001\u7EE7\u7EED\u6267\u884C\u6216\u91CD\u5199\u8BA1\u5212\uFF1BActive Plans \u6309 taskId \u66F4\u65B0\u3002
 5. \u5B9E\u65BD\uFF1A\u6539\u52A8\u524D\u518D\u6B21\u68C0\u67E5 \`git status --short\`\uFF0C\u907F\u514D\u8E29\u7528\u6237\u6216\u961F\u53CB\u6539\u52A8\u3002
 6. Self-test\uFF1A\u4F18\u5148\u8DD1\u9879\u76EE\u5DF2\u6709\u9A8C\u8BC1\u547D\u4EE4\uFF1B\u5931\u8D25\u4E24\u6B21\u505C\u4E0B\u8BCA\u65AD\u6839\u56E0\u3002\u9700\u8981\u771F\u5B9E\u9A8C\u8BC1\u65F6\u521B\u5EFA\u5E26 parentTaskId \u7684 /mamba \u5B50\u4EFB\u52A1\u3002\u5B50\u4EFB\u52A1\u4FEE\u590D\u540E\u82E5\u7236\u4EFB\u52A1\u66FE\u56E0\u6B64 blocked\uFF0C\u5148\u7528 workflow CLI \u6062\u590D\u7236\u4EFB\u52A1\u4E3A in_progress\uFF1Bmanual_test_required \u4E0D\u5F97\u81EA\u52A8\u6062\u590D\u3002
-7. Film #1\uFF1A\u91CD\u70B9\u5BA1\u67E5\u53EF\u7EF4\u62A4\u6027\u3001\u547D\u540D\u4E00\u81F4\u6027\u3001\u56E2\u961F\u98CE\u683C\u4E00\u81F4\u6027\uFF0C\u5E76\u4FEE\u590D \u{1F534}\u3002
-8. Film #2\uFF1A\u91CD\u70B9\u5BA1\u67E5\u8FB9\u754C\u6761\u4EF6\u3001\u5B89\u5168\u3001\u6027\u80FD\u3001\u5E76\u53D1\u3001\u517C\u5BB9\u6027\u3002\u53CC\u5BA1\u9ED8\u8BA4\u6267\u884C\uFF1B\u7528\u6237\u660E\u786E\u8981\u6C42\u624D\u53EF\u8DF3\u8FC7\uFF0C\u5199\u5165 \`skippedSteps\` \u548C\u6B8B\u4F59\u98CE\u9669\uFF1B\u8DF3\u8FC7\u4E0D\u963B\u6B62 completed\uFF0C\u4F46\u4E0D\u5F97\u58F0\u79F0"\u5DF2\u5B8C\u6210\u53CC\u5BA1"\u3002
-9. Post-game\uFF1A\u590D\u9A8C\uFF0C\u5199 summary \u4E0E hand-off\uFF1B\u9A8C\u8BC1\u5931\u8D25\u6216\u672A\u4FEE\u590D \u{1F534} \u65F6\u6807\u8BB0 blocked\uFF0C\u4E0D\u5F97\u6807 completed\u3002
+7. Review scope + Film #1\uFF1A\u57FA\u4E8E\u5B9E\u9645 diff \u5199 \`review-scope.md\`\uFF0C\u7528 \`workflow review ... init\` \u9009\u62E9 targeted \u6216 full\uFF1B\u91CD\u70B9\u5BA1\u67E5\u884C\u4E3A\u3001\u53EF\u7EF4\u62A4\u6027\u3001\u56E2\u961F\u98CE\u683C\u4E0E\u6D4B\u8BD5\uFF0Cfinding \u5FC5\u987B\u6709\u8BC1\u636E\u548C\u7A33\u5B9A ID\u3002
+8. Film #2\uFF1A\u4EC5 full \u6267\u884C\uFF0C\u5148\u8BFB Film #1 \u62A5\u544A\u5E76\u53BB\u91CD\uFF0C\u53EA\u5BA1\u67E5\u8FB9\u754C\u3001\u5B89\u5168\u3001\u6027\u80FD\u3001\u5E76\u53D1\u548C\u517C\u5BB9\u6027\u3002\u7528\u6237\u660E\u786E\u8981\u6C42\u624D\u53EF\u8DF3\u8FC7\u5168\u90E8 review\uFF0C\u5E76\u5199\u5165 \`skippedSteps\` \u548C\u6B8B\u4F59\u98CE\u9669\u3002
+9. Post-game\uFF1A\u6C47\u603B blocker\uFF0C\u53EA\u505A\u4E00\u8F6E\u4FEE\u590D\u5E76\u7528 \`workflow review ... remediate\` \u8BB0\u5F55\uFF1B\u590D\u9A8C\u540E\u5199 summary \u4E0E hand-off\u3002\u9A8C\u8BC1\u5931\u8D25\u3001\u5BA1\u67E5\u4E0D\u5B8C\u6574\u6216\u4ECD\u6709 blocker \u65F6\u6807\u8BB0 blocked\uFF0C\u4E0D\u5F97\u6807 completed\u3002
 
 \u5982\u679C\u7528\u6237\u5728\u786E\u8BA4\u9636\u6BB5\u9009\u62E9"\u9000\u51FA"\u6216\u653E\u5F03\u56E2\u961F workflow\uFF1A\u7528 \`mancode workflow update <taskId> --status abandoned\` \u66F4\u65B0\u5E76\u6E05\u7406 Active Plans\uFF1B\u82E5\u6709\u6D3B\u8DC3 mamba \u5B50\u4EFB\u52A1\uFF0C\u5148\u53D6\u5F97\u786E\u8BA4\u5E76\u9010\u4E2A abandoned\u3002\u6210\u529F\u540E\u518D\u7528 Edit \u66F4\u65B0 state \u56DE solo\u3002\u4E0D\u8981\u76F4\u63A5\u6539 metadata\uFF0C\u4E5F\u4E0D\u8981\u628A abandoned workflow \u7559\u5728 active state\u3002
 
@@ -1242,7 +1261,7 @@ ${spec.body}
 }
 
 // src/installers/common.ts
-import { chmod, mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "fs/promises";
 import path2 from "path";
 
 // src/system/team-memory.ts
@@ -1432,12 +1451,10 @@ async function readTextIfExists(filePath) {
   }
 }
 async function installHooks(hooksDir) {
-  const sessionStartDst = path2.join(hooksDir, "session-start.sh");
+  const sessionStartDst = path2.join(hooksDir, "session-start.mjs");
   await writeFile2(sessionStartDst, SESSION_START_HOOK, "utf-8");
-  await chmod(sessionStartDst, 493);
-  const userPromptDst = path2.join(hooksDir, "user-prompt-submit.sh");
+  const userPromptDst = path2.join(hooksDir, "user-prompt-submit.mjs");
   await writeFile2(userPromptDst, USER_PROMPT_SUBMIT_HOOK, "utf-8");
-  await chmod(userPromptDst, 493);
 }
 async function pathExists(p) {
   try {
@@ -1455,12 +1472,18 @@ function isNodeError(err) {
 var CLAUDE_SKILL_MANAGED_MARKER = "<!-- Managed by mancode:claude-skill. Do not edit this marker. -->";
 var CLAUDE_AGENT_MANAGED_MARKER = "<!-- Managed by mancode:claude-agent. Do not edit this marker. -->";
 var MANCODE_HOOK_COMMANDS = [
+  'node ".mancode/hooks/session-start.mjs"',
+  'node ".mancode/hooks/user-prompt-submit.mjs"'
+];
+var LEGACY_MANCODE_HOOK_COMMANDS = [
   "bash .mancode/hooks/session-start.sh",
   "bash .mancode/hooks/user-prompt-submit.sh"
 ];
 function isGeneratedMancodeHookCommand(command) {
   const normalized = command.trim();
-  return MANCODE_HOOK_COMMANDS.some((item) => item === normalized);
+  return [...MANCODE_HOOK_COMMANDS, ...LEGACY_MANCODE_HOOK_COMMANDS].some(
+    (item) => item === normalized
+  );
 }
 var LEGACY_CLAUDE_SKILL_SETTINGS = {
   solo: ".claude/skills/mancode-solo.md",
@@ -1489,6 +1512,14 @@ async function installClaudeCode(projectRoot, options) {
     await installAgents(path3.join(claudeDir, "agents"), force);
   }
   await updateClaudeSettings(claudeDir, settings);
+  await removeLegacyHookFiles(projectRoot);
+}
+async function removeLegacyHookFiles(projectRoot) {
+  const hooksDir = path3.join(projectRoot, ".mancode", "hooks");
+  await Promise.all([
+    rm(path3.join(hooksDir, "session-start.sh"), { force: true }),
+    rm(path3.join(hooksDir, "user-prompt-submit.sh"), { force: true })
+  ]);
 }
 async function installSoloSkill(skillsDir, force) {
   await installProjectSkill(
@@ -2194,10 +2225,10 @@ var MODE_META = {
       "Step 3 \u2014 Plan: write `plan.md` with scope, reuse, exclusions, risks, completion criteria, and real validation. First plan is v1; revisions use `--plan-version <current+1>` and Active Plans is updated by the CLI.",
       "Step 4 \u2014 Plan gate: the user chooses plan-only (`status planned`), continue to execution, or revise the plan. Do not implement before this choice.",
       "Step 5 \u2014 Implement the confirmed minimum change.",
-      "Step 6 \u2014 Run detected build/lint/typecheck/test and smoke checks. A real or complex diagnosis creates a linked mamba child while the parent remains at Step 6. After a resolved child, restore a parent blocked by that child with `workflow update --status in_progress` before Step 7; never auto-resume manual_test_required.",
-      "Step 7 \u2014 Film #1 code-quality review; fix all required findings and explain suggested-item tradeoffs.",
-      "Step 8 \u2014 Film #2 security/boundary review; keep it independent from Film #1. The two review passes are skipped only on explicit user instruction and the residual risk is recorded.",
-      "Step 9 \u2014 Fix, re-verify, write `summary.md`, archive decisions, and set completed only when verification passes and required findings are zero; otherwise set blocked+blockingReason.",
+      "Step 6 \u2014 Run detected build/lint/typecheck/test and smoke checks. A real or complex diagnosis creates a linked mamba child while the parent remains at Step 6. After a resolved child, restore a parent blocked by that child with `workflow update --status in_progress` before Step 7; never auto-resume manual_test_required. Then write `review-scope.md` from the actual diff, verification evidence, and hard-risk triggers. Initialize a targeted review for routine governed changes or a full review for auth, payment, sensitive data, migrations/deletion, public APIs, untrusted input, concurrency, cross-service, or infrastructure changes using `mancode workflow review <taskId> init ...`.",
+      "Step 7 \u2014 Run one quality review limited to the changed diff and direct impact. Findings require changed-line evidence and user impact, with at most three new findings. Record stable blocker IDs through `workflow review ... complete`; do not fix yet.",
+      "Step 8 \u2014 Only full review runs the security/boundary reviewer. It must read Film #1, mark the same root cause duplicate, and stay within security, permissions, recovery, resources, and boundaries. A targeted review ends after Film #1.",
+      "Step 9 \u2014 If open blockers exist, fix them in one remediation round and record resolved IDs through `workflow review ... remediate`; with no blockers, do not create a remediation round. Re-run affected verification without re-running completed reviewers. Write `summary.md` and set completed only when required domains are complete and blockers are zero; otherwise set blocked+blockingReason.",
       "",
       "After planned/completed/abandoned, return state to solo. On blocked, preserve enough state to resume. A CLI rejection is a hard stop, never a reason to bypass metadata validation."
     ].join("\n")
@@ -2214,7 +2245,7 @@ var MODE_META = {
       "shared-module, and handoff risks in `team-context.md`.",
       "",
       "Then execute every /man Step 1 through Step 9, including clarification,",
-      "plan gate, validation, two review passes, conditional completion, planVersion,",
+      "plan gate, validation, bounded risk-based review, conditional completion, planVersion,",
       "Active Plans, and linked mamba child behavior. Add compatibility, rollback,",
       "ownership, conflict, and handoff notes at each relevant step.",
       "When a resolved mamba child had blocked the parent, restore the parent through",
@@ -2317,7 +2348,9 @@ function renderPracticeRules() {
     "5. Prefer a one-line fix when it is enough.",
     "6. Only then write the smallest new implementation.",
     "",
-    "For every task, consider: why this change, what already exists, and what is the smallest useful diff?"
+    "For every task, consider: why this change, what already exists, and what is the smallest useful diff?",
+    "",
+    "In solo mode, use the narrowest meaningful validation and one bounded self-check limited to the current diff. Do not start another reviewer or repeat the review. Only recommend man for auth, payment, sensitive data, migrations/deletion, public APIs, untrusted input, concurrency, or infrastructure risk."
   ].join("\n");
 }
 function renderAesthetics(tokens) {
@@ -2499,7 +2532,7 @@ function renderCopilotPromptConventions() {
     "",
     "GitHub Copilot does not provide native mancode slash commands, hooks, or isolated subagents. Treat these names as user prompt conventions:",
     "",
-    "- man: use progressive research, planning, implementation, verification, and review.",
+    "- man: use progressive research, planning, implementation, verification, and bounded risk-based review.",
     "- mamba: diagnose bugs and validate real user flows or regressions.",
     "- manteam: read team memory and write handoff-friendly summaries.",
     "- manps: prefer `mancode manps [area]` before cleanup.",
@@ -2717,7 +2750,9 @@ function renderSoloRule() {
     "- Keep the diff narrow.",
     "- Reuse existing functions, components, styles, and dependencies.",
     "- Read `.mancode/project-profile.json` before choosing tools or validation. For detected UI assets and UI work, read `.mancode/aesthetics/style-tokens.json` and inspect existing components before inventing new styles.",
-    "- Verify with the narrowest meaningful test, lint, build, or smoke check."
+    "- Verify with the narrowest meaningful test, lint, build, or smoke check.",
+    "- Perform one bounded self-check limited to the current diff. Do not start another reviewer, create a review artifact, or repeat the review.",
+    "- Recommend /man only for auth, payment, sensitive data, migrations/deletion, public APIs, untrusted input, concurrency, or infrastructure risk."
   ].join("\n");
 }
 function renderMambaRule() {
@@ -2851,11 +2886,12 @@ function isPlatformName(platform) {
 }
 
 // src/system/detect-team.ts
-import { exec } from "child_process";
+import { execFile } from "child_process";
+import { access as access2 } from "fs/promises";
 import path10 from "path";
 import process2 from "process";
 import { promisify } from "util";
-var execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
 var NO_TEAM = {
   isTeam: false,
   contributors: 1,
@@ -2863,101 +2899,68 @@ var NO_TEAM = {
   hasRemote: false
 };
 var REMOTE_PATTERN = /github\.com|gitlab\.com|bitbucket\.org/;
-var EXEC_OPTS = {
-  shell: "/bin/bash",
-  encoding: "utf-8",
-  env: {
-    ...process2.env,
-    GIT_PAGER: "cat",
-    PAGER: "cat",
-    GIT_TERMINAL_PROMPT: "0"
-  }
+var GIT_ENV = {
+  ...process2.env,
+  GIT_PAGER: "cat",
+  PAGER: "cat",
+  GIT_TERMINAL_PROMPT: "0"
 };
 async function detectTeamStatus(projectRoot) {
-  const gitDir = path10.join(projectRoot, ".git");
-  try {
-    await execAsync("git rev-parse --is-inside-work-tree", {
-      cwd: projectRoot,
-      ...EXEC_OPTS
-    });
-  } catch {
-    return NO_TEAM;
-  }
   try {
-    await execAsync(`test -d ${JSON.stringify(gitDir)}`, {
-      cwd: projectRoot,
-      ...EXEC_OPTS
-    });
+    await access2(path10.join(projectRoot, ".git"));
+    const inside = await runGit(projectRoot, [
+      "rev-parse",
+      "--is-inside-work-tree"
+    ]);
+    if (inside.trim() !== "true") return NO_TEAM;
+    const [allEmails, recentEmails, remotes] = await Promise.all([
+      runGit(projectRoot, ["log", "--all", "--format=%ae"]),
+      runGit(projectRoot, ["log", "--since=30 days ago", "--format=%ae"]),
+      runGit(projectRoot, ["remote", "-v"])
+    ]);
+    const contributors = countUniqueLines(allEmails);
+    const recentActive = countUniqueLines(recentEmails);
+    const hasRemote = REMOTE_PATTERN.test(remotes);
+    return {
+      isTeam: contributors > 1 && hasRemote && recentActive > 1,
+      contributors: contributors || 1,
+      recentActive: recentActive || 1,
+      hasRemote
+    };
   } catch {
     return NO_TEAM;
   }
-  const contributors = await countUniqueEmails(
-    "git log --all --format='%ae'",
-    projectRoot
-  );
-  const recentActive = await countUniqueEmails(
-    "git log --since='30 days ago' --format='%ae'",
-    projectRoot
-  );
-  const hasRemote = await checkRemote(projectRoot);
-  const safeContributors = Number.isFinite(contributors) ? contributors : 0;
-  const safeRecent = Number.isFinite(recentActive) ? recentActive : 0;
-  const isTeam = safeContributors > 1 && hasRemote && safeRecent > 1;
-  return {
-    isTeam,
-    contributors: safeContributors || 1,
-    recentActive: safeRecent || 1,
-    hasRemote
-  };
 }
-async function countUniqueEmails(command, cwd) {
-  try {
-    const { stdout } = await execAsync(
-      `${command} 2>/dev/null | sort -u | grep -c . || true`,
-      { cwd, ...EXEC_OPTS }
-    );
-    const n = Number.parseInt(stdout.trim(), 10);
-    return Number.isFinite(n) ? n : 0;
-  } catch {
-    return 0;
-  }
+async function runGit(cwd, args) {
+  const { stdout } = await execFileAsync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    env: GIT_ENV,
+    windowsHide: true
+  });
+  return stdout;
 }
-async function checkRemote(cwd) {
-  try {
-    const { stdout } = await execAsync("git remote -v 2>/dev/null || true", {
-      cwd,
-      ...EXEC_OPTS
-    });
-    return REMOTE_PATTERN.test(stdout);
-  } catch {
-    return false;
-  }
+function countUniqueLines(output) {
+  return new Set(
+    output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
+  ).size;
 }
 
 // src/system/detect.ts
-import { exec as exec2 } from "child_process";
+import { execFile as execFile2 } from "child_process";
+import process3 from "process";
 import { promisify as promisify2 } from "util";
-var execAsync2 = promisify2(exec2);
-async function detectSystemDeps() {
-  const ALLOWED_COMMANDS = /* @__PURE__ */ new Set(["bash", "git", "jq", "node"]);
-  const check = async (cmd) => {
-    if (!ALLOWED_COMMANDS.has(cmd)) {
-      throw new Error(`Unsupported dependency check: ${cmd}`);
-    }
-    try {
-      await execAsync2(`command -v ${cmd}`, { shell: "/bin/bash" });
-      return true;
-    } catch {
-      return false;
-    }
-  };
-  const [bash, git, jq, node] = await Promise.all([
-    check("bash"),
-    check("git"),
-    check("jq"),
-    check("node")
-  ]);
-  return { bash, git, jq, node };
+var execFileAsync2 = promisify2(execFile2);
+async function detectSystemDeps(env = process3.env) {
+  try {
+    await execFileAsync2("git", ["--version"], {
+      env,
+      windowsHide: true
+    });
+    return { git: true };
+  } catch {
+    return { git: false };
+  }
 }
 
 // src/system/project-profile.ts
@@ -3653,7 +3656,7 @@ var EXIT_ALREADY_INITIALIZED = 1;
 var EXIT_NOT_A_PROJECT_DIR = 2;
 var EXIT_INIT_FAILED = 5;
 var DEFAULT_INIT_PLATFORM = "claude-code";
-async function init(rootDir = process3.cwd(), options = {}) {
+async function init(rootDir = process4.cwd(), options = {}) {
   const mancodeDir = path13.join(rootDir, ".mancode");
   const stateFile = path13.join(mancodeDir, "state.json");
   const wasInitialized = await pathExists3(stateFile);
@@ -3702,20 +3705,12 @@ async function init(rootDir = process3.cwd(), options = {}) {
   try {
     console.log("\u2713  \u68C0\u6D4B\u7CFB\u7EDF\u4F9D\u8D56...");
     const deps = await detectSystemDeps();
-    if (!deps.bash || !deps.git) {
-      console.error("\u2717  Missing required dependencies:");
-      if (!deps.bash) console.error("   - bash (required)");
-      if (!deps.git) console.error("   - git (required)");
-      console.error("");
-      console.error("   Install them and try again.");
-      return EXIT_NOT_A_PROJECT_DIR;
-    }
-    if (!deps.jq) {
+    if (!deps.git) {
       console.log(
-        "\u26A0\uFE0F  jq not found (optional). Hooks will use grep/sed fallback (slightly slower)."
+        "\u26A0\uFE0F  Git not found (optional). Team auto-detection will use solo defaults."
       );
     } else {
-      console.log("   bash \u2713 git \u2713 jq \u2713");
+      console.log("   git \u2713");
     }
     console.log("\u2713  \u68C0\u6D4B\u9879\u76EE\u7C7B\u578B...");
     const profile = await detectProjectProfile(rootDir);
@@ -3996,7 +3991,7 @@ async function pathExists3(p) {
 // src/commands/install.ts
 import { promises as fs4 } from "fs";
 import path15 from "path";
-import process4 from "process";
+import process5 from "process";
 
 // src/installers/platform-status.ts
 import { promises as fs3 } from "fs";
@@ -4019,8 +4014,8 @@ async function checkPlatformReadiness(rootDir, platform) {
       ),
       claudeHooksRegistered(rootDir),
       pathsExist([
-        path14.join(rootDir, ".mancode", "hooks", "session-start.sh"),
-        path14.join(rootDir, ".mancode", "hooks", "user-prompt-submit.sh")
+        path14.join(rootDir, ".mancode", "hooks", "session-start.mjs"),
+        path14.join(rootDir, ".mancode", "hooks", "user-prompt-submit.mjs")
       ])
     ]);
     const present = hasSoloSkill && registered && hasHookFiles;
@@ -4249,9 +4244,9 @@ function hooksRegistered(settings) {
   if (!isRecord4(settings)) return false;
   const hooks = settings.hooks;
   if (!isRecord4(hooks)) return false;
-  return hasHookCommand(hooks.SessionStart, ".mancode/hooks/session-start.sh") && hasHookCommand(
+  return hasHookCommand(hooks.SessionStart, ".mancode/hooks/session-start.mjs") && hasHookCommand(
     hooks.UserPromptSubmit,
-    ".mancode/hooks/user-prompt-submit.sh"
+    ".mancode/hooks/user-prompt-submit.mjs"
   );
 }
 function hasHookCommand(value, needle) {
@@ -4281,7 +4276,7 @@ var EXIT_OK2 = 0;
 var EXIT_NOT_INITIALIZED = 1;
 var EXIT_UNSUPPORTED_PLATFORM = 2;
 var EXIT_INSTALL_FAILED = 3;
-async function install(rootDir = process4.cwd(), platform = "claude-code", options = {}) {
+async function install(rootDir = process5.cwd(), platform = "claude-code", options = {}) {
   const stateFile = path15.join(rootDir, ".mancode", "state.json");
   if (!await pathExists5(stateFile)) {
     console.error("\u2717  mancode not initialized.");
@@ -4443,9 +4438,9 @@ function isRecord5(value) {
 // src/commands/list-platforms.ts
 import { promises as fs5 } from "fs";
 import path16 from "path";
-import process5 from "process";
+import process6 from "process";
 var EXIT_OK3 = 0;
-async function listPlatforms(rootDir = process5.cwd()) {
+async function listPlatforms(rootDir = process6.cwd()) {
   const installed = new Set(await readInstalledPlatforms(rootDir));
   const platforms = getPlatformInstallers();
   console.log("");
@@ -4483,16 +4478,16 @@ function describePlatform(platform) {
 }
 
 // src/commands/manps.ts
-import { access as access3 } from "fs/promises";
+import { access as access4 } from "fs/promises";
 import path18 from "path";
 import { createInterface } from "readline/promises";
 
 // src/system/preseason.ts
-import { execFile } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { createHash } from "crypto";
 import { existsSync, readFileSync } from "fs";
 import {
-  access as access2,
+  access as access3,
   lstat,
   mkdir as mkdir7,
   readFile as readFile8,
@@ -5052,7 +5047,7 @@ function architectureScannerUnavailableIssue() {
 function runDepcruise(binary, projectRoot) {
   return new Promise((resolve) => {
     const needsShell = process.platform === "win32";
-    execFile(
+    execFile3(
       binary,
       ["--output-type", "json", "."],
       {
@@ -5392,7 +5387,7 @@ function pathExistsSync(file) {
 }
 async function pathExists6(file) {
   try {
-    await access2(file);
+    await access3(file);
     return true;
   } catch {
     return false;
@@ -5555,7 +5550,7 @@ async function readStdinLines() {
 }
 async function pathExists7(p) {
   try {
-    await access3(p);
+    await access4(p);
     return true;
   } catch {
     return false;
@@ -5565,10 +5560,10 @@ async function pathExists7(p) {
 // src/commands/refresh-style.ts
 import { promises as fs6 } from "fs";
 import path19 from "path";
-import process6 from "process";
+import process7 from "process";
 var EXIT_OK5 = 0;
 var EXIT_NOT_INITIALIZED3 = 1;
-async function refreshStyle(rootDir = process6.cwd()) {
+async function refreshStyle(rootDir = process7.cwd()) {
   const stateFile = path19.join(rootDir, ".mancode", "state.json");
   if (!await pathExists8(stateFile)) {
     console.error("\u2717  mancode not initialized.");
@@ -5718,24 +5713,220 @@ async function pathExists8(p) {
 // src/commands/status.ts
 import { spawn } from "child_process";
 import { promises as fs7 } from "fs";
-import path21 from "path";
-import process7 from "process";
+import path22 from "path";
+import process8 from "process";
 
 // src/system/workflow.ts
 import {
-  mkdir as mkdir8,
-  readFile as readFile9,
+  mkdir as mkdir9,
+  readFile as readFile10,
   readdir as readdir5,
   rm as rm4,
-  stat as stat3,
-  writeFile as writeFile10
+  stat as stat4,
+  writeFile as writeFile11
 } from "fs/promises";
+import path21 from "path";
+
+// src/system/review-ledger.ts
+import { mkdir as mkdir8, readFile as readFile9, stat as stat3, writeFile as writeFile10 } from "fs/promises";
 import path20 from "path";
+var REVIEW_FILE = "review-ledger.json";
+var TASK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+var BLOCKER_ID_PATTERN = /^[A-Z][A-Z0-9-]{0,31}$/;
+function isReviewDepth(value) {
+  return value === "targeted" || value === "full";
+}
+function isReviewDomain(value) {
+  return value === "quality" || value === "security";
+}
+async function initializeReview(projectRoot, taskId, depth, targetDomain) {
+  assertValidTaskId(taskId);
+  const existing = await readReviewLedger(projectRoot, taskId);
+  if (existing) throw new Error(`review already initialized: ${taskId}`);
+  if (depth === "targeted" && !targetDomain) {
+    throw new Error("targeted review requires a review domain");
+  }
+  const ledger = {
+    version: "1.0",
+    depth,
+    requiredDomains: depth === "full" ? ["quality", "security"] : [targetDomain],
+    completedDomains: [],
+    reports: {},
+    blockers: [],
+    remediationRounds: 0
+  };
+  await writeReviewLedger(projectRoot, taskId, ledger);
+  return ledger;
+}
+async function completeReviewDomain(projectRoot, taskId, domain, report, blockerIds) {
+  const ledger = await requireReviewLedger(projectRoot, taskId);
+  if (!ledger.requiredDomains.includes(domain)) {
+    throw new Error(`review domain is not required: ${domain}`);
+  }
+  if (ledger.completedDomains.includes(domain)) {
+    throw new Error(`review domain already completed: ${domain}`);
+  }
+  if (domain === "security" && !ledger.completedDomains.includes("quality")) {
+    throw new Error("quality review must complete first");
+  }
+  assertSafeReportPath(report);
+  await assertReportExists(projectRoot, taskId, report);
+  const uniqueIds = new Set(blockerIds);
+  if (uniqueIds.size !== blockerIds.length) {
+    throw new Error("review blocker ids must be unique");
+  }
+  for (const id of blockerIds) {
+    if (!BLOCKER_ID_PATTERN.test(id)) {
+      throw new Error(`invalid review blocker id: ${id}`);
+    }
+    if (ledger.blockers.some((blocker) => blocker.id === id)) {
+      throw new Error(`duplicate review blocker id: ${id}`);
+    }
+  }
+  const updated = {
+    ...ledger,
+    completedDomains: [...ledger.completedDomains, domain],
+    reports: { ...ledger.reports, [domain]: report },
+    blockers: [
+      ...ledger.blockers,
+      ...blockerIds.map((id) => ({
+        id,
+        domain,
+        status: "open"
+      }))
+    ]
+  };
+  await writeReviewLedger(projectRoot, taskId, updated);
+  return updated;
+}
+async function remediateReviewBlockers(projectRoot, taskId, resolvedIds) {
+  const ledger = await requireReviewLedger(projectRoot, taskId);
+  if (ledger.remediationRounds >= 1) {
+    throw new Error("review allows only one remediation round");
+  }
+  if (resolvedIds.length === 0) {
+    throw new Error("review remediation requires resolved blocker ids");
+  }
+  const uniqueIds = new Set(resolvedIds);
+  if (uniqueIds.size !== resolvedIds.length) {
+    throw new Error("resolved review blocker ids must be unique");
+  }
+  for (const id of resolvedIds) {
+    const blocker = ledger.blockers.find((item) => item.id === id);
+    if (!blocker || blocker.status !== "open") {
+      throw new Error(`review blocker is not open: ${id}`);
+    }
+  }
+  const updated = {
+    ...ledger,
+    remediationRounds: ledger.remediationRounds + 1,
+    blockers: ledger.blockers.map(
+      (blocker) => uniqueIds.has(blocker.id) ? { ...blocker, status: "resolved" } : blocker
+    )
+  };
+  await writeReviewLedger(projectRoot, taskId, updated);
+  return updated;
+}
+async function reviewCanComplete(projectRoot, taskId) {
+  const ledger = await readReviewLedger(projectRoot, taskId);
+  if (!ledger) return false;
+  return ledger.requiredDomains.every(
+    (domain) => ledger.completedDomains.includes(domain)
+  ) && ledger.blockers.every((blocker) => blocker.status === "resolved");
+}
+async function readReviewLedger(projectRoot, taskId) {
+  if (!TASK_ID_PATTERN.test(taskId)) return null;
+  try {
+    const raw = await readFile9(reviewPath(projectRoot, taskId), "utf-8");
+    const value = JSON.parse(raw);
+    return isReviewLedger(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function isReviewLedger(value) {
+  if (!isRecord7(value)) return false;
+  if (value.version !== "1.0" || !isReviewDepth(value.depth) || !isDomainArray(value.requiredDomains) || !isDomainArray(value.completedDomains) || !isRecord7(value.reports) || !Array.isArray(value.blockers) || value.remediationRounds !== 0 && value.remediationRounds !== 1) {
+    return false;
+  }
+  const requiredDomains = value.requiredDomains;
+  const completedDomains = value.completedDomains;
+  const reports = value.reports;
+  const blockers = value.blockers;
+  const expectedDomains = value.depth === "full" ? ["quality", "security"] : requiredDomains;
+  if (value.depth === "targeted" && requiredDomains.length !== 1 || requiredDomains.length !== expectedDomains.length || !expectedDomains.every((domain) => requiredDomains.includes(domain)) || new Set(completedDomains).size !== completedDomains.length || completedDomains.some((domain) => !requiredDomains.includes(domain)) || completedDomains.some((domain) => {
+    const report = reports[domain];
+    return typeof report !== "string" || !isSafeReportPath(report);
+  })) {
+    return false;
+  }
+  const blockerIds = /* @__PURE__ */ new Set();
+  return blockers.every(
+    (blocker) => isRecord7(blocker) && typeof blocker.id === "string" && BLOCKER_ID_PATTERN.test(blocker.id) && !blockerIds.has(blocker.id) && blockerIds.add(blocker.id) && isReviewDomain(blocker.domain) && completedDomains.includes(blocker.domain) && (blocker.status === "open" || blocker.status === "resolved")
+  );
+}
+function isDomainArray(value) {
+  return Array.isArray(value) && value.every(isReviewDomain);
+}
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function requireReviewLedger(projectRoot, taskId) {
+  assertValidTaskId(taskId);
+  const ledger = await readReviewLedger(projectRoot, taskId);
+  if (!ledger) throw new Error(`review not initialized: ${taskId}`);
+  return ledger;
+}
+async function writeReviewLedger(projectRoot, taskId, ledger) {
+  const dir = path20.join(projectRoot, ".mancode", "workflows", taskId);
+  await mkdir8(dir, { recursive: true });
+  await writeFile10(
+    path20.join(dir, REVIEW_FILE),
+    `${JSON.stringify(ledger, null, 2)}
+`,
+    "utf-8"
+  );
+}
+function reviewPath(projectRoot, taskId) {
+  return path20.join(projectRoot, ".mancode", "workflows", taskId, REVIEW_FILE);
+}
+function assertValidTaskId(taskId) {
+  if (!TASK_ID_PATTERN.test(taskId)) {
+    throw new Error(`invalid workflow taskId: ${taskId}`);
+  }
+}
+function assertSafeReportPath(report) {
+  if (!isSafeReportPath(report)) {
+    throw new Error(`invalid review report path: ${report}`);
+  }
+}
+async function assertReportExists(projectRoot, taskId, report) {
+  const reportPath = path20.join(
+    projectRoot,
+    ".mancode",
+    "workflows",
+    taskId,
+    report
+  );
+  try {
+    if ((await stat3(reportPath)).isFile()) return;
+  } catch {
+  }
+  throw new Error(`review report not found: ${report}`);
+}
+function isSafeReportPath(report) {
+  const normalized = path20.posix.normalize(report.replaceAll("\\", "/"));
+  return Boolean(
+    report.trim() && !path20.isAbsolute(report) && normalized !== ".." && !normalized.startsWith("../") && normalized.endsWith(".md")
+  );
+}
+
+// src/system/workflow.ts
 var METADATA_FILE = "metadata.json";
 var SLUG_MAX = 30;
-var TASK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+var TASK_ID_PATTERN2 = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
 function isValidWorkflowTaskId(taskId) {
-  return TASK_ID_PATTERN.test(taskId);
+  return TASK_ID_PATTERN2.test(taskId);
 }
 function generateTaskId(task, now = /* @__PURE__ */ new Date()) {
   const slug = slugify(task).slice(0, SLUG_MAX) || "task";
@@ -5748,7 +5939,7 @@ function slugify(text) {
 }
 async function createWorkflow(projectRoot, task, mode, options = {}) {
   await validateParentTask(projectRoot, mode, options.parentTaskId, true);
-  await mkdir8(workflowsRoot(projectRoot), { recursive: true });
+  await mkdir9(workflowsRoot(projectRoot), { recursive: true });
   const taskId = await allocateTaskId(projectRoot, generateTaskId(task));
   const dir = workflowDir(projectRoot, taskId);
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -5762,7 +5953,7 @@ async function createWorkflow(projectRoot, task, mode, options = {}) {
     updatedAt: now,
     status: "in_progress",
     ...options.parentTaskId ? { parentTaskId: options.parentTaskId } : {},
-    ...mode === "man" || mode === "manteam" ? { planVersion: 1 } : {}
+    ...mode === "man" || mode === "manteam" ? { planVersion: 1, reviewPolicyVersion: 1 } : {}
   };
   await writeMetadata(dir, meta);
   return meta;
@@ -5771,7 +5962,7 @@ async function allocateTaskId(projectRoot, baseTaskId) {
   for (let attempt = 0; attempt < 1e3; attempt++) {
     const taskId = attempt === 0 ? baseTaskId : `${baseTaskId}-${attempt + 1}`;
     try {
-      await mkdir8(workflowDir(projectRoot, taskId));
+      await mkdir9(workflowDir(projectRoot, taskId));
       return taskId;
     } catch (err) {
       if (isNodeError6(err) && err.code === "EEXIST") {
@@ -5786,14 +5977,14 @@ async function readWorkflow(projectRoot, taskId) {
   if (!isValidWorkflowTaskId(taskId)) return null;
   const file = metadataPath(projectRoot, taskId);
   try {
-    const raw = await readFile9(file, "utf-8");
+    const raw = await readFile10(file, "utf-8");
     return parseWorkflowMeta(raw, taskId);
   } catch {
     return null;
   }
 }
 async function updateWorkflow(projectRoot, taskId, patch) {
-  assertValidTaskId(taskId);
+  assertValidTaskId2(taskId);
   const existing = await readWorkflow(projectRoot, taskId);
   if (!existing) {
     throw new Error(`workflow not found: ${taskId}`);
@@ -5838,7 +6029,7 @@ async function deleteWorkflow(projectRoot, taskId) {
   if (!isValidWorkflowTaskId(taskId)) return false;
   const dir = workflowDir(projectRoot, taskId);
   try {
-    await stat3(dir);
+    await stat4(dir);
   } catch {
     return false;
   }
@@ -5850,19 +6041,19 @@ async function deleteWorkflow(projectRoot, taskId) {
   return true;
 }
 function workflowsRoot(projectRoot) {
-  return path20.join(projectRoot, ".mancode", "workflows");
+  return path21.join(projectRoot, ".mancode", "workflows");
 }
 function workflowDir(projectRoot, taskId) {
-  assertValidTaskId(taskId);
-  return path20.join(workflowsRoot(projectRoot), taskId);
+  assertValidTaskId2(taskId);
+  return path21.join(workflowsRoot(projectRoot), taskId);
 }
 function metadataPath(projectRoot, taskId) {
-  return path20.join(workflowDir(projectRoot, taskId), METADATA_FILE);
+  return path21.join(workflowDir(projectRoot, taskId), METADATA_FILE);
 }
 async function writeMetadata(dir, meta) {
   const content = `${JSON.stringify(meta, null, 2)}
 `;
-  await writeFile10(path20.join(dir, METADATA_FILE), content, "utf-8");
+  await writeFile11(path21.join(dir, METADATA_FILE), content, "utf-8");
 }
 function parseWorkflowMeta(raw, taskId) {
   try {
@@ -5912,6 +6103,9 @@ async function validateWorkflowMeta(projectRoot, updated, existing) {
   if (updated.parentTaskId !== existing.parentTaskId) {
     throw new Error("workflow parent task cannot be changed");
   }
+  if (updated.reviewPolicyVersion !== existing.reviewPolicyVersion) {
+    throw new Error("workflow review policy version cannot be changed");
+  }
   if (!Number.isInteger(updated.currentStep) || updated.currentStep < 1 || updated.currentStep > maxWorkflowStep(updated.mode)) {
     throw new Error(`invalid workflow step: ${updated.currentStep}`);
   }
@@ -5962,6 +6156,12 @@ async function validateWorkflowMeta(projectRoot, updated, existing) {
   if (updated.mode === "mamba" && updated.planVersion !== void 0) {
     throw new Error("mamba workflows cannot have a plan version");
   }
+  if (updated.reviewPolicyVersion !== void 0 && updated.reviewPolicyVersion !== 1) {
+    throw new Error("invalid workflow review policy version");
+  }
+  if (updated.mode === "mamba" && updated.reviewPolicyVersion !== void 0) {
+    throw new Error("mamba workflows cannot have a review policy version");
+  }
   if (updated.planVersion !== void 0 && (!Number.isInteger(updated.planVersion) || updated.planVersion < 1)) {
     throw new Error("workflow plan version must be a positive integer");
   }
@@ -5975,6 +6175,9 @@ async function validateWorkflowMeta(projectRoot, updated, existing) {
   if ((isTerminalWorkflowStatus(updated.status) || updated.status === "planned") && (await listActiveMambaChildren(projectRoot, updated.taskId)).length > 0) {
     throw new Error("cannot finish workflow with an active mamba child");
   }
+  if (updated.status === "completed" && updated.reviewPolicyVersion === 1 && !reviewWasExplicitlySkipped(updated) && !await reviewCanComplete(projectRoot, updated.taskId)) {
+    throw new Error("workflow review is incomplete or still has open blockers");
+  }
 }
 function canTransition(from, to) {
   if (from === to) return true;
@@ -6002,13 +6205,16 @@ function isWorkflowShape(obj) {
     return false;
   if (obj.planVersion !== void 0 && (!Number.isInteger(obj.planVersion) || obj.planVersion < 1))
     return false;
+  if (obj.reviewPolicyVersion !== void 0 && obj.reviewPolicyVersion !== 1)
+    return false;
   if (status2 === "blocked") {
     if (!obj.blockingReason?.trim()) return false;
   } else if (obj.blockingReason !== void 0) {
     return false;
   }
   if (mode === "mamba") {
-    if (status2 === "planned" || obj.planVersion !== void 0) return false;
+    if (status2 === "planned" || obj.planVersion !== void 0 || obj.reviewPolicyVersion !== void 0)
+      return false;
     if (obj.parentTaskId !== void 0 && !isValidWorkflowTaskId(obj.parentTaskId))
       return false;
     if (obj.outcome !== void 0 && status2 !== "completed") return false;
@@ -6018,6 +6224,9 @@ function isWorkflowShape(obj) {
   }
   return true;
 }
+function reviewWasExplicitlySkipped(meta) {
+  return meta.skippedSteps.includes("review") || meta.skippedSteps.includes("film-1") && meta.skippedSteps.includes("film-2");
+}
 async function listActiveMambaChildren(projectRoot, parentTaskId) {
   return (await listMambaChildren(projectRoot, parentTaskId)).filter(
     (workflow2) => workflow2.status === "in_progress" || workflow2.status === "blocked"
@@ -6053,7 +6262,7 @@ async function propagateChildStatus(projectRoot, child) {
 function isNodeError6(err) {
   return err instanceof Error && "code" in err;
 }
-function assertValidTaskId(taskId) {
+function assertValidTaskId2(taskId) {
   if (!isValidWorkflowTaskId(taskId)) {
     throw new Error(`invalid workflow taskId: ${taskId}`);
   }
@@ -6064,8 +6273,8 @@ var HOOK_ESTIMATE_TIMEOUT_MS = 2e3;
 var EXIT_OK6 = 0;
 var EXIT_NOT_INITIALIZED4 = 1;
 var EXIT_CORRUPT_STATE = 2;
-async function status(rootDir = process7.cwd(), options = {}) {
-  const stateFile = path21.join(rootDir, ".mancode", "state.json");
+async function status(rootDir = process8.cwd(), options = {}) {
+  const stateFile = path22.join(rootDir, ".mancode", "state.json");
   if (!await pathExists9(stateFile)) {
     console.error("\u2717  mancode not initialized.");
     console.error("   Run `mancode init` to get started.");
@@ -6164,19 +6373,19 @@ async function getCurrentWorkflow(rootDir, taskId) {
 }
 async function getProjectName(rootDir) {
   try {
-    const raw = await fs7.readFile(path21.join(rootDir, "package.json"), "utf-8");
+    const raw = await fs7.readFile(path22.join(rootDir, "package.json"), "utf-8");
     const pkg = JSON.parse(raw);
     if (pkg.name && typeof pkg.name === "string") {
       return pkg.name;
     }
   } catch {
   }
-  return path21.basename(rootDir);
+  return path22.basename(rootDir);
 }
 async function readConfig2(rootDir) {
   try {
     const raw = await fs7.readFile(
-      path21.join(rootDir, ".mancode", "config.json"),
+      path22.join(rootDir, ".mancode", "config.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -6203,9 +6412,9 @@ function getEffectiveTeamStatus(state, config, detected) {
 }
 async function checkHooks(rootDir) {
   const [sessionStart, userPromptSubmit, registered] = await Promise.all([
-    pathExists9(path21.join(rootDir, ".mancode", "hooks", "session-start.sh")),
+    pathExists9(path22.join(rootDir, ".mancode", "hooks", "session-start.mjs")),
     pathExists9(
-      path21.join(rootDir, ".mancode", "hooks", "user-prompt-submit.sh")
+      path22.join(rootDir, ".mancode", "hooks", "user-prompt-submit.mjs")
     ),
     isRegistered(rootDir)
   ]);
@@ -6214,7 +6423,7 @@ async function checkHooks(rootDir) {
 async function isRegistered(rootDir) {
   try {
     const raw = await fs7.readFile(
-      path21.join(rootDir, ".claude", "settings.json"),
+      path22.join(rootDir, ".claude", "settings.json"),
       "utf-8"
     );
     const settings = JSON.parse(raw);
@@ -6224,30 +6433,30 @@ async function isRegistered(rootDir) {
   }
 }
 function hooksRegistered2(settings) {
-  if (!isRecord7(settings)) return false;
+  if (!isRecord8(settings)) return false;
   const hooks = settings.hooks;
-  if (!isRecord7(hooks)) return false;
-  return hasHookCommand2(hooks.SessionStart, ".mancode/hooks/session-start.sh") && hasHookCommand2(
+  if (!isRecord8(hooks)) return false;
+  return hasHookCommand2(hooks.SessionStart, ".mancode/hooks/session-start.mjs") && hasHookCommand2(
     hooks.UserPromptSubmit,
-    ".mancode/hooks/user-prompt-submit.sh"
+    ".mancode/hooks/user-prompt-submit.mjs"
   );
 }
 function hasHookCommand2(value, needle) {
   if (!Array.isArray(value)) return false;
   return value.some((group) => {
-    if (!isRecord7(group) || !Array.isArray(group.hooks)) return false;
+    if (!isRecord8(group) || !Array.isArray(group.hooks)) return false;
     return group.hooks.some((hook) => {
-      if (!isRecord7(hook) || typeof hook.command !== "string") return false;
+      if (!isRecord8(hook) || typeof hook.command !== "string") return false;
       return hook.command.includes(needle);
     });
   });
 }
 async function estimateHookInjection(rootDir) {
-  const hookPath = path21.join(
+  const hookPath = path22.join(
     rootDir,
     ".mancode",
     "hooks",
-    "user-prompt-submit.sh"
+    "user-prompt-submit.mjs"
   );
   if (!await pathExists9(hookPath)) {
     return { tokens: 0, cap: 800 };
@@ -6264,7 +6473,7 @@ async function estimateHookInjection(rootDir) {
 }
 function runHookEstimate(rootDir, hookPath) {
   return new Promise((resolve, reject) => {
-    const child = spawn("bash", [hookPath], {
+    const child = spawn(process8.execPath, [hookPath], {
       cwd: rootDir,
       stdio: ["pipe", "pipe", "ignore"]
     });
@@ -6348,9 +6557,9 @@ function printText(r) {
   console.log("");
   if (r.platforms.includes("claude-code")) {
     console.log("Hooks:");
-    console.log(`  ${r.hooks.sessionStart ? "\u2713" : "\u2717"} session-start.sh`);
+    console.log(`  ${r.hooks.sessionStart ? "\u2713" : "\u2717"} session-start.mjs`);
     console.log(
-      `  ${r.hooks.userPromptSubmit ? "\u2713" : "\u2717"} user-prompt-submit.sh`
+      `  ${r.hooks.userPromptSubmit ? "\u2713" : "\u2717"} user-prompt-submit.mjs`
     );
     console.log(
       `  ${r.hooks.registered ? "\u2713" : "\u2717"} registered in .claude/settings.json`
@@ -6369,7 +6578,7 @@ function formatTeamStatus(team) {
 function workflowStepMax(mode) {
   return maxWorkflowStep(mode);
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null;
 }
 async function pathExists9(p) {
@@ -6382,14 +6591,14 @@ async function pathExists9(p) {
 }
 
 // src/commands/uninstall.ts
-import { access as access4, readFile as readFile10, rm as rm5, writeFile as writeFile11 } from "fs/promises";
-import path22 from "path";
-import process8 from "process";
+import { access as access5, readFile as readFile11, rm as rm5, writeFile as writeFile12 } from "fs/promises";
+import path23 from "path";
+import process9 from "process";
 var EXIT_OK7 = 0;
 var EXIT_NOT_INITIALIZED5 = 1;
 var EXIT_UNSUPPORTED_PLATFORM2 = 2;
-async function uninstall(rootDir = process8.cwd(), platform, options = {}) {
-  const stateFile = path22.join(rootDir, ".mancode", "state.json");
+async function uninstall(rootDir = process9.cwd(), platform, options = {}) {
+  const stateFile = path23.join(rootDir, ".mancode", "state.json");
   if (!await pathExists10(stateFile)) {
     console.error("\u2717  mancode not initialized.");
     console.error("   Run `mancode init` first.");
@@ -6441,7 +6650,7 @@ async function uninstallAll(rootDir) {
     await uninstallPlatform(rootDir, p);
   }
   console.log("\u2713  Removing .mancode/ directory...");
-  await rm5(path22.join(rootDir, ".mancode"), {
+  await rm5(path23.join(rootDir, ".mancode"), {
     recursive: true,
     force: true
   });
@@ -6451,10 +6660,10 @@ async function uninstallClaudeCode(rootDir) {
   await cleanClaudeSettings(rootDir);
 }
 async function cleanClaudeSettings(rootDir) {
-  const settingsPath = path22.join(rootDir, ".claude", "settings.json");
+  const settingsPath = path23.join(rootDir, ".claude", "settings.json");
   let content;
   try {
-    content = await readFile10(settingsPath, "utf-8");
+    content = await readFile11(settingsPath, "utf-8");
   } catch {
     return;
   }
@@ -6465,14 +6674,14 @@ async function cleanClaudeSettings(rootDir) {
     return;
   }
   const cleanedHooks = {};
-  if (isRecord8(settings.hooks)) {
+  if (isRecord9(settings.hooks)) {
     for (const [event, value] of Object.entries(settings.hooks)) {
       const cleaned = cleanClaudeHookValue(value);
       if (cleaned !== void 0) cleanedHooks[event] = cleaned;
     }
     settings.hooks = Object.keys(cleanedHooks).length > 0 ? cleanedHooks : void 0;
   }
-  if (isRecord8(settings.skills)) {
+  if (isRecord9(settings.skills)) {
     const retainedSkills = Object.fromEntries(
       Object.entries(settings.skills).filter(
         ([name, value]) => LEGACY_CLAUDE_SKILL_SETTINGS[name] !== value
@@ -6480,7 +6689,7 @@ async function cleanClaudeSettings(rootDir) {
     );
     settings.skills = Object.keys(retainedSkills).length > 0 ? retainedSkills : void 0;
   }
-  await writeFile11(
+  await writeFile12(
     settingsPath,
     `${JSON.stringify(settings, null, 2)}
 `,
@@ -6492,7 +6701,7 @@ function cleanClaudeHookValue(value) {
     const entries2 = value.flatMap(cleanClaudeHookEntry);
     return entries2.length > 0 ? entries2 : void 0;
   }
-  if (!isRecord8(value)) return value;
+  if (!isRecord9(value)) return value;
   if (Array.isArray(value.hooks) || typeof value.command === "string") {
     const entries2 = cleanClaudeHookEntry(value);
     return entries2.length > 0 ? entries2 : void 0;
@@ -6506,7 +6715,7 @@ function cleanClaudeHookValue(value) {
 }
 function cleanClaudeHookEntry(entry) {
   if (Array.isArray(entry)) return entry.flatMap(cleanClaudeHookEntry);
-  if (!isRecord8(entry)) return [entry];
+  if (!isRecord9(entry)) return [entry];
   if (Array.isArray(entry.hooks)) {
     const hooks = entry.hooks.filter((hook) => !isMancodeHookEntry(hook));
     return hooks.length > 0 ? [{ ...entry, hooks }] : [];
@@ -6514,11 +6723,11 @@ function cleanClaudeHookEntry(entry) {
   return isMancodeHookEntry(entry) ? [] : [entry];
 }
 function isMancodeHookEntry(value) {
-  return isRecord8(value) && typeof value.command === "string" && isGeneratedMancodeHookCommand(value.command);
+  return isRecord9(value) && typeof value.command === "string" && isGeneratedMancodeHookCommand(value.command);
 }
 function containsLegacyMancodeHookPath2(value) {
   if (Array.isArray(value)) return value.some(containsLegacyMancodeHookPath2);
-  if (!isRecord8(value)) return false;
+  if (!isRecord9(value)) return false;
   if (typeof value.command === "string" && value.command.includes(".mancode/hooks/")) {
     return true;
   }
@@ -6529,12 +6738,12 @@ async function uninstallCursor(rootDir) {
   await removeCursorCommands(rootDir);
 }
 async function uninstallCodex(rootDir) {
-  const agentsPath = path22.join(rootDir, "AGENTS.md");
+  const agentsPath = path23.join(rootDir, "AGENTS.md");
   try {
-    const content = await readFile10(agentsPath, "utf-8");
+    const content = await readFile11(agentsPath, "utf-8");
     const cleaned = removeManagedBlock(content);
     if (cleaned.trim()) {
-      await writeFile11(agentsPath, `${cleaned}
+      await writeFile12(agentsPath, `${cleaned}
 `, "utf-8");
     } else {
       await rm5(agentsPath, { force: true });
@@ -6544,16 +6753,16 @@ async function uninstallCodex(rootDir) {
   await removeCodexSkills(rootDir);
 }
 async function uninstallCopilot(rootDir) {
-  const instructionsPath = path22.join(
+  const instructionsPath = path23.join(
     rootDir,
     ".github",
     "copilot-instructions.md"
   );
   try {
-    const content = await readFile10(instructionsPath, "utf-8");
+    const content = await readFile11(instructionsPath, "utf-8");
     const cleaned = removeManagedBlock(content);
     if (cleaned.trim()) {
-      await writeFile11(instructionsPath, `${cleaned}
+      await writeFile12(instructionsPath, `${cleaned}
 `, "utf-8");
     } else {
       await rm5(instructionsPath, { force: true });
@@ -6563,16 +6772,16 @@ async function uninstallCopilot(rootDir) {
   await removeCopilotPrompts(rootDir);
 }
 async function uninstallZcode(rootDir) {
-  const agentsPath = path22.join(rootDir, "AGENTS.md");
+  const agentsPath = path23.join(rootDir, "AGENTS.md");
   try {
-    const content = await readFile10(agentsPath, "utf-8");
+    const content = await readFile11(agentsPath, "utf-8");
     const cleaned = removeManagedBlock(
       content,
       ZCODE_MANCODE_START_MARKER,
       ZCODE_MANCODE_END_MARKER
     );
     if (cleaned.trim()) {
-      await writeFile11(agentsPath, `${cleaned}
+      await writeFile12(agentsPath, `${cleaned}
 `, "utf-8");
     } else {
       await rm5(agentsPath, { force: true });
@@ -6582,13 +6791,13 @@ async function uninstallZcode(rootDir) {
   await removeZcodeSkills(rootDir);
 }
 async function removeFromConfig(rootDir, platform) {
-  const configPath = path22.join(rootDir, ".mancode", "config.json");
+  const configPath = path23.join(rootDir, ".mancode", "config.json");
   try {
-    const raw = await readFile10(configPath, "utf-8");
+    const raw = await readFile11(configPath, "utf-8");
     const config = JSON.parse(raw);
     if (Array.isArray(config.platforms)) {
       config.platforms = config.platforms.filter((p) => p !== platform);
-      if (isRecord8(config.platformOptions)) {
+      if (isRecord9(config.platformOptions)) {
         const platformOptions = Object.fromEntries(
           Object.entries(config.platformOptions).filter(
             ([name]) => name !== platform
@@ -6596,7 +6805,7 @@ async function removeFromConfig(rootDir, platform) {
         );
         config.platformOptions = Object.keys(platformOptions).length > 0 ? platformOptions : void 0;
       }
-      await writeFile11(
+      await writeFile12(
         configPath,
         `${JSON.stringify(config, null, 2)}
 `,
@@ -6606,12 +6815,12 @@ async function removeFromConfig(rootDir, platform) {
   } catch {
   }
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function pathExists10(p) {
   try {
-    await access4(p);
+    await access5(p);
     return true;
   } catch {
     return false;
@@ -6619,23 +6828,23 @@ async function pathExists10(p) {
 }
 
 // src/commands/version.ts
-import process9 from "process";
+import process10 from "process";
 function version() {
-  const nodeVersion = process9.version;
-  const platform = `${process9.platform}/${process9.arch}`;
+  const nodeVersion = process10.version;
+  const platform = `${process10.platform}/${process10.arch}`;
   console.log(`mancode/${VERSION}`);
   console.log(`node/${nodeVersion.replace("v", "")}`);
   console.log(platform);
 }
 
 // src/commands/workflow.ts
-import { access as access5 } from "fs/promises";
-import path23 from "path";
+import { access as access6 } from "fs/promises";
+import path24 from "path";
 var EXIT_OK8 = 0;
 var EXIT_NOT_INITIALIZED6 = 1;
 var EXIT_INVALID_ARG2 = 2;
 async function workflow(rootDir, subcommand, args = [], options = {}) {
-  if (!await pathExists11(path23.join(rootDir, ".mancode", "state.json"))) {
+  if (!await pathExists11(path24.join(rootDir, ".mancode", "state.json"))) {
     if (options.json) {
       console.log(JSON.stringify({ error: "not initialized" }, null, 2));
     } else {
@@ -6653,6 +6862,8 @@ async function workflow(rootDir, subcommand, args = [], options = {}) {
       return workflowList(rootDir, options);
     case "show":
       return workflowShow(rootDir, args[0], options);
+    case "review":
+      return workflowReview(rootDir, args, options);
     case "clean":
       return workflowClean(rootDir, options);
     default:
@@ -6667,12 +6878,109 @@ async function workflow(rootDir, subcommand, args = [], options = {}) {
       } else {
         console.error(`\u2717  Invalid workflow subcommand: ${subcommand}`);
         console.error(
-          "   Use: create <man|mamba|manteam> <task> | update <taskId> | list | show <taskId> | clean"
+          "   Use: create <man|mamba|manteam> <task> | update <taskId> | review <taskId> <init|complete|remediate|show> | list | show <taskId> | clean"
         );
       }
       return EXIT_INVALID_ARG2;
   }
 }
+async function workflowReview(rootDir, args, options) {
+  const taskId = args[0];
+  const action = args[1];
+  if (!taskId || !isValidWorkflowTaskId(taskId)) {
+    return invalidArg(options, `invalid taskId: ${taskId ?? ""}`);
+  }
+  const meta = await readWorkflow(rootDir, taskId);
+  if (!meta) return invalidArg(options, `workflow not found: ${taskId}`);
+  if (meta.mode !== "man" && meta.mode !== "manteam") {
+    return invalidArg(options, "review is only valid for man or manteam");
+  }
+  if (action === "show") {
+    const ledger = await readReviewLedger(rootDir, taskId);
+    if (!ledger)
+      return invalidArg(options, `review not initialized: ${taskId}`);
+    outputReviewLedger(ledger, options);
+    return EXIT_OK8;
+  }
+  if (meta.status !== "in_progress" || meta.currentStep < 6) {
+    return invalidArg(
+      options,
+      "review requires an in_progress workflow at step 6 or later"
+    );
+  }
+  try {
+    let ledger;
+    if (action === "init") {
+      if (!isReviewDepth(options.reviewDepth)) {
+        return invalidArg(
+          options,
+          `invalid --review-depth: ${options.reviewDepth ?? ""}`
+        );
+      }
+      if (options.reviewDomain !== void 0 && !isReviewDomain(options.reviewDomain)) {
+        return invalidArg(
+          options,
+          `invalid --review-domain: ${options.reviewDomain}`
+        );
+      }
+      ledger = await initializeReview(
+        rootDir,
+        taskId,
+        options.reviewDepth,
+        isReviewDomain(options.reviewDomain) ? options.reviewDomain : void 0
+      );
+    } else if (action === "complete") {
+      if (!isReviewDomain(options.reviewDomain) || !options.report) {
+        return invalidArg(
+          options,
+          "review complete requires --review-domain and --report"
+        );
+      }
+      ledger = await completeReviewDomain(
+        rootDir,
+        taskId,
+        options.reviewDomain,
+        options.report,
+        parseCsv(options.blockers)
+      );
+    } else if (action === "remediate") {
+      ledger = await remediateReviewBlockers(
+        rootDir,
+        taskId,
+        parseCsv(options.resolved)
+      );
+    } else {
+      return invalidArg(
+        options,
+        `invalid review action: ${action ?? ""}`,
+        "Use: mancode workflow review <taskId> <init|complete|remediate|show>"
+      );
+    }
+    outputReviewLedger(ledger, options);
+    return EXIT_OK8;
+  } catch (error) {
+    return invalidArg(
+      options,
+      error instanceof Error ? error.message : "unable to update review"
+    );
+  }
+}
+function outputReviewLedger(ledger, options) {
+  if (options.json) {
+    console.log(JSON.stringify(ledger, null, 2));
+    return;
+  }
+  if (!ledger) return;
+  const openBlockers = ledger.blockers.filter(
+    (blocker) => blocker.status === "open"
+  );
+  console.log(
+    `Review: ${ledger.depth}; domains ${ledger.completedDomains.length}/${ledger.requiredDomains.length}; open blockers ${openBlockers.length}; remediation ${ledger.remediationRounds}/1`
+  );
+}
+function parseCsv(value) {
+  return (value ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+}
 async function workflowCreate(rootDir, args, options) {
   const mode = args[0];
   const task = args.slice(1).join(" ").trim();
@@ -7017,7 +7325,7 @@ function ago(iso) {
 }
 async function pathExists11(p) {
   try {
-    await access5(p);
+    await access6(p);
     return true;
   } catch {
     return false;
@@ -7057,7 +7365,13 @@ program.command("uninstall [platform]").description("Remove platform adapter or
 program.command("workflow <subcommand> [args...]").description("Manage mancode workflows").option("--dry-run", "Preview clean without deleting").option("--older-than <duration>", "Clean workflows older than (e.g. 30d)").option("--step <n>", "Update workflow current step").option("--status <status>", "Update workflow status").option(
   "--parent-task <taskId>",
   "Parent /man or /manteam workflow for mamba"
-).option("--blocking-reason <reason>", "Explain why a workflow is blocked").option("--outcome <outcome>", "Set mamba outcome").option("--plan-version <n>", "Set the next man/manteam plan revision").option("--skipped <steps>", "Update skipped steps as comma-separated values").option("--json", "Output as JSON (for scripts)").action(async (subcommand, args, options) => {
+).option("--blocking-reason <reason>", "Explain why a workflow is blocked").option("--outcome <outcome>", "Set mamba outcome").option("--plan-version <n>", "Set the next man/manteam plan revision").option("--skipped <steps>", "Update skipped steps as comma-separated values").option("--review-depth <depth>", "Review depth: targeted or full").option("--review-domain <domain>", "Review domain: quality or security").option(
+  "--report <path>",
+  "Relative Markdown report path for a review domain"
+).option("--blockers <ids>", "Comma-separated blocker ids found by a review").option(
+  "--resolved <ids>",
+  "Comma-separated blocker ids resolved in remediation"
+).option("--json", "Output as JSON (for scripts)").action(async (subcommand, args, options) => {
   const code = await workflow(process.cwd(), subcommand, args ?? [], options);
   process.exitCode = code;
 });