mason-context 0.11.0 → 0.12.0

package/dist/mason-auto.js

@@ -0,0 +1,2283 @@
+#!/usr/bin/env node
+
+// src/automation/cli.ts
+import { parseArgs } from "util";
+
+// src/automation/runtime.ts
+import { randomUUID as randomUUID3 } from "crypto";
+
+// src/audit/repair.ts
+import fs10 from "fs/promises";
+import path16 from "path";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { z as z3 } from "zod";
+
+// src/audit/audit.ts
+import fs9 from "fs/promises";
+import path15 from "path";
+
+// src/drift/drift.ts
+import fs3 from "fs/promises";
+import path6 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+
+// src/snapshot/snapshot.ts
+import path5 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+
+// src/utils/files.ts
+import fs from "fs/promises";
+import { constants } from "fs";
+import path2 from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import fg from "fast-glob";
+
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+}
+
+// src/utils/files.ts
+var exec = promisify(execFile);
+var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+var SOURCE_IGNORE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.gradle/**",
+  "**/target/**",
+  "**/.git/**",
+  "**/.mason/**",
+  "**/vendor/**",
+  "**/__pycache__/**",
+  "**/venv/**",
+  "**/.venv/**",
+  "**/*.min.*",
+  "**/*.map",
+  "**/*.lock",
+  "**/generated/**",
+  "**/*.generated.*",
+  "**/R.java",
+  "**/BuildConfig.java",
+  "**/package-lock.json",
+  "**/yarn.lock",
+  "**/pnpm-lock.yaml"
+];
+var MAX_SOURCE_BYTES = 1024 * 1024;
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function writeStoreJson(root, relative, value) {
+  const payload = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
+    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
+  }
+  const file = await storePath(root, relative, true);
+  const temporary = path3.join(path3.dirname(file), `.${path3.basename(file)}.${randomUUID()}.tmp`);
+  try {
+    const handle = await fs2.open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(payload, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fs2.rename(temporary, file);
+  } finally {
+    await fs2.rm(temporary, { force: true });
+  }
+}
+
+// src/snapshot/snapshot.ts
+import { z } from "zod";
+
+// src/test-map.ts
+import path4 from "path";
+
+// src/snapshot/snapshot.ts
+var exec2 = promisify2(execFile2);
+var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var verificationFields = {
+  refreshedHash: z.string().optional(),
+  verifiedAt: z.string().optional(),
+  verifiedHash: z.string().optional(),
+  verificationFailed: z.boolean().optional(),
+  verificationNote: z.string().optional()
+};
+var featureSchema = z.object({
+  description: z.string(),
+  files: z.array(repoPath),
+  tests: z.array(repoPath).optional(),
+  type: z.enum(["capability", "infrastructure"]).optional(),
+  ...verificationFields
+}).passthrough();
+var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
+var snapshotSchema = z.object({
+  version: z.literal(2),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  gitHash: z.string(),
+  features: z.record(featureSchema),
+  flows: z.record(flowSchema)
+}).passthrough();
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
+
+// src/drift/drift.ts
+var exec3 = promisify3(execFile3);
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  try {
+    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
+  } catch {
+    return null;
+  }
+}
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
+}
+
+// src/audit/docs.ts
+import fs4 from "fs/promises";
+import path7 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+
+// src/audit/tree.ts
+var MIN_GLYPH_LINES = 3;
+var GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
+function glyphIndex(line) {
+  for (const glyph of GLYPHS) {
+    const idx = line.indexOf(glyph);
+    if (idx !== -1) return idx;
+  }
+  return -1;
+}
+function isSpacerLine(line) {
+  return /^[\s│|]*$/.test(line);
+}
+function entryName(afterGlyph) {
+  let name = afterGlyph.replace(/^\s+/, "");
+  const hash2 = name.search(/\s+#/);
+  if (hash2 !== -1) name = name.slice(0, hash2);
+  const columns = name.search(/\s{2,}/);
+  if (columns !== -1) name = name.slice(0, columns);
+  name = name.trim();
+  if (!name || /\s/.test(name)) return null;
+  return name;
+}
+function extractTreeClaims(blockLines, blockStartLine) {
+  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
+  if (glyphLines < MIN_GLYPH_LINES) return [];
+  const claims = [];
+  const stack = [];
+  let rootPrefix = "";
+  let started = false;
+  for (let i = 0; i < blockLines.length; i++) {
+    const line = blockLines[i];
+    const col = glyphIndex(line);
+    if (col === -1) {
+      if (isSpacerLine(line)) continue;
+      if (!started) {
+        const candidate = line.trim();
+        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
+          rootPrefix = candidate.replace(/\/+$/, "");
+          claims.push({
+            path: rootPrefix,
+            line: blockStartLine + i,
+            excerpt: candidate
+          });
+        }
+        continue;
+      }
+      return claims;
+    }
+    started = true;
+    const name = entryName(line.slice(col + GLYPHS[0].length));
+    if (name === null) return claims;
+    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
+      stack.pop();
+    }
+    const isDir = name.endsWith("/");
+    const cleanName = name.replace(/\/+$/, "");
+    const segments = [
+      ...rootPrefix ? [rootPrefix] : [],
+      ...stack.map((s) => s.name),
+      cleanName
+    ];
+    claims.push({
+      path: segments.join("/"),
+      line: blockStartLine + i,
+      excerpt: name
+    });
+    if (isDir) stack.push({ col, name: cleanName });
+  }
+  return claims;
+}
+
+// src/audit/claims.ts
+var ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "package-lock.json",
+  "pnpm-workspace.yaml",
+  "tsconfig.json",
+  "tsup.config.ts",
+  "vitest.config.ts",
+  "Makefile",
+  "Dockerfile",
+  "docker-compose.yml",
+  "Cargo.toml",
+  "go.mod",
+  "go.sum",
+  "pyproject.toml",
+  "requirements.txt",
+  "Gemfile",
+  "composer.json",
+  "settings.gradle.kts",
+  "settings.gradle",
+  "build.gradle.kts",
+  "build.gradle",
+  "manifest.json",
+  "server.json",
+  "README.md",
+  "CHANGELOG.md",
+  "LICENSE",
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".gitignore",
+  ".env.example"
+]);
+var SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+var COMMAND_RE = /\b(npm|pnpm|yarn)\s+run\s+([A-Za-z0-9:_.-]+)/g;
+var COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+var COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+var IGNORE_LINE = "<!-- mason:ignore -->";
+var IGNORE_START = "<!-- mason:ignore-start -->";
+var IGNORE_END = "<!-- mason:ignore-end -->";
+function normalizePathToken(token) {
+  let t = token.trim();
+  if (!t) return null;
+  if (/\s/.test(t)) return null;
+  if (t.includes("://") || t.includes("\\")) return null;
+  if (/[*?[\]{}<>$`]/.test(t)) return null;
+  if (t.startsWith("/") || t.startsWith("~") || t.startsWith("./") || t.startsWith("../")) {
+    return null;
+  }
+  t = t.replace(/:\d+(?:-\d+)?$/, "");
+  if (t.includes(":")) return null;
+  const normalized = t.replace(/\/+$/, "");
+  if (!normalized) return null;
+  if (normalized.split("/").some((seg) => /^\.+$/.test(seg))) return null;
+  if (normalized.includes("/")) return normalized;
+  return ROOT_FILE_NAMES.has(normalized) ? normalized : null;
+}
+function exactTokenPath(line) {
+  const trimmed = line.trim();
+  if (!trimmed || /\s/.test(trimmed) || !trimmed.includes("/")) return null;
+  return normalizePathToken(trimmed);
+}
+function computeIgnoredLines(lines) {
+  const ignored = new Array(lines.length).fill(false);
+  let inRegion = false;
+  let ignoreNext = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.includes(IGNORE_START)) {
+      inRegion = true;
+      ignored[i] = true;
+      continue;
+    }
+    if (line.includes(IGNORE_END)) {
+      inRegion = false;
+      ignored[i] = true;
+      continue;
+    }
+    if (inRegion) {
+      ignored[i] = true;
+      continue;
+    }
+    if (ignoreNext) {
+      if (line.trim().length === 0) continue;
+      ignored[i] = true;
+      ignoreNext = false;
+      continue;
+    }
+    if (line.includes(IGNORE_LINE)) {
+      ignored[i] = true;
+      const rest = line.replace(IGNORE_LINE, "").trim();
+      if (rest.length === 0) ignoreNext = true;
+    }
+  }
+  return ignored;
+}
+function extractClaims(content2) {
+  const lines = content2.split("\n");
+  const ignored = computeIgnoredLines(lines);
+  const paths = /* @__PURE__ */ new Map();
+  const counts = [];
+  const commands = /* @__PURE__ */ new Map();
+  const addPath = (claim) => {
+    if (!paths.has(claim.path)) paths.set(claim.path, claim);
+  };
+  const addCommand = (claim) => {
+    if (!commands.has(claim.scriptName)) commands.set(claim.scriptName, claim);
+  };
+  let inFence = false;
+  let fenceInfo = "";
+  let fenceMarker = "";
+  let blockLines = [];
+  let blockStartLine = 0;
+  const processBlock = () => {
+    for (const claim of extractTreeClaims(blockLines, blockStartLine)) {
+      addPath(claim);
+    }
+    for (let i = 0; i < blockLines.length; i++) {
+      const exact = exactTokenPath(blockLines[i]);
+      if (exact) {
+        addPath({
+          path: exact,
+          line: blockStartLine + i,
+          excerpt: blockLines[i].trim()
+        });
+      }
+    }
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    const fenceMatch = line.match(/^\s*(```+|~~~+)(.*)$/);
+    if (fenceMatch) {
+      if (!inFence) {
+        inFence = true;
+        fenceMarker = fenceMatch[1][0];
+        fenceInfo = fenceMatch[2].trim().toLowerCase();
+        blockLines = [];
+        blockStartLine = lineNo + 1;
+      } else if (fenceMatch[1][0] === fenceMarker) {
+        inFence = false;
+        processBlock();
+      }
+      continue;
+    }
+    if (inFence) {
+      blockLines.push(ignored[i] ? "" : line);
+      if (!ignored[i] && SHELL_FENCE_INFOS.has(fenceInfo)) {
+        for (const m of line.matchAll(COMMAND_RE)) {
+          addCommand({
+            scriptName: m[2],
+            invocation: m[0],
+            line: lineNo,
+            excerpt: m[0]
+          });
+        }
+      }
+      continue;
+    }
+    if (ignored[i]) continue;
+    for (const m of line.matchAll(/`([^`]+)`/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(/"([A-Za-z][\w.@-]*(?:\/[\w.@-]+)+\/?)"/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(COUNT_RE)) {
+      const rest = line.slice((m.index ?? 0) + m[0].length);
+      if (COUNT_DENYLIST_RE.test(rest)) continue;
+      counts.push({
+        count: Number.parseInt(m[1], 10),
+        unit: m[2].toLowerCase(),
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+    for (const m of line.matchAll(COMMAND_RE)) {
+      addCommand({
+        scriptName: m[2],
+        invocation: m[0],
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+  }
+  if (inFence) processBlock();
+  return {
+    paths: [...paths.values()],
+    counts,
+    commands: [...commands.values()]
+  };
+}
+
+// src/audit/git.ts
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+var exec4 = promisify4(execFile4);
+var COMMIT_FORMAT = "%H%x09%cI%x09%s";
+function parseCommitLine(line) {
+  const parts = line.split("	");
+  if (parts.length < 3 || !parts[0]) return null;
+  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
+}
+async function lastCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function deletingCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      [
+        "log",
+        "-1",
+        "--diff-filter=D",
+        `--format=${COMMIT_FORMAT}`,
+        "--",
+        relPath
+      ],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function firstCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
+  if (!fromHash || fromHash === "unknown") return null;
+  try {
+    const { stdout } = await exec4(
+      "git",
+      [
+        "log",
+        `${fromHash}..HEAD`,
+        `--format=%x01${COMMIT_FORMAT}`,
+        "--name-only",
+        "--",
+        ...pathspecs
+      ],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const commits = [];
+    for (const block of stdout.split("
")) {
+      if (!block.trim()) continue;
+      const lines = block.split("\n").filter((l) => l.trim().length > 0);
+      const ref = parseCommitLine(lines[0]);
+      if (!ref) continue;
+      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
+    }
+    return { commits, total: commits.length };
+  } catch {
+    return null;
+  }
+}
+
+// src/audit/docs.ts
+var exec5 = promisify5(execFile5);
+var DOC_CANDIDATES = [
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".claude/CLAUDE.md"
+];
+async function isDirty(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec5(
+      "git",
+      ["status", "--porcelain", "--", relPath],
+      { cwd: resolvedRoot }
+    );
+    return stdout.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+async function discoverDocs(resolvedRoot) {
+  const docs = [];
+  for (const candidate of DOC_CANDIDATES) {
+    let content2;
+    try {
+      content2 = await fs4.readFile(path7.join(resolvedRoot, candidate), "utf-8");
+    } catch {
+      continue;
+    }
+    docs.push({
+      path: candidate,
+      content: content2,
+      lineCount: content2.split("\n").length,
+      lastCommit: await lastCommitOf(resolvedRoot, candidate),
+      dirty: await isDirty(resolvedRoot, candidate),
+      claims: extractClaims(content2)
+    });
+  }
+  return docs;
+}
+
+// src/audit/types.ts
+var ALL_CHECKS = [
+  "deleted-reference",
+  "new-module",
+  "stale-count",
+  "dead-command",
+  "deps-changed",
+  "decision-anchor-drift"
+];
+
+// src/audit/checks/deleted-reference.ts
+import fs5 from "fs/promises";
+import path8 from "path";
+async function exists(absPath) {
+  try {
+    await fs5.access(absPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkDeletedReferences(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    const changes = ctx.changesSinceDoc.get(doc.path);
+    const renames = /* @__PURE__ */ new Map();
+    for (const change of changes ?? []) {
+      if (change.status === "renamed" && change.previousPath) {
+        renames.set(change.previousPath, change.path);
+      }
+    }
+    for (const claim of doc.claims.paths) {
+      if (claim.path === ".mason" || claim.path.startsWith(".mason/")) {
+        continue;
+      }
+      if (await exists(path8.join(ctx.root, claim.path))) continue;
+      const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
+      const renamedTo = renames.get(claim.path) ?? null;
+      if (renamedTo) {
+        result.issues.push({
+          type: "deleted-reference",
+          message: `\`${claim.path}\` was renamed to \`${renamedTo}\``,
+          anchor,
+          confidence: "certain",
+          evidence: {
+            kind: "missing-path",
+            claimed: claim.path,
+            renamedTo,
+            deletedInCommit: null,
+            everTracked: true,
+            parentDirExists: true
+          }
+        });
+        continue;
+      }
+      const tracked = await lastCommitOf(ctx.root, claim.path);
+      if (tracked) {
+        const deleted = await deletingCommitOf(ctx.root, claim.path);
+        const detail = deleted ? ` \u2013 deleted in ${deleted.hash.slice(0, 7)} "${deleted.subject}" (${deleted.date.slice(0, 10)})` : "";
+        result.issues.push({
+          type: "deleted-reference",
+          message: `\`${claim.path}\` no longer exists${detail}`,
+          anchor,
+          confidence: "certain",
+          evidence: {
+            kind: "missing-path",
+            claimed: claim.path,
+            renamedTo: null,
+            deletedInCommit: deleted,
+            everTracked: true,
+            parentDirExists: await exists(
+              path8.join(ctx.root, path8.dirname(claim.path))
+            )
+          }
+        });
+        continue;
+      }
+      const parentDirExists = await exists(
+        path8.join(ctx.root, path8.dirname(claim.path))
+      );
+      if (!parentDirExists) continue;
+      const issue = {
+        type: "deleted-reference",
+        message: `\`${claim.path}\` does not exist (never tracked in git \u2013 possible typo or invented path)`,
+        anchor,
+        confidence: "likely",
+        evidence: {
+          kind: "missing-path",
+          claimed: claim.path,
+          renamedTo: null,
+          deletedInCommit: null,
+          everTracked: false,
+          parentDirExists: true
+        }
+      };
+      result.issues.push(issue);
+    }
+  }
+  return result;
+}
+
+// src/audit/checks/new-module.ts
+import fg2 from "fast-glob";
+import path9 from "path";
+var DIR_DENYLIST = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "target",
+  "vendor",
+  "__pycache__",
+  "venv",
+  ".venv",
+  ".git",
+  ".gradle",
+  ".mason",
+  ".claude",
+  ".github",
+  ".vscode",
+  ".idea"
+]);
+var SECOND_LEVEL_MIN_SOURCE_FILES = 2;
+var ENUMERATION_THRESHOLD = 2;
+function escapeRegExp(text2) {
+  return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isMentioned(combinedDocs, name) {
+  const re = new RegExp(
+    `(^|[^A-Za-z0-9_-])${escapeRegExp(name)}(/|[^A-Za-z0-9_-]|$)`,
+    "im"
+  );
+  return re.test(combinedDocs);
+}
+async function listSubdirs(absDir) {
+  const dirs = await fg2("*", {
+    cwd: absDir,
+    onlyDirectories: true,
+    suppressErrors: true
+  });
+  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
+}
+async function countSourceFiles(absDir) {
+  const files = await fg2(SOURCE_GLOB, {
+    cwd: absDir,
+    ignore: SOURCE_IGNORE,
+    suppressErrors: true
+  });
+  return files.length;
+}
+async function checkNewModules(ctx) {
+  const result = emptyResult();
+  if (ctx.docs.length === 0) return result;
+  const combinedDocs = ctx.docs.map((d) => d.content).join("\n");
+  const primaryDoc = ctx.docs[0].path;
+  const checkedDocs = ctx.docs.map((d) => d.path);
+  const flag = async (dir, sourceFileCount) => {
+    result.issues.push({
+      type: "new-module",
+      message: `directory \`${dir}/\` contains ${sourceFileCount} source file${sourceFileCount === 1 ? "" : "s"} but is not mentioned in any context file`,
+      anchor: { doc: primaryDoc, line: null, excerpt: dir },
+      confidence: "likely",
+      evidence: {
+        kind: "unmentioned-dir",
+        dir,
+        sourceFileCount,
+        firstCommit: await firstCommitOf(ctx.root, dir),
+        checkedDocs
+      }
+    });
+  };
+  for (const topDir of await listSubdirs(ctx.root)) {
+    const absTop = path9.join(ctx.root, topDir);
+    const topMentioned = isMentioned(combinedDocs, topDir);
+    if (!topMentioned) {
+      const count2 = await countSourceFiles(absTop);
+      if (count2 >= 1) await flag(topDir, count2);
+      continue;
+    }
+    const subdirs = await listSubdirs(absTop);
+    const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
+    if (mentioned.length < ENUMERATION_THRESHOLD) continue;
+    for (const sub of subdirs) {
+      if (isMentioned(combinedDocs, sub)) continue;
+      const count2 = await countSourceFiles(path9.join(absTop, sub));
+      if (count2 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
+        await flag(`${topDir}/${sub}`, count2);
+      }
+    }
+  }
+  return result;
+}
+
+// src/audit/checks/stale-count.ts
+import fs6 from "fs/promises";
+import path10 from "path";
+import fg3 from "fast-glob";
+var MEMBERS_CAP = 50;
+async function readIfExists(absPath) {
+  try {
+    return await fs6.readFile(absPath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function countGradleModules(root) {
+  for (const name of ["settings.gradle.kts", "settings.gradle"]) {
+    const content2 = await readIfExists(path10.join(root, name));
+    if (content2 === null) continue;
+    const members = [];
+    for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
+      for (const proj of call[1].matchAll(/["']([^"']+)["']/g)) {
+        members.push(proj[1]);
+      }
+    }
+    if (members.length === 0) return null;
+    return { actual: members.length, countedFrom: name, members };
+  }
+  return null;
+}
+async function countNpmWorkspaces(root) {
+  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  if (pkgRaw !== null) {
+    try {
+      const pkg = JSON.parse(pkgRaw);
+      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
+      if (globs.length > 0) {
+        const matched = await fg3(
+          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+          { cwd: root, ignore: ["**/node_modules/**"] }
+        );
+        return {
+          actual: matched.length,
+          countedFrom: "package.json workspaces",
+          members: matched.map((m) => path10.dirname(m)).sort()
+        };
+      }
+    } catch {
+    }
+  }
+  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  if (pnpmRaw !== null) {
+    const globs = [];
+    let inPackages = false;
+    for (const line of pnpmRaw.split("\n")) {
+      if (/^packages\s*:/.test(line)) {
+        inPackages = true;
+        continue;
+      }
+      if (inPackages) {
+        const entry = line.match(/^\s*-\s*["']?([^"'#\s]+)/);
+        if (entry) {
+          if (!entry[1].startsWith("!")) globs.push(entry[1]);
+        } else if (line.trim().length > 0 && !line.startsWith(" ")) {
+          inPackages = false;
+        }
+      }
+    }
+    if (globs.length > 0) {
+      const matched = await fg3(
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { cwd: root, ignore: ["**/node_modules/**"] }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "pnpm-workspace.yaml",
+        members: matched.map((m) => path10.dirname(m)).sort()
+      };
+    }
+  }
+  return null;
+}
+async function countCargoCrates(root) {
+  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  if (content2 === null) return null;
+  const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
+  if (!membersBlock) return null;
+  const entries = [...membersBlock[1].matchAll(/["']([^"']+)["']/g)].map(
+    (m) => m[1]
+  );
+  if (entries.length === 0) return null;
+  const members = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (/[*?[\]{}]/.test(entry)) {
+      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        cwd: root,
+        ignore: ["**/target/**"]
+      });
+      for (const m of matched) members.add(path10.dirname(m));
+    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      members.add(entry);
+    }
+  }
+  if (members.size === 0) return null;
+  return {
+    actual: members.size,
+    countedFrom: "Cargo.toml workspace members",
+    members: [...members].sort()
+  };
+}
+async function resolveCountSource(root, claim) {
+  const unit = claim.unit.replace(/s$/, "");
+  if (unit === "module") return countGradleModules(root);
+  if (unit === "workspace") return countNpmWorkspaces(root);
+  if (unit === "crate") return countCargoCrates(root);
+  return await countNpmWorkspaces(root) ?? await countCargoCrates(root) ?? await countGradleModules(root);
+}
+async function checkStaleCounts(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    for (const claim of doc.claims.counts) {
+      const source = await resolveCountSource(ctx.root, claim);
+      if (source === null) {
+        result.skipped.push({
+          check: "stale-count",
+          doc: doc.path,
+          reason: `${doc.path}: cannot resolve a workspace manifest for "${claim.excerpt}"`
+        });
+        continue;
+      }
+      if (source.actual === claim.count) continue;
+      result.issues.push({
+        type: "stale-count",
+        message: `says "${claim.excerpt}" but ${source.countedFrom} resolves to ${source.actual}`,
+        anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
+        confidence: "certain",
+        evidence: {
+          kind: "count-mismatch",
+          claimed: claim.count,
+          actual: source.actual,
+          unit: claim.unit,
+          countedFrom: source.countedFrom,
+          members: source.members.slice(0, MEMBERS_CAP)
+        }
+      });
+    }
+  }
+  return result;
+}
+
+// src/audit/checks/dead-command.ts
+import fs7 from "fs/promises";
+import path11 from "path";
+import fg4 from "fast-glob";
+var AVAILABLE_SCRIPTS_CAP = 30;
+async function scriptsOf(absManifest) {
+  try {
+    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
+  } catch {
+    return null;
+  }
+}
+async function checkDeadCommands(ctx) {
+  const result = emptyResult();
+  const commandClaims = ctx.docs.flatMap(
+    (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
+  );
+  if (commandClaims.length === 0) return result;
+  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  if (rootScripts === null) {
+    result.skipped.push({
+      check: "dead-command",
+      reason: "no package.json at the repo root"
+    });
+    return result;
+  }
+  const rootSet = new Set(rootScripts);
+  let workspaceScripts = null;
+  let manifestsChecked = ["package.json"];
+  const loadWorkspaceScripts = async () => {
+    if (workspaceScripts !== null) return workspaceScripts;
+    workspaceScripts = /* @__PURE__ */ new Set();
+    const manifests = await fg4("**/package.json", {
+      cwd: ctx.root,
+      ignore: [
+        "**/node_modules/**",
+        "**/dist/**",
+        "**/build/**",
+        "package.json"
+      ]
+    });
+    manifestsChecked = ["package.json", ...manifests.sort()];
+    for (const manifest2 of manifests) {
+      const scripts = await scriptsOf(path11.join(ctx.root, manifest2));
+      for (const name of scripts ?? []) workspaceScripts.add(name);
+    }
+    return workspaceScripts;
+  };
+  for (const { doc, claim } of commandClaims) {
+    if (rootSet.has(claim.scriptName)) continue;
+    const elsewhere = await loadWorkspaceScripts();
+    if (elsewhere.has(claim.scriptName)) continue;
+    result.issues.push({
+      type: "dead-command",
+      message: `\`${claim.invocation}\` refers to script "${claim.scriptName}", which exists in no package.json`,
+      anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
+      confidence: "certain",
+      evidence: {
+        kind: "missing-script",
+        scriptName: claim.scriptName,
+        invocation: claim.invocation,
+        manifestsChecked,
+        availableScripts: rootScripts.slice(0, AVAILABLE_SCRIPTS_CAP)
+      }
+    });
+  }
+  return result;
+}
+
+// src/audit/checks/deps-changed.ts
+var MANIFEST_COMMITS_CAP = 10;
+var MANIFEST_PATHSPECS = [
+  ":(glob)**/package.json",
+  ":(glob)**/build.gradle.kts",
+  ":(glob)**/build.gradle",
+  "settings.gradle.kts",
+  "settings.gradle",
+  "gradle/libs.versions.toml",
+  ":(glob)**/Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "requirements.txt",
+  "Gemfile",
+  "composer.json"
+];
+async function checkDepsChanged(ctx) {
+  const result = emptyResult();
+  result.suppressedAdvisories = [];
+  for (const doc of ctx.docs) {
+    if (!doc.lastCommit) {
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path} has no commit history`
+      });
+      continue;
+    }
+    if (doc.dirty) {
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+      });
+    }
+    const range = await commitsTouchingSince(
+      ctx.root,
+      doc.lastCommit.hash,
+      MANIFEST_PATHSPECS
+    );
+    if (range === null) {
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path}: commit range unreachable (shallow clone?)`
+      });
+      continue;
+    }
+    if (range.total === 0) continue;
+    const latest = range.commits[0];
+    (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
+      type: "deps-changed",
+      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
+      anchor: { doc: doc.path, line: null, excerpt: null },
+      evidence: {
+        kind: "doc-behind-manifests",
+        docLastCommit: doc.lastCommit,
+        manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
+        totalCommits: range.total
+      }
+    });
+  }
+  return result;
+}
+
+// src/decisions/drift.ts
+import path14 from "path";
+
+// src/decisions/decisions.ts
+import fs8 from "fs/promises";
+import path13 from "path";
+import { createHash } from "crypto";
+
+// src/context/lexical.ts
+import path12 from "path";
+
+// src/decisions/provenance.ts
+import { z as z2 } from "zod";
+var text = (max) => z2.string().trim().min(1).max(max);
+var decisionSourceSchema = z2.object({
+  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+  reference: text(1e3),
+  note: text(500).optional()
+}).strict();
+var attributionSchema = z2.object({
+  owner: text(200).nullable().optional(),
+  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  actor: text(200).optional()
+});
+var contentSchema = z2.object({
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20)
+});
+var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z2.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z2.object({
+  baseHash: z2.string(),
+  headHash: z2.string(),
+  historyAvailable: z2.boolean(),
+  changedFiles: z2.array(z2.string()),
+  localChanges: z2.array(z2.string())
+});
+var eventSchema = z2.object({
+  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+  at: z2.string().datetime(),
+  actor: text(200).optional(),
+  note: text(1500).optional(),
+  revision: z2.number().int().positive(),
+  content: contentSchema,
+  approval: approvalSchema,
+  status: statusSchema,
+  refreshedHash: z2.string(),
+  evidence: reviewEvidenceSchema.optional()
+});
+var legacySchema = z2.object({
+  version: z2.literal(1),
+  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: contentSchema.shape.category,
+  files: contentSchema.shape.files,
+  createdAt: z2.string(),
+  updatedAt: z2.string(),
+  refreshedHash: z2.string(),
+  status: z2.enum(["active", "superseded"]),
+  supersededBy: z2.string().optional()
+}).passthrough();
+var currentSchema = legacySchema.extend({
+  version: z2.literal(2),
+  status: statusSchema,
+  approval: approvalSchema,
+  revision: z2.number().int().positive(),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20),
+  history: z2.array(eventSchema).min(1)
+}).superRefine((record, ctx) => {
+  const invalid = (message) => ctx.addIssue({ code: "custom", message });
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+  let previous;
+  for (const event of record.history) {
+    if (!previous) {
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+    } else {
+      if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
+      if (previous.status !== "active") invalid("Archived decisions cannot be changed");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
+      if (event.approval !== approval) invalid("Approval disagrees with review history");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+    }
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (["accepted", "reaffirmed"].includes(event.kind)) {
+      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+    }
+    previous = event;
+  }
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+});
+var decisionSchema = z2.union([legacySchema, currentSchema]);
+function decisionContent(record) {
+  return {
+    title: record.title,
+    body: record.body,
+    category: record.category,
+    files: record.files,
+    ...typeof record.owner === "string" ? { owner: record.owner } : {},
+    sources: Array.isArray(record.sources) ? record.sources : []
+  };
+}
+function decisionApproval(record) {
+  return record.version === 1 ? "unreviewed" : record.approval;
+}
+function effectiveDecision(record) {
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  let index = record.history.length - 1;
+  while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
+  if (index < 0) return record;
+  const event = record.history[index];
+  return {
+    ...record,
+    ...event.content,
+    owner: event.content.owner,
+    approval: "accepted",
+    revision: event.revision,
+    refreshedHash: event.refreshedHash,
+    updatedAt: event.at,
+    history: record.history.slice(0, index + 1)
+  };
+}
+function decisionProvenance(record, freshness = "unknown") {
+  const approval = decisionApproval(record);
+  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  return {
+    approval,
+    revision: record.version === 2 ? record.revision : 0,
+    owner: record.version === 2 ? record.owner ?? null : null,
+    sources: record.version === 2 ? record.sources : [],
+    guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
+    reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
+    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+  };
+}
+
+// src/decisions/decisions.ts
+async function loadDecisionStore(rootDir) {
+  const records = [];
+  const diagnostics = [];
+  let entries;
+  try {
+    entries = await fs8.readdir(await storePath(rootDir, ".mason/decisions"));
+  } catch (error) {
+    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
+    return { records, diagnostics };
+  }
+  for (const entry of entries.sort()) {
+    if (!entry.endsWith(".json")) continue;
+    const relative = `.mason/decisions/${entry}`;
+    try {
+      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
+      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
+      records.push(record);
+    } catch (error) {
+      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { records, diagnostics };
+}
+
+// src/decisions/drift.ts
+async function computeDecisionDrift(rootDir, decisions) {
+  const resolvedRoot = path14.resolve(rootDir);
+  const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
+  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
+  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const changesByHash = /* @__PURE__ */ new Map();
+  const inspect = async (record) => {
+    if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
+    let touched = changesByHash.get(record.refreshedHash);
+    if (touched === void 0) {
+      const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
+      touched = changes === null ? null : touchedPaths(changes);
+      changesByHash.set(record.refreshedHash, touched);
+    }
+    if (touched === null) report.historyAvailable = false;
+    const hits = touched ? matchingPaths(record.files, touched) : [];
+    const localHits = matchingPaths(record.files, workingTree.changedFiles);
+    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+  };
+  for (const record of store.records) {
+    if (record.status !== "active") continue;
+    const effective = effectiveDecision(record);
+    const state = await inspect(effective);
+    report.freshness[record.id] = state.freshness;
+    if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
+    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
+  }
+  return report;
+}
+
+// src/audit/checks/decision-anchor.ts
+async function checkDecisionAnchors(ctx) {
+  const result = emptyResult();
+  if (!ctx.decisionsPresent) return result;
+  const store = await loadDecisionStore(ctx.root);
+  const records = store.records;
+  for (const diagnostic of store.diagnostics) result.skipped.push({ check: "decision-anchor-drift", reason: `${diagnostic.path}: ${diagnostic.message}` });
+  const drift = await computeDecisionDrift(ctx.root, records);
+  if (!drift.historyAvailable) {
+    result.skipped.push({
+      check: "decision-anchor-drift",
+      reason: "some decision base commits are unreachable (shallow clone?)"
+    });
+  }
+  const changed = records.flatMap((record) => [
+    { record: effectiveDecision(record), changedFiles: drift.staleDecisions[record.id] ?? [], freshness: drift.freshness?.[record.id] ?? "unknown" },
+    { record, changedFiles: drift.pendingProposals?.[record.id]?.changedFiles ?? [], freshness: drift.pendingProposals?.[record.id]?.freshness ?? "unknown" }
+  ]);
+  for (const { record, changedFiles, freshness } of changed) {
+    if (!changedFiles.length) continue;
+    const id = record.id;
+    const provenance = decisionProvenance(record, freshness);
+    result.advisories.push({
+      type: "decision-anchor-drift",
+      message: `decision "${record.title}" (${provenance.approval}) has anchor files that changed since its evidence baseline \u2013 needs human review`,
+      anchor: {
+        doc: `.mason/decisions/${id}.json`,
+        line: null,
+        excerpt: record.title
+      },
+      evidence: {
+        kind: "decision-anchor",
+        provenance,
+        decisionId: id,
+        title: record.title,
+        changedFiles,
+        refreshedHash: record.refreshedHash
+      }
+    });
+  }
+  return result;
+}
+
+// src/audit/checks/index.ts
+var CHECKS = {
+  "deleted-reference": checkDeletedReferences,
+  "new-module": checkNewModules,
+  "stale-count": checkStaleCounts,
+  "dead-command": checkDeadCommands,
+  "deps-changed": checkDepsChanged,
+  "decision-anchor-drift": checkDecisionAnchors
+};
+function emptyResult() {
+  return { issues: [], advisories: [], skipped: [] };
+}
+
+// src/audit/audit.ts
+async function computeAudit(rootDir, options = {}) {
+  const resolvedRoot = path15.resolve(rootDir);
+  const docs = await discoverDocs(resolvedRoot);
+  if (docs.length === 0) return null;
+  const headHash = await getCurrentGitHash(resolvedRoot);
+  const report = {
+    version: 1,
+    root: resolvedRoot,
+    gitAvailable: headHash !== "unknown",
+    headHash,
+    checksRun: [],
+    docs: docs.map((d) => ({
+      path: d.path,
+      lastCommit: d.lastCommit,
+      dirty: d.dirty,
+      lineCount: d.lineCount
+    })),
+    decisionsChecked: false,
+    issues: [],
+    advisories: [],
+    suppressedAdvisories: [],
+    skippedChecks: [],
+    clean: true
+  };
+  if (!report.gitAvailable) return report;
+  const changesSinceDoc = /* @__PURE__ */ new Map();
+  for (const doc of docs) {
+    changesSinceDoc.set(
+      doc.path,
+      doc.lastCommit ? await getChangesWithStatus(resolvedRoot, doc.lastCommit.hash) : null
+    );
+  }
+  let decisionsPresent = false;
+  try {
+    await fs9.access(path15.join(resolvedRoot, ".mason", "decisions"));
+    decisionsPresent = true;
+  } catch {
+  }
+  report.decisionsChecked = decisionsPresent;
+  const ctx = {
+    root: resolvedRoot,
+    docs,
+    headHash,
+    changesSinceDoc,
+    decisionsPresent
+  };
+  const selected = options.checks ?? ALL_CHECKS;
+  for (const name of ALL_CHECKS) {
+    if (!selected.includes(name)) continue;
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    report.checksRun.push(name);
+    report.issues.push(...issues);
+    report.advisories.push(...advisories);
+    report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
+    report.skippedChecks.push(...skipped);
+  }
+  report.clean = report.issues.length === 0;
+  return report;
+}
+
+// src/audit/repair.ts
+var checkSchema = z3.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+var commitSchema = z3.object({ hash: z3.string().regex(/^[a-f0-9]{40,64}$/), date: z3.string(), subject: z3.string() });
+var anchorSchema = z3.object({ doc: z3.string(), line: z3.number().int().positive().nullable(), excerpt: z3.string().nullable() });
+var count = z3.number().int().nonnegative();
+var evidenceSchema = z3.discriminatedUnion("kind", [
+  z3.object({
+    kind: z3.literal("missing-path"),
+    claimed: z3.string(),
+    renamedTo: z3.string().nullable(),
+    deletedInCommit: commitSchema.nullable(),
+    everTracked: z3.boolean(),
+    parentDirExists: z3.boolean()
+  }),
+  z3.object({
+    kind: z3.literal("unmentioned-dir"),
+    dir: z3.string(),
+    sourceFileCount: count,
+    firstCommit: commitSchema.nullable(),
+    checkedDocs: z3.array(z3.string())
+  }),
+  z3.object({
+    kind: z3.literal("count-mismatch"),
+    claimed: count,
+    actual: count,
+    unit: z3.string(),
+    countedFrom: z3.string(),
+    members: z3.array(z3.string())
+  }),
+  z3.object({
+    kind: z3.literal("missing-script"),
+    scriptName: z3.string(),
+    invocation: z3.string(),
+    manifestsChecked: z3.array(z3.string()),
+    availableScripts: z3.array(z3.string())
+  }),
+  z3.object({
+    kind: z3.literal("doc-behind-manifests"),
+    docLastCommit: commitSchema,
+    manifestCommits: z3.array(commitSchema.extend({ files: z3.array(z3.string()) })),
+    totalCommits: count
+  }),
+  z3.object({
+    kind: z3.literal("decision-anchor"),
+    decisionId: z3.string(),
+    title: z3.string(),
+    changedFiles: z3.array(z3.string()),
+    refreshedHash: z3.string(),
+    provenance: z3.object({}).passthrough().optional()
+  })
+]);
+var findingSchema = z3.object({ message: z3.string(), anchor: anchorSchema, evidence: evidenceSchema });
+var issueSchema = findingSchema.extend({
+  type: z3.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+  confidence: z3.enum(["certain", "likely"])
+});
+var advisorySchema = findingSchema.extend({ type: z3.enum(["deps-changed", "decision-anchor-drift"]) });
+var checkResultSchema = z3.object({
+  issues: z3.array(issueSchema),
+  advisories: z3.array(advisorySchema),
+  suppressedAdvisories: z3.array(advisorySchema).optional(),
+  skipped: z3.array(z3.object({ check: z3.string(), reason: z3.string(), doc: z3.string().optional() }))
+});
+var reportSchema = z3.object({
+  version: z3.literal(1),
+  root: z3.string(),
+  gitAvailable: z3.literal(true),
+  headHash: commitSchema.shape.hash,
+  checksRun: z3.array(checkSchema).nonempty(),
+  docs: z3.array(z3.object({
+    path: z3.enum(DOC_CANDIDATES),
+    lastCommit: commitSchema.nullable(),
+    dirty: z3.boolean(),
+    lineCount: count
+  })).nonempty(),
+  decisionsChecked: z3.boolean(),
+  clean: z3.boolean(),
+  issues: z3.array(issueSchema),
+  advisories: z3.array(advisorySchema),
+  suppressedAdvisories: z3.array(advisorySchema).optional(),
+  skippedChecks: z3.array(z3.object({ check: z3.string(), reason: z3.string(), doc: z3.string().optional() }))
+});
+var baselineSchema = z3.object({
+  kind: z3.literal("mason-audit-repair"),
+  version: z3.literal(1),
+  createdAt: z3.string().datetime(),
+  report: reportSchema,
+  digest: z3.string().regex(/^[a-f0-9]{64}$/)
+});
+var digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+function findingId(finding) {
+  const e = finding.evidence;
+  let key;
+  switch (e.kind) {
+    case "missing-path":
+      key = e.claimed;
+      break;
+    case "unmentioned-dir":
+      key = e.dir;
+      break;
+    case "count-mismatch":
+      key = [e.unit.replace(/s$/, ""), e.countedFrom];
+      break;
+    case "missing-script":
+      key = e.scriptName;
+      break;
+    case "doc-behind-manifests":
+      key = null;
+      break;
+    case "decision-anchor":
+      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
+      break;
+  }
+  return digest([finding.type, finding.anchor.doc, key]);
+}
+function allFindings(report) {
+  return [...report.issues, ...report.advisories, ...report.suppressedAdvisories ?? []];
+}
+async function docState(root) {
+  const docs = [];
+  for (const doc of DOC_CANDIDATES) {
+    try {
+      const content2 = await readBoundedFile(await storePath(root, doc), 10 * 1024 * 1024);
+      if (content2 === null) throw new Error("Context file is not regular or exceeds 10 MiB: " + doc);
+      docs.push([doc, digest(content2)]);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      docs.push([doc, null]);
+    }
+  }
+  return digest(docs);
+}
+async function stableAudit(root, checks, options = {}) {
+  const head = await getCurrentGitHash(root);
+  const before = await docState(root);
+  const report = await computeAudit(root, { ...options, checks });
+  if (head !== await getCurrentGitHash(root) || before !== await docState(root) || report && report.headHash !== head) {
+    throw new Error("HEAD or context files changed during the audit; retry against a stable checkout.");
+  }
+  return report;
+}
+async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
+  const root = await fs10.realpath(rootDir);
+  const selected = z3.array(checkSchema).nonempty().parse(checks);
+  const report = await stableAudit(root, selected, options);
+  if (!report) throw new Error("No context files found to prepare a repair.");
+  if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
+  const storedReport = reportSchema.parse(report);
+  const payload = {
+    kind: "mason-audit-repair",
+    version: 1,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    report: storedReport
+  };
+  const baselinePath = ".mason/reports/repairs/" + randomUUID2() + ".json";
+  await writeStoreJson(root, baselinePath, { ...payload, digest: digest(payload) });
+  return { version: 1, action: "prepare", baselinePath, report };
+}
+async function verifyRepair(rootDir, baselinePath, options = {}) {
+  const root = await fs10.realpath(rootDir);
+  const declaredRoot = path16.resolve(rootDir);
+  const relative = path16.isAbsolute(baselinePath) ? path16.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const stored = baselineSchema.parse(await readStoreJson(root, relative));
+  const { digest: savedDigest, ...payload } = stored;
+  if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
+  if (stored.report.root !== root) throw new Error("Repair baseline belongs to a different repository.");
+  const original = stored.report;
+  const diagnostics = [];
+  let current = null;
+  try {
+    current = await stableAudit(root, original.checksRun, options);
+    if (!current) diagnostics.push("No context files remain available to audit.");
+    else if (!current.gitAvailable) diagnostics.push("Git history is unavailable.");
+    for (const doc of original.docs) {
+      if (!original.issues.some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path)) continue;
+      const content2 = await readBoundedFile(await storePath(root, doc.path), 10 * 1024 * 1024);
+      if (content2 === null || !content2.trim()) {
+        diagnostics.push("Original context file " + doc.path + " is empty or unreadable; losing its claims does not verify a repair.");
+      }
+    }
+    if (await getChangesWithStatus(root, original.headHash) === null) {
+      diagnostics.push("The original audit commit is unavailable; repair history cannot be verified.");
+    }
+  } catch (error) {
+    diagnostics.push(error instanceof Error ? error.message : String(error));
+  }
+  const currentById = new Map((current ? allFindings(current) : []).map((f) => [findingId(f), f]));
+  const originalFindings = allFindings(original);
+  const originalIds = new Set(originalFindings.map(findingId));
+  const missingDocs = original.docs.filter((doc) => !current?.docs.some((d) => d.path === doc.path));
+  for (const doc of missingDocs) diagnostics.push("Original context file " + doc.path + " is unavailable; removing it does not verify a repair.");
+  const findings = originalFindings.map((finding) => {
+    const id = findingId(finding);
+    const now = currentById.get(id);
+    const base = { id, original: finding, ...now ? { current: now } : {} };
+    if (diagnostics.length || !current) {
+      return { ...base, status: "unverified", reason: "The original audit scope could not be verified. See diagnostics." };
+    }
+    if ("confidence" in finding && now) {
+      return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
+    }
+    const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
+    if (!current.checksRun?.includes(finding.type) || skipped.length) {
+      return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
+    }
+    if (!("confidence" in finding)) {
+      return {
+        ...base,
+        status: "review-required",
+        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+      };
+    }
+    return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
+  });
+  const newFindings = [...currentById].filter(([id]) => !originalIds.has(id)).map(([, f]) => f);
+  const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+  for (const f of findings) counts[f.status]++;
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f));
+  const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
+  return {
+    version: 1,
+    action: "verify",
+    baselinePath: relative,
+    baselineHead: original.headHash,
+    currentHead: current?.gitAvailable ? current.headHash : null,
+    status: incomplete ? "incomplete" : issuesRemain ? "issues-remain" : "verified",
+    findings,
+    newFindings,
+    diagnostics,
+    currentAudit: current,
+    counts,
+    scope: "Original audit checks over current context files and repository evidence. Resolved means no longer detected by that check. Advisories require separate review; this is not a certification of documentation or application correctness."
+  };
+}
+
+// src/automation/evidence.ts
+import fs11 from "fs/promises";
+import path17 from "path";
+import { createHash as createHash3 } from "crypto";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+import fg5 from "fast-glob";
+import { z as z4 } from "zod";
+var exec6 = promisify6(execFile6);
+var engineVersion = true ? "0.12.0" : "development";
+var hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+async function git(root, ...args) {
+  return (await exec6("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
+}
+async function workspace(dir) {
+  const root = await fs11.realpath((await git(dir, "rev-parse", "--show-toplevel")).trim());
+  const gitDir = await fs11.realpath((await git(root, "rev-parse", "--absolute-git-dir")).trim());
+  let branch;
+  try {
+    branch = (await git(root, "symbolic-ref", "--quiet", "HEAD")).trim();
+  } catch {
+    branch = "detached";
+  }
+  return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
+}
+async function content(root, file) {
+  try {
+    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+var manifest = /(^|\/)(package\.json|pnpm-workspace\.yaml|Cargo\.toml|settings\.gradle(?:\.kts)?|build\.gradle(?:\.kts)?|libs\.versions\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)$/;
+var internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
+async function readInputs(root) {
+  const [headText, status, inventory, index, shallowPath, replacements] = await Promise.all([
+    git(root, "rev-parse", "HEAD"),
+    git(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
+    fg5("**/*", {
+      cwd: root,
+      dot: true,
+      onlyFiles: false,
+      followSymbolicLinks: false,
+      objectMode: true,
+      ignore: ["**/.git/**", "**/node_modules/**", ".mason/reports/**"]
+    }),
+    git(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports"),
+    git(root, "rev-parse", "--git-path", "shallow"),
+    git(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
+  ]);
+  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
+  const files = entries.map((f) => f.path);
+  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
+  const head = headText.trim();
+  let shallow = null;
+  try {
+    shallow = await fs11.readFile(path17.resolve(root, shallowPath.trim()), "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const docs = {};
+  const docContents = [];
+  const claims = [];
+  for (const file of DOC_CANDIDATES) {
+    const text2 = await content(root, file);
+    docs[file] = text2 === null ? null : hash(text2);
+    docContents.push([file, text2]);
+    for (const claim of text2 ? extractClaims(text2).paths : []) {
+      if (internal(claim.path) || claim.path.startsWith(".mason/")) continue;
+      const exists2 = async (p) => fs11.access(path17.resolve(root, p)).then(() => true, () => false);
+      claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
+    }
+  }
+  const metadata = [];
+  for (const file of files) {
+    if (manifest.test(file) || file.startsWith(".mason/decisions/") && file.endsWith(".json") || file === ".mason/config.json") {
+      metadata.push([file, await content(root, file)]);
+    }
+  }
+  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
+  const common = [1, engineVersion, head, shallow, replacements, docContents];
+  const layout = hash(entries.map((f) => [f.path, f.dirent.isDirectory() ? "directory" : "file"]));
+  const manifests = hash(metadata.filter(([file]) => manifest.test(file)));
+  const decisions = hash(metadata.filter(([file]) => !manifest.test(file)));
+  const keys = {
+    "deleted-reference": hash([common, layout, claims]),
+    "new-module": hash([common, layout]),
+    "stale-count": hash([common, layout, manifests]),
+    "dead-command": hash([common, layout, manifests]),
+    "deps-changed": hash([common, status]),
+    "decision-anchor-drift": hash([common, layout, decisions, status, index])
+  };
+  return { fingerprint: hash(keys), head, docs, keys };
+}
+var cacheSchema = z4.object({ version: z4.literal(1), entries: z4.record(z4.object({ key: z4.string(), result: checkResultSchema })), digest: z4.string() });
+function checkCache(raw, inputs) {
+  let entries = {};
+  let diagnostic = null;
+  if (raw !== null) {
+    const parsed = cacheSchema.safeParse(raw);
+    if (parsed.success && parsed.data.digest === hash(parsed.data.entries)) entries = parsed.data.entries;
+    else diagnostic = "Discarded an invalid automation cache; checks are being recomputed.";
+  }
+  const ran = /* @__PURE__ */ new Set(), reused = /* @__PURE__ */ new Set();
+  const options = { runCheck: async (name, ctx) => {
+    if (entries[name]?.key === inputs.keys[name]) {
+      reused.add(name);
+      return structuredClone(entries[name].result);
+    }
+    const result = await CHECKS[name](ctx);
+    ran.add(name);
+    if (!result.skipped.length) entries[name] = { key: inputs.keys[name], result };
+    else delete entries[name];
+    return result;
+  } };
+  return { options, ran, reused, diagnostic, serialize: () => {
+    const canonical = cacheSchema.shape.entries.parse(entries);
+    return { version: 1, entries: canonical, digest: hash(canonical) };
+  } };
+}
+
+// src/automation/store.ts
+import fs12 from "fs/promises";
+import os from "os";
+import { z as z5 } from "zod";
+var hostSchema = z5.enum(["claude", "codex"]);
+var stateSchema = z5.object({
+  version: z5.literal(1),
+  root: z5.string(),
+  gitDir: z5.string(),
+  branch: z5.string(),
+  baselines: z5.array(z5.object({ path: z5.string(), at: z5.string(), event: z5.string(), fingerprint: z5.string() })).max(128),
+  sessions: z5.record(z5.object({
+    host: hostSchema,
+    seen: z5.string().nullable(),
+    continued: z5.boolean(),
+    initialIssues: z5.array(z5.string()),
+    initialDocs: z5.record(z5.string().nullable()),
+    lastUsed: z5.string(),
+    mutationObserved: z5.boolean(),
+    pending: z5.record(z5.string()),
+    coverageGaps: z5.array(z5.string()),
+    events: z5.record(z5.object({ at: z5.string(), count: z5.number().int().positive() }))
+  })),
+  updatedAt: z5.string(),
+  fingerprint: z5.string().nullable(),
+  latest: z5.string().nullable()
+});
+async function withLock(root, directory, run) {
+  const file = await storePath(root, directory + "/lock", true);
+  const deadline = Date.now() + 5e3;
+  let handle;
+  while (!handle) {
+    try {
+      handle = await fs12.open(file, "wx", 384);
+      await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const owner = JSON.parse(await fs12.readFile(file, "utf8"));
+        if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+          try {
+            process.kill(owner.pid, 0);
+          } catch (probe) {
+            if (probe.code === "ESRCH") {
+              const reclaim = file + ".reclaim";
+              let guard;
+              try {
+                guard = await fs12.open(reclaim, "wx", 384);
+                const current = JSON.parse(await fs12.readFile(file, "utf8"));
+                if (current.pid === owner.pid && current.host === owner.host) await fs12.unlink(file);
+              } finally {
+                if (guard) {
+                  await guard.close();
+                  await fs12.rm(reclaim, { force: true });
+                }
+              }
+            }
+          }
+        }
+      } catch {
+      }
+      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
+      await new Promise((resolve) => setTimeout(resolve, 40));
+    }
+  }
+  try {
+    return await run();
+  } finally {
+    await handle.close();
+    await fs12.unlink(file);
+  }
+}
+
+// src/automation/runtime.ts
+var SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved claims no longer fail their checks; advisories need separate review. Repair only within the user's task authorization.";
+var priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
+var cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+function summarize(report) {
+  const open = report.findings.filter((f) => f.status !== "resolved");
+  return [
+    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
+    ...report.diagnostics.slice(0, 2).map(cleanText),
+    `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+  ].join("\n");
+}
+async function automate(dir, event) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ws.directory, async () => {
+    const inputs = await readInputs(ws.root);
+    const statePath = ws.directory + "/state.json";
+    const raw = await readStoreJson(ws.root, statePath);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const state = raw === null ? {
+      version: 1,
+      root: ws.root,
+      gitDir: ws.gitDir,
+      branch: ws.branch,
+      baselines: [],
+      sessions: {},
+      updatedAt: now,
+      fingerprint: null,
+      latest: null
+    } : stateSchema.parse(raw);
+    if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
+      throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
+    }
+    if (ws.branch === "detached" && state.latest) {
+      const previous = await readStoreJson(ws.root, state.latest);
+      if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
+      try {
+        await git(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
+      } catch {
+        throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
+      }
+    }
+    const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
+    const newSession = key !== null && !state.sessions[key];
+    if (key && !state.sessions[key]) {
+      const keys = Object.keys(state.sessions).sort((a, b) => state.sessions[a].lastUsed.localeCompare(state.sessions[b].lastUsed));
+      for (const expired of keys.slice(0, Math.max(0, keys.length - 31))) delete state.sessions[expired];
+      state.sessions[key] = {
+        host: event.host,
+        seen: null,
+        continued: false,
+        initialIssues: [],
+        initialDocs: inputs.docs,
+        lastUsed: now,
+        mutationObserved: false,
+        pending: {},
+        coverageGaps: [],
+        events: {}
+      };
+    }
+    const session = key ? state.sessions[key] : null;
+    if (session) {
+      session.lastUsed = now;
+      session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
+      if (event.event === "before_tool" && event.mutating && event.toolId) {
+        if (Object.keys(session.pending).length >= 128) throw new Error("Too many unfinished tool calls to track pre-edit evidence.");
+        session.pending[event.toolId] = inputs.fingerprint;
+      }
+      if (event.event === "after_tool" && event.mutating) {
+        session.mutationObserved = true;
+        if (!event.toolId || !session.pending[event.toolId]) {
+          const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+          if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
+        }
+        if (event.toolId) delete session.pending[event.toolId];
+      }
+    }
+    if (!state.baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
+      const report2 = {
+        version: 1,
+        status: "unavailable",
+        root: ws.root,
+        branch: ws.branch,
+        head: inputs.head,
+        baselinePaths: [],
+        reportPath: ws.directory + "/checks/" + randomUUID3() + ".json",
+        findings: [],
+        diagnostics: ["No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md exists. Documentation capture is unavailable; other Mason tools remain usable."],
+        checks: { ran: [], reused: [], skipped: [] },
+        counts: { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 },
+        capture: "unknown",
+        scope: SCOPE
+      };
+      const notify2 = !session || session.seen !== "no-docs";
+      if (session) session.seen = "no-docs";
+      state.fingerprint = inputs.fingerprint;
+      state.latest = report2.reportPath;
+      state.updatedAt = now;
+      await writeStoreJson(ws.root, report2.reportPath, report2);
+      await writeStoreJson(ws.root, statePath, state);
+      return { report: report2, message: notify2 ? summarize(report2) : null, continueOnce: false };
+    }
+    let cached = null;
+    const diagnostics = [];
+    try {
+      cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
+    } catch {
+      diagnostics.push("Unreadable automation cache; checks are being recomputed.");
+    }
+    const cache = checkCache(cached, inputs);
+    if (cache.diagnostic) diagnostics.push(cache.diagnostic);
+    const saveBaseline = async () => {
+      if (state.baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
+      const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
+      state.baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
+    };
+    if (!state.baselines.length) await saveBaseline();
+    const verifications = [];
+    for (const baseline of state.baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
+    const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
+    if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
+      await saveBaseline();
+      verifications.push(await verifyRepair(ws.root, state.baselines.at(-1).path, cache.options));
+    }
+    const merged = /* @__PURE__ */ new Map();
+    for (const verification of verifications) {
+      for (const finding of verification.findings) {
+        const previous = merged.get(finding.id);
+        if (!previous || priority[finding.status] > priority[previous.status]) merged.set(finding.id, finding);
+      }
+      diagnostics.push(...verification.diagnostics);
+    }
+    if (newSession && session) session.initialIssues = [...merged.values()].filter((f) => f.status === "unresolved").map((f) => f.id);
+    const current = verifications.at(-1).currentAudit;
+    const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+    for (const finding of merged.values()) counts[finding.status]++;
+    if (session) diagnostics.push(...session.coverageGaps);
+    const capture = session && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
+    const after = await readInputs(ws.root);
+    const currentWs = await workspace(ws.root);
+    if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
+      throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
+    }
+    const report = {
+      version: 1,
+      status: diagnostics.length || verifications.some((v) => v.status === "incomplete") ? "incomplete" : counts.unresolved ? "issues-remain" : "verified",
+      root: ws.root,
+      branch: ws.branch,
+      head: inputs.head,
+      baselinePaths: state.baselines.map((b) => b.path),
+      reportPath: ws.directory + "/checks/" + randomUUID3() + ".json",
+      findings: [...merged.values()],
+      diagnostics: [...new Set(diagnostics)],
+      checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: current?.skippedChecks ?? [] },
+      counts,
+      capture,
+      scope: SCOPE
+    };
+    const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
+    const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
+    const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
+    const notify = !session || newSession || signature !== session.seen || continueOnce;
+    if (session) {
+      session.seen = signature;
+      if (continueOnce) session.continued = true;
+    }
+    const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+    if (!persistReport) report.reportPath = state.latest;
+    state.updatedAt = now;
+    state.fingerprint = inputs.fingerprint;
+    state.latest = report.reportPath;
+    if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
+    await writeStoreJson(ws.root, ws.directory + "/cache.json", cache.serialize());
+    await writeStoreJson(ws.root, statePath, state);
+    return { report, message: notify ? summarize(report) : null, continueOnce };
+  });
+}
+async function automationStatus(dir) {
+  const ws = await workspace(dir);
+  const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
+  if (raw === null) return { version: 1, status: "not-observed", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {} };
+  const state = stateSchema.parse(raw);
+  if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
+  const inputs = await readInputs(ws.root);
+  const latest = state.latest ? await readStoreJson(ws.root, state.latest) : null;
+  const hosts = {};
+  for (const session of Object.values(state.sessions)) {
+    const host = hosts[session.host] ??= { sessions: 0, observedEvents: [] };
+    host.sessions++;
+    host.observedEvents = [.../* @__PURE__ */ new Set([...host.observedEvents, ...Object.keys(session.events)])];
+  }
+  return {
+    version: 1,
+    status: inputs.fingerprint === state.fingerprint ? "current" : "changed",
+    root: ws.root,
+    branch: ws.branch,
+    baselinePaths: state.baselines.map((b) => b.path),
+    reportPath: state.latest,
+    verificationStatus: latest?.status ?? "unavailable",
+    hosts,
+    note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
+  };
+}
+
+// src/automation/adapters.ts
+import { z as z6 } from "zod";
+var inputSchema = z6.object({
+  cwd: z6.string().min(1),
+  session_id: z6.string().min(1).max(500),
+  hook_event_name: z6.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+  tool_name: z6.string().optional(),
+  tool_use_id: z6.string().max(500).optional(),
+  tool_input: z6.unknown().optional(),
+  stop_hook_active: z6.boolean().optional(),
+  permission_mode: z6.string().optional()
+});
+var lifecycle = {
+  SessionStart: "session_start",
+  UserPromptSubmit: "turn_start",
+  PreToolUse: "before_tool",
+  PostToolUse: "after_tool",
+  Stop: "task_end"
+};
+function normalizeHook(host, raw) {
+  hostSchema.parse(host);
+  const input2 = inputSchema.parse(raw);
+  const readOnly = host === "claude" ? /^(Read|Glob|Grep|WebSearch|WebFetch)$/ : /^(read_file|list_dir|grep_files)$/;
+  return { cwd: input2.cwd, name: input2.hook_event_name, event: {
+    event: lifecycle[input2.hook_event_name],
+    host,
+    sessionId: input2.session_id,
+    toolId: input2.tool_use_id,
+    mutating: !!input2.tool_name && !readOnly.test(input2.tool_name),
+    stopHookActive: input2.stop_hook_active || input2.permission_mode === "plan"
+  } };
+}
+async function runAutomationHook(host, stdin) {
+  let name = "";
+  try {
+    if (Buffer.byteLength(stdin) > 1024 * 1024) throw new Error("Hook input exceeds 1 MiB.");
+    const input2 = normalizeHook(host, JSON.parse(stdin));
+    name = input2.name;
+    const result = await automate(input2.cwd, input2.event);
+    if (!result.message) return null;
+    if (name === "Stop") {
+      return result.continueOnce ? { decision: "block", reason: result.message } : { systemMessage: result.message };
+    }
+    return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
+  } catch (error) {
+    const message = "Mason automation unavailable; evidence capture/verification was not established. " + (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+    return { systemMessage: message, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message } } : {} };
+  }
+}
+var HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
+function hookConfig(host, command = "npx --no-install --package mason-context mason-auto") {
+  const handler = { type: "command", command: command + " hook --host " + host, timeout: 30 };
+  return { hooks: Object.fromEntries(HOOK_EVENTS.map((name) => [
+    name,
+    [{ ...["PreToolUse", "PostToolUse"].includes(name) ? { matcher: ".*" } : {}, hooks: [{ ...handler }] }]
+  ])) };
+}
+
+// src/automation/install.ts
+import { z as z7 } from "zod";
+var groupSchema = z7.object({ hooks: z7.array(z7.object({ type: z7.string(), command: z7.string().optional() }).passthrough()) }).passthrough();
+var configSchema = z7.object({ hooks: z7.record(z7.array(groupSchema)).optional() }).passthrough();
+var recordSchema = z7.object({ version: z7.literal(1), hosts: z7.record(z7.object({ command: z7.string() })) });
+var configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+async function installAutomation(dir, host, command) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command));
+}
+async function installLocked(root, host, command) {
+  const file = configPath(host);
+  const existing = configSchema.parse(await readStoreJson(root, file) ?? {});
+  const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
+  const desired = hookConfig(host, command);
+  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
+  const previous = record.hosts[host]?.command;
+  const hooks = existing.hooks ?? {};
+  for (const event of HOOK_EVENTS) {
+    hooks[event] = (hooks[event] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && (handler.command === previous || handler.command === newCommand)))
+    })).filter((group) => group.hooks.length);
+    hooks[event].push(...desired.hooks[event]);
+  }
+  record.hosts[host] = { command: newCommand };
+  await writeStoreJson(root, file, { ...existing, hooks });
+  await writeStoreJson(root, ".mason/automation.json", record);
+  return {
+    version: 1,
+    host,
+    configPath: file,
+    status: "configured",
+    command: newCommand,
+    events: HOOK_EVENTS,
+    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
+    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
+  };
+}
+async function installedAutomation(dir) {
+  const ws = await workspace(dir);
+  const raw = await readStoreJson(ws.root, ".mason/automation.json");
+  if (raw === null) return {};
+  const record = recordSchema.parse(raw);
+  const result = {};
+  for (const host of ["claude", "codex"]) {
+    const expected = record.hosts[host];
+    if (!expected) continue;
+    const current = configSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
+    result[host] = {
+      configPath: configPath(host),
+      configuredEvents,
+      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
+      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+    };
+  }
+  return result;
+}
+
+// src/automation/cli.ts
+var USAGE = `Usage: mason-auto <install|config|status|check|hook> [options]
+
+  install --host claude|codex  Merge lifecycle hooks into this project's host config
+  config --host claude|codex   Print the host config without writing
+  status                      Read configured hooks and observed runtime events
+  check                       Capture/resume and verify retained audit evidence
+  hook --host claude|codex     Handle host JSON on stdin
+
+  --dir <path>                Project directory (defaults to cwd)
+  --command <prefix>          Installed executable prefix for install/config
+  --json                      Machine-readable check output (status always uses JSON)
+
+check exits 0 for verified checks, 1 for issues, 2 for incomplete/unavailable.
+Hooks are advisory and exit 0; a failed capture is reported explicitly.
+Local evidence is written under .mason/reports/. No LLM calls or source edits.`;
+async function runAutomationCli(argv2, stdin = "", io = {
+  out: (s) => process.stdout.write(s + "\n"),
+  err: (s) => process.stderr.write(s + "\n")
+}) {
+  try {
+    const { values, positionals } = parseArgs({ args: argv2, allowPositionals: true, options: {
+      dir: { type: "string" },
+      host: { type: "string" },
+      command: { type: "string" },
+      json: { type: "boolean" },
+      help: { type: "boolean", short: "h" }
+    } });
+    if (values.help || !positionals.length) {
+      io.out(USAGE);
+      return 0;
+    }
+    if (positionals.length !== 1) throw new Error("Expected one command.");
+    const [action] = positionals;
+    const dir = values.dir ?? process.cwd();
+    if (action === "hook") {
+      const output = await runAutomationHook(hostSchema.parse(values.host), stdin);
+      if (output) io.out(JSON.stringify(output));
+      return 0;
+    }
+    if (action === "install" || action === "config") {
+      const host = hostSchema.parse(values.host);
+      io.out(JSON.stringify(action === "install" ? await installAutomation(dir, host, values.command) : hookConfig(host, values.command), null, 2));
+      return 0;
+    }
+    if (values.host || values.command) throw new Error("--host and --command apply only to install/config/hook.");
+    if (action === "status") {
+      io.out(JSON.stringify({ ...await automationStatus(dir), configured: await installedAutomation(dir) }, null, 2));
+      return 0;
+    }
+    if (action !== "check") throw new Error("Unknown automation command: " + action);
+    const { report } = await automate(dir, { event: "task_end" });
+    io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
+    return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
+  } catch (error) {
+    const message = "Mason automation unavailable: " + (error instanceof Error ? error.message : String(error));
+    if (argv2.includes("hook")) {
+      io.out(JSON.stringify({ systemMessage: message }));
+      return 0;
+    }
+    io.err(message);
+    return 2;
+  }
+}
+
+// bin/mason-auto.ts
+var argv = process.argv.slice(2);
+var input = "";
+if (argv.includes("hook") && !argv.some((a) => a === "--help" || a === "-h") && !process.stdin.isTTY) {
+  for await (const chunk of process.stdin) {
+    input += chunk.toString();
+    if (Buffer.byteLength(input) > 1024 * 1024) break;
+  }
+}
+process.exitCode = await runAutomationCli(argv, input);
+//# sourceMappingURL=mason-auto.js.map