mason-context 0.11.0 → 0.13.0

package/dist/mason-auto.js

@@ -0,0 +1,4487 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+}
+var init_paths = __esm({
+  "src/utils/paths.ts"() {
+    "use strict";
+  }
+});
+
+// src/utils/files.ts
+import fs from "fs/promises";
+import { constants } from "fs";
+import path2 from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import fg from "fast-glob";
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
+}
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath2 = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath2, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read };
+}
+var exec, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var init_files = __esm({
+  "src/utils/files.ts"() {
+    "use strict";
+    init_paths();
+    exec = promisify(execFile);
+    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+    SOURCE_IGNORE = [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.gradle/**",
+      "**/target/**",
+      "**/.git/**",
+      "**/.mason/**",
+      "**/vendor/**",
+      "**/__pycache__/**",
+      "**/venv/**",
+      "**/.venv/**",
+      "**/*.min.*",
+      "**/*.map",
+      "**/*.lock",
+      "**/generated/**",
+      "**/*.generated.*",
+      "**/R.java",
+      "**/BuildConfig.java",
+      "**/package-lock.json",
+      "**/yarn.lock",
+      "**/pnpm-lock.yaml"
+    ];
+    MAX_SOURCE_BYTES = 1024 * 1024;
+  }
+});
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+}
+async function writeStoreJson(root, relative, value) {
+  const payload = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
+    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
+  }
+  const file = await storePath(root, relative, true);
+  const temporary = path3.join(path3.dirname(file), `.${path3.basename(file)}.${randomUUID()}.tmp`);
+  try {
+    const handle = await fs2.open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(payload, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fs2.rename(temporary, file);
+  } finally {
+    await fs2.rm(temporary, { force: true });
+  }
+}
+var init_storage = __esm({
+  "src/utils/storage.ts"() {
+    "use strict";
+    init_paths();
+    init_files();
+  }
+});
+
+// src/automation/execution.ts
+import os from "os";
+import { randomUUID as randomUUID2 } from "crypto";
+import { z } from "zod";
+function parseExecution(raw) {
+  try {
+    return executionSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation execution store; receipt history was retained.", { cause: error });
+  }
+}
+function automationFailure(error) {
+  const recorded = failureSchema.safeParse(error?.failure);
+  if (recorded.success) return recorded.data;
+  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const codes = /* @__PURE__ */ new Set();
+  let cause = error;
+  for (let i = 0; cause && i < 8; i++) {
+    codes.add(String(cause.code));
+    cause = cause.cause;
+  }
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+}
+function failureMessage(error) {
+  const failure = automationFailure(error);
+  return `Mason automation unavailable [${failure.code}]; evidence capture/verification was not established. ${failure.message}` + (failure.receiptRecorded ? "" : " No durable failure receipt was recorded.");
+}
+async function recordExecution(root, directory, event, run) {
+  const file = directory + "/execution.json";
+  const raw = await readStoreJson(root, file);
+  const log = raw === null ? { version: 1, attempts: [], discardedAttempts: 0 } : parseExecution(raw);
+  for (const attempt2 of log.attempts) if (attempt2.status === "running") attempt2.status = "unknown";
+  log.discardedAttempts += Math.max(0, log.attempts.length - 31);
+  log.attempts = log.attempts.slice(-31);
+  const started = performance.now();
+  const attempt = {
+    id: randomUUID2(),
+    event,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    pid: process.pid,
+    host: os.hostname(),
+    status: "running"
+  };
+  log.attempts.push(attempt);
+  await writeStoreJson(root, file, log);
+  try {
+    const result = await run();
+    Object.assign(attempt, {
+      status: "completed",
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs: performance.now() - started,
+      verificationStatus: result.report.status,
+      reportPath: result.report.reportPath
+    });
+    await writeStoreJson(root, file, log);
+    return result;
+  } catch (error) {
+    const failure = automationFailure(error);
+    Object.assign(attempt, { status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: performance.now() - started, failure });
+    delete attempt.verificationStatus;
+    delete attempt.reportPath;
+    try {
+      await writeStoreJson(root, file, { ...log, attempts: log.attempts.map((a) => a === attempt ? { ...a, failure: { ...failure, receiptRecorded: true } } : a) });
+      failure.receiptRecorded = true;
+    } catch {
+    }
+    throw Object.assign(new Error(failure.message, { cause: error }), { failure });
+  }
+}
+async function executionStatus(root, directory) {
+  const raw = await readStoreJson(root, directory + "/execution.json");
+  if (raw === null) return { status: "not-observed", attempts: [] };
+  const log = parseExecution(raw);
+  let lock = null;
+  if (log.attempts.some((attempt) => attempt.status === "running")) {
+    try {
+      lock = await readStoreJson(root, directory + "/lock");
+    } catch {
+    }
+  }
+  for (const attempt of log.attempts) {
+    if (attempt.status !== "running") continue;
+    let alive = false;
+    if (attempt.host === os.hostname() && lock?.pid === attempt.pid && lock.host === attempt.host) {
+      try {
+        process.kill(attempt.pid, 0);
+        alive = true;
+      } catch (error) {
+        alive = error.code === "EPERM";
+      }
+    }
+    if (!alive) attempt.status = "unknown";
+  }
+  return { status: log.attempts.at(-1)?.status ?? "not-observed", attempts: log.attempts, discardedAttempts: log.discardedAttempts };
+}
+var failureSchema, attemptSchema, executionSchema;
+var init_execution = __esm({
+  "src/automation/execution.ts"() {
+    "use strict";
+    init_storage();
+    failureSchema = z.object({
+      code: z.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z.string(),
+      retryable: z.boolean(),
+      receiptRecorded: z.boolean()
+    });
+    attemptSchema = z.object({
+      id: z.string(),
+      event: z.string(),
+      startedAt: z.string(),
+      finishedAt: z.string().optional(),
+      durationMs: z.number().nonnegative().optional(),
+      pid: z.number().int().positive(),
+      host: z.string(),
+      status: z.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z.string().optional(),
+      reportPath: z.string().optional(),
+      failure: failureSchema.optional()
+    });
+    executionSchema = z.object({ version: z.literal(1), attempts: z.array(attemptSchema).max(32), discardedAttempts: z.number().int().nonnegative().default(0) });
+  }
+});
+
+// src/test-map.ts
+import path4 from "path";
+async function buildTestMap(dir) {
+  const rootDir = path4.resolve(dir);
+  const access = await createFileAccess(rootDir);
+  const testPatterns = [
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/*Test.kt",
+    "**/*Test.java",
+    "**/*Tests.kt",
+    "**/*Tests.java",
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*_test.go",
+    "**/*Tests.swift",
+    "**/*Test.swift",
+    "**/*_test.rs"
+  ];
+  const testFiles = await access.list(testPatterns);
+  const sourceFiles = await access.list();
+  const sourceByBaseName = /* @__PURE__ */ new Map();
+  for (const file of sourceFiles) {
+    if (testFiles.includes(file)) continue;
+    const baseName = path4.basename(file).replace(/\.[^.]+$/, "");
+    const existing = sourceByBaseName.get(baseName) ?? [];
+    existing.push(file);
+    sourceByBaseName.set(baseName, existing);
+  }
+  const paired = [];
+  const unmatched = [];
+  for (const testFile of testFiles) {
+    const testBaseName = path4.basename(testFile).replace(/\.[^.]+$/, "");
+    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
+    if (!sourceName) {
+      unmatched.push(testFile);
+      continue;
+    }
+    const candidates = sourceByBaseName.get(sourceName);
+    if (candidates && candidates.length > 0) {
+      const testDir = path4.dirname(testFile);
+      const bestMatch = candidates.reduce((best, candidate) => {
+        const candidateDir = path4.dirname(candidate);
+        const bestDir = path4.dirname(best);
+        const candidateOverlap = commonSegments(testDir, candidateDir);
+        const bestOverlap = commonSegments(testDir, bestDir);
+        return candidateOverlap > bestOverlap ? candidate : best;
+      });
+      paired.push({
+        test: testFile,
+        source: bestMatch,
+        confidence: candidates.length === 1 ? "exact" : "best-guess"
+      });
+    } else {
+      unmatched.push(testFile);
+    }
+  }
+  return { totalTestFiles: testFiles.length, paired, unmatched };
+}
+function commonSegments(pathA, pathB) {
+  const segsA = pathA.split("/");
+  const segsB = pathB.split("/");
+  let count3 = 0;
+  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
+    if (segsA[i] === segsB[i]) count3++;
+    else break;
+  }
+  return count3;
+}
+var init_test_map = __esm({
+  "src/test-map.ts"() {
+    "use strict";
+    init_files();
+  }
+});
+
+// src/snapshot/snapshot.ts
+import path5 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+import { z as z2 } from "zod";
+async function inspectSnapshot(rootDir) {
+  try {
+    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
+    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
+    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
+  } catch (error) {
+    return { status: "invalid", snapshot: null, diagnostics: [{
+      path: ".mason/snapshot.json",
+      message: error instanceof Error ? error.message : String(error)
+    }] };
+  }
+}
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
+var exec2, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var init_snapshot = __esm({
+  "src/snapshot/snapshot.ts"() {
+    "use strict";
+    init_files();
+    init_files();
+    init_storage();
+    init_paths();
+    init_test_map();
+    exec2 = promisify2(execFile2);
+    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    verificationFields = {
+      refreshedHash: z2.string().optional(),
+      verifiedAt: z2.string().optional(),
+      verifiedHash: z2.string().optional(),
+      verificationFailed: z2.boolean().optional(),
+      verificationNote: z2.string().optional()
+    };
+    featureSchema = z2.object({
+      description: z2.string(),
+      files: z2.array(repoPath),
+      tests: z2.array(repoPath).optional(),
+      type: z2.enum(["capability", "infrastructure"]).optional(),
+      ...verificationFields
+    }).passthrough();
+    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z2.object({
+      version: z2.literal(2),
+      createdAt: z2.string(),
+      updatedAt: z2.string(),
+      gitHash: z2.string(),
+      features: z2.record(featureSchema),
+      flows: z2.record(flowSchema)
+    }).passthrough();
+  }
+});
+
+// src/drift/drift.ts
+import fs3 from "fs/promises";
+import path6 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  try {
+    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
+  } catch {
+    return null;
+  }
+}
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
+}
+var exec3;
+var init_drift = __esm({
+  "src/drift/drift.ts"() {
+    "use strict";
+    init_snapshot();
+    init_paths();
+    exec3 = promisify3(execFile3);
+  }
+});
+
+// src/audit/tree.ts
+function glyphIndex(line) {
+  for (const glyph of GLYPHS) {
+    const idx = line.indexOf(glyph);
+    if (idx !== -1) return idx;
+  }
+  return -1;
+}
+function isSpacerLine(line) {
+  return /^[\s│|]*$/.test(line);
+}
+function entryName(afterGlyph) {
+  let name = afterGlyph.replace(/^\s+/, "");
+  const hash2 = name.search(/\s+#/);
+  if (hash2 !== -1) name = name.slice(0, hash2);
+  const columns = name.search(/\s{2,}/);
+  if (columns !== -1) name = name.slice(0, columns);
+  name = name.trim();
+  if (!name || /\s/.test(name)) return null;
+  return name;
+}
+function extractTreeClaims(blockLines, blockStartLine) {
+  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
+  if (glyphLines < MIN_GLYPH_LINES) return [];
+  const claims = [];
+  const stack = [];
+  let rootPrefix = "";
+  let started = false;
+  for (let i = 0; i < blockLines.length; i++) {
+    const line = blockLines[i];
+    const col = glyphIndex(line);
+    if (col === -1) {
+      if (isSpacerLine(line)) continue;
+      if (!started) {
+        const candidate = line.trim();
+        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
+          rootPrefix = candidate.replace(/\/+$/, "");
+          claims.push({
+            path: rootPrefix,
+            line: blockStartLine + i,
+            excerpt: candidate
+          });
+        }
+        continue;
+      }
+      return claims;
+    }
+    started = true;
+    const name = entryName(line.slice(col + GLYPHS[0].length));
+    if (name === null) return claims;
+    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
+      stack.pop();
+    }
+    const isDir = name.endsWith("/");
+    const cleanName = name.replace(/\/+$/, "");
+    const segments = [
+      ...rootPrefix ? [rootPrefix] : [],
+      ...stack.map((s) => s.name),
+      cleanName
+    ];
+    claims.push({
+      path: segments.join("/"),
+      line: blockStartLine + i,
+      excerpt: name
+    });
+    if (isDir) stack.push({ col, name: cleanName });
+  }
+  return claims;
+}
+var MIN_GLYPH_LINES, GLYPHS;
+var init_tree = __esm({
+  "src/audit/tree.ts"() {
+    "use strict";
+    MIN_GLYPH_LINES = 3;
+    GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
+  }
+});
+
+// src/audit/claims.ts
+function normalizePathToken(token) {
+  let t = token.trim();
+  if (!t) return null;
+  if (/\s/.test(t)) return null;
+  if (t.includes("://") || t.includes("\\")) return null;
+  if (/[*?[\]{}<>$`]/.test(t)) return null;
+  if (t.startsWith("/") || t.startsWith("~") || t.startsWith("./") || t.startsWith("../")) {
+    return null;
+  }
+  t = t.replace(/:\d+(?:-\d+)?$/, "");
+  if (t.includes(":")) return null;
+  const normalized = t.replace(/\/+$/, "");
+  if (!normalized) return null;
+  if (normalized.split("/").some((seg) => /^\.+$/.test(seg))) return null;
+  if (normalized.includes("/")) return normalized;
+  return ROOT_FILE_NAMES.has(normalized) ? normalized : null;
+}
+function exactTokenPath(line) {
+  const trimmed = line.trim();
+  if (!trimmed || /\s/.test(trimmed) || !trimmed.includes("/")) return null;
+  return normalizePathToken(trimmed);
+}
+function computeIgnoredLines(lines) {
+  const ignored = new Array(lines.length).fill(false);
+  let inRegion = false;
+  let ignoreNext = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.includes(IGNORE_START)) {
+      inRegion = true;
+      ignored[i] = true;
+      continue;
+    }
+    if (line.includes(IGNORE_END)) {
+      inRegion = false;
+      ignored[i] = true;
+      continue;
+    }
+    if (inRegion) {
+      ignored[i] = true;
+      continue;
+    }
+    if (ignoreNext) {
+      if (line.trim().length === 0) continue;
+      ignored[i] = true;
+      ignoreNext = false;
+      continue;
+    }
+    if (line.includes(IGNORE_LINE)) {
+      ignored[i] = true;
+      const rest = line.replace(IGNORE_LINE, "").trim();
+      if (rest.length === 0) ignoreNext = true;
+    }
+  }
+  return ignored;
+}
+function extractClaims(content2) {
+  const lines = content2.split("\n");
+  const ignored = computeIgnoredLines(lines);
+  const paths = /* @__PURE__ */ new Map();
+  const counts = [];
+  const commands = /* @__PURE__ */ new Map();
+  const addPath = (claim) => {
+    if (!paths.has(claim.path)) paths.set(claim.path, claim);
+  };
+  const addCommand = (claim) => {
+    if (!commands.has(claim.scriptName)) commands.set(claim.scriptName, claim);
+  };
+  let inFence = false;
+  let fenceInfo = "";
+  let fenceMarker = "";
+  let blockLines = [];
+  let blockStartLine = 0;
+  const processBlock = () => {
+    for (const claim of extractTreeClaims(blockLines, blockStartLine)) {
+      addPath(claim);
+    }
+    for (let i = 0; i < blockLines.length; i++) {
+      const exact = exactTokenPath(blockLines[i]);
+      if (exact) {
+        addPath({
+          path: exact,
+          line: blockStartLine + i,
+          excerpt: blockLines[i].trim()
+        });
+      }
+    }
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    const fenceMatch = line.match(/^\s*(```+|~~~+)(.*)$/);
+    if (fenceMatch) {
+      if (!inFence) {
+        inFence = true;
+        fenceMarker = fenceMatch[1][0];
+        fenceInfo = fenceMatch[2].trim().toLowerCase();
+        blockLines = [];
+        blockStartLine = lineNo + 1;
+      } else if (fenceMatch[1][0] === fenceMarker) {
+        inFence = false;
+        processBlock();
+      }
+      continue;
+    }
+    if (inFence) {
+      blockLines.push(ignored[i] ? "" : line);
+      if (!ignored[i] && SHELL_FENCE_INFOS.has(fenceInfo)) {
+        for (const m of line.matchAll(COMMAND_RE)) {
+          addCommand({
+            scriptName: m[2],
+            invocation: m[0],
+            line: lineNo,
+            excerpt: m[0]
+          });
+        }
+      }
+      continue;
+    }
+    if (ignored[i]) continue;
+    for (const m of line.matchAll(/`([^`]+)`/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(/"([A-Za-z][\w.@-]*(?:\/[\w.@-]+)+\/?)"/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(COUNT_RE)) {
+      const rest = line.slice((m.index ?? 0) + m[0].length);
+      if (COUNT_DENYLIST_RE.test(rest)) continue;
+      counts.push({
+        count: Number.parseInt(m[1], 10),
+        unit: m[2].toLowerCase(),
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+    for (const m of line.matchAll(COMMAND_RE)) {
+      addCommand({
+        scriptName: m[2],
+        invocation: m[0],
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+  }
+  if (inFence) processBlock();
+  return {
+    paths: [...paths.values()],
+    counts,
+    commands: [...commands.values()]
+  };
+}
+var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, COMMAND_RE, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
+var init_claims = __esm({
+  "src/audit/claims.ts"() {
+    "use strict";
+    init_tree();
+    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+      "package.json",
+      "package-lock.json",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "tsup.config.ts",
+      "vitest.config.ts",
+      "Makefile",
+      "Dockerfile",
+      "docker-compose.yml",
+      "Cargo.toml",
+      "go.mod",
+      "go.sum",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "build.gradle.kts",
+      "build.gradle",
+      "manifest.json",
+      "server.json",
+      "README.md",
+      "CHANGELOG.md",
+      "LICENSE",
+      "CLAUDE.md",
+      "AGENTS.md",
+      ".gitignore",
+      ".env.example"
+    ]);
+    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+    COMMAND_RE = /\b(npm|pnpm|yarn)\s+run\s+([A-Za-z0-9:_.-]+)/g;
+    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+    IGNORE_LINE = "<!-- mason:ignore -->";
+    IGNORE_START = "<!-- mason:ignore-start -->";
+    IGNORE_END = "<!-- mason:ignore-end -->";
+  }
+});
+
+// src/audit/git.ts
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+function parseCommitLine(line) {
+  const parts = line.split("	");
+  if (parts.length < 3 || !parts[0]) return null;
+  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
+}
+async function lastCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function deletingCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      [
+        "log",
+        "-1",
+        "--diff-filter=D",
+        `--format=${COMMIT_FORMAT}`,
+        "--",
+        relPath
+      ],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function firstCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
+  if (!fromHash || fromHash === "unknown") return null;
+  try {
+    const { stdout } = await exec4(
+      "git",
+      [
+        "log",
+        `${fromHash}..HEAD`,
+        `--format=%x01${COMMIT_FORMAT}`,
+        "--name-only",
+        "--",
+        ...pathspecs
+      ],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const commits = [];
+    for (const block of stdout.split("
")) {
+      if (!block.trim()) continue;
+      const lines = block.split("\n").filter((l) => l.trim().length > 0);
+      const ref = parseCommitLine(lines[0]);
+      if (!ref) continue;
+      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
+    }
+    return { commits, total: commits.length };
+  } catch {
+    return null;
+  }
+}
+var exec4, COMMIT_FORMAT;
+var init_git = __esm({
+  "src/audit/git.ts"() {
+    "use strict";
+    exec4 = promisify4(execFile4);
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
+  }
+});
+
+// src/audit/docs.ts
+import fs4 from "fs/promises";
+import path7 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+async function isDirty(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec5(
+      "git",
+      ["status", "--porcelain", "--", relPath],
+      { cwd: resolvedRoot }
+    );
+    return stdout.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+async function discoverDocs(resolvedRoot) {
+  const docs = await Promise.all(DOC_CANDIDATES.map(async (candidate) => {
+    let content2;
+    try {
+      content2 = await fs4.readFile(path7.join(resolvedRoot, candidate), "utf-8");
+    } catch {
+      return null;
+    }
+    const [lastCommit, dirty] = await Promise.all([lastCommitOf(resolvedRoot, candidate), isDirty(resolvedRoot, candidate)]);
+    return {
+      path: candidate,
+      content: content2,
+      lineCount: content2.split("\n").length,
+      lastCommit,
+      dirty,
+      claims: extractClaims(content2)
+    };
+  }));
+  return docs.filter((doc) => doc !== null);
+}
+var exec5, DOC_CANDIDATES;
+var init_docs = __esm({
+  "src/audit/docs.ts"() {
+    "use strict";
+    init_claims();
+    init_git();
+    exec5 = promisify5(execFile5);
+    DOC_CANDIDATES = [
+      "AGENTS.md",
+      "CLAUDE.md",
+      ".claude/CLAUDE.md"
+    ];
+  }
+});
+
+// src/audit/types.ts
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
+
+// src/audit/checks/deleted-reference.ts
+import fs5 from "fs/promises";
+import path8 from "path";
+async function exists(absPath) {
+  try {
+    await fs5.access(absPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkDeletedReferences(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    const changes = ctx.changesSinceDoc.get(doc.path);
+    const renames = /* @__PURE__ */ new Map();
+    for (const change of changes ?? []) {
+      if (change.status === "renamed" && change.previousPath) {
+        renames.set(change.previousPath, change.path);
+      }
+    }
+    for (const claim of doc.claims.paths) {
+      if (claim.path === ".mason" || claim.path.startsWith(".mason/")) {
+        continue;
+      }
+      if (await exists(path8.join(ctx.root, claim.path))) continue;
+      const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
+      const renamedTo = renames.get(claim.path) ?? null;
+      if (renamedTo) {
+        result.issues.push({
+          type: "deleted-reference",
+          message: `\`${claim.path}\` was renamed to \`${renamedTo}\``,
+          anchor,
+          confidence: "certain",
+          evidence: {
+            kind: "missing-path",
+            claimed: claim.path,
+            renamedTo,
+            deletedInCommit: null,
+            everTracked: true,
+            parentDirExists: true
+          }
+        });
+        continue;
+      }
+      const tracked = await lastCommitOf(ctx.root, claim.path);
+      if (tracked) {
+        const deleted = await deletingCommitOf(ctx.root, claim.path);
+        const detail = deleted ? ` \u2013 deleted in ${deleted.hash.slice(0, 7)} "${deleted.subject}" (${deleted.date.slice(0, 10)})` : "";
+        result.issues.push({
+          type: "deleted-reference",
+          message: `\`${claim.path}\` no longer exists${detail}`,
+          anchor,
+          confidence: "certain",
+          evidence: {
+            kind: "missing-path",
+            claimed: claim.path,
+            renamedTo: null,
+            deletedInCommit: deleted,
+            everTracked: true,
+            parentDirExists: await exists(
+              path8.join(ctx.root, path8.dirname(claim.path))
+            )
+          }
+        });
+        continue;
+      }
+      const parentDirExists = await exists(
+        path8.join(ctx.root, path8.dirname(claim.path))
+      );
+      if (!parentDirExists) continue;
+      const issue = {
+        type: "deleted-reference",
+        message: `\`${claim.path}\` does not exist (never tracked in git \u2013 possible typo or invented path)`,
+        anchor,
+        confidence: "likely",
+        evidence: {
+          kind: "missing-path",
+          claimed: claim.path,
+          renamedTo: null,
+          deletedInCommit: null,
+          everTracked: false,
+          parentDirExists: true
+        }
+      };
+      result.issues.push(issue);
+    }
+  }
+  return result;
+}
+var init_deleted_reference = __esm({
+  "src/audit/checks/deleted-reference.ts"() {
+    "use strict";
+    init_git();
+    init_checks();
+  }
+});
+
+// src/audit/checks/new-module.ts
+import fg2 from "fast-glob";
+import path9 from "path";
+function escapeRegExp(text2) {
+  return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isMentioned(combinedDocs, name) {
+  const re = new RegExp(
+    `(^|[^A-Za-z0-9_-])${escapeRegExp(name)}(/|[^A-Za-z0-9_-]|$)`,
+    "im"
+  );
+  return re.test(combinedDocs);
+}
+async function listSubdirs(absDir) {
+  const dirs = await fg2("*", {
+    cwd: absDir,
+    onlyDirectories: true,
+    suppressErrors: true
+  });
+  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
+}
+async function countSourceFiles(absDir) {
+  const files = await fg2(SOURCE_GLOB, {
+    cwd: absDir,
+    ignore: SOURCE_IGNORE,
+    suppressErrors: true
+  });
+  return files.length;
+}
+async function checkNewModules(ctx) {
+  const result = emptyResult();
+  if (ctx.docs.length === 0) return result;
+  const combinedDocs = ctx.docs.map((d) => d.content).join("\n");
+  const primaryDoc = ctx.docs[0].path;
+  const checkedDocs = ctx.docs.map((d) => d.path);
+  const flag = async (dir, sourceFileCount) => {
+    result.issues.push({
+      type: "new-module",
+      message: `directory \`${dir}/\` contains ${sourceFileCount} source file${sourceFileCount === 1 ? "" : "s"} but is not mentioned in any context file`,
+      anchor: { doc: primaryDoc, line: null, excerpt: dir },
+      confidence: "likely",
+      evidence: {
+        kind: "unmentioned-dir",
+        dir,
+        sourceFileCount,
+        firstCommit: await firstCommitOf(ctx.root, dir),
+        checkedDocs
+      }
+    });
+  };
+  for (const candidate of await moduleCandidates(ctx.root, combinedDocs)) {
+    await flag(candidate.dir, candidate.sourceFileCount);
+  }
+  return result;
+}
+async function moduleCandidates(root, combinedDocs) {
+  const candidates = [];
+  for (const topDir of await listSubdirs(root)) {
+    const absTop = path9.join(root, topDir);
+    const topMentioned = isMentioned(combinedDocs, topDir);
+    if (!topMentioned) {
+      const count3 = await countSourceFiles(absTop);
+      if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
+      continue;
+    }
+    const subdirs = await listSubdirs(absTop);
+    const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
+    if (mentioned.length < ENUMERATION_THRESHOLD) continue;
+    for (const sub of subdirs) {
+      if (isMentioned(combinedDocs, sub)) continue;
+      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
+        candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
+      }
+    }
+  }
+  return candidates;
+}
+var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
+var init_new_module = __esm({
+  "src/audit/checks/new-module.ts"() {
+    "use strict";
+    init_snapshot();
+    init_git();
+    init_checks();
+    DIR_DENYLIST = /* @__PURE__ */ new Set([
+      "node_modules",
+      "dist",
+      "build",
+      "out",
+      "coverage",
+      "target",
+      "vendor",
+      "__pycache__",
+      "venv",
+      ".venv",
+      ".git",
+      ".gradle",
+      ".mason",
+      ".claude",
+      ".github",
+      ".vscode",
+      ".idea"
+    ]);
+    SECOND_LEVEL_MIN_SOURCE_FILES = 2;
+    ENUMERATION_THRESHOLD = 2;
+  }
+});
+
+// src/audit/checks/stale-count.ts
+import fs6 from "fs/promises";
+import path10 from "path";
+import fg3 from "fast-glob";
+async function readIfExists(absPath) {
+  try {
+    return await fs6.readFile(absPath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function countGradleModules(root) {
+  for (const name of ["settings.gradle.kts", "settings.gradle"]) {
+    const content2 = await readIfExists(path10.join(root, name));
+    if (content2 === null) continue;
+    const members = [];
+    for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
+      for (const proj of call[1].matchAll(/["']([^"']+)["']/g)) {
+        members.push(proj[1]);
+      }
+    }
+    if (members.length === 0) return null;
+    return { actual: members.length, countedFrom: name, members };
+  }
+  return null;
+}
+async function countNpmWorkspaces(root) {
+  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  if (pkgRaw !== null) {
+    try {
+      const pkg = JSON.parse(pkgRaw);
+      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
+      if (globs.length > 0) {
+        const matched = await fg3(
+          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+          { cwd: root, ignore: ["**/node_modules/**"] }
+        );
+        return {
+          actual: matched.length,
+          countedFrom: "package.json workspaces",
+          members: matched.map((m) => path10.dirname(m)).sort()
+        };
+      }
+    } catch {
+    }
+  }
+  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  if (pnpmRaw !== null) {
+    const globs = [];
+    let inPackages = false;
+    for (const line of pnpmRaw.split("\n")) {
+      if (/^packages\s*:/.test(line)) {
+        inPackages = true;
+        continue;
+      }
+      if (inPackages) {
+        const entry = line.match(/^\s*-\s*["']?([^"'#\s]+)/);
+        if (entry) {
+          if (!entry[1].startsWith("!")) globs.push(entry[1]);
+        } else if (line.trim().length > 0 && !line.startsWith(" ")) {
+          inPackages = false;
+        }
+      }
+    }
+    if (globs.length > 0) {
+      const matched = await fg3(
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { cwd: root, ignore: ["**/node_modules/**"] }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "pnpm-workspace.yaml",
+        members: matched.map((m) => path10.dirname(m)).sort()
+      };
+    }
+  }
+  return null;
+}
+async function countCargoCrates(root) {
+  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  if (content2 === null) return null;
+  const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
+  if (!membersBlock) return null;
+  const entries = [...membersBlock[1].matchAll(/["']([^"']+)["']/g)].map(
+    (m) => m[1]
+  );
+  if (entries.length === 0) return null;
+  const members = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (/[*?[\]{}]/.test(entry)) {
+      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        cwd: root,
+        ignore: ["**/target/**"]
+      });
+      for (const m of matched) members.add(path10.dirname(m));
+    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      members.add(entry);
+    }
+  }
+  if (members.size === 0) return null;
+  return {
+    actual: members.size,
+    countedFrom: "Cargo.toml workspace members",
+    members: [...members].sort()
+  };
+}
+async function resolveCountSource(root, claim) {
+  const unit = claim.unit.replace(/s$/, "");
+  if (unit === "module") return countGradleModules(root);
+  if (unit === "workspace") return countNpmWorkspaces(root);
+  if (unit === "crate") return countCargoCrates(root);
+  return await countNpmWorkspaces(root) ?? await countCargoCrates(root) ?? await countGradleModules(root);
+}
+async function checkStaleCounts(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    for (const claim of doc.claims.counts) {
+      const source = await resolveCountSource(ctx.root, claim);
+      if (source === null) {
+        result.skipped.push({
+          check: "stale-count",
+          doc: doc.path,
+          reason: `${doc.path}: cannot resolve a workspace manifest for "${claim.excerpt}"`
+        });
+        continue;
+      }
+      if (source.actual === claim.count) continue;
+      result.issues.push({
+        type: "stale-count",
+        message: `says "${claim.excerpt}" but ${source.countedFrom} resolves to ${source.actual}`,
+        anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
+        confidence: "certain",
+        evidence: {
+          kind: "count-mismatch",
+          claimed: claim.count,
+          actual: source.actual,
+          unit: claim.unit,
+          countedFrom: source.countedFrom,
+          members: source.members.slice(0, MEMBERS_CAP)
+        }
+      });
+    }
+  }
+  return result;
+}
+var MEMBERS_CAP;
+var init_stale_count = __esm({
+  "src/audit/checks/stale-count.ts"() {
+    "use strict";
+    init_checks();
+    MEMBERS_CAP = 50;
+  }
+});
+
+// src/audit/checks/dead-command.ts
+import fs7 from "fs/promises";
+import path11 from "path";
+import fg4 from "fast-glob";
+async function scriptsOf(absManifest) {
+  try {
+    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
+  } catch {
+    return null;
+  }
+}
+async function checkDeadCommands(ctx) {
+  const result = emptyResult();
+  const commandClaims = ctx.docs.flatMap(
+    (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
+  );
+  if (commandClaims.length === 0) return result;
+  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  if (rootScripts === null) {
+    result.skipped.push({
+      check: "dead-command",
+      reason: "no package.json at the repo root"
+    });
+    return result;
+  }
+  const rootSet = new Set(rootScripts);
+  let workspaceScripts = null;
+  let manifestsChecked = ["package.json"];
+  const loadWorkspaceScripts = async () => {
+    if (workspaceScripts !== null) return workspaceScripts;
+    workspaceScripts = /* @__PURE__ */ new Set();
+    const manifests = await commandManifests(ctx.root);
+    manifestsChecked = ["package.json", ...manifests.sort()];
+    for (const manifest of manifests) {
+      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
+      for (const name of scripts ?? []) workspaceScripts.add(name);
+    }
+    return workspaceScripts;
+  };
+  for (const { doc, claim } of commandClaims) {
+    if (rootSet.has(claim.scriptName)) continue;
+    const elsewhere = await loadWorkspaceScripts();
+    if (elsewhere.has(claim.scriptName)) continue;
+    result.issues.push({
+      type: "dead-command",
+      message: `\`${claim.invocation}\` refers to script "${claim.scriptName}", which exists in no package.json`,
+      anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
+      confidence: "certain",
+      evidence: {
+        kind: "missing-script",
+        scriptName: claim.scriptName,
+        invocation: claim.invocation,
+        manifestsChecked,
+        availableScripts: rootScripts.slice(0, AVAILABLE_SCRIPTS_CAP)
+      }
+    });
+  }
+  return result;
+}
+function commandManifests(root) {
+  return fg4("**/package.json", {
+    cwd: root,
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  });
+}
+var AVAILABLE_SCRIPTS_CAP;
+var init_dead_command = __esm({
+  "src/audit/checks/dead-command.ts"() {
+    "use strict";
+    init_checks();
+    AVAILABLE_SCRIPTS_CAP = 30;
+  }
+});
+
+// src/audit/release-metadata.ts
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+async function git(root, args) {
+  return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+}
+function withoutAndroidReleaseValues(text2) {
+  if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
+  const scopes = [];
+  const normalized = [];
+  let assignments = 0;
+  for (const line of text2.split("\n")) {
+    const code = line.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/.*$/g, (token) => token.startsWith("//") ? "" : '""');
+    const assignment = line.match(/^(\s*)(versionName|versionCode)(\s*(?:=\s*|\s+))("[A-Za-z0-9._+-]+"|'[A-Za-z0-9._+-]+'|\d+)(\s*)$/);
+    if (assignment && scopes.join("/") === "android/defaultConfig" && (assignment[2] === "versionCode" ? /^\d+$/.test(assignment[4]) : /^["']/.test(assignment[4]))) {
+      normalized.push(assignment[1] + assignment[2] + assignment[3] + "<release-value>" + assignment[5]);
+      assignments++;
+    } else {
+      if (/\bversion(?:Name|Code)\b/.test(line)) return null;
+      normalized.push(line);
+    }
+    const named = code.match(/^\s*(android|defaultConfig)\s*\{\s*$/)?.[1];
+    for (const brace of code.matchAll(/[{}]/g)) {
+      if (brace[0] === "{") scopes.push(named ?? "unknown");
+      else if (!scopes.length) return null;
+      else scopes.pop();
+    }
+  }
+  return assignments && !scopes.length ? normalized.join("\n") : null;
+}
+async function releaseMetadataOnly(root, commit) {
+  if (!commit.files.length || !commit.files.every((file) => /(^|\/)build\.gradle(?:\.kts)?$/.test(file))) return false;
+  try {
+    const parents = (await git(root, ["rev-list", "--parents", "-n", "1", commit.hash])).trim().split(/\s+/);
+    if (parents.length !== 2) return false;
+    for (const file of commit.files) {
+      const raw = await git(root, ["diff", "--raw", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", parents[1], commit.hash, "--", file]);
+      if (!/^:(100644|100755) \1 [a-f0-9]+ [a-f0-9]+ M\0/.test(raw)) return false;
+      const [before, after] = await Promise.all([
+        git(root, ["show", parents[1] + ":" + file]),
+        git(root, ["show", commit.hash + ":" + file])
+      ]);
+      const previous = withoutAndroidReleaseValues(before);
+      if (previous === null || previous !== withoutAndroidReleaseValues(after)) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+var exec6;
+var init_release_metadata = __esm({
+  "src/audit/release-metadata.ts"() {
+    "use strict";
+    exec6 = promisify6(execFile6);
+  }
+});
+
+// src/audit/checks/deps-changed.ts
+async function checkDepsChanged(ctx) {
+  const result = emptyResult();
+  result.suppressedAdvisories = [];
+  const releaseOnly = /* @__PURE__ */ new Map();
+  for (const doc of ctx.docs) {
+    if (!doc.lastCommit) {
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path} has no commit history`
+      });
+      continue;
+    }
+    if (doc.dirty) {
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+      });
+    }
+    const range = await commitsTouchingSince(
+      ctx.root,
+      doc.lastCommit.hash,
+      MANIFEST_PATHSPECS
+    );
+    if (range === null) {
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path}: commit range unreachable (shallow clone?)`
+      });
+      continue;
+    }
+    const relevant = [];
+    for (const commit of range.commits) {
+      if (!releaseOnly.has(commit.hash) && releaseOnly.size < 100) {
+        releaseOnly.set(commit.hash, await releaseMetadataOnly(ctx.root, commit));
+      }
+      if (!releaseOnly.get(commit.hash)) relevant.push(commit);
+    }
+    range.commits = relevant;
+    range.total = relevant.length;
+    if (range.total === 0) continue;
+    const latest = range.commits[0];
+    (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
+      type: "deps-changed",
+      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
+      anchor: { doc: doc.path, line: null, excerpt: null },
+      evidence: {
+        kind: "doc-behind-manifests",
+        docLastCommit: doc.lastCommit,
+        manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
+        totalCommits: range.total
+      }
+    });
+  }
+  return result;
+}
+var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
+var init_deps_changed = __esm({
+  "src/audit/checks/deps-changed.ts"() {
+    "use strict";
+    init_release_metadata();
+    init_git();
+    init_checks();
+    MANIFEST_COMMITS_CAP = 10;
+    MANIFEST_PATHSPECS = [
+      ":(glob)**/package.json",
+      ":(glob)**/build.gradle.kts",
+      ":(glob)**/build.gradle",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "gradle/libs.versions.toml",
+      ":(glob)**/Cargo.toml",
+      "go.mod",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json"
+    ];
+  }
+});
+
+// src/context/lexical.ts
+import path12 from "path";
+var init_lexical = __esm({
+  "src/context/lexical.ts"() {
+    "use strict";
+  }
+});
+
+// src/context/trust.ts
+function assessTrust(entry, freshness) {
+  const verification = entry.verificationFailed ? "failed" : entry.verifiedAt ? "passed" : "unverified";
+  const reasons = [];
+  if (freshness === "unknown") reasons.push("Anchors, history, or working-tree evidence are unavailable; verify before relying on this entry.");
+  if (freshness === "changed") reasons.push("Anchored files changed; verify against current code before relying on this entry.");
+  if (verification === "failed") reasons.push(`Verification failed: ${entry.verificationNote ?? "re-map this entry before relying on it"}`);
+  if (verification === "unverified") reasons.push("No correctness verification has been recorded.");
+  return { freshness, verification, verifiedAt: entry.verifiedAt, verifiedHash: entry.verifiedHash, reasons };
+}
+var init_trust = __esm({
+  "src/context/trust.ts"() {
+    "use strict";
+  }
+});
+
+// src/decisions/provenance.ts
+import { z as z3 } from "zod";
+function decisionContent(record) {
+  return {
+    title: record.title,
+    body: record.body,
+    category: record.category,
+    files: record.files,
+    ...typeof record.owner === "string" ? { owner: record.owner } : {},
+    sources: Array.isArray(record.sources) ? record.sources : []
+  };
+}
+function decisionApproval(record) {
+  return record.version === 1 ? "unreviewed" : record.approval;
+}
+function effectiveDecision(record) {
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  let index2 = record.history.length - 1;
+  while (index2 >= 0 && !["accepted", "reaffirmed"].includes(record.history[index2].kind)) index2--;
+  if (index2 < 0) return record;
+  const event = record.history[index2];
+  return {
+    ...record,
+    ...event.content,
+    owner: event.content.owner,
+    approval: "accepted",
+    revision: event.revision,
+    refreshedHash: event.refreshedHash,
+    updatedAt: event.at,
+    history: record.history.slice(0, index2 + 1)
+  };
+}
+function decisionProvenance(record, freshness = "unknown") {
+  const approval = decisionApproval(record);
+  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  return {
+    approval,
+    revision: record.version === 2 ? record.revision : 0,
+    owner: record.version === 2 ? record.owner ?? null : null,
+    sources: record.version === 2 ? record.sources : [],
+    guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
+    reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
+    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+  };
+}
+function decisionTrust(record, freshness) {
+  const review = decisionProvenance(record, freshness).lastReview;
+  return assessTrust(review ? { verifiedAt: review.at, verifiedHash: review.gitHash } : {}, freshness);
+}
+function revisionKnowledge(record, freshness) {
+  return { ...decisionContent(record), ...decisionProvenance(record, freshness), trust: decisionTrust(record, freshness) };
+}
+function decisionKnowledge(record, freshness = "unknown", proposalFreshness = "unknown") {
+  const effective = effectiveDecision(record);
+  return {
+    ...revisionKnowledge(effective, freshness),
+    ...effective !== record ? { pendingProposal: revisionKnowledge(record, proposalFreshness) } : {}
+  };
+}
+var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema;
+var init_provenance = __esm({
+  "src/decisions/provenance.ts"() {
+    "use strict";
+    init_paths();
+    init_trust();
+    text = (max) => z3.string().trim().min(1).max(max);
+    decisionSourceSchema = z3.object({
+      kind: z3.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+      reference: text(1e3),
+      note: text(500).optional()
+    }).strict();
+    attributionSchema = z3.object({
+      owner: text(200).nullable().optional(),
+      sources: z3.array(decisionSourceSchema).max(20).optional(),
+      actor: text(200).optional()
+    });
+    contentSchema = z3.object({
+      title: z3.string().min(1),
+      body: z3.string().min(1),
+      category: z3.enum(["decision", "gotcha", "deprecation", "convention"]),
+      files: z3.array(z3.string().refine((f) => normalizeRepoPath(f) !== null)),
+      owner: text(200).optional(),
+      sources: z3.array(decisionSourceSchema).max(20)
+    });
+    approvalSchema = z3.enum(["unreviewed", "proposed", "accepted"]);
+    statusSchema = z3.enum(["active", "superseded", "retired"]);
+    reviewEvidenceSchema = z3.object({
+      baseHash: z3.string(),
+      headHash: z3.string(),
+      historyAvailable: z3.boolean(),
+      changedFiles: z3.array(z3.string()),
+      localChanges: z3.array(z3.string())
+    });
+    eventSchema = z3.object({
+      kind: z3.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+      at: z3.string().datetime(),
+      actor: text(200).optional(),
+      note: text(1500).optional(),
+      revision: z3.number().int().positive(),
+      content: contentSchema,
+      approval: approvalSchema,
+      status: statusSchema,
+      refreshedHash: z3.string(),
+      evidence: reviewEvidenceSchema.optional()
+    });
+    legacySchema = z3.object({
+      version: z3.literal(1),
+      id: z3.string().regex(/^[a-zA-Z0-9_-]+$/),
+      title: z3.string().min(1),
+      body: z3.string().min(1),
+      category: contentSchema.shape.category,
+      files: contentSchema.shape.files,
+      createdAt: z3.string(),
+      updatedAt: z3.string(),
+      refreshedHash: z3.string(),
+      status: z3.enum(["active", "superseded"]),
+      supersededBy: z3.string().optional()
+    }).passthrough();
+    currentSchema = legacySchema.extend({
+      version: z3.literal(2),
+      status: statusSchema,
+      approval: approvalSchema,
+      revision: z3.number().int().positive(),
+      owner: text(200).optional(),
+      sources: z3.array(decisionSourceSchema).max(20),
+      history: z3.array(eventSchema).min(1)
+    }).superRefine((record, ctx) => {
+      const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+      const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+      let previous;
+      for (const event of record.history) {
+        if (!previous) {
+          if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
+          if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+        } else {
+          if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
+          if (previous.status !== "active") invalid("Archived decisions cannot be changed");
+          if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
+          if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
+          if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
+          if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+          const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
+          if (event.approval !== approval) invalid("Approval disagrees with review history");
+          if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+        }
+        if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
+        if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+        if (["accepted", "reaffirmed"].includes(event.kind)) {
+          if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
+          if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+        }
+        previous = event;
+      }
+      if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+    });
+    decisionSchema = z3.union([legacySchema, currentSchema]);
+  }
+});
+
+// src/decisions/decisions.ts
+import fs8 from "fs/promises";
+import path13 from "path";
+import { createHash } from "crypto";
+async function loadDecisionStore(rootDir) {
+  const records = [];
+  const diagnostics = [];
+  let entries;
+  try {
+    entries = await fs8.readdir(await storePath(rootDir, ".mason/decisions"));
+  } catch (error) {
+    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
+    return { records, diagnostics };
+  }
+  for (const entry of entries.sort()) {
+    if (!entry.endsWith(".json")) continue;
+    const relative = `.mason/decisions/${entry}`;
+    try {
+      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
+      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
+      records.push(record);
+    } catch (error) {
+      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { records, diagnostics };
+}
+var init_decisions = __esm({
+  "src/decisions/decisions.ts"() {
+    "use strict";
+    init_storage();
+    init_paths();
+    init_snapshot();
+    init_lexical();
+    init_provenance();
+  }
+});
+
+// src/decisions/drift.ts
+import path14 from "path";
+async function computeDecisionDrift(rootDir, decisions) {
+  const resolvedRoot = path14.resolve(rootDir);
+  const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
+  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
+  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const changesByHash = /* @__PURE__ */ new Map();
+  const inspect = async (record) => {
+    if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
+    let touched = changesByHash.get(record.refreshedHash);
+    if (touched === void 0) {
+      const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
+      touched = changes === null ? null : touchedPaths(changes);
+      changesByHash.set(record.refreshedHash, touched);
+    }
+    if (touched === null) report.historyAvailable = false;
+    const hits = touched ? matchingPaths(record.files, touched) : [];
+    const localHits = matchingPaths(record.files, workingTree.changedFiles);
+    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+  };
+  for (const record of store.records) {
+    if (record.status !== "active") continue;
+    const effective = effectiveDecision(record);
+    const state = await inspect(effective);
+    report.freshness[record.id] = state.freshness;
+    if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
+    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
+  }
+  return report;
+}
+var init_drift2 = __esm({
+  "src/decisions/drift.ts"() {
+    "use strict";
+    init_drift();
+    init_paths();
+    init_snapshot();
+    init_decisions();
+    init_provenance();
+  }
+});
+
+// src/audit/checks/decision-anchor.ts
+async function checkDecisionAnchors(ctx) {
+  const result = emptyResult();
+  if (!ctx.decisionsPresent) return result;
+  const store = await loadDecisionStore(ctx.root);
+  const records = store.records;
+  for (const diagnostic of store.diagnostics) result.skipped.push({ check: "decision-anchor-drift", reason: `${diagnostic.path}: ${diagnostic.message}` });
+  const drift = await computeDecisionDrift(ctx.root, records);
+  if (!drift.historyAvailable) {
+    result.skipped.push({
+      check: "decision-anchor-drift",
+      reason: "some decision base commits are unreachable (shallow clone?)"
+    });
+  }
+  const changed = records.flatMap((record) => [
+    { record: effectiveDecision(record), changedFiles: drift.staleDecisions[record.id] ?? [], freshness: drift.freshness?.[record.id] ?? "unknown" },
+    { record, changedFiles: drift.pendingProposals?.[record.id]?.changedFiles ?? [], freshness: drift.pendingProposals?.[record.id]?.freshness ?? "unknown" }
+  ]);
+  for (const { record, changedFiles, freshness } of changed) {
+    if (!changedFiles.length) continue;
+    const id = record.id;
+    const provenance = decisionProvenance(record, freshness);
+    result.advisories.push({
+      type: "decision-anchor-drift",
+      message: `decision "${record.title}" (${provenance.approval}) has anchor files that changed since its evidence baseline \u2013 needs human review`,
+      anchor: {
+        doc: `.mason/decisions/${id}.json`,
+        line: null,
+        excerpt: record.title
+      },
+      evidence: {
+        kind: "decision-anchor",
+        provenance,
+        decisionId: id,
+        title: record.title,
+        changedFiles,
+        refreshedHash: record.refreshedHash
+      }
+    });
+  }
+  return result;
+}
+var init_decision_anchor = __esm({
+  "src/audit/checks/decision-anchor.ts"() {
+    "use strict";
+    init_drift2();
+    init_decisions();
+    init_provenance();
+    init_checks();
+  }
+});
+
+// src/audit/checks/index.ts
+function emptyResult() {
+  return { issues: [], advisories: [], skipped: [] };
+}
+var CHECKS;
+var init_checks = __esm({
+  "src/audit/checks/index.ts"() {
+    "use strict";
+    init_deleted_reference();
+    init_new_module();
+    init_stale_count();
+    init_dead_command();
+    init_deps_changed();
+    init_decision_anchor();
+    CHECKS = {
+      "deleted-reference": checkDeletedReferences,
+      "new-module": checkNewModules,
+      "stale-count": checkStaleCounts,
+      "dead-command": checkDeadCommands,
+      "deps-changed": checkDepsChanged,
+      "decision-anchor-drift": checkDecisionAnchors
+    };
+  }
+});
+
+// src/audit/audit.ts
+import fs9 from "fs/promises";
+import path15 from "path";
+async function computeAudit(rootDir, options = {}) {
+  const resolvedRoot = path15.resolve(rootDir);
+  const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
+  if (docs.length === 0) return null;
+  const report = {
+    version: 1,
+    root: resolvedRoot,
+    gitAvailable: headHash !== "unknown",
+    headHash,
+    checksRun: [],
+    docs: docs.map((d) => ({
+      path: d.path,
+      lastCommit: d.lastCommit,
+      dirty: d.dirty,
+      lineCount: d.lineCount
+    })),
+    decisionsChecked: false,
+    issues: [],
+    advisories: [],
+    suppressedAdvisories: [],
+    skippedChecks: [],
+    clean: true
+  };
+  if (!report.gitAvailable) return report;
+  const changesSinceDoc = /* @__PURE__ */ new Map();
+  for (const doc of docs) {
+    changesSinceDoc.set(
+      doc.path,
+      doc.lastCommit ? await getChangesWithStatus(resolvedRoot, doc.lastCommit.hash) : null
+    );
+  }
+  let decisionsPresent = false;
+  try {
+    await fs9.access(path15.join(resolvedRoot, ".mason", "decisions"));
+    decisionsPresent = true;
+  } catch {
+  }
+  report.decisionsChecked = decisionsPresent;
+  const ctx = {
+    root: resolvedRoot,
+    docs,
+    headHash,
+    changesSinceDoc,
+    decisionsPresent
+  };
+  const selected = options.checks ?? ALL_CHECKS;
+  for (const name of ALL_CHECKS) {
+    if (!selected.includes(name)) continue;
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    report.checksRun.push(name);
+    report.issues.push(...issues);
+    report.advisories.push(...advisories);
+    report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
+    report.skippedChecks.push(...skipped);
+  }
+  report.clean = report.issues.length === 0;
+  return report;
+}
+var init_audit = __esm({
+  "src/audit/audit.ts"() {
+    "use strict";
+    init_drift();
+    init_snapshot();
+    init_docs();
+    init_types();
+    init_checks();
+  }
+});
+
+// src/audit/repair.ts
+import fs10 from "fs/promises";
+import path16 from "path";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
+import { z as z4 } from "zod";
+function findingId(finding) {
+  const e = finding.evidence;
+  let key;
+  switch (e.kind) {
+    case "missing-path":
+      key = e.claimed;
+      break;
+    case "unmentioned-dir":
+      key = e.dir;
+      break;
+    case "count-mismatch":
+      key = [e.unit.replace(/s$/, ""), e.countedFrom];
+      break;
+    case "missing-script":
+      key = e.scriptName;
+      break;
+    case "doc-behind-manifests":
+      key = null;
+      break;
+    case "decision-anchor":
+      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
+      break;
+  }
+  return digest([finding.type, finding.anchor.doc, key]);
+}
+function allFindings(report) {
+  return [...report.issues, ...report.advisories, ...report.suppressedAdvisories ?? []];
+}
+async function docState(root) {
+  const docs = [];
+  for (const doc of DOC_CANDIDATES) {
+    try {
+      const content2 = await readBoundedFile(await storePath(root, doc), 10 * 1024 * 1024);
+      if (content2 === null) throw new Error("Context file is not regular or exceeds 10 MiB: " + doc);
+      docs.push([doc, digest(content2)]);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      docs.push([doc, null]);
+    }
+  }
+  return digest(docs);
+}
+async function stableAudit(root, checks, options = {}) {
+  const head = await getCurrentGitHash(root);
+  const before = await docState(root);
+  const report = await computeAudit(root, { ...options, checks });
+  if (head !== await getCurrentGitHash(root) || before !== await docState(root) || report && report.headHash !== head) {
+    throw new Error("HEAD or context files changed during the audit; retry against a stable checkout.");
+  }
+  return report;
+}
+async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
+  const root = await fs10.realpath(rootDir);
+  const selected = z4.array(checkSchema).nonempty().parse(checks);
+  const report = await stableAudit(root, selected, options);
+  if (!report) throw new Error("No context files found to prepare a repair.");
+  if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
+  const storedReport = reportSchema.parse(report);
+  const payload = {
+    kind: "mason-audit-repair",
+    version: 1,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    report: storedReport
+  };
+  const baselinePath = ".mason/reports/repairs/" + randomUUID3() + ".json";
+  await writeStoreJson(root, baselinePath, { ...payload, digest: digest(payload) });
+  return { version: 1, action: "prepare", baselinePath, report };
+}
+async function verifyRepair(rootDir, baselinePath, options = {}) {
+  const root = await fs10.realpath(rootDir);
+  const declaredRoot = path16.resolve(rootDir);
+  const relative = path16.isAbsolute(baselinePath) ? path16.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const stored = baselineSchema.parse(await readStoreJson(root, relative));
+  const { digest: savedDigest, ...payload } = stored;
+  if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
+  if (stored.report.root !== root) throw new Error("Repair baseline belongs to a different repository.");
+  const original = stored.report;
+  const diagnostics = [];
+  let current = null;
+  try {
+    current = await stableAudit(root, original.checksRun, options);
+    if (!current) diagnostics.push("No context files remain available to audit.");
+    else if (!current.gitAvailable) diagnostics.push("Git history is unavailable.");
+    for (const doc of original.docs) {
+      if (!original.issues.some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path)) continue;
+      const content2 = await readBoundedFile(await storePath(root, doc.path), 10 * 1024 * 1024);
+      if (content2 === null || !content2.trim()) {
+        diagnostics.push("Original context file " + doc.path + " is empty or unreadable; losing its claims does not verify a repair.");
+      }
+    }
+    if (await getChangesWithStatus(root, original.headHash) === null) {
+      diagnostics.push("The original audit commit is unavailable; repair history cannot be verified.");
+    }
+  } catch (error) {
+    diagnostics.push(error instanceof Error ? error.message : String(error));
+  }
+  const currentById = new Map((current ? allFindings(current) : []).map((f) => [findingId(f), f]));
+  const originalFindings = allFindings(original);
+  const originalIds = new Set(originalFindings.map(findingId));
+  const missingDocs = original.docs.filter((doc) => !current?.docs.some((d) => d.path === doc.path));
+  for (const doc of missingDocs) diagnostics.push("Original context file " + doc.path + " is unavailable; removing it does not verify a repair.");
+  const findings = originalFindings.map((finding) => {
+    const id = findingId(finding);
+    const now = currentById.get(id);
+    const base = { id, original: finding, ...now ? { current: now } : {} };
+    if (diagnostics.length || !current) {
+      return { ...base, status: "unverified", reason: "The original audit scope could not be verified. See diagnostics." };
+    }
+    if ("confidence" in finding && now) {
+      return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
+    }
+    const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
+    if (!current.checksRun?.includes(finding.type) || skipped.length) {
+      return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
+    }
+    if (!("confidence" in finding)) {
+      return {
+        ...base,
+        status: "review-required",
+        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+      };
+    }
+    return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
+  });
+  const newFindings = [...currentById].filter(([id]) => !originalIds.has(id)).map(([, f]) => f);
+  const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+  for (const f of findings) counts[f.status]++;
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f));
+  const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
+  return {
+    version: 1,
+    action: "verify",
+    baselinePath: relative,
+    baselineHead: original.headHash,
+    currentHead: current?.gitAvailable ? current.headHash : null,
+    status: incomplete ? "incomplete" : issuesRemain ? "issues-remain" : "verified",
+    findings,
+    newFindings,
+    diagnostics,
+    currentAudit: current,
+    counts,
+    scope: "Original audit checks over current context files and repository evidence. Resolved means no longer detected by that check. Advisories require separate review; this is not a certification of documentation or application correctness."
+  };
+}
+var checkSchema, commitSchema, anchorSchema, count, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema, reportSchema, baselineSchema, digest;
+var init_repair = __esm({
+  "src/audit/repair.ts"() {
+    "use strict";
+    init_audit();
+    init_docs();
+    init_snapshot();
+    init_drift();
+    init_storage();
+    init_files();
+    init_paths();
+    init_types();
+    checkSchema = z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+    commitSchema = z4.object({ hash: z4.string().regex(/^[a-f0-9]{40,64}$/), date: z4.string(), subject: z4.string() });
+    anchorSchema = z4.object({ doc: z4.string(), line: z4.number().int().positive().nullable(), excerpt: z4.string().nullable() });
+    count = z4.number().int().nonnegative();
+    evidenceSchema = z4.discriminatedUnion("kind", [
+      z4.object({
+        kind: z4.literal("missing-path"),
+        claimed: z4.string(),
+        renamedTo: z4.string().nullable(),
+        deletedInCommit: commitSchema.nullable(),
+        everTracked: z4.boolean(),
+        parentDirExists: z4.boolean()
+      }),
+      z4.object({
+        kind: z4.literal("unmentioned-dir"),
+        dir: z4.string(),
+        sourceFileCount: count,
+        firstCommit: commitSchema.nullable(),
+        checkedDocs: z4.array(z4.string())
+      }),
+      z4.object({
+        kind: z4.literal("count-mismatch"),
+        claimed: count,
+        actual: count,
+        unit: z4.string(),
+        countedFrom: z4.string(),
+        members: z4.array(z4.string())
+      }),
+      z4.object({
+        kind: z4.literal("missing-script"),
+        scriptName: z4.string(),
+        invocation: z4.string(),
+        manifestsChecked: z4.array(z4.string()),
+        availableScripts: z4.array(z4.string())
+      }),
+      z4.object({
+        kind: z4.literal("doc-behind-manifests"),
+        docLastCommit: commitSchema,
+        manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
+        totalCommits: count
+      }),
+      z4.object({
+        kind: z4.literal("decision-anchor"),
+        decisionId: z4.string(),
+        title: z4.string(),
+        changedFiles: z4.array(z4.string()),
+        refreshedHash: z4.string(),
+        provenance: z4.object({}).passthrough().optional()
+      })
+    ]);
+    findingSchema = z4.object({ message: z4.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    issueSchema = findingSchema.extend({
+      type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z4.enum(["certain", "likely"])
+    });
+    advisorySchema = findingSchema.extend({ type: z4.enum(["deps-changed", "decision-anchor-drift"]) });
+    checkResultSchema = z4.object({
+      issues: z4.array(issueSchema),
+      advisories: z4.array(advisorySchema),
+      suppressedAdvisories: z4.array(advisorySchema).optional(),
+      skipped: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+    });
+    reportSchema = z4.object({
+      version: z4.literal(1),
+      root: z4.string(),
+      gitAvailable: z4.literal(true),
+      headHash: commitSchema.shape.hash,
+      checksRun: z4.array(checkSchema).nonempty(),
+      docs: z4.array(z4.object({
+        path: z4.enum(DOC_CANDIDATES),
+        lastCommit: commitSchema.nullable(),
+        dirty: z4.boolean(),
+        lineCount: count
+      })).nonempty(),
+      decisionsChecked: z4.boolean(),
+      clean: z4.boolean(),
+      issues: z4.array(issueSchema),
+      advisories: z4.array(advisorySchema),
+      suppressedAdvisories: z4.array(advisorySchema).optional(),
+      skippedChecks: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+    });
+    baselineSchema = z4.object({
+      kind: z4.literal("mason-audit-repair"),
+      version: z4.literal(1),
+      createdAt: z4.string().datetime(),
+      report: reportSchema,
+      digest: z4.string().regex(/^[a-f0-9]{64}$/)
+    });
+    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+  }
+});
+
+// src/automation/evidence.ts
+var evidence_exports = {};
+__export(evidence_exports, {
+  checkCache: () => checkCache,
+  git: () => git2,
+  hash: () => hash,
+  readInputs: () => readInputs,
+  workspace: () => workspace
+});
+import fs11 from "fs/promises";
+import path17 from "path";
+import { createHash as createHash3 } from "crypto";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
+import fg5 from "fast-glob";
+import { z as z5 } from "zod";
+async function git2(root, ...args) {
+  return (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
+}
+async function workspace(dir) {
+  const root = await fs11.realpath((await git2(dir, "rev-parse", "--show-toplevel")).trim());
+  const gitDir = await fs11.realpath((await git2(root, "rev-parse", "--absolute-git-dir")).trim());
+  let branch;
+  try {
+    branch = (await git2(root, "symbolic-ref", "--quiet", "HEAD")).trim();
+  } catch {
+    branch = "detached";
+  }
+  return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
+}
+async function content(root, file) {
+  try {
+    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function readInputs(root) {
+  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+    git2(root, "rev-parse", "HEAD"),
+    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
+    fg5("**/*", {
+      cwd: root,
+      dot: true,
+      onlyFiles: false,
+      followSymbolicLinks: false,
+      objectMode: true,
+      ignore: SOURCE_IGNORE
+    }),
+    git2(root, "rev-parse", "--git-path", "shallow"),
+    git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
+  ]);
+  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
+  const files = entries.map((f) => f.path);
+  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
+  const head = headText.trim();
+  let shallow = null;
+  try {
+    shallow = await fs11.readFile(path17.resolve(root, shallowPath.trim()), "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const docs = {};
+  const docContents = [];
+  const claims = [];
+  for (const file of DOC_CANDIDATES) {
+    const text2 = await content(root, file);
+    docs[file] = text2 === null ? null : hash(text2);
+    docContents.push([file, text2]);
+    for (const claim of text2 ? extractClaims(text2).paths : []) {
+      if (internal(claim.path) || claim.path.startsWith(".mason/")) continue;
+      const exists2 = async (p) => fs11.access(path17.resolve(root, p)).then(() => true, () => false);
+      claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
+    }
+  }
+  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
+  const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
+  const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const decisionDirectory = await storePath(root, ".mason/decisions");
+  const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
+    if (error.code === "ENOENT") return "absent";
+    throw error;
+  });
+  const [modules, counts, manifests, decisionFiles] = await Promise.all([
+    combinedDocs ? moduleCandidates(root, combinedDocs) : [],
+    Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
+    commandManifests(root),
+    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+  ]);
+  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const [status, index2] = decisions.length ? await Promise.all([
+    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
+    git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
+  ]) : ["", ""];
+  const common = [2, engineVersion, head, shallow, replacements, docContents];
+  const keys = {
+    "deleted-reference": hash([common, claims, docStatus]),
+    "new-module": hash([common, modules]),
+    "stale-count": hash([common, counts]),
+    "dead-command": hash([common, packages]),
+    "deps-changed": hash([common, docStatus]),
+    "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
+  };
+  return { fingerprint: hash(keys), head, docs, keys };
+}
+function checkCache(raw, inputs) {
+  let entries = {};
+  let diagnostic = null;
+  if (raw !== null) {
+    const parsed = cacheSchema.safeParse(raw);
+    if (parsed.success && parsed.data.digest === hash(parsed.data.entries)) entries = parsed.data.entries;
+    else diagnostic = "Discarded an invalid automation cache; checks are being recomputed.";
+  }
+  const ran = /* @__PURE__ */ new Set(), reused = /* @__PURE__ */ new Set();
+  const options = { runCheck: async (name, ctx) => {
+    if (entries[name]?.key === inputs.keys[name]) {
+      reused.add(name);
+      return structuredClone(entries[name].result);
+    }
+    const result = await CHECKS[name](ctx);
+    ran.add(name);
+    if (!result.skipped.length) entries[name] = { key: inputs.keys[name], result };
+    else delete entries[name];
+    return result;
+  } };
+  return { options, ran, reused, diagnostic, serialize: () => {
+    const canonical = cacheSchema.shape.entries.parse(entries);
+    return { version: 1, entries: canonical, digest: hash(canonical) };
+  } };
+}
+var exec7, engineVersion, hash, internal, cacheSchema;
+var init_evidence = __esm({
+  "src/automation/evidence.ts"() {
+    "use strict";
+    init_docs();
+    init_claims();
+    init_repair();
+    init_checks();
+    init_files();
+    init_new_module();
+    init_stale_count();
+    init_dead_command();
+    init_storage();
+    exec7 = promisify7(execFile7);
+    engineVersion = true ? "0.13.0" : "development";
+    hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+    internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
+    cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
+  }
+});
+
+// src/automation/store.ts
+import fs12 from "fs/promises";
+import os2 from "os";
+import { z as z6 } from "zod";
+function parseState(raw) {
+  try {
+    return stateSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+  }
+}
+async function withLock(root, directory, run) {
+  const file = await storePath(root, directory + "/lock", true);
+  const deadline = Date.now() + 5e3;
+  let handle;
+  while (!handle) {
+    try {
+      handle = await fs12.open(file, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os2.hostname() }));
+      } catch (error) {
+        await handle.close().catch(() => {
+        });
+        handle = void 0;
+        await fs12.rm(file, { force: true }).catch(() => {
+        });
+        throw error;
+      }
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const owner = JSON.parse(await fs12.readFile(file, "utf8"));
+        if (owner.host === os2.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+          try {
+            process.kill(owner.pid, 0);
+          } catch (probe) {
+            if (probe.code === "ESRCH") {
+              const reclaim = file + ".reclaim";
+              let guard;
+              try {
+                guard = await fs12.open(reclaim, "wx", 384);
+                const current = JSON.parse(await fs12.readFile(file, "utf8"));
+                if (current.pid === owner.pid && current.host === owner.host) await fs12.unlink(file);
+              } finally {
+                if (guard) {
+                  await guard.close();
+                  await fs12.rm(reclaim, { force: true });
+                }
+              }
+            }
+          }
+        }
+      } catch {
+      }
+      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
+      await new Promise((resolve) => setTimeout(resolve, 40));
+    }
+  }
+  try {
+    return await run();
+  } finally {
+    await handle.close();
+    await fs12.unlink(file);
+  }
+}
+var hostSchema, events, stateSchema;
+var init_store = __esm({
+  "src/automation/store.ts"() {
+    "use strict";
+    init_storage();
+    hostSchema = z6.enum(["claude", "codex"]);
+    events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
+    stateSchema = z6.object({
+      version: z6.literal(1),
+      root: z6.string(),
+      gitDir: z6.string(),
+      branch: z6.string(),
+      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
+      sessions: z6.record(z6.object({
+        host: hostSchema,
+        seen: z6.string().nullable(),
+        continued: z6.boolean(),
+        initialIssues: z6.array(z6.string()),
+        initialDocs: z6.record(z6.string().nullable()),
+        lastUsed: z6.string(),
+        mutationObserved: z6.boolean(),
+        pending: z6.record(z6.string()),
+        coverageGaps: z6.array(z6.string()),
+        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
+      })),
+      updatedAt: z6.string(),
+      fingerprint: z6.string().nullable(),
+      latest: z6.string().nullable()
+    });
+  }
+});
+
+// src/automation/runtime.ts
+import { randomUUID as randomUUID4 } from "crypto";
+function summarize(report) {
+  const open = report.findings.filter((f) => f.status !== "resolved");
+  return [
+    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
+    ...report.diagnostics.slice(0, 2).map(cleanText),
+    `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+  ].join("\n");
+}
+async function automate(dir, event) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ws.directory, () => recordExecution(ws.root, ws.directory, event.event, async () => {
+    const inputs = await readInputs(ws.root);
+    const statePath = ws.directory + "/state.json";
+    const raw = await readStoreJson(ws.root, statePath);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const state = raw === null ? {
+      version: 1,
+      root: ws.root,
+      gitDir: ws.gitDir,
+      branch: ws.branch,
+      baselines: [],
+      sessions: {},
+      updatedAt: now,
+      fingerprint: null,
+      latest: null
+    } : parseState(raw);
+    if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
+      throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
+    }
+    if (ws.branch === "detached" && state.latest) {
+      const previous = await readStoreJson(ws.root, state.latest);
+      if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
+      try {
+        await git2(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
+      } catch {
+        throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
+      }
+    }
+    const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
+    const newSession = key !== null && !state.sessions[key];
+    if (key && !state.sessions[key]) {
+      const keys = Object.keys(state.sessions).sort((a, b) => state.sessions[a].lastUsed.localeCompare(state.sessions[b].lastUsed));
+      for (const expired of keys.slice(0, Math.max(0, keys.length - 31))) delete state.sessions[expired];
+      state.sessions[key] = {
+        host: event.host,
+        seen: null,
+        continued: false,
+        initialIssues: [],
+        initialDocs: inputs.docs,
+        lastUsed: now,
+        mutationObserved: false,
+        pending: {},
+        coverageGaps: [],
+        events: {}
+      };
+    }
+    const session = key ? state.sessions[key] : null;
+    if (session) {
+      session.lastUsed = now;
+      session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
+      if (event.event === "before_tool" && event.mutating && event.toolId) {
+        if (Object.keys(session.pending).length >= 128) throw new Error("Too many unfinished tool calls to track pre-edit evidence.");
+        session.pending[event.toolId] = inputs.fingerprint;
+      }
+      if (event.event === "after_tool" && event.mutating) {
+        session.mutationObserved = true;
+        if (!event.toolId || !session.pending[event.toolId]) {
+          const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+          if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
+        }
+        if (event.toolId) delete session.pending[event.toolId];
+      }
+    }
+    if (!state.baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
+      const report2 = {
+        version: 1,
+        status: "unavailable",
+        root: ws.root,
+        branch: ws.branch,
+        head: inputs.head,
+        baselinePaths: [],
+        reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
+        findings: [],
+        diagnostics: ["No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md exists. Documentation capture is unavailable; other Mason tools remain usable."],
+        checks: { ran: [], reused: [], skipped: [] },
+        counts: { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 },
+        capture: "unknown",
+        scope: SCOPE
+      };
+      const notify2 = !session || session.seen !== "no-docs";
+      if (session) session.seen = "no-docs";
+      state.fingerprint = inputs.fingerprint;
+      state.latest = report2.reportPath;
+      state.updatedAt = now;
+      await writeStoreJson(ws.root, report2.reportPath, report2);
+      await writeStoreJson(ws.root, statePath, state);
+      return { report: report2, message: notify2 ? summarize(report2) : null, continueOnce: false };
+    }
+    let cached = null;
+    const diagnostics = [];
+    try {
+      cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
+    } catch {
+      diagnostics.push("Unreadable automation cache; checks are being recomputed.");
+    }
+    const cache = checkCache(cached, inputs);
+    if (cache.diagnostic) diagnostics.push(cache.diagnostic);
+    const saveBaseline = async () => {
+      if (state.baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
+      const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
+      state.baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
+    };
+    if (!state.baselines.length) await saveBaseline();
+    const verifications = [];
+    for (const baseline of state.baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
+    const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
+    if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
+      await saveBaseline();
+      verifications.push(await verifyRepair(ws.root, state.baselines.at(-1).path, cache.options));
+    }
+    const merged = /* @__PURE__ */ new Map();
+    for (const verification of verifications) {
+      for (const finding of verification.findings) {
+        const previous = merged.get(finding.id);
+        if (!previous || priority[finding.status] > priority[previous.status]) merged.set(finding.id, finding);
+      }
+      diagnostics.push(...verification.diagnostics);
+    }
+    if (newSession && session) session.initialIssues = [...merged.values()].filter((f) => f.status === "unresolved").map((f) => f.id);
+    const current = verifications.at(-1).currentAudit;
+    const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+    for (const finding of merged.values()) counts[finding.status]++;
+    if (session) diagnostics.push(...session.coverageGaps);
+    const capture = session && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
+    const after = await readInputs(ws.root);
+    const currentWs = await workspace(ws.root);
+    if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
+      throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
+    }
+    const report = {
+      version: 1,
+      status: diagnostics.length || verifications.some((v) => v.status === "incomplete") ? "incomplete" : counts.unresolved ? "issues-remain" : "verified",
+      root: ws.root,
+      branch: ws.branch,
+      head: inputs.head,
+      baselinePaths: state.baselines.map((b) => b.path),
+      reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
+      findings: [...merged.values()],
+      diagnostics: [...new Set(diagnostics)],
+      checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: current?.skippedChecks ?? [] },
+      counts,
+      capture,
+      scope: SCOPE
+    };
+    const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
+    const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
+    const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
+    const notify = !session || newSession || signature !== session.seen || continueOnce;
+    if (session) {
+      session.seen = signature;
+      if (continueOnce) session.continued = true;
+    }
+    const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+    if (!persistReport) report.reportPath = state.latest;
+    state.updatedAt = now;
+    state.fingerprint = inputs.fingerprint;
+    state.latest = report.reportPath;
+    if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
+    if (cache.ran.size || cached === null || cache.diagnostic) await writeStoreJson(ws.root, ws.directory + "/cache.json", cache.serialize());
+    await writeStoreJson(ws.root, statePath, state);
+    return { report, message: notify ? summarize(report) : null, continueOnce };
+  }));
+}
+async function automationStatus(dir) {
+  const ws = await workspace(dir);
+  const execution = await executionStatus(ws.root, ws.directory);
+  const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution };
+  const state = parseState(raw);
+  if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
+  const inputs = await readInputs(ws.root);
+  const latest = state.latest ? await readStoreJson(ws.root, state.latest) : null;
+  const hosts = {};
+  for (const session of Object.values(state.sessions)) {
+    const host = hosts[session.host] ??= { sessions: 0, observedEvents: [] };
+    host.sessions++;
+    host.observedEvents = [.../* @__PURE__ */ new Set([...host.observedEvents, ...Object.keys(session.events)])];
+  }
+  const unfinished = ["failed", "unknown", "running"].includes(execution.status);
+  return {
+    version: 1,
+    status: unfinished ? "unavailable" : inputs.fingerprint === state.fingerprint ? "current" : "changed",
+    root: ws.root,
+    branch: ws.branch,
+    baselinePaths: state.baselines.map((b) => b.path),
+    reportPath: state.latest,
+    verificationStatus: unfinished ? "unavailable" : latest?.status ?? "unavailable",
+    hosts,
+    execution,
+    note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
+  };
+}
+var SCOPE, priority, cleanText;
+var init_runtime = __esm({
+  "src/automation/runtime.ts"() {
+    "use strict";
+    init_execution();
+    init_repair();
+    init_types();
+    init_storage();
+    init_evidence();
+    init_store();
+    SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved claims no longer fail their checks; advisories need separate review. Repair only within the user's task authorization.";
+    priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
+    cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+  }
+});
+
+// src/setup/model.ts
+import { z as z7 } from "zod";
+async function loadSetup(root) {
+  const raw = await readStoreJson(root, ".mason/setup.json");
+  if (raw === null) return null;
+  return setupSchema.parse(raw);
+}
+async function loadSetupReceipt(root, directory, host) {
+  const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
+  if (raw === null) return null;
+  const receipt = receiptSchema.parse(raw);
+  if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
+  return receipt;
+}
+var runtimeSchema, setupHostSchema, setupSchema, receiptSchema;
+var init_model = __esm({
+  "src/setup/model.ts"() {
+    "use strict";
+    init_storage();
+    runtimeSchema = z7.object({
+      id: z7.string().regex(/^[a-f0-9]{24}$/),
+      version: z7.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      hashes: z7.record(z7.string().regex(/^[a-f0-9]{64}$/))
+    });
+    setupHostSchema = z7.object({
+      runtime: runtimeSchema,
+      revision: z7.string().uuid(),
+      fingerprint: z7.string(),
+      mcpFingerprint: z7.string(),
+      instructions: z7.array(z7.string())
+    });
+    setupSchema = z7.object({ version: z7.literal(1), hosts: z7.object({
+      codex: setupHostSchema.optional(),
+      claude: setupHostSchema.optional()
+    }) });
+    receiptSchema = z7.object({
+      version: z7.literal(1),
+      host: z7.enum(["codex", "claude"]),
+      status: z7.enum(["installing", "configured"]),
+      initialReportPath: z7.string(),
+      initialBaselinePaths: z7.array(z7.string()),
+      root: z7.string(),
+      revision: z7.string().uuid(),
+      configuredAt: z7.string().optional()
+    });
+  }
+});
+
+// src/setup/observations.ts
+var observations_exports = {};
+__export(observations_exports, {
+  observationPath: () => observationPath,
+  observeActivation: () => observeActivation,
+  readObservation: () => readObservation
+});
+import fs13 from "fs/promises";
+import { z as z8 } from "zod";
+function observationPath(directory, host, revision) {
+  return `${directory}/activation/${host}-${revision}.json`;
+}
+async function readObservation(root, directory, host, revision) {
+  const raw = await readStoreJson(root, observationPath(directory, host, revision));
+  if (raw === null) return null;
+  const record = observationSchema.parse(raw);
+  if (record.root !== root || record.host !== host || record.revision !== revision) throw new Error("Activation receipt belongs to another installation.");
+  return record;
+}
+async function observeActivation(dir, event, options = {}) {
+  const host = process.env.MASON_SETUP_HOST, revision = process.env.MASON_SETUP_REVISION;
+  if (host !== "codex" && host !== "claude" || !revision || !process.env.MASON_SETUP_ROOT) return null;
+  try {
+    const capturedDirectory = options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
+    const ws = capturedDirectory ? { root: await fs13.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs13.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const setup = await loadSetup(ws.root);
+    if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
+    const directory = ws.directory + "/activation";
+    await withLock(ws.root, directory, async () => {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const record = await readObservation(ws.root, ws.directory, host, revision) ?? {
+        version: 1,
+        root: ws.root,
+        revision,
+        host,
+        contextCalls: 0,
+        sessions: {}
+      };
+      if (event === "context") {
+        record.contextCalls++;
+        record.lastContextAt = now;
+      } else if (options.sessionId) {
+        const key = hash(options.sessionId);
+        const session = record.sessions[key] ?? { events: [], at: now };
+        if (event !== "task_end" && session.events.includes(event)) return;
+        session.events = [.../* @__PURE__ */ new Set([...session.events, event])];
+        session.at = now;
+        if (event === "task_end") {
+          session.verificationStatus = options.verificationStatus;
+          session.reportPath = options.reportPath;
+        }
+        record.sessions[key] = session;
+        const ordered = Object.entries(record.sessions).sort(([, a], [, b]) => b.at.localeCompare(a.at));
+        record.sessions = Object.fromEntries(ordered.slice(0, 32));
+      } else return;
+      await writeStoreJson(ws.root, observationPath(ws.directory, host, revision), record);
+    });
+    return null;
+  } catch (error) {
+    return "Mason activation observation could not be saved; activation coverage is unknown. " + (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 300);
+  }
+}
+var observationSchema;
+var init_observations = __esm({
+  "src/setup/observations.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_storage();
+    init_model();
+    observationSchema = z8.object({
+      version: z8.literal(1),
+      root: z8.string(),
+      revision: z8.string(),
+      host: z8.enum(["codex", "claude"]),
+      contextCalls: z8.number().int().nonnegative(),
+      lastContextAt: z8.string().optional(),
+      sessions: z8.record(z8.object({
+        events: z8.array(z8.enum(events)),
+        at: z8.string(),
+        verificationStatus: z8.string().optional(),
+        reportPath: z8.string().optional()
+      }))
+    });
+  }
+});
+
+// src/automation/adapters.ts
+import { z as z9 } from "zod";
+function normalizeHook(host, raw) {
+  hostSchema.parse(host);
+  const input2 = inputSchema.parse(raw);
+  const readOnly = host === "claude" ? /^(Read|Glob|Grep|WebSearch|WebFetch)$/ : /^(read_file|list_dir|grep_files)$/;
+  return { cwd: input2.cwd, name: input2.hook_event_name, event: {
+    event: lifecycle[input2.hook_event_name],
+    host,
+    sessionId: input2.session_id,
+    toolId: input2.tool_use_id,
+    mutating: !!input2.tool_name && !readOnly.test(input2.tool_name),
+    stopHookActive: input2.stop_hook_active || input2.permission_mode === "plan"
+  } };
+}
+async function runAutomationHook(host, stdin) {
+  let name = "";
+  try {
+    if (Buffer.byteLength(stdin) > 1024 * 1024) throw new Error("Hook input exceeds 1 MiB.");
+    const input2 = normalizeHook(host, JSON.parse(stdin));
+    name = input2.name;
+    const result = await automate(input2.cwd, input2.event);
+    const { observeActivation: observeActivation2 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
+    const warning = await observeActivation2(result.report.root, input2.event.event, {
+      sessionId: input2.event.sessionId,
+      verificationStatus: result.report.status,
+      reportPath: result.report.reportPath
+    });
+    if (warning) result.message = [result.message, warning].filter(Boolean).join("\n");
+    if (!result.message) return null;
+    if (name === "Stop") {
+      return result.continueOnce ? { decision: "block", reason: result.message } : { systemMessage: result.message };
+    }
+    return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
+  } catch (error) {
+    const message2 = failureMessage(error);
+    return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
+  }
+}
+function hookConfig(host, command = "npx --no-install --package mason-context mason-auto") {
+  const handler = { type: "command", command: command + " hook --host " + host, timeout: 30 };
+  return { hooks: Object.fromEntries(HOOK_EVENTS.map((name) => [
+    name,
+    [{ ...["PreToolUse", "PostToolUse"].includes(name) ? { matcher: ".*" } : {}, hooks: [{ ...handler }] }]
+  ])) };
+}
+var inputSchema, lifecycle, HOOK_EVENTS;
+var init_adapters = __esm({
+  "src/automation/adapters.ts"() {
+    "use strict";
+    init_execution();
+    init_runtime();
+    init_store();
+    inputSchema = z9.object({
+      cwd: z9.string().min(1),
+      session_id: z9.string().min(1).max(500),
+      hook_event_name: z9.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z9.string().optional(),
+      tool_use_id: z9.string().max(500).optional(),
+      tool_input: z9.unknown().optional(),
+      stop_hook_active: z9.boolean().optional(),
+      permission_mode: z9.string().optional()
+    });
+    lifecycle = {
+      SessionStart: "session_start",
+      UserPromptSubmit: "turn_start",
+      PreToolUse: "before_tool",
+      PostToolUse: "after_tool",
+      Stop: "task_end"
+    };
+    HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
+  }
+});
+
+// src/automation/install.ts
+var install_exports = {};
+__export(install_exports, {
+  automationConfigSchema: () => automationConfigSchema,
+  configPath: () => configPath,
+  installAutomation: () => installAutomation,
+  installedAutomation: () => installedAutomation,
+  planAutomationInstall: () => planAutomationInstall
+});
+import { z as z10 } from "zod";
+async function installAutomation(dir, host, command) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command));
+}
+async function planAutomationInstall(root, host, command) {
+  const file = configPath(host);
+  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
+  const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
+  const desired = hookConfig(host, command);
+  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
+  const previous = record.hosts[host]?.command;
+  const hooks = existing.hooks ?? {};
+  for (const event of HOOK_EVENTS) {
+    hooks[event] = (hooks[event] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && (handler.command === previous || handler.command === newCommand)))
+    })).filter((group) => group.hooks.length);
+    hooks[event].push(...desired.hooks[event]);
+  }
+  record.hosts[host] = { command: newCommand };
+  return { file, config: { ...existing, hooks }, record, newCommand };
+}
+async function installLocked(root, host, command) {
+  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command);
+  await writeStoreJson(root, file, config);
+  await writeStoreJson(root, ".mason/automation.json", record);
+  return {
+    version: 1,
+    host,
+    configPath: file,
+    status: "configured",
+    command: newCommand,
+    events: HOOK_EVENTS,
+    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
+    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
+  };
+}
+async function installedAutomation(dir) {
+  const ws = await workspace(dir);
+  const raw = await readStoreJson(ws.root, ".mason/automation.json");
+  if (raw === null) return {};
+  const record = recordSchema.parse(raw);
+  const result = {};
+  for (const host of ["claude", "codex"]) {
+    const expected = record.hosts[host];
+    if (!expected) continue;
+    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
+    result[host] = {
+      configPath: configPath(host),
+      configuredEvents,
+      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
+      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+    };
+  }
+  return result;
+}
+var groupSchema, automationConfigSchema, recordSchema, configPath;
+var init_install = __esm({
+  "src/automation/install.ts"() {
+    "use strict";
+    init_storage();
+    init_evidence();
+    init_adapters();
+    init_store();
+    groupSchema = z10.object({ hooks: z10.array(z10.object({ type: z10.string(), command: z10.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z10.object({ hooks: z10.record(z10.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z10.object({ version: z10.literal(1), hosts: z10.record(z10.object({ command: z10.string() })) });
+    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+  }
+});
+
+// src/mcp/init.ts
+import { z as z11 } from "zod";
+async function loadProjectMarker(rootDir) {
+  const raw = await readStoreJson(rootDir, ".mason/project.json");
+  return raw === null ? null : markerSchema.parse(raw);
+}
+async function saveProjectMarker(rootDir, marker) {
+  await writeStoreJson(rootDir, ".mason/project.json", markerSchema.parse(marker));
+}
+var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
+var init_init = __esm({
+  "src/mcp/init.ts"() {
+    "use strict";
+    init_storage();
+    markerSchema = z11.object({
+      version: z11.literal(1),
+      initializedAt: z11.string(),
+      features: z11.object({ confluence: z11.boolean().optional() }).optional()
+    }).passthrough();
+    CLAUDE_MD_SECTION = `<!-- mason:start -->
+## Mason project knowledge
+
+Mason provides recorded decisions and file impact over MCP. A concept map is optional.
+
+- Task, bug, or change request \u2192 \`get_context\` with the task text and known files: matching decisions, related tests, impact, and any available map entries.
+- Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
+- Learned something the code cannot explain (a failed approach, an incident's cause, a workaround's reason, a review-settled convention) \u2192 \`save_decision\` with rationale, anchors, and any known owner, sources, and recorder. It creates a proposal immediately without setup or a map. Never invent attribution or record code-derivable facts, session trivia, or secrets.
+- Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, and failed verification means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
+- For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
+- \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
+
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+
+- When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
+
+Inspect source for what the retrieved context does not answer.
+<!-- mason:end -->`;
+    ASSISTANT_SETUP = `UNIFIED SETUP
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, install a pinned private runtime, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason-auto status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
+
+The managed project guidance is:
+${CLAUDE_MD_SECTION}`;
+    QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
+
+1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
+2. Address findings within the user's requested scope. Setup alone authorizes the Mason runtime, host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
+
+${ASSISTANT_SETUP}
+
+OPTIONAL ARCHITECTURE MAP
+A full map adds feature and flow navigation. Build it only if the user requests it, by calling \`mason_init(dir, mode: "map")\`. Decision capture and task context do not depend on that build.`;
+    MAP_PLAYBOOK = `The user has requested a full architecture map. Follow this Map-Reduce workflow to cover the codebase. Report the audit and review findings included in this response before beginning.
+
+PHASE 1 \u2014 Map (loop until done)
+Goal: process every file in the codebase, batch by batch, producing a partial concept map per batch.
+
+  1. Call \`generate_snapshot_batch(dir)\` (omit offset on the first call).
+     The response includes:
+     - \`batchId\`: identifier for this batch
+     - \`offset\`, \`nextOffset\`, \`totalFiles\`: progress markers
+     - \`instructions\`: the system prompt for the batch step
+     - \`prompt\`: the files in this batch (skeletons + a few deeper bodies)
+  2. Following the \`instructions\`, derive features and flows that involve ONLY the files in this batch. Use product-natural feature names ("home screen", not "HomeScreenAndroid") so the reduce step can merge platform variants.
+  3. Call \`save_partial_snapshot(dir, batchId, offset, features, flows)\` to persist the partial.
+  4. If \`nextOffset\` is null, the Map phase is done. Otherwise call \`generate_snapshot_batch(dir, offset=nextOffset)\` and repeat from step 2.
+
+  Briefly tell the user "Batch N of M done" each iteration so they see progress.
+
+  CRITICAL RULES FOR PHASE 1:
+  - Derive features and file paths ONLY from what appears verbatim in the \`prompt\` field of each batch response. NEVER invent paths from memory, prior projects, or what you assume a project of this kind would contain. If you have not seen a path in a batch \`prompt\`, do not put it in \`features.files\` or \`flows.chain\`.
+  - Process batches SEQUENTIALLY: one \`generate_snapshot_batch\` \u2192 derive \u2192 one \`save_partial_snapshot\` \u2192 next \`generate_snapshot_batch\`. Do not parallelise. Do not call \`save_snapshot\` during this phase \u2014 that is a Phase 2 step.
+  - You must walk every batch until \`nextOffset\` is null. Do not stop early. Do not skip ahead to reduce until every batch has been saved as a partial.
+
+PHASE 2 \u2014 Reduce (once)
+Goal: merge all partial maps into one coherent product-shaped catalog.
+
+  1. Call \`reduce_snapshot(dir)\`. It returns every partial map plus reconciliation instructions.
+  2. Follow the instructions to produce a unified \`features\` and \`flows\` map. Specifically: merge platform variants ("home Android" + "home iOS" \u2192 "home screen"), dedupe near-duplicates, reconcile descriptions, and ensure every file from every partial appears somewhere in the final map.
+  3. Call \`save_snapshot(dir, features, flows)\` ONCE with the unified map. Mason detects that partials exist and replaces the snapshot wholesale (rather than merging with any earlier state) and then clears the partials. Do not call \`save_snapshot\` more than once per Map-Reduce run.
+
+${ASSISTANT_SETUP}
+
+If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`. Re-run \`mason_init(dir, mode: "map")\` to obtain this workflow again.`;
+  }
+});
+
+// src/review/cochange.ts
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+async function buildMatrix(resolvedRoot) {
+  try {
+    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    if (shallow.trim() === "true") return null;
+    const { stdout } = await exec8(
+      "git",
+      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
+      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
+    );
+    const commitsByFile = /* @__PURE__ */ new Map();
+    const blocks = stdout.split("
");
+    let index2 = 0;
+    for (const block of blocks) {
+      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
+      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
+      for (const file of files) {
+        let set = commitsByFile.get(file);
+        if (!set) {
+          set = /* @__PURE__ */ new Set();
+          commitsByFile.set(file, set);
+        }
+        set.add(index2);
+      }
+      index2++;
+    }
+    return { commitsByFile, totalCommits: index2 };
+  } catch {
+    return null;
+  }
+}
+async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
+  const matrix = await buildMatrix(resolvedRoot);
+  if (!matrix) return null;
+  const changedSet = new Set(allChangedFiles);
+  const findings = [];
+  for (const changedFile of changedFiles) {
+    const fileCommits = matrix.commitsByFile.get(changedFile);
+    if (!fileCommits || fileCommits.size < MIN_FILE_COMMITS) continue;
+    for (const [partner, partnerCommits] of matrix.commitsByFile) {
+      if (partner === changedFile || changedSet.has(partner)) continue;
+      let shared = 0;
+      for (const c of fileCommits) {
+        if (partnerCommits.has(c)) shared++;
+      }
+      if (shared < MIN_SHARED_COMMITS) continue;
+      const rate = shared / fileCommits.size;
+      if (rate < MIN_COCHANGE_RATE) continue;
+      if (!await existsOnDisk(partner)) continue;
+      findings.push({
+        changedFile,
+        missingPartner: partner,
+        sharedCommits: shared,
+        fileCommits: fileCommits.size,
+        rate: Math.round(rate * 100) / 100
+      });
+    }
+  }
+  findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
+  return findings;
+}
+var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var init_cochange = __esm({
+  "src/review/cochange.ts"() {
+    "use strict";
+    exec8 = promisify8(execFile8);
+    HISTORY_COMMITS = 1500;
+    MIN_FILE_COMMITS = 5;
+    MIN_SHARED_COMMITS = 4;
+    MIN_COCHANGE_RATE = 0.6;
+    MAX_COMMIT_FILES = 30;
+  }
+});
+
+// src/review/evidence/paths.ts
+function evidencePath(value, sourceRoot, uri = false) {
+  if (value.length > 4e3) return null;
+  let file = value;
+  try {
+    if (uri) {
+      if (file.startsWith("file:")) {
+        const url = new URL(file);
+        if (url.hostname && url.hostname !== "localhost") return null;
+        file = decodeURIComponent(url.pathname).replace(/^\/([A-Za-z]:\/)/, "$1");
+      } else {
+        if (/^[a-z][a-z0-9+.-]*:/i.test(file)) return null;
+        file = decodeURIComponent(file);
+      }
+    }
+  } catch {
+    return null;
+  }
+  file = file.replace(/\\/g, "/");
+  const root = sourceRoot.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (file.startsWith("/") || /^[A-Za-z]:/.test(file)) {
+    if (!file.startsWith(root + "/")) return null;
+    file = file.slice(root.length + 1);
+  }
+  return normalizeRepoPath(file);
+}
+var init_paths2 = __esm({
+  "src/review/evidence/paths.ts"() {
+    "use strict";
+    init_paths();
+  }
+});
+
+// src/review/evidence/types.ts
+function messagePreview(message2) {
+  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
+}
+var MAX_FINDINGS;
+var init_types2 = __esm({
+  "src/review/evidence/types.ts"() {
+    "use strict";
+    MAX_FINDINGS = 200;
+  }
+});
+
+// src/review/evidence/vitest.ts
+import { z as z12 } from "zod";
+function parseVitest(raw, sourceRoot) {
+  const report = schema.parse(raw);
+  const findings = [], diagnostics = [];
+  let passed = 0, failed = 0, skipped = 0;
+  for (const [index2, suite] of report.testResults.entries()) {
+    const file = evidencePath(suite.name, sourceRoot);
+    if (!file) diagnostics.push(`Test path is outside the declared checkout or invalid: ${suite.name}`);
+    let suiteFailures = 0;
+    for (const [testIndex, test] of suite.assertionResults.entries()) {
+      if (test.status === "passed") passed++;
+      else if (test.status === "failed") {
+        failed++;
+        suiteFailures++;
+        findings.push({
+          id: `${index2}:${testIndex}`,
+          ...messagePreview([test.fullName, ...test.failureMessages ?? []].join("\n")),
+          severity: "error",
+          state: "active",
+          locations: file ? [{ file, ...test.location ? { line: test.location.line, column: test.location.column } : {} }] : []
+        });
+      } else skipped++;
+    }
+    if (suite.status === "failed" && !suiteFailures) {
+      findings.push({ id: `${index2}:suite`, ...messagePreview(suite.message || `Test suite failed: ${suite.name}`), severity: "error", state: "active", locations: file ? [{ file }] : [] });
+    }
+  }
+  if (passed !== report.numPassedTests || failed !== report.numFailedTests || skipped !== report.numPendingTests + report.numTodoTests || passed + failed + skipped !== report.numTotalTests) {
+    throw new Error("Vitest summary counts disagree with its assertion results");
+  }
+  const hasFailures = failed > 0 || report.numFailedTestSuites > 0 || report.testResults.some((s) => s.status === "failed");
+  if (report.success && hasFailures) throw new Error("Vitest success conflicts with failed tests or suites");
+  const outcome = hasFailures || !report.success ? "failed" : !report.numTotalTests ? "unavailable" : !passed ? "skipped" : "passed";
+  if (!report.numTotalTests) diagnostics.push("No tests executed; an empty report is not passing test evidence.");
+  if (skipped) diagnostics.push(`${skipped} tests were skipped, pending, disabled, or todo.`);
+  return {
+    outcome,
+    findings,
+    counts: { total: report.numTotalTests, passed, failed, skipped, failedSuites: report.numFailedTestSuites },
+    incomplete: skipped > 0 || diagnostics.length > 0,
+    diagnostics
+  };
+}
+var count2, schema;
+var init_vitest = __esm({
+  "src/review/evidence/vitest.ts"() {
+    "use strict";
+    init_paths2();
+    init_types2();
+    count2 = z12.number().int().nonnegative();
+    schema = z12.object({
+      success: z12.boolean(),
+      numTotalTests: count2,
+      numPassedTests: count2,
+      numFailedTests: count2,
+      numPendingTests: count2,
+      numTodoTests: count2,
+      numFailedTestSuites: count2,
+      testResults: z12.array(z12.object({
+        name: z12.string().min(1),
+        status: z12.enum(["passed", "failed"]),
+        message: z12.string().optional(),
+        assertionResults: z12.array(z12.object({
+          fullName: z12.string(),
+          status: z12.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z12.array(z12.string()).nullable().optional(),
+          location: z12.object({ line: count2, column: count2 }).nullable().optional()
+        }))
+      }))
+    });
+  }
+});
+
+// src/review/evidence/sarif.ts
+import { z as z13 } from "zod";
+function parseSarif(raw, sourceRoot) {
+  const report = schema2.parse(raw), findings = [], diagnostics = [];
+  let active = 0, suppressed = 0, absent = 0, unresolved = 0;
+  let executed = report.runs.length > 0, executionFailed = false;
+  const reportedCommits = [], reportedCommands = [], reportedTools = [];
+  for (const [runIndex, run] of report.runs.entries()) {
+    reportedTools.push(run.tool.driver.name);
+    reportedCommits.push(...(run.versionControlProvenance ?? []).flatMap((v) => v.revisionId ? [v.revisionId] : []));
+    if (!run.invocations?.length) executed = false;
+    for (const invocation of run.invocations ?? []) {
+      if (invocation.commandLine) reportedCommands.push(invocation.commandLine);
+      if (!invocation.executionSuccessful) executionFailed = true;
+      for (const notification of invocation.toolExecutionNotifications ?? []) {
+        diagnostics.push(notification.message.text ?? notification.message.markdown ?? "SARIF tool execution notification");
+        if (notification.level === "error") executionFailed = true;
+      }
+    }
+    if (!run.results) {
+      diagnostics.push(`Run ${runIndex} omits results; analysis output is unavailable.`);
+      executed = false;
+    }
+    const resolve = (ref, seen = /* @__PURE__ */ new Set()) => {
+      if (!ref.uri && ref.index !== void 0) {
+        const key = `artifact:${ref.index}`;
+        if (seen.has(key)) return null;
+        const entry = run.artifacts?.[ref.index]?.location;
+        return entry ? resolve(entry, /* @__PURE__ */ new Set([...seen, key])) : null;
+      }
+      if (!ref.uri) return null;
+      if (!ref.uriBaseId) return ref.uri;
+      if (seen.has(ref.uriBaseId)) return null;
+      const base = run.originalUriBaseIds?.[ref.uriBaseId];
+      if (!base) return null;
+      const prefix = resolve(base, /* @__PURE__ */ new Set([...seen, ref.uriBaseId]));
+      if (!prefix) return null;
+      return /^[a-z][a-z0-9+.-]*:/i.test(ref.uri) ? ref.uri : prefix + ref.uri;
+    };
+    for (const [resultIndex, result] of (run.results ?? []).entries()) {
+      const kind = result.kind ?? "fail";
+      const isSuppressed = result.suppressions?.some((s) => s.status === "accepted");
+      if (result.suppressions?.some((s) => !s.status || s.status === "underReview")) {
+        diagnostics.push(`Suppression state unresolved for result ${runIndex}:${resultIndex}.`);
+        unresolved++;
+      }
+      const state = result.baselineState === "absent" ? "absent" : isSuppressed ? "suppressed" : kind === "fail" ? "active" : "informational";
+      if (state === "active") active++;
+      if (state === "absent") absent++;
+      if (state === "suppressed") suppressed++;
+      if (["open", "review"].includes(kind) && state === "informational") {
+        unresolved++;
+        diagnostics.push(`Result ${runIndex}:${resultIndex} needs further analysis or review.`);
+      }
+      if (kind === "pass" || kind === "notApplicable") continue;
+      const rule = result.ruleIndex !== void 0 ? run.tool.driver.rules?.[result.ruleIndex] : run.tool.driver.rules?.find((rule2) => rule2.id === result.ruleId);
+      const template = result.message.id ? rule?.messageStrings?.[result.message.id] ?? run.tool.driver.globalMessageStrings?.[result.message.id] : void 0;
+      const rawMessage = result.message.text ?? result.message.markdown ?? template?.text ?? template?.markdown;
+      if (!rawMessage) diagnostics.push(`Message cannot be resolved for result ${runIndex}:${resultIndex}.`);
+      const rendered = (rawMessage ?? `Unresolved SARIF message ${result.message.id ?? ""}`).replace(/\{(\d+)\}/g, (match, n) => result.message.arguments?.[Number(n)] ?? match);
+      const locations = [];
+      for (const entry of [...result.locations ?? [], ...result.relatedLocations ?? []]) {
+        const ref = entry.physicalLocation?.artifactLocation;
+        const uri = ref ? resolve(ref) : null;
+        const file = uri ? evidencePath(uri, sourceRoot, true) : null;
+        if (file) locations.push({ file, line: entry.physicalLocation?.region?.startLine, column: entry.physicalLocation?.region?.startColumn });
+        else diagnostics.push(`Unresolved or out-of-checkout location for result ${runIndex}:${resultIndex}.`);
+      }
+      const severity = result.level ?? rule?.defaultConfiguration?.level ?? (kind === "fail" ? "warning" : "none");
+      findings.push({ id: `${runIndex}:${resultIndex}`, ruleId: result.ruleId ?? rule?.id, ...messagePreview(rendered), severity: severity === "none" ? "note" : severity, state, locations });
+    }
+  }
+  if (!report.runs.length) diagnostics.push("SARIF contains no analysis runs.");
+  if (executionFailed) diagnostics.push("The SARIF tool reported an unsuccessful analysis invocation.");
+  return {
+    outcome: executionFailed || !report.runs.length || report.runs.some((r) => !r.results) ? "unavailable" : active ? "failed" : "passed",
+    findings,
+    counts: { active, suppressed, absent, unresolved },
+    incomplete: diagnostics.length > 0,
+    diagnostics,
+    reportedCommits,
+    reportedCommands,
+    reportedTools,
+    executed: executed && !executionFailed
+  };
+}
+var index, artifact, message, level, location, schema2;
+var init_sarif = __esm({
+  "src/review/evidence/sarif.ts"() {
+    "use strict";
+    init_paths2();
+    init_types2();
+    index = z13.number().int().nonnegative();
+    artifact = z13.object({ uri: z13.string().optional(), uriBaseId: z13.string().optional(), index: index.optional() });
+    message = z13.object({ text: z13.string().optional(), markdown: z13.string().optional(), id: z13.string().optional(), arguments: z13.array(z13.string()).optional() });
+    level = z13.enum(["error", "warning", "note", "none"]);
+    location = z13.object({ physicalLocation: z13.object({ artifactLocation: artifact.optional(), region: z13.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z13.object({
+      version: z13.literal("2.1.0"),
+      runs: z13.array(z13.object({
+        tool: z13.object({ driver: z13.object({ name: z13.string().min(1), rules: z13.array(z13.object({ id: z13.string(), defaultConfiguration: z13.object({ level: level.optional() }).optional(), messageStrings: z13.record(message).optional() })).optional(), globalMessageStrings: z13.record(message).optional() }) }),
+        invocations: z13.array(z13.object({ executionSuccessful: z13.boolean(), commandLine: z13.string().optional(), toolExecutionNotifications: z13.array(z13.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z13.array(z13.object({ revisionId: z13.string().optional() })).optional(),
+        originalUriBaseIds: z13.record(artifact).optional(),
+        artifacts: z13.array(z13.object({ location: artifact.optional() })).optional(),
+        results: z13.array(z13.object({
+          ruleId: z13.string().optional(),
+          ruleIndex: index.optional(),
+          message,
+          level: level.optional(),
+          kind: z13.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z13.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z13.array(z13.object({ kind: z13.enum(["inSource", "external"]), status: z13.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z13.array(location).optional(),
+          relatedLocations: z13.array(location).optional()
+        })).optional()
+      }))
+    });
+  }
+});
+
+// src/review/evidence.ts
+import path18 from "path";
+import { z as z14 } from "zod";
+function relativeArtifact(root, file) {
+  const relative = path18.isAbsolute(file) ? path18.relative(root, file) : file;
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
+  return normalized;
+}
+function linkFinding(finding, changed, pairs, decisions, freshness) {
+  const located = [...new Set(finding.locations.map((l) => l.file))];
+  const paired = pairs.filter((pair) => located.includes(pair.test));
+  const relatedChangedFiles = located.filter((file) => changed.has(file)).map((file) => ({ file, relationship: "direct" }));
+  for (const pair of paired) {
+    if (changed.has(pair.source) && !relatedChangedFiles.some((f) => f.file === pair.source)) relatedChangedFiles.push({ file: pair.source, relationship: "paired-test", confidence: pair.confidence });
+  }
+  const allFiles = [.../* @__PURE__ */ new Set([...located, ...paired.map((pair) => pair.source)])];
+  const acceptedDecisions = decisions.map(effectiveDecision).filter((d) => d.status === "active" && decisionApproval(d) === "accepted").map((d) => ({ d, viaFiles: matchingPaths(d.files, allFiles) })).filter((match) => match.viaFiles.length).map(({ d, viaFiles }) => {
+    const state = freshness[d.id] ?? "unknown", provenance = decisionProvenance(d, state);
+    return { id: d.id, title: d.title, owner: provenance.owner, freshness: state, reviewRequired: provenance.reviewRequired, viaFiles };
+  });
+  return { ...finding, relatedChangedFiles, acceptedDecisions: acceptedDecisions.slice(0, 5), totalAcceptedDecisions: acceptedDecisions.length };
+}
+async function collectReviewEvidence(root, manifests, changedFiles, decisions, decisionFreshness = {}, reviewedHead) {
+  const [headHash, workingTree] = await Promise.all([reviewedHead ?? getCurrentGitHash(root), getWorkingTree(root)]);
+  const output = {
+    version: 1,
+    scope: "committed",
+    headHash,
+    status: "unavailable",
+    checks: [],
+    diagnostics: [],
+    workingTree,
+    summary: { passed: 0, failed: 0, skipped: 0, unavailable: 0, stale: 0, unknown: 0 },
+    hint: "Evidence describes the recorded check runs for a commit, not uncommitted edits or complete test coverage. Commands and CI provenance are imported assertions, not authenticated execution. File and test-pair associations identify relevant decisions; they do not prove a decision was violated. Missing checks must be declared in the manifest to be reported."
+  };
+  const seen = /* @__PURE__ */ new Set(), changed = new Set(changedFiles);
+  let pairs;
+  if (manifests.length > 10) output.diagnostics.push("Only the first 10 evidence manifests were imported.");
+  for (const supplied of manifests.slice(0, 10)) {
+    let manifest, raw;
+    try {
+      manifest = relativeArtifact(root, supplied);
+      raw = z14.object({ version: z14.literal(1), checks: z14.array(z14.unknown()) }).parse(await readStoreJson(root, manifest));
+    } catch (error) {
+      output.diagnostics.push(`${supplied}: ${String(error)}`);
+      continue;
+    }
+    if (!raw.checks.length) output.diagnostics.push(`${manifest}: no checks declared.`);
+    for (const [index2, item] of raw.checks.entries()) {
+      if (output.checks.length >= 50) {
+        output.diagnostics.push("Only the first 50 checks were imported.");
+        break;
+      }
+      const input2 = checkSchema2.safeParse(item);
+      if (!input2.success) {
+        output.diagnostics.push(`${manifest} check ${index2}: ${input2.error.message}`);
+        continue;
+      }
+      const check = input2.data;
+      if (seen.has(check.id)) {
+        output.diagnostics.push(`Duplicate check id ${check.id}; give different runs distinct ids.`);
+        continue;
+      }
+      seen.add(check.id);
+      const result = {
+        id: check.id,
+        kind: check.kind,
+        tool: check.tool,
+        command: check.command,
+        commit: check.commit?.toLowerCase() ?? null,
+        workingTreeClean: check.workingTreeClean ?? null,
+        source: check.source ?? null,
+        manifest,
+        report: check.report ?? null,
+        outcome: "unavailable",
+        freshness: "unknown",
+        findings: [],
+        totalFindings: 0,
+        counts: {},
+        incomplete: false,
+        diagnostics: [],
+        truncated: false
+      };
+      output.checks.push(result);
+      if (check.workingTreeClean !== true) result.diagnostics.push("The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone.");
+      else if (result.commit && headHash !== "unknown") result.freshness = result.commit === headHash.toLowerCase() ? "current" : "stale";
+      else result.diagnostics.push("The tested commit or reviewed HEAD is unknown.");
+      if (check.status !== "completed") {
+        result.outcome = check.status;
+        result.diagnostics.push(check.reason ?? "No reason was recorded for this skipped or unavailable check.");
+        continue;
+      }
+      try {
+        if (!check.report) throw new Error("Completed check has no report artifact.");
+        if (check.kind === "tests" !== (check.report.format === "vitest-json")) throw new Error("Test checks require vitest-json; analysis checks require sarif.");
+        const file = relativeArtifact(root, check.report.path);
+        const report = await readStoreJson(root, file);
+        if (report === null) throw new Error(`Report artifact is missing: ${file}`);
+        const sourceRoot = check.sourceRoot ?? root;
+        if (!path18.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
+        result.outcome = parsed.outcome;
+        result.counts = parsed.counts;
+        result.incomplete = parsed.incomplete;
+        result.diagnostics.push(...parsed.diagnostics);
+        result.reportedCommands = parsed.reportedCommands;
+        result.reportedTools = parsed.reportedTools;
+        if (parsed.reportedCommits?.some((commit) => !result.commit || commit.toLowerCase() !== result.commit)) {
+          result.freshness = "unknown";
+          result.incomplete = true;
+          result.diagnostics.push("Report revision metadata conflicts with, or cannot be tied to, the manifest's tested commit.");
+        }
+        if (check.exitCode == null && !parsed.executed) {
+          result.incomplete = true;
+          result.diagnostics.push("Neither an exit code nor successful analysis invocation was recorded; completion cannot be confirmed.");
+        }
+        if (check.exitCode != null && check.exitCode !== 0 && result.outcome === "passed") {
+          result.outcome = "failed";
+          result.diagnostics.push(`Check command exited ${check.exitCode} despite a report with no active failures.`);
+        }
+        if (check.report.format === "vitest-json" && pairs === void 0) {
+          try {
+            pairs = (await buildTestMap(root)).paired;
+          } catch (error) {
+            pairs = [];
+            output.diagnostics.push(`Test pairing unavailable: ${String(error)}`);
+          }
+        }
+        result.totalFindings = parsed.findings.length;
+        const testPairs = check.kind === "tests" ? pairs ?? [] : [];
+        const relevant = /* @__PURE__ */ new Set([...changed, ...testPairs.filter((p) => changed.has(p.source)).map((p) => p.test)]);
+        const touchesChange = (f) => f.locations.some((l) => relevant.has(l.file));
+        parsed.findings.sort((a, b) => Number(b.state === "active") - Number(a.state === "active") || Number(touchesChange(b)) - Number(touchesChange(a)));
+        result.findings = parsed.findings.slice(0, MAX_FINDINGS).map((f) => linkFinding(f, changed, testPairs, decisions, decisionFreshness));
+        result.truncated = parsed.findings.length > MAX_FINDINGS || result.findings.some((f) => f.truncated || f.totalAcceptedDecisions > f.acceptedDecisions.length);
+      } catch (error) {
+        result.outcome = "unavailable";
+        result.incomplete = true;
+        result.diagnostics.push(String(error));
+      }
+    }
+  }
+  if (!output.checks.length) output.diagnostics.push("No readable checks were imported.");
+  for (const check of output.checks) {
+    output.summary[check.outcome]++;
+    if (check.freshness !== "current") output.summary[check.freshness]++;
+  }
+  if (output.checks.some((c) => c.outcome === "failed" && c.freshness === "current")) output.status = "failed";
+  else if (!output.checks.length || output.checks.every((c) => c.outcome === "unavailable")) output.status = "unavailable";
+  else if (output.diagnostics.length || output.checks.some((c) => c.outcome !== "passed" || c.freshness !== "current" || c.incomplete)) output.status = "incomplete";
+  else output.status = "passed";
+  return output;
+}
+function summarizeEvidence(evidence) {
+  const previews = (values, limit) => values.slice(0, limit).map((value) => value.slice(0, 2e3));
+  const checks = evidence.checks.slice(0, 10).map((check) => {
+    const findings = check.findings.slice(0, 5).map((finding) => ({
+      ...finding,
+      ruleId: finding.ruleId?.slice(0, 200),
+      locations: finding.locations.slice(0, 5),
+      totalLocations: finding.locations.length,
+      relatedChangedFiles: finding.relatedChangedFiles.slice(0, 5),
+      totalRelatedChangedFiles: finding.relatedChangedFiles.length,
+      acceptedDecisions: finding.acceptedDecisions.map((decision) => ({ ...decision, viaFiles: decision.viaFiles.slice(0, 5) })),
+      truncated: finding.truncated || finding.locations.length > 5 || finding.relatedChangedFiles.length > 5 || (finding.ruleId?.length ?? 0) > 200 || finding.acceptedDecisions.some((d) => d.viaFiles.length > 5)
+    }));
+    return {
+      ...check,
+      findings,
+      reportedCommands: check.reportedCommands ? previews(check.reportedCommands, 5) : void 0,
+      reportedTools: check.reportedTools ? previews(check.reportedTools, 5) : void 0,
+      diagnostics: previews(check.diagnostics, 10),
+      truncated: check.truncated || check.findings.length > 5 || findings.some((f) => f.truncated) || check.diagnostics.length > 10 || check.diagnostics.some((d) => d.length > 2e3) || [check.reportedCommands ?? [], check.reportedTools ?? []].some((values) => values.length > 5 || values.some((v) => v.length > 2e3))
+    };
+  });
+  return {
+    ...evidence,
+    checks,
+    diagnostics: previews(evidence.diagnostics, 20),
+    truncated: evidence.checks.length > 10 || evidence.diagnostics.length > 20 || evidence.diagnostics.some((d) => d.length > 2e3) || checks.some((c) => c.truncated)
+  };
+}
+var checkSchema2;
+var init_evidence2 = __esm({
+  "src/review/evidence.ts"() {
+    "use strict";
+    init_storage();
+    init_paths();
+    init_snapshot();
+    init_drift();
+    init_test_map();
+    init_provenance();
+    init_vitest();
+    init_sarif();
+    init_types2();
+    checkSchema2 = z14.object({
+      id: z14.string().min(1).max(100),
+      kind: z14.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z14.string().min(1).max(200),
+      command: z14.string().min(1).max(2e3),
+      commit: z14.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z14.boolean().optional(),
+      source: z14.string().max(2e3).optional(),
+      sourceRoot: z14.string().min(1).max(4e3).optional(),
+      status: z14.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z14.string().min(1).max(2e3).optional(),
+      exitCode: z14.number().int().nullable().optional(),
+      report: z14.object({ format: z14.enum(["vitest-json", "sarif"]), path: z14.string().min(1).max(4e3) }).optional()
+    });
+  }
+});
+
+// src/review/review.ts
+import fs14 from "fs/promises";
+import path19 from "path";
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+async function resolveMergeBase(resolvedRoot, base, head) {
+  try {
+    const { stdout } = await exec9("git", ["merge-base", base, head], {
+      cwd: resolvedRoot
+    });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function defaultBase(resolvedRoot) {
+  for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
+    try {
+      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+        cwd: resolvedRoot
+      });
+      return ref;
+    } catch {
+    }
+  }
+  return null;
+}
+function anchorsTouched(record, changedFiles) {
+  return matchingPaths(record.files, changedFiles);
+}
+async function computeReview(rootDir, base, options = {}) {
+  const resolvedRoot = path19.resolve(rootDir);
+  const head = await getCurrentGitHash(resolvedRoot);
+  if (head === "unknown") return null;
+  const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
+  if (!mergeBase) return null;
+  const changes = await getChangesWithStatus(resolvedRoot, mergeBase, head);
+  if (changes === null) return null;
+  const changedFiles = touchedPaths(changes);
+  const report = {
+    version: 1,
+    root: resolvedRoot,
+    base,
+    mergeBase,
+    changedFiles,
+    missingPartners: [],
+    touchedDecisions: [],
+    historyAvailable: true,
+    truncated: false
+  };
+  const store = await loadDecisionStore(resolvedRoot);
+  report.diagnostics = store.diagnostics;
+  const decisionDrift = await computeDecisionDrift(resolvedRoot, store.records);
+  if (options.evidence !== void 0) {
+    report.evidence = await collectReviewEvidence(resolvedRoot, options.evidence, changedFiles, store.records, decisionDrift.freshness, head);
+    if (store.diagnostics.length) {
+      report.evidence.diagnostics.push("Invalid decision records make knowledge associations incomplete; consult review diagnostics.");
+      if (report.evidence.status === "passed") report.evidence.status = "incomplete";
+    }
+  }
+  const finalize = async () => {
+    if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
+      report.evidence.diagnostics.push("HEAD changed during the review; rerun to obtain consistent change and knowledge associations.");
+      for (const check of report.evidence.checks) check.freshness = "unknown";
+      report.evidence.summary.stale = 0;
+      report.evidence.summary.unknown = report.evidence.checks.length;
+      if (report.evidence.status !== "unavailable") report.evidence.status = "incomplete";
+    }
+    return report;
+  };
+  if (changedFiles.length === 0) return finalize();
+  let analyzed = changedFiles;
+  if (changedFiles.length > MAX_ANALYZED_FILES) {
+    analyzed = changedFiles.slice(0, MAX_ANALYZED_FILES);
+    report.truncated = true;
+  }
+  const partners = await findMissingPartners(
+    resolvedRoot,
+    analyzed,
+    async (relPath) => {
+      try {
+        await fs14.access(path19.join(resolvedRoot, relPath));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    changedFiles
+  );
+  if (partners === null) {
+    report.historyAvailable = false;
+  } else {
+    report.missingPartners = partners;
+  }
+  const decisions = store.records;
+  for (const record of decisions) {
+    if (record.status !== "active") continue;
+    const effective = effectiveDecision(record);
+    const touched = anchorsTouched(effective, changedFiles);
+    const proposalTouched = effective !== record ? anchorsTouched(record, changedFiles) : [];
+    if (touched.length > 0 || proposalTouched.length > 0) {
+      const { pendingProposal, ...knowledge } = decisionKnowledge(record, decisionDrift.freshness?.[record.id] ?? "unknown", decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown");
+      report.touchedDecisions.push({
+        ...knowledge,
+        ...pendingProposal ? { pendingProposal: { ...pendingProposal, touchedFiles: proposalTouched } } : {},
+        id: record.id,
+        anchors: effective.files,
+        freshness: decisionDrift.freshness?.[record.id] ?? "unknown",
+        touchedFiles: touched
+      });
+    }
+  }
+  return finalize();
+}
+var exec9, MAX_ANALYZED_FILES;
+var init_review = __esm({
+  "src/review/review.ts"() {
+    "use strict";
+    init_drift();
+    init_provenance();
+    init_decisions();
+    init_paths();
+    init_drift2();
+    init_cochange();
+    init_evidence2();
+    init_snapshot();
+    exec9 = promisify9(execFile9);
+    MAX_ANALYZED_FILES = 50;
+  }
+});
+
+// src/mcp/onboarding.ts
+async function auditSummary(root) {
+  try {
+    const report = await computeAudit(root);
+    if (!report) return { status: "no-context-files", reason: "No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md found to audit." };
+    if (!report.gitAvailable) return { status: "unavailable", reason: "Audit needs readable Git history to verify documentation claims.", docs: report.docs };
+    return {
+      ...report,
+      status: "complete",
+      issues: report.issues.slice(0, MAX_FINDINGS2),
+      advisories: report.advisories.slice(0, MAX_FINDINGS2),
+      suppressedAdvisories: (report.suppressedAdvisories ?? []).slice(0, MAX_FINDINGS2),
+      counts: {
+        issues: report.issues.length,
+        advisories: report.advisories.length,
+        suppressedAdvisories: report.suppressedAdvisories?.length ?? 0
+      },
+      truncated: report.issues.length > MAX_FINDINGS2 || report.advisories.length > MAX_FINDINGS2 || (report.suppressedAdvisories?.length ?? 0) > MAX_FINDINGS2
+    };
+  } catch (error) {
+    return { status: "unavailable", reason: reason(error) };
+  }
+}
+async function reviewSummary(root, requestedBase, evidence) {
+  const workingTree = await getWorkingTree(root);
+  const scope = "committed";
+  try {
+    const base = requestedBase ?? await defaultBase(root);
+    if (!base) return { status: "unavailable", scope, workingTree, reason: "No default review base resolves. Pass base to mason_init, or run mason-review --base <ref>." };
+    const report = await computeReview(root, base, { evidence });
+    if (!report) return { status: "unavailable", scope, base, workingTree, reason: "The review base, merge base, or committed diff could not be read." };
+    return {
+      ...report,
+      scope,
+      workingTree,
+      ...report.evidence ? { evidence: summarizeEvidence(report.evidence) } : {},
+      status: !report.historyAvailable ? "unavailable" : report.changedFiles.length ? "complete" : "no-changes",
+      ...!report.historyAvailable ? { reason: "Co-change history could not be read; review findings are incomplete." } : {},
+      changedFiles: report.changedFiles.slice(0, MAX_FINDINGS2),
+      missingPartners: report.missingPartners.slice(0, MAX_FINDINGS2),
+      touchedDecisions: report.touchedDecisions.slice(0, MAX_FINDINGS2),
+      counts: { changedFiles: report.changedFiles.length, missingPartners: report.missingPartners.length, touchedDecisions: report.touchedDecisions.length },
+      truncated: report.truncated || [report.changedFiles, report.missingPartners, report.touchedDecisions].some((list) => list.length > MAX_FINDINGS2),
+      hint: "Reviews cover merge-base..HEAD. Uncommitted paths are reported separately in workingTree; they have not been reviewed."
+    };
+  } catch (error) {
+    return { status: "unavailable", scope, workingTree, reason: reason(error) };
+  }
+}
+async function inspectOnboarding(root, base, evidence) {
+  const [audit, review, map, decisions] = await Promise.all([
+    auditSummary(root),
+    reviewSummary(root, base, evidence),
+    inspectSnapshot(root),
+    loadDecisionStore(root)
+  ]);
+  return {
+    audit,
+    review,
+    map: { status: map.status },
+    decisions: {
+      active: decisions.records.filter((record) => record.status === "active").length,
+      ...Object.fromEntries(["accepted", "proposed", "unreviewed"].map((approval) => [approval, decisions.records.filter((record) => record.status === "active" && decisionApproval(effectiveDecision(record)) === approval).length])),
+      pendingProposals: decisions.records.filter((record) => effectiveDecision(record) !== record).length
+    },
+    diagnostics: [...map.diagnostics, ...decisions.diagnostics]
+  };
+}
+var MAX_FINDINGS2, reason;
+var init_onboarding = __esm({
+  "src/mcp/onboarding.ts"() {
+    "use strict";
+    init_audit();
+    init_review();
+    init_drift();
+    init_snapshot();
+    init_provenance();
+    init_evidence2();
+    init_decisions();
+    MAX_FINDINGS2 = 20;
+    reason = (error) => error instanceof Error ? error.message : String(error);
+  }
+});
+
+// src/setup/files.ts
+import fs15 from "fs/promises";
+import path20 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+async function readText(root, file) {
+  try {
+    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
+    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
+    return text2;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function managedBlock(text2, start, end, body) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
+    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
+  }
+  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
+  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
+  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
+  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
+}
+async function applyEdit(root, edit) {
+  const current = await readText(root, edit.path);
+  if (current === edit.after) return false;
+  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
+  const file = await storePath(root, edit.path, true);
+  const temporary = path20.join(path20.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  try {
+    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs15.open(temporary, "wx", mode);
+    try {
+      await handle.writeFile(edit.after, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
+    await fs15.rename(temporary, file);
+    return true;
+  } finally {
+    await fs15.rm(temporary, { force: true });
+  }
+}
+var init_files2 = __esm({
+  "src/setup/files.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+  }
+});
+
+// src/setup/launcher.ts
+var BOOTSTRAP, mcpCommand, hookCommand, LAUNCHER;
+var init_launcher = __esm({
+  "src/setup/launcher.ts"() {
+    "use strict";
+    BOOTSTRAP = "require(require('node:path').join(require('node:child_process').execFileSync('git',['rev-parse','--show-toplevel'],{encoding:'utf8'}).trim(),'.mason','run.cjs'))";
+    mcpCommand = (host) => ({ command: "node", args: ["-e", BOOTSTRAP, "--", host, "mcp"] });
+    hookCommand = (host) => `node -e "${BOOTSTRAP}" -- ${host} auto`;
+    LAUNCHER = `// Managed by mason-auto setup. Rerun setup to install this checkout's pinned runtime.
+const fs = require('node:fs');
+const path = require('node:path');
+const {pathToFileURL} = require('node:url');
+const launchArgs = process.argv.slice(1);
+(async () => {
+  const root = path.dirname(__dirname);
+  const args = launchArgs;
+  const [host, command, ...rest] = args;
+  if (!['codex','claude'].includes(host) || !['auto','mcp'].includes(command)) throw new Error('Invalid Mason launcher arguments.');
+  const setup = JSON.parse(fs.readFileSync(path.join(__dirname, 'setup.json'), 'utf8'));
+  const entry = setup.hosts?.[host];
+  if (setup.version !== 1 || !entry || !/^[a-f0-9]{24}$/.test(entry.runtime?.id)) throw new Error('Mason is not configured for this host. Rerun mason-auto setup.');
+  const binary = path.join(__dirname, 'runtime', entry.runtime.id, 'node_modules', 'mason-context', 'dist', 'mason-' + command + '.js');
+  if (!fs.existsSync(binary)) throw new Error('The pinned Mason runtime is missing in this checkout. Rerun mason-auto setup --host ' + host + '.');
+  process.env.MASON_SETUP_ROOT = root;
+  process.env.MASON_SETUP_HOST = host;
+  process.env.MASON_SETUP_REVISION = entry.revision;
+  process.argv = [process.execPath, binary, ...rest];
+  await import(pathToFileURL(binary).href);
+})().catch(error => {
+  const message = 'Mason setup unavailable: ' + error.message;
+  if (launchArgs[1] === 'auto' && launchArgs[2] === 'hook') { console.log(JSON.stringify({systemMessage: message})); process.exitCode = 0; }
+  else { console.error(message); process.exitCode = 2; }
+});
+`;
+  }
+});
+
+// src/setup/config.ts
+import { isDeepStrictEqual } from "util";
+import { parse, stringify } from "smol-toml";
+import { z as z15 } from "zod";
+async function instructionEdits(root, host) {
+  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
+  const existing = found.find((f) => f.text !== null);
+  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
+  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
+  const edits = [{
+    path: primary.path,
+    before: primary.text,
+    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
+  }];
+  if (primary.path === "AGENTS.md") {
+    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
+    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
+    for (const file of secondary) {
+      const text2 = file.text ?? "";
+      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
+      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      if (text2.trim() === imported) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
+      edits.push({
+        path: file.path,
+        before: file.text,
+        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
+      });
+    }
+  }
+  return edits;
+}
+function managedMcp(previous, host) {
+  const options = previous === void 0 ? {} : object.parse(previous);
+  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
+  return { ...options, ...mcpCommand(host) };
+}
+async function mcpEdit(root, host) {
+  const file = mcpPath(host), before = await readText(root, file);
+  if (host === "claude") {
+    const config2 = before === null ? {} : object.parse(JSON.parse(before));
+    const servers2 = object.parse(config2.mcpServers ?? {});
+    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host) } }, null, 2) + "\n" };
+  }
+  const config = parse(before ?? "");
+  const managed = (before ?? "").includes(TOML_START);
+  const servers = config.mcp_servers;
+  const desired = managedMcp(servers?.mason, host);
+  let base = before ?? "";
+  if (servers?.mason && !managed) {
+    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
+    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
+    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
+    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
+  }
+  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
+  const parsed = parse(after);
+  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
+  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
+  return { path: file, before, after };
+}
+async function hookEdits(root, host) {
+  const file = configPath(host), before = await readText(root, file);
+  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  const plan = await planAutomationInstall2(root, host, hookCommand(host));
+  return [
+    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
+    { path: ".mason/automation.json", before: await readText(root, ".mason/automation.json"), after: JSON.stringify(plan.record, null, 2) + "\n" }
+  ];
+}
+async function ancillaryEdits(root) {
+  const ignore = await readText(root, ".gitignore");
+  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  let parentIgnored = false;
+  try {
+    parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+  } catch (error) {
+    if (error.code !== 1) throw error;
+  }
+  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
+  const rules = [...retainParentRule ? ["!/.mason/", "/.mason/*"] : [], "!/.mason/decisions/", "!/.mason/decisions/**", "!/.mason/setup.json", "!/.mason/automation.json", "!/.mason/project.json", "!/.mason/run.cjs", "/.mason/reports/", "/.mason/runtime/"].join("\n");
+  return [
+    { path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) },
+    { path: ".mason/run.cjs", before: await readText(root, ".mason/run.cjs"), after: LAUNCHER }
+  ];
+}
+async function inspectHostConfig(root, host, plannedMcp) {
+  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
+  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
+  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
+  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
+  const expected = hookConfig(host, hookCommand(host));
+  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
+  return {
+    mcp,
+    mcpDisabled: mcp?.enabled === false,
+    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
+      event,
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+    ])),
+    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
+  };
+}
+var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
+var init_config = __esm({
+  "src/setup/config.ts"() {
+    "use strict";
+    init_init();
+    init_docs();
+    init_adapters();
+    init_install();
+    init_files2();
+    init_launcher();
+    object = z15.record(z15.unknown());
+    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
+    TOML_START = "# mason:mcp:start";
+    TOML_END = "# mason:mcp:end";
+    POINTER_START = "<!-- mason:agents:start -->";
+    POINTER_END = "<!-- mason:agents:end -->";
+  }
+});
+
+// src/setup/runtime.ts
+import fs16 from "fs/promises";
+import path21 from "path";
+import { fileURLToPath } from "url";
+import { randomUUID as randomUUID6, createHash as createHash4 } from "crypto";
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+async function packageRoot() {
+  let directory = path21.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 8; i++) {
+    try {
+      const pkg = JSON.parse(await fs16.readFile(path21.join(directory, "package.json"), "utf8"));
+      if (pkg.name === "mason-context") return directory;
+    } catch {
+    }
+    directory = path21.dirname(directory);
+  }
+  throw new Error("Cannot locate the executing Mason distribution. Reinstall Mason and rerun setup.");
+}
+async function sourceRuntime() {
+  const source = await packageRoot();
+  const pkg = JSON.parse(await fs16.readFile(path21.join(source, "package.json"), "utf8"));
+  const hashes = Object.fromEntries(await Promise.all(BINARIES.map(async (file) => [file, checksum(await fs16.readFile(path21.join(source, file)))])));
+  return { source, runtime: runtimeSchema.parse({ id: hash([pkg.version, pkg.dependencies, hashes]).slice(0, 24), version: pkg.version, hashes }) };
+}
+async function verifyRuntime(root, runtime) {
+  try {
+    const saved = await readStoreJson(root, `.mason/runtime/${runtime.id}/receipt.json`);
+    if (JSON.stringify(saved) !== JSON.stringify(runtime)) return false;
+    const base = `.mason/runtime/${runtime.id}/node_modules/mason-context/`;
+    const pkg = await readStoreJson(root, base + "package.json");
+    if (pkg?.name !== "mason-context" || pkg.version !== runtime.version) return false;
+    for (const file of BINARIES) {
+      if (checksum(await fs16.readFile(await storePath(root, base + file))) !== runtime.hashes[file]) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function installRuntime(root, selected) {
+  const { runtime, source } = selected;
+  if (await verifyRuntime(root, runtime)) return runtime;
+  const relative = `.mason/runtime/${runtime.id}`;
+  const target = await storePath(root, relative, true);
+  const stage = await storePath(root, ".mason/runtime/.install-" + randomUUID6(), true);
+  await fs16.mkdir(stage);
+  try {
+    const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+    const options = { timeout: 12e4, maxBuffer: 2 * 1024 * 1024, windowsHide: true };
+    const packed = JSON.parse((await exec10(npm, ["pack", "--ignore-scripts", "--json", "--pack-destination", stage], { ...options, cwd: source })).stdout);
+    const filename = packed[0]?.filename;
+    if (typeof filename !== "string" || path21.basename(filename) !== filename) throw new Error("npm did not produce a Mason package archive.");
+    await fs16.rename(path21.join(stage, filename), path21.join(stage, "mason.tgz"));
+    await fs16.writeFile(path21.join(stage, "package.json"), JSON.stringify({ name: "mason-project-runtime", private: true, version: "1.0.0" }));
+    await exec10(npm, ["install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--save-exact", "./mason.tgz"], { ...options, cwd: stage });
+    for (const file of BINARIES) {
+      if (checksum(await fs16.readFile(path21.join(stage, "node_modules/mason-context", file))) !== runtime.hashes[file]) throw new Error("Installed Mason binary differs from the selected distribution.");
+    }
+    await fs16.writeFile(path21.join(stage, "receipt.json"), JSON.stringify(runtime, null, 2) + "\n");
+    try {
+      await fs16.rename(target, target + ".previous-" + randomUUID6());
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await fs16.rename(stage, target);
+    if (!await verifyRuntime(root, runtime)) throw new Error("The installed Mason runtime could not be verified.");
+    return runtime;
+  } finally {
+    await fs16.rm(stage, { recursive: true, force: true });
+  }
+}
+var exec10, checksum, BINARIES;
+var init_runtime2 = __esm({
+  "src/setup/runtime.ts"() {
+    "use strict";
+    init_model();
+    init_storage();
+    init_evidence();
+    exec10 = promisify10(execFile10);
+    checksum = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+    BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
+  }
+});
+
+// src/setup/status.ts
+var status_exports = {};
+__export(status_exports, {
+  setupStatus: () => setupStatus,
+  summarizeActivation: () => summarizeActivation
+});
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+async function setupStatus(dir) {
+  const ws = await workspace(dir);
+  const setup = await loadSetup(ws.root);
+  if (!setup) {
+    const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
+      host,
+      receipt: await loadSetupReceipt(ws.root, ws.directory, host)
+    })));
+    const pending = partial.filter((item) => item.receipt !== null).map((item) => item.host);
+    return {
+      version: 1,
+      status: pending.length ? "incomplete" : "not-configured",
+      hosts: {},
+      next: pending.length ? "Setup did not finish. Rerun mason-auto setup --host " + pending[0] + " to resume using the retained original evidence." : "Run mason-auto setup --host codex or --host claude."
+    };
+  }
+  const hosts = {};
+  const launcherCurrent = await readText(ws.root, ".mason/run.cjs") === LAUNCHER;
+  const automation = await automationStatus(ws.root);
+  for (const host of ["codex", "claude"]) {
+    const entry = setup.hosts[host];
+    if (!entry) continue;
+    const instructions = await instructionEdits(ws.root, host);
+    const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
+    const installed = await verifyRuntime(ws.root, entry.runtime);
+    const config = await inspectHostConfig(ws.root, host);
+    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
+    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
+    const local = await loadSetupReceipt(ws.root, ws.directory, host);
+    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const observation = await readObservation(ws.root, ws.directory, host, entry.revision);
+    const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
+    const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
+    const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
+    const pending = [];
+    if (!installed || !launcherCurrent) pending.push("Install this checkout's pinned runtime by rerunning setup.");
+    if (!mcp || !hooks || !instructionsCurrent || !configured) pending.push("Rerun setup to reconcile project configuration; inspect any disabled host settings.");
+    if (!observation?.contextCalls) pending.push("Start a new assistant session and request task context through Mason's get_context tool.");
+    if (!complete) pending.push("Review/trust the host configuration, then complete a normal task to observe the full hook lifecycle.");
+    if (automation.status === "unavailable") pending.push("The latest automation attempt did not establish verification. Run mason-auto check and inspect its diagnostics.");
+    const healthy = installed && launcherCurrent && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    hosts[host] = {
+      status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
+      runtime: installed && launcherCurrent ? "installed" : "missing-or-changed",
+      mcp: mcp ? "configured" : "changed",
+      instructions: instructionsCurrent ? "current" : "changed",
+      hookConfiguration: hooks ? "configured" : "disabled-or-changed",
+      observedEvents,
+      contextCalls: observation?.contextCalls ?? 0,
+      verificationStatus: automation.status === "current" ? automation.verificationStatus ?? "unavailable" : "unavailable",
+      pending
+    };
+  }
+  const statuses = Object.values(hosts).map((host) => host.status);
+  const decisions = await loadDecisionStore(ws.root);
+  return {
+    version: 1,
+    status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
+    root: ws.root,
+    hosts,
+    decisionRecords: decisions.records.length,
+    diagnostics: decisions.diagnostics,
+    scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
+  };
+}
+function summarizeActivation(status) {
+  const lines = ["Mason setup: " + status.status + "."];
+  for (const [host, state] of Object.entries(status.hosts)) {
+    lines.push(
+      `${host}: ${state.status}`,
+      `  Runtime: ${state.runtime}; MCP: ${state.mcp}; instructions: ${state.instructions}.`,
+      `  Hooks: ${state.hookConfiguration}; observed: ${state.observedEvents.join(", ") || "none"}.`,
+      `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
+      ...state.pending.map((message2) => "  Next: " + message2)
+    );
+  }
+  if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
+  if (status.next) lines.push(status.next);
+  return lines.join("\n");
+}
+var init_status = __esm({
+  "src/setup/status.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_runtime();
+    init_decisions();
+    init_adapters();
+    init_model();
+    init_runtime2();
+    init_config();
+    init_launcher();
+    init_files2();
+    init_observations();
+  }
+});
+
+// src/setup/setup.ts
+var setup_exports = {};
+__export(setup_exports, {
+  selectHost: () => selectHost,
+  setupProject: () => setupProject,
+  summarizeSetup: () => summarizeSetup
+});
+import { randomUUID as randomUUID7 } from "crypto";
+async function selectHost(root, explicit) {
+  if (explicit) return explicit;
+  if (process.env.MASON_SETUP_HOST === "codex" || process.env.MASON_SETUP_HOST === "claude") return process.env.MASON_SETUP_HOST;
+  const found = [];
+  if (await readText(root, ".codex/config.toml") !== null || await readText(root, ".codex/hooks.json") !== null) found.push("codex");
+  if (await readText(root, ".claude/settings.json") !== null || await readText(root, ".mcp.json") !== null) found.push("claude");
+  if (found.length === 1) return found[0];
+  throw new Error("Choose the assistant for setup with --host codex or --host claude.");
+}
+async function setupProject(dir, options = {}) {
+  const ws = await workspace(dir);
+  const host = await selectHost(ws.root, options.host);
+  return withLock(ws.root, ".mason/reports/setup-lock", async () => {
+    const existing = await loadSetup(ws.root);
+    const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
+    const marker = await loadProjectMarker(ws.root);
+    const instructions = await instructionEdits(ws.root, host);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
+    const ancillary = await ancillaryEdits(ws.root);
+    const edits = [...ancillary, ...instructions, mcp, ...hooks];
+    const setupBefore = await readText(ws.root, ".mason/setup.json");
+    const selected = await sourceRuntime();
+    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
+    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
+    const fingerprint = hash({
+      runtime: selected.runtime,
+      launcher: LAUNCHER,
+      mcp: mcpFingerprint,
+      hooks: desiredHooks,
+      instructions: instructions.map((edit) => edit.path)
+    });
+    const previous = existing?.hosts[host];
+    const changed = edits.some((edit) => edit.before !== edit.after) || previous?.fingerprint !== fingerprint;
+    const revision = !changed && previous ? previous.revision : randomUUID7();
+    const setup = existing ?? { version: 1, hosts: {} };
+    setup.hosts[host] = { runtime: selected.runtime, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
+    const initial = await automate(ws.root, { event: "turn_start" });
+    const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
+    const receiptPath = ws.directory + "/setup-" + host + ".json";
+    const initialReportPath = previousReceipt?.initialReportPath ?? initial.report.reportPath;
+    const initialBaselinePaths = previousReceipt?.initialBaselinePaths ?? initial.report.baselinePaths;
+    await writeStoreJson(ws.root, receiptPath, {
+      version: 1,
+      host,
+      status: "installing",
+      initialReportPath,
+      initialBaselinePaths,
+      root: ws.root,
+      revision
+    });
+    await installRuntime(ws.root, selected);
+    const changedFiles = [];
+    for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
+    if (await applyEdit(ws.root, { path: ".mason/setup.json", before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(".mason/setup.json");
+    if (!marker) {
+      await saveProjectMarker(ws.root, { version: 1, initializedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      changedFiles.push(".mason/project.json");
+    }
+    const checked = await automate(ws.root, { event: "turn_start" });
+    const configured = await inspectHostConfig(ws.root, host);
+    await writeStoreJson(ws.root, receiptPath, {
+      version: 1,
+      host,
+      status: "configured",
+      initialReportPath,
+      initialBaselinePaths,
+      root: ws.root,
+      revision,
+      configuredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return {
+      version: 1,
+      action: "setup",
+      status: "configured",
+      host,
+      root: ws.root,
+      runtime: selected.runtime,
+      changedFiles,
+      initialReportPath,
+      findings,
+      reportPath: checked.report.reportPath,
+      activation: await setupStatus(ws.root),
+      next: configured.disabled || configured.mcpDisabled ? "Mason hooks or MCP are disabled in project configuration. Review that setting before activation." : host === "codex" ? "Review/trust this project's MCP configuration and hooks in Codex (/hooks in the CLI), then start a new session and give it a normal task." : "Approve the project MCP server in Claude Code, then start a new session and give it a normal task."
+    };
+  });
+}
+function summarizeSetup(result) {
+  const audit = result.findings.audit;
+  return [
+    `Mason configured for ${result.host}.`,
+    "  Runtime installed; MCP server and lifecycle hooks configured.",
+    "  Project instructions updated; original audit evidence retained.",
+    `  ${result.changedFiles.length} shared files changed.`,
+    `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
+    ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
+    `Original evidence: ${result.initialReportPath}`,
+    "Activation: " + result.activation.status + ".",
+    result.next,
+    "After the task finishes, run mason-auto status. Configuration alone does not establish activation."
+  ].join("\n");
+}
+var init_setup = __esm({
+  "src/setup/setup.ts"() {
+    "use strict";
+    init_evidence();
+    init_store();
+    init_runtime();
+    init_init();
+    init_onboarding();
+    init_storage();
+    init_files2();
+    init_config();
+    init_launcher();
+    init_adapters();
+    init_model();
+    init_runtime2();
+    init_status();
+  }
+});
+
+// src/automation/cli.ts
+init_execution();
+init_runtime();
+init_adapters();
+init_install();
+init_store();
+import { parseArgs } from "util";
+var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options]
+
+  setup [--host claude|codex]  Install a pinned runtime, MCP, instructions and hooks; retain the initial audit
+  install --host claude|codex  Merge lifecycle hooks into this project's host config
+  config --host claude|codex   Print the host config without writing
+  status                      Read configured hooks and observed runtime events
+  check                       Capture/resume and verify retained audit evidence
+  hook --host claude|codex     Handle host JSON on stdin
+
+  --dir <path>                Project directory (defaults to cwd)
+  --command <prefix>          Installed executable prefix for install/config
+  --json                      Machine-readable output (status also uses JSON when piped)
+
+check exits 0 for verified checks, 1 for issues, 2 for incomplete/unavailable.
+Hooks are advisory and exit 0; a failed capture is reported explicitly.
+Local evidence is written under .mason/reports/. No LLM calls or source edits.`;
+var parseCli = (argv2) => parseArgs({ args: argv2, allowPositionals: true, options: {
+  dir: { type: "string" },
+  host: { type: "string" },
+  command: { type: "string" },
+  json: { type: "boolean" },
+  help: { type: "boolean", short: "h" }
+} });
+function isHookCommand(argv2) {
+  try {
+    const parsed = parseCli(argv2);
+    return parsed.positionals[0] === "hook" && !parsed.values.help;
+  } catch {
+    return false;
+  }
+}
+async function runAutomationCli(argv2, stdin = "", io = {
+  out: (s) => process.stdout.write(s + "\n"),
+  err: (s) => process.stderr.write(s + "\n")
+}) {
+  let action = "";
+  try {
+    const { values, positionals } = parseCli(argv2);
+    if (values.help || !positionals.length) {
+      io.out(USAGE);
+      return 0;
+    }
+    if (positionals.length !== 1) throw new Error("Expected one command.");
+    [action] = positionals;
+    const dir = values.dir ?? process.cwd();
+    if (action === "hook") {
+      const output = await runAutomationHook(hostSchema.parse(values.host), stdin);
+      if (output) io.out(JSON.stringify(output));
+      return 0;
+    }
+    if (action === "setup") {
+      if (values.command) throw new Error("--command applies to install/config, not managed setup.");
+      const { setupProject: setupProject2, summarizeSetup: summarizeSetup2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
+      const result = await setupProject2(dir, { host: values.host ? hostSchema.parse(values.host) : void 0 });
+      io.out(values.json ? JSON.stringify(result, null, 2) : summarizeSetup2(result));
+      return 0;
+    }
+    if (action === "install" || action === "config") {
+      const host = hostSchema.parse(values.host);
+      io.out(JSON.stringify(action === "install" ? await installAutomation(dir, host, values.command) : hookConfig(host, values.command), null, 2));
+      return 0;
+    }
+    if (values.host || values.command) throw new Error("--host and --command apply only to install/config/hook.");
+    if (action === "status") {
+      const { setupStatus: setupStatus2, summarizeActivation: summarizeActivation2 } = await Promise.resolve().then(() => (init_status(), status_exports));
+      const setup = await setupStatus2(dir);
+      const result = { ...await automationStatus(dir), configured: await installedAutomation(dir), setup };
+      io.out(values.json || !process.stdout.isTTY ? JSON.stringify(result, null, 2) : summarizeActivation2(setup));
+      return 0;
+    }
+    if (action !== "check") throw new Error("Unknown automation command: " + action);
+    const { report } = await automate(dir, { event: "task_end" });
+    io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
+    return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
+  } catch (error) {
+    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
+    if (action === "hook" || isHookCommand(argv2)) {
+      io.out(JSON.stringify({ systemMessage: message2 }));
+      return 0;
+    }
+    if (argv2.includes("--json")) io.out(JSON.stringify({ version: 1, ...action === "setup" ? { action, status: "incomplete", next: "Rerun the same setup command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
+    else io.err(message2);
+    return 2;
+  }
+}
+
+// bin/mason-auto.ts
+var argv = process.argv.slice(2);
+var input = "";
+if (isHookCommand(argv) && !process.stdin.isTTY) {
+  for await (const chunk of process.stdin) {
+    input += chunk.toString();
+    if (Buffer.byteLength(input) > 1024 * 1024) break;
+  }
+}
+process.exitCode = await runAutomationCli(argv, input);
+//# sourceMappingURL=mason-auto.js.map