mason-context 0.14.0 → 0.14.2

package/dist/mason-mcp.js

@@ -1394,9 +1394,133 @@ var init_deleted_reference = __esm({
   }
 });
 
-// src/audit/checks/new-module.ts
-import fg2 from "fast-glob";
+// src/audit/inputs.ts
+import fs6 from "fs/promises";
+import * as nativeFs from "fs";
 import path9 from "path";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+import fg2 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs6.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg2.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  const { stdout } = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
+    ],
+    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
+  );
+  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const operation = execute(
+    "git",
+    ["check-ignore", "-z", "--stdin"],
+    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
+  );
+  operation.child.stdin.on("error", () => {
+  });
+  operation.child.stdin.end(files.join("\0") + "\0");
+  try {
+    return new Set((await operation).stdout.split("\0").filter(Boolean));
+  } catch (error) {
+    if (error.code === 1) return /* @__PURE__ */ new Set();
+    throw error;
+  }
+}
+var execute, MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    execute = promisify6(execFile6);
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/checks/new-module.ts
+import fg3 from "fast-glob";
+import fs7 from "fs/promises";
+import path10 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1407,22 +1531,6 @@ function isMentioned(combinedDocs, name) {
   );
   return re.test(combinedDocs);
 }
-async function listSubdirs(absDir) {
-  const dirs = await fg2("*", {
-    cwd: absDir,
-    onlyDirectories: true,
-    suppressErrors: true
-  });
-  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
-}
-async function countSourceFiles(absDir) {
-  const files = await fg2(SOURCE_GLOB, {
-    cwd: absDir,
-    ignore: SOURCE_IGNORE,
-    suppressErrors: true
-  });
-  return files.length;
-}
 async function checkNewModules(ctx) {
   const result = emptyResult();
   if (ctx.docs.length === 0) return result;
@@ -1450,21 +1558,48 @@ async function checkNewModules(ctx) {
   return result;
 }
 async function moduleCandidates(root, combinedDocs) {
+  const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const listSubdirs = async (dir) => {
+    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
+    const ignored = await gitIgnoredPaths(root, dirs);
+    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
+    return (await auditGlob(root, dir === "." ? "*" : `${fg3.escapePath(dir)}/*`, {
+      ignore,
+      onlyDirectories: true,
+      label: "Module directory discovery",
+      select: (file) => visible.has(file)
+    })).map((file) => path10.posix.basename(file));
+  };
+  const countSourceFiles = async (dir) => {
+    const files = sources.filter((file) => file.startsWith(dir + "/"));
+    let count3 = 0;
+    for (let offset = 0; offset < files.length; offset += 256) {
+      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg3.escapePath(file)), {
+        ignore,
+        followSymbolicLinks: false,
+        label: `Source discovery in ${dir}`
+      })).length;
+      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+    }
+    return count3;
+  };
   const candidates = [];
-  for (const topDir of await listSubdirs(root)) {
-    const absTop = path9.join(root, topDir);
+  for (const topDir of await listSubdirs(".")) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count3 = await countSourceFiles(absTop);
+      const count3 = await countSourceFiles(topDir);
       if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
-    const subdirs = await listSubdirs(absTop);
+    const subdirs = await listSubdirs(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      const count3 = await countSourceFiles(`${topDir}/${sub}`);
       if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
         candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
@@ -1476,7 +1611,8 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
-    init_snapshot();
+    init_files();
+    init_inputs();
     init_git();
     init_checks();
     DIR_DENYLIST = /* @__PURE__ */ new Set([
@@ -1504,19 +1640,10 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import fs6 from "fs/promises";
-import path10 from "path";
-import fg3 from "fast-glob";
-async function readIfExists(absPath) {
-  try {
-    return await fs6.readFile(absPath, "utf-8");
-  } catch {
-    return null;
-  }
-}
+import path11 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
-    const content2 = await readIfExists(path10.join(root, name));
+    const content2 = await readAuditInput(root, name);
     if (content2 === null) continue;
     const members = [];
     for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
@@ -1530,26 +1657,28 @@ async function countGradleModules(root) {
   return null;
 }
 async function countNpmWorkspaces(root) {
-  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  const pkgRaw = await readAuditInput(root, "package.json");
   if (pkgRaw !== null) {
+    let globs = [];
     try {
       const pkg = JSON.parse(pkgRaw);
-      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
-      if (globs.length > 0) {
-        const matched = await fg3(
-          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-          { cwd: root, ignore: ["**/node_modules/**"] }
-        );
-        return {
-          actual: matched.length,
-          countedFrom: "package.json workspaces",
-          members: matched.map((m) => path10.dirname(m)).sort()
-        };
-      }
+      globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
     } catch {
     }
+    if (globs.length > 0) {
+      const matched = await auditGlob(
+        root,
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { ignore: ["**/node_modules/**"], label: "npm workspace discovery" }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "package.json workspaces",
+        members: matched.map((m) => path11.dirname(m)).sort()
+      };
+    }
   }
-  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  const pnpmRaw = await readAuditInput(root, "pnpm-workspace.yaml");
   if (pnpmRaw !== null) {
     const globs = [];
     let inPackages = false;
@@ -1568,21 +1697,22 @@ async function countNpmWorkspaces(root) {
       }
     }
     if (globs.length > 0) {
-      const matched = await fg3(
+      const matched = await auditGlob(
+        root,
         globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-        { cwd: root, ignore: ["**/node_modules/**"] }
+        { ignore: ["**/node_modules/**"], label: "pnpm workspace discovery" }
       );
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path10.dirname(m)).sort()
+        members: matched.map((m) => path11.dirname(m)).sort()
       };
     }
   }
   return null;
 }
 async function countCargoCrates(root) {
-  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  const content2 = await readAuditInput(root, "Cargo.toml");
   if (content2 === null) return null;
   const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
@@ -1593,12 +1723,12 @@ async function countCargoCrates(root) {
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (/[*?[\]{}]/.test(entry)) {
-      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
-        cwd: root,
-        ignore: ["**/target/**"]
+      const matched = await auditGlob(root, `${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        ignore: ["**/target/**"],
+        label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path10.dirname(m));
-    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path11.dirname(m));
+    } else if (await readAuditInput(root, path11.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1652,18 +1782,18 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     MEMBERS_CAP = 50;
   }
 });
 
 // src/audit/checks/dead-command.ts
-import fs7 from "fs/promises";
-import path11 from "path";
-import fg4 from "fast-glob";
-async function scriptsOf(absManifest) {
+async function scriptsOf(root, manifest) {
+  const raw = await readAuditInput(root, manifest);
+  if (raw === null) return null;
   try {
-    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    const pkg = JSON.parse(raw);
     return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
   } catch {
     return null;
@@ -1675,7 +1805,7 @@ async function checkDeadCommands(ctx) {
     (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
   );
   if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  const rootScripts = await scriptsOf(ctx.root, "package.json");
   if (rootScripts === null) {
     result.skipped.push({
       check: "dead-command",
@@ -1692,7 +1822,7 @@ async function checkDeadCommands(ctx) {
     const manifests = await commandManifests(ctx.root);
     manifestsChecked = ["package.json", ...manifests.sort()];
     for (const manifest of manifests) {
-      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
+      const scripts = await scriptsOf(ctx.root, manifest);
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -1718,23 +1848,24 @@ async function checkDeadCommands(ctx) {
   return result;
 }
 function commandManifests(root) {
-  return fg4("**/package.json", {
-    cwd: root,
-    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  return auditGlob(root, "**/package.json", {
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"],
+    label: "Command manifest discovery"
   });
 }
 var AVAILABLE_SCRIPTS_CAP;
 var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     AVAILABLE_SCRIPTS_CAP = 30;
   }
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 async function git(root, args) {
   return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
@@ -1786,7 +1917,7 @@ var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify6(execFile6);
+    exec6 = promisify7(execFile7);
   }
 });
 
@@ -2738,8 +2869,8 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
 });
 
 // src/review/cochange.ts
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
     const { stdout: shallow } = await exec11("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
@@ -2804,7 +2935,7 @@ var exec11, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec11 = promisify11(execFile11);
+    exec11 = promisify12(execFile12);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3269,8 +3400,8 @@ var init_evidence = __esm({
 // src/review/review.ts
 import fs13 from "fs/promises";
 import path20 from "path";
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import { execFile as execFile13 } from "child_process";
+import { promisify as promisify13 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
     const { stdout } = await exec12("git", ["merge-base", base, head], {
@@ -3392,7 +3523,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence();
     init_snapshot();
-    exec12 = promisify12(execFile12);
+    exec12 = promisify13(execFile13);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -3487,8 +3618,8 @@ __export(impact_exports, {
   analyzeImpact: () => analyzeImpact
 });
 import path21 from "path";
-import { execFile as execFile13 } from "child_process";
-import { promisify as promisify13 } from "util";
+import { execFile as execFile14 } from "child_process";
+import { promisify as promisify14 } from "util";
 async function analyzeImpact(rootDir, targetFiles) {
   const resolvedRoot = path21.resolve(rootDir);
   const resolvedTargets = await resolveTargetFiles(resolvedRoot, targetFiles);
@@ -3655,7 +3786,7 @@ var init_impact = __esm({
     "use strict";
     init_files();
     init_paths();
-    exec13 = promisify13(execFile13);
+    exec13 = promisify14(execFile14);
   }
 });
 
@@ -4027,9 +4158,9 @@ __export(evidence_exports, {
 import fs15 from "fs/promises";
 import path23 from "path";
 import { createHash as createHash4 } from "crypto";
-import { execFile as execFile14 } from "child_process";
-import { promisify as promisify14 } from "util";
-import fg6 from "fast-glob";
+import { execFile as execFile15 } from "child_process";
+import { promisify as promisify15 } from "util";
+import fg5 from "fast-glob";
 import { z as z11 } from "zod";
 async function git2(root, ...args) {
   return (await exec14("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
@@ -4045,34 +4176,13 @@ async function workspace(dir) {
   }
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
-async function content(root, file) {
-  try {
-    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
 async function readInputs(root) {
-  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+  const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git2(root, "rev-parse", "HEAD"),
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
-    fg6("**/*", {
-      cwd: root,
-      dot: true,
-      onlyFiles: false,
-      followSymbolicLinks: false,
-      objectMode: true,
-      ignore: SOURCE_IGNORE
-    }),
     git2(root, "rev-parse", "--git-path", "shallow"),
     git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
-  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
-  const files = entries.map((f) => f.path);
-  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
   const head = headText.trim();
   let shallow = null;
   try {
@@ -4093,9 +4203,19 @@ async function readInputs(root) {
       claims.push([claim.path, await exists2(claim.path), await exists2(path23.dirname(claim.path))]);
     }
   }
-  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
   const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
   const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const commandClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).commands : []);
+  const rootPackage = await content(root, "package.json");
+  let rootScripts = null;
+  if (rootPackage !== null) {
+    try {
+      const pkg = JSON.parse(rootPackage);
+      rootScripts = pkg?.scripts && typeof pkg.scripts === "object" ? Object.keys(pkg.scripts) : [];
+    } catch {
+    }
+  }
+  const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs15.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -4104,16 +4224,19 @@ async function readInputs(root) {
   const [modules, counts, manifests, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
-    commandManifests(root),
-    fg6(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    needsWorkspaceScripts ? commandManifests(root) : [],
+    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
-  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
-  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const packages = [["package.json", rootPackage], ...await Promise.all(manifests.sort().map(async (file) => [file, await content(root, file)]))];
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
+    await storePath(root, file);
+    return [file, await content(root, file)];
+  }));
   const [status, index2] = decisions.length ? await Promise.all([
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [2, engineVersion, head, shallow, replacements, docContents];
+  const common = [3, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -4149,7 +4272,7 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
-var exec14, engineVersion, hash, internal, cacheSchema;
+var exec14, engineVersion, hash, content, internal, cacheSchema;
 var init_evidence2 = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
@@ -4157,14 +4280,15 @@ var init_evidence2 = __esm({
     init_claims();
     init_repair();
     init_checks();
-    init_files();
+    init_inputs();
     init_new_module();
     init_stale_count();
     init_dead_command();
     init_storage();
-    exec14 = promisify14(execFile14);
-    engineVersion = true ? "0.14.0" : "development";
+    exec14 = promisify15(execFile15);
+    engineVersion = true ? "0.14.2" : "development";
     hash = (value) => createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+    content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z11.object({ version: z11.literal(1), entries: z11.record(z11.object({ key: z11.string(), result: checkResultSchema })), digest: z11.string() });
   }
@@ -4709,8 +4833,8 @@ import fs18 from "fs/promises";
 import path25 from "path";
 import { fileURLToPath } from "url";
 import { randomUUID as randomUUID5, createHash as createHash6 } from "crypto";
-import { execFile as execFile15 } from "child_process";
-import { promisify as promisify15 } from "util";
+import { execFile as execFile16 } from "child_process";
+import { promisify as promisify16 } from "util";
 async function packageRoot() {
   let directory = path25.dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
@@ -4818,7 +4942,7 @@ var init_runtime2 = __esm({
     init_storage();
     init_evidence2();
     init_bundle();
-    exec15 = promisify15(execFile15);
+    exec15 = promisify16(execFile16);
     checksum = (bytes) => createHash6("sha256").update(bytes).digest("hex");
     BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
   }
@@ -5533,8 +5657,8 @@ __export(config_exports, {
 import fs21 from "fs/promises";
 import path27 from "path";
 import os3 from "os";
-import { execFile as execFile16 } from "child_process";
-import { promisify as promisify16 } from "util";
+import { execFile as execFile17 } from "child_process";
+import { promisify as promisify17 } from "util";
 function configDir() {
   return path27.join(os3.homedir(), ".mason");
 }
@@ -5590,7 +5714,7 @@ var exec16, DEFAULT_MODELS;
 var init_config2 = __esm({
   "src/llm/config.ts"() {
     "use strict";
-    exec16 = promisify16(execFile16);
+    exec16 = promisify17(execFile17);
     DEFAULT_MODELS = {
       claude: "claude-sonnet-4-20250514",
       gemini: "gemini-2.5-flash",
@@ -5789,8 +5913,8 @@ var init_diff = __esm({
 });
 
 // src/llm/providers.ts
-import { execFile as execFile17, spawn } from "child_process";
-import { promisify as promisify17 } from "util";
+import { execFile as execFile18, spawn } from "child_process";
+import { promisify as promisify18 } from "util";
 async function callLLM(config, userMessage, systemPrompt) {
   const model = config.model ?? getDefaultModel(config.provider);
   const system = systemPrompt ?? CLAUDE_MD_SYSTEM_PROMPT;
@@ -5952,7 +6076,7 @@ var init_providers = __esm({
   "src/llm/providers.ts"() {
     "use strict";
     init_config2();
-    exec17 = promisify17(execFile17);
+    exec17 = promisify18(execFile18);
     CLAUDE_MD_SYSTEM_PROMPT = `You are Mason, a context engineering tool. You've been given a comprehensive analysis of a codebase including:
 - Git history stats (commit patterns, frequently changed files, stale directories)
 - Project structure (directory layout, file counts by type)
@@ -6291,8 +6415,8 @@ import { z as z19 } from "zod";
 init_repair();
 import fs23 from "fs/promises";
 import path29 from "path";
-import { execFile as execFile18 } from "child_process";
-import { promisify as promisify18 } from "util";
+import { execFile as execFile19 } from "child_process";
+import { promisify as promisify19 } from "util";
 
 // src/audit/cli.ts
 init_audit();
@@ -6386,15 +6510,15 @@ function formatFixPrompt(report, baselinePath) {
 }
 
 // src/analyzers/git-history.ts
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
 
 // src/analyzers/base.ts
 import fs11 from "fs/promises";
-import fg5 from "fast-glob";
+import fg4 from "fast-glob";
 var BaseAnalyzer = class {
   async findFiles(patterns, root) {
-    return fg5(patterns, {
+    return fg4(patterns, {
       cwd: root,
       ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"],
       absolute: true
@@ -6424,7 +6548,7 @@ var BaseAnalyzer = class {
 };
 
 // src/analyzers/git-history.ts
-var exec7 = promisify7(execFile7);
+var exec7 = promisify8(execFile8);
 var GitHistoryAnalyzer = class extends BaseAnalyzer {
   name = "git-history";
   async analyze(context) {
@@ -6594,9 +6718,9 @@ async function runAll(context) {
 }
 
 // src/utils/git.ts
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
-var exec8 = promisify8(execFile8);
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+var exec8 = promisify9(execFile9);
 async function isGitRepo(dir) {
   try {
     await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
@@ -6609,9 +6733,9 @@ async function isGitRepo(dir) {
 // src/mcp/sampler.ts
 init_files();
 import path18 from "path";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
-var exec9 = promisify9(execFile9);
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+var exec9 = promisify10(execFile10);
 var CONFIG_FILES = [
   // Build & project config
   "package.json",
@@ -6903,10 +7027,10 @@ init_drift();
 init_paths();
 init_files();
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 import { z as z4 } from "zod";
-var exec10 = promisify10(execFile10);
+var exec10 = promisify11(execFile11);
 var requestSchema = z4.object({
   id: z4.string().regex(/^[a-zA-Z0-9_-]+$/),
   action: z4.enum(["prepare", "accept", "reaffirm", "retire"]).default("prepare"),
@@ -7187,7 +7311,7 @@ function batchIdFor(offset) {
 // src/mcp/tools.ts
 init_init();
 init_onboarding();
-var exec18 = promisify18(execFile18);
+var exec18 = promisify19(execFile19);
 async function buildContext(dir) {
   return {
     rootDir: dir,
@@ -8113,7 +8237,7 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.14.0"
+      version: "0.14.2"
     },
     {
       instructions: 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, failed verification needs correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'