mason-context 0.14.1 → 0.14.2

package/dist/mason.js

@@ -262,15 +262,15 @@ function parseExecution(raw) {
 function automationFailure(error) {
   const recorded = failureSchema.safeParse(error?.failure);
   if (recorded.success) return recorded.data;
-  const message3 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
   const codes = /* @__PURE__ */ new Set();
   let cause = error;
   for (let i = 0; cause && i < 8; i++) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message3) ? "inputs-changed" : /Automation is busy/.test(message3) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message3) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message3) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message3) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
-  return { code, message: message3, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
 }
 function failureMessage(error) {
   const failure = automationFailure(error);
@@ -1105,9 +1105,133 @@ var init_deleted_reference = __esm({
   }
 });
 
-// src/audit/checks/new-module.ts
-import fg2 from "fast-glob";
+// src/audit/inputs.ts
+import fs6 from "fs/promises";
+import * as nativeFs from "fs";
 import path9 from "path";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+import fg2 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs6.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg2.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  const { stdout } = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
+    ],
+    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
+  );
+  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const operation = execute(
+    "git",
+    ["check-ignore", "-z", "--stdin"],
+    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
+  );
+  operation.child.stdin.on("error", () => {
+  });
+  operation.child.stdin.end(files.join("\0") + "\0");
+  try {
+    return new Set((await operation).stdout.split("\0").filter(Boolean));
+  } catch (error) {
+    if (error.code === 1) return /* @__PURE__ */ new Set();
+    throw error;
+  }
+}
+var execute, MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    execute = promisify6(execFile6);
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/checks/new-module.ts
+import fg3 from "fast-glob";
+import fs7 from "fs/promises";
+import path10 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1118,22 +1242,6 @@ function isMentioned(combinedDocs, name) {
   );
   return re.test(combinedDocs);
 }
-async function listSubdirs(absDir) {
-  const dirs = await fg2("*", {
-    cwd: absDir,
-    onlyDirectories: true,
-    suppressErrors: true
-  });
-  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
-}
-async function countSourceFiles(absDir) {
-  const files = await fg2(SOURCE_GLOB, {
-    cwd: absDir,
-    ignore: SOURCE_IGNORE,
-    suppressErrors: true
-  });
-  return files.length;
-}
 async function checkNewModules(ctx) {
   const result = emptyResult();
   if (ctx.docs.length === 0) return result;
@@ -1161,21 +1269,48 @@ async function checkNewModules(ctx) {
   return result;
 }
 async function moduleCandidates(root, combinedDocs) {
+  const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const listSubdirs = async (dir) => {
+    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
+    const ignored = await gitIgnoredPaths(root, dirs);
+    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
+    return (await auditGlob(root, dir === "." ? "*" : `${fg3.escapePath(dir)}/*`, {
+      ignore,
+      onlyDirectories: true,
+      label: "Module directory discovery",
+      select: (file) => visible.has(file)
+    })).map((file) => path10.posix.basename(file));
+  };
+  const countSourceFiles = async (dir) => {
+    const files = sources.filter((file) => file.startsWith(dir + "/"));
+    let count3 = 0;
+    for (let offset = 0; offset < files.length; offset += 256) {
+      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg3.escapePath(file)), {
+        ignore,
+        followSymbolicLinks: false,
+        label: `Source discovery in ${dir}`
+      })).length;
+      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+    }
+    return count3;
+  };
   const candidates = [];
-  for (const topDir of await listSubdirs(root)) {
-    const absTop = path9.join(root, topDir);
+  for (const topDir of await listSubdirs(".")) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count3 = await countSourceFiles(absTop);
+      const count3 = await countSourceFiles(topDir);
       if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
-    const subdirs = await listSubdirs(absTop);
+    const subdirs = await listSubdirs(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      const count3 = await countSourceFiles(`${topDir}/${sub}`);
       if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
         candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
@@ -1187,7 +1322,8 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
-    init_snapshot();
+    init_files();
+    init_inputs();
     init_git();
     init_checks();
     DIR_DENYLIST = /* @__PURE__ */ new Set([
@@ -1215,19 +1351,10 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import fs6 from "fs/promises";
-import path10 from "path";
-import fg3 from "fast-glob";
-async function readIfExists(absPath) {
-  try {
-    return await fs6.readFile(absPath, "utf-8");
-  } catch {
-    return null;
-  }
-}
+import path11 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
-    const content2 = await readIfExists(path10.join(root, name));
+    const content2 = await readAuditInput(root, name);
     if (content2 === null) continue;
     const members = [];
     for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
@@ -1241,26 +1368,28 @@ async function countGradleModules(root) {
   return null;
 }
 async function countNpmWorkspaces(root) {
-  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  const pkgRaw = await readAuditInput(root, "package.json");
   if (pkgRaw !== null) {
+    let globs = [];
     try {
       const pkg = JSON.parse(pkgRaw);
-      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
-      if (globs.length > 0) {
-        const matched = await fg3(
-          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-          { cwd: root, ignore: ["**/node_modules/**"] }
-        );
-        return {
-          actual: matched.length,
-          countedFrom: "package.json workspaces",
-          members: matched.map((m) => path10.dirname(m)).sort()
-        };
-      }
+      globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
     } catch {
     }
+    if (globs.length > 0) {
+      const matched = await auditGlob(
+        root,
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { ignore: ["**/node_modules/**"], label: "npm workspace discovery" }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "package.json workspaces",
+        members: matched.map((m) => path11.dirname(m)).sort()
+      };
+    }
   }
-  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  const pnpmRaw = await readAuditInput(root, "pnpm-workspace.yaml");
   if (pnpmRaw !== null) {
     const globs = [];
     let inPackages = false;
@@ -1279,21 +1408,22 @@ async function countNpmWorkspaces(root) {
       }
     }
     if (globs.length > 0) {
-      const matched = await fg3(
+      const matched = await auditGlob(
+        root,
         globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-        { cwd: root, ignore: ["**/node_modules/**"] }
+        { ignore: ["**/node_modules/**"], label: "pnpm workspace discovery" }
       );
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path10.dirname(m)).sort()
+        members: matched.map((m) => path11.dirname(m)).sort()
       };
     }
   }
   return null;
 }
 async function countCargoCrates(root) {
-  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  const content2 = await readAuditInput(root, "Cargo.toml");
   if (content2 === null) return null;
   const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
@@ -1304,12 +1434,12 @@ async function countCargoCrates(root) {
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (/[*?[\]{}]/.test(entry)) {
-      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
-        cwd: root,
-        ignore: ["**/target/**"]
+      const matched = await auditGlob(root, `${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        ignore: ["**/target/**"],
+        label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path10.dirname(m));
-    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path11.dirname(m));
+    } else if (await readAuditInput(root, path11.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1363,18 +1493,18 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     MEMBERS_CAP = 50;
   }
 });
 
 // src/audit/checks/dead-command.ts
-import fs7 from "fs/promises";
-import path11 from "path";
-import fg4 from "fast-glob";
-async function scriptsOf(absManifest) {
+async function scriptsOf(root, manifest) {
+  const raw = await readAuditInput(root, manifest);
+  if (raw === null) return null;
   try {
-    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    const pkg = JSON.parse(raw);
     return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
   } catch {
     return null;
@@ -1386,7 +1516,7 @@ async function checkDeadCommands(ctx) {
     (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
   );
   if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  const rootScripts = await scriptsOf(ctx.root, "package.json");
   if (rootScripts === null) {
     result.skipped.push({
       check: "dead-command",
@@ -1403,7 +1533,7 @@ async function checkDeadCommands(ctx) {
     const manifests = await commandManifests(ctx.root);
     manifestsChecked = ["package.json", ...manifests.sort()];
     for (const manifest of manifests) {
-      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
+      const scripts = await scriptsOf(ctx.root, manifest);
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -1429,23 +1559,24 @@ async function checkDeadCommands(ctx) {
   return result;
 }
 function commandManifests(root) {
-  return fg4("**/package.json", {
-    cwd: root,
-    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  return auditGlob(root, "**/package.json", {
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"],
+    label: "Command manifest discovery"
   });
 }
 var AVAILABLE_SCRIPTS_CAP;
 var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     AVAILABLE_SCRIPTS_CAP = 30;
   }
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 async function git(root, args2) {
   return (await exec6("git", args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
@@ -1497,7 +1628,7 @@ var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify6(execFile6);
+    exec6 = promisify7(execFile7);
   }
 });
 
@@ -1736,7 +1867,7 @@ var init_provenance = __esm({
       sources: z3.array(decisionSourceSchema).max(20),
       history: z3.array(eventSchema).min(1)
     }).superRefine((record, ctx) => {
-      const invalid = (message3) => ctx.addIssue({ code: "custom", message: message3 });
+      const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
       let previous;
       for (const event of record.history) {
@@ -2262,9 +2393,9 @@ __export(evidence_exports, {
 import fs11 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
-import fg5 from "fast-glob";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+import fg4 from "fast-glob";
 import { z as z5 } from "zod";
 async function git2(root, ...args2) {
   return (await exec7("git", args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
@@ -2280,34 +2411,13 @@ async function workspace(dir) {
   }
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
-async function content(root, file) {
-  try {
-    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
 async function readInputs(root) {
-  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+  const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git2(root, "rev-parse", "HEAD"),
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
-    fg5("**/*", {
-      cwd: root,
-      dot: true,
-      onlyFiles: false,
-      followSymbolicLinks: false,
-      objectMode: true,
-      ignore: SOURCE_IGNORE
-    }),
     git2(root, "rev-parse", "--git-path", "shallow"),
     git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
-  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
-  const files = entries.map((f) => f.path);
-  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
   const head = headText.trim();
   let shallow = null;
   try {
@@ -2328,9 +2438,19 @@ async function readInputs(root) {
       claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
     }
   }
-  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
   const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
   const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const commandClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).commands : []);
+  const rootPackage = await content(root, "package.json");
+  let rootScripts = null;
+  if (rootPackage !== null) {
+    try {
+      const pkg = JSON.parse(rootPackage);
+      rootScripts = pkg?.scripts && typeof pkg.scripts === "object" ? Object.keys(pkg.scripts) : [];
+    } catch {
+    }
+  }
+  const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -2339,16 +2459,19 @@ async function readInputs(root) {
   const [modules, counts, manifests, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
-    commandManifests(root),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    needsWorkspaceScripts ? commandManifests(root) : [],
+    fg4(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
-  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
-  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const packages = [["package.json", rootPackage], ...await Promise.all(manifests.sort().map(async (file) => [file, await content(root, file)]))];
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
+    await storePath(root, file);
+    return [file, await content(root, file)];
+  }));
   const [status, index2] = decisions.length ? await Promise.all([
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [2, engineVersion, head, shallow, replacements, docContents];
+  const common = [3, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -2384,7 +2507,7 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
-var exec7, engineVersion, hash, internal, cacheSchema;
+var exec7, engineVersion, hash, content, internal, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
@@ -2392,14 +2515,15 @@ var init_evidence = __esm({
     init_claims();
     init_repair();
     init_checks();
-    init_files();
+    init_inputs();
     init_new_module();
     init_stale_count();
     init_dead_command();
     init_storage();
-    exec7 = promisify7(execFile7);
-    engineVersion = true ? "0.14.1" : "development";
+    exec7 = promisify8(execFile8);
+    engineVersion = true ? "0.14.2" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+    content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
   }
@@ -2897,8 +3021,8 @@ async function runAutomationHook(host, stdin) {
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message3 = failureMessage(error);
-    return { systemMessage: message3, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message3 } } : {} };
+    const message2 = failureMessage(error);
+    return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
   }
 }
 function hookConfig(host, command2 = "npx --no-install --package mason-context mason-auto") {
@@ -3108,8 +3232,8 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
 });
 
 // src/review/cochange.ts
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
     const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
@@ -3174,7 +3298,7 @@ var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_R
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify8(execFile8);
+    exec8 = promisify9(execFile9);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3217,8 +3341,8 @@ var init_paths2 = __esm({
 });
 
 // src/review/evidence/types.ts
-function messagePreview(message3) {
-  return { message: message3.slice(0, 4e3), ...message3.length > 4e3 ? { truncated: true } : {} };
+function messagePreview(message2) {
+  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
 }
 var MAX_FINDINGS;
 var init_types2 = __esm({
@@ -3639,8 +3763,8 @@ var init_evidence2 = __esm({
 // src/review/review.ts
 import fs14 from "fs/promises";
 import path19 from "path";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
     const { stdout } = await exec9("git", ["merge-base", base, head], {
@@ -3762,7 +3886,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify9(execFile9);
+    exec9 = promisify10(execFile10);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -4167,8 +4291,8 @@ import fs17 from "fs/promises";
 import path22 from "path";
 import { fileURLToPath } from "url";
 import { randomUUID as randomUUID6, createHash as createHash5 } from "crypto";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 async function packageRoot() {
   let directory = path22.dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
@@ -4276,7 +4400,7 @@ var init_runtime2 = __esm({
     init_storage();
     init_evidence();
     init_bundle();
-    exec10 = promisify10(execFile10);
+    exec10 = promisify11(execFile11);
     checksum = (bytes) => createHash5("sha256").update(bytes).digest("hex");
     BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
   }
@@ -4363,7 +4487,7 @@ function summarizeActivation(status) {
       `  Runtime: ${state.runtime}; MCP: ${state.mcp}; instructions: ${state.instructions}.`,
       `  Hooks: ${state.hookConfiguration}; observed: ${state.observedEvents.join(", ") || "none"}.`,
       `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
-      ...state.pending.map((message3) => "  Next: " + message3)
+      ...state.pending.map((message2) => "  Next: " + message2)
     );
   }
   if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
@@ -4524,15 +4648,18 @@ var init_setup = __esm({
 import fs18 from "fs/promises";
 import os3 from "os";
 import path23 from "path";
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
 import { z as z17 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
+  const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path23.posix.isAbsolute(entry) && path23.posix.resolve(entry) === path23.posix.resolve(bin));
+  const message2 = alreadyOnPath ? "Run: mason setup --host codex" : "Open a new terminal, then run: mason setup --host codex";
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
-Add ${bin} to your PATH, then run: mason setup --host codex` });
+${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --host codex`}` });
   if (env.MASON_NO_MODIFY_PATH === "1") return manual("Automatic PATH setup is disabled (MASON_NO_MODIFY_PATH=1).");
   if (/[\r\n\0]/.test(bin) || bin.includes(platform === "win32" ? ";" : ":")) return manual("This installation path cannot be represented safely in PATH.");
   try {
@@ -4676,20 +4803,19 @@ try {
   @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
 } finally { $key.Dispose() }
 `;
-  const { stdout } = await execute("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
   return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
 }
-var execute, pathChangeSchema, quote, message2, normalizeWindowsEntry, hasWindowsEntry;
+var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
-    execute = promisify11(execFile11);
+    execute2 = promisify12(execFile12);
     pathChangeSchema = z17.discriminatedUnion("kind", [
       z17.object({ kind: z17.literal("profile"), file: z17.string(), block: z17.string(), created: z17.boolean() }),
       z17.object({ kind: z17.literal("windows"), entry: z17.string(), created: z17.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    message2 = "Open a new terminal, then run: mason setup --host codex";
     normalizeWindowsEntry = (value) => path23.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
@@ -4977,20 +5103,20 @@ async function runAutomationCli(argv, stdin = "", io = {
     io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
-    const message3 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
+    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
     if (action === "hook" || isHookCommand(argv)) {
-      io.out(JSON.stringify({ systemMessage: message3 }));
+      io.out(JSON.stringify({ systemMessage: message2 }));
       return 0;
     }
     if (argv.includes("--json")) io.out(JSON.stringify({ version: 1, ...action === "setup" ? { action, status: "incomplete", next: "Rerun the same setup command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
-    else io.err(message3);
+    else io.err(message2);
     return 2;
   }
 }
 
 // bin/mason.ts
 var [command, ...args] = process.argv.slice(2);
-var usage = `Mason ${"0.14.1"}
+var usage = `Mason ${"0.14.2"}
 
 Usage: mason <command> [options]
 
@@ -5008,7 +5134,7 @@ Use mason <command> --help for options. npm users can keep using mason-auto,
 mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
 try {
   if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.14.1");
+  else if (["--version", "-v"].includes(command)) console.log("0.14.2");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { sourceRuntime: sourceRuntime2 } = await Promise.resolve().then(() => (init_runtime2(), runtime_exports));