mason-context 0.17.2 → 0.17.4

package/dist/mason.js

@@ -36,12 +36,69 @@ var init_paths = __esm({
   }
 });
 
+// src/utils/profile.ts
+import { AsyncLocalStorage } from "async_hooks";
+async function profilePhase(label, run) {
+  const phases = profiles.getStore();
+  if (!phases) return run();
+  const start = performance.now();
+  try {
+    return await run();
+  } finally {
+    const timing = phases[label] ??= { calls: 0, totalMs: 0 };
+    timing.calls++;
+    timing.totalMs += performance.now() - start;
+  }
+}
+async function withProfile(run, emit) {
+  const phases = {};
+  const start = performance.now();
+  return profiles.run(phases, async () => {
+    try {
+      return await run();
+    } finally {
+      emit(JSON.stringify({ kind: "mason-profile", version: 1, totalMs: performance.now() - start, phases }));
+    }
+  });
+}
+var profiles;
+var init_profile = __esm({
+  "src/utils/profile.ts"() {
+    "use strict";
+    profiles = new AsyncLocalStorage();
+  }
+});
+
+// src/utils/git-read.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function execGit(args2, options) {
+  const command2 = args2.find((arg) => !arg.startsWith("-")) ?? "other";
+  return profilePhase("git." + (commands.has(command2) ? command2 : "other"), async () => {
+    const { input, ...processOptions } = options;
+    const operation = execute("git", args2, processOptions);
+    if (input !== void 0) {
+      operation.child.stdin.on("error", () => {
+      });
+      operation.child.stdin.end(input);
+    }
+    return operation;
+  });
+}
+var execute, commands;
+var init_git_read = __esm({
+  "src/utils/git-read.ts"() {
+    "use strict";
+    init_profile();
+    execute = promisify(execFile);
+    commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+  }
+});
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
-import { execFile } from "child_process";
-import { promisify } from "util";
 import fg from "fast-glob";
 function isSensitiveFile(file) {
   return file.split(/[\\/]/).some(
@@ -95,12 +152,12 @@ async function createFileAccess(rootDir) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   let gitFiles = null;
   try {
-    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
     gitFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     let inGit = false;
     try {
-      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
       inGit = true;
     } catch {
     }
@@ -143,12 +200,12 @@ async function createFileAccess(rootDir) {
   }
   return { root, config, list, read };
 }
-var exec, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
 var init_files = __esm({
   "src/utils/files.ts"() {
     "use strict";
+    init_git_read();
     init_paths();
-    exec = promisify(execFile);
     SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
     SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
     SOURCE_IGNORE = [
@@ -570,14 +627,14 @@ function extractClaims(content2) {
   const ignored = computeIgnoredLines(lines);
   const paths = /* @__PURE__ */ new Map();
   const counts = [];
-  const commands = /* @__PURE__ */ new Map();
+  const commands2 = /* @__PURE__ */ new Map();
   const addPath = (claim) => {
     const key = [claim.relativeTo ?? "scope", claim.path].join(":");
     if (!paths.has(key)) paths.set(key, claim);
   };
   const addCommand = (claim) => {
     const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
-    if (!commands.has(key)) commands.set(key, claim);
+    if (!commands2.has(key)) commands2.set(key, claim);
   };
   const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
   for (const token of parsed) {
@@ -679,7 +736,7 @@ function extractClaims(content2) {
   return {
     paths: [...paths.values()],
     counts,
-    commands: [...commands.values()]
+    commands: [...commands2.values()]
   };
 }
 var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
@@ -729,9 +786,53 @@ var init_claims = __esm({
   }
 });
 
+// src/audit/inspection.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path5 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path5.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path5.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args2, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args2, options]), () => execGit(args2, options));
+}
+async function auditGitPaths(root, kind) {
+  const shared = inspections.getStore()?.root === path5.resolve(root);
+  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path5.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
 // src/audit/git.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -739,8 +840,7 @@ function parseCommitLine(line) {
 }
 async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot }
     );
@@ -752,8 +852,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 }
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         "-1",
@@ -772,8 +871,7 @@ async function deletingCommitOf(resolvedRoot, relPath) {
 }
 async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
     );
@@ -786,8 +884,7 @@ async function firstCommitOf(resolvedRoot, relPath) {
 async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
   if (!fromHash || fromHash === "unknown") return null;
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         `${fromHash}..HEAD`,
@@ -811,11 +908,11 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     return null;
   }
 }
-var exec2, COMMIT_FORMAT;
+var COMMIT_FORMAT;
 var init_git = __esm({
   "src/audit/git.ts"() {
     "use strict";
-    exec2 = promisify2(execFile2);
+    init_inspection();
     COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
@@ -823,9 +920,7 @@ var init_git = __esm({
 // src/audit/inputs.ts
 import fs4 from "fs/promises";
 import * as nativeFs from "fs";
-import path5 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
+import path6 from "path";
 import fg2 from "fast-glob";
 async function auditInputPath(root, file) {
   if (file === ".") return fs4.realpath(root);
@@ -852,7 +947,7 @@ async function auditGlob(root, patterns, options) {
   if (Array.isArray(patterns) && !patterns.length) return [];
   const directories = /* @__PURE__ */ new Set();
   const readdir2 = ((directory, opts, callback) => {
-    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
       callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
@@ -863,7 +958,7 @@ async function auditGlob(root, patterns, options) {
     }, callback);
   });
   const lstat2 = ((file, callback) => {
-    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
     auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
   });
   const stream = fg2.stream(patterns, {
@@ -900,89 +995,71 @@ async function auditGlob(root, patterns, options) {
   return matches.sort();
 }
 async function gitSourcePaths(root) {
-  const { stdout } = await execute(
-    "git",
-    [
-      "ls-files",
-      "-z",
-      "--cached",
-      "--others",
-      "--exclude-standard",
-      "--",
-      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
-    ],
-    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
-  );
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+  return auditGitPaths(root, "sources");
 }
 async function gitIgnoredPaths(root, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
-  const operation = execute(
-    "git",
-    ["check-ignore", "-z", "--stdin"],
-    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
-  );
-  operation.child.stdin.on("error", () => {
-  });
-  operation.child.stdin.end(files.join("\0") + "\0");
-  try {
-    return new Set((await operation).stdout.split("\0").filter(Boolean));
-  } catch (error) {
-    if (error.code === 1) return /* @__PURE__ */ new Set();
-    throw error;
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
   }
+  return ignored;
 }
-var execute, MAX_INPUTS;
+var MAX_INPUTS;
 var init_inputs = __esm({
   "src/audit/inputs.ts"() {
     "use strict";
     init_files();
     init_storage();
-    execute = promisify3(execFile3);
+    init_git_read();
+    init_inspection();
     MAX_INPUTS = 1e5;
   }
 });
 
 // src/audit/docs.ts
 import fs5 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
+import path7 from "path";
 import fg3 from "fast-glob";
-async function isDirty(resolvedRoot, relPath) {
+async function dirtyDocs(resolvedRoot, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
   try {
-    const { stdout } = await exec3(
-      "git",
-      ["status", "--porcelain", "--", `:(literal)${relPath}`],
-      { cwd: resolvedRoot }
-    );
-    return stdout.trim().length > 0;
+    const dirty = /* @__PURE__ */ new Set();
+    for (let offset = 0; offset < files.length; offset += 256) {
+      const { stdout } = await execGit(
+        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
+        { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
+      );
+      const entries = stdout.split("\0");
+      for (let i = 0; i < entries.length; i++) {
+        if (!entries[i]) continue;
+        const status = entries[i].slice(0, 2);
+        dirty.add(entries[i].slice(3));
+        if (/[RC]/.test(status) && entries[i + 1]) dirty.add(entries[++i]);
+      }
+    }
+    return dirty;
   } catch {
-    return true;
+    return new Set(files);
   }
 }
 async function discoverDocPaths(root) {
   let candidates = [];
   try {
-    const { stdout } = await exec3(
-      "git",
-      [
-        "ls-files",
-        "-z",
-        "--cached",
-        "--others",
-        "--exclude-standard",
-        "--",
-        ":(icase,glob)**/readme.md",
-        ":(icase,glob)**/agents.md",
-        ":(icase,glob)**/claude.md"
-      ],
-      { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
-    );
-    candidates = stdout.split("\0").filter(Boolean);
+    candidates = await auditGitPaths(root, "documents");
   } catch (error) {
     try {
-      await exec3("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
     } catch {
       return localDocPaths(root);
     }
@@ -1029,43 +1106,54 @@ async function localDocPaths(root) {
       throw error;
     }
     for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-      paths.push(path6.posix.join(dir, entry.name));
+      paths.push(path7.posix.join(dir, entry.name));
     }
   }
   return paths;
 }
 function documentScope(file) {
-  const parent = path6.posix.dirname(file);
-  return path6.posix.basename(parent).toLowerCase() === ".claude" ? path6.posix.dirname(parent) : parent;
+  const parent = path7.posix.dirname(file);
+  return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
+  return profilePhase("audit.documents", () => readDocs(resolvedRoot));
+}
+async function readDocs(resolvedRoot) {
   const docs = [];
-  for (const candidate of await discoverDocPaths(resolvedRoot)) {
-    const content2 = await readAuditInput(resolvedRoot, candidate);
-    if (content2 === null) throw new Error("Document disappeared during discovery: " + candidate);
-    const [lastCommit, dirty] = await Promise.all([lastCommitOf(resolvedRoot, candidate), isDirty(resolvedRoot, candidate)]);
-    docs.push({
-      path: candidate,
-      content: content2,
-      scope: documentScope(candidate),
-      kind: /^readme\.md$/i.test(path6.posix.basename(candidate)) ? "readme" : "instructions",
-      lineCount: content2.split("\n").length,
-      lastCommit,
-      dirty,
-      claims: extractClaims(content2)
-    });
+  const files = await discoverDocPaths(resolvedRoot);
+  const dirty = await dirtyDocs(resolvedRoot, files);
+  for (let offset = 0; offset < files.length; offset += 4) {
+    docs.push(...await Promise.all(files.slice(offset, offset + 4).map(async (candidate) => {
+      const [content2, lastCommit] = await Promise.all([
+        readAuditInput(resolvedRoot, candidate),
+        profilePhase("audit.document-history", () => lastCommitOf(resolvedRoot, candidate))
+      ]);
+      if (content2 === null) throw new Error("Document disappeared during discovery: " + candidate);
+      return {
+        path: candidate,
+        content: content2,
+        scope: documentScope(candidate),
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
+        lineCount: content2.split("\n").length,
+        lastCommit,
+        dirty: dirty.has(candidate),
+        claims: extractClaims(content2)
+      };
+    })));
   }
   return docs;
 }
-var exec3, DOC_CANDIDATES;
+var DOC_CANDIDATES;
 var init_docs = __esm({
   "src/audit/docs.ts"() {
     "use strict";
+    init_git_read();
+    init_profile();
     init_claims();
     init_git();
     init_inputs();
     init_files();
-    exec3 = promisify4(execFile4);
+    init_inspection();
     DOC_CANDIDATES = [
       "AGENTS.md",
       "CLAUDE.md",
@@ -1076,14 +1164,14 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs6 from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function scopedPath(directory, value) {
-  if (path7.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
-  const resolved = path7.posix.normalize(path7.posix.join(directory, value));
+  if (path8.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
+  const resolved = path8.posix.normalize(path8.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path7.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path8.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1117,9 +1205,9 @@ var init_scope = __esm({
 });
 
 // src/test-map.ts
-import path8 from "path";
+import path9 from "path";
 async function buildTestMap(dir) {
-  const rootDir = path8.resolve(dir);
+  const rootDir = path9.resolve(dir);
   const access = await createFileAccess(rootDir);
   const testPatterns = [
     "**/*.test.*",
@@ -1140,7 +1228,7 @@ async function buildTestMap(dir) {
   const sourceByBaseName = /* @__PURE__ */ new Map();
   for (const file of sourceFiles) {
     if (testFiles.includes(file)) continue;
-    const baseName = path8.basename(file).replace(/\.[^.]+$/, "");
+    const baseName = path9.basename(file).replace(/\.[^.]+$/, "");
     const existing = sourceByBaseName.get(baseName) ?? [];
     existing.push(file);
     sourceByBaseName.set(baseName, existing);
@@ -1148,7 +1236,7 @@ async function buildTestMap(dir) {
   const paired = [];
   const unmatched = [];
   for (const testFile of testFiles) {
-    const testBaseName = path8.basename(testFile).replace(/\.[^.]+$/, "");
+    const testBaseName = path9.basename(testFile).replace(/\.[^.]+$/, "");
     const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
     if (!sourceName) {
       unmatched.push(testFile);
@@ -1156,10 +1244,10 @@ async function buildTestMap(dir) {
     }
     const candidates = sourceByBaseName.get(sourceName);
     if (candidates && candidates.length > 0) {
-      const testDir = path8.dirname(testFile);
+      const testDir = path9.dirname(testFile);
       const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path8.dirname(candidate);
-        const bestDir = path8.dirname(best);
+        const candidateDir = path9.dirname(candidate);
+        const bestDir = path9.dirname(best);
         const candidateOverlap = commonSegments(testDir, candidateDir);
         const bestOverlap = commonSegments(testDir, bestDir);
         return candidateOverlap > bestOverlap ? candidate : best;
@@ -1193,9 +1281,7 @@ var init_test_map = __esm({
 });
 
 // src/snapshot/snapshot.ts
-import path9 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+import path10 from "path";
 import { z as z2 } from "zod";
 async function inspectSnapshot(rootDir) {
   try {
@@ -1211,7 +1297,7 @@ async function inspectSnapshot(rootDir) {
 }
 async function getCurrentGitHash(rootDir) {
   try {
-    const { stdout } = await exec4("git", ["rev-parse", "HEAD"], {
+    const { stdout } = await execGit(["rev-parse", "HEAD"], {
       cwd: rootDir
     });
     return stdout.trim();
@@ -1219,16 +1305,16 @@ async function getCurrentGitHash(rootDir) {
     return "unknown";
   }
 }
-var exec4, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
 var init_snapshot = __esm({
   "src/snapshot/snapshot.ts"() {
     "use strict";
+    init_git_read();
     init_files();
     init_files();
     init_storage();
     init_paths();
     init_test_map();
-    exec4 = promisify5(execFile5);
     repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z2.string().optional(),
@@ -1258,9 +1344,7 @@ var init_snapshot = __esm({
 
 // src/drift/drift.ts
 import fs7 from "fs/promises";
-import path10 from "path";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import path11 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -1281,7 +1365,7 @@ function touchedPaths(changes) {
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec5("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
     return parseChanges(stdout);
   } catch {
     return null;
@@ -1290,8 +1374,8 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      exec5("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec5("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
     return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
@@ -1299,13 +1383,12 @@ async function getWorkingTree(resolvedRoot) {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
 }
-var exec5;
 var init_drift = __esm({
   "src/drift/drift.ts"() {
     "use strict";
+    init_git_read();
     init_snapshot();
     init_paths();
-    exec5 = promisify6(execFile6);
   }
 });
 
@@ -1326,7 +1409,7 @@ var init_types = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path11 from "path";
+import path12 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1355,7 +1438,7 @@ async function checkDeletedReferences(ctx) {
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
         tracked: await lastCommitOf(ctx.root, file),
-        parent: await pathExists(ctx.root, path11.posix.dirname(file))
+        parent: await pathExists(ctx.root, path12.posix.dirname(file))
       })));
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
       if (!candidate && claim.relativeTo !== "document") continue;
@@ -1395,7 +1478,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg4 from "fast-glob";
 import fs8 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1433,23 +1516,36 @@ async function checkNewModules(ctx) {
   return result;
 }
 function moduleDocumentation(docs) {
-  return docs.map((doc) => doc.content + "\n" + (path12.posix.dirname(doc.path) === "." ? "" : path12.posix.dirname(doc.path) + "/")).join("\n");
+  return docs.map((doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")).join("\n");
+}
+function moduleCandidates(root, combinedDocs) {
+  return inspectionRead(root, "modules:" + combinedDocs, () => collectModuleCandidates(root, combinedDocs));
 }
-async function moduleCandidates(root, combinedDocs) {
+async function collectModuleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
-  const listSubdirs = async (dir) => {
-    const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path12.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path12.posix.join(dir, entry.name));
-    const ignored = await gitIgnoredPaths(root, dirs);
-    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
-    return (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
-      ignore,
-      onlyDirectories: true,
-      label: "Module directory discovery",
-      select: (file) => visible.has(file)
-    })).map((file) => path12.posix.basename(file));
+  const listSubdirs = async (parents) => {
+    const byParent = /* @__PURE__ */ new Map();
+    for (let offset = 0; offset < parents.length; offset += 16) {
+      await Promise.all(parents.slice(offset, offset + 16).map(async (dir) => {
+        const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+        const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path13.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path13.posix.join(dir, entry.name));
+        byParent.set(dir, dirs);
+      }));
+    }
+    const ignored = await gitIgnoredPaths(root, [...byParent.values()].flat());
+    const result = /* @__PURE__ */ new Map();
+    for (const dir of parents) {
+      const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+        ignore,
+        onlyDirectories: true,
+        label: "Module directory discovery",
+        select: (file) => visible.has(file)
+      })).map((file) => path13.posix.basename(file)));
+    }
+    return result;
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
@@ -1465,14 +1561,16 @@ async function moduleCandidates(root, combinedDocs) {
     return count4;
   };
   const candidates = [];
-  for (const topDir of await listSubdirs(".")) {
+  const topDirs = (await listSubdirs(["."])).get(".");
+  const nested = await listSubdirs(topDirs.filter((dir) => isMentioned(combinedDocs, dir)));
+  for (const topDir of topDirs) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
       const count4 = await countSourceFiles(topDir);
       if (count4 >= 1) candidates.push({ dir: topDir, sourceFileCount: count4 });
       continue;
     }
-    const subdirs = await listSubdirs(topDir);
+    const subdirs = nested.get(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
@@ -1489,6 +1587,7 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
+    init_inspection();
     init_files();
     init_inputs();
     init_git();
@@ -1518,7 +1617,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path13 from "path";
+import path14 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content2 = await readAuditInput(root, name);
@@ -1552,7 +1651,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1583,7 +1682,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1605,8 +1704,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path13.dirname(m));
-    } else if (await readAuditInput(root, path13.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path14.dirname(m));
+    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1626,7 +1725,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path13.join(root, scope), claim);
+  const source = await resolveCountSource(path14.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1678,7 +1777,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path14 from "path";
+import path15 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -1714,7 +1813,7 @@ async function commandInputs(root, docs) {
     }
     let cursor = directory;
     while (true) {
-      const manifest = path14.posix.join(cursor, "package.json");
+      const manifest = path15.posix.join(cursor, "package.json");
       scope.candidates.push(manifest);
       const raw = await read(manifest);
       if (raw !== null) {
@@ -1725,7 +1824,7 @@ async function commandInputs(root, docs) {
         break;
       }
       if (claim.directory !== void 0 || cursor === ".") break;
-      cursor = path14.posix.dirname(cursor);
+      cursor = path15.posix.dirname(cursor);
     }
     if (!resolution.manifest && !resolution.problem) {
       resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -1788,10 +1887,8 @@ var init_dead_command = __esm({
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
 async function git(root, args2) {
-  return (await exec6("git", args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+  return (await execGit(args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
 function withoutAndroidReleaseValues(text2) {
   if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
@@ -1837,11 +1934,10 @@ async function releaseMetadataOnly(root, commit) {
     return false;
   }
 }
-var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify7(execFile7);
+    init_git_read();
   }
 });
 
@@ -1937,7 +2033,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path15 from "path";
+import path16 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2121,7 +2217,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import { createHash } from "crypto";
 import { z as z4 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2172,9 +2268,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path17 from "path";
+import path18 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path17.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2398,8 +2494,6 @@ var init_findings = __esm({
 
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
 import { z as z6 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
@@ -2526,10 +2620,12 @@ async function advisoryReviewInventory(root) {
   if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
   return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
 }
-var execute2, git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
+    init_inspection();
+    init_git_read();
     init_findings();
     init_deps_changed();
     init_inputs();
@@ -2539,8 +2635,7 @@ var init_advisory_review = __esm({
     init_store();
     init_decisions();
     init_drift2();
-    execute2 = promisify8(execFile8);
-    git2 = async (root, ...args2) => (await execute2("git", args2, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
+    git2 = async (root, ...args2) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args2[0]) ? inspectionGit : execGit)(args2, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
     hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
     commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
     evidenceSchema2 = z6.object({
@@ -2584,9 +2679,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
-  const resolvedRoot = path18.resolve(rootDir);
+  return profilePhase("audit.current", () => auditCurrent(rootDir, options));
+}
+async function auditCurrent(rootDir, options) {
+  const resolvedRoot = path19.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2612,15 +2710,15 @@ async function computeAudit(rootDir, options = {}) {
   };
   if (!report.gitAvailable) return report;
   const changesSinceDoc = /* @__PURE__ */ new Map();
+  const changesByCommit = /* @__PURE__ */ new Map();
   for (const doc of docs) {
-    changesSinceDoc.set(
-      doc.path,
-      doc.lastCommit ? await getChangesWithStatus(resolvedRoot, doc.lastCommit.hash) : null
-    );
+    const hash2 = doc.lastCommit?.hash;
+    if (hash2 && !changesByCommit.has(hash2)) changesByCommit.set(hash2, await getChangesWithStatus(resolvedRoot, hash2));
+    changesSinceDoc.set(doc.path, hash2 ? changesByCommit.get(hash2) : null);
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path18.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2650,6 +2748,7 @@ async function computeAudit(rootDir, options = {}) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_profile();
     init_drift();
     init_snapshot();
     init_docs();
@@ -2661,7 +2760,7 @@ var init_audit = __esm({
 
 // src/audit/repair.ts
 import fs12 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -2685,6 +2784,9 @@ async function docState(root) {
   return digest(docs);
 }
 async function stableAudit(root, checks, options = {}) {
+  return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
+}
+async function readStableAudit(root, checks, options) {
   const head = await getCurrentGitHash(root);
   const before = await docState(root);
   const report = await computeAudit(root, { ...options, checks });
@@ -2693,10 +2795,43 @@ async function stableAudit(root, checks, options = {}) {
   }
   return report;
 }
-async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
+async function withRepairSession(root, options, run, validate, cachedAudit) {
+  const head = await getCurrentGitHash(root);
+  const audits = /* @__PURE__ */ new Map();
+  const documents = /* @__PURE__ */ new Map();
+  const history = /* @__PURE__ */ new Map();
+  const assessments = /* @__PURE__ */ new Map();
+  const memo = (cache, key, read) => {
+    if (!cache.has(key)) cache.set(key, read());
+    return cache.get(key);
+  };
+  const session = {
+    audit: (checks) => memo(audits, [...checks].sort().join(","), async () => {
+      if (cachedAudit && cachedAudit.headHash === head && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
+        const current = structuredClone(cachedAudit);
+        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, head)))).filter((r) => r !== null);
+        delete current.advisoryReviews;
+        if (reviews.length) current.advisoryReviews = reviews;
+        return current;
+      }
+      return computeAudit(root, { ...options, checks });
+    }),
+    document: (file) => memo(documents, file, async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)),
+    history: (head2) => memo(history, head2, () => getChangesWithStatus(root, head2)),
+    assessment: (dir, finding, head2) => memo(assessments, digest([dir, finding, head2]), () => assessAdvisory(dir, finding, head2))
+  };
+  const result = await run({
+    prepare: () => prepareOriginal(root, ALL_CHECKS, options, session),
+    verify: (baseline) => profilePhase("repair.verify", () => verifyOriginal(root, baseline, options, session)),
+    currentAudit: () => session.audit(ALL_CHECKS)
+  });
+  await validate();
+  return result;
+}
+async function prepareOriginal(rootDir, checks, options, session) {
   const root = await fs12.realpath(rootDir);
   const selected = z7.array(checkSchema).nonempty().parse(checks);
-  const report = await stableAudit(root, selected, options);
+  const report = await (session ? session.audit(selected) : stableAudit(root, selected, options));
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
   const storedReport = reportSchema.parse(report);
@@ -2712,8 +2847,8 @@ async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path19.resolve(rootDir);
-  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path20.resolve(rootDir);
+  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2721,24 +2856,24 @@ async function loadRepairBaseline(rootDir, baselinePath) {
   const original = stored.report;
   return { root, relative, original };
 }
-async function verifyRepair(rootDir, baselinePath, options = {}) {
+async function verifyOriginal(rootDir, baselinePath, options, session) {
   const { root, relative, original } = await loadRepairBaseline(rootDir, baselinePath);
   const diagnostics = [];
   let reviewDigest;
   let current = null;
   try {
-    reviewDigest = digest(await advisoryReviewInventory(root));
-    current = await stableAudit(root, original.checksRun, options);
+    if (!session) reviewDigest = digest(await advisoryReviewInventory(root));
+    current = await (session ? session.audit(original.checksRun) : stableAudit(root, original.checksRun, options));
     if (!current) diagnostics.push("No context files remain available to audit.");
     else if (!current.gitAvailable) diagnostics.push("Git history is unavailable.");
     for (const doc of original.docs) {
       if (!allFindings(original).some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path)) continue;
-      const content2 = await readBoundedFile(await storePath(root, doc.path), 10 * 1024 * 1024);
+      const content2 = await (session ? session.document(doc.path) : readBoundedFile(await storePath(root, doc.path), 10 * 1024 * 1024));
       if (content2 === null || !content2.trim()) {
         diagnostics.push("Original context file " + doc.path + " is empty or unreadable; losing its claims does not verify a repair.");
       }
     }
-    if (await getChangesWithStatus(root, original.headHash) === null) {
+    if (await (session ? session.history(original.headHash) : getChangesWithStatus(root, original.headHash)) === null) {
       diagnostics.push("The original audit commit is unavailable; repair history cannot be verified.");
     }
   } catch (error) {
@@ -2763,7 +2898,7 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
     }
-    const review = await assessAdvisory(root, now ?? finding, original.headHash);
+    const review = await (session?.assessment ?? assessAdvisory)(root, now ?? finding, original.headHash);
     if (review) {
       if (review.status === "unverified") return { ...base, review, status: "unverified", reason: review.reason };
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
@@ -2778,7 +2913,7 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
   }));
-  try {
+  if (!session) try {
     if (reviewDigest !== digest(await advisoryReviewInventory(root)) || current?.headHash !== await getCurrentGitHash(root)) {
       diagnostics.push("HEAD or advisory review records changed during verification; repeat against stable evidence.");
       for (const finding of findings) {
@@ -2818,6 +2953,7 @@ var count2, reportSchema, baselineSchema, repairFindingSchema;
 var init_repair = __esm({
   "src/audit/repair.ts"() {
     "use strict";
+    init_profile();
     init_audit();
     init_docs();
     init_snapshot();
@@ -2871,27 +3007,25 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
 import fg5 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args2) {
-  return (await exec7("git", args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
+  return profilePhase("automation.git", async () => (await execGit(args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
 async function workspace(dir) {
   const root = await fs13.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
-  const gitDir = await fs13.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
-  let branch;
-  try {
-    branch = (await git3(root, "symbolic-ref", "--quiet", "HEAD")).trim();
-  } catch {
-    branch = "detached";
-  }
+  const [gitDir, branch] = await Promise.all([
+    git3(root, "rev-parse", "--absolute-git-dir").then((value) => fs13.realpath(value.trim())),
+    git3(root, "symbolic-ref", "--quiet", "HEAD").then((value) => value.trim(), () => "detached")
+  ]);
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
 async function readInputs(root) {
+  return profilePhase("automation.inputs", () => collectInputs(root));
+}
+async function collectInputs(root) {
   const docPaths = await discoverDocPaths(root);
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git3(root, "rev-parse", "HEAD"),
@@ -2902,27 +3036,35 @@ async function readInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path20.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   const docs = {};
   const docContents = [];
+  const parsedDocs = [];
   const claims = [];
+  const presence = /* @__PURE__ */ new Map();
+  const exists = (file) => {
+    if (!presence.has(file)) presence.set(file, pathExists(root, file));
+    return presence.get(file);
+  };
   for (const file of docPaths) {
     const text2 = await content(root, file);
     docs[file] = text2 === null ? null : hash(text2);
     docContents.push([file, text2]);
-    for (const claim of text2 ? extractClaims(text2).paths : []) {
+    const parsed = { path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") };
+    parsedDocs.push(parsed);
+    for (const claim of parsed.claims.paths) {
       const scope = pathClaimScope(file, claim);
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        claims.push([candidate, await pathExists(root, candidate), await pathExists(root, path20.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
+        claims.push([candidate, filePresent, parentPresent]);
       }
     }
   }
-  const parsedDocs = docContents.map(([file, text2]) => ({ path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") }));
   const combinedDocs = moduleDocumentation(parsedDocs);
   const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
@@ -2930,7 +3072,7 @@ async function readInputs(root) {
     if (error.code === "ENOENT") return "absent";
     throw error;
   });
-  const [modules, counts, commands, decisionFiles] = await Promise.all([
+  const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
     commandInputs(root, parsedDocs),
@@ -2944,12 +3086,12 @@ async function readInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [4, engineVersion, head, shallow, replacements, docContents];
+  const common = [5, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
     "stale-count": hash([common, counts]),
-    "dead-command": hash([common, commands]),
+    "dead-command": hash([common, commands2]),
     "deps-changed": hash([common, docStatus]),
     "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
   };
@@ -2969,21 +3111,30 @@ function checkCache(raw, inputs) {
       reused.add(name);
       return structuredClone(entries[name].result);
     }
-    const result = await CHECKS[name](ctx);
+    const result = await profilePhase("check." + name, () => CHECKS[name](ctx));
     ran.add(name);
     if (!result.skipped.length) entries[name] = { key: inputs.keys[name], result };
     else delete entries[name];
     return result;
   } };
-  return { options, ran, reused, diagnostic, serialize: () => {
-    const canonical = cacheSchema.shape.entries.parse(entries);
-    return { version: 1, entries: canonical, digest: hash(canonical) };
-  } };
+  return {
+    options,
+    ran,
+    reused,
+    diagnostic,
+    has: (name) => entries[name]?.key === inputs.keys[name] && !entries[name].result.skipped.length,
+    serialize: () => {
+      const canonical = cacheSchema.shape.entries.parse(entries);
+      return { version: 1, entries: canonical, digest: hash(canonical) };
+    }
+  };
 }
-var exec7, engineVersion, hash, content, cacheSchema;
+var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_git_read();
+    init_profile();
     init_docs();
     init_scope();
     init_claims();
@@ -2995,8 +3146,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    exec7 = promisify9(execFile9);
-    engineVersion = true ? "0.17.2" : "development";
+    engineVersion = true ? "0.17.4" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3190,7 +3340,7 @@ var init_execution = __esm({
 import { randomUUID as randomUUID4 } from "crypto";
 import { z as z10 } from "zod";
 async function observeReadOnlyTool(dir, event) {
-  const ws = await workspace(dir);
+  const ws = await profilePhase("automation.workspace", () => workspace(dir));
   await withLock(ws.root, ws.directory, async () => {
     const statePath = ws.directory + "/state.json";
     const raw = await readStoreJson(ws.root, statePath);
@@ -3237,24 +3387,41 @@ async function loadState(ws) {
   }
   return state;
 }
-async function sharedAnalysis(ws, state, inputs, startedAt) {
+async function matchingAnalysis(ws, state, inputs) {
   const pointer = state.analysis;
-  if (!pointer || pointer.fingerprint !== inputs.fingerprint || pointer.completedAt < startedAt) return null;
-  const stored = sharedSchema.parse(await readStoreJson(ws.root, pointer.path));
+  if (!pointer || pointer.fingerprint !== inputs.fingerprint) return { analysis: null };
+  if (pointer.path !== ws.directory + "/checks/analysis-" + inputs.fingerprint + ".json") {
+    throw new Error("Invalid automation analysis cache path; inspect the retained state.");
+  }
+  const invalid = { analysis: null, diagnostic: "Discarded an invalid current-audit cache; audit preparation and original verification were repeated." };
+  let raw;
+  try {
+    raw = await readStoreJson(ws.root, pointer.path);
+  } catch (error) {
+    const cause = error.cause;
+    if (cause instanceof SyntaxError || cause instanceof Error && cause.message === "expected a JSON object, received null") return invalid;
+    throw error;
+  }
+  if (raw === null) return { analysis: null };
+  const parsed = sharedSchema.safeParse(raw);
+  if (!parsed.success) return invalid;
+  const stored = parsed.data;
   const a = stored.analysis;
   if (stored.digest !== hash(a) || a.id !== pointer.id || a.fingerprint !== inputs.fingerprint || a.completedAt !== pointer.completedAt || a.report.root !== ws.root || a.report.branch !== ws.branch || a.report.head !== inputs.head || hash(a.report.baselinePaths) !== hash(state.baselines.map((b) => b.path))) {
-    throw new Error("Invalid shared automation evidence; run a new check.");
+    return invalid;
   }
   if (a.baselineDigest !== await baselineDigest(ws, state)) throw new Error("Repair baseline was modified; use the original baseline.");
-  return a;
+  return { analysis: a };
 }
 async function verifyInputs(ws, inputs) {
-  const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
-  if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
-    throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
-  }
+  return profilePhase("automation.revalidate", () => withRepositoryInspection(ws.root, async () => {
+    const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
+    if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
+      throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
+    }
+  }));
 }
-async function computeAnalysis(ws, state, inputs, event) {
+async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDiagnostic) {
   const baselines = [...state.baselines];
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const empty = {
@@ -3272,7 +3439,10 @@ async function computeAnalysis(ws, state, inputs, event) {
     capture: "unknown",
     scope: SCOPE
   };
-  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) return { baselines, report: empty, cache: null };
+  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
+    await verifyInputs(ws, inputs);
+    return { baselines, report: empty, cache: null };
+  }
   if (ws.branch === "detached" && state.latest) {
     const previous = await readStoreJson(ws.root, state.latest);
     if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
@@ -3283,7 +3453,7 @@ async function computeAnalysis(ws, state, inputs, event) {
     }
   }
   let cached = null;
-  const diagnostics = [];
+  const diagnostics = cacheDiagnostic ? [cacheDiagnostic] : [];
   try {
     cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
   } catch {
@@ -3291,19 +3461,26 @@ async function computeAnalysis(ws, state, inputs, event) {
   }
   const cache = checkCache(cached, inputs);
   if (cache.diagnostic) diagnostics.push(cache.diagnostic);
-  const saveBaseline = async () => {
-    if (baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
-    const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
-    baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
-  };
-  if (!baselines.length) await saveBaseline();
-  const verifications = [];
-  for (const baseline of baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
-  const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
-  if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
-    await saveBaseline();
-    verifications.push(await verifyRepair(ws.root, baselines.at(-1).path, cache.options));
-  }
+  const cachedAudit = previousAudit?.gitAvailable && previousAudit.headHash === inputs.head && previousAudit.root === ws.root && !previousAudit.skippedChecks.length && ALL_CHECKS.every((name) => previousAudit.checksRun?.includes(name) && cache.has(name)) ? previousAudit : void 0;
+  if (cachedAudit) for (const name of ALL_CHECKS) cache.reused.add(name);
+  let currentAudit = null;
+  const verifications = await withRepairSession(ws.root, cache.options, async (repairs) => {
+    const saveBaseline = async () => {
+      if (baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
+      const prepared = await repairs.prepare();
+      baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
+    };
+    if (!baselines.length) await saveBaseline();
+    const verifications2 = [];
+    for (const baseline of baselines) verifications2.push(await repairs.verify(baseline.path));
+    const known = new Set(verifications2.flatMap((v) => v.findings.map((f) => f.id)));
+    if (verifications2.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
+      await saveBaseline();
+      verifications2.push(await repairs.verify(baselines.at(-1).path));
+    }
+    currentAudit = await repairs.currentAudit();
+    return verifications2;
+  }, () => verifyInputs(ws, inputs), cachedAudit);
   const merged = /* @__PURE__ */ new Map();
   for (const verification of verifications) {
     for (const finding of verification.findings) {
@@ -3324,21 +3501,20 @@ async function computeAnalysis(ws, state, inputs, event) {
     reportPath: "",
     findings: [...merged.values()],
     diagnostics: [...new Set(diagnostics)],
-    checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: verifications.at(-1).currentAudit?.skippedChecks ?? [] },
+    checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: verifications.at(-1).currentAudit?.skippedChecks ?? [], ...cachedAudit ? { auditReused: true } : {} },
     counts,
     capture: "unknown",
     scope: SCOPE
   };
-  return { baselines, report, cache: cache.ran.size || cached === null || cache.diagnostic ? cache.serialize() : null };
+  return { baselines, report, currentAudit, cache: cache.ran.size || cached === null || cache.diagnostic ? cache.serialize() : null };
 }
 async function analyze(ws, inputs, event, startedAt) {
   return withLock(ws.root, ws.directory + "/analysis/" + inputs.fingerprint, async () => {
     const before = await loadState(ws);
-    const shared = await sharedAnalysis(ws, before, inputs, startedAt);
-    if (shared) return { analysis: shared, shared: true };
+    const { analysis: previous, diagnostic } = await matchingAnalysis(ws, before, inputs);
+    if (previous && previous.completedAt >= startedAt) return { analysis: previous, shared: true };
     const originalDigest = await baselineDigest(ws, before);
-    const computed = await computeAnalysis(ws, before, inputs, event);
-    await verifyInputs(ws, inputs);
+    const computed = await computeAnalysis(ws, before, inputs, event, previous?.currentAudit, diagnostic);
     if (originalDigest !== await baselineDigest(ws, before)) throw new Error("Repair baseline was modified during automation; original evidence must be inspected.");
     const id = randomUUID4();
     const analysis = analysisSchema.parse({
@@ -3346,7 +3522,8 @@ async function analyze(ws, inputs, event, startedAt) {
       fingerprint: inputs.fingerprint,
       completedAt: Date.now(),
       baselineDigest: await baselineDigest(ws, { ...before, baselines: computed.baselines }),
-      report: computed.report
+      report: computed.report,
+      currentAudit: computed.currentAudit
     });
     const analysisPath = ws.directory + "/checks/analysis-" + inputs.fingerprint + ".json";
     await withLock(ws.root, ws.directory, async () => {
@@ -3365,17 +3542,17 @@ async function analyze(ws, inputs, event, startedAt) {
 }
 async function automate(dir, event) {
   const startedAt = Date.now();
-  const ws = await workspace(dir);
-  return recordExecution(ws.root, ws.directory, event.event, async () => {
+  const ws = await profilePhase("automation.workspace", () => workspace(dir));
+  return recordExecution(ws.root, ws.directory, event.event, () => withRepositoryInspection(ws.root, async () => {
     const inputs = await readInputs(ws.root);
-    const result = await analyze(ws, inputs, event, startedAt);
+    const result = await profilePhase("automation.analysis", () => analyze(ws, inputs, event, startedAt));
     if (result.shared) {
       await verifyInputs(ws, inputs);
       if (result.analysis.baselineDigest !== await baselineDigest(ws, await loadState(ws))) {
         throw new Error("Repair baseline was modified during shared automation; original evidence must be inspected.");
       }
     }
-    return withLock(ws.root, ws.directory, async () => {
+    return profilePhase("automation.publish", () => withLock(ws.root, ws.directory, async () => {
       const state = await loadState(ws);
       if (state.analysis?.id !== result.analysis.id) throw new Error("Automation evidence changed during publication; retry against the current inputs.");
       const report = structuredClone(result.analysis.report);
@@ -3438,11 +3615,11 @@ async function automate(dir, event) {
       if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
       return { report, message: notify ? summarize(report) : null, continueOnce };
-    });
-  });
+    }));
+  }));
 }
 async function automationStatus(dir) {
-  const ws = await workspace(dir);
+  const ws = await profilePhase("automation.workspace", () => workspace(dir));
   const execution = await executionStatus(ws.root, ws.directory);
   const notifications = await failureNotifications(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
@@ -3476,6 +3653,8 @@ var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
+    init_profile();
+    init_inspection();
     init_execution();
     init_repair();
     init_types();
@@ -3490,6 +3669,7 @@ var init_runtime = __esm({
       fingerprint: z10.string(),
       completedAt: z10.number(),
       baselineDigest: z10.string(),
+      currentAudit: reportSchema.nullable().optional(),
       report: z10.object({
         version: z10.literal(1),
         status: z10.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
@@ -3503,7 +3683,8 @@ var init_runtime = __esm({
         checks: z10.object({
           ran: z10.array(z10.string()),
           reused: z10.array(z10.string()),
-          skipped: z10.array(z10.object({ check: z10.string(), reason: z10.string(), doc: z10.string().optional() }))
+          skipped: z10.array(z10.object({ check: z10.string(), reason: z10.string(), doc: z10.string().optional() })),
+          auditReused: z10.boolean().optional()
         }),
         counts: z10.object({ resolved: z10.number(), unresolved: z10.number(), "review-required": z10.number(), unverified: z10.number() }),
         capture: z10.enum(["observed", "unknown"]),
@@ -3511,17 +3692,17 @@ var init_runtime = __esm({
       })
     });
     sharedSchema = z10.object({ analysis: analysisSchema, digest: z10.string() });
-    baselineDigest = async (ws, state) => hash(await Promise.all(
+    baselineDigest = async (ws, state) => profilePhase("automation.baselines", async () => hash(await Promise.all(
       state.baselines.map(async (b) => [b.path, await readStoreJson(ws.root, b.path)])
-    ));
+    )));
   }
 });
 
 // src/automation/hook-root.ts
 import fs15 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 async function repositoryRoot(dir) {
-  if (!path21.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  if (!path22.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
   try {
     return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
   } catch (error) {
@@ -3605,8 +3786,8 @@ __export(launcher_exports, {
   mcpCommand: () => mcpCommand,
   prepareLaunch: () => prepareLaunch
 });
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 import fs16 from "fs/promises";
 function globalCommand(args2, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
@@ -3614,7 +3795,7 @@ function globalCommand(args2, platform = process.platform) {
 async function installedCommand() {
   const invocation = globalCommand(["internal-integration-version"]);
   try {
-    const { stdout } = await promisify10(execFile10)(
+    const { stdout } = await promisify2(execFile2)(
       invocation.command,
       invocation.args,
       { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
@@ -3650,7 +3831,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.2" : "development";
+    executingVersion = () => true ? "0.17.4" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3866,7 +4047,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs18 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -3899,7 +4080,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path22.join(path22.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path23.join(path23.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
     const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs18.open(temporary, "wx", mode);
@@ -4344,14 +4525,14 @@ async function planTeardown(root, selected) {
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
   const automationBefore = await read(AUTOMATION_PATH);
   const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
-  const commands = (host) => new Set([
+  const commands2 = (host) => new Set([
     automation?.hosts[host]?.command,
     ...ownership.files[configPath(host)]?.hookCommands ?? [],
     ...knownManagedHookCommands(host),
     hookConfig(host, hookCommand(host)).hooks.SessionStart[0].hooks[0].command,
     hookConfig(host).hooks.SessionStart[0].hooks[0].command
   ].filter((command2) => !!command2));
-  const possibleHook = (command2, host) => commands(host).has(command2) || /\bmason(?:-auto|-hook)?\b/.test(command2);
+  const possibleHook = (command2, host) => commands2(host).has(command2) || /\bmason(?:-auto|-hook)?\b/.test(command2);
   const add = (file, before, after, empty) => {
     edits.push({ path: file, before, after: ownership.files[file]?.created && (empty || ownership.files[file].initialHash === hash(before)) ? null : after });
   };
@@ -4415,12 +4596,12 @@ async function planTeardown(root, selected) {
       for (const [event, groups] of Object.entries(config.hooks ?? {})) {
         const known = ownership.files[hookFile]?.hooks?.[event];
         const handlers = groups.flatMap((group) => group.hooks);
-        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
+        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands2(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
           diagnostics.push({ path: hookFile, message: "A recorded Mason hook is missing beside a new or edited handler (" + event + "); inspect ownership manually." });
         }
         const kept = groups.flatMap((group) => {
           const handlers2 = group.hooks.filter((handler) => {
-            if (handler.type === "command" && handler.command && commands(host).has(handler.command)) {
+            if (handler.type === "command" && handler.command && commands2(host).has(handler.command)) {
               changed = true;
               return false;
             }
@@ -4552,13 +4733,13 @@ var init_teardown = __esm({
 });
 
 // src/review/cochange.ts
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
+    const { stdout } = await exec(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -4614,11 +4795,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify11(execFile11);
+    exec = promisify3(execFile3);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -4926,10 +5107,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path23 from "path";
+import path24 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path23.isAbsolute(file) ? path23.relative(root, file) : file;
+  const relative = path24.isAbsolute(file) ? path24.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5026,7 +5207,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path23.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path24.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5148,12 +5329,12 @@ var init_evidence2 = __esm({
 
 // src/review/review.ts
 import fs19 from "fs/promises";
-import path24 from "path";
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import path25 from "path";
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec2("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -5164,7 +5345,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec2("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -5177,7 +5358,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path24.resolve(rootDir);
+  const resolvedRoot = path25.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5227,7 +5408,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs19.access(path24.join(resolvedRoot, relPath));
+        await fs19.access(path25.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5260,7 +5441,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec9, MAX_ANALYZED_FILES;
+var exec2, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -5272,7 +5453,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify12(execFile12);
+    exec2 = promisify4(execFile4);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -5607,7 +5788,7 @@ var init_setup = __esm({
 
 // src/distribution/bundle.ts
 import fs20 from "fs/promises";
-import path25 from "path";
+import path26 from "path";
 import { createHash as createHash4 } from "crypto";
 import { z as z23 } from "zod";
 async function readBundle(root) {
@@ -5615,7 +5796,7 @@ async function readBundle(root) {
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path25.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path26.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -5655,16 +5836,16 @@ var init_bundle = __esm({
 // src/distribution/path.ts
 import fs21 from "fs/promises";
 import os3 from "os";
-import path26 from "path";
-import { execFile as execFile13 } from "child_process";
-import { promisify as promisify13 } from "util";
+import path27 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
 import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
 import { z as z24 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path26.posix.isAbsolute(entry) && path26.posix.resolve(entry) === path26.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path27.posix.isAbsolute(entry) && path27.posix.resolve(entry) === path27.posix.resolve(bin));
   const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
   const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
@@ -5684,15 +5865,15 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path26.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path27.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
-    let profiles;
+    let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles = [path26.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles = [path26.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles = [path26.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path27.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path27.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path27.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path26.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path27.join(userHome, name));
       let login = candidates[2];
       for (const file of candidates) if (await fs21.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
@@ -5701,15 +5882,15 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         login = file;
         break;
       }
-      profiles = [path26.join(userHome, ".bashrc"), login];
+      profiles2 = [path27.join(userHome, ".bashrc"), login];
     }
     const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
-    for (const profile of profiles) {
+    for (const profile of profiles2) {
       const stat = await fs21.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs21.realpath(profile) : path26.resolve(profile);
+      const file = stat?.isSymbolicLink() ? await fs21.realpath(profile) : path27.resolve(profile);
       const original = await fs21.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
@@ -5725,7 +5906,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs21.mkdir(path26.dirname(file), { recursive: true });
+      await fs21.mkdir(path27.dirname(file), { recursive: true });
       const handle = await fs21.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
@@ -5813,20 +5994,20 @@ try {
   @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
 } finally { $key.Dispose() }
 `;
-  const { stdout } = await execute3("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
   return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
 }
-var execute3, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
+var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
-    execute3 = promisify13(execFile13);
+    execute2 = promisify5(execFile5);
     pathChangeSchema = z24.discriminatedUnion("kind", [
       z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
       z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path26.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path27.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -5846,7 +6027,7 @@ __export(install_exports2, {
 });
 import fs22 from "fs/promises";
 import os4 from "os";
-import path27 from "path";
+import path28 from "path";
 import { fileURLToPath } from "url";
 import { spawn } from "child_process";
 import { randomUUID as randomUUID8 } from "crypto";
@@ -5863,16 +6044,16 @@ async function replace(file, content2, mode = 384) {
 async function installStandalone(source, progress2) {
   progress2?.step("Checking installation files and location");
   const bundle = await verifyBundle(source);
-  const selectedHome = path27.resolve(defaultHome());
+  const selectedHome = path28.resolve(defaultHome());
   await fs22.mkdir(selectedHome, { recursive: true });
   const home = await fs22.realpath(selectedHome);
-  const selectedBin = path27.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path27.join(home, "bin") : path27.join(os4.homedir(), ".local/bin")));
+  const selectedBin = path28.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path28.join(home, "bin") : path28.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
     const previous = raw === null ? null : recordSchema3.parse(raw);
     if (!previous) for (const file of await fs22.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path27.join(home, file);
+      const directory = path28.join(home, file);
       const stat = await fs22.lstat(directory);
       if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs22.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
@@ -5890,10 +6071,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path27.join(destination, "node.exe"))} ${psQuote(path27.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path28.join(destination, "node.exe"))} ${psQuote(path28.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path27.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path28.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -5902,7 +6083,7 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path27.join(destination, "node"))} ${shQuote(path27.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path28.join(destination, "node"))} ${shQuote(path28.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
@@ -5958,12 +6139,12 @@ exec ${shQuote(path27.join(destination, "node"))} ${shQuote(path27.join(destinat
   });
 }
 async function currentInstallation() {
-  const app = path27.dirname(path27.dirname(fileURLToPath(import.meta.url)));
-  const bundle = path27.dirname(app), home = path27.dirname(path27.dirname(bundle));
+  const app = path28.dirname(path28.dirname(fileURLToPath(import.meta.url)));
+  const bundle = path28.dirname(app), home = path28.dirname(path28.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
   const record = recordSchema3.parse(raw);
-  if (record.home !== await fs22.realpath(home) || path27.dirname(bundle) !== path27.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs22.realpath(home) || path28.dirname(bundle) !== path28.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version, progress2) {
@@ -5972,7 +6153,7 @@ async function upgradeStandalone(version, progress2) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path27.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path28.join(bundle, windows ? "install.ps1" : "install.sh");
   progress2?.stop();
   return new Promise((resolve, reject) => {
     const child = spawn(
@@ -6029,7 +6210,7 @@ var init_install2 = __esm({
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path27.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path27.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path28.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path28.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
@@ -6094,6 +6275,7 @@ function createProgress(options = {}) {
 }
 
 // src/automation/cli.ts
+init_profile();
 var TEARDOWN_USAGE = `Usage: mason teardown [options]
 
 Disconnect Mason from this Git project. Defaults to all project hosts.
@@ -6121,6 +6303,7 @@ var USAGE = `Usage: mason-auto <setup|teardown|install|config|status|check|hook>
   --command <prefix>          Installed executable prefix for install/config
   --dry-run                   Preview teardown without writing
   --json                      Machine-readable output (status also uses JSON when piped)
+  --profile                   Local phase timings on stderr for check/hook; no file contents
 
 check exits 0 for verified checks, 1 for issues, 2 for incomplete/unavailable.
 teardown exits 0 for complete/no-op, 2 when cleanup needs attention (also in dry runs).
@@ -6132,7 +6315,8 @@ var parseCli = (argv) => parseArgs({ args: argv, allowPositionals: true, options
   command: { type: "string" },
   json: { type: "boolean" },
   help: { type: "boolean", short: "h" },
-  "dry-run": { type: "boolean" }
+  "dry-run": { type: "boolean" },
+  profile: { type: "boolean" }
 } });
 function isHookCommand(argv) {
   try {
@@ -6157,6 +6341,8 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
     }
     if (positionals.length !== 1) throw new Error("Expected one command.");
     [action] = positionals;
+    if (values.profile && !["check", "hook"].includes(action)) throw new Error("--profile applies only to check/hook.");
+    const measured = (run) => values.profile ? withProfile(run, io.err) : run();
     const dir = values.dir ?? process.cwd();
     if (values["dry-run"] !== void 0 && action !== "teardown") throw new Error("--dry-run applies only to teardown.");
     if (action === "teardown") {
@@ -6169,7 +6355,7 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
     if (action === "hook") {
       const host = hostSchema.parse(values.host);
       if (options.managedHost && options.managedHost !== host) throw new Error("Managed hook --host does not match its launcher.");
-      const output = await runAutomationHook(host, stdin, { managed: !!options.managedHost });
+      const output = await measured(() => runAutomationHook(host, stdin, { managed: !!options.managedHost }));
       if (output) io.out(JSON.stringify(output));
       return 0;
     }
@@ -6200,7 +6386,7 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
       return 0;
     }
     if (action !== "check") throw new Error("Unknown automation command: " + action);
-    const { report } = await automate(dir, { event: "task_end" });
+    const { report } = await measured(() => automate(dir, { event: "task_end" }));
     io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
@@ -6221,7 +6407,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.17.2"}
+var usage = `Mason ${"0.17.4"}
 
 Usage: mason <command> [options]
 
@@ -6247,9 +6433,9 @@ try {
       await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
     }
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.17.2" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.17.4" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.17.2");
+  else if (["--version", "-v"].includes(command)) console.log("0.17.4");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));