mason-context 0.17.3 → 0.17.4

package/dist/mason-auto.js

@@ -36,12 +36,69 @@ var init_paths = __esm({
   }
 });
 
+// src/utils/profile.ts
+import { AsyncLocalStorage } from "async_hooks";
+async function profilePhase(label, run) {
+  const phases = profiles.getStore();
+  if (!phases) return run();
+  const start = performance.now();
+  try {
+    return await run();
+  } finally {
+    const timing = phases[label] ??= { calls: 0, totalMs: 0 };
+    timing.calls++;
+    timing.totalMs += performance.now() - start;
+  }
+}
+async function withProfile(run, emit) {
+  const phases = {};
+  const start = performance.now();
+  return profiles.run(phases, async () => {
+    try {
+      return await run();
+    } finally {
+      emit(JSON.stringify({ kind: "mason-profile", version: 1, totalMs: performance.now() - start, phases }));
+    }
+  });
+}
+var profiles;
+var init_profile = __esm({
+  "src/utils/profile.ts"() {
+    "use strict";
+    profiles = new AsyncLocalStorage();
+  }
+});
+
+// src/utils/git-read.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function execGit(args, options) {
+  const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
+  return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
+    const { input: input2, ...processOptions } = options;
+    const operation = execute("git", args, processOptions);
+    if (input2 !== void 0) {
+      operation.child.stdin.on("error", () => {
+      });
+      operation.child.stdin.end(input2);
+    }
+    return operation;
+  });
+}
+var execute, commands;
+var init_git_read = __esm({
+  "src/utils/git-read.ts"() {
+    "use strict";
+    init_profile();
+    execute = promisify(execFile);
+    commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+  }
+});
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
-import { execFile } from "child_process";
-import { promisify } from "util";
 import fg from "fast-glob";
 function isSensitiveFile(file) {
   return file.split(/[\\/]/).some(
@@ -95,12 +152,12 @@ async function createFileAccess(rootDir) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   let gitFiles = null;
   try {
-    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
     gitFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     let inGit = false;
     try {
-      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
       inGit = true;
     } catch {
     }
@@ -143,12 +200,12 @@ async function createFileAccess(rootDir) {
   }
   return { root, config, list, read };
 }
-var exec, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
 var init_files = __esm({
   "src/utils/files.ts"() {
     "use strict";
+    init_git_read();
     init_paths();
-    exec = promisify(execFile);
     SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
     SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
     SOURCE_IGNORE = [
@@ -346,39 +403,6 @@ var init_store = __esm({
   }
 });
 
-// src/utils/profile.ts
-import { AsyncLocalStorage } from "async_hooks";
-async function profilePhase(label, run) {
-  const phases = profiles.getStore();
-  if (!phases) return run();
-  const start = performance.now();
-  try {
-    return await run();
-  } finally {
-    const timing = phases[label] ??= { calls: 0, totalMs: 0 };
-    timing.calls++;
-    timing.totalMs += performance.now() - start;
-  }
-}
-async function withProfile(run, emit) {
-  const phases = {};
-  const start = performance.now();
-  return profiles.run(phases, async () => {
-    try {
-      return await run();
-    } finally {
-      emit(JSON.stringify({ kind: "mason-profile", version: 1, totalMs: performance.now() - start, phases }));
-    }
-  });
-}
-var profiles;
-var init_profile = __esm({
-  "src/utils/profile.ts"() {
-    "use strict";
-    profiles = new AsyncLocalStorage();
-  }
-});
-
 // src/audit/commands.ts
 import path4 from "path";
 function splitCommands(line) {
@@ -603,14 +627,14 @@ function extractClaims(content2) {
   const ignored = computeIgnoredLines(lines);
   const paths = /* @__PURE__ */ new Map();
   const counts = [];
-  const commands = /* @__PURE__ */ new Map();
+  const commands2 = /* @__PURE__ */ new Map();
   const addPath = (claim) => {
     const key = [claim.relativeTo ?? "scope", claim.path].join(":");
     if (!paths.has(key)) paths.set(key, claim);
   };
   const addCommand = (claim) => {
     const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
-    if (!commands.has(key)) commands.set(key, claim);
+    if (!commands2.has(key)) commands2.set(key, claim);
   };
   const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
   for (const token of parsed) {
@@ -712,7 +736,7 @@ function extractClaims(content2) {
   return {
     paths: [...paths.values()],
     counts,
-    commands: [...commands.values()]
+    commands: [...commands2.values()]
   };
 }
 var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
@@ -762,9 +786,53 @@ var init_claims = __esm({
   }
 });
 
+// src/audit/inspection.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path5 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path5.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path5.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const shared = inspections.getStore()?.root === path5.resolve(root);
+  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path5.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
 // src/audit/git.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -772,8 +840,7 @@ function parseCommitLine(line) {
 }
 async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot }
     );
@@ -785,8 +852,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 }
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         "-1",
@@ -805,8 +871,7 @@ async function deletingCommitOf(resolvedRoot, relPath) {
 }
 async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
     );
@@ -819,8 +884,7 @@ async function firstCommitOf(resolvedRoot, relPath) {
 async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
   if (!fromHash || fromHash === "unknown") return null;
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         `${fromHash}..HEAD`,
@@ -844,11 +908,11 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     return null;
   }
 }
-var exec2, COMMIT_FORMAT;
+var COMMIT_FORMAT;
 var init_git = __esm({
   "src/audit/git.ts"() {
     "use strict";
-    exec2 = promisify2(execFile2);
+    init_inspection();
     COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
@@ -856,9 +920,7 @@ var init_git = __esm({
 // src/audit/inputs.ts
 import fs4 from "fs/promises";
 import * as nativeFs from "fs";
-import path5 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
+import path6 from "path";
 import fg2 from "fast-glob";
 async function auditInputPath(root, file) {
   if (file === ".") return fs4.realpath(root);
@@ -885,7 +947,7 @@ async function auditGlob(root, patterns, options) {
   if (Array.isArray(patterns) && !patterns.length) return [];
   const directories = /* @__PURE__ */ new Set();
   const readdir2 = ((directory, opts, callback) => {
-    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
       callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
@@ -896,7 +958,7 @@ async function auditGlob(root, patterns, options) {
     }, callback);
   });
   const lstat2 = ((file, callback) => {
-    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
     auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
   });
   const stream = fg2.stream(patterns, {
@@ -933,62 +995,48 @@ async function auditGlob(root, patterns, options) {
   return matches.sort();
 }
 async function gitSourcePaths(root) {
-  const { stdout } = await execute(
-    "git",
-    [
-      "ls-files",
-      "-z",
-      "--cached",
-      "--others",
-      "--exclude-standard",
-      "--",
-      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
-    ],
-    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
-  );
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+  return auditGitPaths(root, "sources");
 }
 async function gitIgnoredPaths(root, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
-  const operation = execute(
-    "git",
-    ["check-ignore", "-z", "--stdin"],
-    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
-  );
-  operation.child.stdin.on("error", () => {
-  });
-  operation.child.stdin.end(files.join("\0") + "\0");
-  try {
-    return new Set((await operation).stdout.split("\0").filter(Boolean));
-  } catch (error) {
-    if (error.code === 1) return /* @__PURE__ */ new Set();
-    throw error;
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
   }
+  return ignored;
 }
-var execute, MAX_INPUTS;
+var MAX_INPUTS;
 var init_inputs = __esm({
   "src/audit/inputs.ts"() {
     "use strict";
     init_files();
     init_storage();
-    execute = promisify3(execFile3);
+    init_git_read();
+    init_inspection();
     MAX_INPUTS = 1e5;
   }
 });
 
 // src/audit/docs.ts
 import fs5 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
+import path7 from "path";
 import fg3 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
     const dirty = /* @__PURE__ */ new Set();
     for (let offset = 0; offset < files.length; offset += 256) {
-      const { stdout } = await exec3(
-        "git",
+      const { stdout } = await execGit(
         ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
         { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
       );
@@ -1008,25 +1056,10 @@ async function dirtyDocs(resolvedRoot, files) {
 async function discoverDocPaths(root) {
   let candidates = [];
   try {
-    const { stdout } = await exec3(
-      "git",
-      [
-        "ls-files",
-        "-z",
-        "--cached",
-        "--others",
-        "--exclude-standard",
-        "--",
-        ":(icase,glob)**/readme.md",
-        ":(icase,glob)**/agents.md",
-        ":(icase,glob)**/claude.md"
-      ],
-      { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
-    );
-    candidates = stdout.split("\0").filter(Boolean);
+    candidates = await auditGitPaths(root, "documents");
   } catch (error) {
     try {
-      await exec3("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
     } catch {
       return localDocPaths(root);
     }
@@ -1073,14 +1106,14 @@ async function localDocPaths(root) {
       throw error;
     }
     for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-      paths.push(path6.posix.join(dir, entry.name));
+      paths.push(path7.posix.join(dir, entry.name));
     }
   }
   return paths;
 }
 function documentScope(file) {
-  const parent = path6.posix.dirname(file);
-  return path6.posix.basename(parent).toLowerCase() === ".claude" ? path6.posix.dirname(parent) : parent;
+  const parent = path7.posix.dirname(file);
+  return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -1100,7 +1133,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path6.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1110,16 +1143,17 @@ async function readDocs(resolvedRoot) {
   }
   return docs;
 }
-var exec3, DOC_CANDIDATES;
+var DOC_CANDIDATES;
 var init_docs = __esm({
   "src/audit/docs.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_claims();
     init_git();
     init_inputs();
     init_files();
-    exec3 = promisify4(execFile4);
+    init_inspection();
     DOC_CANDIDATES = [
       "AGENTS.md",
       "CLAUDE.md",
@@ -1130,14 +1164,14 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs6 from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function scopedPath(directory, value) {
-  if (path7.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
-  const resolved = path7.posix.normalize(path7.posix.join(directory, value));
+  if (path8.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
+  const resolved = path8.posix.normalize(path8.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path7.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path8.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1171,9 +1205,9 @@ var init_scope = __esm({
 });
 
 // src/test-map.ts
-import path8 from "path";
+import path9 from "path";
 async function buildTestMap(dir) {
-  const rootDir = path8.resolve(dir);
+  const rootDir = path9.resolve(dir);
   const access = await createFileAccess(rootDir);
   const testPatterns = [
     "**/*.test.*",
@@ -1194,7 +1228,7 @@ async function buildTestMap(dir) {
   const sourceByBaseName = /* @__PURE__ */ new Map();
   for (const file of sourceFiles) {
     if (testFiles.includes(file)) continue;
-    const baseName = path8.basename(file).replace(/\.[^.]+$/, "");
+    const baseName = path9.basename(file).replace(/\.[^.]+$/, "");
     const existing = sourceByBaseName.get(baseName) ?? [];
     existing.push(file);
     sourceByBaseName.set(baseName, existing);
@@ -1202,7 +1236,7 @@ async function buildTestMap(dir) {
   const paired = [];
   const unmatched = [];
   for (const testFile of testFiles) {
-    const testBaseName = path8.basename(testFile).replace(/\.[^.]+$/, "");
+    const testBaseName = path9.basename(testFile).replace(/\.[^.]+$/, "");
     const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
     if (!sourceName) {
       unmatched.push(testFile);
@@ -1210,10 +1244,10 @@ async function buildTestMap(dir) {
     }
     const candidates = sourceByBaseName.get(sourceName);
     if (candidates && candidates.length > 0) {
-      const testDir = path8.dirname(testFile);
+      const testDir = path9.dirname(testFile);
       const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path8.dirname(candidate);
-        const bestDir = path8.dirname(best);
+        const candidateDir = path9.dirname(candidate);
+        const bestDir = path9.dirname(best);
         const candidateOverlap = commonSegments(testDir, candidateDir);
         const bestOverlap = commonSegments(testDir, bestDir);
         return candidateOverlap > bestOverlap ? candidate : best;
@@ -1247,9 +1281,7 @@ var init_test_map = __esm({
 });
 
 // src/snapshot/snapshot.ts
-import path9 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+import path10 from "path";
 import { z as z2 } from "zod";
 async function inspectSnapshot(rootDir) {
   try {
@@ -1265,7 +1297,7 @@ async function inspectSnapshot(rootDir) {
 }
 async function getCurrentGitHash(rootDir) {
   try {
-    const { stdout } = await exec4("git", ["rev-parse", "HEAD"], {
+    const { stdout } = await execGit(["rev-parse", "HEAD"], {
       cwd: rootDir
     });
     return stdout.trim();
@@ -1273,16 +1305,16 @@ async function getCurrentGitHash(rootDir) {
     return "unknown";
   }
 }
-var exec4, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
 var init_snapshot = __esm({
   "src/snapshot/snapshot.ts"() {
     "use strict";
+    init_git_read();
     init_files();
     init_files();
     init_storage();
     init_paths();
     init_test_map();
-    exec4 = promisify5(execFile5);
     repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z2.string().optional(),
@@ -1312,9 +1344,7 @@ var init_snapshot = __esm({
 
 // src/drift/drift.ts
 import fs7 from "fs/promises";
-import path10 from "path";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import path11 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -1335,7 +1365,7 @@ function touchedPaths(changes) {
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec5("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
     return parseChanges(stdout);
   } catch {
     return null;
@@ -1344,8 +1374,8 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      exec5("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec5("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
     return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
@@ -1353,13 +1383,12 @@ async function getWorkingTree(resolvedRoot) {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
 }
-var exec5;
 var init_drift = __esm({
   "src/drift/drift.ts"() {
     "use strict";
+    init_git_read();
     init_snapshot();
     init_paths();
-    exec5 = promisify6(execFile6);
   }
 });
 
@@ -1380,7 +1409,7 @@ var init_types = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path11 from "path";
+import path12 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1409,7 +1438,7 @@ async function checkDeletedReferences(ctx) {
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
         tracked: await lastCommitOf(ctx.root, file),
-        parent: await pathExists(ctx.root, path11.posix.dirname(file))
+        parent: await pathExists(ctx.root, path12.posix.dirname(file))
       })));
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
       if (!candidate && claim.relativeTo !== "document") continue;
@@ -1449,7 +1478,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg4 from "fast-glob";
 import fs8 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1487,23 +1516,36 @@ async function checkNewModules(ctx) {
   return result;
 }
 function moduleDocumentation(docs) {
-  return docs.map((doc) => doc.content + "\n" + (path12.posix.dirname(doc.path) === "." ? "" : path12.posix.dirname(doc.path) + "/")).join("\n");
+  return docs.map((doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")).join("\n");
 }
-async function moduleCandidates(root, combinedDocs) {
+function moduleCandidates(root, combinedDocs) {
+  return inspectionRead(root, "modules:" + combinedDocs, () => collectModuleCandidates(root, combinedDocs));
+}
+async function collectModuleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
-  const listSubdirs = async (dir) => {
-    const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path12.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path12.posix.join(dir, entry.name));
-    const ignored = await gitIgnoredPaths(root, dirs);
-    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
-    return (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
-      ignore,
-      onlyDirectories: true,
-      label: "Module directory discovery",
-      select: (file) => visible.has(file)
-    })).map((file) => path12.posix.basename(file));
+  const listSubdirs = async (parents) => {
+    const byParent = /* @__PURE__ */ new Map();
+    for (let offset = 0; offset < parents.length; offset += 16) {
+      await Promise.all(parents.slice(offset, offset + 16).map(async (dir) => {
+        const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+        const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path13.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path13.posix.join(dir, entry.name));
+        byParent.set(dir, dirs);
+      }));
+    }
+    const ignored = await gitIgnoredPaths(root, [...byParent.values()].flat());
+    const result = /* @__PURE__ */ new Map();
+    for (const dir of parents) {
+      const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+        ignore,
+        onlyDirectories: true,
+        label: "Module directory discovery",
+        select: (file) => visible.has(file)
+      })).map((file) => path13.posix.basename(file)));
+    }
+    return result;
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
@@ -1519,14 +1561,16 @@ async function moduleCandidates(root, combinedDocs) {
     return count4;
   };
   const candidates = [];
-  for (const topDir of await listSubdirs(".")) {
+  const topDirs = (await listSubdirs(["."])).get(".");
+  const nested = await listSubdirs(topDirs.filter((dir) => isMentioned(combinedDocs, dir)));
+  for (const topDir of topDirs) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
       const count4 = await countSourceFiles(topDir);
       if (count4 >= 1) candidates.push({ dir: topDir, sourceFileCount: count4 });
       continue;
     }
-    const subdirs = await listSubdirs(topDir);
+    const subdirs = nested.get(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
@@ -1543,6 +1587,7 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
+    init_inspection();
     init_files();
     init_inputs();
     init_git();
@@ -1572,7 +1617,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path13 from "path";
+import path14 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content2 = await readAuditInput(root, name);
@@ -1606,7 +1651,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1637,7 +1682,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1659,8 +1704,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path13.dirname(m));
-    } else if (await readAuditInput(root, path13.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path14.dirname(m));
+    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1680,7 +1725,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path13.join(root, scope), claim);
+  const source = await resolveCountSource(path14.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1732,7 +1777,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path14 from "path";
+import path15 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -1768,7 +1813,7 @@ async function commandInputs(root, docs) {
     }
     let cursor = directory;
     while (true) {
-      const manifest = path14.posix.join(cursor, "package.json");
+      const manifest = path15.posix.join(cursor, "package.json");
       scope.candidates.push(manifest);
       const raw = await read(manifest);
       if (raw !== null) {
@@ -1779,7 +1824,7 @@ async function commandInputs(root, docs) {
         break;
       }
       if (claim.directory !== void 0 || cursor === ".") break;
-      cursor = path14.posix.dirname(cursor);
+      cursor = path15.posix.dirname(cursor);
     }
     if (!resolution.manifest && !resolution.problem) {
       resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -1842,10 +1887,8 @@ var init_dead_command = __esm({
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
 async function git(root, args) {
-  return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+  return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
 function withoutAndroidReleaseValues(text2) {
   if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
@@ -1891,11 +1934,10 @@ async function releaseMetadataOnly(root, commit) {
     return false;
   }
 }
-var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify7(execFile7);
+    init_git_read();
   }
 });
 
@@ -1991,7 +2033,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path15 from "path";
+import path16 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2175,7 +2217,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import { createHash } from "crypto";
 import { z as z4 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2226,9 +2268,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path17 from "path";
+import path18 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path17.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2452,8 +2494,6 @@ var init_findings = __esm({
 
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
 import { z as z6 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
@@ -2580,10 +2620,12 @@ async function advisoryReviewInventory(root) {
   if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
   return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
 }
-var execute2, git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
+    init_inspection();
+    init_git_read();
     init_findings();
     init_deps_changed();
     init_inputs();
@@ -2593,8 +2635,7 @@ var init_advisory_review = __esm({
     init_store();
     init_decisions();
     init_drift2();
-    execute2 = promisify8(execFile8);
-    git2 = async (root, ...args) => (await execute2("git", args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
+    git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
     hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
     commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
     evidenceSchema2 = z6.object({
@@ -2638,12 +2679,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2677,7 +2718,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path18.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2719,7 +2760,7 @@ var init_audit = __esm({
 
 // src/audit/repair.ts
 import fs12 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -2754,8 +2795,8 @@ async function readStableAudit(root, checks, options) {
   }
   return report;
 }
-async function withRepairSession(root, options, run, cachedAudit) {
-  const before = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
+async function withRepairSession(root, options, run, validate, cachedAudit) {
+  const head = await getCurrentGitHash(root);
   const audits = /* @__PURE__ */ new Map();
   const documents = /* @__PURE__ */ new Map();
   const history = /* @__PURE__ */ new Map();
@@ -2766,9 +2807,9 @@ async function withRepairSession(root, options, run, cachedAudit) {
   };
   const session = {
     audit: (checks) => memo(audits, [...checks].sort().join(","), async () => {
-      if (cachedAudit && cachedAudit.headHash === before[0] && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
+      if (cachedAudit && cachedAudit.headHash === head && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
         const current = structuredClone(cachedAudit);
-        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, before[0])))).filter((r) => r !== null);
+        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, head)))).filter((r) => r !== null);
         delete current.advisoryReviews;
         if (reviews.length) current.advisoryReviews = reviews;
         return current;
@@ -2776,16 +2817,15 @@ async function withRepairSession(root, options, run, cachedAudit) {
       return computeAudit(root, { ...options, checks });
     }),
     document: (file) => memo(documents, file, async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)),
-    history: (head) => memo(history, head, () => getChangesWithStatus(root, head)),
-    assessment: (dir, finding, head) => memo(assessments, digest([dir, finding, head]), () => assessAdvisory(dir, finding, head))
+    history: (head2) => memo(history, head2, () => getChangesWithStatus(root, head2)),
+    assessment: (dir, finding, head2) => memo(assessments, digest([dir, finding, head2]), () => assessAdvisory(dir, finding, head2))
   };
   const result = await run({
     prepare: () => prepareOriginal(root, ALL_CHECKS, options, session),
     verify: (baseline) => profilePhase("repair.verify", () => verifyOriginal(root, baseline, options, session)),
     currentAudit: () => session.audit(ALL_CHECKS)
   });
-  const after = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
-  if (digest(before) !== digest(after)) throw new Error("HEAD, context files or advisory review records changed during verification; retry against stable evidence.");
+  await validate();
   return result;
 }
 async function prepareOriginal(rootDir, checks, options, session) {
@@ -2807,8 +2847,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path19.resolve(rootDir);
-  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path20.resolve(rootDir);
+  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2967,14 +3007,12 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
 import fg5 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args) {
-  return profilePhase("automation.git", async () => (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
+  return profilePhase("automation.git", async () => (await execGit(args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
 async function workspace(dir) {
   const root = await fs13.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
@@ -2998,7 +3036,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path20.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3022,7 +3060,7 @@ async function collectInputs(root) {
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path20.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
@@ -3034,7 +3072,7 @@ async function collectInputs(root) {
     if (error.code === "ENOENT") return "absent";
     throw error;
   });
-  const [modules, counts, commands, decisionFiles] = await Promise.all([
+  const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
     commandInputs(root, parsedDocs),
@@ -3053,7 +3091,7 @@ async function collectInputs(root) {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
     "stale-count": hash([common, counts]),
-    "dead-command": hash([common, commands]),
+    "dead-command": hash([common, commands2]),
     "deps-changed": hash([common, docStatus]),
     "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
   };
@@ -3091,10 +3129,11 @@ function checkCache(raw, inputs) {
     }
   };
 }
-var exec7, engineVersion, hash, content, cacheSchema;
+var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_docs();
     init_scope();
@@ -3107,8 +3146,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    exec7 = promisify9(execFile9);
-    engineVersion = true ? "0.17.3" : "development";
+    engineVersion = true ? "0.17.4" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3376,12 +3414,12 @@ async function matchingAnalysis(ws, state, inputs) {
   return { analysis: a };
 }
 async function verifyInputs(ws, inputs) {
-  return profilePhase("automation.revalidate", async () => {
+  return profilePhase("automation.revalidate", () => withRepositoryInspection(ws.root, async () => {
     const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
     if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
       throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
     }
-  });
+  }));
 }
 async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDiagnostic) {
   const baselines = [...state.baselines];
@@ -3401,7 +3439,10 @@ async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDia
     capture: "unknown",
     scope: SCOPE
   };
-  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) return { baselines, report: empty, cache: null };
+  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
+    await verifyInputs(ws, inputs);
+    return { baselines, report: empty, cache: null };
+  }
   if (ws.branch === "detached" && state.latest) {
     const previous = await readStoreJson(ws.root, state.latest);
     if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
@@ -3439,7 +3480,7 @@ async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDia
     }
     currentAudit = await repairs.currentAudit();
     return verifications2;
-  }, cachedAudit);
+  }, () => verifyInputs(ws, inputs), cachedAudit);
   const merged = /* @__PURE__ */ new Map();
   for (const verification of verifications) {
     for (const finding of verification.findings) {
@@ -3474,7 +3515,6 @@ async function analyze(ws, inputs, event, startedAt) {
     if (previous && previous.completedAt >= startedAt) return { analysis: previous, shared: true };
     const originalDigest = await baselineDigest(ws, before);
     const computed = await computeAnalysis(ws, before, inputs, event, previous?.currentAudit, diagnostic);
-    await verifyInputs(ws, inputs);
     if (originalDigest !== await baselineDigest(ws, before)) throw new Error("Repair baseline was modified during automation; original evidence must be inspected.");
     const id = randomUUID4();
     const analysis = analysisSchema.parse({
@@ -3503,7 +3543,7 @@ async function analyze(ws, inputs, event, startedAt) {
 async function automate(dir, event) {
   const startedAt = Date.now();
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
-  return recordExecution(ws.root, ws.directory, event.event, async () => {
+  return recordExecution(ws.root, ws.directory, event.event, () => withRepositoryInspection(ws.root, async () => {
     const inputs = await readInputs(ws.root);
     const result = await profilePhase("automation.analysis", () => analyze(ws, inputs, event, startedAt));
     if (result.shared) {
@@ -3576,7 +3616,7 @@ async function automate(dir, event) {
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
       return { report, message: notify ? summarize(report) : null, continueOnce };
     }));
-  });
+  }));
 }
 async function automationStatus(dir) {
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
@@ -3614,6 +3654,7 @@ var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
     init_profile();
+    init_inspection();
     init_execution();
     init_repair();
     init_types();
@@ -3659,9 +3700,9 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs15 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 async function repositoryRoot(dir) {
-  if (!path21.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  if (!path22.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
   try {
     return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
   } catch (error) {
@@ -3745,8 +3786,8 @@ __export(launcher_exports, {
   mcpCommand: () => mcpCommand,
   prepareLaunch: () => prepareLaunch
 });
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 import fs16 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
@@ -3754,7 +3795,7 @@ function globalCommand(args, platform = process.platform) {
 async function installedCommand() {
   const invocation = globalCommand(["internal-integration-version"]);
   try {
-    const { stdout } = await promisify10(execFile10)(
+    const { stdout } = await promisify2(execFile2)(
       invocation.command,
       invocation.args,
       { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
@@ -3790,7 +3831,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.3" : "development";
+    executingVersion = () => true ? "0.17.4" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4006,7 +4047,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs18 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4039,7 +4080,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path22.join(path22.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path23.join(path23.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
     const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs18.open(temporary, "wx", mode);
@@ -4484,14 +4525,14 @@ async function planTeardown(root, selected) {
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
   const automationBefore = await read(AUTOMATION_PATH);
   const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
-  const commands = (host) => new Set([
+  const commands2 = (host) => new Set([
     automation?.hosts[host]?.command,
     ...ownership.files[configPath(host)]?.hookCommands ?? [],
     ...knownManagedHookCommands(host),
     hookConfig(host, hookCommand(host)).hooks.SessionStart[0].hooks[0].command,
     hookConfig(host).hooks.SessionStart[0].hooks[0].command
   ].filter((command) => !!command));
-  const possibleHook = (command, host) => commands(host).has(command) || /\bmason(?:-auto|-hook)?\b/.test(command);
+  const possibleHook = (command, host) => commands2(host).has(command) || /\bmason(?:-auto|-hook)?\b/.test(command);
   const add = (file, before, after, empty) => {
     edits.push({ path: file, before, after: ownership.files[file]?.created && (empty || ownership.files[file].initialHash === hash(before)) ? null : after });
   };
@@ -4555,12 +4596,12 @@ async function planTeardown(root, selected) {
       for (const [event, groups] of Object.entries(config.hooks ?? {})) {
         const known = ownership.files[hookFile]?.hooks?.[event];
         const handlers = groups.flatMap((group) => group.hooks);
-        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
+        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands2(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
           diagnostics.push({ path: hookFile, message: "A recorded Mason hook is missing beside a new or edited handler (" + event + "); inspect ownership manually." });
         }
         const kept = groups.flatMap((group) => {
           const handlers2 = group.hooks.filter((handler) => {
-            if (handler.type === "command" && handler.command && commands(host).has(handler.command)) {
+            if (handler.type === "command" && handler.command && commands2(host).has(handler.command)) {
               changed = true;
               return false;
             }
@@ -4692,13 +4733,13 @@ var init_teardown = __esm({
 });
 
 // src/review/cochange.ts
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
+    const { stdout } = await exec(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -4754,11 +4795,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify11(execFile11);
+    exec = promisify3(execFile3);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -5066,10 +5107,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path23 from "path";
+import path24 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path23.isAbsolute(file) ? path23.relative(root, file) : file;
+  const relative = path24.isAbsolute(file) ? path24.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5166,7 +5207,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path23.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path24.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5288,12 +5329,12 @@ var init_evidence2 = __esm({
 
 // src/review/review.ts
 import fs19 from "fs/promises";
-import path24 from "path";
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import path25 from "path";
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec2("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -5304,7 +5345,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec2("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -5317,7 +5358,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path24.resolve(rootDir);
+  const resolvedRoot = path25.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5367,7 +5408,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs19.access(path24.join(resolvedRoot, relPath));
+        await fs19.access(path25.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5400,7 +5441,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec9, MAX_ANALYZED_FILES;
+var exec2, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -5412,7 +5453,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify12(execFile12);
+    exec2 = promisify4(execFile4);
     MAX_ANALYZED_FILES = 50;
   }
 });