mason-context 0.17.3 → 0.17.4

package/dist/mason-mcp.js

@@ -31,6 +31,32 @@ var init_profile = __esm({
   }
 });
 
+// src/utils/git-read.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function execGit(args, options) {
+  const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
+  return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
+    const { input, ...processOptions } = options;
+    const operation = execute("git", args, processOptions);
+    if (input !== void 0) {
+      operation.child.stdin.on("error", () => {
+      });
+      operation.child.stdin.end(input);
+    }
+    return operation;
+  });
+}
+var execute, commands;
+var init_git_read = __esm({
+  "src/utils/git-read.ts"() {
+    "use strict";
+    init_profile();
+    execute = promisify(execFile);
+    commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+  }
+});
+
 // src/audit/commands.ts
 import path from "path";
 function splitCommands(line) {
@@ -255,14 +281,14 @@ function extractClaims(content2) {
   const ignored = computeIgnoredLines(lines);
   const paths = /* @__PURE__ */ new Map();
   const counts = [];
-  const commands = /* @__PURE__ */ new Map();
+  const commands2 = /* @__PURE__ */ new Map();
   const addPath = (claim) => {
     const key = [claim.relativeTo ?? "scope", claim.path].join(":");
     if (!paths.has(key)) paths.set(key, claim);
   };
   const addCommand = (claim) => {
     const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
-    if (!commands.has(key)) commands.set(key, claim);
+    if (!commands2.has(key)) commands2.set(key, claim);
   };
   const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
   for (const token of parsed) {
@@ -364,7 +390,7 @@ function extractClaims(content2) {
   return {
     paths: [...paths.values()],
     counts,
-    commands: [...commands.values()]
+    commands: [...commands2.values()]
   };
 }
 var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
@@ -414,97 +440,6 @@ var init_claims = __esm({
   }
 });
 
-// src/audit/git.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-function parseCommitLine(line) {
-  const parts = line.split("	");
-  if (parts.length < 3 || !parts[0]) return null;
-  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
-}
-async function lastCommitOf(resolvedRoot, relPath) {
-  try {
-    const { stdout } = await exec(
-      "git",
-      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
-      { cwd: resolvedRoot }
-    );
-    const line = stdout.trim().split("\n")[0];
-    return line ? parseCommitLine(line) : null;
-  } catch {
-    return null;
-  }
-}
-async function deletingCommitOf(resolvedRoot, relPath) {
-  try {
-    const { stdout } = await exec(
-      "git",
-      [
-        "log",
-        "-1",
-        "--diff-filter=D",
-        `--format=${COMMIT_FORMAT}`,
-        "--",
-        `:(literal)${relPath}`
-      ],
-      { cwd: resolvedRoot }
-    );
-    const line = stdout.trim().split("\n")[0];
-    return line ? parseCommitLine(line) : null;
-  } catch {
-    return null;
-  }
-}
-async function firstCommitOf(resolvedRoot, relPath) {
-  try {
-    const { stdout } = await exec(
-      "git",
-      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const line = stdout.trim().split("\n")[0];
-    return line ? parseCommitLine(line) : null;
-  } catch {
-    return null;
-  }
-}
-async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
-  if (!fromHash || fromHash === "unknown") return null;
-  try {
-    const { stdout } = await exec(
-      "git",
-      [
-        "log",
-        `${fromHash}..HEAD`,
-        `--format=%x01${COMMIT_FORMAT}`,
-        "--name-only",
-        "--",
-        ...pathspecs
-      ],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const commits = [];
-    for (const block of stdout.split("
")) {
-      if (!block.trim()) continue;
-      const lines = block.split("\n").filter((l) => l.trim().length > 0);
-      const ref = parseCommitLine(lines[0]);
-      if (!ref) continue;
-      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
-    }
-    return { commits, total: commits.length };
-  } catch {
-    return null;
-  }
-}
-var exec, COMMIT_FORMAT;
-var init_git = __esm({
-  "src/audit/git.ts"() {
-    "use strict";
-    exec = promisify(execFile);
-    COMMIT_FORMAT = "%H%x09%cI%x09%s";
-  }
-});
-
 // src/utils/paths.ts
 import path2 from "path";
 function normalizeRepoPath(value) {
@@ -539,8 +474,6 @@ var init_paths = __esm({
 import fs from "fs/promises";
 import { constants } from "fs";
 import path3 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
 import fg from "fast-glob";
 function isSensitiveFile(file) {
   return file.split(/[\\/]/).some(
@@ -594,12 +527,12 @@ async function createFileAccess(rootDir) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   let gitFiles = null;
   try {
-    const { stdout } = await exec2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
     gitFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     let inGit = false;
     try {
-      await exec2("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
       inGit = true;
     } catch {
     }
@@ -642,12 +575,12 @@ async function createFileAccess(rootDir) {
   }
   return { root, config, list, read };
 }
-var exec2, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
 var init_files = __esm({
   "src/utils/files.ts"() {
     "use strict";
+    init_git_read();
     init_paths();
-    exec2 = promisify2(execFile2);
     SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
     SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
     SOURCE_IGNORE = [
@@ -677,9 +610,140 @@ var init_files = __esm({
   }
 });
 
+// src/audit/inspection.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path4 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const shared = inspections.getStore()?.root === path4.resolve(root);
+  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
+// src/audit/git.ts
+function parseCommitLine(line) {
+  const parts = line.split("	");
+  if (parts.length < 3 || !parts[0]) return null;
+  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
+}
+async function lastCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await inspectionGit(
+      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function deletingCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await inspectionGit(
+      [
+        "log",
+        "-1",
+        "--diff-filter=D",
+        `--format=${COMMIT_FORMAT}`,
+        "--",
+        `:(literal)${relPath}`
+      ],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function firstCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await inspectionGit(
+      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
+  if (!fromHash || fromHash === "unknown") return null;
+  try {
+    const { stdout } = await inspectionGit(
+      [
+        "log",
+        `${fromHash}..HEAD`,
+        `--format=%x01${COMMIT_FORMAT}`,
+        "--name-only",
+        "--",
+        ...pathspecs
+      ],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const commits = [];
+    for (const block of stdout.split("
")) {
+      if (!block.trim()) continue;
+      const lines = block.split("\n").filter((l) => l.trim().length > 0);
+      const ref = parseCommitLine(lines[0]);
+      if (!ref) continue;
+      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
+    }
+    return { commits, total: commits.length };
+  } catch {
+    return null;
+  }
+}
+var COMMIT_FORMAT;
+var init_git = __esm({
+  "src/audit/git.ts"() {
+    "use strict";
+    init_inspection();
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
+  }
+});
+
 // src/utils/storage.ts
 import fs2 from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 import { randomUUID } from "crypto";
 async function storePath(root, relative, createParents = false) {
   const normalized = normalizeRepoPath(relative);
@@ -687,7 +751,7 @@ async function storePath(root, relative, createParents = false) {
   let current = await fs2.realpath(root);
   const parts = normalized.split("/");
   for (let i = 0; i < parts.length; i++) {
-    current = path4.join(current, parts[i]);
+    current = path5.join(current, parts[i]);
     let stat;
     try {
       stat = await fs2.lstat(current);
@@ -725,7 +789,7 @@ async function writeStoreJson(root, relative, value) {
     throw new Error(`Mason store ${relative} exceeds 10 MiB`);
   }
   const file = await storePath(root, relative, true);
-  const temporary = path4.join(path4.dirname(file), `.${path4.basename(file)}.${randomUUID()}.tmp`);
+  const temporary = path5.join(path5.dirname(file), `.${path5.basename(file)}.${randomUUID()}.tmp`);
   try {
     const handle = await fs2.open(temporary, "wx", 384);
     try {
@@ -750,9 +814,7 @@ var init_storage = __esm({
 // src/audit/inputs.ts
 import fs3 from "fs/promises";
 import * as nativeFs from "fs";
-import path5 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
+import path6 from "path";
 import fg2 from "fast-glob";
 async function auditInputPath(root, file) {
   if (file === ".") return fs3.realpath(root);
@@ -779,7 +841,7 @@ async function auditGlob(root, patterns, options) {
   if (Array.isArray(patterns) && !patterns.length) return [];
   const directories = /* @__PURE__ */ new Set();
   const readdir2 = ((directory, opts, callback) => {
-    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
       callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
@@ -790,7 +852,7 @@ async function auditGlob(root, patterns, options) {
     }, callback);
   });
   const lstat2 = ((file, callback) => {
-    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
     auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
   });
   const stream = fg2.stream(patterns, {
@@ -827,62 +889,48 @@ async function auditGlob(root, patterns, options) {
   return matches.sort();
 }
 async function gitSourcePaths(root) {
-  const { stdout } = await execute(
-    "git",
-    [
-      "ls-files",
-      "-z",
-      "--cached",
-      "--others",
-      "--exclude-standard",
-      "--",
-      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
-    ],
-    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
-  );
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+  return auditGitPaths(root, "sources");
 }
 async function gitIgnoredPaths(root, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
-  const operation = execute(
-    "git",
-    ["check-ignore", "-z", "--stdin"],
-    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
-  );
-  operation.child.stdin.on("error", () => {
-  });
-  operation.child.stdin.end(files.join("\0") + "\0");
-  try {
-    return new Set((await operation).stdout.split("\0").filter(Boolean));
-  } catch (error) {
-    if (error.code === 1) return /* @__PURE__ */ new Set();
-    throw error;
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
   }
+  return ignored;
 }
-var execute, MAX_INPUTS;
+var MAX_INPUTS;
 var init_inputs = __esm({
   "src/audit/inputs.ts"() {
     "use strict";
     init_files();
     init_storage();
-    execute = promisify3(execFile3);
+    init_git_read();
+    init_inspection();
     MAX_INPUTS = 1e5;
   }
 });
 
 // src/audit/docs.ts
 import fs4 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
+import path7 from "path";
 import fg3 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
     const dirty = /* @__PURE__ */ new Set();
     for (let offset = 0; offset < files.length; offset += 256) {
-      const { stdout } = await exec3(
-        "git",
+      const { stdout } = await execGit(
         ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
         { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
       );
@@ -902,25 +950,10 @@ async function dirtyDocs(resolvedRoot, files) {
 async function discoverDocPaths(root) {
   let candidates = [];
   try {
-    const { stdout } = await exec3(
-      "git",
-      [
-        "ls-files",
-        "-z",
-        "--cached",
-        "--others",
-        "--exclude-standard",
-        "--",
-        ":(icase,glob)**/readme.md",
-        ":(icase,glob)**/agents.md",
-        ":(icase,glob)**/claude.md"
-      ],
-      { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
-    );
-    candidates = stdout.split("\0").filter(Boolean);
+    candidates = await auditGitPaths(root, "documents");
   } catch (error) {
     try {
-      await exec3("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
     } catch {
       return localDocPaths(root);
     }
@@ -967,14 +1000,14 @@ async function localDocPaths(root) {
       throw error;
     }
     for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-      paths.push(path6.posix.join(dir, entry.name));
+      paths.push(path7.posix.join(dir, entry.name));
     }
   }
   return paths;
 }
 function documentScope(file) {
-  const parent = path6.posix.dirname(file);
-  return path6.posix.basename(parent).toLowerCase() === ".claude" ? path6.posix.dirname(parent) : parent;
+  const parent = path7.posix.dirname(file);
+  return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -994,7 +1027,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path6.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1004,16 +1037,17 @@ async function readDocs(resolvedRoot) {
   }
   return docs;
 }
-var exec3, DOC_CANDIDATES;
+var DOC_CANDIDATES;
 var init_docs = __esm({
   "src/audit/docs.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_claims();
     init_git();
     init_inputs();
     init_files();
-    exec3 = promisify4(execFile4);
+    init_inspection();
     DOC_CANDIDATES = [
       "AGENTS.md",
       "CLAUDE.md",
@@ -1024,14 +1058,14 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs5 from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function scopedPath(directory, value) {
-  if (path7.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
-  const resolved = path7.posix.normalize(path7.posix.join(directory, value));
+  if (path8.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
+  const resolved = path8.posix.normalize(path8.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path7.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path8.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1069,9 +1103,9 @@ var test_map_exports = {};
 __export(test_map_exports, {
   buildTestMap: () => buildTestMap
 });
-import path8 from "path";
+import path9 from "path";
 async function buildTestMap(dir) {
-  const rootDir = path8.resolve(dir);
+  const rootDir = path9.resolve(dir);
   const access = await createFileAccess(rootDir);
   const testPatterns = [
     "**/*.test.*",
@@ -1092,7 +1126,7 @@ async function buildTestMap(dir) {
   const sourceByBaseName = /* @__PURE__ */ new Map();
   for (const file of sourceFiles) {
     if (testFiles.includes(file)) continue;
-    const baseName = path8.basename(file).replace(/\.[^.]+$/, "");
+    const baseName = path9.basename(file).replace(/\.[^.]+$/, "");
     const existing = sourceByBaseName.get(baseName) ?? [];
     existing.push(file);
     sourceByBaseName.set(baseName, existing);
@@ -1100,7 +1134,7 @@ async function buildTestMap(dir) {
   const paired = [];
   const unmatched = [];
   for (const testFile of testFiles) {
-    const testBaseName = path8.basename(testFile).replace(/\.[^.]+$/, "");
+    const testBaseName = path9.basename(testFile).replace(/\.[^.]+$/, "");
     const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
     if (!sourceName) {
       unmatched.push(testFile);
@@ -1108,10 +1142,10 @@ async function buildTestMap(dir) {
     }
     const candidates = sourceByBaseName.get(sourceName);
     if (candidates && candidates.length > 0) {
-      const testDir = path8.dirname(testFile);
+      const testDir = path9.dirname(testFile);
       const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path8.dirname(candidate);
-        const bestDir = path8.dirname(best);
+        const candidateDir = path9.dirname(candidate);
+        const bestDir = path9.dirname(best);
         const candidateOverlap = commonSegments(testDir, candidateDir);
         const bestOverlap = commonSegments(testDir, bestDir);
         return candidateOverlap > bestOverlap ? candidate : best;
@@ -1145,9 +1179,7 @@ var init_test_map = __esm({
 });
 
 // src/snapshot/snapshot.ts
-import path9 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+import path10 from "path";
 import { z } from "zod";
 function normalizeFeatureType(value) {
   return value === "infrastructure" ? "infrastructure" : "capability";
@@ -1176,7 +1208,7 @@ async function saveSnapshot(rootDir, snapshot) {
 }
 async function getCurrentGitHash(rootDir) {
   try {
-    const { stdout } = await exec4("git", ["rev-parse", "HEAD"], {
+    const { stdout } = await execGit(["rev-parse", "HEAD"], {
       cwd: rootDir
     });
     return stdout.trim();
@@ -1188,7 +1220,7 @@ async function listSourceFiles(resolvedRoot) {
   return (await createFileAccess(resolvedRoot)).list();
 }
 async function prepareSnapshotBatch(rootDir, offset, batchSize = DEFAULT_BATCH_SIZE, scopeFiles) {
-  const resolvedRoot = path9.resolve(rootDir);
+  const resolvedRoot = path10.resolve(rootDir);
   const access = await createFileAccess(resolvedRoot);
   let allFiles = await access.list();
   if (scopeFiles) {
@@ -1237,16 +1269,16 @@ async function prepareSnapshotBatch(rootDir, offset, batchSize = DEFAULT_BATCH_S
     testPairs
   };
 }
-var exec4, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema, DEFAULT_BATCH_SIZE, SKELETON_CHARS, DEEP_SAMPLE_CHARS, DEEP_SAMPLES_PER_BATCH;
+var repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema, DEFAULT_BATCH_SIZE, SKELETON_CHARS, DEEP_SAMPLE_CHARS, DEEP_SAMPLES_PER_BATCH;
 var init_snapshot = __esm({
   "src/snapshot/snapshot.ts"() {
     "use strict";
+    init_git_read();
     init_files();
     init_files();
     init_storage();
     init_paths();
     init_test_map();
-    exec4 = promisify5(execFile5);
     repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z.string().optional(),
@@ -1280,9 +1312,7 @@ var init_snapshot = __esm({
 
 // src/drift/drift.ts
 import fs6 from "fs/promises";
-import path10 from "path";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import path11 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -1303,7 +1333,7 @@ function touchedPaths(changes) {
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec5("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
     return parseChanges(stdout);
   } catch {
     return null;
@@ -1312,8 +1342,8 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      exec5("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec5("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
     return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
@@ -1324,8 +1354,7 @@ async function getWorkingTree(resolvedRoot) {
 async function countCommitsBehind(resolvedRoot, fromHash) {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec5(
-      "git",
+    const { stdout } = await execGit(
       ["rev-list", "--count", `${fromHash}..HEAD`],
       { cwd: resolvedRoot }
     );
@@ -1350,7 +1379,7 @@ async function findGhostFiles(resolvedRoot, mappedFiles) {
   const ghosts = [];
   for (const file of mappedFiles) {
     try {
-      await fs6.access(path10.join(resolvedRoot, file));
+      await fs6.access(path11.join(resolvedRoot, file));
     } catch {
       ghosts.push(file);
     }
@@ -1358,7 +1387,7 @@ async function findGhostFiles(resolvedRoot, mappedFiles) {
   return ghosts.sort();
 }
 async function computeDrift(rootDir) {
-  const root = path10.resolve(rootDir);
+  const root = path11.resolve(rootDir);
   const snapshot = await loadSnapshot(root);
   if (!snapshot) return null;
   const [headHash, workingTree] = await Promise.all([getCurrentGitHash(root), getWorkingTree(root)]);
@@ -1415,7 +1444,7 @@ async function computeDrift(rootDir) {
   const sourceFiles = new Set(await listSourceFiles(root));
   let committedFiles = /* @__PURE__ */ new Set();
   try {
-    const { stdout } = await exec5("git", ["ls-tree", "-r", "--name-only", "-z", "HEAD"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(["ls-tree", "-r", "--name-only", "-z", "HEAD"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
     committedFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     report.historyAvailable = false;
@@ -1435,13 +1464,13 @@ async function computeDrift(rootDir) {
   else report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedMapped.size / Math.max(1, mappedFiles.size) > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
   return report;
 }
-var exec5, FULL_REBUILD_FRACTION, FULL_REBUILD_MIN_CHANGED_MAPPED_FILES;
+var FULL_REBUILD_FRACTION, FULL_REBUILD_MIN_CHANGED_MAPPED_FILES;
 var init_drift = __esm({
   "src/drift/drift.ts"() {
     "use strict";
+    init_git_read();
     init_snapshot();
     init_paths();
-    exec5 = promisify6(execFile6);
     FULL_REBUILD_FRACTION = 0.4;
     FULL_REBUILD_MIN_CHANGED_MAPPED_FILES = 10;
   }
@@ -1464,7 +1493,7 @@ var init_types = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path11 from "path";
+import path12 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1493,7 +1522,7 @@ async function checkDeletedReferences(ctx) {
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
         tracked: await lastCommitOf(ctx.root, file),
-        parent: await pathExists(ctx.root, path11.posix.dirname(file))
+        parent: await pathExists(ctx.root, path12.posix.dirname(file))
       })));
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
       if (!candidate && claim.relativeTo !== "document") continue;
@@ -1533,7 +1562,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg4 from "fast-glob";
 import fs7 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1571,23 +1600,36 @@ async function checkNewModules(ctx) {
   return result;
 }
 function moduleDocumentation(docs) {
-  return docs.map((doc) => doc.content + "\n" + (path12.posix.dirname(doc.path) === "." ? "" : path12.posix.dirname(doc.path) + "/")).join("\n");
+  return docs.map((doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")).join("\n");
+}
+function moduleCandidates(root, combinedDocs) {
+  return inspectionRead(root, "modules:" + combinedDocs, () => collectModuleCandidates(root, combinedDocs));
 }
-async function moduleCandidates(root, combinedDocs) {
+async function collectModuleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
-  const listSubdirs = async (dir) => {
-    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path12.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path12.posix.join(dir, entry.name));
-    const ignored = await gitIgnoredPaths(root, dirs);
-    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
-    return (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
-      ignore,
-      onlyDirectories: true,
-      label: "Module directory discovery",
-      select: (file) => visible.has(file)
-    })).map((file) => path12.posix.basename(file));
+  const listSubdirs = async (parents) => {
+    const byParent = /* @__PURE__ */ new Map();
+    for (let offset = 0; offset < parents.length; offset += 16) {
+      await Promise.all(parents.slice(offset, offset + 16).map(async (dir) => {
+        const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+        const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path13.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path13.posix.join(dir, entry.name));
+        byParent.set(dir, dirs);
+      }));
+    }
+    const ignored = await gitIgnoredPaths(root, [...byParent.values()].flat());
+    const result = /* @__PURE__ */ new Map();
+    for (const dir of parents) {
+      const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+        ignore,
+        onlyDirectories: true,
+        label: "Module directory discovery",
+        select: (file) => visible.has(file)
+      })).map((file) => path13.posix.basename(file)));
+    }
+    return result;
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
@@ -1603,14 +1645,16 @@ async function moduleCandidates(root, combinedDocs) {
     return count4;
   };
   const candidates = [];
-  for (const topDir of await listSubdirs(".")) {
+  const topDirs = (await listSubdirs(["."])).get(".");
+  const nested = await listSubdirs(topDirs.filter((dir) => isMentioned(combinedDocs, dir)));
+  for (const topDir of topDirs) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
       const count4 = await countSourceFiles(topDir);
       if (count4 >= 1) candidates.push({ dir: topDir, sourceFileCount: count4 });
       continue;
     }
-    const subdirs = await listSubdirs(topDir);
+    const subdirs = nested.get(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
@@ -1627,6 +1671,7 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
+    init_inspection();
     init_files();
     init_inputs();
     init_git();
@@ -1656,7 +1701,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path13 from "path";
+import path14 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content2 = await readAuditInput(root, name);
@@ -1690,7 +1735,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1721,7 +1766,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1743,8 +1788,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path13.dirname(m));
-    } else if (await readAuditInput(root, path13.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path14.dirname(m));
+    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1764,7 +1809,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path13.join(root, scope), claim);
+  const source = await resolveCountSource(path14.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1816,7 +1861,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path14 from "path";
+import path15 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -1852,7 +1897,7 @@ async function commandInputs(root, docs) {
     }
     let cursor = directory;
     while (true) {
-      const manifest = path14.posix.join(cursor, "package.json");
+      const manifest = path15.posix.join(cursor, "package.json");
       scope.candidates.push(manifest);
       const raw = await read(manifest);
       if (raw !== null) {
@@ -1863,7 +1908,7 @@ async function commandInputs(root, docs) {
         break;
       }
       if (claim.directory !== void 0 || cursor === ".") break;
-      cursor = path14.posix.dirname(cursor);
+      cursor = path15.posix.dirname(cursor);
     }
     if (!resolution.manifest && !resolution.problem) {
       resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -1926,10 +1971,8 @@ var init_dead_command = __esm({
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
 async function git(root, args) {
-  return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+  return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
 function withoutAndroidReleaseValues(text2) {
   if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
@@ -1975,11 +2018,10 @@ async function releaseMetadataOnly(root, commit) {
     return false;
   }
 }
-var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify7(execFile7);
+    init_git_read();
   }
 });
 
@@ -2075,7 +2117,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path15 from "path";
+import path16 from "path";
 function tokenize(text2) {
   return text2.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 2 && !STOPWORDS.has(t));
 }
@@ -2088,7 +2130,7 @@ function tokenSet(text2) {
 function scoreEntry(taskTokens, entry) {
   const nameTokens = tokenSet(entry.name);
   const descTokens = tokenSet(entry.description);
-  const fileTokens = tokenSet(entry.files.map((f) => path15.basename(f)).join(" "));
+  const fileTokens = tokenSet(entry.files.map((f) => path16.basename(f)).join(" "));
   let score = 0;
   for (const token of taskTokens) {
     if (nameTokens.has(token)) score += 3;
@@ -2420,7 +2462,7 @@ __export(decisions_exports, {
   withDecisionWrite: () => withDecisionWrite
 });
 import fs8 from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import { createHash } from "crypto";
 import { z as z3 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2518,7 +2560,7 @@ async function upsertDecision(rootDir, input) {
     if (input.files && files.length < input.files.length) warnings.push("some anchor paths were outside the repo or duplicated and were dropped");
     for (const file of files) {
       try {
-        await fs8.access(path16.join(rootDir, file));
+        await fs8.access(path17.join(rootDir, file));
       } catch {
         warnings.push(`anchor file does not exist on disk: ${file}`);
       }
@@ -2643,9 +2685,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path17 from "path";
+import path18 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path17.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2967,8 +3009,6 @@ var init_store = __esm({
 
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
 import { z as z6 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
@@ -3163,10 +3203,12 @@ async function reviewAdvisory(rootDir, input) {
     };
   });
 }
-var execute2, git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
+    init_inspection();
+    init_git_read();
     init_findings();
     init_deps_changed();
     init_inputs();
@@ -3176,8 +3218,7 @@ var init_advisory_review = __esm({
     init_store();
     init_decisions();
     init_drift2();
-    execute2 = promisify8(execFile8);
-    git2 = async (root, ...args) => (await execute2("git", args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
+    git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
     hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
     commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
     evidenceSchema2 = z6.object({
@@ -3221,12 +3262,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -3260,7 +3301,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path18.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -3315,7 +3356,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs12 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -3353,8 +3394,8 @@ async function readStableAudit(root, checks, options) {
 async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
   return prepareOriginal(rootDir, checks, options);
 }
-async function withRepairSession(root, options, run, cachedAudit) {
-  const before = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
+async function withRepairSession(root, options, run, validate, cachedAudit) {
+  const head = await getCurrentGitHash(root);
   const audits = /* @__PURE__ */ new Map();
   const documents = /* @__PURE__ */ new Map();
   const history = /* @__PURE__ */ new Map();
@@ -3365,9 +3406,9 @@ async function withRepairSession(root, options, run, cachedAudit) {
   };
   const session = {
     audit: (checks) => memo(audits, [...checks].sort().join(","), async () => {
-      if (cachedAudit && cachedAudit.headHash === before[0] && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
+      if (cachedAudit && cachedAudit.headHash === head && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
         const current = structuredClone(cachedAudit);
-        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, before[0])))).filter((r) => r !== null);
+        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, head)))).filter((r) => r !== null);
         delete current.advisoryReviews;
         if (reviews.length) current.advisoryReviews = reviews;
         return current;
@@ -3375,16 +3416,15 @@ async function withRepairSession(root, options, run, cachedAudit) {
       return computeAudit(root, { ...options, checks });
     }),
     document: (file) => memo(documents, file, async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)),
-    history: (head) => memo(history, head, () => getChangesWithStatus(root, head)),
-    assessment: (dir, finding, head) => memo(assessments, digest([dir, finding, head]), () => assessAdvisory(dir, finding, head))
+    history: (head2) => memo(history, head2, () => getChangesWithStatus(root, head2)),
+    assessment: (dir, finding, head2) => memo(assessments, digest([dir, finding, head2]), () => assessAdvisory(dir, finding, head2))
   };
   const result = await run({
     prepare: () => prepareOriginal(root, ALL_CHECKS, options, session),
     verify: (baseline) => profilePhase("repair.verify", () => verifyOriginal(root, baseline, options, session)),
     currentAudit: () => session.audit(ALL_CHECKS)
   });
-  const after = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
-  if (digest(before) !== digest(after)) throw new Error("HEAD, context files or advisory review records changed during verification; retry against stable evidence.");
+  await validate();
   return result;
 }
 async function prepareOriginal(rootDir, checks, options, session) {
@@ -3406,8 +3446,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path19.resolve(rootDir);
-  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path20.resolve(rootDir);
+  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -3582,14 +3622,12 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
 import fg5 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args) {
-  return profilePhase("automation.git", async () => (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
+  return profilePhase("automation.git", async () => (await execGit(args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
 async function workspace(dir) {
   const root = await fs13.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
@@ -3613,7 +3651,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path20.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3637,7 +3675,7 @@ async function collectInputs(root) {
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path20.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
@@ -3649,7 +3687,7 @@ async function collectInputs(root) {
     if (error.code === "ENOENT") return "absent";
     throw error;
   });
-  const [modules, counts, commands, decisionFiles] = await Promise.all([
+  const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
     commandInputs(root, parsedDocs),
@@ -3668,7 +3706,7 @@ async function collectInputs(root) {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
     "stale-count": hash([common, counts]),
-    "dead-command": hash([common, commands]),
+    "dead-command": hash([common, commands2]),
     "deps-changed": hash([common, docStatus]),
     "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
   };
@@ -3706,10 +3744,11 @@ function checkCache(raw, inputs) {
     }
   };
 }
-var exec7, engineVersion, hash, content, cacheSchema;
+var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_docs();
     init_scope();
@@ -3722,8 +3761,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    exec7 = promisify9(execFile9);
-    engineVersion = true ? "0.17.3" : "development";
+    engineVersion = true ? "0.17.4" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3783,8 +3821,8 @@ var init_model = __esm({
 });
 
 // src/setup/launcher.ts
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 import fs14 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
@@ -3792,7 +3830,7 @@ function globalCommand(args, platform = process.platform) {
 async function installedCommand() {
   const invocation = globalCommand(["internal-integration-version"]);
   try {
-    const { stdout } = await promisify10(execFile10)(
+    const { stdout } = await promisify2(execFile2)(
       invocation.command,
       invocation.args,
       { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
@@ -3815,7 +3853,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.3" : "development";
+    executingVersion = () => true ? "0.17.4" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3829,7 +3867,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs17 from "fs/promises";
-import path24 from "path";
+import path25 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function readText(root, file) {
   try {
@@ -3862,7 +3900,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path24.join(path24.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
+  const temporary = path25.join(path25.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
   try {
     const mode = await fs17.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs17.open(temporary, "wx", mode);
@@ -4164,12 +4202,12 @@ async function matchingAnalysis(ws, state, inputs) {
   return { analysis: a };
 }
 async function verifyInputs(ws, inputs) {
-  return profilePhase("automation.revalidate", async () => {
+  return profilePhase("automation.revalidate", () => withRepositoryInspection(ws.root, async () => {
     const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
     if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
       throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
     }
-  });
+  }));
 }
 async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDiagnostic) {
   const baselines = [...state.baselines];
@@ -4189,7 +4227,10 @@ async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDia
     capture: "unknown",
     scope: SCOPE
   };
-  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) return { baselines, report: empty, cache: null };
+  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
+    await verifyInputs(ws, inputs);
+    return { baselines, report: empty, cache: null };
+  }
   if (ws.branch === "detached" && state.latest) {
     const previous = await readStoreJson(ws.root, state.latest);
     if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
@@ -4227,7 +4268,7 @@ async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDia
     }
     currentAudit = await repairs.currentAudit();
     return verifications2;
-  }, cachedAudit);
+  }, () => verifyInputs(ws, inputs), cachedAudit);
   const merged = /* @__PURE__ */ new Map();
   for (const verification of verifications) {
     for (const finding of verification.findings) {
@@ -4262,7 +4303,6 @@ async function analyze(ws, inputs, event, startedAt) {
     if (previous && previous.completedAt >= startedAt) return { analysis: previous, shared: true };
     const originalDigest = await baselineDigest(ws, before);
     const computed = await computeAnalysis(ws, before, inputs, event, previous?.currentAudit, diagnostic);
-    await verifyInputs(ws, inputs);
     if (originalDigest !== await baselineDigest(ws, before)) throw new Error("Repair baseline was modified during automation; original evidence must be inspected.");
     const id = randomUUID5();
     const analysis = analysisSchema.parse({
@@ -4291,7 +4331,7 @@ async function analyze(ws, inputs, event, startedAt) {
 async function automate(dir, event) {
   const startedAt = Date.now();
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
-  return recordExecution(ws.root, ws.directory, event.event, async () => {
+  return recordExecution(ws.root, ws.directory, event.event, () => withRepositoryInspection(ws.root, async () => {
     const inputs = await readInputs(ws.root);
     const result = await profilePhase("automation.analysis", () => analyze(ws, inputs, event, startedAt));
     if (result.shared) {
@@ -4364,7 +4404,7 @@ async function automate(dir, event) {
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
       return { report, message: notify ? summarize(report) : null, continueOnce };
     }));
-  });
+  }));
 }
 async function automationStatus(dir) {
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
@@ -4402,6 +4442,7 @@ var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
     init_profile();
+    init_inspection();
     init_execution();
     init_repair();
     init_types();
@@ -4447,7 +4488,7 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs19 from "fs/promises";
-import path25 from "path";
+import path26 from "path";
 var init_hook_root = __esm({
   "src/automation/hook-root.ts"() {
     "use strict";
@@ -4916,13 +4957,13 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
 });
 
 // src/review/cochange.ts
-import { execFile as execFile15 } from "child_process";
-import { promisify as promisify15 } from "util";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec12("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec4("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec12(
+    const { stdout } = await exec4(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -4978,11 +5019,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec12, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec4, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec12 = promisify15(execFile15);
+    exec4 = promisify6(execFile6);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -5290,10 +5331,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path26 from "path";
+import path27 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path26.isAbsolute(file) ? path26.relative(root, file) : file;
+  const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5390,7 +5431,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path26.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path27.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5512,12 +5553,12 @@ var init_evidence2 = __esm({
 
 // src/review/review.ts
 import fs20 from "fs/promises";
-import path27 from "path";
-import { execFile as execFile16 } from "child_process";
-import { promisify as promisify16 } from "util";
+import path28 from "path";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec13("git", ["merge-base", base, head], {
+    const { stdout } = await exec5("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -5528,7 +5569,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec13("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec5("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -5541,7 +5582,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path27.resolve(rootDir);
+  const resolvedRoot = path28.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5591,7 +5632,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs20.access(path27.join(resolvedRoot, relPath));
+        await fs20.access(path28.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5624,7 +5665,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec13, MAX_ANALYZED_FILES;
+var exec5, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -5636,7 +5677,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec13 = promisify16(execFile16);
+    exec5 = promisify7(execFile7);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -5726,7 +5767,7 @@ var init_onboarding = __esm({
 });
 
 // src/impact/references.ts
-import path28 from "path";
+import path29 from "path";
 function templateEnd(content2, start) {
   let i = start + 1, interpolation = 0;
   while (i < content2.length) {
@@ -5852,10 +5893,10 @@ function jvmImports(content2) {
 }
 function resolveImport(file, specifier, available) {
   if (!specifier.startsWith("./") && !specifier.startsWith("../")) return null;
-  const relative = path28.posix.normalize(path28.posix.join(path28.posix.dirname(file), specifier));
+  const relative = path29.posix.normalize(path29.posix.join(path29.posix.dirname(file), specifier));
   if (relative.startsWith("../")) return null;
   if (available.has(relative)) return relative;
-  const ext = path28.posix.extname(relative);
+  const ext = path29.posix.extname(relative);
   const replacements = { ".js": [".ts", ".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
   const candidates = ext ? (replacements[ext] ?? []).map((e) => relative.slice(0, -ext.length) + e) : jsExtensions.flatMap((e) => [relative + e, relative + "/index" + e]);
   const found = candidates.filter((f) => available.has(f));
@@ -5867,13 +5908,13 @@ function mentionsPath(content2, target) {
 function createReferenceMatcher(targets, available, targetContents = /* @__PURE__ */ new Map()) {
   const counts = /* @__PURE__ */ new Map();
   for (const file of available) {
-    const name = path28.posix.basename(file, path28.posix.extname(file));
+    const name = path29.posix.basename(file, path29.posix.extname(file));
     counts.set(name, (counts.get(name) ?? 0) + 1);
   }
   const jvmTargets = new Map([...targetContents].filter(([file]) => /\.(?:kt|kts|java)$/.test(file)).map(([file, content2]) => [file, declaredSymbols(content2)]));
   return (source) => {
     if (targets.includes(source.path)) return [];
-    const resolved = new Set(jsExtensions.includes(path28.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
+    const resolved = new Set(jsExtensions.includes(path29.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
     if (/\.(?:kt|kts|java)$/.test(source.path)) {
       const imported = jvmImports(source.content);
       for (const [target, symbols] of jvmTargets) if (symbols.some((symbol) => imported.some((name) => name === symbol || name.startsWith(symbol + ".")))) resolved.add(target);
@@ -5889,7 +5930,7 @@ function createReferenceMatcher(targets, available, targetContents = /* @__PURE_
         add("explicit-path", target);
         continue;
       }
-      const ext = path28.posix.extname(target), name = path28.posix.basename(target, ext);
+      const ext = path29.posix.extname(target), name = path29.posix.basename(target, ext);
       if (!/\.(?:[cm]?[jt]sx?|py|kt|java|go|rs|swift|rb|cs|cpp|c|h|hpp|dart|php)$/.test(ext) || name.startsWith(".") || name.length < 3 || genericNames.has(name.toLowerCase()) || counts.get(name) !== 1) continue;
       if (word(name).test(source.content)) {
         add("name-candidate", name);
@@ -5918,11 +5959,11 @@ var impact_exports = {};
 __export(impact_exports, {
   analyzeImpact: () => analyzeImpact
 });
-import path29 from "path";
-import { execFile as execFile17 } from "child_process";
-import { promisify as promisify17 } from "util";
+import path30 from "path";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
 async function analyzeImpact(rootDir, targetFiles) {
-  const resolvedRoot = path29.resolve(rootDir);
+  const resolvedRoot = path30.resolve(rootDir);
   const resolvedTargets = await resolveTargetFiles(resolvedRoot, targetFiles);
   const [cochange, references, tests] = await Promise.all([
     getCochangeFiles(resolvedRoot, resolvedTargets),
@@ -5965,7 +6006,7 @@ async function getCochangeFiles(rootDir, targetFiles) {
   let totalTargetCommits = 0;
   for (const targetFile of targetFiles) {
     try {
-      const { stdout: commitLog } = await exec14(
+      const { stdout: commitLog } = await exec6(
         "git",
         ["log", "--format=%H", "-n", "500", "--", targetFile],
         { cwd: rootDir, maxBuffer: 5e6 }
@@ -5975,7 +6016,7 @@ async function getCochangeFiles(rootDir, targetFiles) {
       if (commits.length === 0) continue;
       for (const commit of commits) {
         try {
-          const { stdout: filesInCommit } = await exec14(
+          const { stdout: filesInCommit } = await exec6(
             "git",
             ["diff-tree", "--no-commit-id", "--name-only", "-r", commit],
             { cwd: rootDir }
@@ -6036,9 +6077,9 @@ async function getRelatedTests(rootDir, targetFiles) {
   const testFiles = await (await createFileAccess(rootDir)).list(testPatterns);
   const results = [];
   for (const target of targetFiles) {
-    const targetBaseName = path29.basename(target).replace(/\.[^.]+$/, "");
+    const targetBaseName = path30.basename(target).replace(/\.[^.]+$/, "");
     for (const testFile of testFiles) {
-      const testBaseName = path29.basename(testFile).replace(/\.[^.]+$/, "");
+      const testBaseName = path30.basename(testFile).replace(/\.[^.]+$/, "");
       const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
       if (sourceName === targetBaseName) {
         results.push({
@@ -6050,14 +6091,14 @@ async function getRelatedTests(rootDir, targetFiles) {
   }
   return results;
 }
-var exec14;
+var exec6;
 var init_impact = __esm({
   "src/impact/impact.ts"() {
     "use strict";
     init_files();
     init_paths();
     init_references();
-    exec14 = promisify17(execFile17);
+    exec6 = promisify8(execFile8);
   }
 });
 
@@ -6066,13 +6107,13 @@ var assemble_exports = {};
 __export(assemble_exports, {
   assembleContext: () => assembleContext
 });
-import path30 from "path";
+import path31 from "path";
 import fs21 from "fs/promises";
 async function collectImpact(root, candidates) {
   const targets = /* @__PURE__ */ new Set();
   let sourceFiles;
   for (const candidate of sanitizeRepoPaths(candidates)) {
-    const stat = await fs21.stat(path30.join(root, candidate)).catch(() => null);
+    const stat = await fs21.stat(path31.join(root, candidate)).catch(() => null);
     if (stat?.isDirectory()) {
       sourceFiles ??= await (await createFileAccess(root)).list();
       for (const file of sourceFiles) {
@@ -6098,7 +6139,7 @@ async function collectImpact(root, candidates) {
   };
 }
 async function assembleContext(rootDir, task, files) {
-  const resolvedRoot = path30.resolve(rootDir);
+  const resolvedRoot = path31.resolve(rootDir);
   const mapState = await inspectSnapshot(resolvedRoot);
   const snapshot = mapState.snapshot;
   const store = await loadDecisionStore(resolvedRoot);
@@ -6641,8 +6682,8 @@ __export(client_exports, {
 function createConfluenceClient(config, fetchFn = fetch) {
   const baseUrl = config.baseUrl.replace(/\/+$/, "");
   const auth = "Basic " + Buffer.from(`${config.email}:${config.apiToken}`).toString("base64");
-  async function call(method, path34, body) {
-    const res = await fetchFn(`${baseUrl}${path34}`, {
+  async function call(method, path35, body) {
+    const res = await fetchFn(`${baseUrl}${path35}`, {
       method,
       headers: {
         Authorization: auth,
@@ -6654,7 +6695,7 @@ function createConfluenceClient(config, fetchFn = fetch) {
     if (!res.ok) {
       const text2 = await res.text();
       throw new Error(
-        `Confluence ${method} ${path34} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
+        `Confluence ${method} ${path35} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
       );
     }
     if (res.status === 204) return null;
@@ -6756,15 +6797,15 @@ __export(config_exports2, {
   validateProvider: () => validateProvider
 });
 import fs23 from "fs/promises";
-import path31 from "path";
+import path32 from "path";
 import os3 from "os";
-import { execFile as execFile18 } from "child_process";
-import { promisify as promisify18 } from "util";
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
 function configDir() {
-  return path31.join(os3.homedir(), ".mason");
+  return path32.join(os3.homedir(), ".mason");
 }
 function configFile() {
-  return path31.join(configDir(), "config.json");
+  return path32.join(configDir(), "config.json");
 }
 async function loadConfig() {
   try {
@@ -6794,7 +6835,7 @@ async function detectCLI(provider) {
   const cliName = provider === "claude" ? "claude" : provider === "gemini" ? "gemini" : provider === "ollama" ? "ollama" : null;
   if (!cliName) return { available: false };
   try {
-    const { stdout } = await exec15(cliName, ["--version"]);
+    const { stdout } = await exec7(cliName, ["--version"]);
     return { available: true, version: stdout.trim() };
   } catch {
     return { available: false };
@@ -6811,11 +6852,11 @@ async function loadConfluenceConfig() {
   const config = await loadConfig();
   return config?.confluence ?? null;
 }
-var exec15, DEFAULT_MODELS;
+var exec7, DEFAULT_MODELS;
 var init_config2 = __esm({
   "src/llm/config.ts"() {
     "use strict";
-    exec15 = promisify18(execFile18);
+    exec7 = promisify9(execFile9);
     DEFAULT_MODELS = {
       claude: "claude-sonnet-4-20250514",
       gemini: "gemini-2.5-flash",
@@ -6937,16 +6978,16 @@ var init_renderer = __esm({
 
 // src/confluence/diff.ts
 import fs24 from "fs/promises";
-import path32 from "path";
+import path33 from "path";
 import { createHash as createHash5 } from "crypto";
 function hashDescription(description) {
   return createHash5("sha256").update(description, "utf8").digest("hex");
 }
 function syncStateDir(rootDir) {
-  return path32.join(rootDir, ".mason");
+  return path33.join(rootDir, ".mason");
 }
 function syncStatePath(rootDir) {
-  return path32.join(syncStateDir(rootDir), "confluence-sync.json");
+  return path33.join(syncStateDir(rootDir), "confluence-sync.json");
 }
 async function loadSyncState(rootDir) {
   try {
@@ -7014,8 +7055,8 @@ var init_diff = __esm({
 });
 
 // src/llm/providers.ts
-import { execFile as execFile19, spawn } from "child_process";
-import { promisify as promisify19 } from "util";
+import { execFile as execFile10, spawn } from "child_process";
+import { promisify as promisify10 } from "util";
 async function callLLM(config, userMessage, systemPrompt) {
   const model = config.model ?? getDefaultModel(config.provider);
   const system = systemPrompt ?? CLAUDE_MD_SYSTEM_PROMPT;
@@ -7172,12 +7213,12 @@ async function callOpenAIAPI(apiKey, model, system, userMessage) {
   });
   return response.choices[0]?.message?.content ?? "";
 }
-var exec16, CLAUDE_MD_SYSTEM_PROMPT;
+var exec8, CLAUDE_MD_SYSTEM_PROMPT;
 var init_providers = __esm({
   "src/llm/providers.ts"() {
     "use strict";
     init_config2();
-    exec16 = promisify19(execFile19);
+    exec8 = promisify10(execFile10);
     CLAUDE_MD_SYSTEM_PROMPT = `You are Mason, a context engineering tool. You've been given a comprehensive analysis of a codebase including:
 - Git history stats (commit patterns, frequently changed files, stale directories)
 - Project structure (directory layout, file counts by type)
@@ -7519,20 +7560,20 @@ import { z as z24 } from "zod";
 init_repair();
 init_advisory_review();
 import fs25 from "fs/promises";
-import path33 from "path";
-import { execFile as execFile20 } from "child_process";
-import { promisify as promisify20 } from "util";
+import path34 from "path";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 
 // src/audit/cli.ts
 init_audit();
 init_types();
 init_repair();
 init_findings();
-import path22 from "path";
+import path23 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path21 from "path";
+import path22 from "path";
 import { stripVTControlCharacters } from "util";
 
 // src/audit/cli.ts
@@ -7625,8 +7666,8 @@ function formatFixPrompt(report, baselinePath) {
 }
 
 // src/analyzers/git-history.ts
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 
 // src/analyzers/base.ts
 import fs15 from "fs/promises";
@@ -7663,7 +7704,7 @@ var BaseAnalyzer = class {
 };
 
 // src/analyzers/git-history.ts
-var exec8 = promisify11(execFile11);
+var exec = promisify3(execFile3);
 var GitHistoryAnalyzer = class extends BaseAnalyzer {
   name = "git-history";
   async analyze(context) {
@@ -7684,7 +7725,7 @@ var GitHistoryAnalyzer = class extends BaseAnalyzer {
   }
   async git(args, cwd) {
     try {
-      const { stdout } = await exec8("git", args, { cwd, maxBuffer: 1e7 });
+      const { stdout } = await exec("git", args, { cwd, maxBuffer: 1e7 });
       return stdout.trim();
     } catch {
       return "";
@@ -7833,12 +7874,10 @@ async function runAll(context) {
 }
 
 // src/utils/git.ts
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
-var exec9 = promisify12(execFile12);
+init_git_read();
 async function isGitRepo(dir) {
   try {
-    await exec9("git", ["rev-parse", "--git-dir"], { cwd: dir });
+    await execGit(["rev-parse", "--git-dir"], { cwd: dir });
     return true;
   } catch {
     return false;
@@ -7847,10 +7886,10 @@ async function isGitRepo(dir) {
 
 // src/mcp/sampler.ts
 init_files();
-import path23 from "path";
-import { execFile as execFile13 } from "child_process";
-import { promisify as promisify13 } from "util";
-var exec10 = promisify13(execFile13);
+import path24 from "path";
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+var exec2 = promisify4(execFile4);
 var CONFIG_FILES = [
   // Build & project config
   "package.json",
@@ -7955,8 +7994,8 @@ async function sampleFiles(rootDir, maxFiles = 25) {
   const projectConfig = access.config;
   for (const filePath of projectConfig.alwaysInclude ?? []) {
     if (selected.size >= maxFiles) break;
-    const resolvedPath = path23.resolve(rootDir, filePath);
-    if (!resolvedPath.startsWith(path23.resolve(rootDir))) continue;
+    const resolvedPath = path24.resolve(rootDir, filePath);
+    if (!resolvedPath.startsWith(path24.resolve(rootDir))) continue;
     selected.set(filePath, "always-include (project config)");
   }
   let configCount = 0;
@@ -8012,7 +8051,7 @@ async function sampleFiles(rootDir, maxFiles = 25) {
     }
   }
   try {
-    const { stdout } = await exec10(
+    const { stdout } = await exec2(
       "git",
       ["log", "--since=3 months ago", "--format=", "--name-only"],
       { cwd: rootDir, maxBuffer: 5e6 }
@@ -8022,7 +8061,7 @@ async function sampleFiles(rootDir, maxFiles = 25) {
       if (!line) continue;
       if (line.includes("node_modules") || line.includes("/build/") || line.includes(".gradle") || line.includes("/generated/"))
         continue;
-      const ext = path23.extname(line).slice(1);
+      const ext = path24.extname(line).slice(1);
       if (!SOURCE_EXTENSIONS.includes(ext)) continue;
       fileCounts.set(line, (fileCounts.get(line) ?? 0) + 1);
     }
@@ -8142,10 +8181,10 @@ init_drift();
 init_paths();
 init_files();
 import { createHash as createHash4 } from "crypto";
-import { execFile as execFile14 } from "child_process";
-import { promisify as promisify14 } from "util";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
 import { z as z10 } from "zod";
-var exec11 = promisify14(execFile14);
+var exec3 = promisify5(execFile5);
 var requestSchema = z10.object({
   id: z10.string().regex(/^[a-zA-Z0-9_-]+$/),
   action: z10.enum(["prepare", "accept", "reaffirm", "retire"]).default("prepare"),
@@ -8200,7 +8239,7 @@ async function previews(root, record, state) {
   let diffUnavailable;
   if (state.evidence.historyAvailable && diffPaths.length) {
     try {
-      const { stdout } = await exec11("git", ["--literal-pathspecs", "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--no-renames", "-U3", record.refreshedHash, state.evidence.headHash, "--", ...diffPaths], { cwd: root, maxBuffer: 1024 * 1024 });
+      const { stdout } = await exec3("git", ["--literal-pathspecs", "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--no-renames", "-U3", record.refreshedHash, state.evidence.headHash, "--", ...diffPaths], { cwd: root, maxBuffer: 1024 * 1024 });
       diff = stdout.slice(0, 16e3);
       if (stdout.length > diff.length) diffUnavailable = "Diff preview was truncated; inspect the full diff before reviewing.";
     } catch {
@@ -8426,7 +8465,7 @@ function batchIdFor(offset) {
 // src/mcp/tools.ts
 init_init();
 init_onboarding();
-var exec17 = promisify20(execFile20);
+var exec9 = promisify11(execFile11);
 async function buildContext(dir) {
   return {
     rootDir: dir,
@@ -8434,7 +8473,7 @@ async function buildContext(dir) {
   };
 }
 async function analyzeProject(dir) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const context = await buildContext(rootDir);
   const results = await runAll(context);
   const projectSnapshot = await detectProjectSnapshot(rootDir);
@@ -8489,7 +8528,7 @@ async function detectProjectSnapshot(rootDir) {
   const present = [];
   for (const file of buildFiles) {
     try {
-      await fs25.access(path33.join(rootDir, file));
+      await fs25.access(path34.join(rootDir, file));
       present.push(file);
     } catch {
     }
@@ -8531,7 +8570,7 @@ async function detectProjectSnapshot(rootDir) {
   const sourceFiles = await access.list();
   const fileCounts = {};
   for (const file of sourceFiles) {
-    const ext = path33.extname(file).slice(1);
+    const ext = path34.extname(file).slice(1);
     fileCounts[ext] = (fileCounts[ext] ?? 0) + 1;
   }
   return {
@@ -8542,7 +8581,7 @@ async function detectProjectSnapshot(rootDir) {
   };
 }
 async function getCodeSamples(dir, count4 = 15) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const samples = await sampleFiles(rootDir, count4);
   const output = {
     note: "These are previews (first ~60 lines). Read the file directly with your own tools to see it in full.",
@@ -8585,7 +8624,7 @@ async function unmappedContextResponse(rootDir) {
   });
 }
 async function getProjectStructure(dir) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const allFiles = await (await createFileAccess(rootDir)).list("**/*");
   const dirInfo = /* @__PURE__ */ new Map();
   for (const file of allFiles) {
@@ -8597,7 +8636,7 @@ async function getProjectStructure(dir) {
       }
       const info = dirInfo.get(dirPath);
       info.fileCount++;
-      const ext = path33.extname(file).slice(1);
+      const ext = path34.extname(file).slice(1);
       if (ext) {
         info.extensions.set(ext, (info.extensions.get(ext) ?? 0) + 1);
       }
@@ -8642,7 +8681,7 @@ async function buildChangedFilePreviews(rootDir, changedFiles) {
   return previews2;
 }
 async function getSnapshot(dir) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return unmappedContextResponse(rootDir);
@@ -8743,7 +8782,7 @@ function driftHint(report) {
   return "Read the changed files under staleFeatures/staleFlows, update those entries (fold unmappedFiles into the right features), and call save_snapshot with only the affected entries \u2014 unchanged entries are preserved. Drop ghostFiles from any entries that reference them, and delete features/flows that no longer exist via save_snapshot's removeFeatures/removeFlows.";
 }
 async function checkDrift(dir) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const report = await computeDrift(rootDir);
   if (!report) {
     return JSON.stringify({
@@ -8774,7 +8813,7 @@ async function checkDrift(dir) {
   return JSON.stringify({ exists: true, ...report, verification, hint });
 }
 async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_SIZE, files) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const scoped = files !== void 0 && files.length > 0;
   const scopeFiles = scoped ? sanitizePaths(rootDir, files) : void 0;
   const batch = await prepareSnapshotBatch(dir, offset, batchSize, scopeFiles);
@@ -8821,7 +8860,7 @@ async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_
   );
 }
 async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   for (const feat of Object.values(features)) {
     feat.files = sanitizePaths(rootDir, feat.files);
     if (feat.tests) feat.tests = sanitizePaths(rootDir, feat.tests);
@@ -8850,7 +8889,7 @@ async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
   );
 }
 async function reduceSnapshot(dir) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const partials = await loadAllPartials(rootDir);
   if (partials.length === 0) {
     return JSON.stringify(
@@ -8912,7 +8951,7 @@ async function reduceSnapshot(dir) {
   );
 }
 async function fullAnalysis(dir) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const [analysis, structure, samples, testMap, snapshot] = await Promise.all([
     analyzeProject(dir),
     getProjectStructure(dir),
@@ -8941,7 +8980,7 @@ function sanitizePaths(rootDir, files) {
   return sanitizeRepoPaths(files);
 }
 async function saveSnapshotData(dir, features, flows, removeFeatures = [], removeFlows = []) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const gitHash = await getCurrentGitHash(rootDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   for (const feat of Object.values(features)) {
@@ -9025,7 +9064,7 @@ async function saveSnapshotData(dir, features, flows, removeFeatures = [], remov
   });
 }
 async function getImpact(dir, files) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const { analyzeImpact: analyzeImpact2 } = await Promise.resolve().then(() => (init_impact(), impact_exports));
   const result = await analyzeImpact2(rootDir, files);
   return JSON.stringify(result, null, 2);
@@ -9034,7 +9073,7 @@ var VERIFY_DEFAULT_SAMPLE = 5;
 var VERIFY_MAX_FILES_PER_ENTRY = 8;
 var VERIFY_SKELETON_CHARS = 500;
 async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return JSON.stringify({
@@ -9099,7 +9138,7 @@ async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
   });
 }
 async function saveVerification(dir, verdicts) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return JSON.stringify({ exists: false, hint: "No concept map exists." });
@@ -9137,16 +9176,16 @@ async function saveVerification(dir, verdicts) {
   });
 }
 async function saveDecision(dir, input) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const { upsertDecision: upsertDecision2 } = await Promise.resolve().then(() => (init_decisions(), decisions_exports));
   const result = await upsertDecision2(rootDir, input);
   return JSON.stringify(result);
 }
 async function reviewDecision2(dir, input) {
-  return JSON.stringify(await reviewDecision(path33.resolve(dir), input));
+  return JSON.stringify(await reviewDecision(path34.resolve(dir), input));
 }
 async function getContext(dir, task, files) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const { assembleContext: assembleContext2 } = await Promise.resolve().then(() => (init_assemble(), assemble_exports));
   const bundle = await assembleContext2(rootDir, task, files);
   return JSON.stringify(bundle);
@@ -9195,7 +9234,7 @@ async function masonInit(dir, options = {}) {
     return JSON.stringify(await setupProject2(dir, options), null, 2);
   }
   if (options.host) throw new Error("host applies only to mode: setup.");
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const marker = await loadProjectMarker(rootDir);
   const { loadSetup: loadSetup2 } = await Promise.resolve().then(() => (init_model(), model_exports));
   const setup = await loadSetup2(rootDir);
@@ -9215,7 +9254,7 @@ async function masonInit(dir, options = {}) {
   );
 }
 async function masonCompleteInit(dir, options = {}) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const existing = await loadProjectMarker(rootDir);
   const features = await loadProjectFeatures(rootDir);
   const marker = {
@@ -9324,7 +9363,7 @@ async function masonSetConfluence(input) {
   );
 }
 async function exportToConfluenceTool(dir, overrides) {
-  const rootDir = path33.resolve(dir);
+  const rootDir = path34.resolve(dir);
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), config_exports2));
   const { exportToConfluence: exportToConfluence2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
   const config = await loadConfig2();
@@ -9363,7 +9402,7 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.17.3"
+      version: "0.17.4"
     },
     {
       instructions: (setupNotice ? setupNotice + "\n\n" : "") + 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, failed verification needs correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'