mason-context 0.17.3 → 0.18.0

package/dist/mason-audit.js

@@ -31,6 +31,32 @@ var init_profile = __esm({
   }
 });
 
+// src/utils/git-read.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function execGit(args, options) {
+  const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
+  return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
+    const { input, ...processOptions } = options;
+    const operation = execute("git", args, processOptions);
+    if (input !== void 0) {
+      operation.child.stdin.on("error", () => {
+      });
+      operation.child.stdin.end(input);
+    }
+    return operation;
+  });
+}
+var execute, commands;
+var init_git_read = __esm({
+  "src/utils/git-read.ts"() {
+    "use strict";
+    init_profile();
+    execute = promisify(execFile);
+    commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+  }
+});
+
 // src/utils/paths.ts
 import path from "path";
 function normalizeRepoPath(value) {
@@ -62,8 +88,6 @@ var init_paths = __esm({
 import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
-import { execFile } from "child_process";
-import { promisify } from "util";
 import fg from "fast-glob";
 async function readBoundedFile(file, maxBytes) {
   const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
@@ -105,12 +129,12 @@ async function loadProjectConfig(root) {
     throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-var exec, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
 var init_files = __esm({
   "src/utils/files.ts"() {
     "use strict";
+    init_git_read();
     init_paths();
-    exec = promisify(execFile);
     SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
     SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
     SOURCE_IGNORE = [
@@ -210,6 +234,102 @@ var init_storage = __esm({
   }
 });
 
+// src/utils/store-lock.ts
+import fs3 from "fs/promises";
+import os from "os";
+async function lockDiagnostic(file) {
+  let reason;
+  try {
+    const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+    if (!owner || typeof owner.host !== "string" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
+      reason = "Lock owner data is incomplete or malformed.";
+    } else if (owner.host !== os.hostname()) {
+      reason = "The lock belongs to another host; its process cannot be checked locally.";
+    } else {
+      try {
+        process.kill(owner.pid, 0);
+        reason = `Local owner PID ${owner.pid} is still running.`;
+      } catch (error) {
+        reason = error.code === "ESRCH" ? `Local owner PID ${owner.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.pid} could not be checked.`;
+      }
+    }
+  } catch (error) {
+    reason = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
+  }
+  if (await fs3.lstat(file + ".reclaim").then(() => true, () => false)) {
+    reason += " A recovery guard also needs inspection: " + file + ".reclaim.";
+  }
+  return reason + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
+}
+async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason store") {
+  const file = await storePath(root, directory + "/lock", true);
+  const deadline = Date.now() + waitMs;
+  let handle;
+  while (!handle) {
+    try {
+      handle = await fs3.open(file, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
+      } catch (error) {
+        await handle.close().catch(() => {
+        });
+        handle = void 0;
+        await fs3.rm(file, { force: true }).catch(() => {
+        });
+        throw error;
+      }
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+        if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+          try {
+            process.kill(owner.pid, 0);
+          } catch (probe) {
+            if (probe.code === "ESRCH") {
+              const reclaim = file + ".reclaim";
+              let guard;
+              try {
+                guard = await fs3.open(reclaim, "wx", 384);
+                const current = JSON.parse(await fs3.readFile(file, "utf8"));
+                if (current.pid === owner.pid && current.host === owner.host) await fs3.unlink(file);
+              } finally {
+                if (guard) {
+                  await guard.close();
+                  await fs3.rm(reclaim, { force: true });
+                }
+              }
+            }
+          }
+        }
+      } catch {
+      }
+      if (Date.now() >= deadline) throw new Error(label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file));
+      await new Promise((resolve) => setTimeout(resolve, 40));
+    }
+  }
+  try {
+    return await run();
+  } finally {
+    await handle.close();
+    await fs3.unlink(file);
+  }
+}
+var init_store_lock = __esm({
+  "src/utils/store-lock.ts"() {
+    "use strict";
+    init_storage();
+  }
+});
+
+// src/snapshot/lock.ts
+var init_lock = __esm({
+  "src/snapshot/lock.ts"() {
+    "use strict";
+    init_store_lock();
+  }
+});
+
 // src/test-map.ts
 import path4 from "path";
 var init_test_map = __esm({
@@ -221,12 +341,10 @@ var init_test_map = __esm({
 
 // src/snapshot/snapshot.ts
 import path5 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
 import { z } from "zod";
 async function getCurrentGitHash(rootDir) {
   try {
-    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+    const { stdout } = await execGit(["rev-parse", "HEAD"], {
       cwd: rootDir
     });
     return stdout.trim();
@@ -234,21 +352,23 @@ async function getCurrentGitHash(rootDir) {
     return "unknown";
   }
 }
-var exec2, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
 var init_snapshot = __esm({
   "src/snapshot/snapshot.ts"() {
     "use strict";
+    init_git_read();
     init_files();
     init_files();
     init_storage();
+    init_lock();
     init_paths();
     init_test_map();
-    exec2 = promisify2(execFile2);
     repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z.string().optional(),
       verifiedAt: z.string().optional(),
       verifiedHash: z.string().optional(),
+      verificationToken: z.string().optional(),
       verificationFailed: z.boolean().optional(),
       verificationNote: z.string().optional()
     };
@@ -272,10 +392,8 @@ var init_snapshot = __esm({
 });
 
 // src/drift/drift.ts
-import fs3 from "fs/promises";
+import fs4 from "fs/promises";
 import path6 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -296,7 +414,7 @@ function touchedPaths(changes) {
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
     return parseChanges(stdout);
   } catch {
     return null;
@@ -305,8 +423,8 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
     return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
@@ -314,13 +432,12 @@ async function getWorkingTree(resolvedRoot) {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
 }
-var exec3;
 var init_drift = __esm({
   "src/drift/drift.ts"() {
     "use strict";
+    init_git_read();
     init_snapshot();
     init_paths();
-    exec3 = promisify3(execFile3);
   }
 });
 
@@ -548,14 +665,14 @@ function extractClaims(content) {
   const ignored = computeIgnoredLines(lines);
   const paths = /* @__PURE__ */ new Map();
   const counts = [];
-  const commands = /* @__PURE__ */ new Map();
+  const commands2 = /* @__PURE__ */ new Map();
   const addPath = (claim) => {
     const key = [claim.relativeTo ?? "scope", claim.path].join(":");
     if (!paths.has(key)) paths.set(key, claim);
   };
   const addCommand = (claim) => {
     const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
-    if (!commands.has(key)) commands.set(key, claim);
+    if (!commands2.has(key)) commands2.set(key, claim);
   };
   const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
   for (const token of parsed) {
@@ -657,7 +774,7 @@ function extractClaims(content) {
   return {
     paths: [...paths.values()],
     counts,
-    commands: [...commands.values()]
+    commands: [...commands2.values()]
   };
 }
 var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
@@ -707,9 +824,50 @@ var init_claims = __esm({
   }
 });
 
+// src/audit/inspection.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path8 from "path";
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path8.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const shared = inspections.getStore()?.root === path8.resolve(root);
+  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path8.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
 // src/audit/git.ts
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -717,8 +875,7 @@ function parseCommitLine(line) {
 }
 async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot }
     );
@@ -730,8 +887,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 }
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         "-1",
@@ -750,8 +906,7 @@ async function deletingCommitOf(resolvedRoot, relPath) {
 }
 async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
     );
@@ -764,8 +919,7 @@ async function firstCommitOf(resolvedRoot, relPath) {
 async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
   if (!fromHash || fromHash === "unknown") return null;
   try {
-    const { stdout } = await exec4(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         `${fromHash}..HEAD`,
@@ -789,24 +943,22 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     return null;
   }
 }
-var exec4, COMMIT_FORMAT;
+var COMMIT_FORMAT;
 var init_git = __esm({
   "src/audit/git.ts"() {
     "use strict";
-    exec4 = promisify4(execFile4);
+    init_inspection();
     COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
 
 // src/audit/inputs.ts
-import fs4 from "fs/promises";
+import fs5 from "fs/promises";
 import * as nativeFs from "fs";
-import path8 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+import path9 from "path";
 import fg2 from "fast-glob";
 async function auditInputPath(root, file) {
-  if (file === ".") return fs4.realpath(root);
+  if (file === ".") return fs5.realpath(root);
   try {
     return await storePath(root, file);
   } catch (error) {
@@ -830,7 +982,7 @@ async function auditGlob(root, patterns, options) {
   if (Array.isArray(patterns) && !patterns.length) return [];
   const directories = /* @__PURE__ */ new Set();
   const readdir2 = ((directory, opts, callback) => {
-    const relative = path8.relative(root, directory).split(path8.sep).join("/") || ".";
+    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
       callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
@@ -841,7 +993,7 @@ async function auditGlob(root, patterns, options) {
     }, callback);
   });
   const lstat2 = ((file, callback) => {
-    const relative = path8.relative(root, file).split(path8.sep).join("/") || ".";
+    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
     auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
   });
   const stream = fg2.stream(patterns, {
@@ -878,62 +1030,48 @@ async function auditGlob(root, patterns, options) {
   return matches.sort();
 }
 async function gitSourcePaths(root) {
-  const { stdout } = await execute(
-    "git",
-    [
-      "ls-files",
-      "-z",
-      "--cached",
-      "--others",
-      "--exclude-standard",
-      "--",
-      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
-    ],
-    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
-  );
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+  return auditGitPaths(root, "sources");
 }
 async function gitIgnoredPaths(root, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
-  const operation = execute(
-    "git",
-    ["check-ignore", "-z", "--stdin"],
-    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
-  );
-  operation.child.stdin.on("error", () => {
-  });
-  operation.child.stdin.end(files.join("\0") + "\0");
-  try {
-    return new Set((await operation).stdout.split("\0").filter(Boolean));
-  } catch (error) {
-    if (error.code === 1) return /* @__PURE__ */ new Set();
-    throw error;
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
   }
+  return ignored;
 }
-var execute, MAX_INPUTS;
+var MAX_INPUTS;
 var init_inputs = __esm({
   "src/audit/inputs.ts"() {
     "use strict";
     init_files();
     init_storage();
-    execute = promisify5(execFile5);
+    init_git_read();
+    init_inspection();
     MAX_INPUTS = 1e5;
   }
 });
 
 // src/audit/docs.ts
-import fs5 from "fs/promises";
-import path9 from "path";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import fs6 from "fs/promises";
+import path10 from "path";
 import fg3 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
     const dirty = /* @__PURE__ */ new Set();
     for (let offset = 0; offset < files.length; offset += 256) {
-      const { stdout } = await exec5(
-        "git",
+      const { stdout } = await execGit(
         ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
         { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
       );
@@ -953,25 +1091,10 @@ async function dirtyDocs(resolvedRoot, files) {
 async function discoverDocPaths(root) {
   let candidates = [];
   try {
-    const { stdout } = await exec5(
-      "git",
-      [
-        "ls-files",
-        "-z",
-        "--cached",
-        "--others",
-        "--exclude-standard",
-        "--",
-        ":(icase,glob)**/readme.md",
-        ":(icase,glob)**/agents.md",
-        ":(icase,glob)**/claude.md"
-      ],
-      { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
-    );
-    candidates = stdout.split("\0").filter(Boolean);
+    candidates = await auditGitPaths(root, "documents");
   } catch (error) {
     try {
-      await exec5("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
     } catch {
       return localDocPaths(root);
     }
@@ -1012,20 +1135,20 @@ async function localDocPaths(root) {
   for (const dir of [".", ".claude"]) {
     let entries;
     try {
-      entries = await fs5.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+      entries = await fs6.readdir(await auditInputPath(root, dir), { withFileTypes: true });
     } catch (error) {
       if (error.code === "ENOENT") continue;
       throw error;
     }
     for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-      paths.push(path9.posix.join(dir, entry.name));
+      paths.push(path10.posix.join(dir, entry.name));
     }
   }
   return paths;
 }
 function documentScope(file) {
-  const parent = path9.posix.dirname(file);
-  return path9.posix.basename(parent).toLowerCase() === ".claude" ? path9.posix.dirname(parent) : parent;
+  const parent = path10.posix.dirname(file);
+  return path10.posix.basename(parent).toLowerCase() === ".claude" ? path10.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -1045,7 +1168,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path9.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path10.posix.basename(candidate)) ? "readme" : "instructions",
         lineCount: content.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1055,16 +1178,17 @@ async function readDocs(resolvedRoot) {
   }
   return docs;
 }
-var exec5, DOC_CANDIDATES;
+var DOC_CANDIDATES;
 var init_docs = __esm({
   "src/audit/docs.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_claims();
     init_git();
     init_inputs();
     init_files();
-    exec5 = promisify6(execFile6);
+    init_inspection();
     DOC_CANDIDATES = [
       "AGENTS.md",
       "CLAUDE.md",
@@ -1090,15 +1214,15 @@ var init_types = __esm({
 });
 
 // src/audit/scope.ts
-import fs6 from "fs/promises";
-import path10 from "path";
+import fs7 from "fs/promises";
+import path11 from "path";
 function scopedPath(directory, value) {
-  if (path10.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
-  const resolved = path10.posix.normalize(path10.posix.join(directory, value));
+  if (path11.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
+  const resolved = path11.posix.normalize(path11.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path10.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path11.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1110,7 +1234,7 @@ function pathClaimScope(doc, claim) {
 }
 async function pathExists(root, file) {
   try {
-    await fs6.access(await auditInputPath(root, file));
+    await fs7.access(await auditInputPath(root, file));
     return true;
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return false;
@@ -1132,7 +1256,7 @@ var init_scope = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path11 from "path";
+import path12 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1161,7 +1285,7 @@ async function checkDeletedReferences(ctx) {
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
         tracked: await lastCommitOf(ctx.root, file),
-        parent: await pathExists(ctx.root, path11.posix.dirname(file))
+        parent: await pathExists(ctx.root, path12.posix.dirname(file))
       })));
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
       if (!candidate && claim.relativeTo !== "document") continue;
@@ -1200,8 +1324,8 @@ var init_deleted_reference = __esm({
 
 // src/audit/checks/new-module.ts
 import fg4 from "fast-glob";
-import fs7 from "fs/promises";
-import path12 from "path";
+import fs8 from "fs/promises";
+import path13 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1239,23 +1363,36 @@ async function checkNewModules(ctx) {
   return result;
 }
 function moduleDocumentation(docs) {
-  return docs.map((doc) => doc.content + "\n" + (path12.posix.dirname(doc.path) === "." ? "" : path12.posix.dirname(doc.path) + "/")).join("\n");
+  return docs.map((doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")).join("\n");
 }
-async function moduleCandidates(root, combinedDocs) {
+function moduleCandidates(root, combinedDocs) {
+  return inspectionRead(root, "modules:" + combinedDocs, () => collectModuleCandidates(root, combinedDocs));
+}
+async function collectModuleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
-  const listSubdirs = async (dir) => {
-    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path12.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path12.posix.join(dir, entry.name));
-    const ignored = await gitIgnoredPaths(root, dirs);
-    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
-    return (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
-      ignore,
-      onlyDirectories: true,
-      label: "Module directory discovery",
-      select: (file) => visible.has(file)
-    })).map((file) => path12.posix.basename(file));
+  const listSubdirs = async (parents) => {
+    const byParent = /* @__PURE__ */ new Map();
+    for (let offset = 0; offset < parents.length; offset += 16) {
+      await Promise.all(parents.slice(offset, offset + 16).map(async (dir) => {
+        const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+        const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path13.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path13.posix.join(dir, entry.name));
+        byParent.set(dir, dirs);
+      }));
+    }
+    const ignored = await gitIgnoredPaths(root, [...byParent.values()].flat());
+    const result = /* @__PURE__ */ new Map();
+    for (const dir of parents) {
+      const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+        ignore,
+        onlyDirectories: true,
+        label: "Module directory discovery",
+        select: (file) => visible.has(file)
+      })).map((file) => path13.posix.basename(file)));
+    }
+    return result;
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
@@ -1271,14 +1408,16 @@ async function moduleCandidates(root, combinedDocs) {
     return count3;
   };
   const candidates = [];
-  for (const topDir of await listSubdirs(".")) {
+  const topDirs = (await listSubdirs(["."])).get(".");
+  const nested = await listSubdirs(topDirs.filter((dir) => isMentioned(combinedDocs, dir)));
+  for (const topDir of topDirs) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
       const count3 = await countSourceFiles(topDir);
       if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
-    const subdirs = await listSubdirs(topDir);
+    const subdirs = nested.get(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
@@ -1295,6 +1434,7 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
+    init_inspection();
     init_files();
     init_inputs();
     init_git();
@@ -1324,7 +1464,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path13 from "path";
+import path14 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content = await readAuditInput(root, name);
@@ -1358,7 +1498,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1389,7 +1529,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1411,8 +1551,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path13.dirname(m));
-    } else if (await readAuditInput(root, path13.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path14.dirname(m));
+    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1432,7 +1572,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path13.join(root, scope), claim);
+  const source = await resolveCountSource(path14.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1484,7 +1624,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path14 from "path";
+import path15 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -1520,7 +1660,7 @@ async function commandInputs(root, docs) {
     }
     let cursor = directory;
     while (true) {
-      const manifest = path14.posix.join(cursor, "package.json");
+      const manifest = path15.posix.join(cursor, "package.json");
       scope.candidates.push(manifest);
       const raw = await read(manifest);
       if (raw !== null) {
@@ -1531,7 +1671,7 @@ async function commandInputs(root, docs) {
         break;
       }
       if (claim.directory !== void 0 || cursor === ".") break;
-      cursor = path14.posix.dirname(cursor);
+      cursor = path15.posix.dirname(cursor);
     }
     if (!resolution.manifest && !resolution.problem) {
       resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -1594,10 +1734,8 @@ var init_dead_command = __esm({
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
 async function git(root, args) {
-  return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+  return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
 function withoutAndroidReleaseValues(text2) {
   if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
@@ -1643,11 +1781,10 @@ async function releaseMetadataOnly(root, commit) {
     return false;
   }
 }
-var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify7(execFile7);
+    init_git_read();
   }
 });
 
@@ -1743,7 +1880,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path15 from "path";
+import path16 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -1903,8 +2040,8 @@ var init_provenance = __esm({
 });
 
 // src/decisions/decisions.ts
-import fs8 from "fs/promises";
-import path16 from "path";
+import fs9 from "fs/promises";
+import path17 from "path";
 import { createHash } from "crypto";
 import { z as z3 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -1912,7 +2049,7 @@ async function loadDecisionStore(rootDir) {
   const diagnostics = [];
   let entries;
   try {
-    entries = await fs8.readdir(await storePath(rootDir, ".mason/decisions"));
+    entries = await fs9.readdir(await storePath(rootDir, ".mason/decisions"));
   } catch (error) {
     if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
     return { records, diagnostics };
@@ -1955,9 +2092,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path17 from "path";
+import path18 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path17.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2180,68 +2317,15 @@ var init_findings = __esm({
 });
 
 // src/automation/store.ts
-import fs9 from "fs/promises";
-import os from "os";
 import { z as z5 } from "zod";
-async function withLock(root, directory, run, waitMs = 5e3) {
-  const file = await storePath(root, directory + "/lock", true);
-  const deadline = Date.now() + waitMs;
-  let handle;
-  while (!handle) {
-    try {
-      handle = await fs9.open(file, "wx", 384);
-      try {
-        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
-      } catch (error) {
-        await handle.close().catch(() => {
-        });
-        handle = void 0;
-        await fs9.rm(file, { force: true }).catch(() => {
-        });
-        throw error;
-      }
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      try {
-        const owner = JSON.parse(await fs9.readFile(file, "utf8"));
-        if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
-          try {
-            process.kill(owner.pid, 0);
-          } catch (probe) {
-            if (probe.code === "ESRCH") {
-              const reclaim = file + ".reclaim";
-              let guard;
-              try {
-                guard = await fs9.open(reclaim, "wx", 384);
-                const current = JSON.parse(await fs9.readFile(file, "utf8"));
-                if (current.pid === owner.pid && current.host === owner.host) await fs9.unlink(file);
-              } finally {
-                if (guard) {
-                  await guard.close();
-                  await fs9.rm(reclaim, { force: true });
-                }
-              }
-            }
-          }
-        }
-      } catch {
-      }
-      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
-      await new Promise((resolve) => setTimeout(resolve, 40));
-    }
-  }
-  try {
-    return await run();
-  } finally {
-    await handle.close();
-    await fs9.unlink(file);
-  }
+function withLock(root, directory, run, waitMs = 5e3) {
+  return withStoreLock(root, directory, run, waitMs, "Automation");
 }
 var hostSchema, stateSchema;
 var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
-    init_storage();
+    init_store_lock();
     hostSchema = z5.enum(["claude", "codex"]);
     stateSchema = z5.object({
       version: z5.literal(1),
@@ -2284,7 +2368,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs10 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z6 } from "zod";
 function recheckable(finding) {
@@ -2322,8 +2406,8 @@ async function readStableAudit(root, checks, options) {
 async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
   return prepareOriginal(rootDir, checks, options);
 }
-async function withRepairSession(root, options, run, cachedAudit) {
-  const before = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
+async function withRepairSession(root, options, run, validate, cachedAudit) {
+  const head = await getCurrentGitHash(root);
   const audits = /* @__PURE__ */ new Map();
   const documents = /* @__PURE__ */ new Map();
   const history = /* @__PURE__ */ new Map();
@@ -2334,9 +2418,9 @@ async function withRepairSession(root, options, run, cachedAudit) {
   };
   const session = {
     audit: (checks) => memo(audits, [...checks].sort().join(","), async () => {
-      if (cachedAudit && cachedAudit.headHash === before[0] && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
+      if (cachedAudit && cachedAudit.headHash === head && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
         const current = structuredClone(cachedAudit);
-        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, before[0])))).filter((r) => r !== null);
+        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, head)))).filter((r) => r !== null);
         delete current.advisoryReviews;
         if (reviews.length) current.advisoryReviews = reviews;
         return current;
@@ -2344,16 +2428,15 @@ async function withRepairSession(root, options, run, cachedAudit) {
       return computeAudit(root, { ...options, checks });
     }),
     document: (file) => memo(documents, file, async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)),
-    history: (head) => memo(history, head, () => getChangesWithStatus(root, head)),
-    assessment: (dir, finding, head) => memo(assessments, digest([dir, finding, head]), () => assessAdvisory(dir, finding, head))
+    history: (head2) => memo(history, head2, () => getChangesWithStatus(root, head2)),
+    assessment: (dir, finding, head2) => memo(assessments, digest([dir, finding, head2]), () => assessAdvisory(dir, finding, head2))
   };
   const result = await run({
     prepare: () => prepareOriginal(root, ALL_CHECKS, options, session),
     verify: (baseline) => profilePhase("repair.verify", () => verifyOriginal(root, baseline, options, session)),
     currentAudit: () => session.audit(ALL_CHECKS)
   });
-  const after = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
-  if (digest(before) !== digest(after)) throw new Error("HEAD, context files or advisory review records changed during verification; retry against stable evidence.");
+  await validate();
   return result;
 }
 async function prepareOriginal(rootDir, checks, options, session) {
@@ -2375,8 +2458,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs10.realpath(rootDir);
-  const declaredRoot = path18.resolve(rootDir);
-  const relative = path18.isAbsolute(baselinePath) ? path18.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path19.resolve(rootDir);
+  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2551,8 +2634,6 @@ var init_repair = __esm({
 
 // src/audit/advisory-review.ts
 import fs11 from "fs/promises";
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
 import { z as z7 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
@@ -2747,10 +2828,12 @@ async function reviewAdvisory(rootDir, input) {
     };
   });
 }
-var execute2, git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
+    init_inspection();
+    init_git_read();
     init_findings();
     init_deps_changed();
     init_inputs();
@@ -2760,8 +2843,7 @@ var init_advisory_review = __esm({
     init_store();
     init_decisions();
     init_drift2();
-    execute2 = promisify8(execFile8);
-    git2 = async (root, ...args) => (await execute2("git", args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
+    git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
     hashSchema = z7.string().regex(/^[a-f0-9]{64}$/);
     commitSchema2 = z7.string().regex(/^[a-f0-9]{40,64}$/);
     evidenceSchema2 = z7.object({
@@ -2805,12 +2887,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs12 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2844,7 +2926,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs12.access(path19.join(resolvedRoot, ".mason", "decisions"));
+    await fs12.access(path20.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2889,11 +2971,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path21 from "path";
+import path22 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path20 from "path";
+import path21 from "path";
 import { stripVTControlCharacters } from "util";
 var USAGE = `Usage: mason audit review --baseline <path> --finding <id> [options]
 
@@ -2939,7 +3021,7 @@ async function runAdvisoryCli(args, io = { out: (text2) => console.log(text2), e
       note: flags["--note"],
       reviewToken: flags["--token"]
     };
-    const result = await reviewAdvisory(path20.resolve(flags["--dir"] ?? process.cwd()), input);
+    const result = await reviewAdvisory(path21.resolve(flags["--dir"] ?? process.cwd()), input);
     if (json) io.out(JSON.stringify(result, null, 2));
     else {
       const lines = [`Advisory review: ${result.status}.`];
@@ -3172,7 +3254,7 @@ async function runAuditCli(argv, io = {
     io.out(USAGE2);
     return 0;
   }
-  const rootDir = path21.resolve(args.dir);
+  const rootDir = path22.resolve(args.dir);
   if (args.baseline || args.prepareRepair) {
     try {
       if (args.baseline) {