mason-context 0.18.0 → 0.19.1

package/dist/mason-mcp.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
@@ -57,23 +58,486 @@ var init_git_read = __esm({
   }
 });
 
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function sanitizeRepoPaths(files) {
+  return [...new Set(files.map(normalizeRepoPath).filter((p) => p !== null))];
+}
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+}
+var init_paths = __esm({
+  "src/utils/paths.ts"() {
+    "use strict";
+  }
+});
+
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
+
+// src/utils/files.ts
+import fs from "fs/promises";
+import { constants } from "fs";
+import path2 from "path";
+import fg from "fast-glob";
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
+}
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath2 = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath2, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
+          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
+      }
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve2(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve2(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve2(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read };
+}
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var init_files = __esm({
+  "src/utils/files.ts"() {
+    "use strict";
+    init_git_read();
+    init_paths();
+    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+    SOURCE_IGNORE = [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.gradle/**",
+      "**/target/**",
+      "**/.git/**",
+      "**/.mason/**",
+      "**/vendor/**",
+      "**/__pycache__/**",
+      "**/venv/**",
+      "**/.venv/**",
+      "**/*.min.*",
+      "**/*.map",
+      "**/*.lock",
+      "**/generated/**",
+      "**/*.generated.*",
+      "**/R.java",
+      "**/BuildConfig.java",
+      "**/package-lock.json",
+      "**/yarn.lock",
+      "**/pnpm-lock.yaml"
+    ];
+    MAX_SOURCE_BYTES = 1024 * 1024;
+  }
+});
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+}
+async function writeStoreJson(root, relative, value) {
+  const payload = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
+    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
+  }
+  const file = await storePath(root, relative, true);
+  const temporary = path3.join(path3.dirname(file), `.${path3.basename(file)}.${randomUUID()}.tmp`);
+  try {
+    const handle = await fs2.open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(payload, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fs2.rename(temporary, file);
+  } finally {
+    await fs2.rm(temporary, { force: true });
+  }
+}
+var init_storage = __esm({
+  "src/utils/storage.ts"() {
+    "use strict";
+    init_paths();
+    init_files();
+  }
+});
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path4 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const custom = (await loadProjectConfig(root)).audit?.include ?? [];
+  const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
+  const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
+  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
+  const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
+// src/audit/inputs.ts
+import fs3 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import fg3 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs3.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg3.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  return auditGitPaths(root, "sources");
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
+  }
+  return ignored;
+}
+var MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    init_git_read();
+    init_inspection();
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/policy.ts
+import fg4 from "fast-glob";
+async function includedCheckPaths(root, paths, exclude) {
+  if (!exclude.length) return new Set(paths);
+  const included = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < paths.length; offset += 256) {
+    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
+      ignore: exclude,
+      followSymbolicLinks: false,
+      label: "Audit check exclusions"
+    })) included.add(file);
+  }
+  return included;
+}
+var init_policy = __esm({
+  "src/audit/policy.ts"() {
+    "use strict";
+    init_inputs();
+  }
+});
+
 // src/audit/commands.ts
-import path from "path";
+import path6 from "path";
 function splitCommands(line) {
   const parts = [];
-  let quote = "", start = 0;
+  let quote2 = "", start = 0;
   for (let i = 0; i < line.length; i++) {
     const char = line[i];
     if (char === "\\") {
       i++;
       continue;
     }
-    if (quote) {
-      if (char === quote) quote = "";
+    if (quote2) {
+      if (char === quote2) quote2 = "";
       continue;
     }
     if (char === "'" || char === '"') {
-      quote = char;
+      quote2 = char;
       continue;
     }
     if (char === ";" || line.slice(i, i + 2) === "&&") {
@@ -94,7 +558,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path6.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -105,7 +569,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
       if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path6.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
@@ -135,7 +599,7 @@ var init_commands = __esm({
     COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path6.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -391,268 +855,52 @@ function extractClaims(content2) {
     paths: [...paths.values()],
     counts,
     commands: [...commands2.values()]
-  };
-}
-var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
-var init_claims = __esm({
-  "src/audit/claims.ts"() {
-    "use strict";
-    init_commands();
-    init_tree();
-    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
-      "package.json",
-      "package-lock.json",
-      "pnpm-workspace.yaml",
-      "tsconfig.json",
-      "tsup.config.ts",
-      "vitest.config.ts",
-      "Makefile",
-      "Dockerfile",
-      "docker-compose.yml",
-      "Cargo.toml",
-      "go.mod",
-      "go.sum",
-      "pyproject.toml",
-      "requirements.txt",
-      "Gemfile",
-      "composer.json",
-      "settings.gradle.kts",
-      "settings.gradle",
-      "build.gradle.kts",
-      "build.gradle",
-      "manifest.json",
-      "server.json",
-      "README.md",
-      "CHANGELOG.md",
-      "LICENSE",
-      "CLAUDE.md",
-      "AGENTS.md",
-      ".gitignore",
-      ".env.example"
-    ]);
-    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
-    markdown = new MarkdownIt("commonmark", { html: false });
-    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
-    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
-    IGNORE_LINE = "<!-- mason:ignore -->";
-    IGNORE_START = "<!-- mason:ignore-start -->";
-    IGNORE_END = "<!-- mason:ignore-end -->";
-  }
-});
-
-// src/utils/paths.ts
-import path2 from "path";
-function normalizeRepoPath(value) {
-  const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path2.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
-  if (slash.split("/").includes("..")) return null;
-  const normalized = path2.posix.normalize(slash).replace(/\/$/, "");
-  return normalized === "." ? null : normalized;
-}
-function sanitizeRepoPaths(files) {
-  return [...new Set(files.map(normalizeRepoPath).filter((p) => p !== null))];
-}
-function isWithinRoot(root, candidate) {
-  const relative = path2.relative(root, candidate);
-  return relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
-}
-function anchorMatches(anchor, file) {
-  const a = normalizeRepoPath(anchor);
-  const f = normalizeRepoPath(file);
-  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
-}
-function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
-}
-var init_paths = __esm({
-  "src/utils/paths.ts"() {
-    "use strict";
-  }
-});
-
-// src/utils/files.ts
-import fs from "fs/promises";
-import { constants } from "fs";
-import path3 from "path";
-import fg from "fast-glob";
-function isSensitiveFile(file) {
-  return file.split(/[\\/]/).some(
-    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
-  );
-}
-async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
-  try {
-    const stat = await handle.stat();
-    if (!stat.isFile() || stat.size > maxBytes) return null;
-    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
-    let bytes = 0;
-    while (bytes < buffer.length) {
-      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
-      if (result.bytesRead === 0) break;
-      bytes += result.bytesRead;
-    }
-    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
-  } finally {
-    await handle.close();
-  }
-}
-async function loadProjectConfig(root) {
-  try {
-    const canonicalRoot = await fs.realpath(root);
-    const configPath2 = await fs.realpath(path3.join(root, ".mason/config.json"));
-    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
-    const raw = await readBoundedFile(configPath2, 64 * 1024);
-    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
-    const value = JSON.parse(raw);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
-    const config = {};
-    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
-      if (value[key] === void 0) continue;
-      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
-        throw new Error(`Configuration ${key} must be an array of strings`);
-      }
-      config[key] = value[key];
-    }
-    return config;
-  } catch (error) {
-    if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-async function createFileAccess(rootDir) {
-  const root = path3.resolve(rootDir);
-  const canonicalRoot = await fs.realpath(root).catch(() => root);
-  const config = await loadProjectConfig(root);
-  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
-  let gitFiles = null;
-  try {
-    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
-    gitFiles = new Set(stdout.split("\0").filter(Boolean));
-  } catch {
-    let inGit = false;
-    try {
-      await execGit(["rev-parse", "--git-dir"], { cwd: root });
-      inGit = true;
-    } catch {
-    }
-    if (inGit) throw new Error("Cannot enumerate Git files safely");
-  }
-  async function resolve2(file) {
-    const relative = normalizeRepoPath(file);
-    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
-    const candidate = path3.join(root, relative);
-    try {
-      const real = await fs.realpath(candidate);
-      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path3.relative(canonicalRoot, real))) return null;
-      const stat = await fs.stat(real);
-      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
-      if (gitFiles && !gitFiles.has(path3.relative(canonicalRoot, real).split(path3.sep).join("/"))) return null;
-      return real;
-    } catch {
-      return null;
-    }
-  }
-  async function list(patterns = SOURCE_GLOB, options = {}) {
-    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
-    const safe = await Promise.all(found.map(async (f) => await resolve2(f) ? f : null));
-    return safe.filter((f) => f !== null).sort();
-  }
-  async function read(file) {
-    const relative = normalizeRepoPath(file);
-    if (!relative) return null;
-    const real = await resolve2(relative);
-    if (!real) return null;
-    for (const rel of /* @__PURE__ */ new Set([relative, path3.relative(canonicalRoot, real).split(path3.sep).join("/")])) {
-      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
-    }
-    try {
-      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
-      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
-    } catch {
-      return null;
-    }
-  }
-  return { root, config, list, read };
-}
-var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
-var init_files = __esm({
-  "src/utils/files.ts"() {
-    "use strict";
-    init_git_read();
-    init_paths();
-    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
-    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
-    SOURCE_IGNORE = [
-      "**/node_modules/**",
-      "**/dist/**",
-      "**/build/**",
-      "**/.gradle/**",
-      "**/target/**",
-      "**/.git/**",
-      "**/.mason/**",
-      "**/vendor/**",
-      "**/__pycache__/**",
-      "**/venv/**",
-      "**/.venv/**",
-      "**/*.min.*",
-      "**/*.map",
-      "**/*.lock",
-      "**/generated/**",
-      "**/*.generated.*",
-      "**/R.java",
-      "**/BuildConfig.java",
-      "**/package-lock.json",
-      "**/yarn.lock",
-      "**/pnpm-lock.yaml"
-    ];
-    MAX_SOURCE_BYTES = 1024 * 1024;
-  }
-});
-
-// src/audit/inspection.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import path4 from "path";
-function withRepositoryInspection(root, run) {
-  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
-}
-function inspectionRead(root, key, read) {
-  const inspection = inspections.getStore();
-  if (!inspection || inspection.root !== path4.resolve(root)) return read();
-  if (!inspection.reads.has(key)) {
-    const pending = read();
-    inspection.reads.set(key, pending);
-    void pending.catch(() => {
-      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
-    });
-  }
-  return inspection.reads.get(key);
-}
-function inspectionGit(args, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
-}
-async function auditGitPaths(root, kind) {
-  const shared = inspections.getStore()?.root === path4.resolve(root);
-  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
-  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
-  const { stdout } = await inspectionGit(
-    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
-    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
-  );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
-  return paths.sort();
-}
-var inspections, sourceSpecs, docSpecs, sourceSuffixes;
-var init_inspection = __esm({
-  "src/audit/inspection.ts"() {
+  };
+}
+var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
+var init_claims = __esm({
+  "src/audit/claims.ts"() {
     "use strict";
-    init_git_read();
-    init_files();
-    inspections = new AsyncLocalStorage2();
-    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
-    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+    init_commands();
+    init_tree();
+    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+      "package.json",
+      "package-lock.json",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "tsup.config.ts",
+      "vitest.config.ts",
+      "Makefile",
+      "Dockerfile",
+      "docker-compose.yml",
+      "Cargo.toml",
+      "go.mod",
+      "go.sum",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "build.gradle.kts",
+      "build.gradle",
+      "manifest.json",
+      "server.json",
+      "README.md",
+      "CHANGELOG.md",
+      "LICENSE",
+      "CLAUDE.md",
+      "AGENTS.md",
+      ".gitignore",
+      ".env.example"
+    ]);
+    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+    markdown = new MarkdownIt("commonmark", { html: false });
+    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+    IGNORE_LINE = "<!-- mason:ignore -->";
+    IGNORE_START = "<!-- mason:ignore-start -->";
+    IGNORE_END = "<!-- mason:ignore-end -->";
   }
 });
 
@@ -741,190 +989,10 @@ var init_git = __esm({
   }
 });
 
-// src/utils/storage.ts
-import fs2 from "fs/promises";
-import path5 from "path";
-import { randomUUID } from "crypto";
-async function storePath(root, relative, createParents = false) {
-  const normalized = normalizeRepoPath(relative);
-  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
-  let current = await fs2.realpath(root);
-  const parts = normalized.split("/");
-  for (let i = 0; i < parts.length; i++) {
-    current = path5.join(current, parts[i]);
-    let stat;
-    try {
-      stat = await fs2.lstat(current);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      if (createParents && i < parts.length - 1) {
-        try {
-          await fs2.mkdir(current);
-        } catch (mkdirError) {
-          if (mkdirError.code !== "EEXIST") throw mkdirError;
-        }
-        stat = await fs2.lstat(current);
-      }
-    }
-    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
-  }
-  return current;
-}
-async function readStoreJson(root, relative) {
-  try {
-    const file = await storePath(root, relative);
-    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
-    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
-    const parsed = JSON.parse(raw);
-    if (parsed === null) throw new Error("expected a JSON object, received null");
-    return parsed;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-  }
-}
-async function writeStoreJson(root, relative, value) {
-  const payload = JSON.stringify(value, null, 2) + "\n";
-  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
-    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
-  }
-  const file = await storePath(root, relative, true);
-  const temporary = path5.join(path5.dirname(file), `.${path5.basename(file)}.${randomUUID()}.tmp`);
-  try {
-    const handle = await fs2.open(temporary, "wx", 384);
-    try {
-      await handle.writeFile(payload, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    await fs2.rename(temporary, file);
-  } finally {
-    await fs2.rm(temporary, { force: true });
-  }
-}
-var init_storage = __esm({
-  "src/utils/storage.ts"() {
-    "use strict";
-    init_paths();
-    init_files();
-  }
-});
-
-// src/audit/inputs.ts
-import fs3 from "fs/promises";
-import * as nativeFs from "fs";
-import path6 from "path";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs3.realpath(root);
-  try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
-  }
-}
-async function readAuditInput(root, file) {
-  try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
-    throw error;
-  }
-}
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
-  try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
-  }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  return auditGitPaths(root, "sources");
-}
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const ignored = /* @__PURE__ */ new Set();
-  for (let offset = 0; offset < files.length; offset += 1e3) {
-    try {
-      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
-        cwd: root,
-        maxBuffer: 4 * 1024 * 1024,
-        timeout: 1e4,
-        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
-      });
-      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
-    } catch (error) {
-      if (error.code !== 1) throw error;
-    }
-  }
-  return ignored;
-}
-var MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-    init_git_read();
-    init_inspection();
-    MAX_INPUTS = 1e5;
-  }
-});
-
 // src/audit/docs.ts
 import fs4 from "fs/promises";
 import path7 from "path";
-import fg3 from "fast-glob";
+import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
@@ -976,7 +1044,7 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
       ignore: excluded,
       followSymbolicLinks: false,
       label: "Documentation discovery"
@@ -1006,6 +1074,7 @@ async function localDocPaths(root) {
   return paths;
 }
 function documentScope(file) {
+  if (!/^(readme|agents|claude)\.md$/i.test(path7.posix.basename(file))) return ".";
   const parent = path7.posix.dirname(file);
   return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
@@ -1027,7 +1096,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path7.posix.basename(candidate)) ? "instructions" : "guide",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1569,34 +1638,18 @@ async function computeDrift(rootDir) {
   report.stale ||= changedMapped.size > 0 || report.unmappedFiles.length > 0 || committedGhosts.length > 0;
   if (!report.historyAvailable) report.recommendation = "full-rebuild";
   else if (!report.stale) report.recommendation = "up-to-date";
-  else report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedMapped.size / Math.max(1, mappedFiles.size) > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
-  return report;
-}
-var FULL_REBUILD_FRACTION, FULL_REBUILD_MIN_CHANGED_MAPPED_FILES;
-var init_drift = __esm({
-  "src/drift/drift.ts"() {
-    "use strict";
-    init_git_read();
-    init_snapshot();
-    init_paths();
-    FULL_REBUILD_FRACTION = 0.4;
-    FULL_REBUILD_MIN_CHANGED_MAPPED_FILES = 10;
-  }
-});
-
-// src/audit/types.ts
-var ALL_CHECKS;
-var init_types = __esm({
-  "src/audit/types.ts"() {
-    "use strict";
-    ALL_CHECKS = [
-      "deleted-reference",
-      "new-module",
-      "stale-count",
-      "dead-command",
-      "deps-changed",
-      "decision-anchor-drift"
-    ];
+  else report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedMapped.size / Math.max(1, mappedFiles.size) > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
+  return report;
+}
+var FULL_REBUILD_FRACTION, FULL_REBUILD_MIN_CHANGED_MAPPED_FILES;
+var init_drift = __esm({
+  "src/drift/drift.ts"() {
+    "use strict";
+    init_git_read();
+    init_snapshot();
+    init_paths();
+    FULL_REBUILD_FRACTION = 0.4;
+    FULL_REBUILD_MIN_CHANGED_MAPPED_FILES = 10;
   }
 });
 
@@ -1668,7 +1721,7 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
+import fg6 from "fast-glob";
 import fs8 from "fs/promises";
 import path13 from "path";
 function escapeRegExp(text2) {
@@ -1730,7 +1783,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
       const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
         ignore,
         onlyDirectories: true,
         label: "Module directory discovery",
@@ -1743,7 +1796,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count4 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
+      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
@@ -2078,6 +2131,87 @@ var init_dead_command = __esm({
   }
 });
 
+// src/audit/dependency-claims.ts
+import path16 from "path";
+import { parse as parseToml } from "smol-toml";
+function dependencyText(content2) {
+  return content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+}
+function declarations(file, source) {
+  const result = /* @__PURE__ */ new Map();
+  if (!source) return result;
+  if (path16.posix.basename(file) === "package.json") {
+    const json = JSON.parse(source);
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
+      for (const [name, value] of Object.entries(json[section] ?? {})) {
+        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+      }
+    }
+  } else if (file.endsWith("libs.versions.toml")) {
+    const catalog = parseToml(source);
+    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
+      if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+      } else if (entry && typeof entry === "object") {
+        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
+        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
+        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+      }
+    }
+  } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+  }
+  return result;
+}
+async function matchDependencyChanges(root, from, head, files, content2) {
+  const matches = [];
+  const lines = dependencyText(content2).split("\n");
+  let incomplete = files.length > 64;
+  for (const file of files.slice(0, 64)) {
+    if (!/(?:^|\/)(?:package\.json|libs\.versions\.toml|build\.gradle(?:\.kts)?)$/.test(file)) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      const read = async (revision) => {
+        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        if (!entry) return "";
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+      };
+      const [before, after] = await Promise.all([read(from), read(head)]);
+      const old = declarations(file, before), next = declarations(file, after);
+      for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
+        if (old.get(dependency) === next.get(dependency)) continue;
+        const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const line = lines.findIndex((text2) => mention.test(text2));
+        if (line < 0) continue;
+        matches.push({
+          dependency,
+          manifest: file,
+          before: old.get(dependency) ?? null,
+          after: next.get(dependency) ?? null,
+          line: line + 1,
+          excerpt: lines[line].trim().slice(0, 500)
+        });
+        if (matches.length >= 100) return { matches, incomplete: true };
+      }
+    } catch {
+      incomplete = true;
+    }
+  }
+  return { matches, incomplete };
+}
+var init_dependency_claims = __esm({
+  "src/audit/dependency-claims.ts"() {
+    "use strict";
+    init_inspection();
+  }
+});
+
 // src/audit/release-metadata.ts
 async function git(root, args) {
   return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
@@ -2134,6 +2268,10 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function hasDependencyContent(content2) {
+  const text2 = content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+}
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
@@ -2153,12 +2291,17 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
+    let content2 = doc.content;
     if (doc.dirty) {
-      result.skipped.push({
-        check: "deps-changed",
-        doc: doc.path,
-        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-      });
+      try {
+        content2 = (await inspectionGit(
+          ["show", `${doc.lastCommit.hash}:${doc.path}`],
+          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
+        )).stdout;
+      } catch {
+        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        continue;
+      }
     }
     const range = await commitsTouchingSince(
       ctx.root,
@@ -2183,16 +2326,32 @@ async function checkDepsChanged(ctx) {
     range.commits = relevant;
     range.total = relevant.length;
     if (range.total === 0) continue;
-    const latest = range.commits[0];
+    const relevance = await matchDependencyChanges(
+      ctx.root,
+      doc.lastCommit.hash,
+      ctx.headHash,
+      [...new Set(range.commits.flatMap((commit) => commit.files))],
+      content2
+    );
+    if (!relevance.matches.length && !hasDependencyContent(content2)) continue;
+    const match = relevance.matches[0];
+    if (doc.dirty && match) result.skipped.push({
+      check: "deps-changed",
+      doc: doc.path,
+      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+    });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
-      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
-      anchor: { doc: doc.path, line: null, excerpt: null },
+      ...match ? {} : { resolution: "informational" },
+      message: match ? `${match.dependency} changed from ${match.before ?? "absent"} to ${match.after ?? "removed"} in ${match.manifest}; review ${doc.path}:${match.line}: ${match.excerpt}${relevance.matches.length > 1 ? ` (${relevance.matches.length - 1} more matches in evidence)` : ""}` : `Dependency manifests changed after the document baseline ${doc.lastCommit.hash.slice(0, 7)} (${doc.lastCommit.date.slice(0, 10)}); no specific affected passage was established. Informational only.${relevance.incomplete ? " Some manifest declarations could not be matched." : ""}`,
+      anchor: { doc: doc.path, line: match?.line ?? null, excerpt: match?.excerpt ?? null },
       evidence: {
         kind: "doc-behind-manifests",
         docLastCommit: doc.lastCommit,
         manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
-        totalCommits: range.total
+        totalCommits: range.total,
+        matches: relevance.matches,
+        matchingIncomplete: relevance.incomplete
       }
     });
   }
@@ -2202,9 +2361,11 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_dependency_claims();
     init_docs();
     init_release_metadata();
     init_git();
+    init_inspection();
     init_checks();
     MANIFEST_COMMITS_CAP = 10;
     MANIFEST_PATHSPECS = [
@@ -2225,7 +2386,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path16 from "path";
+import path17 from "path";
 function tokenize(text2) {
   return text2.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 2 && !STOPWORDS.has(t));
 }
@@ -2238,7 +2399,7 @@ function tokenSet(text2) {
 function scoreEntry(taskTokens, entry) {
   const nameTokens = tokenSet(entry.name);
   const descTokens = tokenSet(entry.description);
-  const fileTokens = tokenSet(entry.files.map((f) => path16.basename(f)).join(" "));
+  const fileTokens = tokenSet(entry.files.map((f) => path17.basename(f)).join(" "));
   let score = 0;
   for (const token of taskTokens) {
     if (nameTokens.has(token)) score += 3;
@@ -2572,7 +2733,7 @@ __export(decisions_exports, {
   withDecisionWrite: () => withDecisionWrite
 });
 import fs9 from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import { createHash } from "crypto";
 import { z as z3 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2670,7 +2831,7 @@ async function upsertDecision(rootDir, input) {
     if (input.files && files.length < input.files.length) warnings.push("some anchor paths were outside the repo or duplicated and were dropped");
     for (const file of files) {
       try {
-        await fs9.access(path17.join(rootDir, file));
+        await fs9.access(path18.join(rootDir, file));
       } catch {
         warnings.push(`anchor file does not exist on disk: ${file}`);
       }
@@ -2795,9 +2956,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path18 from "path";
+import path19 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2993,7 +3154,9 @@ var init_findings = __esm({
         kind: z4.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
         manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
-        totalCommits: count
+        totalCommits: count,
+        matches: z4.array(z4.object({ dependency: z4.string(), manifest: z4.string(), before: z4.string().nullable(), after: z4.string().nullable(), line: z4.number().int().positive(), excerpt: z4.string() })).optional(),
+        matchingIncomplete: z4.boolean().optional()
       }),
       z4.object({
         kind: z4.literal("decision-anchor"),
@@ -3009,7 +3172,7 @@ var init_findings = __esm({
       type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
       confidence: z4.enum(["certain", "likely"])
     });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.literal("recheck").optional() });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.enum(["recheck", "informational"]).optional() });
     checkResultSchema = z4.object({
       issues: z4.array(issueSchema),
       advisories: z4.array(advisorySchema),
@@ -3072,14 +3235,18 @@ async function readRecord(root, id) {
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
-function scopes(finding) {
+function evidenceFingerprint(evidence, reason2) {
+  return digest([evidence.scope, evidence.tree, ...reason2 === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+}
+function scopes(finding, reason2) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason2 === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
   if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
   else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
@@ -3090,9 +3257,9 @@ function scopes(finding) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding) {
+async function reviewEvidence(root, finding, reason2) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding);
+  const scope = scopes(finding, reason2);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -3118,7 +3285,7 @@ async function reviewEvidence(root, finding) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason2);
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
   return {
     ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
@@ -3165,7 +3332,7 @@ async function assessAdvisory(root, finding, baselineHead) {
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
-    const current = await reviewEvidence(root, event.finding);
+    const current = await reviewEvidence(root, event.finding, event.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
     const base = {
       id,
@@ -3175,7 +3342,7 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
     return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
   } catch (error) {
     return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
@@ -3203,9 +3370,13 @@ async function reviewAdvisory(rootDir, input) {
     decisionId: finding.evidence.decisionId,
     hint: "Use review_decision to prepare evidence and record authorized acceptance, reaffirmation or retirement, then verify this original repair baseline. An advisory assessment cannot approve a decision."
   };
+  if (request.action === "dismiss") {
+    if (finding.type !== "deps-changed" || finding.evidence.kind !== "doc-behind-manifests") throw new Error("One-step dismissal is only available for dependency advisories.");
+    if (!request.reasonCode || !request.note) throw new Error("Dismissal requires reasonCode and note; it does not require a reviewer or prepared token.");
+  } else if (request.reasonCode) throw new Error("reasonCode is only used with dismiss.");
   const prepare = async () => {
     const record = await readRecord(root, request.findingId);
-    const evidence = await reviewEvidence(root, finding);
+    const evidence = await reviewEvidence(root, finding, request.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", baseline.original.headHash, evidence.head);
     const token = digest({ baseline: baseline.original, finding, evidence, record });
     return { record, evidence, token };
@@ -3234,10 +3405,10 @@ async function reviewAdvisory(rootDir, input) {
       hint: "Inspect the original finding, scoped document and relevant code changes. Record addressed, inapplicable or deferred only when the user or cited project review authorizes that assessment. Supply the actual reviewer, reason in note and reviewToken. Relevant edits must be committed first. Deferral remains outstanding. Review identities are recorded assertions, not authenticated approvals."
     };
   }
-  if (!request.reviewer || !request.note || !request.reviewToken) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
+  if (request.action !== "dismiss" && (!request.reviewer || !request.note || !request.reviewToken)) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
   return withLock(root, ".mason/reports/advisory-review-locks/" + request.findingId, async () => {
     const state = await prepare();
-    if (state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
+    if (request.action !== "dismiss" && state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
     if (state.evidence.dirty) throw new Error("Commit relevant document and repository edits before recording the assessment. Unrelated local work may remain.");
     if ((state.record?.events.length ?? 0) >= 200) throw new Error("Review history limit reached; existing events were retained.");
     const { dirty, documentDigest, ...evidence } = state.evidence;
@@ -3245,7 +3416,8 @@ async function reviewAdvisory(rootDir, input) {
       at: (/* @__PURE__ */ new Date()).toISOString(),
       reviewer: request.reviewer,
       note: request.note,
-      outcome: request.action,
+      outcome: request.action === "dismiss" ? "dismissed" : request.action,
+      reasonCode: request.reasonCode,
       finding,
       evidence
     });
@@ -3256,11 +3428,11 @@ async function reviewAdvisory(rootDir, input) {
       status: "recorded",
       recordPath: recordPath(request.findingId),
       event,
-      hint: "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
+      hint: request.action === "dismiss" ? "Dismissal saved and effective locally. Commit the record to share it. No-dependency-claims dismissals reopen on document content changes; unrelated-manifest-change dismissals reopen on scoped document or manifest changes. This does not approve a decision." : "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
     };
   });
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -3286,11 +3458,13 @@ var init_advisory_review = __esm({
       lastScopeCommit: commitSchema2,
       paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
     });
+    dismissalReasonSchema = z6.enum(["no-dependency-claims", "unrelated-manifest-change"]);
     eventSchema2 = z6.object({
       at: z6.string().datetime(),
-      reviewer: z6.string().trim().min(1).max(200),
+      reviewer: z6.string().trim().min(1).max(200).optional(),
       note: z6.string().trim().min(1).max(2500),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred"]),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+      reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
@@ -3302,13 +3476,14 @@ var init_advisory_review = __esm({
       recordPath: z6.string().optional(),
       reviewer: z6.string().optional(),
       note: z6.string().optional(),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
       reviewedHead: z6.string().optional()
     });
     advisoryReviewRequest = z6.object({
       baselinePath: z6.string().min(1),
       findingId: hashSchema,
-      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
       reviewToken: hashSchema.optional()
@@ -3319,12 +3494,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -3358,7 +3533,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path20.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -3370,13 +3545,21 @@ async function auditCurrent(rootDir, options) {
     changesSinceDoc,
     decisionsPresent
   };
+  const policy = (await loadProjectConfig(resolvedRoot)).audit;
   const selected = options.checks ?? ALL_CHECKS;
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
-    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    const exclusions = policy?.exclude?.[name] ?? [];
+    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
+    if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
+    const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    report.advisories.push(...advisories);
+    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
+    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
@@ -3388,6 +3571,8 @@ async function auditCurrent(rootDir, options) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_files();
+    init_policy();
     init_profile();
     init_drift();
     init_snapshot();
@@ -3413,7 +3598,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs12 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -3434,7 +3619,7 @@ async function docState(root) {
       docs.push([doc, null]);
     }
   }
-  return digest(docs);
+  return digest([docs, (await loadProjectConfig(root)).audit]);
 }
 async function stableAudit(root, checks, options = {}) {
   return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
@@ -3503,8 +3688,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path21.resolve(rootDir);
+  const relative = path21.isAbsolute(baselinePath) ? path21.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -3553,6 +3738,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
+    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
+      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
+    }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
@@ -3563,11 +3751,14 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
       return { ...base, review, status: "review-required", reason: review.reason };
     }
+    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
+    }
     if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
         status: "review-required",
-        reason: "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
@@ -3591,7 +3782,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -3614,7 +3805,7 @@ function repairExitCode(report) {
 function formatRepairSummary(report) {
   return [
     "Repair verification: " + report.status + ". Baseline: " + report.baselinePath,
-    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + f.original.message + "\n    " + f.reason + "\n    findingId: " + f.id),
+    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + (f.current?.message ?? "Historical evidence at " + report.baselineHead.slice(0, 7) + ": " + f.original.message) + "\n    " + f.reason + "\n    findingId: " + f.id),
     ...report.newFindings.map((f) => "  [new] " + f.type + " " + f.anchor.doc + ": " + f.message),
     ...report.diagnostics.map((d) => "  [unverified] " + d),
     ...(report.currentAudit?.skippedChecks ?? []).map((s) => "  [skipped] " + s.check + ": " + s.reason),
@@ -3647,13 +3838,14 @@ var init_repair = __esm({
       docs: z7.array(z7.object({
         path: z7.string().refine((value) => normalizeRepoPath(value) === value),
         scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme"]).optional(),
+        kind: z7.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
         dirty: z7.boolean(),
         lineCount: count2
       })).nonempty(),
       decisionsChecked: z7.boolean(),
       clean: z7.boolean(),
+      excludedChecks: z7.array(z7.object({ check: checkSchema, doc: z7.string() })).optional(),
       issues: z7.array(issueSchema),
       advisories: z7.array(advisorySchema),
       suppressedAdvisories: z7.array(advisorySchema).optional(),
@@ -3679,9 +3871,9 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import { createHash as createHash3 } from "crypto";
-import fg5 from "fast-glob";
+import fg7 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args) {
   return profilePhase("automation.git", async () => (await execGit(args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
@@ -3699,6 +3891,11 @@ async function readInputs(root) {
 }
 async function collectInputs(root) {
   const docPaths = await discoverDocPaths(root);
+  const auditPolicy = (await loadProjectConfig(root)).audit;
+  const allowed = /* @__PURE__ */ new Map();
+  for (const name of ["deleted-reference", "new-module", "stale-count", "dead-command"]) {
+    allowed.set(name, await includedCheckPaths(root, docPaths, auditPolicy?.exclude?.[name] ?? []));
+  }
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git3(root, "rev-parse", "HEAD"),
     docPaths.length ? git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...docPaths.map((p) => `:(literal)${p}`)) : "",
@@ -3708,7 +3905,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path22.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3727,18 +3924,18 @@ async function collectInputs(root) {
     docContents.push([file, text2]);
     const parsed = { path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") };
     parsedDocs.push(parsed);
-    for (const claim of parsed.claims.paths) {
+    for (const claim of allowed.get("deleted-reference").has(file) ? parsed.claims.paths : []) {
       const scope = pathClaimScope(file, claim);
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path22.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
   }
-  const combinedDocs = moduleDocumentation(parsedDocs);
-  const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
+  const combinedDocs = moduleDocumentation(parsedDocs.filter((doc) => allowed.get("new-module").has(doc.path)));
+  const countClaims = parsedDocs.filter((doc) => allowed.get("stale-count").has(doc.path)).flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs13.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -3747,8 +3944,8 @@ async function collectInputs(root) {
   const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
-    commandInputs(root, parsedDocs),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    commandInputs(root, parsedDocs.filter((doc) => allowed.get("dead-command").has(doc.path))),
+    fg7(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
   const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
     await storePath(root, file);
@@ -3758,7 +3955,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [5, engineVersion, head, shallow, replacements, docContents];
+  const common = [7, engineVersion, head, shallow, replacements, docContents, auditPolicy];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3805,6 +4002,8 @@ var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_policy();
+    init_files();
     init_git_read();
     init_profile();
     init_docs();
@@ -3818,7 +4017,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.18.0" : "development";
+    engineVersion = true ? "0.19.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3828,18 +4027,49 @@ var init_evidence = __esm({
 // src/setup/model.ts
 var model_exports = {};
 __export(model_exports, {
+  INACTIVE_HOSTS_PATH: () => INACTIVE_HOSTS_PATH,
   SETUP_PATH: () => SETUP_PATH,
+  effectiveSetup: () => effectiveSetup,
+  inactiveHostsSchema: () => inactiveHostsSchema,
   loadSetup: () => loadSetup,
   loadSetupReceipt: () => loadSetupReceipt,
   setupHostSchema: () => setupHostSchema,
   setupSchema: () => setupSchema
 });
 import { z as z9 } from "zod";
+import fs14 from "fs/promises";
+import path23 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
+async function effectiveSetup(root) {
+  const local = await loadSetup(root);
+  if (local) return { root, setup: local };
+  const common = await fs14.realpath(path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const own = await fs14.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
+  if (common === own) return { root, setup: null };
+  const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
+  const candidate = primary.find((field) => field.startsWith("worktree "))?.slice(9);
+  if (!candidate || primary.includes("bare")) return { root, setup: null };
+  let inheritedRoot;
+  try {
+    inheritedRoot = await fs14.realpath((await git3(candidate, "rev-parse", "--show-toplevel")).trim());
+  } catch (error) {
+    if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
+    throw error;
+  }
+  const inheritedCommon = await fs14.realpath(path23.resolve(
+    inheritedRoot,
+    (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
+  ));
+  if (inheritedCommon !== common) throw new Error("Linked worktree setup does not belong to the same Git repository.");
+  const setup = await loadSetup(inheritedRoot);
+  const inactive = await readStoreJson(root, INACTIVE_HOSTS_PATH);
+  if (inactive && setup) for (const host of inactiveHostsSchema.parse(inactive).hosts) delete setup.hosts[host];
+  return { root: inheritedRoot, setup };
+}
 async function loadSetupReceipt(root, directory, host) {
   const raw = await readStoreJson(root, directory + "/setup-" + host + ".json");
   if (raw === null) return null;
@@ -3847,10 +4077,11 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, INACTIVE_HOSTS_PATH, inactiveHostsSchema, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
+    init_evidence();
     init_storage();
     setupHostSchema = z9.object({
       configuredVersion: z9.string(),
@@ -3864,6 +4095,8 @@ var init_model = __esm({
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
+    INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
+    inactiveHostsSchema = z9.object({ version: z9.literal(1), hosts: z9.array(z9.enum(["claude", "codex"])) });
     receiptSchema = z9.object({
       version: z9.literal(1),
       host: z9.enum(["codex", "claude"]),
@@ -3880,7 +4113,7 @@ var init_model = __esm({
 // src/setup/launcher.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fs14 from "fs/promises";
+import fs15 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
 }
@@ -3910,7 +4143,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.18.0" : "development";
+    executingVersion = () => true ? "0.19.1" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4035,8 +4268,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs17 from "fs/promises";
-import path25 from "path";
+import fs18 from "fs/promises";
+import path27 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4065,14 +4298,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs17.unlink(file2);
+    await fs18.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path25.join(path25.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
+  const temporary = path27.join(path27.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
   try {
-    const mode = await fs17.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs17.open(temporary, "wx", mode);
+    const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs18.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -4080,10 +4313,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs17.rename(temporary, file);
+    await fs18.rename(temporary, file);
     return true;
   } finally {
-    await fs17.rm(temporary, { force: true });
+    await fs18.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -4105,7 +4338,7 @@ __export(execution_exports, {
   recordExecution: () => recordExecution
 });
 import os2 from "os";
-import fs18 from "fs/promises";
+import fs19 from "fs/promises";
 import { randomUUID as randomUUID4 } from "crypto";
 import { z as z12 } from "zod";
 function parseExecution(raw) {
@@ -4233,7 +4466,7 @@ async function recordExecution(root, directory, event, run) {
       throw Object.assign(new Error(failure.message, { cause: error }), { failure });
     }
   } finally {
-    await fs18.rm(await storePath(root, owner), { force: true }).catch(() => {
+    await fs19.rm(await storePath(root, owner), { force: true }).catch(() => {
     });
   }
 }
@@ -4317,13 +4550,17 @@ async function observeReadOnlyTool(dir, event) {
 }
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
+  const onlyReview = report.status === "incomplete" && !report.diagnostics.length && !report.counts.unresolved && !report.counts.unverified && report.counts["review-required"] > 0;
   return [
-    `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
-    ...open.slice(0, 4).map((f) => `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(f.original.message)}`),
+    onlyReview ? `Mason: ${report.counts["review-required"]} advisor${report.counts["review-required"] === 1 ? "y" : "ies"} awaiting review; no unresolved issues.` : `Mason: ${report.status}; ${report.counts.unresolved} unresolved, ${report.counts["review-required"]} need review, ${report.counts.unverified} unverified.`,
+    ...open.slice(0, 4).map((f) => {
+      const detail = f.current ? f.current.message : f.status === "review-required" ? `${f.original.type}: current check no longer reports ${f.original.type === "deps-changed" ? "this condition" : "the original finding"}; historical evidence awaits assessment.` : `Original evidence: ${f.original.message}. ${f.reason}`;
+      return `[${f.status}] ${cleanText(f.original.anchor.doc)}: ${cleanText(detail)}`;
+    }),
     ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
     ...report.diagnostics.slice(0, 2).map(cleanText),
     `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason-auto check.`,
-    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use review_advisory for authorized assessments; otherwise leave advisories open without approving them."
   ].join("\n");
 }
 async function loadState(ws) {
@@ -4547,7 +4784,7 @@ async function automate(dir, event) {
         if (event.event === "after_tool" && event.mutating) {
           session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
-            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
           }
           if (event.toolId) delete session.pending[event.toolId];
@@ -4656,8 +4893,8 @@ var init_runtime = __esm({
 });
 
 // src/automation/hook-root.ts
-import fs19 from "fs/promises";
-import path26 from "path";
+import fs20 from "fs/promises";
+import path28 from "path";
 var init_hook_root = __esm({
   "src/automation/hook-root.ts"() {
     "use strict";
@@ -5067,9 +5304,11 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
 
-- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Specific suppressed advisories remain unresolved; editing a doc does not approve it. Informational dependency notices require no review.
 - When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
 
+- For a dependency advisory, \`review_advisory(action: "dismiss", baselinePath, findingId, reasonCode, note)\` records a one-step dismissal without reviewer or token. Use \`no-dependency-claims\` for a document with no dependency claims (reopens on document content changes), or \`unrelated-manifest-change\` for reviewed changes that do not affect its guidance (reopens on document or manifest changes). Keep the relevant scope committed; commit the dismissal to share it. This never approves a decision.
+
 - When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
 
 Inspect source for what the retrieved context does not answer.
@@ -5500,10 +5739,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path27 from "path";
+import path29 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
+  const relative = path29.isAbsolute(file) ? path29.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5600,7 +5839,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path27.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path29.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5721,8 +5960,8 @@ var init_evidence2 = __esm({
 });
 
 // src/review/review.ts
-import fs20 from "fs/promises";
-import path28 from "path";
+import fs21 from "fs/promises";
+import path30 from "path";
 import { execFile as execFile7 } from "child_process";
 import { promisify as promisify7 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5751,7 +5990,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path28.resolve(rootDir);
+  const resolvedRoot = path30.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5801,7 +6040,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs20.access(path28.join(resolvedRoot, relPath));
+        await fs21.access(path30.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5936,7 +6175,7 @@ var init_onboarding = __esm({
 });
 
 // src/impact/references.ts
-import path29 from "path";
+import path31 from "path";
 function templateEnd(content2, start) {
   let i = start + 1, interpolation = 0;
   while (i < content2.length) {
@@ -5958,10 +6197,10 @@ function templateEnd(content2, start) {
         continue;
       }
       if (c === '"' || c === "'") {
-        const quote = c;
+        const quote2 = c;
         for (i++; i < content2.length; i++) {
           if (content2[i] === "\\") i++;
-          else if (content2[i] === quote) {
+          else if (content2[i] === quote2) {
             i++;
             break;
           }
@@ -6062,10 +6301,10 @@ function jvmImports(content2) {
 }
 function resolveImport(file, specifier, available) {
   if (!specifier.startsWith("./") && !specifier.startsWith("../")) return null;
-  const relative = path29.posix.normalize(path29.posix.join(path29.posix.dirname(file), specifier));
+  const relative = path31.posix.normalize(path31.posix.join(path31.posix.dirname(file), specifier));
   if (relative.startsWith("../")) return null;
   if (available.has(relative)) return relative;
-  const ext = path29.posix.extname(relative);
+  const ext = path31.posix.extname(relative);
   const replacements = { ".js": [".ts", ".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
   const candidates = ext ? (replacements[ext] ?? []).map((e) => relative.slice(0, -ext.length) + e) : jsExtensions.flatMap((e) => [relative + e, relative + "/index" + e]);
   const found = candidates.filter((f) => available.has(f));
@@ -6074,23 +6313,23 @@ function resolveImport(file, specifier, available) {
 function mentionsPath(content2, target) {
   return new RegExp(`(?<![\\w./\\\\-])(?:\\./)?${escape(target)}(?![\\w./\\\\-])`).test(content2);
 }
-function createReferenceMatcher(targets, available, targetContents = /* @__PURE__ */ new Map()) {
+function createReferenceMatcher(targets2, available, targetContents = /* @__PURE__ */ new Map()) {
   const counts = /* @__PURE__ */ new Map();
   for (const file of available) {
-    const name = path29.posix.basename(file, path29.posix.extname(file));
+    const name = path31.posix.basename(file, path31.posix.extname(file));
     counts.set(name, (counts.get(name) ?? 0) + 1);
   }
   const jvmTargets = new Map([...targetContents].filter(([file]) => /\.(?:kt|kts|java)$/.test(file)).map(([file, content2]) => [file, declaredSymbols(content2)]));
   return (source) => {
-    if (targets.includes(source.path)) return [];
-    const resolved = new Set(jsExtensions.includes(path29.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
+    if (targets2.includes(source.path)) return [];
+    const resolved = new Set(jsExtensions.includes(path31.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
     if (/\.(?:kt|kts|java)$/.test(source.path)) {
       const imported = jvmImports(source.content);
       for (const [target, symbols] of jvmTargets) if (symbols.some((symbol) => imported.some((name) => name === symbol || name.startsWith(symbol + ".")))) resolved.add(target);
     }
     const groups = /* @__PURE__ */ new Map();
     const add = (evidence, match) => groups.set(evidence, [...groups.get(evidence) ?? [], match]);
-    for (const target of targets) {
+    for (const target of targets2) {
       if (resolved.has(target)) {
         add("resolved-import", target);
         continue;
@@ -6099,7 +6338,7 @@ function createReferenceMatcher(targets, available, targetContents = /* @__PURE_
         add("explicit-path", target);
         continue;
       }
-      const ext = path29.posix.extname(target), name = path29.posix.basename(target, ext);
+      const ext = path31.posix.extname(target), name = path31.posix.basename(target, ext);
       if (!/\.(?:[cm]?[jt]sx?|py|kt|java|go|rs|swift|rb|cs|cpp|c|h|hpp|dart|php)$/.test(ext) || name.startsWith(".") || name.length < 3 || genericNames.has(name.toLowerCase()) || counts.get(name) !== 1) continue;
       if (word(name).test(source.content)) {
         add("name-candidate", name);
@@ -6128,11 +6367,11 @@ var impact_exports = {};
 __export(impact_exports, {
   analyzeImpact: () => analyzeImpact
 });
-import path30 from "path";
+import path32 from "path";
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify8 } from "util";
 async function analyzeImpact(rootDir, targetFiles) {
-  const resolvedRoot = path30.resolve(rootDir);
+  const resolvedRoot = path32.resolve(rootDir);
   const resolvedTargets = await resolveTargetFiles(resolvedRoot, targetFiles);
   const [cochange, references, tests] = await Promise.all([
     getCochangeFiles(resolvedRoot, resolvedTargets),
@@ -6146,10 +6385,10 @@ async function analyzeImpact(rootDir, targetFiles) {
     tests
   };
 }
-async function resolveTargetFiles(rootDir, targets) {
+async function resolveTargetFiles(rootDir, targets2) {
   const resolved = [];
   const access = await createFileAccess(rootDir);
-  for (const target of targets) {
+  for (const target of targets2) {
     if (target.includes("/")) {
       const normalized = normalizeRepoPath(target);
       if (normalized) resolved.push(normalized);
@@ -6246,9 +6485,9 @@ async function getRelatedTests(rootDir, targetFiles) {
   const testFiles = await (await createFileAccess(rootDir)).list(testPatterns);
   const results = [];
   for (const target of targetFiles) {
-    const targetBaseName = path30.basename(target).replace(/\.[^.]+$/, "");
+    const targetBaseName = path32.basename(target).replace(/\.[^.]+$/, "");
     for (const testFile of testFiles) {
-      const testBaseName = path30.basename(testFile).replace(/\.[^.]+$/, "");
+      const testBaseName = path32.basename(testFile).replace(/\.[^.]+$/, "");
       const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
       if (sourceName === targetBaseName) {
         results.push({
@@ -6276,26 +6515,26 @@ var assemble_exports = {};
 __export(assemble_exports, {
   assembleContext: () => assembleContext
 });
-import path31 from "path";
-import fs21 from "fs/promises";
+import path33 from "path";
+import fs22 from "fs/promises";
 async function collectImpact(root, candidates) {
-  const targets = /* @__PURE__ */ new Set();
+  const targets2 = /* @__PURE__ */ new Set();
   let sourceFiles;
   for (const candidate of sanitizeRepoPaths(candidates)) {
-    const stat = await fs21.stat(path31.join(root, candidate)).catch(() => null);
+    const stat = await fs22.stat(path33.join(root, candidate)).catch(() => null);
     if (stat?.isDirectory()) {
       sourceFiles ??= await (await createFileAccess(root)).list();
       for (const file of sourceFiles) {
-        if (anchorMatches(candidate, file)) targets.add(file);
-        if (targets.size >= MAX_IMPACT_TARGETS) break;
+        if (anchorMatches(candidate, file)) targets2.add(file);
+        if (targets2.size >= MAX_IMPACT_TARGETS) break;
       }
     } else {
-      targets.add(candidate);
+      targets2.add(candidate);
     }
-    if (targets.size >= MAX_IMPACT_TARGETS) break;
+    if (targets2.size >= MAX_IMPACT_TARGETS) break;
   }
-  if (!targets.size) return { impact: null, relatedTests: [] };
-  const result = await analyzeImpact(root, [...targets]);
+  if (!targets2.size) return { impact: null, relatedTests: [] };
+  const result = await analyzeImpact(root, [...targets2]);
   const referenceCandidatesOmitted = result.references.filter((r) => r.evidence === "name-candidate").length;
   return {
     impact: {
@@ -6308,7 +6547,7 @@ async function collectImpact(root, candidates) {
   };
 }
 async function assembleContext(rootDir, task, files) {
-  const resolvedRoot = path31.resolve(rootDir);
+  const resolvedRoot = path33.resolve(rootDir);
   const mapState = await inspectSnapshot(resolvedRoot);
   const snapshot = mapState.snapshot;
   const store = await loadDecisionStore(resolvedRoot);
@@ -6504,7 +6743,7 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs22 from "fs/promises";
+import fs23 from "fs/promises";
 import { z as z23 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
@@ -6521,15 +6760,15 @@ async function observeActivation(dir, event, options = {}) {
   if (host !== "codex" && host !== "claude" || !process.env.MASON_SETUP_ROOT) return null;
   try {
     if (!revision) {
-      if ((await loadSetup(process.env.MASON_SETUP_ROOT))?.hosts[host]) {
+      if ((await effectiveSetup(process.env.MASON_SETUP_ROOT)).setup?.hosts[host]) {
         return "Mason setup is now present. Restart the assistant to connect this MCP session to the configured integration; activation has not been established by this session.";
       }
       return inactiveSetupMessage();
     }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs22.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs22.realpath(process.env.MASON_SETUP_ROOT)) return null;
-    const setup = await loadSetup(ws.root);
+    const ws = capturedDirectory ? { root: await fs23.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs23.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const { setup } = await effectiveSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
     await withLock(ws.root, directory, async () => {
@@ -6603,8 +6842,9 @@ __export(status_exports, {
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
-  const setup = await loadSetup(ws.root);
-  if (!setup) {
+  const activation = await effectiveSetup(ws.root);
+  const setup = activation.setup;
+  if (!setup || !Object.keys(setup.hosts).length) {
     const partial = await Promise.all(["codex", "claude"].map(async (host) => ({
       host,
       receipt: await loadSetupReceipt(ws.root, ws.directory, host)
@@ -6638,7 +6878,7 @@ async function setupStatus(dir) {
     ]));
     const hooks = isDeepStrictEqual2(compatibleHooks, expectedHooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
-    const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
+    const configured = activation.root !== ws.root || local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
@@ -6670,6 +6910,7 @@ async function setupStatus(dir) {
     status: statuses.length && statuses.every((status) => status === "active") ? "active" : statuses.includes("attention") ? "attention" : "pending",
     root: ws.root,
     hosts,
+    activationRoot: activation.root,
     decisionRecords: decisions.records.length,
     diagnostics: decisions.diagnostics,
     scope: "Activation receipts record observed use after setup, not complete interception, correct repairs, or measured usefulness. Host trust and higher-priority settings may prevent execution. Receipts are local to this worktree and branch."
@@ -6677,6 +6918,9 @@ async function setupStatus(dir) {
 }
 function summarizeActivation(status) {
   const lines = ["Mason setup: " + status.status + "."];
+  if (status.activationRoot && status.activationRoot !== status.root) {
+    lines.push("Activation inherited from " + status.activationRoot + "; evidence belongs to this worktree.");
+  }
   for (const [host, state] of Object.entries(status.hosts)) {
     lines.push(
       `${host}: ${state.status}`,
@@ -6846,8 +7090,8 @@ __export(client_exports, {
 function createConfluenceClient(config, fetchFn = fetch) {
   const baseUrl = config.baseUrl.replace(/\/+$/, "");
   const auth = "Basic " + Buffer.from(`${config.email}:${config.apiToken}`).toString("base64");
-  async function call(method, path35, body) {
-    const res = await fetchFn(`${baseUrl}${path35}`, {
+  async function call(method, path43, body) {
+    const res = await fetchFn(`${baseUrl}${path43}`, {
       method,
       headers: {
         Authorization: auth,
@@ -6859,7 +7103,7 @@ function createConfluenceClient(config, fetchFn = fetch) {
     if (!res.ok) {
       const text2 = await res.text();
       throw new Error(
-        `Confluence ${method} ${path35} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
+        `Confluence ${method} ${path43} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
       );
     }
     if (res.status === 204) return null;
@@ -6960,28 +7204,28 @@ __export(config_exports2, {
   saveConfluenceConfig: () => saveConfluenceConfig,
   validateProvider: () => validateProvider
 });
-import fs23 from "fs/promises";
-import path32 from "path";
+import fs24 from "fs/promises";
+import path34 from "path";
 import os3 from "os";
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
 function configDir() {
-  return path32.join(os3.homedir(), ".mason");
+  return path34.join(os3.homedir(), ".mason");
 }
 function configFile() {
-  return path32.join(configDir(), "config.json");
+  return path34.join(configDir(), "config.json");
 }
 async function loadConfig() {
   try {
-    const raw = await fs23.readFile(configFile(), "utf-8");
+    const raw = await fs24.readFile(configFile(), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 async function saveConfig(config) {
-  await fs23.mkdir(configDir(), { recursive: true });
-  await fs23.writeFile(configFile(), JSON.stringify(config, null, 2), "utf-8");
+  await fs24.mkdir(configDir(), { recursive: true });
+  await fs24.writeFile(configFile(), JSON.stringify(config, null, 2), "utf-8");
 }
 function getDefaultModel(provider) {
   return DEFAULT_MODELS[provider];
@@ -7141,21 +7385,21 @@ var init_renderer = __esm({
 });
 
 // src/confluence/diff.ts
-import fs24 from "fs/promises";
-import path33 from "path";
+import fs25 from "fs/promises";
+import path35 from "path";
 import { createHash as createHash6 } from "crypto";
 function hashDescription(description) {
   return createHash6("sha256").update(description, "utf8").digest("hex");
 }
 function syncStateDir(rootDir) {
-  return path33.join(rootDir, ".mason");
+  return path35.join(rootDir, ".mason");
 }
 function syncStatePath(rootDir) {
-  return path33.join(syncStateDir(rootDir), "confluence-sync.json");
+  return path35.join(syncStateDir(rootDir), "confluence-sync.json");
 }
 async function loadSyncState(rootDir) {
   try {
-    const raw = await fs24.readFile(syncStatePath(rootDir), "utf-8");
+    const raw = await fs25.readFile(syncStatePath(rootDir), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 2) return null;
     return parsed;
@@ -7164,8 +7408,8 @@ async function loadSyncState(rootDir) {
   }
 }
 async function saveSyncState(rootDir, state) {
-  await fs24.mkdir(syncStateDir(rootDir), { recursive: true });
-  await fs24.writeFile(
+  await fs25.mkdir(syncStateDir(rootDir), { recursive: true });
+  await fs25.writeFile(
     syncStatePath(rootDir),
     JSON.stringify(state, null, 2),
     "utf-8"
@@ -7723,8 +7967,8 @@ import { z as z24 } from "zod";
 // src/mcp/tools.ts
 init_repair();
 init_advisory_review();
-import fs25 from "fs/promises";
-import path34 from "path";
+import fs26 from "fs/promises";
+import path36 from "path";
 import { execFile as execFile11 } from "child_process";
 import { promisify as promisify11 } from "util";
 
@@ -7733,11 +7977,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path23 from "path";
+import path25 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path22 from "path";
+import path24 from "path";
 import { stripVTControlCharacters } from "util";
 
 // src/audit/cli.ts
@@ -7804,7 +8048,7 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
   lines.push("AUDIT REPORT (current context files and repository evidence, including local edits):");
@@ -7834,18 +8078,18 @@ import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
 // src/analyzers/base.ts
-import fs15 from "fs/promises";
-import fg6 from "fast-glob";
+import fs16 from "fs/promises";
+import fg8 from "fast-glob";
 var BaseAnalyzer = class {
   async findFiles(patterns, root) {
-    return fg6(patterns, {
+    return fg8(patterns, {
       cwd: root,
       ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"],
       absolute: true
     });
   }
   async readFile(filePath) {
-    return fs15.readFile(filePath, "utf-8");
+    return fs16.readFile(filePath, "utf-8");
   }
   createFinding(partial) {
     return {
@@ -8050,7 +8294,7 @@ async function isGitRepo(dir) {
 
 // src/mcp/sampler.ts
 init_files();
-import path24 from "path";
+import path26 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 var exec2 = promisify4(execFile4);
@@ -8158,8 +8402,8 @@ async function sampleFiles(rootDir, maxFiles = 25) {
   const projectConfig = access.config;
   for (const filePath of projectConfig.alwaysInclude ?? []) {
     if (selected.size >= maxFiles) break;
-    const resolvedPath = path24.resolve(rootDir, filePath);
-    if (!resolvedPath.startsWith(path24.resolve(rootDir))) continue;
+    const resolvedPath = path26.resolve(rootDir, filePath);
+    if (!resolvedPath.startsWith(path26.resolve(rootDir))) continue;
     selected.set(filePath, "always-include (project config)");
   }
   let configCount = 0;
@@ -8225,7 +8469,7 @@ async function sampleFiles(rootDir, maxFiles = 25) {
       if (!line) continue;
       if (line.includes("node_modules") || line.includes("/build/") || line.includes(".gradle") || line.includes("/generated/"))
         continue;
-      const ext = path24.extname(line).slice(1);
+      const ext = path26.extname(line).slice(1);
       if (!SOURCE_EXTENSIONS.includes(ext)) continue;
       fileCounts.set(line, (fileCounts.get(line) ?? 0) + 1);
     }
@@ -8580,7 +8824,7 @@ ${JSON.stringify({ partials }, null, 2)}`;
 init_lock();
 init_storage();
 init_snapshot();
-import fs16 from "fs/promises";
+import fs17 from "fs/promises";
 import { z as z11 } from "zod";
 var DIRECTORY = ".mason/partial-snapshots";
 var partialSchema = z11.object({
@@ -8598,7 +8842,7 @@ async function savePartial(rootDir, partial) {
 async function loadAllPartials(rootDir) {
   let entries;
   try {
-    entries = await fs16.readdir(await storePath(rootDir, DIRECTORY));
+    entries = await fs17.readdir(await storePath(rootDir, DIRECTORY));
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -8621,11 +8865,11 @@ async function loadScope(rootDir) {
 }
 async function clearScope(rootDir) {
   await withSnapshotWrite(rootDir, async () => {
-    await fs16.rm(await storePath(rootDir, `${DIRECTORY}/scope.json`), { force: true });
+    await fs17.rm(await storePath(rootDir, `${DIRECTORY}/scope.json`), { force: true });
   });
 }
 async function clearAllPartials(rootDir) {
-  await fs16.rm(await storePath(rootDir, DIRECTORY), { recursive: true, force: true });
+  await fs17.rm(await storePath(rootDir, DIRECTORY), { recursive: true, force: true });
 }
 function batchIdFor(offset) {
   return `batch-${String(offset).padStart(6, "0")}`;
@@ -8642,7 +8886,7 @@ async function buildContext(dir) {
   };
 }
 async function analyzeProject(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const context = await buildContext(rootDir);
   const results = await runAll(context);
   const projectSnapshot = await detectProjectSnapshot(rootDir);
@@ -8697,7 +8941,7 @@ async function detectProjectSnapshot(rootDir) {
   const present = [];
   for (const file of buildFiles) {
     try {
-      await fs25.access(path34.join(rootDir, file));
+      await fs26.access(path36.join(rootDir, file));
       present.push(file);
     } catch {
     }
@@ -8739,7 +8983,7 @@ async function detectProjectSnapshot(rootDir) {
   const sourceFiles = await access.list();
   const fileCounts = {};
   for (const file of sourceFiles) {
-    const ext = path34.extname(file).slice(1);
+    const ext = path36.extname(file).slice(1);
     fileCounts[ext] = (fileCounts[ext] ?? 0) + 1;
   }
   return {
@@ -8750,7 +8994,7 @@ async function detectProjectSnapshot(rootDir) {
   };
 }
 async function getCodeSamples(dir, count4 = 15) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const samples = await sampleFiles(rootDir, count4);
   const output = {
     note: "These are previews (first ~60 lines). Read the file directly with your own tools to see it in full.",
@@ -8793,7 +9037,7 @@ async function unmappedContextResponse(rootDir) {
   });
 }
 async function getProjectStructure(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const allFiles = await (await createFileAccess(rootDir)).list("**/*");
   const dirInfo = /* @__PURE__ */ new Map();
   for (const file of allFiles) {
@@ -8805,7 +9049,7 @@ async function getProjectStructure(dir) {
       }
       const info = dirInfo.get(dirPath);
       info.fileCount++;
-      const ext = path34.extname(file).slice(1);
+      const ext = path36.extname(file).slice(1);
       if (ext) {
         info.extensions.set(ext, (info.extensions.get(ext) ?? 0) + 1);
       }
@@ -8850,7 +9094,7 @@ async function buildChangedFilePreviews(rootDir, changedFiles) {
   return previews2;
 }
 async function getSnapshot(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return unmappedContextResponse(rootDir);
@@ -8951,7 +9195,7 @@ function driftHint(report) {
   return "Read the changed files under staleFeatures/staleFlows, update those entries (fold unmappedFiles into the right features), and call save_snapshot with only the affected entries \u2014 unchanged entries are preserved. Drop ghostFiles from any entries that reference them, and delete features/flows that no longer exist via save_snapshot's removeFeatures/removeFlows.";
 }
 async function checkDrift(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const report = await computeDrift(rootDir);
   if (!report) {
     return JSON.stringify({
@@ -8982,7 +9226,7 @@ async function checkDrift(dir) {
   return JSON.stringify({ exists: true, ...report, verification, hint });
 }
 async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_SIZE, files) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const scoped = files !== void 0 && files.length > 0;
   const scopeFiles = scoped ? sanitizePaths(rootDir, files) : void 0;
   const batch = await prepareSnapshotBatch(dir, offset, batchSize, scopeFiles);
@@ -9029,7 +9273,7 @@ async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_
   );
 }
 async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   for (const feat of Object.values(features)) {
     feat.files = sanitizePaths(rootDir, feat.files);
     if (feat.tests) feat.tests = sanitizePaths(rootDir, feat.tests);
@@ -9058,7 +9302,7 @@ async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
   );
 }
 async function reduceSnapshot(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const partials = await loadAllPartials(rootDir);
   if (partials.length === 0) {
     return JSON.stringify(
@@ -9120,7 +9364,7 @@ async function reduceSnapshot(dir) {
   );
 }
 async function fullAnalysis(dir) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const [analysis, structure, samples, testMap, snapshot] = await Promise.all([
     analyzeProject(dir),
     getProjectStructure(dir),
@@ -9149,7 +9393,7 @@ function sanitizePaths(rootDir, files) {
   return sanitizeRepoPaths(files);
 }
 async function saveSnapshotData(dir, features, flows, removeFeatures = [], removeFlows = []) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   return updateSnapshot(rootDir, async (previous) => {
     const gitHash = await getCurrentGitHash(rootDir);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -9229,14 +9473,14 @@ async function saveSnapshotData(dir, features, flows, removeFeatures = [], remov
   });
 }
 async function getImpact(dir, files) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { analyzeImpact: analyzeImpact2 } = await Promise.resolve().then(() => (init_impact(), impact_exports));
   const result = await analyzeImpact2(rootDir, files);
   return JSON.stringify(result, null, 2);
 }
 var VERIFY_DEFAULT_SAMPLE = 5;
 async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return JSON.stringify({
@@ -9289,7 +9533,7 @@ async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
   });
 }
 async function saveVerification(dir, verdicts) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   return updateSnapshot(rootDir, async (snapshot) => {
     if (!snapshot) {
       return { snapshot: null, result: JSON.stringify({ exists: false, stamped: [], hint: "No concept map exists. Build it and run verify_snapshot before recording verdicts." }) };
@@ -9363,16 +9607,16 @@ async function saveVerification(dir, verdicts) {
   });
 }
 async function saveDecision(dir, input) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { upsertDecision: upsertDecision2 } = await Promise.resolve().then(() => (init_decisions(), decisions_exports));
   const result = await upsertDecision2(rootDir, input);
   return JSON.stringify(result);
 }
 async function reviewDecision2(dir, input) {
-  return JSON.stringify(await reviewDecision(path34.resolve(dir), input));
+  return JSON.stringify(await reviewDecision(path36.resolve(dir), input));
 }
 async function getContext(dir, task, files) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { assembleContext: assembleContext2 } = await Promise.resolve().then(() => (init_assemble(), assemble_exports));
   const bundle = await assembleContext2(rootDir, task, files);
   return JSON.stringify(bundle);
@@ -9421,7 +9665,7 @@ async function masonInit(dir, options = {}) {
     return JSON.stringify(await setupProject2(dir, options), null, 2);
   }
   if (options.host) throw new Error("host applies only to mode: setup.");
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const marker = await loadProjectMarker(rootDir);
   const { loadSetup: loadSetup2 } = await Promise.resolve().then(() => (init_model(), model_exports));
   const setup = await loadSetup2(rootDir);
@@ -9441,7 +9685,7 @@ async function masonInit(dir, options = {}) {
   );
 }
 async function masonCompleteInit(dir, options = {}) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const existing = await loadProjectMarker(rootDir);
   const features = await loadProjectFeatures(rootDir);
   const marker = {
@@ -9550,7 +9794,7 @@ async function masonSetConfluence(input) {
   );
 }
 async function exportToConfluenceTool(dir, overrides) {
-  const rootDir = path34.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), config_exports2));
   const { exportToConfluence: exportToConfluence2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
   const config = await loadConfig2();
@@ -9589,7 +9833,7 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.18.0"
+      version: "0.19.1"
     },
     {
       instructions: (setupNotice ? setupNotice + "\n\n" : "") + 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, stale or unknown map verification needs a fresh review, recorded failed verdicts need correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'
@@ -9635,7 +9879,7 @@ function createMcpServer() {
   );
   server.tool(
     "review_advisory",
-    "Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals.",
+    "Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals. For dependency advisories, action dismiss with reasonCode and note records a one-step dismissal without a token or reviewer. no-dependency-claims reopens only on document content changes; unrelated-manifest-change also tracks scoped manifests.",
     { dir: z24.string().describe("Absolute path to the project root"), ...advisoryReviewRequest.shape },
     async ({ dir, ...request }) => ({ content: [{ type: "text", text: await masonReviewAdvisory(dir, request) }] })
   );
@@ -9970,14 +10214,592 @@ function createMcpServer() {
   );
   return server;
 }
-async function startMcpServer() {
+async function startMcpServer(onClose) {
   const server = createMcpServer();
+  if (onClose) server.server.onclose = onClose;
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
 
+// src/distribution/updates.ts
+init_store();
+init_storage();
+import fs33 from "fs/promises";
+import path42 from "path";
+import { spawn as spawn3 } from "child_process";
+import { randomUUID as randomUUID11 } from "crypto";
+import { z as z30 } from "zod";
+
+// src/distribution/state.ts
+init_storage();
+import os5 from "os";
+import path38 from "path";
+import { fileURLToPath } from "url";
+import fs28 from "fs/promises";
+import { z as z26 } from "zod";
+
+// src/distribution/path.ts
+import fs27 from "fs/promises";
+import os4 from "os";
+import path37 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
+import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
+import { z as z25 } from "zod";
+var execute2 = promisify12(execFile12);
+var pathChangeSchema = z25.discriminatedUnion("kind", [
+  z25.object({ kind: z25.literal("profile"), file: z25.string(), block: z25.string(), created: z25.boolean() }),
+  z25.object({ kind: z25.literal("windows"), entry: z25.string(), created: z25.boolean() })
+]);
+var quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+async function configurePath(bin, previous, save, options = {}) {
+  const env = options.env ?? process.env, platform = options.platform ?? process.platform;
+  const changes = [...previous];
+  const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path37.posix.isAbsolute(entry) && path37.posix.resolve(entry) === path37.posix.resolve(bin));
+  const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
+  const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
+  const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
+${alreadyOnPath ? "" : `Add ${bin} to your PATH.
+`}${setupHint}` });
+  if (env.MASON_NO_MODIFY_PATH === "1") return manual("Automatic PATH setup is disabled (MASON_NO_MODIFY_PATH=1).");
+  if (/[\r\n\0]/.test(bin) || bin.includes(platform === "win32" ? ";" : ":")) return manual("This installation path cannot be represented safely in PATH.");
+  try {
+    if (platform === "win32") {
+      const current = await windowsPath("read");
+      if (!hasWindowsEntry(current.value, bin)) {
+        if (!changes.some((c) => c.kind === "windows" && c.entry === bin)) {
+          changes.push({ kind: "windows", entry: bin, created: current.value === null });
+          await save(changes);
+        }
+        await windowsPath("add", bin, current);
+      }
+      return { status: "configured", changes, message: message2 };
+    }
+    const shell = path37.basename(env.SHELL ?? os4.userInfo().shell ?? "");
+    const userHome = options.userHome ?? os4.homedir();
+    let profiles2;
+    if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
+    if (env.MASON_PROFILE) profiles2 = [path37.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path37.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path37.join(userHome, ".profile")];
+    else {
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path37.join(userHome, name));
+      let login = candidates[2];
+      for (const file of candidates) if (await fs27.lstat(file).then(() => true, (error) => {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      })) {
+        login = file;
+        break;
+      }
+      profiles2 = [path37.join(userHome, ".bashrc"), login];
+    }
+    const marker = `# >>> mason PATH ${createHash7("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    for (const profile of profiles2) {
+      const stat = await fs27.lstat(profile).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      const file = stat?.isSymbolicLink() ? await fs27.realpath(profile) : path37.resolve(profile);
+      const original = await fs27.readFile(file).catch((error) => {
+        if (error.code === "ENOENT" && !stat) return null;
+        throw error;
+      });
+      if (original && !Buffer.from(original.toString("utf8")).equals(original)) return manual(`Shell profile is not UTF-8: ${profile}.`);
+      const text2 = original?.toString("utf8") ?? "";
+      const owned = changes.find((c) => c.kind === "profile" && c.file === file);
+      if (owned && text2.includes(owned.block)) continue;
+      if (text2.includes(marker) || owned && text2.includes("# <<< mason PATH")) return manual(`Mason's PATH block was edited; retained ${profile}.`);
+      const newline = text2.includes("\r\n") ? "\r\n" : "\n";
+      const block = owned?.block ?? ("\n" + marker + '\ncase ":${PATH-}:" in\n  *:' + quote(bin) + ":*) ;;\n  *) export PATH=" + quote(bin) + ':"${PATH-}" ;;\nesac\n# <<< mason PATH <<<\n').replaceAll("\n", newline);
+      if (!owned) {
+        changes.push({ kind: "profile", file, block, created: original === null });
+        await save(changes);
+      }
+      await fs27.mkdir(path37.dirname(file), { recursive: true });
+      const handle = await fs27.open(file, original === null ? "ax+" : "a+", 384);
+      try {
+        if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
+        await handle.writeFile(block);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+    }
+    return { status: "configured", changes, message: message2 };
+  } catch (error) {
+    return manual(`Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+var normalizeWindowsEntry = (value) => path37.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+var hasWindowsEntry = (value, entry, env = process.env) => {
+  const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
+  const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
+  return (value ?? "").split(";").some((part) => normalizeWindowsEntry(expand(part)) === normalizeWindowsEntry(entry));
+};
+async function windowsPath(action, entry = "", expected, removeEmpty = false) {
+  const payload = Buffer.from(JSON.stringify({ action, entry, expected, removeEmpty })).toString("base64");
+  const script = `$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+$p = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${payload}')) | ConvertFrom-Json
+$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+try {
+  $value = $key.GetValue('Path', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+  $kind = if ($null -eq $value) { $null } else { $key.GetValueKind('Path').ToString() }
+  if ($null -ne $kind -and $kind -notin @('String','ExpandString')) { throw 'User PATH is not a string.' }
+  if ($p.action -eq 'read') { @{ value = $value; kind = $kind } | ConvertTo-Json -Compress; exit 0 }
+  if ($p.expected -and ($value -cne $p.expected.value -or $kind -cne $p.expected.kind)) { throw 'User PATH changed concurrently; retry the operation.' }
+  $parts = if ($null -eq $value -or $value -eq '') { @() } else { @($value.Split(';')) }
+  if ($p.action -eq 'add') { $next = (@($p.entry) + $parts) -join ';' }
+  else { $next = (@($parts | Where-Object { $_ -cne $p.entry })) -join ';' }
+  if ($next -cne $value) {
+    $writeKind = if ($kind) { [Microsoft.Win32.RegistryValueKind]$kind } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }
+    if ($p.action -eq 'remove' -and $p.removeEmpty -and $next -eq '') { $key.DeleteValue('Path', $false) }
+    else { $key.SetValue('Path', $next, $writeKind) }
+    Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class MasonEnvironment { [DllImport("user32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern IntPtr SendMessageTimeout(IntPtr h, uint m, UIntPtr w, string l, uint f, uint t, out UIntPtr r); }'
+    $result = [UIntPtr]::Zero
+    [void][MasonEnvironment]::SendMessageTimeout([IntPtr]0xffff, 0x1a, [UIntPtr]::Zero, 'Environment', 2, 1000, [ref]$result)
+  }
+  @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
+} finally { $key.Dispose() }
+`;
+  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
+}
+
+// src/distribution/state.ts
+var releaseVersion = z26.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+var bundleId = z26.string().regex(/^[a-f0-9]{24}$/);
+var updatePolicySchema = z26.object({
+  enabled: z26.boolean(),
+  revision: z26.string(),
+  pinnedVersion: releaseVersion.optional(),
+  mirror: z26.string().optional()
+});
+var recordSchema3 = z26.object({
+  format: z26.literal(1),
+  home: z26.string(),
+  bin: z26.string(),
+  current: bundleId,
+  version: releaseVersion,
+  launchers: z26.record(z26.string()),
+  previousLaunchers: z26.record(z26.string()).optional(),
+  pathChanges: z26.array(pathChangeSchema).optional(),
+  updates: updatePolicySchema.optional(),
+  previous: z26.object({ id: bundleId, version: releaseVersion }).optional(),
+  pending: z26.object({ id: bundleId, version: releaseVersion, policyRevision: z26.string() }).optional()
+});
+async function readInstallation(home) {
+  const raw = await readStoreJson(home, "install.json");
+  if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const record = recordSchema3.parse(raw);
+  if (record.home !== await fs28.realpath(home)) throw new Error("Invalid standalone installation receipt.");
+  return record;
+}
+function standaloneLocation() {
+  const bundle = path38.resolve(path38.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path38.dirname(path38.dirname(bundle));
+  if (path38.dirname(bundle) !== path38.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path38.basename(bundle))) {
+    return null;
+  }
+  return { home, bundle };
+}
+async function currentInstallation() {
+  const location2 = standaloneLocation();
+  if (!location2) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
+  const { home, bundle } = location2;
+  const record = await readInstallation(home);
+  return { home, bundle, record };
+}
+function automaticUpdatesAllowed(record, env = process.env) {
+  return record.updates?.enabled === true && !record.updates.pinnedVersion && !record.updates.mirror && !env.CI && env.MASON_NO_AUTO_UPDATE !== "1" && !env.MASON_RELEASE_BASE && !env.MASON_VERSION;
+}
+function newerStableVersion(candidate, installed) {
+  if (!/^\d+\.\d+\.\d+$/.test(candidate)) return false;
+  const a = candidate.split(".").map(BigInt), b = installed.split("-")[0].split(".").map(BigInt);
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return installed.includes("-");
+}
+
+// src/distribution/bundle.ts
+init_storage();
+import fs29 from "fs/promises";
+import path39 from "path";
+import { createHash as createHash8 } from "crypto";
+import { z as z27 } from "zod";
+var targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+var digest2 = z27.string().regex(/^[a-f0-9]{64}$/);
+var bundleSchema = z27.object({
+  format: z27.literal(1),
+  version: z27.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+  target: z27.enum(targets),
+  nodeVersion: z27.string(),
+  files: z27.record(digest2)
+}).strict();
+var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex");
+async function readBundle(root) {
+  const bytes = await fs29.readFile(await storePath(root, "bundle.json"));
+  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
+  const windows = manifest.target.startsWith("win32-");
+  for (const file of Object.keys(manifest.files)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path39.isAbsolute(file)) {
+      throw new Error("Unsafe path in Mason bundle: " + file);
+    }
+  }
+  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
+    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  }
+  return { manifest, manifestHash: sha256(bytes) };
+}
+async function verifyBundle(root, expectedHash) {
+  const bundle = await readBundle(root);
+  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
+  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
+  const files = Object.keys(bundle.manifest.files);
+  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
+    if (sha256(await fs29.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+  }));
+  return bundle;
+}
+
+// src/distribution/runtime.ts
+init_store();
+init_storage();
+import fs30 from "fs/promises";
+import { unlinkSync } from "fs";
+import os6 from "os";
+import path40 from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+import { z as z28 } from "zod";
+var leaseSchema = z28.object({ pid: z28.number().int().positive(), host: z28.string(), bundle: z28.string().regex(/^[a-f0-9]{24}$/) });
+
+// src/distribution/install.ts
+import fs32 from "fs/promises";
+import os8 from "os";
+import path41 from "path";
+import { execFile as execFile13, spawn as spawn2 } from "child_process";
+import { promisify as promisify13 } from "util";
+import { randomUUID as randomUUID10 } from "crypto";
+init_storage();
+init_store();
+
+// src/distribution/sessions.ts
+init_storage();
+import fs31 from "fs/promises";
+import os7 from "os";
+import { randomUUID as randomUUID9 } from "crypto";
+import { z as z29 } from "zod";
+var leaseSchema2 = z29.object({ pid: z29.number().int().positive(), host: z29.string() });
+async function hasRunningMcp(home) {
+  const directory = await storePath(home, "sessions");
+  const files = await fs31.readdir(directory).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  for (const name of files) {
+    if (!/^[a-f0-9-]+\.json$/.test(name)) return true;
+    const relative = "sessions/" + name;
+    try {
+      const raw = await readStoreJson(home, relative);
+      if (raw === null) continue;
+      const lease = leaseSchema2.parse(raw);
+      if (lease.host !== os7.hostname()) return true;
+      try {
+        process.kill(lease.pid, 0);
+        return true;
+      } catch (error) {
+        if (error.code !== "ESRCH") return true;
+      }
+      await fs31.rm(await storePath(home, relative), { force: true });
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+async function registerMcp(home) {
+  const name = `sessions/${randomUUID9()}.json`;
+  await writeStoreJson(home, name, { pid: process.pid, host: os7.hostname() });
+  return async () => {
+    await fs31.rm(await storePath(home, name), { force: true }).catch(() => {
+    });
+  };
+}
+
+// src/distribution/install.ts
+var shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+var psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
+var WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
+var launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
+async function replace(file, content2, mode = 384) {
+  const temp = file + ".tmp-" + randomUUID10();
+  try {
+    await fs32.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs32.rename(temp, file);
+  } finally {
+    await fs32.rm(temp, { force: true });
+  }
+}
+function assertUpdatePolicy(record, version, revision) {
+  if (!record || !automaticUpdatesAllowed(record, { ...process.env, MASON_VERSION: "" }) || record.updates?.revision !== revision || !newerStableVersion(version, record.version)) {
+    throw new Error("Update policy or installed version changed; download was not activated.");
+  }
+}
+async function installLocked2(home, source, bundle, progress, options, alreadyStaged = false) {
+  const raw = await readStoreJson(home, "install.json");
+  const previous = raw === null ? null : recordSchema3.parse(raw);
+  if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
+  if (!previous) for (const file of await fs32.readdir(home)) {
+    if (file === ".install-lock") continue;
+    const directory = path41.join(home, file);
+    const stat = await fs32.lstat(directory);
+    if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs32.readdir(directory)).length) {
+      throw new Error("Mason installation directory is not empty and has no ownership receipt.");
+    }
+  }
+  const selectedBin = path41.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path41.join(home, "bin") : path41.join(os8.homedir(), ".local/bin")));
+  await fs32.mkdir(selectedBin, { recursive: true });
+  const bin = await fs32.realpath(selectedBin);
+  if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
+  const id = bundle.manifestHash.slice(0, 24);
+  const destination = await storePath(home, "versions/" + id);
+  if (options.stageOnly) {
+    const receipt2 = { ...previous, pending: { id, version: bundle.manifest.version, policyRevision: options.policyRevision } };
+    await writeStoreJson(home, "install.json", receipt2);
+    return { home, bin, version: bundle.manifest.version, previousVersion: previous.version, path: { message: "Update staged for a future MCP launch." } };
+  }
+  const launchers = process.platform === "win32" ? {
+    "mason.cmd": WINDOWS_BATCH_LAUNCHER,
+    "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
+$previousToken = $env:MASON_UNINSTALL_TOKEN
+$token = [Guid]::NewGuid().ToString()
+$env:MASON_UNINSTALL_TOKEN = $token
+try {
+  & ${psQuote(path41.join(destination, "node.exe"))} ${psQuote(path41.join(destination, "app/dist/mason.js"))} @args
+  $code = $LASTEXITCODE
+  if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
+    if ([IO.File]::ReadAllText(${psQuote(path41.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
+    Write-Output ${psQuote("Removed standalone installation: " + home)}
+  }
+  exit $code
+} catch { [Console]::Error.WriteLine($_.Exception.Message); exit 2 }
+finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
+`
+  } : { mason: `#!/bin/sh
+exec ${shQuote(path41.join(destination, "node"))} ${shQuote(path41.join(destination, "app/dist/mason.js"))} "$@"
+` };
+  for (const [name, content2] of Object.entries(launchers)) {
+    const file = await storePath(bin, name);
+    const old = await fs32.readFile(file, "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
+  }
+  const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
+  const checkRetired = async (name, expected) => {
+    if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
+    const actual = await fs32.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
+  };
+  for (const [name, expected] of retired) await checkRetired(name, expected);
+  progress?.step(`Installing Mason ${bundle.manifest.version}`);
+  const updates = options.preservePolicy && previous?.updates ? { ...previous.updates } : {
+    ...previous?.updates ?? { enabled: !previous && !process.env.CI && process.env.MASON_NO_AUTO_UPDATE !== "1" },
+    revision: randomUUID10(),
+    pinnedVersion: process.env.MASON_VERSION?.replace(/^v/, "") || void 0,
+    mirror: process.env.MASON_RELEASE_BASE || previous?.updates?.mirror
+  };
+  if (options.rollback) {
+    updates.pinnedVersion = bundle.manifest.version;
+    updates.revision = randomUUID10();
+  }
+  const receipt = {
+    format: 1,
+    home,
+    bin,
+    current: id,
+    version: bundle.manifest.version,
+    launchers,
+    pathChanges: previous?.pathChanges ?? [],
+    updates,
+    previous: previous && previous.current !== id ? { id: previous.current, version: previous.version } : previous?.previous
+  };
+  await writeStoreJson(home, "install.json", previous ? { ...previous, previousLaunchers: launchers } : receipt);
+  try {
+    if (!alreadyStaged) await copyBundle(home, source, destination, bundle);
+    for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
+    for (const [name, expected] of retired) {
+      await checkRetired(name, expected);
+      await fs32.rm(await storePath(bin, name), { force: true });
+    }
+    await writeStoreJson(home, "install.json", receipt);
+  } catch (error) {
+    if (previous) {
+      for (const [name, content2] of Object.entries(previous.launchers)) await replace(await storePath(bin, name, true), content2, 493);
+      await writeStoreJson(home, "install.json", previous);
+    }
+    throw error;
+  }
+  if (options.preservePolicy) return { home, bin, version: receipt.version, previousVersion: previous?.version, path: { message: "Installation selected." } };
+  progress?.step("Checking terminal command availability");
+  const pathResult = await configurePath(bin, receipt.pathChanges ?? [], async (changes) => {
+    receipt.pathChanges = changes;
+    await writeStoreJson(home, "install.json", receipt);
+  });
+  return { home, bin, version: bundle.manifest.version, previousVersion: previous?.version, path: pathResult };
+}
+async function copyBundle(home, source, destination, bundle) {
+  const exists = await fs32.lstat(destination).then(() => true, (error) => {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  });
+  if (exists) {
+    await verifyBundle(destination, bundle.manifestHash);
+    return;
+  }
+  const stage = await storePath(home, "versions/.install-" + randomUUID10(), true);
+  await fs32.mkdir(stage);
+  try {
+    for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
+      const from = await storePath(source, file), to = await storePath(stage, file, true);
+      await fs32.copyFile(from, to);
+      await fs32.chmod(to, (await fs32.stat(from)).mode & 511);
+    }
+    await verifyBundle(stage, bundle.manifestHash);
+    try {
+      await fs32.rename(stage, destination);
+    } catch (error) {
+      try {
+        await verifyBundle(destination, bundle.manifestHash);
+      } catch {
+        throw error;
+      }
+    }
+  } finally {
+    await fs32.rm(stage, { recursive: true, force: true });
+  }
+}
+async function prepareStandaloneMcp(home) {
+  const before = await readInstallation(home), candidate = before.pending;
+  let verified, verificationError;
+  if (candidate && automaticUpdatesAllowed(before) && !await hasRunningMcp(home)) {
+    try {
+      verified = await verifyBundle(await storePath(home, "versions/" + candidate.id));
+      if (verified.manifestHash.slice(0, 24) !== candidate.id || verified.manifest.version !== candidate.version) throw new Error("Staged update changed.");
+    } catch (error) {
+      verificationError = error;
+    }
+  }
+  return withLock(home, ".install-lock", async () => {
+    let record = await readInstallation(home);
+    const pending = record.pending;
+    if (pending && candidate?.id === pending.id && (verified || verificationError) && automaticUpdatesAllowed(record) && pending.policyRevision === record.updates?.revision && newerStableVersion(pending.version, record.version) && !await hasRunningMcp(home)) {
+      try {
+        if (verificationError) throw verificationError;
+        const source = await storePath(home, "versions/" + pending.id);
+        await installLocked2(home, source, verified, void 0, { preservePolicy: true }, true);
+        record = await readInstallation(home);
+      } catch (error) {
+        record = await readInstallation(home);
+        delete record.pending;
+        await writeStoreJson(home, "install.json", record);
+        await writeStoreJson(home, "update-status.json", { lastAttempt: Date.now(), error: String(error) });
+      }
+    }
+    const release = await registerMcp(home);
+    return { bundle: await storePath(home, "versions/" + record.current), release };
+  });
+}
+
+// src/distribution/updates.ts
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
+var releaseListSchema = z30.array(z30.object({ tag_name: z30.string(), draft: z30.boolean(), prerelease: z30.boolean(), published_at: z30.string().nullable() }));
+var updateManifestSchema = z30.object({
+  format: z30.literal(1),
+  version: z30.string().regex(/^\d+\.\d+\.\d+$/),
+  publishedAt: z30.string().datetime(),
+  assets: z30.record(z30.string().regex(/^[a-f0-9]{64}$/))
+}).strict();
+var statusSchema2 = z30.object({ lastAttempt: z30.number(), availableVersion: z30.string().optional(), error: z30.string().optional() });
+async function scheduleAutomaticUpdate() {
+  try {
+    const { home, record } = await currentInstallation();
+    if (!automaticUpdatesAllowed(record)) return;
+    const status = statusSchema2.safeParse(await readStoreJson(home, "update-status.json"));
+    const now = Date.now();
+    if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
+    const bundle = await storePath(home, "versions/" + record.current);
+    const child = spawn3(
+      path42.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path42.join(bundle, "app/dist/mason.js"), "internal-update"],
+      { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
+    );
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function startMcpWithUpdates(start) {
+  const current = standaloneLocation();
+  if (!current) {
+    await start();
+    return;
+  }
+  const session = await prepareStandaloneMcp(current.home);
+  if (session.bundle !== current.bundle) {
+    const child = spawn3(
+      path42.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path42.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      { stdio: "inherit", windowsHide: true }
+    );
+    const interrupt = () => {
+      child.kill("SIGINT");
+    }, terminate = () => {
+      child.kill("SIGTERM");
+    };
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    try {
+      process.exitCode = await new Promise((resolve2, reject) => {
+        child.on("error", reject);
+        child.on("exit", (code) => resolve2(code ?? 1));
+      });
+    } finally {
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+      await session.release();
+    }
+    return;
+  }
+  const timer = setInterval(() => {
+    void scheduleAutomaticUpdate();
+  }, 60 * 60 * 1e3);
+  timer.unref();
+  const stop = () => {
+    clearInterval(timer);
+    void session?.release();
+  };
+  try {
+    await start(stop);
+    void scheduleAutomaticUpdate();
+  } catch (error) {
+    stop();
+    throw error;
+  }
+}
+
 // bin/mason-mcp.ts
-startMcpServer().catch((err) => {
+startMcpWithUpdates(startMcpServer).catch((err) => {
   process.stderr.write(`Mason MCP server error: ${err}
 `);
   process.exit(1);