mason-context 0.19.0 → 0.19.1

package/dist/mason-mcp.js

@@ -58,874 +58,941 @@ var init_git_read = __esm({
   }
 });
 
-// src/audit/commands.ts
+// src/utils/paths.ts
 import path from "path";
-function splitCommands(line) {
-  const parts = [];
-  let quote2 = "", start = 0;
-  for (let i = 0; i < line.length; i++) {
-    const char = line[i];
-    if (char === "\\") {
-      i++;
-      continue;
-    }
-    if (quote2) {
-      if (char === quote2) quote2 = "";
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      quote2 = char;
-      continue;
-    }
-    if (char === ";" || line.slice(i, i + 2) === "&&") {
-      parts.push(line.slice(start, i));
-      if (char === "&") i++;
-      start = i + 1;
-    }
-  }
-  parts.push(line.slice(start));
-  return parts;
-}
-function commandClaims(line, lineNo, cwd, shell = false) {
-  const claims = [];
-  const segments = splitCommands(line);
-  for (const segment of segments) {
-    const text2 = segment.trim().replace(/^\$\s+/, "");
-    if (text2.startsWith("#") || /^(?:echo|printf)\b/.test(text2)) continue;
-    const cd = text2.match(/^cd\s+(.+)$/);
-    if (cd) {
-      const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path.posix.join(cwd ?? ".", directory);
-      continue;
-    }
-    for (const match of text2.matchAll(COMMAND)) {
-      const flags = match[2].trim();
-      const selector = flags.match(/^(?:--prefix|--dir|-C)(?:\s+|=)(.+)$/);
-      let directory = cwd;
-      let scopeUnknown;
-      if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
-      if (selector) {
-        const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path.posix.join(cwd ?? ".", selected);
-      } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
-      const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
-      if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
-        scopeUnknown = "Package selection or conditional options after the script need review.";
-      }
-      if (/[|()]/.test(text2) || /\b(?:pushd|popd|if|for|while)\b/.test(text2) || directory === null) {
-        scopeUnknown = "The command's working directory or shell control flow could not be resolved.";
-      }
-      claims.push({
-        scriptName: match[3],
-        invocation: match[0],
-        excerpt: match[0],
-        line: lineNo,
-        ...directory !== void 0 && directory !== null ? { directory } : {},
-        ...scopeUnknown ? { scopeUnknown } : {}
-      });
-    }
-    if (/\b(?:cd|pushd|popd)\b/.test(text2)) cwd = null;
-  }
-  return { claims, cwd };
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
 }
-var TOKEN, COMMAND, literal;
-var init_commands = __esm({
-  "src/audit/commands.ts"() {
-    "use strict";
-    TOKEN = `(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s\`;&|]+)`;
-    COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
-    literal = (value) => {
-      const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path.posix.isAbsolute(unquoted) ? null : unquoted;
-    };
-  }
-});
-
-// src/audit/tree.ts
-function glyphIndex(line) {
-  for (const glyph of GLYPHS) {
-    const idx = line.indexOf(glyph);
-    if (idx !== -1) return idx;
-  }
-  return -1;
+function sanitizeRepoPaths(files) {
+  return [...new Set(files.map(normalizeRepoPath).filter((p) => p !== null))];
 }
-function isSpacerLine(line) {
-  return /^[\s│|]*$/.test(line);
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
-function entryName(afterGlyph) {
-  let name = afterGlyph.replace(/^\s+/, "");
-  const hash2 = name.search(/\s+#/);
-  if (hash2 !== -1) name = name.slice(0, hash2);
-  const columns = name.search(/\s{2,}/);
-  if (columns !== -1) name = name.slice(0, columns);
-  name = name.trim();
-  if (!name || /\s/.test(name)) return null;
-  return name;
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
 }
-function extractTreeClaims(blockLines, blockStartLine) {
-  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
-  if (glyphLines < MIN_GLYPH_LINES) return [];
-  const claims = [];
-  const stack = [];
-  let rootPrefix = "";
-  let started = false;
-  for (let i = 0; i < blockLines.length; i++) {
-    const line = blockLines[i];
-    const col = glyphIndex(line);
-    if (col === -1) {
-      if (isSpacerLine(line)) continue;
-      if (!started) {
-        const candidate = line.trim();
-        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
-          rootPrefix = candidate.replace(/\/+$/, "");
-          claims.push({
-            path: rootPrefix,
-            line: blockStartLine + i,
-            excerpt: candidate
-          });
-        }
-        continue;
-      }
-      return claims;
-    }
-    started = true;
-    const name = entryName(line.slice(col + GLYPHS[0].length));
-    if (name === null) return claims;
-    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
-      stack.pop();
-    }
-    const isDir = name.endsWith("/");
-    const cleanName = name.replace(/\/+$/, "");
-    const segments = [
-      ...rootPrefix ? [rootPrefix] : [],
-      ...stack.map((s) => s.name),
-      cleanName
-    ];
-    claims.push({
-      path: segments.join("/"),
-      line: blockStartLine + i,
-      excerpt: name
-    });
-    if (isDir) stack.push({ col, name: cleanName });
-  }
-  return claims;
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
 }
-var MIN_GLYPH_LINES, GLYPHS;
-var init_tree = __esm({
-  "src/audit/tree.ts"() {
+var init_paths = __esm({
+  "src/utils/paths.ts"() {
     "use strict";
-    MIN_GLYPH_LINES = 3;
-    GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
   }
 });
 
-// src/audit/claims.ts
-import MarkdownIt from "markdown-it";
-function normalizePathToken(token) {
-  let t = token.trim();
-  if (!t) return null;
-  if (/\s/.test(t)) return null;
-  if (t.includes("://") || t.includes("\\")) return null;
-  if (/[*?[\]{}<>$`]/.test(t)) return null;
-  if (t.startsWith("/") || t.startsWith("~") || t.startsWith("./") || t.startsWith("../")) {
-    return null;
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
   }
-  t = t.replace(/:\d+(?:-\d+)?$/, "");
-  if (t.includes(":")) return null;
-  const normalized = t.replace(/\/+$/, "");
-  if (!normalized) return null;
-  if (normalized.split("/").some((seg) => /^\.+$/.test(seg))) return null;
-  if (normalized.includes("/")) return normalized;
-  return ROOT_FILE_NAMES.has(normalized) ? normalized : null;
-}
-function exactTokenPath(line) {
-  const trimmed = line.trim();
-  if (!trimmed || /\s/.test(trimmed) || !trimmed.includes("/")) return null;
-  return normalizePathToken(trimmed);
+});
+
+// src/utils/files.ts
+import fs from "fs/promises";
+import { constants } from "fs";
+import path2 from "path";
+import fg from "fast-glob";
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
 }
-function computeIgnoredLines(lines) {
-  const ignored = new Array(lines.length).fill(false);
-  let inRegion = false;
-  let ignoreNext = false;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line.includes(IGNORE_START)) {
-      inRegion = true;
-      ignored[i] = true;
-      continue;
-    }
-    if (line.includes(IGNORE_END)) {
-      inRegion = false;
-      ignored[i] = true;
-      continue;
-    }
-    if (inRegion) {
-      ignored[i] = true;
-      continue;
-    }
-    if (ignoreNext) {
-      if (line.trim().length === 0) continue;
-      ignored[i] = true;
-      ignoreNext = false;
-      continue;
-    }
-    if (line.includes(IGNORE_LINE)) {
-      ignored[i] = true;
-      const rest = line.replace(IGNORE_LINE, "").trim();
-      if (rest.length === 0) ignoreNext = true;
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
     }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
   }
-  return ignored;
 }
-function extractClaims(content2) {
-  const lines = content2.split("\n");
-  const ignored = computeIgnoredLines(lines);
-  const paths = /* @__PURE__ */ new Map();
-  const counts = [];
-  const commands2 = /* @__PURE__ */ new Map();
-  const addPath = (claim) => {
-    const key = [claim.relativeTo ?? "scope", claim.path].join(":");
-    if (!paths.has(key)) paths.set(key, claim);
-  };
-  const addCommand = (claim) => {
-    const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
-    if (!commands2.has(key)) commands2.set(key, claim);
-  };
-  const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
-  for (const token of parsed) {
-    if (token.type !== "inline" || !token.map) continue;
-    let line = token.map[0] + 1;
-    for (const child of token.children ?? []) {
-      const target = child.type === "link_open" ? child.attrGet("href") : child.type === "image" ? child.attrGet("src") : null;
-      if (target && !/^(?:[a-z][a-z0-9+.-]*:|[\/#~])/i.test(target)) {
-        let pathname = null;
-        try {
-          pathname = decodeURIComponent(target.split(/[?#]/)[0]);
-        } catch {
-        }
-        if (pathname && !/[$*?{}<>\\\x00-\x1f]/.test(pathname)) {
-          addPath({ path: pathname, line, excerpt: target, relativeTo: "document" });
-        }
-      }
-      if (child.type === "softbreak" || child.type === "hardbreak") line++;
-      else line += child.content.split("\n").length - 1;
-    }
-  }
-  let shellCwd;
-  let inFence = false;
-  let fenceInfo = "";
-  let fenceMarker = "";
-  let blockLines = [];
-  let blockStartLine = 0;
-  const processBlock = () => {
-    for (const claim of extractTreeClaims(blockLines, blockStartLine)) {
-      addPath(claim);
-    }
-    for (let i = 0; i < blockLines.length; i++) {
-      const exact = exactTokenPath(blockLines[i]);
-      if (exact) {
-        addPath({
-          path: exact,
-          line: blockStartLine + i,
-          excerpt: blockLines[i].trim()
-        });
-      }
-    }
-  };
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    const lineNo = i + 1;
-    const fenceMatch = line.match(/^\s*(```+|~~~+)(.*)$/);
-    if (fenceMatch) {
-      if (!inFence) {
-        inFence = true;
-        fenceMarker = fenceMatch[1][0];
-        fenceInfo = fenceMatch[2].trim().toLowerCase();
-        blockLines = [];
-        shellCwd = void 0;
-        blockStartLine = lineNo + 1;
-      } else if (fenceMatch[1][0] === fenceMarker) {
-        inFence = false;
-        processBlock();
-      }
-      continue;
-    }
-    if (inFence) {
-      blockLines.push(ignored[i] ? "" : line);
-      if (!ignored[i] && SHELL_FENCE_INFOS.has(fenceInfo)) {
-        const scanned = commandClaims(line, lineNo, shellCwd, true);
-        shellCwd = scanned.cwd;
-        for (const claim of scanned.claims) addCommand(claim);
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath2 = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath2, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
       }
-      continue;
+      config[key] = value[key];
     }
-    if (ignored[i]) continue;
-    for (const m of line.matchAll(/`([^`]+)`/g)) {
-      const normalized = normalizePathToken(m[1]);
-      if (normalized) {
-        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
+          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
       }
     }
-    for (const m of line.matchAll(/"([A-Za-z][\w.@-]*(?:\/[\w.@-]+)+\/?)"/g)) {
-      const normalized = normalizePathToken(m[1]);
-      if (normalized) {
-        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
-      }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
     }
-    for (const m of line.matchAll(COUNT_RE)) {
-      const rest = line.slice((m.index ?? 0) + m[0].length);
-      if (COUNT_DENYLIST_RE.test(rest)) continue;
-      counts.push({
-        count: Number.parseInt(m[1], 10),
-        unit: m[2].toLowerCase(),
-        line: lineNo,
-        excerpt: m[0]
-      });
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve2(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
     }
-    for (const match of line.matchAll(/`([^`]+)`/g)) {
-      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims) addCommand(claim);
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve2(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve2(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
+    } catch {
+      return null;
     }
-    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims) addCommand(claim);
   }
-  if (inFence) processBlock();
-  return {
-    paths: [...paths.values()],
-    counts,
-    commands: [...commands2.values()]
-  };
+  return { root, config, list, read };
 }
-var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
-var init_claims = __esm({
-  "src/audit/claims.ts"() {
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var init_files = __esm({
+  "src/utils/files.ts"() {
     "use strict";
-    init_commands();
-    init_tree();
-    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
-      "package.json",
-      "package-lock.json",
-      "pnpm-workspace.yaml",
-      "tsconfig.json",
-      "tsup.config.ts",
-      "vitest.config.ts",
-      "Makefile",
-      "Dockerfile",
-      "docker-compose.yml",
-      "Cargo.toml",
-      "go.mod",
-      "go.sum",
-      "pyproject.toml",
-      "requirements.txt",
-      "Gemfile",
-      "composer.json",
-      "settings.gradle.kts",
-      "settings.gradle",
-      "build.gradle.kts",
-      "build.gradle",
-      "manifest.json",
-      "server.json",
-      "README.md",
-      "CHANGELOG.md",
-      "LICENSE",
-      "CLAUDE.md",
-      "AGENTS.md",
-      ".gitignore",
-      ".env.example"
-    ]);
-    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
-    markdown = new MarkdownIt("commonmark", { html: false });
-    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
-    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
-    IGNORE_LINE = "<!-- mason:ignore -->";
-    IGNORE_START = "<!-- mason:ignore-start -->";
-    IGNORE_END = "<!-- mason:ignore-end -->";
+    init_git_read();
+    init_paths();
+    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+    SOURCE_IGNORE = [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.gradle/**",
+      "**/target/**",
+      "**/.git/**",
+      "**/.mason/**",
+      "**/vendor/**",
+      "**/__pycache__/**",
+      "**/venv/**",
+      "**/.venv/**",
+      "**/*.min.*",
+      "**/*.map",
+      "**/*.lock",
+      "**/generated/**",
+      "**/*.generated.*",
+      "**/R.java",
+      "**/BuildConfig.java",
+      "**/package-lock.json",
+      "**/yarn.lock",
+      "**/pnpm-lock.yaml"
+    ];
+    MAX_SOURCE_BYTES = 1024 * 1024;
   }
 });
 
-// src/utils/paths.ts
-import path2 from "path";
-function normalizeRepoPath(value) {
-  const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path2.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
-  if (slash.split("/").includes("..")) return null;
-  const normalized = path2.posix.normalize(slash).replace(/\/$/, "");
-  return normalized === "." ? null : normalized;
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
 }
-function sanitizeRepoPaths(files) {
-  return [...new Set(files.map(normalizeRepoPath).filter((p) => p !== null))];
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
 }
-function isWithinRoot(root, candidate) {
-  const relative = path2.relative(root, candidate);
-  return relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
+async function writeStoreJson(root, relative, value) {
+  const payload = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
+    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
+  }
+  const file = await storePath(root, relative, true);
+  const temporary = path3.join(path3.dirname(file), `.${path3.basename(file)}.${randomUUID()}.tmp`);
+  try {
+    const handle = await fs2.open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(payload, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fs2.rename(temporary, file);
+  } finally {
+    await fs2.rm(temporary, { force: true });
+  }
 }
-function anchorMatches(anchor, file) {
-  const a = normalizeRepoPath(anchor);
-  const f = normalizeRepoPath(file);
-  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+var init_storage = __esm({
+  "src/utils/storage.ts"() {
+    "use strict";
+    init_paths();
+    init_files();
+  }
+});
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path4 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
 }
-function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+async function auditGitPaths(root, kind) {
+  const custom = (await loadProjectConfig(root)).audit?.include ?? [];
+  const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
+  const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
+  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
+  const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
 }
-var init_paths = __esm({
-  "src/utils/paths.ts"() {
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
     "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
   }
 });
 
-// src/utils/files.ts
-import fs from "fs/promises";
-import { constants } from "fs";
-import path3 from "path";
-import fg from "fast-glob";
-function isSensitiveFile(file) {
-  return file.split(/[\\/]/).some(
-    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
-  );
-}
-async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+// src/audit/inputs.ts
+import fs3 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import fg3 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs3.realpath(root);
   try {
-    const stat = await handle.stat();
-    if (!stat.isFile() || stat.size > maxBytes) return null;
-    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
-    let bytes = 0;
-    while (bytes < buffer.length) {
-      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
-      if (result.bytesRead === 0) break;
-      bytes += result.bytesRead;
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
     }
-    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
-  } finally {
-    await handle.close();
+    throw error;
   }
 }
-async function loadProjectConfig(root) {
+async function readAuditInput(root, file) {
   try {
-    const canonicalRoot = await fs.realpath(root);
-    const configPath2 = await fs.realpath(path3.join(root, ".mason/config.json"));
-    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
-    const raw = await readBoundedFile(configPath2, 64 * 1024);
-    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
-    const value = JSON.parse(raw);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
-    const config = {};
-    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
-      if (value[key] === void 0) continue;
-      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
-        throw new Error(`Configuration ${key} must be an array of strings`);
-      }
-      config[key] = value[key];
-    }
-    return config;
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
   } catch (error) {
-    if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
+    throw error;
   }
 }
-async function createFileAccess(rootDir) {
-  const root = path3.resolve(rootDir);
-  const canonicalRoot = await fs.realpath(root).catch(() => root);
-  const config = await loadProjectConfig(root);
-  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
-  let gitFiles = null;
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg3.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
   try {
-    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
-    gitFiles = new Set(stdout.split("\0").filter(Boolean));
-  } catch {
-    let inGit = false;
-    try {
-      await execGit(["rev-parse", "--git-dir"], { cwd: root });
-      inGit = true;
-    } catch {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
+      }
     }
-    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  } finally {
+    stream.destroy();
   }
-  async function resolve2(file) {
-    const relative = normalizeRepoPath(file);
-    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
-    const candidate = path3.join(root, relative);
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  return auditGitPaths(root, "sources");
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
     try {
-      const real = await fs.realpath(candidate);
-      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path3.relative(canonicalRoot, real))) return null;
-      const stat = await fs.stat(real);
-      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
-      if (gitFiles && !gitFiles.has(path3.relative(canonicalRoot, real).split(path3.sep).join("/"))) return null;
-      return real;
-    } catch {
-      return null;
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
     }
   }
-  async function list(patterns = SOURCE_GLOB, options = {}) {
-    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
-    const safe = await Promise.all(found.map(async (f) => await resolve2(f) ? f : null));
-    return safe.filter((f) => f !== null).sort();
+  return ignored;
+}
+var MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    init_git_read();
+    init_inspection();
+    MAX_INPUTS = 1e5;
   }
-  async function read(file) {
-    const relative = normalizeRepoPath(file);
-    if (!relative) return null;
-    const real = await resolve2(relative);
-    if (!real) return null;
-    for (const rel of /* @__PURE__ */ new Set([relative, path3.relative(canonicalRoot, real).split(path3.sep).join("/")])) {
-      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+});
+
+// src/audit/policy.ts
+import fg4 from "fast-glob";
+async function includedCheckPaths(root, paths, exclude) {
+  if (!exclude.length) return new Set(paths);
+  const included = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < paths.length; offset += 256) {
+    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
+      ignore: exclude,
+      followSymbolicLinks: false,
+      label: "Audit check exclusions"
+    })) included.add(file);
+  }
+  return included;
+}
+var init_policy = __esm({
+  "src/audit/policy.ts"() {
+    "use strict";
+    init_inputs();
+  }
+});
+
+// src/audit/commands.ts
+import path6 from "path";
+function splitCommands(line) {
+  const parts = [];
+  let quote2 = "", start = 0;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if (char === "\\") {
+      i++;
+      continue;
     }
-    try {
-      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
-      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
-    } catch {
-      return null;
+    if (quote2) {
+      if (char === quote2) quote2 = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote2 = char;
+      continue;
+    }
+    if (char === ";" || line.slice(i, i + 2) === "&&") {
+      parts.push(line.slice(start, i));
+      if (char === "&") i++;
+      start = i + 1;
+    }
+  }
+  parts.push(line.slice(start));
+  return parts;
+}
+function commandClaims(line, lineNo, cwd, shell = false) {
+  const claims = [];
+  const segments = splitCommands(line);
+  for (const segment of segments) {
+    const text2 = segment.trim().replace(/^\$\s+/, "");
+    if (text2.startsWith("#") || /^(?:echo|printf)\b/.test(text2)) continue;
+    const cd = text2.match(/^cd\s+(.+)$/);
+    if (cd) {
+      const directory = literal(cd[1]);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path6.posix.join(cwd ?? ".", directory);
+      continue;
+    }
+    for (const match of text2.matchAll(COMMAND)) {
+      const flags = match[2].trim();
+      const selector = flags.match(/^(?:--prefix|--dir|-C)(?:\s+|=)(.+)$/);
+      let directory = cwd;
+      let scopeUnknown;
+      if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
+      if (selector) {
+        const selected = literal(selector[1]);
+        directory = selected === null || cwd === null ? null : path6.posix.join(cwd ?? ".", selected);
+      } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
+      const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
+      if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
+        scopeUnknown = "Package selection or conditional options after the script need review.";
+      }
+      if (/[|()]/.test(text2) || /\b(?:pushd|popd|if|for|while)\b/.test(text2) || directory === null) {
+        scopeUnknown = "The command's working directory or shell control flow could not be resolved.";
+      }
+      claims.push({
+        scriptName: match[3],
+        invocation: match[0],
+        excerpt: match[0],
+        line: lineNo,
+        ...directory !== void 0 && directory !== null ? { directory } : {},
+        ...scopeUnknown ? { scopeUnknown } : {}
+      });
     }
+    if (/\b(?:cd|pushd|popd)\b/.test(text2)) cwd = null;
   }
-  return { root, config, list, read };
+  return { claims, cwd };
 }
-var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
-var init_files = __esm({
-  "src/utils/files.ts"() {
+var TOKEN, COMMAND, literal;
+var init_commands = __esm({
+  "src/audit/commands.ts"() {
     "use strict";
-    init_git_read();
-    init_paths();
-    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
-    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
-    SOURCE_IGNORE = [
-      "**/node_modules/**",
-      "**/dist/**",
-      "**/build/**",
-      "**/.gradle/**",
-      "**/target/**",
-      "**/.git/**",
-      "**/.mason/**",
-      "**/vendor/**",
-      "**/__pycache__/**",
-      "**/venv/**",
-      "**/.venv/**",
-      "**/*.min.*",
-      "**/*.map",
-      "**/*.lock",
-      "**/generated/**",
-      "**/*.generated.*",
-      "**/R.java",
-      "**/BuildConfig.java",
-      "**/package-lock.json",
-      "**/yarn.lock",
-      "**/pnpm-lock.yaml"
-    ];
-    MAX_SOURCE_BYTES = 1024 * 1024;
+    TOKEN = `(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s\`;&|]+)`;
+    COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
+    literal = (value) => {
+      const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path6.posix.isAbsolute(unquoted) ? null : unquoted;
+    };
   }
 });
 
-// src/audit/inspection.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import path4 from "path";
-function withRepositoryInspection(root, run) {
-  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
-}
-function inspectionRead(root, key, read) {
-  const inspection = inspections.getStore();
-  if (!inspection || inspection.root !== path4.resolve(root)) return read();
-  if (!inspection.reads.has(key)) {
-    const pending = read();
-    inspection.reads.set(key, pending);
-    void pending.catch(() => {
-      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
-    });
+// src/audit/tree.ts
+function glyphIndex(line) {
+  for (const glyph of GLYPHS) {
+    const idx = line.indexOf(glyph);
+    if (idx !== -1) return idx;
   }
-  return inspection.reads.get(key);
+  return -1;
 }
-function inspectionGit(args, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+function isSpacerLine(line) {
+  return /^[\s│|]*$/.test(line);
 }
-async function auditGitPaths(root, kind) {
-  const shared = inspections.getStore()?.root === path4.resolve(root);
-  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
-  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
-  const { stdout } = await inspectionGit(
-    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
-    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
-  );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
-  return paths.sort();
+function entryName(afterGlyph) {
+  let name = afterGlyph.replace(/^\s+/, "");
+  const hash2 = name.search(/\s+#/);
+  if (hash2 !== -1) name = name.slice(0, hash2);
+  const columns = name.search(/\s{2,}/);
+  if (columns !== -1) name = name.slice(0, columns);
+  name = name.trim();
+  if (!name || /\s/.test(name)) return null;
+  return name;
 }
-var inspections, sourceSpecs, docSpecs, sourceSuffixes;
-var init_inspection = __esm({
-  "src/audit/inspection.ts"() {
+function extractTreeClaims(blockLines, blockStartLine) {
+  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
+  if (glyphLines < MIN_GLYPH_LINES) return [];
+  const claims = [];
+  const stack = [];
+  let rootPrefix = "";
+  let started = false;
+  for (let i = 0; i < blockLines.length; i++) {
+    const line = blockLines[i];
+    const col = glyphIndex(line);
+    if (col === -1) {
+      if (isSpacerLine(line)) continue;
+      if (!started) {
+        const candidate = line.trim();
+        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
+          rootPrefix = candidate.replace(/\/+$/, "");
+          claims.push({
+            path: rootPrefix,
+            line: blockStartLine + i,
+            excerpt: candidate
+          });
+        }
+        continue;
+      }
+      return claims;
+    }
+    started = true;
+    const name = entryName(line.slice(col + GLYPHS[0].length));
+    if (name === null) return claims;
+    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
+      stack.pop();
+    }
+    const isDir = name.endsWith("/");
+    const cleanName = name.replace(/\/+$/, "");
+    const segments = [
+      ...rootPrefix ? [rootPrefix] : [],
+      ...stack.map((s) => s.name),
+      cleanName
+    ];
+    claims.push({
+      path: segments.join("/"),
+      line: blockStartLine + i,
+      excerpt: name
+    });
+    if (isDir) stack.push({ col, name: cleanName });
+  }
+  return claims;
+}
+var MIN_GLYPH_LINES, GLYPHS;
+var init_tree = __esm({
+  "src/audit/tree.ts"() {
     "use strict";
-    init_git_read();
-    init_files();
-    inspections = new AsyncLocalStorage2();
-    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
-    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+    MIN_GLYPH_LINES = 3;
+    GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
   }
 });
 
-// src/audit/git.ts
-function parseCommitLine(line) {
-  const parts = line.split("	");
-  if (parts.length < 3 || !parts[0]) return null;
-  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
-}
-async function lastCommitOf(resolvedRoot, relPath) {
-  try {
-    const { stdout } = await inspectionGit(
-      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
-      { cwd: resolvedRoot }
-    );
-    const line = stdout.trim().split("\n")[0];
-    return line ? parseCommitLine(line) : null;
-  } catch {
-    return null;
-  }
-}
-async function deletingCommitOf(resolvedRoot, relPath) {
-  try {
-    const { stdout } = await inspectionGit(
-      [
-        "log",
-        "-1",
-        "--diff-filter=D",
-        `--format=${COMMIT_FORMAT}`,
-        "--",
-        `:(literal)${relPath}`
-      ],
-      { cwd: resolvedRoot }
-    );
-    const line = stdout.trim().split("\n")[0];
-    return line ? parseCommitLine(line) : null;
-  } catch {
+// src/audit/claims.ts
+import MarkdownIt from "markdown-it";
+function normalizePathToken(token) {
+  let t = token.trim();
+  if (!t) return null;
+  if (/\s/.test(t)) return null;
+  if (t.includes("://") || t.includes("\\")) return null;
+  if (/[*?[\]{}<>$`]/.test(t)) return null;
+  if (t.startsWith("/") || t.startsWith("~") || t.startsWith("./") || t.startsWith("../")) {
     return null;
   }
+  t = t.replace(/:\d+(?:-\d+)?$/, "");
+  if (t.includes(":")) return null;
+  const normalized = t.replace(/\/+$/, "");
+  if (!normalized) return null;
+  if (normalized.split("/").some((seg) => /^\.+$/.test(seg))) return null;
+  if (normalized.includes("/")) return normalized;
+  return ROOT_FILE_NAMES.has(normalized) ? normalized : null;
 }
-async function firstCommitOf(resolvedRoot, relPath) {
-  try {
-    const { stdout } = await inspectionGit(
-      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const line = stdout.trim().split("\n")[0];
-    return line ? parseCommitLine(line) : null;
-  } catch {
-    return null;
-  }
+function exactTokenPath(line) {
+  const trimmed = line.trim();
+  if (!trimmed || /\s/.test(trimmed) || !trimmed.includes("/")) return null;
+  return normalizePathToken(trimmed);
 }
-async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
-  if (!fromHash || fromHash === "unknown") return null;
-  try {
-    const { stdout } = await inspectionGit(
-      [
-        "log",
-        `${fromHash}..HEAD`,
-        `--format=%x01${COMMIT_FORMAT}`,
-        "--name-only",
-        "--",
-        ...pathspecs
-      ],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const commits = [];
-    for (const block of stdout.split("
")) {
-      if (!block.trim()) continue;
-      const lines = block.split("\n").filter((l) => l.trim().length > 0);
-      const ref = parseCommitLine(lines[0]);
-      if (!ref) continue;
-      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
+function computeIgnoredLines(lines) {
+  const ignored = new Array(lines.length).fill(false);
+  let inRegion = false;
+  let ignoreNext = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.includes(IGNORE_START)) {
+      inRegion = true;
+      ignored[i] = true;
+      continue;
+    }
+    if (line.includes(IGNORE_END)) {
+      inRegion = false;
+      ignored[i] = true;
+      continue;
+    }
+    if (inRegion) {
+      ignored[i] = true;
+      continue;
+    }
+    if (ignoreNext) {
+      if (line.trim().length === 0) continue;
+      ignored[i] = true;
+      ignoreNext = false;
+      continue;
+    }
+    if (line.includes(IGNORE_LINE)) {
+      ignored[i] = true;
+      const rest = line.replace(IGNORE_LINE, "").trim();
+      if (rest.length === 0) ignoreNext = true;
     }
-    return { commits, total: commits.length };
-  } catch {
-    return null;
   }
+  return ignored;
 }
-var COMMIT_FORMAT;
-var init_git = __esm({
-  "src/audit/git.ts"() {
-    "use strict";
-    init_inspection();
-    COMMIT_FORMAT = "%H%x09%cI%x09%s";
-  }
-});
-
-// src/utils/storage.ts
-import fs2 from "fs/promises";
-import path5 from "path";
-import { randomUUID } from "crypto";
-async function storePath(root, relative, createParents = false) {
-  const normalized = normalizeRepoPath(relative);
-  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
-  let current = await fs2.realpath(root);
-  const parts = normalized.split("/");
-  for (let i = 0; i < parts.length; i++) {
-    current = path5.join(current, parts[i]);
-    let stat;
-    try {
-      stat = await fs2.lstat(current);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      if (createParents && i < parts.length - 1) {
+function extractClaims(content2) {
+  const lines = content2.split("\n");
+  const ignored = computeIgnoredLines(lines);
+  const paths = /* @__PURE__ */ new Map();
+  const counts = [];
+  const commands2 = /* @__PURE__ */ new Map();
+  const addPath = (claim) => {
+    const key = [claim.relativeTo ?? "scope", claim.path].join(":");
+    if (!paths.has(key)) paths.set(key, claim);
+  };
+  const addCommand = (claim) => {
+    const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
+    if (!commands2.has(key)) commands2.set(key, claim);
+  };
+  const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
+  for (const token of parsed) {
+    if (token.type !== "inline" || !token.map) continue;
+    let line = token.map[0] + 1;
+    for (const child of token.children ?? []) {
+      const target = child.type === "link_open" ? child.attrGet("href") : child.type === "image" ? child.attrGet("src") : null;
+      if (target && !/^(?:[a-z][a-z0-9+.-]*:|[\/#~])/i.test(target)) {
+        let pathname = null;
         try {
-          await fs2.mkdir(current);
-        } catch (mkdirError) {
-          if (mkdirError.code !== "EEXIST") throw mkdirError;
+          pathname = decodeURIComponent(target.split(/[?#]/)[0]);
+        } catch {
+        }
+        if (pathname && !/[$*?{}<>\\\x00-\x1f]/.test(pathname)) {
+          addPath({ path: pathname, line, excerpt: target, relativeTo: "document" });
         }
-        stat = await fs2.lstat(current);
       }
+      if (child.type === "softbreak" || child.type === "hardbreak") line++;
+      else line += child.content.split("\n").length - 1;
     }
-    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
-  }
-  return current;
-}
-async function readStoreJson(root, relative) {
-  try {
-    const file = await storePath(root, relative);
-    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
-    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
-    const parsed = JSON.parse(raw);
-    if (parsed === null) throw new Error("expected a JSON object, received null");
-    return parsed;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-  }
-}
-async function writeStoreJson(root, relative, value) {
-  const payload = JSON.stringify(value, null, 2) + "\n";
-  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
-    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
   }
-  const file = await storePath(root, relative, true);
-  const temporary = path5.join(path5.dirname(file), `.${path5.basename(file)}.${randomUUID()}.tmp`);
-  try {
-    const handle = await fs2.open(temporary, "wx", 384);
-    try {
-      await handle.writeFile(payload, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
+  let shellCwd;
+  let inFence = false;
+  let fenceInfo = "";
+  let fenceMarker = "";
+  let blockLines = [];
+  let blockStartLine = 0;
+  const processBlock = () => {
+    for (const claim of extractTreeClaims(blockLines, blockStartLine)) {
+      addPath(claim);
     }
-    await fs2.rename(temporary, file);
-  } finally {
-    await fs2.rm(temporary, { force: true });
+    for (let i = 0; i < blockLines.length; i++) {
+      const exact = exactTokenPath(blockLines[i]);
+      if (exact) {
+        addPath({
+          path: exact,
+          line: blockStartLine + i,
+          excerpt: blockLines[i].trim()
+        });
+      }
+    }
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    const fenceMatch = line.match(/^\s*(```+|~~~+)(.*)$/);
+    if (fenceMatch) {
+      if (!inFence) {
+        inFence = true;
+        fenceMarker = fenceMatch[1][0];
+        fenceInfo = fenceMatch[2].trim().toLowerCase();
+        blockLines = [];
+        shellCwd = void 0;
+        blockStartLine = lineNo + 1;
+      } else if (fenceMatch[1][0] === fenceMarker) {
+        inFence = false;
+        processBlock();
+      }
+      continue;
+    }
+    if (inFence) {
+      blockLines.push(ignored[i] ? "" : line);
+      if (!ignored[i] && SHELL_FENCE_INFOS.has(fenceInfo)) {
+        const scanned = commandClaims(line, lineNo, shellCwd, true);
+        shellCwd = scanned.cwd;
+        for (const claim of scanned.claims) addCommand(claim);
+      }
+      continue;
+    }
+    if (ignored[i]) continue;
+    for (const m of line.matchAll(/`([^`]+)`/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(/"([A-Za-z][\w.@-]*(?:\/[\w.@-]+)+\/?)"/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(COUNT_RE)) {
+      const rest = line.slice((m.index ?? 0) + m[0].length);
+      if (COUNT_DENYLIST_RE.test(rest)) continue;
+      counts.push({
+        count: Number.parseInt(m[1], 10),
+        unit: m[2].toLowerCase(),
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+    for (const match of line.matchAll(/`([^`]+)`/g)) {
+      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims) addCommand(claim);
+    }
+    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims) addCommand(claim);
   }
+  if (inFence) processBlock();
+  return {
+    paths: [...paths.values()],
+    counts,
+    commands: [...commands2.values()]
+  };
 }
-var init_storage = __esm({
-  "src/utils/storage.ts"() {
+var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
+var init_claims = __esm({
+  "src/audit/claims.ts"() {
     "use strict";
-    init_paths();
-    init_files();
+    init_commands();
+    init_tree();
+    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+      "package.json",
+      "package-lock.json",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "tsup.config.ts",
+      "vitest.config.ts",
+      "Makefile",
+      "Dockerfile",
+      "docker-compose.yml",
+      "Cargo.toml",
+      "go.mod",
+      "go.sum",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "build.gradle.kts",
+      "build.gradle",
+      "manifest.json",
+      "server.json",
+      "README.md",
+      "CHANGELOG.md",
+      "LICENSE",
+      "CLAUDE.md",
+      "AGENTS.md",
+      ".gitignore",
+      ".env.example"
+    ]);
+    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+    markdown = new MarkdownIt("commonmark", { html: false });
+    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+    IGNORE_LINE = "<!-- mason:ignore -->";
+    IGNORE_START = "<!-- mason:ignore-start -->";
+    IGNORE_END = "<!-- mason:ignore-end -->";
   }
 });
 
-// src/audit/inputs.ts
-import fs3 from "fs/promises";
-import * as nativeFs from "fs";
-import path6 from "path";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs3.realpath(root);
+// src/audit/git.ts
+function parseCommitLine(line) {
+  const parts = line.split("	");
+  if (parts.length < 3 || !parts[0]) return null;
+  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
+}
+async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
+    const { stdout } = await inspectionGit(
+      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
   }
 }
-async function readAuditInput(root, file) {
+async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
-    throw error;
+    const { stdout } = await inspectionGit(
+      [
+        "log",
+        "-1",
+        "--diff-filter=D",
+        `--format=${COMMIT_FORMAT}`,
+        "--",
+        `:(literal)${relPath}`
+      ],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
   }
 }
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
+async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
+    const { stdout } = await inspectionGit(
+      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
   }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  return auditGitPaths(root, "sources");
 }
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const ignored = /* @__PURE__ */ new Set();
-  for (let offset = 0; offset < files.length; offset += 1e3) {
-    try {
-      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
-        cwd: root,
-        maxBuffer: 4 * 1024 * 1024,
-        timeout: 1e4,
-        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
-      });
-      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
-    } catch (error) {
-      if (error.code !== 1) throw error;
+async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
+  if (!fromHash || fromHash === "unknown") return null;
+  try {
+    const { stdout } = await inspectionGit(
+      [
+        "log",
+        `${fromHash}..HEAD`,
+        `--format=%x01${COMMIT_FORMAT}`,
+        "--name-only",
+        "--",
+        ...pathspecs
+      ],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const commits = [];
+    for (const block of stdout.split("
")) {
+      if (!block.trim()) continue;
+      const lines = block.split("\n").filter((l) => l.trim().length > 0);
+      const ref = parseCommitLine(lines[0]);
+      if (!ref) continue;
+      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
     }
+    return { commits, total: commits.length };
+  } catch {
+    return null;
   }
-  return ignored;
 }
-var MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
+var COMMIT_FORMAT;
+var init_git = __esm({
+  "src/audit/git.ts"() {
     "use strict";
-    init_files();
-    init_storage();
-    init_git_read();
     init_inspection();
-    MAX_INPUTS = 1e5;
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
 
 // src/audit/docs.ts
 import fs4 from "fs/promises";
 import path7 from "path";
-import fg3 from "fast-glob";
+import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
@@ -977,7 +1044,7 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
       ignore: excluded,
       followSymbolicLinks: false,
       label: "Documentation discovery"
@@ -1007,6 +1074,7 @@ async function localDocPaths(root) {
   return paths;
 }
 function documentScope(file) {
+  if (!/^(readme|agents|claude)\.md$/i.test(path7.posix.basename(file))) return ".";
   const parent = path7.posix.dirname(file);
   return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
@@ -1028,7 +1096,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path7.posix.basename(candidate)) ? "instructions" : "guide",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1585,22 +1653,6 @@ var init_drift = __esm({
   }
 });
 
-// src/audit/types.ts
-var ALL_CHECKS;
-var init_types = __esm({
-  "src/audit/types.ts"() {
-    "use strict";
-    ALL_CHECKS = [
-      "deleted-reference",
-      "new-module",
-      "stale-count",
-      "dead-command",
-      "deps-changed",
-      "decision-anchor-drift"
-    ];
-  }
-});
-
 // src/audit/checks/deleted-reference.ts
 import path12 from "path";
 async function checkDeletedReferences(ctx) {
@@ -1669,7 +1721,7 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
+import fg6 from "fast-glob";
 import fs8 from "fs/promises";
 import path13 from "path";
 function escapeRegExp(text2) {
@@ -1731,7 +1783,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
       const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
         ignore,
         onlyDirectories: true,
         label: "Module directory discovery",
@@ -1744,7 +1796,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count4 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
+      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
@@ -2079,6 +2131,87 @@ var init_dead_command = __esm({
   }
 });
 
+// src/audit/dependency-claims.ts
+import path16 from "path";
+import { parse as parseToml } from "smol-toml";
+function dependencyText(content2) {
+  return content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+}
+function declarations(file, source) {
+  const result = /* @__PURE__ */ new Map();
+  if (!source) return result;
+  if (path16.posix.basename(file) === "package.json") {
+    const json = JSON.parse(source);
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
+      for (const [name, value] of Object.entries(json[section] ?? {})) {
+        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+      }
+    }
+  } else if (file.endsWith("libs.versions.toml")) {
+    const catalog = parseToml(source);
+    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
+      if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+      } else if (entry && typeof entry === "object") {
+        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
+        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
+        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+      }
+    }
+  } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+  }
+  return result;
+}
+async function matchDependencyChanges(root, from, head, files, content2) {
+  const matches = [];
+  const lines = dependencyText(content2).split("\n");
+  let incomplete = files.length > 64;
+  for (const file of files.slice(0, 64)) {
+    if (!/(?:^|\/)(?:package\.json|libs\.versions\.toml|build\.gradle(?:\.kts)?)$/.test(file)) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      const read = async (revision) => {
+        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        if (!entry) return "";
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+      };
+      const [before, after] = await Promise.all([read(from), read(head)]);
+      const old = declarations(file, before), next = declarations(file, after);
+      for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
+        if (old.get(dependency) === next.get(dependency)) continue;
+        const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const line = lines.findIndex((text2) => mention.test(text2));
+        if (line < 0) continue;
+        matches.push({
+          dependency,
+          manifest: file,
+          before: old.get(dependency) ?? null,
+          after: next.get(dependency) ?? null,
+          line: line + 1,
+          excerpt: lines[line].trim().slice(0, 500)
+        });
+        if (matches.length >= 100) return { matches, incomplete: true };
+      }
+    } catch {
+      incomplete = true;
+    }
+  }
+  return { matches, incomplete };
+}
+var init_dependency_claims = __esm({
+  "src/audit/dependency-claims.ts"() {
+    "use strict";
+    init_inspection();
+  }
+});
+
 // src/audit/release-metadata.ts
 async function git(root, args) {
   return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
@@ -2158,13 +2291,6 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
-    if (doc.dirty) {
-      result.skipped.push({
-        check: "deps-changed",
-        doc: doc.path,
-        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-      });
-    }
     let content2 = doc.content;
     if (doc.dirty) {
       try {
@@ -2177,7 +2303,6 @@ async function checkDepsChanged(ctx) {
         continue;
       }
     }
-    if (!hasDependencyContent(content2)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -2201,16 +2326,32 @@ async function checkDepsChanged(ctx) {
     range.commits = relevant;
     range.total = relevant.length;
     if (range.total === 0) continue;
-    const latest = range.commits[0];
+    const relevance = await matchDependencyChanges(
+      ctx.root,
+      doc.lastCommit.hash,
+      ctx.headHash,
+      [...new Set(range.commits.flatMap((commit) => commit.files))],
+      content2
+    );
+    if (!relevance.matches.length && !hasDependencyContent(content2)) continue;
+    const match = relevance.matches[0];
+    if (doc.dirty && match) result.skipped.push({
+      check: "deps-changed",
+      doc: doc.path,
+      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+    });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
-      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
-      anchor: { doc: doc.path, line: null, excerpt: null },
+      ...match ? {} : { resolution: "informational" },
+      message: match ? `${match.dependency} changed from ${match.before ?? "absent"} to ${match.after ?? "removed"} in ${match.manifest}; review ${doc.path}:${match.line}: ${match.excerpt}${relevance.matches.length > 1 ? ` (${relevance.matches.length - 1} more matches in evidence)` : ""}` : `Dependency manifests changed after the document baseline ${doc.lastCommit.hash.slice(0, 7)} (${doc.lastCommit.date.slice(0, 10)}); no specific affected passage was established. Informational only.${relevance.incomplete ? " Some manifest declarations could not be matched." : ""}`,
+      anchor: { doc: doc.path, line: match?.line ?? null, excerpt: match?.excerpt ?? null },
       evidence: {
         kind: "doc-behind-manifests",
         docLastCommit: doc.lastCommit,
         manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
-        totalCommits: range.total
+        totalCommits: range.total,
+        matches: relevance.matches,
+        matchingIncomplete: relevance.incomplete
       }
     });
   }
@@ -2220,6 +2361,7 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_dependency_claims();
     init_docs();
     init_release_metadata();
     init_git();
@@ -2244,7 +2386,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path16 from "path";
+import path17 from "path";
 function tokenize(text2) {
   return text2.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 2 && !STOPWORDS.has(t));
 }
@@ -2257,7 +2399,7 @@ function tokenSet(text2) {
 function scoreEntry(taskTokens, entry) {
   const nameTokens = tokenSet(entry.name);
   const descTokens = tokenSet(entry.description);
-  const fileTokens = tokenSet(entry.files.map((f) => path16.basename(f)).join(" "));
+  const fileTokens = tokenSet(entry.files.map((f) => path17.basename(f)).join(" "));
   let score = 0;
   for (const token of taskTokens) {
     if (nameTokens.has(token)) score += 3;
@@ -2591,7 +2733,7 @@ __export(decisions_exports, {
   withDecisionWrite: () => withDecisionWrite
 });
 import fs9 from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import { createHash } from "crypto";
 import { z as z3 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2689,7 +2831,7 @@ async function upsertDecision(rootDir, input) {
     if (input.files && files.length < input.files.length) warnings.push("some anchor paths were outside the repo or duplicated and were dropped");
     for (const file of files) {
       try {
-        await fs9.access(path17.join(rootDir, file));
+        await fs9.access(path18.join(rootDir, file));
       } catch {
         warnings.push(`anchor file does not exist on disk: ${file}`);
       }
@@ -2814,9 +2956,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path18 from "path";
+import path19 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -3012,7 +3154,9 @@ var init_findings = __esm({
         kind: z4.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
         manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
-        totalCommits: count
+        totalCommits: count,
+        matches: z4.array(z4.object({ dependency: z4.string(), manifest: z4.string(), before: z4.string().nullable(), after: z4.string().nullable(), line: z4.number().int().positive(), excerpt: z4.string() })).optional(),
+        matchingIncomplete: z4.boolean().optional()
       }),
       z4.object({
         kind: z4.literal("decision-anchor"),
@@ -3028,7 +3172,7 @@ var init_findings = __esm({
       type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
       confidence: z4.enum(["certain", "likely"])
     });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.literal("recheck").optional() });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.enum(["recheck", "informational"]).optional() });
     checkResultSchema = z4.object({
       issues: z4.array(issueSchema),
       advisories: z4.array(advisorySchema),
@@ -3091,14 +3235,18 @@ async function readRecord(root, id) {
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
-function scopes(finding) {
+function evidenceFingerprint(evidence, reason2) {
+  return digest([evidence.scope, evidence.tree, ...reason2 === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+}
+function scopes(finding, reason2) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason2 === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
   if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
   else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
@@ -3109,9 +3257,9 @@ function scopes(finding) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding) {
+async function reviewEvidence(root, finding, reason2) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding);
+  const scope = scopes(finding, reason2);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -3137,7 +3285,7 @@ async function reviewEvidence(root, finding) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason2);
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
   return {
     ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
@@ -3184,7 +3332,7 @@ async function assessAdvisory(root, finding, baselineHead) {
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
-    const current = await reviewEvidence(root, event.finding);
+    const current = await reviewEvidence(root, event.finding, event.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
     const base = {
       id,
@@ -3194,7 +3342,7 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
     return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
   } catch (error) {
     return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
@@ -3222,9 +3370,13 @@ async function reviewAdvisory(rootDir, input) {
     decisionId: finding.evidence.decisionId,
     hint: "Use review_decision to prepare evidence and record authorized acceptance, reaffirmation or retirement, then verify this original repair baseline. An advisory assessment cannot approve a decision."
   };
+  if (request.action === "dismiss") {
+    if (finding.type !== "deps-changed" || finding.evidence.kind !== "doc-behind-manifests") throw new Error("One-step dismissal is only available for dependency advisories.");
+    if (!request.reasonCode || !request.note) throw new Error("Dismissal requires reasonCode and note; it does not require a reviewer or prepared token.");
+  } else if (request.reasonCode) throw new Error("reasonCode is only used with dismiss.");
   const prepare = async () => {
     const record = await readRecord(root, request.findingId);
-    const evidence = await reviewEvidence(root, finding);
+    const evidence = await reviewEvidence(root, finding, request.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", baseline.original.headHash, evidence.head);
     const token = digest({ baseline: baseline.original, finding, evidence, record });
     return { record, evidence, token };
@@ -3253,10 +3405,10 @@ async function reviewAdvisory(rootDir, input) {
       hint: "Inspect the original finding, scoped document and relevant code changes. Record addressed, inapplicable or deferred only when the user or cited project review authorizes that assessment. Supply the actual reviewer, reason in note and reviewToken. Relevant edits must be committed first. Deferral remains outstanding. Review identities are recorded assertions, not authenticated approvals."
     };
   }
-  if (!request.reviewer || !request.note || !request.reviewToken) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
+  if (request.action !== "dismiss" && (!request.reviewer || !request.note || !request.reviewToken)) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
   return withLock(root, ".mason/reports/advisory-review-locks/" + request.findingId, async () => {
     const state = await prepare();
-    if (state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
+    if (request.action !== "dismiss" && state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
     if (state.evidence.dirty) throw new Error("Commit relevant document and repository edits before recording the assessment. Unrelated local work may remain.");
     if ((state.record?.events.length ?? 0) >= 200) throw new Error("Review history limit reached; existing events were retained.");
     const { dirty, documentDigest, ...evidence } = state.evidence;
@@ -3264,7 +3416,8 @@ async function reviewAdvisory(rootDir, input) {
       at: (/* @__PURE__ */ new Date()).toISOString(),
       reviewer: request.reviewer,
       note: request.note,
-      outcome: request.action,
+      outcome: request.action === "dismiss" ? "dismissed" : request.action,
+      reasonCode: request.reasonCode,
       finding,
       evidence
     });
@@ -3275,11 +3428,11 @@ async function reviewAdvisory(rootDir, input) {
       status: "recorded",
       recordPath: recordPath(request.findingId),
       event,
-      hint: "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
+      hint: request.action === "dismiss" ? "Dismissal saved and effective locally. Commit the record to share it. No-dependency-claims dismissals reopen on document content changes; unrelated-manifest-change dismissals reopen on scoped document or manifest changes. This does not approve a decision." : "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
     };
   });
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -3305,11 +3458,13 @@ var init_advisory_review = __esm({
       lastScopeCommit: commitSchema2,
       paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
     });
+    dismissalReasonSchema = z6.enum(["no-dependency-claims", "unrelated-manifest-change"]);
     eventSchema2 = z6.object({
       at: z6.string().datetime(),
-      reviewer: z6.string().trim().min(1).max(200),
+      reviewer: z6.string().trim().min(1).max(200).optional(),
       note: z6.string().trim().min(1).max(2500),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred"]),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+      reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
@@ -3321,13 +3476,14 @@ var init_advisory_review = __esm({
       recordPath: z6.string().optional(),
       reviewer: z6.string().optional(),
       note: z6.string().optional(),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
       reviewedHead: z6.string().optional()
     });
     advisoryReviewRequest = z6.object({
       baselinePath: z6.string().min(1),
       findingId: hashSchema,
-      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
       reviewToken: hashSchema.optional()
@@ -3338,12 +3494,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -3377,7 +3533,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path20.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -3389,13 +3545,21 @@ async function auditCurrent(rootDir, options) {
     changesSinceDoc,
     decisionsPresent
   };
+  const policy = (await loadProjectConfig(resolvedRoot)).audit;
   const selected = options.checks ?? ALL_CHECKS;
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
-    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    const exclusions = policy?.exclude?.[name] ?? [];
+    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
+    if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
+    const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    report.advisories.push(...advisories);
+    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
+    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
@@ -3407,6 +3571,8 @@ async function auditCurrent(rootDir, options) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_files();
+    init_policy();
     init_profile();
     init_drift();
     init_snapshot();
@@ -3432,7 +3598,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs12 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -3453,7 +3619,7 @@ async function docState(root) {
       docs.push([doc, null]);
     }
   }
-  return digest(docs);
+  return digest([docs, (await loadProjectConfig(root)).audit]);
 }
 async function stableAudit(root, checks, options = {}) {
   return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
@@ -3522,8 +3688,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path21.resolve(rootDir);
+  const relative = path21.isAbsolute(baselinePath) ? path21.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -3572,6 +3738,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
+    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
+      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
+    }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
@@ -3582,6 +3751,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
       return { ...base, review, status: "review-required", reason: review.reason };
     }
+    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
+    }
     if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
@@ -3610,7 +3782,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -3633,7 +3805,7 @@ function repairExitCode(report) {
 function formatRepairSummary(report) {
   return [
     "Repair verification: " + report.status + ". Baseline: " + report.baselinePath,
-    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + f.original.message + "\n    " + f.reason + "\n    findingId: " + f.id),
+    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + (f.current?.message ?? "Historical evidence at " + report.baselineHead.slice(0, 7) + ": " + f.original.message) + "\n    " + f.reason + "\n    findingId: " + f.id),
     ...report.newFindings.map((f) => "  [new] " + f.type + " " + f.anchor.doc + ": " + f.message),
     ...report.diagnostics.map((d) => "  [unverified] " + d),
     ...(report.currentAudit?.skippedChecks ?? []).map((s) => "  [skipped] " + s.check + ": " + s.reason),
@@ -3666,13 +3838,14 @@ var init_repair = __esm({
       docs: z7.array(z7.object({
         path: z7.string().refine((value) => normalizeRepoPath(value) === value),
         scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme"]).optional(),
+        kind: z7.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
         dirty: z7.boolean(),
         lineCount: count2
       })).nonempty(),
       decisionsChecked: z7.boolean(),
       clean: z7.boolean(),
+      excludedChecks: z7.array(z7.object({ check: checkSchema, doc: z7.string() })).optional(),
       issues: z7.array(issueSchema),
       advisories: z7.array(advisorySchema),
       suppressedAdvisories: z7.array(advisorySchema).optional(),
@@ -3698,9 +3871,9 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import { createHash as createHash3 } from "crypto";
-import fg5 from "fast-glob";
+import fg7 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args) {
   return profilePhase("automation.git", async () => (await execGit(args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
@@ -3718,6 +3891,11 @@ async function readInputs(root) {
 }
 async function collectInputs(root) {
   const docPaths = await discoverDocPaths(root);
+  const auditPolicy = (await loadProjectConfig(root)).audit;
+  const allowed = /* @__PURE__ */ new Map();
+  for (const name of ["deleted-reference", "new-module", "stale-count", "dead-command"]) {
+    allowed.set(name, await includedCheckPaths(root, docPaths, auditPolicy?.exclude?.[name] ?? []));
+  }
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git3(root, "rev-parse", "HEAD"),
     docPaths.length ? git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...docPaths.map((p) => `:(literal)${p}`)) : "",
@@ -3727,7 +3905,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path22.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3746,18 +3924,18 @@ async function collectInputs(root) {
     docContents.push([file, text2]);
     const parsed = { path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") };
     parsedDocs.push(parsed);
-    for (const claim of parsed.claims.paths) {
+    for (const claim of allowed.get("deleted-reference").has(file) ? parsed.claims.paths : []) {
       const scope = pathClaimScope(file, claim);
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path22.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
   }
-  const combinedDocs = moduleDocumentation(parsedDocs);
-  const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
+  const combinedDocs = moduleDocumentation(parsedDocs.filter((doc) => allowed.get("new-module").has(doc.path)));
+  const countClaims = parsedDocs.filter((doc) => allowed.get("stale-count").has(doc.path)).flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs13.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -3766,8 +3944,8 @@ async function collectInputs(root) {
   const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
-    commandInputs(root, parsedDocs),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    commandInputs(root, parsedDocs.filter((doc) => allowed.get("dead-command").has(doc.path))),
+    fg7(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
   const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
     await storePath(root, file);
@@ -3777,7 +3955,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [6, engineVersion, head, shallow, replacements, docContents];
+  const common = [7, engineVersion, head, shallow, replacements, docContents, auditPolicy];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3824,6 +4002,8 @@ var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_policy();
+    init_files();
     init_git_read();
     init_profile();
     init_docs();
@@ -3837,7 +4017,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.19.0" : "development";
+    engineVersion = true ? "0.19.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3858,7 +4038,7 @@ __export(model_exports, {
 });
 import { z as z9 } from "zod";
 import fs14 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
@@ -3867,7 +4047,7 @@ async function loadSetup(root) {
 async function effectiveSetup(root) {
   const local = await loadSetup(root);
   if (local) return { root, setup: local };
-  const common = await fs14.realpath(path22.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const common = await fs14.realpath(path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
   const own = await fs14.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
   if (common === own) return { root, setup: null };
   const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
@@ -3880,7 +4060,7 @@ async function effectiveSetup(root) {
     if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
     throw error;
   }
-  const inheritedCommon = await fs14.realpath(path22.resolve(
+  const inheritedCommon = await fs14.realpath(path23.resolve(
     inheritedRoot,
     (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
   ));
@@ -3963,7 +4143,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.19.0" : "development";
+    executingVersion = () => true ? "0.19.1" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4089,7 +4269,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs18 from "fs/promises";
-import path26 from "path";
+import path27 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4122,7 +4302,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path26.join(path26.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
+  const temporary = path27.join(path27.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
   try {
     const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs18.open(temporary, "wx", mode);
@@ -4714,7 +4894,7 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs20 from "fs/promises";
-import path27 from "path";
+import path28 from "path";
 var init_hook_root = __esm({
   "src/automation/hook-root.ts"() {
     "use strict";
@@ -5124,9 +5304,11 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
 
-- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Specific suppressed advisories remain unresolved; editing a doc does not approve it. Informational dependency notices require no review.
 - When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
 
+- For a dependency advisory, \`review_advisory(action: "dismiss", baselinePath, findingId, reasonCode, note)\` records a one-step dismissal without reviewer or token. Use \`no-dependency-claims\` for a document with no dependency claims (reopens on document content changes), or \`unrelated-manifest-change\` for reviewed changes that do not affect its guidance (reopens on document or manifest changes). Keep the relevant scope committed; commit the dismissal to share it. This never approves a decision.
+
 - When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
 
 Inspect source for what the retrieved context does not answer.
@@ -5557,10 +5739,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path28 from "path";
+import path29 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path28.isAbsolute(file) ? path28.relative(root, file) : file;
+  const relative = path29.isAbsolute(file) ? path29.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5657,7 +5839,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path28.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path29.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5779,7 +5961,7 @@ var init_evidence2 = __esm({
 
 // src/review/review.ts
 import fs21 from "fs/promises";
-import path29 from "path";
+import path30 from "path";
 import { execFile as execFile7 } from "child_process";
 import { promisify as promisify7 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5808,7 +5990,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path29.resolve(rootDir);
+  const resolvedRoot = path30.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5858,7 +6040,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs21.access(path29.join(resolvedRoot, relPath));
+        await fs21.access(path30.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5993,7 +6175,7 @@ var init_onboarding = __esm({
 });
 
 // src/impact/references.ts
-import path30 from "path";
+import path31 from "path";
 function templateEnd(content2, start) {
   let i = start + 1, interpolation = 0;
   while (i < content2.length) {
@@ -6119,10 +6301,10 @@ function jvmImports(content2) {
 }
 function resolveImport(file, specifier, available) {
   if (!specifier.startsWith("./") && !specifier.startsWith("../")) return null;
-  const relative = path30.posix.normalize(path30.posix.join(path30.posix.dirname(file), specifier));
+  const relative = path31.posix.normalize(path31.posix.join(path31.posix.dirname(file), specifier));
   if (relative.startsWith("../")) return null;
   if (available.has(relative)) return relative;
-  const ext = path30.posix.extname(relative);
+  const ext = path31.posix.extname(relative);
   const replacements = { ".js": [".ts", ".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
   const candidates = ext ? (replacements[ext] ?? []).map((e) => relative.slice(0, -ext.length) + e) : jsExtensions.flatMap((e) => [relative + e, relative + "/index" + e]);
   const found = candidates.filter((f) => available.has(f));
@@ -6134,13 +6316,13 @@ function mentionsPath(content2, target) {
 function createReferenceMatcher(targets2, available, targetContents = /* @__PURE__ */ new Map()) {
   const counts = /* @__PURE__ */ new Map();
   for (const file of available) {
-    const name = path30.posix.basename(file, path30.posix.extname(file));
+    const name = path31.posix.basename(file, path31.posix.extname(file));
     counts.set(name, (counts.get(name) ?? 0) + 1);
   }
   const jvmTargets = new Map([...targetContents].filter(([file]) => /\.(?:kt|kts|java)$/.test(file)).map(([file, content2]) => [file, declaredSymbols(content2)]));
   return (source) => {
     if (targets2.includes(source.path)) return [];
-    const resolved = new Set(jsExtensions.includes(path30.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
+    const resolved = new Set(jsExtensions.includes(path31.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
     if (/\.(?:kt|kts|java)$/.test(source.path)) {
       const imported = jvmImports(source.content);
       for (const [target, symbols] of jvmTargets) if (symbols.some((symbol) => imported.some((name) => name === symbol || name.startsWith(symbol + ".")))) resolved.add(target);
@@ -6156,7 +6338,7 @@ function createReferenceMatcher(targets2, available, targetContents = /* @__PURE
         add("explicit-path", target);
         continue;
       }
-      const ext = path30.posix.extname(target), name = path30.posix.basename(target, ext);
+      const ext = path31.posix.extname(target), name = path31.posix.basename(target, ext);
       if (!/\.(?:[cm]?[jt]sx?|py|kt|java|go|rs|swift|rb|cs|cpp|c|h|hpp|dart|php)$/.test(ext) || name.startsWith(".") || name.length < 3 || genericNames.has(name.toLowerCase()) || counts.get(name) !== 1) continue;
       if (word(name).test(source.content)) {
         add("name-candidate", name);
@@ -6185,11 +6367,11 @@ var impact_exports = {};
 __export(impact_exports, {
   analyzeImpact: () => analyzeImpact
 });
-import path31 from "path";
+import path32 from "path";
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify8 } from "util";
 async function analyzeImpact(rootDir, targetFiles) {
-  const resolvedRoot = path31.resolve(rootDir);
+  const resolvedRoot = path32.resolve(rootDir);
   const resolvedTargets = await resolveTargetFiles(resolvedRoot, targetFiles);
   const [cochange, references, tests] = await Promise.all([
     getCochangeFiles(resolvedRoot, resolvedTargets),
@@ -6303,9 +6485,9 @@ async function getRelatedTests(rootDir, targetFiles) {
   const testFiles = await (await createFileAccess(rootDir)).list(testPatterns);
   const results = [];
   for (const target of targetFiles) {
-    const targetBaseName = path31.basename(target).replace(/\.[^.]+$/, "");
+    const targetBaseName = path32.basename(target).replace(/\.[^.]+$/, "");
     for (const testFile of testFiles) {
-      const testBaseName = path31.basename(testFile).replace(/\.[^.]+$/, "");
+      const testBaseName = path32.basename(testFile).replace(/\.[^.]+$/, "");
       const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
       if (sourceName === targetBaseName) {
         results.push({
@@ -6333,13 +6515,13 @@ var assemble_exports = {};
 __export(assemble_exports, {
   assembleContext: () => assembleContext
 });
-import path32 from "path";
+import path33 from "path";
 import fs22 from "fs/promises";
 async function collectImpact(root, candidates) {
   const targets2 = /* @__PURE__ */ new Set();
   let sourceFiles;
   for (const candidate of sanitizeRepoPaths(candidates)) {
-    const stat = await fs22.stat(path32.join(root, candidate)).catch(() => null);
+    const stat = await fs22.stat(path33.join(root, candidate)).catch(() => null);
     if (stat?.isDirectory()) {
       sourceFiles ??= await (await createFileAccess(root)).list();
       for (const file of sourceFiles) {
@@ -6365,7 +6547,7 @@ async function collectImpact(root, candidates) {
   };
 }
 async function assembleContext(rootDir, task, files) {
-  const resolvedRoot = path32.resolve(rootDir);
+  const resolvedRoot = path33.resolve(rootDir);
   const mapState = await inspectSnapshot(resolvedRoot);
   const snapshot = mapState.snapshot;
   const store = await loadDecisionStore(resolvedRoot);
@@ -6908,8 +7090,8 @@ __export(client_exports, {
 function createConfluenceClient(config, fetchFn = fetch) {
   const baseUrl = config.baseUrl.replace(/\/+$/, "");
   const auth = "Basic " + Buffer.from(`${config.email}:${config.apiToken}`).toString("base64");
-  async function call(method, path42, body) {
-    const res = await fetchFn(`${baseUrl}${path42}`, {
+  async function call(method, path43, body) {
+    const res = await fetchFn(`${baseUrl}${path43}`, {
       method,
       headers: {
         Authorization: auth,
@@ -6921,7 +7103,7 @@ function createConfluenceClient(config, fetchFn = fetch) {
     if (!res.ok) {
       const text2 = await res.text();
       throw new Error(
-        `Confluence ${method} ${path42} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
+        `Confluence ${method} ${path43} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
       );
     }
     if (res.status === 204) return null;
@@ -7023,15 +7205,15 @@ __export(config_exports2, {
   validateProvider: () => validateProvider
 });
 import fs24 from "fs/promises";
-import path33 from "path";
+import path34 from "path";
 import os3 from "os";
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
 function configDir() {
-  return path33.join(os3.homedir(), ".mason");
+  return path34.join(os3.homedir(), ".mason");
 }
 function configFile() {
-  return path33.join(configDir(), "config.json");
+  return path34.join(configDir(), "config.json");
 }
 async function loadConfig() {
   try {
@@ -7204,16 +7386,16 @@ var init_renderer = __esm({
 
 // src/confluence/diff.ts
 import fs25 from "fs/promises";
-import path34 from "path";
+import path35 from "path";
 import { createHash as createHash6 } from "crypto";
 function hashDescription(description) {
   return createHash6("sha256").update(description, "utf8").digest("hex");
 }
 function syncStateDir(rootDir) {
-  return path34.join(rootDir, ".mason");
+  return path35.join(rootDir, ".mason");
 }
 function syncStatePath(rootDir) {
-  return path34.join(syncStateDir(rootDir), "confluence-sync.json");
+  return path35.join(syncStateDir(rootDir), "confluence-sync.json");
 }
 async function loadSyncState(rootDir) {
   try {
@@ -7786,7 +7968,7 @@ import { z as z24 } from "zod";
 init_repair();
 init_advisory_review();
 import fs26 from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 import { execFile as execFile11 } from "child_process";
 import { promisify as promisify11 } from "util";
 
@@ -7795,11 +7977,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path24 from "path";
+import path25 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path23 from "path";
+import path24 from "path";
 import { stripVTControlCharacters } from "util";
 
 // src/audit/cli.ts
@@ -7866,7 +8048,7 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
   lines.push("AUDIT REPORT (current context files and repository evidence, including local edits):");
@@ -7897,10 +8079,10 @@ import { promisify as promisify3 } from "util";
 
 // src/analyzers/base.ts
 import fs16 from "fs/promises";
-import fg6 from "fast-glob";
+import fg8 from "fast-glob";
 var BaseAnalyzer = class {
   async findFiles(patterns, root) {
-    return fg6(patterns, {
+    return fg8(patterns, {
       cwd: root,
       ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"],
       absolute: true
@@ -8112,7 +8294,7 @@ async function isGitRepo(dir) {
 
 // src/mcp/sampler.ts
 init_files();
-import path25 from "path";
+import path26 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 var exec2 = promisify4(execFile4);
@@ -8220,8 +8402,8 @@ async function sampleFiles(rootDir, maxFiles = 25) {
   const projectConfig = access.config;
   for (const filePath of projectConfig.alwaysInclude ?? []) {
     if (selected.size >= maxFiles) break;
-    const resolvedPath = path25.resolve(rootDir, filePath);
-    if (!resolvedPath.startsWith(path25.resolve(rootDir))) continue;
+    const resolvedPath = path26.resolve(rootDir, filePath);
+    if (!resolvedPath.startsWith(path26.resolve(rootDir))) continue;
     selected.set(filePath, "always-include (project config)");
   }
   let configCount = 0;
@@ -8287,7 +8469,7 @@ async function sampleFiles(rootDir, maxFiles = 25) {
       if (!line) continue;
       if (line.includes("node_modules") || line.includes("/build/") || line.includes(".gradle") || line.includes("/generated/"))
         continue;
-      const ext = path25.extname(line).slice(1);
+      const ext = path26.extname(line).slice(1);
       if (!SOURCE_EXTENSIONS.includes(ext)) continue;
       fileCounts.set(line, (fileCounts.get(line) ?? 0) + 1);
     }
@@ -8704,7 +8886,7 @@ async function buildContext(dir) {
   };
 }
 async function analyzeProject(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const context = await buildContext(rootDir);
   const results = await runAll(context);
   const projectSnapshot = await detectProjectSnapshot(rootDir);
@@ -8759,7 +8941,7 @@ async function detectProjectSnapshot(rootDir) {
   const present = [];
   for (const file of buildFiles) {
     try {
-      await fs26.access(path35.join(rootDir, file));
+      await fs26.access(path36.join(rootDir, file));
       present.push(file);
     } catch {
     }
@@ -8801,7 +8983,7 @@ async function detectProjectSnapshot(rootDir) {
   const sourceFiles = await access.list();
   const fileCounts = {};
   for (const file of sourceFiles) {
-    const ext = path35.extname(file).slice(1);
+    const ext = path36.extname(file).slice(1);
     fileCounts[ext] = (fileCounts[ext] ?? 0) + 1;
   }
   return {
@@ -8812,7 +8994,7 @@ async function detectProjectSnapshot(rootDir) {
   };
 }
 async function getCodeSamples(dir, count4 = 15) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const samples = await sampleFiles(rootDir, count4);
   const output = {
     note: "These are previews (first ~60 lines). Read the file directly with your own tools to see it in full.",
@@ -8855,7 +9037,7 @@ async function unmappedContextResponse(rootDir) {
   });
 }
 async function getProjectStructure(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const allFiles = await (await createFileAccess(rootDir)).list("**/*");
   const dirInfo = /* @__PURE__ */ new Map();
   for (const file of allFiles) {
@@ -8867,7 +9049,7 @@ async function getProjectStructure(dir) {
       }
       const info = dirInfo.get(dirPath);
       info.fileCount++;
-      const ext = path35.extname(file).slice(1);
+      const ext = path36.extname(file).slice(1);
       if (ext) {
         info.extensions.set(ext, (info.extensions.get(ext) ?? 0) + 1);
       }
@@ -8912,7 +9094,7 @@ async function buildChangedFilePreviews(rootDir, changedFiles) {
   return previews2;
 }
 async function getSnapshot(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return unmappedContextResponse(rootDir);
@@ -9013,7 +9195,7 @@ function driftHint(report) {
   return "Read the changed files under staleFeatures/staleFlows, update those entries (fold unmappedFiles into the right features), and call save_snapshot with only the affected entries \u2014 unchanged entries are preserved. Drop ghostFiles from any entries that reference them, and delete features/flows that no longer exist via save_snapshot's removeFeatures/removeFlows.";
 }
 async function checkDrift(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const report = await computeDrift(rootDir);
   if (!report) {
     return JSON.stringify({
@@ -9044,7 +9226,7 @@ async function checkDrift(dir) {
   return JSON.stringify({ exists: true, ...report, verification, hint });
 }
 async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_SIZE, files) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const scoped = files !== void 0 && files.length > 0;
   const scopeFiles = scoped ? sanitizePaths(rootDir, files) : void 0;
   const batch = await prepareSnapshotBatch(dir, offset, batchSize, scopeFiles);
@@ -9091,7 +9273,7 @@ async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_
   );
 }
 async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   for (const feat of Object.values(features)) {
     feat.files = sanitizePaths(rootDir, feat.files);
     if (feat.tests) feat.tests = sanitizePaths(rootDir, feat.tests);
@@ -9120,7 +9302,7 @@ async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
   );
 }
 async function reduceSnapshot(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const partials = await loadAllPartials(rootDir);
   if (partials.length === 0) {
     return JSON.stringify(
@@ -9182,7 +9364,7 @@ async function reduceSnapshot(dir) {
   );
 }
 async function fullAnalysis(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const [analysis, structure, samples, testMap, snapshot] = await Promise.all([
     analyzeProject(dir),
     getProjectStructure(dir),
@@ -9211,7 +9393,7 @@ function sanitizePaths(rootDir, files) {
   return sanitizeRepoPaths(files);
 }
 async function saveSnapshotData(dir, features, flows, removeFeatures = [], removeFlows = []) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   return updateSnapshot(rootDir, async (previous) => {
     const gitHash = await getCurrentGitHash(rootDir);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -9291,14 +9473,14 @@ async function saveSnapshotData(dir, features, flows, removeFeatures = [], remov
   });
 }
 async function getImpact(dir, files) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { analyzeImpact: analyzeImpact2 } = await Promise.resolve().then(() => (init_impact(), impact_exports));
   const result = await analyzeImpact2(rootDir, files);
   return JSON.stringify(result, null, 2);
 }
 var VERIFY_DEFAULT_SAMPLE = 5;
 async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return JSON.stringify({
@@ -9351,7 +9533,7 @@ async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
   });
 }
 async function saveVerification(dir, verdicts) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   return updateSnapshot(rootDir, async (snapshot) => {
     if (!snapshot) {
       return { snapshot: null, result: JSON.stringify({ exists: false, stamped: [], hint: "No concept map exists. Build it and run verify_snapshot before recording verdicts." }) };
@@ -9425,16 +9607,16 @@ async function saveVerification(dir, verdicts) {
   });
 }
 async function saveDecision(dir, input) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { upsertDecision: upsertDecision2 } = await Promise.resolve().then(() => (init_decisions(), decisions_exports));
   const result = await upsertDecision2(rootDir, input);
   return JSON.stringify(result);
 }
 async function reviewDecision2(dir, input) {
-  return JSON.stringify(await reviewDecision(path35.resolve(dir), input));
+  return JSON.stringify(await reviewDecision(path36.resolve(dir), input));
 }
 async function getContext(dir, task, files) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { assembleContext: assembleContext2 } = await Promise.resolve().then(() => (init_assemble(), assemble_exports));
   const bundle = await assembleContext2(rootDir, task, files);
   return JSON.stringify(bundle);
@@ -9483,7 +9665,7 @@ async function masonInit(dir, options = {}) {
     return JSON.stringify(await setupProject2(dir, options), null, 2);
   }
   if (options.host) throw new Error("host applies only to mode: setup.");
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const marker = await loadProjectMarker(rootDir);
   const { loadSetup: loadSetup2 } = await Promise.resolve().then(() => (init_model(), model_exports));
   const setup = await loadSetup2(rootDir);
@@ -9503,7 +9685,7 @@ async function masonInit(dir, options = {}) {
   );
 }
 async function masonCompleteInit(dir, options = {}) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const existing = await loadProjectMarker(rootDir);
   const features = await loadProjectFeatures(rootDir);
   const marker = {
@@ -9612,7 +9794,7 @@ async function masonSetConfluence(input) {
   );
 }
 async function exportToConfluenceTool(dir, overrides) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), config_exports2));
   const { exportToConfluence: exportToConfluence2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
   const config = await loadConfig2();
@@ -9651,7 +9833,7 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.19.0"
+      version: "0.19.1"
     },
     {
       instructions: (setupNotice ? setupNotice + "\n\n" : "") + 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, stale or unknown map verification needs a fresh review, recorded failed verdicts need correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'
@@ -9697,7 +9879,7 @@ function createMcpServer() {
   );
   server.tool(
     "review_advisory",
-    "Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals.",
+    "Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals. For dependency advisories, action dismiss with reasonCode and note records a one-step dismissal without a token or reviewer. no-dependency-claims reopens only on document content changes; unrelated-manifest-change also tracks scoped manifests.",
     { dir: z24.string().describe("Absolute path to the project root"), ...advisoryReviewRequest.shape },
     async ({ dir, ...request }) => ({ content: [{ type: "text", text: await masonReviewAdvisory(dir, request) }] })
   );
@@ -10043,7 +10225,7 @@ async function startMcpServer(onClose) {
 init_store();
 init_storage();
 import fs33 from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 import { spawn as spawn3 } from "child_process";
 import { randomUUID as randomUUID11 } from "crypto";
 import { z as z30 } from "zod";
@@ -10051,7 +10233,7 @@ import { z as z30 } from "zod";
 // src/distribution/state.ts
 init_storage();
 import os5 from "os";
-import path37 from "path";
+import path38 from "path";
 import { fileURLToPath } from "url";
 import fs28 from "fs/promises";
 import { z as z26 } from "zod";
@@ -10059,7 +10241,7 @@ import { z as z26 } from "zod";
 // src/distribution/path.ts
 import fs27 from "fs/promises";
 import os4 from "os";
-import path36 from "path";
+import path37 from "path";
 import { execFile as execFile12 } from "child_process";
 import { promisify as promisify12 } from "util";
 import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
@@ -10074,7 +10256,7 @@ async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path36.posix.isAbsolute(entry) && path36.posix.resolve(entry) === path36.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path37.posix.isAbsolute(entry) && path37.posix.resolve(entry) === path37.posix.resolve(bin));
   const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
   const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
@@ -10094,15 +10276,15 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path36.basename(env.SHELL ?? os4.userInfo().shell ?? "");
+    const shell = path37.basename(env.SHELL ?? os4.userInfo().shell ?? "");
     const userHome = options.userHome ?? os4.homedir();
     let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles2 = [path36.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles2 = [path36.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles2 = [path36.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path37.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path37.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path37.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path36.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path37.join(userHome, name));
       let login = candidates[2];
       for (const file of candidates) if (await fs27.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
@@ -10111,7 +10293,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         login = file;
         break;
       }
-      profiles2 = [path36.join(userHome, ".bashrc"), login];
+      profiles2 = [path37.join(userHome, ".bashrc"), login];
     }
     const marker = `# >>> mason PATH ${createHash7("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles2) {
@@ -10119,7 +10301,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs27.realpath(profile) : path36.resolve(profile);
+      const file = stat?.isSymbolicLink() ? await fs27.realpath(profile) : path37.resolve(profile);
       const original = await fs27.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
@@ -10135,7 +10317,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs27.mkdir(path36.dirname(file), { recursive: true });
+      await fs27.mkdir(path37.dirname(file), { recursive: true });
       const handle = await fs27.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
@@ -10150,7 +10332,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
     return manual(`Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-var normalizeWindowsEntry = (value) => path36.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+var normalizeWindowsEntry = (value) => path37.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
 var hasWindowsEntry = (value, entry, env = process.env) => {
   const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
   const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -10216,9 +10398,9 @@ async function readInstallation(home) {
   return record;
 }
 function standaloneLocation() {
-  const bundle = path37.resolve(path37.dirname(fileURLToPath(import.meta.url)), "../..");
-  const home = path37.dirname(path37.dirname(bundle));
-  if (path37.dirname(bundle) !== path37.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path37.basename(bundle))) {
+  const bundle = path38.resolve(path38.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path38.dirname(path38.dirname(bundle));
+  if (path38.dirname(bundle) !== path38.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path38.basename(bundle))) {
     return null;
   }
   return { home, bundle };
@@ -10245,7 +10427,7 @@ function newerStableVersion(candidate, installed) {
 // src/distribution/bundle.ts
 init_storage();
 import fs29 from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 import { createHash as createHash8 } from "crypto";
 import { z as z27 } from "zod";
 var targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
@@ -10263,7 +10445,7 @@ async function readBundle(root) {
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path38.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path39.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -10289,7 +10471,7 @@ init_storage();
 import fs30 from "fs/promises";
 import { unlinkSync } from "fs";
 import os6 from "os";
-import path39 from "path";
+import path40 from "path";
 import { randomUUID as randomUUID8 } from "crypto";
 import { z as z28 } from "zod";
 var leaseSchema = z28.object({ pid: z28.number().int().positive(), host: z28.string(), bundle: z28.string().regex(/^[a-f0-9]{24}$/) });
@@ -10297,7 +10479,7 @@ var leaseSchema = z28.object({ pid: z28.number().int().positive(), host: z28.str
 // src/distribution/install.ts
 import fs32 from "fs/promises";
 import os8 from "os";
-import path40 from "path";
+import path41 from "path";
 import { execFile as execFile13, spawn as spawn2 } from "child_process";
 import { promisify as promisify13 } from "util";
 import { randomUUID as randomUUID10 } from "crypto";
@@ -10372,13 +10554,13 @@ async function installLocked2(home, source, bundle, progress, options, alreadySt
   if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
   if (!previous) for (const file of await fs32.readdir(home)) {
     if (file === ".install-lock") continue;
-    const directory = path40.join(home, file);
+    const directory = path41.join(home, file);
     const stat = await fs32.lstat(directory);
     if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs32.readdir(directory)).length) {
       throw new Error("Mason installation directory is not empty and has no ownership receipt.");
     }
   }
-  const selectedBin = path40.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path40.join(home, "bin") : path40.join(os8.homedir(), ".local/bin")));
+  const selectedBin = path41.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path41.join(home, "bin") : path41.join(os8.homedir(), ".local/bin")));
   await fs32.mkdir(selectedBin, { recursive: true });
   const bin = await fs32.realpath(selectedBin);
   if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
@@ -10396,10 +10578,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path40.join(destination, "node.exe"))} ${psQuote(path40.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path41.join(destination, "node.exe"))} ${psQuote(path41.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path40.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path41.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -10408,7 +10590,7 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
   } : { mason: `#!/bin/sh
-exec ${shQuote(path40.join(destination, "node"))} ${shQuote(path40.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path41.join(destination, "node"))} ${shQuote(path41.join(destination, "app/dist/mason.js"))} "$@"
 ` };
   for (const [name, content2] of Object.entries(launchers)) {
     const file = await storePath(bin, name);
@@ -10557,8 +10739,8 @@ async function scheduleAutomaticUpdate() {
     if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
     const bundle = await storePath(home, "versions/" + record.current);
     const child = spawn3(
-      path41.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path41.join(bundle, "app/dist/mason.js"), "internal-update"],
+      path42.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path42.join(bundle, "app/dist/mason.js"), "internal-update"],
       { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
     );
     child.on("error", () => {
@@ -10576,8 +10758,8 @@ async function startMcpWithUpdates(start) {
   const session = await prepareStandaloneMcp(current.home);
   if (session.bundle !== current.bundle) {
     const child = spawn3(
-      path41.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path41.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      path42.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path42.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
       { stdio: "inherit", windowsHide: true }
     );
     const interrupt = () => {