mason-context 0.3.7 → 0.7.0

package/dist/mason-audit.js

@@ -0,0 +1,1366 @@
+#!/usr/bin/env node
+
+// src/audit/cli.ts
+import path14 from "path";
+
+// src/audit/audit.ts
+import fs9 from "fs/promises";
+import path13 from "path";
+
+// src/drift/drift.ts
+import fs3 from "fs/promises";
+import path4 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+
+// src/snapshot/snapshot.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+import fg3 from "fast-glob";
+
+// src/mcp/sampler.ts
+import fs from "fs/promises";
+import path from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import fg from "fast-glob";
+var exec = promisify(execFile);
+
+// src/test-map.ts
+import path2 from "path";
+import fg2 from "fast-glob";
+
+// src/snapshot/snapshot.ts
+var exec2 = promisify2(execFile2);
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
+var SOURCE_GLOB = "**/*.{ts,tsx,js,jsx,kt,kts,java,py,go,rs,swift,rb,cs,cpp,c,dart}";
+var SOURCE_IGNORE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.gradle/**",
+  "**/target/**",
+  "**/.git/**",
+  "**/vendor/**",
+  "**/__pycache__/**",
+  "**/venv/**",
+  "**/.venv/**",
+  "**/*.min.*",
+  "**/*.map",
+  "**/generated/**",
+  "**/R.java",
+  "**/BuildConfig.java"
+];
+
+// src/drift/drift.ts
+var exec3 = promisify3(execFile3);
+async function getChangesWithStatus(resolvedRoot, fromHash) {
+  if (!fromHash || fromHash === "unknown") return null;
+  try {
+    const { stdout } = await exec3(
+      "git",
+      ["diff", "--name-status", "-M", fromHash, "HEAD"],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const changes = [];
+    for (const line of stdout.split("\n")) {
+      if (!line.trim()) continue;
+      const parts = line.split("	");
+      if (parts.some((p) => p.startsWith(".mason/"))) continue;
+      const code = parts[0];
+      if (code.startsWith("R") && parts.length >= 3) {
+        changes.push({
+          status: "renamed",
+          path: parts[2],
+          previousPath: parts[1]
+        });
+      } else if (code.startsWith("C") && parts.length >= 3) {
+        changes.push({ status: "added", path: parts[2] });
+      } else if (code === "A" && parts.length >= 2) {
+        changes.push({ status: "added", path: parts[1] });
+      } else if (code === "D" && parts.length >= 2) {
+        changes.push({ status: "deleted", path: parts[1] });
+      } else if (parts.length >= 2) {
+        changes.push({ status: "modified", path: parts[1] });
+      }
+    }
+    return changes;
+  } catch {
+    return null;
+  }
+}
+
+// src/audit/docs.ts
+import fs4 from "fs/promises";
+import path5 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+
+// src/audit/tree.ts
+var MIN_GLYPH_LINES = 3;
+var GLYPHS = ["\u251C\u2500\u2500", "\u2514\u2500\u2500"];
+function glyphIndex(line) {
+  for (const glyph of GLYPHS) {
+    const idx = line.indexOf(glyph);
+    if (idx !== -1) return idx;
+  }
+  return -1;
+}
+function isSpacerLine(line) {
+  return /^[\s│|]*$/.test(line);
+}
+function entryName(afterGlyph) {
+  let name = afterGlyph.replace(/^\s+/, "");
+  const hash = name.search(/\s+#/);
+  if (hash !== -1) name = name.slice(0, hash);
+  const columns = name.search(/\s{2,}/);
+  if (columns !== -1) name = name.slice(0, columns);
+  name = name.trim();
+  if (!name || /\s/.test(name)) return null;
+  return name;
+}
+function extractTreeClaims(blockLines, blockStartLine) {
+  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
+  if (glyphLines < MIN_GLYPH_LINES) return [];
+  const claims = [];
+  const stack = [];
+  let rootPrefix = "";
+  let started = false;
+  for (let i = 0; i < blockLines.length; i++) {
+    const line = blockLines[i];
+    const col = glyphIndex(line);
+    if (col === -1) {
+      if (isSpacerLine(line)) continue;
+      if (!started) {
+        const candidate = line.trim();
+        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
+          rootPrefix = candidate.replace(/\/+$/, "");
+          claims.push({
+            path: rootPrefix,
+            line: blockStartLine + i,
+            excerpt: candidate
+          });
+        }
+        continue;
+      }
+      return claims;
+    }
+    started = true;
+    const name = entryName(line.slice(col + GLYPHS[0].length));
+    if (name === null) return claims;
+    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
+      stack.pop();
+    }
+    const isDir = name.endsWith("/");
+    const cleanName = name.replace(/\/+$/, "");
+    const segments = [
+      ...rootPrefix ? [rootPrefix] : [],
+      ...stack.map((s) => s.name),
+      cleanName
+    ];
+    claims.push({
+      path: segments.join("/"),
+      line: blockStartLine + i,
+      excerpt: name
+    });
+    if (isDir) stack.push({ col, name: cleanName });
+  }
+  return claims;
+}
+
+// src/audit/claims.ts
+var ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "package-lock.json",
+  "pnpm-workspace.yaml",
+  "tsconfig.json",
+  "tsup.config.ts",
+  "vitest.config.ts",
+  "Makefile",
+  "Dockerfile",
+  "docker-compose.yml",
+  "Cargo.toml",
+  "go.mod",
+  "go.sum",
+  "pyproject.toml",
+  "requirements.txt",
+  "Gemfile",
+  "composer.json",
+  "settings.gradle.kts",
+  "settings.gradle",
+  "build.gradle.kts",
+  "build.gradle",
+  "manifest.json",
+  "server.json",
+  "README.md",
+  "CHANGELOG.md",
+  "LICENSE",
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".gitignore",
+  ".env.example"
+]);
+var SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+var COMMAND_RE = /\b(npm|pnpm|yarn)\s+run\s+([A-Za-z0-9:_.-]+)/g;
+var COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+var COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+var IGNORE_LINE = "<!-- mason:ignore -->";
+var IGNORE_START = "<!-- mason:ignore-start -->";
+var IGNORE_END = "<!-- mason:ignore-end -->";
+function normalizePathToken(token) {
+  let t = token.trim();
+  if (!t) return null;
+  if (/\s/.test(t)) return null;
+  if (t.includes("://") || t.includes("\\")) return null;
+  if (/[*?[\]{}<>$`]/.test(t)) return null;
+  if (t.startsWith("/") || t.startsWith("~") || t.startsWith("./") || t.startsWith("../")) {
+    return null;
+  }
+  t = t.replace(/:\d+(?:-\d+)?$/, "");
+  if (t.includes(":")) return null;
+  const normalized = t.replace(/\/+$/, "");
+  if (!normalized) return null;
+  if (normalized.includes("/")) return normalized;
+  return ROOT_FILE_NAMES.has(normalized) ? normalized : null;
+}
+function exactTokenPath(line) {
+  const trimmed = line.trim();
+  if (!trimmed || /\s/.test(trimmed) || !trimmed.includes("/")) return null;
+  return normalizePathToken(trimmed);
+}
+function computeIgnoredLines(lines) {
+  const ignored = new Array(lines.length).fill(false);
+  let inRegion = false;
+  let ignoreNext = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.includes(IGNORE_START)) {
+      inRegion = true;
+      ignored[i] = true;
+      continue;
+    }
+    if (line.includes(IGNORE_END)) {
+      inRegion = false;
+      ignored[i] = true;
+      continue;
+    }
+    if (inRegion) {
+      ignored[i] = true;
+      continue;
+    }
+    if (ignoreNext) {
+      if (line.trim().length === 0) continue;
+      ignored[i] = true;
+      ignoreNext = false;
+      continue;
+    }
+    if (line.includes(IGNORE_LINE)) {
+      ignored[i] = true;
+      const rest = line.replace(IGNORE_LINE, "").trim();
+      if (rest.length === 0) ignoreNext = true;
+    }
+  }
+  return ignored;
+}
+function extractClaims(content) {
+  const lines = content.split("\n");
+  const ignored = computeIgnoredLines(lines);
+  const paths = /* @__PURE__ */ new Map();
+  const counts = [];
+  const commands = /* @__PURE__ */ new Map();
+  const addPath = (claim) => {
+    if (!paths.has(claim.path)) paths.set(claim.path, claim);
+  };
+  const addCommand = (claim) => {
+    if (!commands.has(claim.scriptName)) commands.set(claim.scriptName, claim);
+  };
+  let inFence = false;
+  let fenceInfo = "";
+  let fenceMarker = "";
+  let blockLines = [];
+  let blockStartLine = 0;
+  const processBlock = () => {
+    for (const claim of extractTreeClaims(blockLines, blockStartLine)) {
+      addPath(claim);
+    }
+    for (let i = 0; i < blockLines.length; i++) {
+      const exact = exactTokenPath(blockLines[i]);
+      if (exact) {
+        addPath({
+          path: exact,
+          line: blockStartLine + i,
+          excerpt: blockLines[i].trim()
+        });
+      }
+    }
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    const fenceMatch = line.match(/^\s*(```+|~~~+)(.*)$/);
+    if (fenceMatch) {
+      if (!inFence) {
+        inFence = true;
+        fenceMarker = fenceMatch[1][0];
+        fenceInfo = fenceMatch[2].trim().toLowerCase();
+        blockLines = [];
+        blockStartLine = lineNo + 1;
+      } else if (fenceMatch[1][0] === fenceMarker) {
+        inFence = false;
+        processBlock();
+      }
+      continue;
+    }
+    if (inFence) {
+      blockLines.push(ignored[i] ? "" : line);
+      if (!ignored[i] && SHELL_FENCE_INFOS.has(fenceInfo)) {
+        for (const m of line.matchAll(COMMAND_RE)) {
+          addCommand({
+            scriptName: m[2],
+            invocation: m[0],
+            line: lineNo,
+            excerpt: m[0]
+          });
+        }
+      }
+      continue;
+    }
+    if (ignored[i]) continue;
+    for (const m of line.matchAll(/`([^`]+)`/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(/"([A-Za-z][\w.@-]*(?:\/[\w.@-]+)+\/?)"/g)) {
+      const normalized = normalizePathToken(m[1]);
+      if (normalized) {
+        addPath({ path: normalized, line: lineNo, excerpt: m[1] });
+      }
+    }
+    for (const m of line.matchAll(COUNT_RE)) {
+      const rest = line.slice((m.index ?? 0) + m[0].length);
+      if (COUNT_DENYLIST_RE.test(rest)) continue;
+      counts.push({
+        count: Number.parseInt(m[1], 10),
+        unit: m[2].toLowerCase(),
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+    for (const m of line.matchAll(COMMAND_RE)) {
+      addCommand({
+        scriptName: m[2],
+        invocation: m[0],
+        line: lineNo,
+        excerpt: m[0]
+      });
+    }
+  }
+  if (inFence) processBlock();
+  return {
+    paths: [...paths.values()],
+    counts,
+    commands: [...commands.values()]
+  };
+}
+
+// src/audit/git.ts
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+var exec4 = promisify4(execFile4);
+var COMMIT_FORMAT = "%H%x09%cI%x09%s";
+function parseCommitLine(line) {
+  const parts = line.split("	");
+  if (parts.length < 3 || !parts[0]) return null;
+  return { hash: parts[0], date: parts[1], subject: parts.slice(2).join("	") };
+}
+async function lastCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function deletingCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      [
+        "log",
+        "-1",
+        "--diff-filter=D",
+        `--format=${COMMIT_FORMAT}`,
+        "--",
+        relPath
+      ],
+      { cwd: resolvedRoot }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function firstCommitOf(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec4(
+      "git",
+      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const line = stdout.trim().split("\n")[0];
+    return line ? parseCommitLine(line) : null;
+  } catch {
+    return null;
+  }
+}
+async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
+  if (!fromHash || fromHash === "unknown") return null;
+  try {
+    const { stdout } = await exec4(
+      "git",
+      [
+        "log",
+        `${fromHash}..HEAD`,
+        `--format=%x01${COMMIT_FORMAT}`,
+        "--name-only",
+        "--",
+        ...pathspecs
+      ],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const commits = [];
+    for (const block of stdout.split("
")) {
+      if (!block.trim()) continue;
+      const lines = block.split("\n").filter((l) => l.trim().length > 0);
+      const ref = parseCommitLine(lines[0]);
+      if (!ref) continue;
+      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
+    }
+    return { commits, total: commits.length };
+  } catch {
+    return null;
+  }
+}
+
+// src/audit/docs.ts
+var exec5 = promisify5(execFile5);
+var DOC_CANDIDATES = [
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".claude/CLAUDE.md"
+];
+async function isDirty(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec5(
+      "git",
+      ["status", "--porcelain", "--", relPath],
+      { cwd: resolvedRoot }
+    );
+    return stdout.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+async function discoverDocs(resolvedRoot) {
+  const docs = [];
+  for (const candidate of DOC_CANDIDATES) {
+    let content;
+    try {
+      content = await fs4.readFile(path5.join(resolvedRoot, candidate), "utf-8");
+    } catch {
+      continue;
+    }
+    docs.push({
+      path: candidate,
+      content,
+      lineCount: content.split("\n").length,
+      lastCommit: await lastCommitOf(resolvedRoot, candidate),
+      dirty: await isDirty(resolvedRoot, candidate),
+      claims: extractClaims(content)
+    });
+  }
+  return docs;
+}
+
+// src/audit/types.ts
+var ALL_CHECKS = [
+  "deleted-reference",
+  "new-module",
+  "stale-count",
+  "dead-command",
+  "deps-changed",
+  "decision-anchor-drift"
+];
+
+// src/audit/checks/deleted-reference.ts
+import fs5 from "fs/promises";
+import path6 from "path";
+async function exists(absPath) {
+  try {
+    await fs5.access(absPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkDeletedReferences(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    const changes = ctx.changesSinceDoc.get(doc.path);
+    const renames = /* @__PURE__ */ new Map();
+    for (const change of changes ?? []) {
+      if (change.status === "renamed" && change.previousPath) {
+        renames.set(change.previousPath, change.path);
+      }
+    }
+    for (const claim of doc.claims.paths) {
+      if (claim.path === ".mason" || claim.path.startsWith(".mason/")) {
+        continue;
+      }
+      if (await exists(path6.join(ctx.root, claim.path))) continue;
+      const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
+      const renamedTo = renames.get(claim.path) ?? null;
+      if (renamedTo) {
+        result.issues.push({
+          type: "deleted-reference",
+          message: `\`${claim.path}\` was renamed to \`${renamedTo}\``,
+          anchor,
+          confidence: "certain",
+          evidence: {
+            kind: "missing-path",
+            claimed: claim.path,
+            renamedTo,
+            deletedInCommit: null,
+            everTracked: true,
+            parentDirExists: true
+          }
+        });
+        continue;
+      }
+      const tracked = await lastCommitOf(ctx.root, claim.path);
+      if (tracked) {
+        const deleted = await deletingCommitOf(ctx.root, claim.path);
+        const detail = deleted ? ` \u2013 deleted in ${deleted.hash.slice(0, 7)} "${deleted.subject}" (${deleted.date.slice(0, 10)})` : "";
+        result.issues.push({
+          type: "deleted-reference",
+          message: `\`${claim.path}\` no longer exists${detail}`,
+          anchor,
+          confidence: "certain",
+          evidence: {
+            kind: "missing-path",
+            claimed: claim.path,
+            renamedTo: null,
+            deletedInCommit: deleted,
+            everTracked: true,
+            parentDirExists: await exists(
+              path6.join(ctx.root, path6.dirname(claim.path))
+            )
+          }
+        });
+        continue;
+      }
+      const parentDirExists = await exists(
+        path6.join(ctx.root, path6.dirname(claim.path))
+      );
+      if (!parentDirExists) continue;
+      const issue = {
+        type: "deleted-reference",
+        message: `\`${claim.path}\` does not exist (never tracked in git \u2013 possible typo or invented path)`,
+        anchor,
+        confidence: "likely",
+        evidence: {
+          kind: "missing-path",
+          claimed: claim.path,
+          renamedTo: null,
+          deletedInCommit: null,
+          everTracked: false,
+          parentDirExists: true
+        }
+      };
+      result.issues.push(issue);
+    }
+  }
+  return result;
+}
+
+// src/audit/checks/new-module.ts
+import fg4 from "fast-glob";
+import path7 from "path";
+var DIR_DENYLIST = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "target",
+  "vendor",
+  "__pycache__",
+  "venv",
+  ".venv",
+  ".git",
+  ".gradle",
+  ".mason",
+  ".claude",
+  ".github",
+  ".vscode",
+  ".idea"
+]);
+var SECOND_LEVEL_MIN_SOURCE_FILES = 2;
+var ENUMERATION_THRESHOLD = 2;
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isMentioned(combinedDocs, name) {
+  const re = new RegExp(
+    `(^|[^A-Za-z0-9_-])${escapeRegExp(name)}(/|[^A-Za-z0-9_-]|$)`,
+    "im"
+  );
+  return re.test(combinedDocs);
+}
+async function listSubdirs(absDir) {
+  const dirs = await fg4("*", {
+    cwd: absDir,
+    onlyDirectories: true,
+    suppressErrors: true
+  });
+  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
+}
+async function countSourceFiles(absDir) {
+  const files = await fg4(SOURCE_GLOB, {
+    cwd: absDir,
+    ignore: SOURCE_IGNORE,
+    suppressErrors: true
+  });
+  return files.length;
+}
+async function checkNewModules(ctx) {
+  const result = emptyResult();
+  if (ctx.docs.length === 0) return result;
+  const combinedDocs = ctx.docs.map((d) => d.content).join("\n");
+  const primaryDoc = ctx.docs[0].path;
+  const checkedDocs = ctx.docs.map((d) => d.path);
+  const flag = async (dir, sourceFileCount) => {
+    result.issues.push({
+      type: "new-module",
+      message: `directory \`${dir}/\` contains ${sourceFileCount} source file${sourceFileCount === 1 ? "" : "s"} but is not mentioned in any context file`,
+      anchor: { doc: primaryDoc, line: null, excerpt: dir },
+      confidence: "likely",
+      evidence: {
+        kind: "unmentioned-dir",
+        dir,
+        sourceFileCount,
+        firstCommit: await firstCommitOf(ctx.root, dir),
+        checkedDocs
+      }
+    });
+  };
+  for (const topDir of await listSubdirs(ctx.root)) {
+    const absTop = path7.join(ctx.root, topDir);
+    const topMentioned = isMentioned(combinedDocs, topDir);
+    if (!topMentioned) {
+      const count = await countSourceFiles(absTop);
+      if (count >= 1) await flag(topDir, count);
+      continue;
+    }
+    const subdirs = await listSubdirs(absTop);
+    const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
+    if (mentioned.length < ENUMERATION_THRESHOLD) continue;
+    for (const sub of subdirs) {
+      if (isMentioned(combinedDocs, sub)) continue;
+      const count = await countSourceFiles(path7.join(absTop, sub));
+      if (count >= SECOND_LEVEL_MIN_SOURCE_FILES) {
+        await flag(`${topDir}/${sub}`, count);
+      }
+    }
+  }
+  return result;
+}
+
+// src/audit/checks/stale-count.ts
+import fs6 from "fs/promises";
+import path8 from "path";
+import fg5 from "fast-glob";
+var MEMBERS_CAP = 50;
+async function readIfExists(absPath) {
+  try {
+    return await fs6.readFile(absPath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function countGradleModules(root) {
+  for (const name of ["settings.gradle.kts", "settings.gradle"]) {
+    const content = await readIfExists(path8.join(root, name));
+    if (content === null) continue;
+    const members = [];
+    for (const call of content.matchAll(/include\s*\(([^)]*)\)/g)) {
+      for (const proj of call[1].matchAll(/["']([^"']+)["']/g)) {
+        members.push(proj[1]);
+      }
+    }
+    if (members.length === 0) return null;
+    return { actual: members.length, countedFrom: name, members };
+  }
+  return null;
+}
+async function countNpmWorkspaces(root) {
+  const pkgRaw = await readIfExists(path8.join(root, "package.json"));
+  if (pkgRaw !== null) {
+    try {
+      const pkg = JSON.parse(pkgRaw);
+      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
+      if (globs.length > 0) {
+        const matched = await fg5(
+          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+          { cwd: root, ignore: ["**/node_modules/**"] }
+        );
+        return {
+          actual: matched.length,
+          countedFrom: "package.json workspaces",
+          members: matched.map((m) => path8.dirname(m)).sort()
+        };
+      }
+    } catch {
+    }
+  }
+  const pnpmRaw = await readIfExists(path8.join(root, "pnpm-workspace.yaml"));
+  if (pnpmRaw !== null) {
+    const globs = [];
+    let inPackages = false;
+    for (const line of pnpmRaw.split("\n")) {
+      if (/^packages\s*:/.test(line)) {
+        inPackages = true;
+        continue;
+      }
+      if (inPackages) {
+        const entry = line.match(/^\s*-\s*["']?([^"'#\s]+)/);
+        if (entry) {
+          if (!entry[1].startsWith("!")) globs.push(entry[1]);
+        } else if (line.trim().length > 0 && !line.startsWith(" ")) {
+          inPackages = false;
+        }
+      }
+    }
+    if (globs.length > 0) {
+      const matched = await fg5(
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { cwd: root, ignore: ["**/node_modules/**"] }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "pnpm-workspace.yaml",
+        members: matched.map((m) => path8.dirname(m)).sort()
+      };
+    }
+  }
+  return null;
+}
+async function countCargoCrates(root) {
+  const content = await readIfExists(path8.join(root, "Cargo.toml"));
+  if (content === null) return null;
+  const membersBlock = content.match(/members\s*=\s*\[([\s\S]*?)\]/);
+  if (!membersBlock) return null;
+  const entries = [...membersBlock[1].matchAll(/["']([^"']+)["']/g)].map(
+    (m) => m[1]
+  );
+  if (entries.length === 0) return null;
+  const members = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (/[*?[\]{}]/.test(entry)) {
+      const matched = await fg5(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        cwd: root,
+        ignore: ["**/target/**"]
+      });
+      for (const m of matched) members.add(path8.dirname(m));
+    } else if (await readIfExists(path8.join(root, entry, "Cargo.toml")) !== null) {
+      members.add(entry);
+    }
+  }
+  if (members.size === 0) return null;
+  return {
+    actual: members.size,
+    countedFrom: "Cargo.toml workspace members",
+    members: [...members].sort()
+  };
+}
+async function resolveCountSource(root, claim) {
+  const unit = claim.unit.replace(/s$/, "");
+  if (unit === "module") return countGradleModules(root);
+  if (unit === "workspace") return countNpmWorkspaces(root);
+  if (unit === "crate") return countCargoCrates(root);
+  return await countNpmWorkspaces(root) ?? await countCargoCrates(root) ?? await countGradleModules(root);
+}
+async function checkStaleCounts(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    for (const claim of doc.claims.counts) {
+      const source = await resolveCountSource(ctx.root, claim);
+      if (source === null || source.actual === claim.count) continue;
+      result.issues.push({
+        type: "stale-count",
+        message: `says "${claim.excerpt}" but ${source.countedFrom} resolves to ${source.actual}`,
+        anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
+        confidence: "certain",
+        evidence: {
+          kind: "count-mismatch",
+          claimed: claim.count,
+          actual: source.actual,
+          unit: claim.unit,
+          countedFrom: source.countedFrom,
+          members: source.members.slice(0, MEMBERS_CAP)
+        }
+      });
+    }
+  }
+  return result;
+}
+
+// src/audit/checks/dead-command.ts
+import fs7 from "fs/promises";
+import path9 from "path";
+import fg6 from "fast-glob";
+var AVAILABLE_SCRIPTS_CAP = 30;
+async function scriptsOf(absManifest) {
+  try {
+    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
+  } catch {
+    return null;
+  }
+}
+async function checkDeadCommands(ctx) {
+  const result = emptyResult();
+  const commandClaims = ctx.docs.flatMap(
+    (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
+  );
+  if (commandClaims.length === 0) return result;
+  const rootScripts = await scriptsOf(path9.join(ctx.root, "package.json"));
+  if (rootScripts === null) {
+    result.skipped.push({
+      check: "dead-command",
+      reason: "no package.json at the repo root"
+    });
+    return result;
+  }
+  const rootSet = new Set(rootScripts);
+  let workspaceScripts = null;
+  let manifestsChecked = ["package.json"];
+  const loadWorkspaceScripts = async () => {
+    if (workspaceScripts !== null) return workspaceScripts;
+    workspaceScripts = /* @__PURE__ */ new Set();
+    const manifests = await fg6("**/package.json", {
+      cwd: ctx.root,
+      ignore: [
+        "**/node_modules/**",
+        "**/dist/**",
+        "**/build/**",
+        "package.json"
+      ]
+    });
+    manifestsChecked = ["package.json", ...manifests.sort()];
+    for (const manifest of manifests) {
+      const scripts = await scriptsOf(path9.join(ctx.root, manifest));
+      for (const name of scripts ?? []) workspaceScripts.add(name);
+    }
+    return workspaceScripts;
+  };
+  for (const { doc, claim } of commandClaims) {
+    if (rootSet.has(claim.scriptName)) continue;
+    const elsewhere = await loadWorkspaceScripts();
+    if (elsewhere.has(claim.scriptName)) continue;
+    result.issues.push({
+      type: "dead-command",
+      message: `\`${claim.invocation}\` refers to script "${claim.scriptName}", which exists in no package.json`,
+      anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
+      confidence: "certain",
+      evidence: {
+        kind: "missing-script",
+        scriptName: claim.scriptName,
+        invocation: claim.invocation,
+        manifestsChecked,
+        availableScripts: rootScripts.slice(0, AVAILABLE_SCRIPTS_CAP)
+      }
+    });
+  }
+  return result;
+}
+
+// src/audit/checks/deps-changed.ts
+var MANIFEST_COMMITS_CAP = 10;
+var MANIFEST_PATHSPECS = [
+  ":(glob)**/package.json",
+  ":(glob)**/build.gradle.kts",
+  ":(glob)**/build.gradle",
+  "settings.gradle.kts",
+  "settings.gradle",
+  "gradle/libs.versions.toml",
+  ":(glob)**/Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "requirements.txt",
+  "Gemfile",
+  "composer.json"
+];
+async function checkDepsChanged(ctx) {
+  const result = emptyResult();
+  for (const doc of ctx.docs) {
+    if (!doc.lastCommit) {
+      result.skipped.push({
+        check: "deps-changed",
+        reason: `${doc.path} has no commit history`
+      });
+      continue;
+    }
+    if (doc.dirty) {
+      result.skipped.push({
+        check: "deps-changed",
+        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+      });
+      continue;
+    }
+    const range = await commitsTouchingSince(
+      ctx.root,
+      doc.lastCommit.hash,
+      MANIFEST_PATHSPECS
+    );
+    if (range === null) {
+      result.skipped.push({
+        check: "deps-changed",
+        reason: `${doc.path}: commit range unreachable (shallow clone?)`
+      });
+      continue;
+    }
+    if (range.total === 0) continue;
+    const latest = range.commits[0];
+    result.advisories.push({
+      type: "deps-changed",
+      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
+      anchor: { doc: doc.path, line: null, excerpt: null },
+      evidence: {
+        kind: "doc-behind-manifests",
+        docLastCommit: doc.lastCommit,
+        manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
+        totalCommits: range.total
+      }
+    });
+  }
+  return result;
+}
+
+// src/decisions/drift.ts
+import path12 from "path";
+
+// src/decisions/decisions.ts
+import fs8 from "fs/promises";
+import path11 from "path";
+import { createHash } from "crypto";
+
+// src/context/lexical.ts
+import path10 from "path";
+
+// src/decisions/decisions.ts
+function decisionsDir(rootDir) {
+  return path11.join(rootDir, ".mason", "decisions");
+}
+async function loadDecisions(rootDir) {
+  let entries;
+  try {
+    entries = await fs8.readdir(decisionsDir(rootDir));
+  } catch {
+    return [];
+  }
+  const records = [];
+  for (const entry of entries) {
+    if (!entry.endsWith(".json")) continue;
+    try {
+      const raw = await fs8.readFile(
+        path11.join(decisionsDir(rootDir), entry),
+        "utf-8"
+      );
+      const parsed = JSON.parse(raw);
+      if (parsed.version !== 1 || !parsed.id || !parsed.title || !parsed.body) {
+        continue;
+      }
+      records.push(parsed);
+    } catch {
+      continue;
+    }
+  }
+  return records.sort((a, b) => a.id.localeCompare(b.id));
+}
+
+// src/decisions/drift.ts
+async function computeDecisionDrift(rootDir, decisions) {
+  const resolvedRoot = path12.resolve(rootDir);
+  const records = decisions ?? await loadDecisions(resolvedRoot);
+  const report = {
+    historyAvailable: true,
+    totalDecisions: records.length,
+    staleDecisions: {}
+  };
+  const head = await getCurrentGitHash(resolvedRoot);
+  const changesByHash = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    if (record.status !== "active" || record.files.length === 0) continue;
+    if (record.refreshedHash === head) continue;
+    let touched = changesByHash.get(record.refreshedHash);
+    if (touched === void 0) {
+      const changes = await getChangesWithStatus(
+        resolvedRoot,
+        record.refreshedHash
+      );
+      if (changes === null) {
+        touched = null;
+      } else {
+        touched = /* @__PURE__ */ new Set();
+        for (const change of changes) {
+          touched.add(change.path);
+          if (change.previousPath) touched.add(change.previousPath);
+        }
+      }
+      changesByHash.set(record.refreshedHash, touched);
+    }
+    if (touched === null) {
+      report.historyAvailable = false;
+      continue;
+    }
+    const hits = record.files.filter((f) => touched.has(f));
+    if (hits.length > 0) {
+      report.staleDecisions[record.id] = hits;
+    }
+  }
+  return report;
+}
+
+// src/audit/checks/decision-anchor.ts
+async function checkDecisionAnchors(ctx) {
+  const result = emptyResult();
+  if (!ctx.decisionsPresent) return result;
+  const records = await loadDecisions(ctx.root);
+  const drift = await computeDecisionDrift(ctx.root, records);
+  if (!drift.historyAvailable) {
+    result.skipped.push({
+      check: "decision-anchor-drift",
+      reason: "some decision base commits are unreachable (shallow clone?)"
+    });
+  }
+  const byId = new Map(records.map((r) => [r.id, r]));
+  for (const [id, changedFiles] of Object.entries(drift.staleDecisions)) {
+    const record = byId.get(id);
+    if (!record) continue;
+    result.advisories.push({
+      type: "decision-anchor-drift",
+      message: `decision "${record.title}" has anchor files that changed since it was verified \u2013 needs human re-verification`,
+      anchor: {
+        doc: `.mason/decisions/${id}.json`,
+        line: null,
+        excerpt: record.title
+      },
+      evidence: {
+        kind: "decision-anchor",
+        decisionId: id,
+        title: record.title,
+        changedFiles,
+        refreshedHash: record.refreshedHash
+      }
+    });
+  }
+  return result;
+}
+
+// src/audit/checks/index.ts
+var CHECKS = {
+  "deleted-reference": checkDeletedReferences,
+  "new-module": checkNewModules,
+  "stale-count": checkStaleCounts,
+  "dead-command": checkDeadCommands,
+  "deps-changed": checkDepsChanged,
+  "decision-anchor-drift": checkDecisionAnchors
+};
+function emptyResult() {
+  return { issues: [], advisories: [], skipped: [] };
+}
+
+// src/audit/audit.ts
+async function computeAudit(rootDir, options = {}) {
+  const resolvedRoot = path13.resolve(rootDir);
+  const docs = await discoverDocs(resolvedRoot);
+  if (docs.length === 0) return null;
+  const headHash = await getCurrentGitHash(resolvedRoot);
+  const report = {
+    version: 1,
+    root: resolvedRoot,
+    gitAvailable: headHash !== "unknown",
+    docs: docs.map((d) => ({
+      path: d.path,
+      lastCommit: d.lastCommit,
+      dirty: d.dirty,
+      lineCount: d.lineCount
+    })),
+    decisionsChecked: false,
+    issues: [],
+    advisories: [],
+    skippedChecks: [],
+    clean: true
+  };
+  if (!report.gitAvailable) return report;
+  const changesSinceDoc = /* @__PURE__ */ new Map();
+  for (const doc of docs) {
+    changesSinceDoc.set(
+      doc.path,
+      doc.lastCommit ? await getChangesWithStatus(resolvedRoot, doc.lastCommit.hash) : null
+    );
+  }
+  let decisionsPresent = false;
+  try {
+    await fs9.access(path13.join(resolvedRoot, ".mason", "decisions"));
+    decisionsPresent = true;
+  } catch {
+  }
+  report.decisionsChecked = decisionsPresent;
+  const ctx = {
+    root: resolvedRoot,
+    docs,
+    headHash,
+    changesSinceDoc,
+    decisionsPresent
+  };
+  const selected = options.checks ?? ALL_CHECKS;
+  for (const name of ALL_CHECKS) {
+    if (!selected.includes(name)) continue;
+    const { issues, advisories, skipped } = await CHECKS[name](ctx);
+    report.issues.push(...issues);
+    report.advisories.push(...advisories);
+    report.skippedChecks.push(...skipped);
+  }
+  report.clean = report.issues.length === 0;
+  return report;
+}
+
+// src/audit/cli.ts
+var USAGE = `Usage: mason-audit [--dir <path>] [--json | --fix-prompt] [--checks <list>]
+
+Audits the repo's AI context files (CLAUDE.md, .claude/CLAUDE.md, AGENTS.md)
+against repo reality: referenced paths that no longer exist, undocumented
+modules, stale counts, dead npm scripts, and manifests newer than the doc.
+Deterministic: no LLM call, no network \u2013 safe for CI. Works on any repo with
+a context file; no Mason setup required.
+
+Options:
+  --dir <path>     Project root to audit (default: current directory)
+  --json           Print the full audit report as JSON (additive-only schema)
+  --fix-prompt     When issues exist, print a work order for ANY coding agent
+                   (Claude, Codex, Gemini, ...) \u2013 pipe it to your agent CLI to
+                   close the loop. Prints the clean summary when there are none.
+  --checks <list>  Comma-separated subset of checks to run (default: all):
+                   ${ALL_CHECKS.join(", ")}
+  --help           Show this help
+
+Exit codes:
+  0  no issues (advisories may still be present)
+  1  provable issues found
+  2  error (no context file, not a git repository, bad arguments)`;
+function parseArgs(argv) {
+  const parsed = {
+    dir: process.cwd(),
+    json: false,
+    fixPrompt: false,
+    help: false,
+    checks: void 0
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--json") {
+      parsed.json = true;
+    } else if (arg === "--fix-prompt") {
+      parsed.fixPrompt = true;
+    } else if (arg === "--help" || arg === "-h") {
+      parsed.help = true;
+    } else if (arg === "--dir") {
+      const value = argv[++i];
+      if (!value) throw new Error("--dir requires a path argument");
+      parsed.dir = value;
+    } else if (arg === "--checks") {
+      const value = argv[++i];
+      if (!value) throw new Error("--checks requires a comma-separated list");
+      const names = value.split(",").map((n) => n.trim()).filter(Boolean);
+      for (const name of names) {
+        if (!ALL_CHECKS.includes(name)) {
+          throw new Error(
+            `Unknown check: ${name} (valid: ${ALL_CHECKS.join(", ")})`
+          );
+        }
+      }
+      parsed.checks = names;
+    } else if (!arg.startsWith("-") && parsed.dir === process.cwd()) {
+      parsed.dir = arg;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  return parsed;
+}
+function issueLine(issue) {
+  const where = issue.anchor.line !== null ? `line ${issue.anchor.line}` : "doc-level";
+  const likely = issue.confidence === "likely" ? " (likely)" : "";
+  return `  [${issue.type}]${likely} ${where}: ${issue.message}`;
+}
+function formatAuditSummary(report) {
+  const lines = [];
+  for (const doc of report.docs) {
+    const docIssues = report.issues.filter((i) => i.anchor.doc === doc.path);
+    const committed = doc.lastCommit ? `last committed ${doc.lastCommit.date.slice(0, 10)}, ${doc.lastCommit.hash.slice(0, 7)}` : "untracked";
+    if (docIssues.length === 0) {
+      lines.push(`${doc.path} \u2013 clean (${committed})`);
+      continue;
+    }
+    lines.push(
+      `${doc.path} \u2013 ${docIssues.length} issue${docIssues.length === 1 ? "" : "s"} (${committed})`
+    );
+    for (const issue of docIssues) lines.push(issueLine(issue));
+  }
+  const docPaths = new Set(report.docs.map((d) => d.path));
+  for (const issue of report.issues) {
+    if (!docPaths.has(issue.anchor.doc)) lines.push(issueLine(issue));
+  }
+  if (report.advisories.length > 0) {
+    lines.push("Advisories (do not affect the exit code):");
+    for (const advisory of report.advisories) {
+      lines.push(`  [${advisory.type}] ${advisory.anchor.doc}: ${advisory.message}`);
+    }
+  }
+  if (report.skippedChecks.length > 0) {
+    for (const skip of report.skippedChecks) {
+      lines.push(`  [skipped] ${skip.check}: ${skip.reason}`);
+    }
+  }
+  lines.push(
+    report.clean ? `Context files are clean (${report.docs.length} doc${report.docs.length === 1 ? "" : "s"} audited).` : `${report.issues.length} issue${report.issues.length === 1 ? "" : "s"} across ${report.docs.length} doc${report.docs.length === 1 ? "" : "s"}.`
+  );
+  return lines.join("\n");
+}
+function formatFixPrompt(report) {
+  const flaggedDocs = [...new Set(report.issues.map((i) => i.anchor.doc))];
+  const lines = [];
+  lines.push(
+    "The AI context files in this repository contain claims that are provably out of date. Fix ONLY the flagged claims. Work autonomously; do not ask questions."
+  );
+  lines.push("");
+  lines.push("RULES:");
+  lines.push(
+    `- Edit ONLY these files: ${flaggedDocs.join(", ")}. Never modify source code, configs, or anything else \u2013 the docs must be brought to match the code, not the other way around.`
+  );
+  lines.push(
+    "- Keep diffs minimal: change the smallest span that makes each claim true."
+  );
+  lines.push(
+    "- Never invent content. Every replacement must be grounded in the evidence below or in files you read from this repository."
+  );
+  lines.push(
+    "- deleted-reference: if evidence shows renamedTo, update the path; otherwise remove the reference, or rephrase to past tense if the sentence is about history. Deleted paths inside directory trees: delete the tree line."
+  );
+  lines.push(
+    "- stale-count: replace the number with the actual count from the evidence."
+  );
+  lines.push(
+    "- dead-command: replace with the correct script from availableScripts if an obvious rename exists; otherwise remove the command mention."
+  );
+  lines.push(
+    "- new-module: add a one-line factual mention of the directory where sibling modules are described; read the directory's files first and describe only what you verified."
+  );
+  lines.push(
+    "- Do NOT touch anything listed under ADVISORIES \u2013 list them in your summary for human review instead."
+  );
+  lines.push("");
+  lines.push("AUDIT REPORT (deterministic, computed against git HEAD):");
+  lines.push(
+    JSON.stringify(
+      { issues: report.issues, advisories: report.advisories },
+      null,
+      2
+    )
+  );
+  lines.push("");
+  lines.push(
+    "Finish by summarizing each edit and citing the evidence item it resolves."
+  );
+  return lines.join("\n");
+}
+async function runAuditCli(argv, io = {
+  out: (line) => process.stdout.write(`${line}
+`),
+  err: (line) => process.stderr.write(`${line}
+`)
+}) {
+  let args;
+  try {
+    args = parseArgs(argv);
+    if (args.json && args.fixPrompt) {
+      throw new Error("--json and --fix-prompt are mutually exclusive");
+    }
+  } catch (error) {
+    io.err(error instanceof Error ? error.message : String(error));
+    io.err(USAGE);
+    return 2;
+  }
+  if (args.help) {
+    io.out(USAGE);
+    return 0;
+  }
+  const rootDir = path14.resolve(args.dir);
+  const report = await computeAudit(rootDir, { checks: args.checks });
+  if (!report) {
+    io.err(
+      `No CLAUDE.md, .claude/CLAUDE.md, or AGENTS.md found in ${rootDir}.`
+    );
+    return 2;
+  }
+  if (!report.gitAvailable) {
+    io.err(
+      `Could not determine git HEAD in ${rootDir} \u2013 not a git repository, or git is unavailable.`
+    );
+    return 2;
+  }
+  if (args.fixPrompt) {
+    io.out(
+      report.clean ? formatAuditSummary(report) : formatFixPrompt(report)
+    );
+    return report.clean ? 0 : 1;
+  }
+  if (args.json) {
+    io.out(JSON.stringify(report, null, 2));
+  } else {
+    io.out(formatAuditSummary(report));
+  }
+  return report.clean ? 0 : 1;
+}
+
+// bin/mason-audit.ts
+runAuditCli(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    process.stderr.write(`mason-audit error: ${err}
+`);
+    process.exit(2);
+  }
+);
+//# sourceMappingURL=mason-audit.js.map