mason-context 0.9.0 → 0.10.0

package/dist/mason-drift.js

@@ -1,62 +1,53 @@
 #!/usr/bin/env node
 
 // src/drift/cli.ts
-import path8 from "path";
+import path10 from "path";
 
 // src/drift/drift.ts
 import fs3 from "fs/promises";
-import path4 from "path";
+import path6 from "path";
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
 // src/snapshot/snapshot.ts
-import fs2 from "fs/promises";
-import path3 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fg3 from "fast-glob";
 
-// src/mcp/sampler.ts
+// src/utils/files.ts
 import fs from "fs/promises";
-import path from "path";
+import { constants } from "fs";
+import path2 from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import fg from "fast-glob";
-var exec = promisify(execFile);
-
-// src/test-map.ts
-import path2 from "path";
-import fg2 from "fast-glob";
 
-// src/snapshot/snapshot.ts
-var exec2 = promisify2(execFile2);
-function snapshotDir(rootDir) {
-  return path3.join(rootDir, ".mason");
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
 }
-function snapshotPath(rootDir) {
-  return path3.join(snapshotDir(rootDir), "snapshot.json");
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
-async function loadSnapshot(rootDir) {
-  try {
-    const raw = await fs2.readFile(snapshotPath(rootDir), "utf-8");
-    const parsed = JSON.parse(raw);
-    if (parsed.version !== 2) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
 }
-async function getCurrentGitHash(rootDir) {
-  try {
-    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
-      cwd: rootDir
-    });
-    return stdout.trim();
-  } catch {
-    return "unknown";
-  }
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
 }
-var SOURCE_GLOB = "**/*.{ts,tsx,js,jsx,kt,kts,java,py,go,rs,swift,rb,cs,cpp,c,dart}";
+
+// src/utils/files.ts
+var exec = promisify(execFile);
+var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
 var SOURCE_IGNORE = [
   "**/node_modules/**",
   "**/dist/**",
@@ -64,64 +55,264 @@ var SOURCE_IGNORE = [
   "**/.gradle/**",
   "**/target/**",
   "**/.git/**",
+  "**/.mason/**",
   "**/vendor/**",
   "**/__pycache__/**",
   "**/venv/**",
   "**/.venv/**",
   "**/*.min.*",
   "**/*.map",
+  "**/*.lock",
   "**/generated/**",
+  "**/*.generated.*",
   "**/R.java",
-  "**/BuildConfig.java"
+  "**/BuildConfig.java",
+  "**/package-lock.json",
+  "**/yarn.lock",
+  "**/pnpm-lock.yaml"
 ];
+var MAX_SOURCE_BYTES = 1024 * 1024;
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
+}
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content === null ? null : { path: relative, content, totalLines: content.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read };
+}
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/snapshot/snapshot.ts
+import { z } from "zod";
+
+// src/test-map.ts
+import path4 from "path";
+
+// src/snapshot/snapshot.ts
+var exec2 = promisify2(execFile2);
+var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var verificationFields = {
+  refreshedHash: z.string().optional(),
+  verifiedAt: z.string().optional(),
+  verifiedHash: z.string().optional(),
+  verificationFailed: z.boolean().optional(),
+  verificationNote: z.string().optional()
+};
+var featureSchema = z.object({
+  description: z.string(),
+  files: z.array(repoPath),
+  tests: z.array(repoPath).optional(),
+  type: z.enum(["capability", "infrastructure"]).optional(),
+  ...verificationFields
+}).passthrough();
+var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
+var snapshotSchema = z.object({
+  version: z.literal(2),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  gitHash: z.string(),
+  features: z.record(featureSchema),
+  flows: z.record(flowSchema)
+}).passthrough();
+async function loadSnapshot(rootDir) {
+  const parsed = await readStoreJson(rootDir, ".mason/snapshot.json");
+  if (parsed === null || parsed.version === 1) return null;
+  const result = snapshotSchema.safeParse(parsed);
+  if (!result.success) throw new Error(`Invalid Mason snapshot: ${result.error.message}`);
+  return result.data;
+}
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
 async function listSourceFiles(resolvedRoot) {
-  const all = await fg3(SOURCE_GLOB, {
-    cwd: resolvedRoot,
-    ignore: SOURCE_IGNORE
-  });
-  return [...all].sort();
+  return (await createFileAccess(resolvedRoot)).list();
 }
 
 // src/drift/drift.ts
 var exec3 = promisify3(execFile3);
 var FULL_REBUILD_FRACTION = 0.4;
 var FULL_REBUILD_MIN_CHANGED_MAPPED_FILES = 10;
-async function getChangesWithStatus(resolvedRoot, fromHash) {
-  if (!fromHash || fromHash === "unknown") return null;
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec3(
-      "git",
-      ["diff", "--name-status", "-M", fromHash, "HEAD"],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const changes = [];
-    for (const line of stdout.split("\n")) {
-      if (!line.trim()) continue;
-      const parts = line.split("	");
-      if (parts.some((p) => p.startsWith(".mason/"))) continue;
-      const code = parts[0];
-      if (code.startsWith("R") && parts.length >= 3) {
-        changes.push({
-          status: "renamed",
-          path: parts[2],
-          previousPath: parts[1]
-        });
-      } else if (code.startsWith("C") && parts.length >= 3) {
-        changes.push({ status: "added", path: parts[2] });
-      } else if (code === "A" && parts.length >= 2) {
-        changes.push({ status: "added", path: parts[1] });
-      } else if (code === "D" && parts.length >= 2) {
-        changes.push({ status: "deleted", path: parts[1] });
-      } else if (parts.length >= 2) {
-        changes.push({ status: "modified", path: parts[1] });
-      }
-    }
-    return changes;
+    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
   } catch {
     return null;
   }
 }
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
+}
 async function countCommitsBehind(resolvedRoot, fromHash) {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-")) return null;
   try {
     const { stdout } = await exec3(
       "git",
@@ -149,7 +340,7 @@ async function findGhostFiles(resolvedRoot, mappedFiles) {
   const ghosts = [];
   for (const file of mappedFiles) {
     try {
-      await fs3.access(path4.join(resolvedRoot, file));
+      await fs3.access(path6.join(resolvedRoot, file));
     } catch {
       ghosts.push(file);
     }
@@ -157,181 +348,248 @@ async function findGhostFiles(resolvedRoot, mappedFiles) {
   return ghosts.sort();
 }
 async function computeDrift(rootDir) {
-  const resolvedRoot = path4.resolve(rootDir);
-  const snapshot = await loadSnapshot(resolvedRoot);
+  const root = path6.resolve(rootDir);
+  const snapshot = await loadSnapshot(root);
   if (!snapshot) return null;
-  const headHash = await getCurrentGitHash(resolvedRoot);
-  const totalFeatures = Object.keys(snapshot.features).length;
-  const totalFlows = Object.keys(snapshot.flows).length;
+  const [headHash, workingTree] = await Promise.all([getCurrentGitHash(root), getWorkingTree(root)]);
   const hashFor = (entry) => entry.refreshedHash ?? snapshot.gitHash;
-  const distinctHashes = /* @__PURE__ */ new Set([snapshot.gitHash]);
-  for (const feature of Object.values(snapshot.features)) {
-    distinctHashes.add(hashFor(feature));
-  }
-  for (const flow of Object.values(snapshot.flows)) {
-    distinctHashes.add(hashFor(flow));
-  }
-  distinctHashes.delete("unknown");
-  const staleHashes = headHash === "unknown" ? [] : [...distinctHashes].filter((h) => h !== headHash);
-  const stale = staleHashes.length > 0;
+  const entries = [...Object.values(snapshot.features), ...Object.values(snapshot.flows)];
+  const hashes = /* @__PURE__ */ new Set([snapshot.gitHash, ...entries.map(hashFor)]);
+  const changesByHash = /* @__PURE__ */ new Map();
+  await Promise.all([...hashes].map(async (hash) => {
+    changesByHash.set(hash, hash === headHash && headHash !== "unknown" ? [] : await getChangesWithStatus(root, hash));
+  }));
+  const historyAvailable = headHash !== "unknown" && [...changesByHash.values()].every((changes) => changes !== null);
+  const mappedFiles = collectMappedFiles(snapshot);
   const report = {
-    stale,
+    stale: !historyAvailable,
     snapshotHash: snapshot.gitHash,
     headHash,
-    commitsBehind: stale ? null : 0,
-    historyAvailable: true,
+    commitsBehind: 0,
+    historyAvailable,
     changedFiles: [],
     staleFeatures: {},
     staleFlows: {},
-    totalFeatures,
-    totalFlows,
+    totalFeatures: Object.keys(snapshot.features).length,
+    totalFlows: Object.keys(snapshot.flows).length,
     unmappedFiles: [],
-    ghostFiles: [],
+    ghostFiles: await findGhostFiles(root, mappedFiles),
     renames: [],
-    recommendation: "up-to-date"
-  };
-  if (!stale) return report;
-  const mappedFiles = collectMappedFiles(snapshot);
-  report.ghostFiles = await findGhostFiles(resolvedRoot, mappedFiles);
-  const changesByHash = /* @__PURE__ */ new Map();
-  const touchedByHash = /* @__PURE__ */ new Map();
-  for (const hash of staleHashes) {
-    const changes = await getChangesWithStatus(resolvedRoot, hash);
-    if (changes === null) {
-      report.historyAvailable = false;
-      report.recommendation = "full-rebuild";
-      return report;
-    }
-    changesByHash.set(hash, changes);
-    const touched = /* @__PURE__ */ new Set();
-    for (const change of changes) {
-      touched.add(change.path);
-      if (change.previousPath) touched.add(change.previousPath);
+    recommendation: historyAvailable ? "up-to-date" : "full-rebuild",
+    featureFreshness: {},
+    flowFreshness: {},
+    workingTree,
+    verification: {
+      neverVerified: entries.filter((e) => !e.verifiedAt).length,
+      failed: [...Object.entries(snapshot.features), ...Object.entries(snapshot.flows)].filter(([, e]) => e.verificationFailed).map(([name]) => name)
     }
-    touchedByHash.set(hash, touched);
-  }
-  const commitCounts = await Promise.all(
-    staleHashes.map((hash) => countCommitsBehind(resolvedRoot, hash))
-  );
-  const validCounts = commitCounts.filter((c) => c !== null);
-  report.commitsBehind = validCounts.length > 0 ? Math.max(...validCounts) : null;
-  const emptySet = /* @__PURE__ */ new Set();
-  const touchedFor = (entry) => touchedByHash.get(hashFor(entry)) ?? emptySet;
+  };
+  const counts = await Promise.all([...hashes].map((hash) => hash === headHash ? 0 : countCommitsBehind(root, hash)));
+  const knownCounts = counts.filter((n) => n !== null);
+  report.commitsBehind = knownCounts.length ? Math.max(...knownCounts) : null;
+  const check = (name, files, hash, staleEntries, freshness) => {
+    const changes = changesByHash.get(hash);
+    const committedHits = changes ? matchingPaths(files, touchedPaths(changes)) : [];
+    if (committedHits.length) staleEntries[name] = committedHits;
+    const localHits = matchingPaths(files, workingTree.changedFiles);
+    freshness[name] = files.length === 0 || changes === null || changes === void 0 || !workingTree.available ? "unknown" : committedHits.length || localHits.length || files.some((f) => report.ghostFiles.includes(f)) ? "changed" : "current";
+  };
   for (const [name, feature] of Object.entries(snapshot.features)) {
-    const touched = touchedFor(feature);
-    const hits = [...feature.files, ...feature.tests ?? []].filter(
-      (f) => touched.has(f)
-    );
-    if (hits.length > 0) report.staleFeatures[name] = [...new Set(hits)];
+    check(name, [...feature.files, ...feature.tests ?? []], hashFor(feature), report.staleFeatures, report.featureFreshness);
   }
   for (const [name, flow] of Object.entries(snapshot.flows)) {
-    const touched = touchedFor(flow);
-    const hits = flow.chain.filter((f) => touched.has(f));
-    if (hits.length > 0) report.staleFlows[name] = [...new Set(hits)];
+    check(name, flow.chain, hashFor(flow), report.staleFlows, report.flowFreshness);
   }
-  const allChanges = [...changesByHash.values()].flat();
+  const allChanges = [...changesByHash.values()].flatMap((changes) => changes ?? []);
   report.changedFiles = [...new Set(allChanges.map((c) => c.path))].sort();
-  const sourceFileSet = new Set(await listSourceFiles(resolvedRoot));
-  const newPaths = allChanges.filter((c) => c.status === "added" || c.status === "renamed").map((c) => c.path);
-  report.unmappedFiles = [...new Set(newPaths)].filter((p) => sourceFileSet.has(p) && !mappedFiles.has(p)).sort();
-  const renameKeys = /* @__PURE__ */ new Set();
+  const sourceFiles = new Set(await listSourceFiles(root));
+  let committedFiles = /* @__PURE__ */ new Set();
+  try {
+    const { stdout } = await exec3("git", ["ls-tree", "-r", "--name-only", "-z", "HEAD"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    committedFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    report.historyAvailable = false;
+    report.stale = true;
+  }
+  report.unmappedFiles = [...sourceFiles].filter((f) => committedFiles.has(f) && !mappedFiles.has(f)).sort();
+  const renames = /* @__PURE__ */ new Map();
   for (const change of allChanges) {
-    if (change.status !== "renamed" || !change.previousPath) continue;
-    const key = `${change.previousPath}\0${change.path}`;
-    if (renameKeys.has(key)) continue;
-    renameKeys.add(key);
-    report.renames.push({ from: change.previousPath, to: change.path });
-  }
-  const changedMapped = /* @__PURE__ */ new Set([
-    ...Object.values(report.staleFeatures).flat(),
-    ...Object.values(report.staleFlows).flat()
-  ]);
-  const changedFraction = mappedFiles.size > 0 ? changedMapped.size / mappedFiles.size : 0;
-  report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedFraction > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
+    if (change.status === "renamed" && change.previousPath) renames.set(`${change.previousPath}\0${change.path}`, { from: change.previousPath, to: change.path });
+  }
+  report.renames = [...renames.values()];
+  const changedMapped = /* @__PURE__ */ new Set([...Object.values(report.staleFeatures).flat(), ...Object.values(report.staleFlows).flat()]);
+  const committedGhosts = report.ghostFiles.filter((f) => !workingTree.changedFiles.includes(f));
+  report.stale ||= changedMapped.size > 0 || report.unmappedFiles.length > 0 || committedGhosts.length > 0;
+  if (!report.historyAvailable) report.recommendation = "full-rebuild";
+  else if (!report.stale) report.recommendation = "up-to-date";
+  else report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedMapped.size / Math.max(1, mappedFiles.size) > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
   return report;
 }
 
 // src/decisions/drift.ts
-import path7 from "path";
+import path9 from "path";
 
 // src/decisions/decisions.ts
 import fs4 from "fs/promises";
-import path6 from "path";
+import path8 from "path";
 import { createHash } from "crypto";
 
 // src/context/lexical.ts
-import path5 from "path";
+import path7 from "path";
 
-// src/decisions/decisions.ts
-function decisionsDir(rootDir) {
-  return path6.join(rootDir, ".mason", "decisions");
+// src/decisions/provenance.ts
+import { z as z2 } from "zod";
+var text = (max) => z2.string().trim().min(1).max(max);
+var decisionSourceSchema = z2.object({
+  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+  reference: text(1e3),
+  note: text(500).optional()
+}).strict();
+var attributionSchema = z2.object({
+  owner: text(200).nullable().optional(),
+  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  actor: text(200).optional()
+});
+var contentSchema = z2.object({
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20)
+});
+var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z2.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z2.object({
+  baseHash: z2.string(),
+  headHash: z2.string(),
+  historyAvailable: z2.boolean(),
+  changedFiles: z2.array(z2.string()),
+  localChanges: z2.array(z2.string())
+});
+var eventSchema = z2.object({
+  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+  at: z2.string().datetime(),
+  actor: text(200).optional(),
+  note: text(1500).optional(),
+  revision: z2.number().int().positive(),
+  content: contentSchema,
+  approval: approvalSchema,
+  status: statusSchema,
+  refreshedHash: z2.string(),
+  evidence: reviewEvidenceSchema.optional()
+});
+var legacySchema = z2.object({
+  version: z2.literal(1),
+  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: contentSchema.shape.category,
+  files: contentSchema.shape.files,
+  createdAt: z2.string(),
+  updatedAt: z2.string(),
+  refreshedHash: z2.string(),
+  status: z2.enum(["active", "superseded"]),
+  supersededBy: z2.string().optional()
+}).passthrough();
+var currentSchema = legacySchema.extend({
+  version: z2.literal(2),
+  status: statusSchema,
+  approval: approvalSchema,
+  revision: z2.number().int().positive(),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20),
+  history: z2.array(eventSchema).min(1)
+}).superRefine((record, ctx) => {
+  const invalid = (message) => ctx.addIssue({ code: "custom", message });
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+  let previous;
+  for (const event of record.history) {
+    if (!previous) {
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+    } else {
+      if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
+      if (previous.status !== "active") invalid("Archived decisions cannot be changed");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
+      if (event.approval !== approval) invalid("Approval disagrees with review history");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+    }
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (["accepted", "reaffirmed"].includes(event.kind)) {
+      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+    }
+    previous = event;
+  }
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+});
+var decisionSchema = z2.union([legacySchema, currentSchema]);
+function decisionContent(record) {
+  return {
+    title: record.title,
+    body: record.body,
+    category: record.category,
+    files: record.files,
+    ...typeof record.owner === "string" ? { owner: record.owner } : {},
+    sources: Array.isArray(record.sources) ? record.sources : []
+  };
 }
-async function loadDecisions(rootDir) {
+
+// src/decisions/decisions.ts
+async function loadDecisionStore(rootDir) {
+  const records = [];
+  const diagnostics = [];
   let entries;
   try {
-    entries = await fs4.readdir(decisionsDir(rootDir));
-  } catch {
-    return [];
+    entries = await fs4.readdir(await storePath(rootDir, ".mason/decisions"));
+  } catch (error) {
+    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
+    return { records, diagnostics };
   }
-  const records = [];
-  for (const entry of entries) {
+  for (const entry of entries.sort()) {
     if (!entry.endsWith(".json")) continue;
+    const relative = `.mason/decisions/${entry}`;
     try {
-      const raw = await fs4.readFile(
-        path6.join(decisionsDir(rootDir), entry),
-        "utf-8"
-      );
-      const parsed = JSON.parse(raw);
-      if (parsed.version !== 1 || !parsed.id || !parsed.title || !parsed.body) {
-        continue;
-      }
-      records.push(parsed);
-    } catch {
-      continue;
+      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
+      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
+      records.push(record);
+    } catch (error) {
+      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
     }
   }
-  return records.sort((a, b) => a.id.localeCompare(b.id));
+  return { records, diagnostics };
 }
 
 // src/decisions/drift.ts
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path7.resolve(rootDir);
-  const records = decisions ?? await loadDecisions(resolvedRoot);
-  const report = {
-    historyAvailable: true,
-    totalDecisions: records.length,
-    staleDecisions: {}
-  };
-  const head = await getCurrentGitHash(resolvedRoot);
+  const resolvedRoot = path9.resolve(rootDir);
+  const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
+  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
+  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
   const changesByHash = /* @__PURE__ */ new Map();
-  for (const record of records) {
-    if (record.status !== "active" || record.files.length === 0) continue;
-    if (record.refreshedHash === head) continue;
+  for (const record of store.records) {
+    if (record.status !== "active") continue;
+    if (record.files.length === 0) {
+      report.freshness[record.id] = "unknown";
+      continue;
+    }
     let touched = changesByHash.get(record.refreshedHash);
     if (touched === void 0) {
-      const changes = await getChangesWithStatus(
-        resolvedRoot,
-        record.refreshedHash
-      );
-      if (changes === null) {
-        touched = null;
-      } else {
-        touched = /* @__PURE__ */ new Set();
-        for (const change of changes) {
-          touched.add(change.path);
-          if (change.previousPath) touched.add(change.previousPath);
-        }
-      }
+      const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
+      touched = changes === null ? null : touchedPaths(changes);
       changesByHash.set(record.refreshedHash, touched);
     }
-    if (touched === null) {
-      report.historyAvailable = false;
-      continue;
-    }
-    const hits = record.files.filter((f) => touched.has(f));
-    if (hits.length > 0) {
-      report.staleDecisions[record.id] = hits;
-    }
+    if (touched === null) report.historyAvailable = false;
+    const hits = touched ? matchingPaths(record.files, touched) : [];
+    if (hits.length) report.staleDecisions[record.id] = hits;
+    const localHits = matchingPaths(record.files, workingTree.changedFiles);
+    report.freshness[record.id] = touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current";
   }
   return report;
 }
@@ -384,7 +642,10 @@ function parseArgs(argv) {
 }
 function formatDriftSummary(report) {
   if (!report.stale) {
-    return `Concept map is up to date (HEAD ${report.headHash.slice(0, 7)}).`;
+    const lines2 = [`Concept map is up to date against committed source (HEAD ${report.headHash.slice(0, 7)}).`];
+    if (report.workingTree?.changedFiles.length) lines2.push(`Working tree has ${report.workingTree.changedFiles.length} changed files; live context checks report these separately.`);
+    if (report.verification?.failed.length) lines2.push(`Verification FAILED: ${report.verification.failed.join(", ")}. Correct these entries before relying on them.`);
+    return lines2.join("\n");
   }
   const lines = [];
   const behind = report.commitsBehind !== null ? `${report.commitsBehind} commit${report.commitsBehind === 1 ? "" : "s"} behind HEAD` : "an unknown number of commits behind HEAD";
@@ -489,11 +750,17 @@ async function runDriftCli(argv, io = {
     io.out(USAGE);
     return 0;
   }
-  const rootDir = path8.resolve(args.dir);
-  const report = await computeDrift(rootDir);
+  const rootDir = path10.resolve(args.dir);
+  let report;
+  try {
+    report = await computeDrift(rootDir);
+  } catch (error) {
+    io.err(error instanceof Error ? error.message : String(error));
+    return 2;
+  }
   if (!report) {
     io.err(
-      `No Mason snapshot found at ${path8.join(rootDir, ".mason", "snapshot.json")}. Build one via the Mason MCP server first.`
+      `No Mason snapshot found at ${path10.join(rootDir, ".mason", "snapshot.json")}. Build one via the Mason MCP server first.`
     );
     return 2;
   }
@@ -512,12 +779,15 @@ async function runDriftCli(argv, io = {
   }
   if (args.json) {
     const output = report;
-    if (decisionDrift.totalDecisions > 0) {
+    if (decisionDrift.totalDecisions > 0 || decisionDrift.diagnostics?.length) {
       output.decisions = decisionDrift;
     }
     io.out(JSON.stringify(output, null, 2));
   } else {
     const lines = [formatDriftSummary(report)];
+    for (const diagnostic of decisionDrift.diagnostics ?? []) lines.push(`Invalid decision record ${diagnostic.path}: ${diagnostic.message}`);
+    const unknownIds = Object.entries(decisionDrift.freshness ?? {}).filter(([, state]) => state === "unknown").map(([id]) => id);
+    if (unknownIds.length) lines.push(`Decision freshness unknown: ${unknownIds.join(", ")}. Verify before relying on them.`);
     const staleIds = Object.keys(decisionDrift.staleDecisions);
     if (staleIds.length > 0) {
       lines.push(