modelos-secure 0.2.0 → 0.3.1

package/cli.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
-import { _ as interactive, a as apiClient, b as say, c as Interrupted, d as beforeStopping, f as blue, g as grey, h as finishBeforeStopping, i as IapRefusal, l as ask, m as dash, o as atAddress, p as bold, r as ApiError$1, s as readConnection, t as loginCommand, u as askText, v as lastFinishedStep, x as step, y as red } from "./assets/login-DZgP66jr.js";
+import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d as beforeStopping, f as blue, g as interactive, h as grey, i as IapRefusal, l as ask, m as finishBeforeStopping, o as atAddress, p as bold, r as ApiError$1, s as readConnection, t as loginCommand, u as askText, v as red, x as step, y as say } from "./assets/login-DeAJGhiN.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { basename, dirname, extname, join, relative, resolve } from "node:path";
-import { access, appendFile, constants, mkdir, readFile, readdir, rename, stat, writeFile } from "node:fs/promises";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { parseArgs } from "node:util";
+import { access, appendFile, constants, glob, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { createServer, request } from "node:http";
 import { connect, createConnection, createServer as createServer$1 } from "node:net";
 // \0rolldown/runtime.js
@@ -20,6 +21,44 @@ if (existsSync(resolve(here, "wasm"))) {
 	process.env.MODELOS_SECURE_HOOK_NODE ??= resolve(here, "hook/hook.mjs");
 	process.env.MODELOS_SECURE_HOOK_PYTHON ??= resolve(here, "python");
 }
+// package.json
+var name = "modelos-secure";
+var version$1 = "0.3.1";
+var type = "module";
+var bin = { "modelos-secure": "dist/cli.js" };
+var exports$1 = { "./hook": "./dist/hook/hook.mjs" };
+var engines = { "node": ">=22" };
+var files = ["dist"];
+var scripts = { "build": "vite build" };
+var dependencies = {
+	"@modelos-secure/core": "workspace:*",
+	"@modelos-secure/scan": "workspace:*",
+	"@modelos-secure/schema": "workspace:*",
+	"yaml": "2.9.1"
+};
+var devDependencies = { "vite": "8.3.6" };
+var description = "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.";
+var license = "UNLICENSED";
+var repository = {
+	"type": "git",
+	"url": "git+https://github.com/mn-chetan/modelos-secure.git"
+};
+var package_default = {
+	name,
+	version: version$1,
+	"private": true,
+	type,
+	bin,
+	exports: exports$1,
+	engines,
+	files,
+	scripts,
+	dependencies,
+	devDependencies,
+	description,
+	license,
+	repository
+};
 // src/failures.ts
 var Failure = class extends Error {
 	cause2;
@@ -35,15 +74,16 @@ var Failure = class extends Error {
 /** Runs a step, offering the fixes for any failure, until it passes or no fix is left to try. */
 async function withFixes(run, options) {
 	const applied = /* @__PURE__ */ new Set();
+	const key = (error, fix) => `${error.message}\n${fix.label}`;
 	for (let tries = 0;; tries++) try {
 		return await run();
 	} catch (caught) {
 		if (!(caught instanceof Failure)) throw caught;
 		const error = caught;
-		error.fixes.splice(0, error.fixes.length, ...error.fixes.filter((f) => !applied.has(f.label)));
+		error.fixes.splice(0, error.fixes.length, ...error.fixes.filter((f) => !applied.has(key(error, f))));
 		say();
 		say(`  ${red(error.message)}`);
-		if (error.cause2) say(`  ${error.cause2}`);
+		if (error.cause2 && !restates(error.cause2, error.message)) say(`  ${error.cause2}`);
 		error.shown = true;
 		const unattended = options.yes || options.ci || !interactive();
 		const choosable = unattended ? error.fixes.filter((f) => !f.needsPerson) : error.fixes;
@@ -55,10 +95,18 @@ async function withFixes(run, options) {
 			value: f,
 			recommended: f === preferred
 		})));
-		applied.add(fix.label);
+		applied.add(key(error, fix));
 		await fix.apply();
 	}
 }
+/** Whether a cause only says again what happened, so printing it would repeat the line above. */
+function restates(cause, what) {
+	if (/\bbecause\b/i.test(what)) return true;
+	const words = (text) => new Set(text.toLowerCase().match(/[a-z0-9_]{3,}/g) ?? []);
+	const said = words(what);
+	const told = [...words(cause)];
+	return told.filter((w) => said.has(w)).length >= told.length / 2;
+}
 // ../../packages/core/src/rules.ts
 function parseRule(source) {
 	const parts = source.split(/\s+and\s+/).map((p) => p.trim());
@@ -255,6 +303,11 @@ function defaultRules(tools) {
 	return rules;
 }
 // ../../packages/scan/src/look.ts
+/**
+* A path in the repository, from its root, always with forward slashes: what the map, the
+* outline, the model and modelos-secure.yaml all use, on Windows too.
+*/
+var inRepo = (root, full) => relative(root, full).split(sep).join("/");
 var SKIPPED = /* @__PURE__ */ new Set([
 	"node_modules",
 	"vendor",
@@ -348,8 +401,8 @@ async function walk$1(root) {
 			} else if (entry.isFile()) {
 				all += 1;
 				if (SOURCE.has(extname(entry.name)) && !/\.(test|spec|d)\.[jt]sx?$/.test(entry.name) && !/^test_.*\.py$/.test(entry.name)) {
-					if ((await stat(full)).size <= MAX_FILE_BYTES) source.push(relative(root, full));
-				} else if (DOCUMENT.has(extname(entry.name)) && !NOT_DOCUMENTS.test(entry.name)) documents.push(relative(root, full));
+					if ((await stat(full)).size <= MAX_FILE_BYTES) source.push(inRepo(root, full));
+				} else if (DOCUMENT.has(extname(entry.name)) && !NOT_DOCUMENTS.test(entry.name)) documents.push(inRepo(root, full));
 			}
 		}
 	};
@@ -430,7 +483,7 @@ async function requirementFiles(root) {
 		for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
 			const full = join(dir, entry.name);
 			if (entry.isDirectory() && !SKIPPED.has(entry.name) && !entry.name.startsWith(".")) await visit(full, depth + 1);
-			else if (entry.isFile() && /^requirements.*\.txt$/.test(entry.name)) found.push(relative(root, full));
+			else if (entry.isFile() && /^requirements.*\.txt$/.test(entry.name)) found.push(inRepo(root, full));
 		}
 	};
 	await visit(root, 0);
@@ -5061,7 +5114,7 @@ var ADAPTERS = [
 ];
 // ../../packages/scan/src/wrappers.ts
 var FOLLOW_DEPTH = 2;
-var FUNCTIONS$1 = /* @__PURE__ */ new Set([
+var FUNCTIONS = /* @__PURE__ */ new Set([
 	"function_definition",
 	"function_declaration",
 	"arrow_function",
@@ -5080,7 +5133,7 @@ var rootName = (node) => {
 	}
 };
 var calledBy = (call) => call.type === "call" || call.type === "call_expression" ? call.childForFieldName("function") : call.type === "new_expression" ? call.childForFieldName("constructor") : null;
-function importsOf(file, project) {
+function importsOf$1(file, project) {
 	const bound = /* @__PURE__ */ new Map();
 	const pythonLocal = (module) => module.startsWith(".") || project.files.some((f) => {
 		const first = module.split(".")[0];
@@ -5126,14 +5179,14 @@ function importsOf(file, project) {
 function functionFor(file, line, name) {
 	let found;
 	walk(file.root, (node) => {
-		if (found || !FUNCTIONS$1.has(node.type)) return;
+		if (found || !FUNCTIONS.has(node.type)) return;
 		if (lineOf(node) === line || node.childForFieldName("name")?.text === name) found = node;
 	});
 	if (found) return found;
 	walk(file.root, (node) => {
 		if (found || lineOf(node) !== line) return;
 		walk(node, (inner) => {
-			if (!found && FUNCTIONS$1.has(inner.type)) found = inner;
+			if (!found && FUNCTIONS.has(inner.type)) found = inner;
 		});
 	});
 	return found;
@@ -5152,7 +5205,7 @@ function servicesCalledBy(project, tool) {
 		return true;
 	};
 	const collect = (fn, file, depth) => {
-		const imports = importsOf(file, project);
+		const imports = importsOf$1(file, project);
 		const addImported = (bound, name) => {
 			if (bound.local) services.add(name);
 			else if (!NOT_SERVICES.has(bound.module.replace(/^node:/, "").split(".")[0])) services.add(bound.module);
@@ -5242,6 +5295,76 @@ function dedupe(facts) {
 		return true;
 	});
 }
+// ../../packages/scan/src/secrets.ts
+/** Files that are never read, whatever the model asks: settings, keys and credentials. */
+var NEVER_READ = [
+	/(^|\/)\.env(\..+)?$/i,
+	/\.(pem|key|p12|pfx|jks|keystore|crt|cer|der|p8|ppk|kdbx|gpg|asc)$/i,
+	/(^|\/)(id_rsa|id_dsa|id_ecdsa|id_ed25519)(\.pub)?$/i,
+	/(^|\/)\.(npmrc|pypirc|netrc|git-credentials|htpasswd|pgpass)$/i,
+	/(^|\/)(credentials|secrets?|service[-_]?account)[^/]*\.(json|ya?ml|toml|ini|txt)$/i,
+	/(^|\/)client_secret[^/]*\.json$/i,
+	/(^|\/)\.aws\/|(^|\/)\.ssh\/|(^|\/)\.gnupg\/|(^|\/)\.docker\/config\.json$/i,
+	/(^|\/)terraform\.tfstate(\.backup)?$/i
+];
+/** Example settings say which names a project reads, with no real values: they may be read. */
+var EXAMPLE = /\.(example|sample|template|dist)$/i;
+/** Why a file in the repository is never sent, or null when it may be. */
+function neverRead(path) {
+	const posix = path.split(sep).join("/");
+	if (EXAMPLE.test(posix)) return null;
+	return NEVER_READ.some((pattern) => pattern.test(posix)) ? "it holds settings, keys or credentials, which never leave this machine" : null;
+}
+/**
+* The repository's own path to a file, or null when the path leads outside it, through `..` or a
+* link. The model names paths; this decides whether one is in the repository at all.
+*/
+async function insideRepository(root, path) {
+	const realRoot = await realpath(root);
+	const full = await realpath(resolve(realRoot, path)).catch(() => null);
+	if (!full) return null;
+	const inRepo = relative(realRoot, full);
+	if (inRepo.startsWith("..") || resolve(realRoot, inRepo) !== full) return null;
+	return inRepo.split(sep).join("/");
+}
+var SECRET_VALUES = /\b(GOCSP[X]-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{16,}|sk_(live|test)_[A-Za-z0-9]{16,}|rk_(live|test)_[A-Za-z0-9]{16,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,}|glpat-[A-Za-z0-9_-]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|ya29\.[A-Za-z0-9._-]+|mst\.[A-Za-z0-9._-]+|hf_[A-Za-z0-9]{30,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g;
+/** A name that holds a secret: `password`, `apiKey`, `DB_PASS`, `client_secret` and the like. */
+var SECRET_NAME = "(?:[A-Za-z0-9_]*(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|access[_-]?key|credential)[A-Za-z0-9_]*|[A-Za-z0-9_]*_(?:pass|pwd)|pass|pwd)";
+/** An assignment of a quoted literal to such a name, in code, JSON or YAML: the value goes. */
+var SECRET_ASSIGNMENT = new RegExp(`\\b(${SECRET_NAME})(["']?\\s*[:=]\\s*)(["'\`])([^"'\`\\n]{4,})\\3`, "gi");
+/**
+* The same with no quotes, as settings files write it (`password: hunter2pass`, `DB_PASS=...`).
+* Only a value with both letters and digits and no call or index in it, so `token = get_token()`
+* and `key = os.environ["KEY"]` stay readable.
+*/
+var SECRET_BARE = new RegExp(`(^|\\n)(\\s*(?:export\\s+)?${SECRET_NAME}\\s*[:=]\\s*)([^\\s"'\`#(\\[{]{4,})`, "gi");
+var looksLikeAValue = (v) => /[0-9]/.test(v) && /[A-Za-z]/.test(v) && !/[()[\]{}]/.test(v);
+/**
+* Text with every secret it holds taken out: private keys, known token shapes, long encoded values,
+* credentials in addresses, literal values assigned to names like `password`, and the exact values
+* of the person's own local settings.
+*/
+function redact(text, knownValues = []) {
+	let clean = text.replace(/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g, "[a private key, left out]").replace(SECRET_VALUES, "[a secret, left out]").replace(/\b[A-Fa-f0-9]{40,}\b/g, "[a long hex value, left out]").replace(/\b[A-Za-z0-9+/]{60,}={0,2}/g, "[a long encoded value, left out]").replace(/(\w+:\/\/)[^\s/:@]+:[^\s/@]+@/g, "$1[credentials left out]@").replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/g, "$1 [a secret, left out]").replace(SECRET_ASSIGNMENT, "$1$2$3[a secret, left out]$3").replace(SECRET_BARE, (all, start, name, value) => looksLikeAValue(value) ? `${start}${name}[a secret, left out]` : all);
+	for (const value of knownValues) if (value.length >= 6) clean = clean.split(value).join("[a setting's value, left out]");
+	return clean;
+}
+/**
+* The values in the person's own settings files, such as `.env`, read here so the same values are
+* taken out of anything sent. They never leave: only their absence does.
+*/
+async function localValues(root, settingsFiles) {
+	const values = /* @__PURE__ */ new Set();
+	for (const file of settingsFiles) {
+		if (EXAMPLE.test(file)) continue;
+		const text = await readFile(resolve(root, file), "utf8").catch(() => "");
+		for (const line of text.split(/\r?\n/)) {
+			const value = /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.-]*\s*[=:]\s*(.*)$/.exec(line)?.[1]?.trim().replace(/^(["'])(.*)\1$/, "$2");
+			if (value && value.length >= 6) values.add(value);
+		}
+	}
+	return [...values];
+}
 // ../../packages/scan/src/symbols.ts
 var SHORT = 300;
 var PROMPT_TEXT = 6e3;
@@ -5249,10 +5372,6 @@ var MAX_CALLS = 40;
 /** A string this long, or named like a prompt, can be a prompt. */
 var PROMPT_LENGTH = 80;
 var PROMPT_NAME = /prompt|instruction|system|backstory|goal|role|template|persona|description|guideline/i;
-/** Secrets never leave, whatever they are called. */
-function redact(text) {
-	return text.replace(/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g, "[a private key, left out]").replace(/\b(sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,}|ghp_[A-Za-z0-9]{30,}|xox[abprs]-[A-Za-z0-9-]{10,}|ya29\.[A-Za-z0-9._-]+|mst\.[A-Za-z0-9._-]+)\b/g, "[a secret, left out]").replace(/\b[A-Fa-f0-9]{40,}\b/g, "[a long hex value, left out]").replace(/\b[A-Za-z0-9+/]{60,}={0,2}/g, "[a long encoded value, left out]").replace(/(\w+:\/\/)[^\s/:@]+:[^\s/@]+@/g, "$1[credentials left out]@");
-}
 var short = (text, max = SHORT) => {
 	const clean = redact(text.replace(/\s+/g, " ").trim());
 	return clean.length > max ? `${clean.slice(0, max)}…` : clean;
@@ -5298,8 +5417,15 @@ function argumentValue(value) {
 		const inner = p.childForFieldName("value");
 		return inner ? `${key}: ${argumentValue(inner)}` : key;
 	}).join(", ")}}`, 1200);
+	if (FUNCTION_VALUE.has(value.type)) return "function(…)";
 	return short(value.text, 120);
 }
+var FUNCTION_VALUE = /* @__PURE__ */ new Set([
+	"arrow_function",
+	"function_expression",
+	"function",
+	"lambda"
+]);
 function declarationArgs(call) {
 	const args = {};
 	const list = call.childForFieldName("arguments");
@@ -5492,6 +5618,72 @@ function docOf(node, file) {
 	const before = node.previousSibling;
 	if (before?.type === "comment" && before.endPosition.row + 1 >= node.startPosition.row) return short(before.text.replace(/^\/\*+|\*+\/$|^\s*\*\s?|^\/\/\s?/gm, ""), 600);
 }
+// ../../packages/scan/src/start-candidates.ts
+/** Words a README command starts with that start an app, not install or test one. */
+var STARTS = /^(?:\$\s*)?((?:uvicorn|gunicorn|hypercorn|fastapi (?:dev|run)|flask (?:--app \S+ )?run|streamlit run|chainlit run|gradio|python3? (?:-m )?\S+\.py|python3? -m \S+|(?:npm|pnpm|yarn|bun) (?:run )?(?:dev|start|serve)|node \S+\.(?:m?js|ts)|npx tsx \S+|docker compose up|docker-compose up)\b.*)$/;
+async function startCandidates(look, project) {
+	const files = new Set(project.files.map((f) => f.path));
+	const read = (file) => readFile(join(look.root, file), "utf8").catch(() => null);
+	const found = [];
+	for (const file of project.files) {
+		if (file.language !== "python") continue;
+		const module = file.path.replace(/\.py$/, "").replace(/\//g, ".");
+		const standsAlone = module.includes(".") || !/^from \.+\w*\s+import/m.test(file.text);
+		for (const d of symbolsOf(file).declarations) {
+			const callee = d.callee.split(".").at(-1) ?? "";
+			if (!d.name) continue;
+			if (!standsAlone) continue;
+			if (/^(FastAPI|Starlette)$/.test(callee)) found.push({
+				command: `uvicorn ${module}:${d.name}`,
+				from: `the ${callee} app ${d.name} at ${file.path}:${d.line.toString()}`
+			});
+			else if (callee === "Flask") found.push({
+				command: `flask --app ${module}:${d.name} run`,
+				from: `the Flask app ${d.name} at ${file.path}:${d.line.toString()}`
+			});
+		}
+		const main = file.text.split("\n").findIndex((l) => /^if __name__\s*==\s*["']__main__["']/.test(l));
+		if (main >= 0) found.push({
+			command: `python ${file.path}`,
+			from: `the main block at ${file.path}:${(main + 1).toString()}`
+		});
+	}
+	const cmd = (await read("Dockerfile"))?.split("\n").reverse().find((l) => /^\s*(CMD|ENTRYPOINT)\s/i.test(l));
+	if (cmd) {
+		const body = cmd.replace(/^\s*(CMD|ENTRYPOINT)\s+/i, "").trim();
+		let command = body;
+		try {
+			const parts = JSON.parse(body);
+			if (Array.isArray(parts)) command = parts.map(String).join(" ");
+		} catch {}
+		if (command) found.push({
+			command,
+			from: "the Dockerfile's command"
+		});
+	}
+	for (const name of [
+		"README.md",
+		"readme.md",
+		"README.rst",
+		"README"
+	]) {
+		const text = await read(name);
+		if (!text) continue;
+		const blocks = text.match(/```[^\n]*\n[\s\S]*?```/g) ?? [];
+		for (const line of blocks.flatMap((b) => b.split("\n"))) if (STARTS.test(line.trim())) found.push({
+			command: line.trim().replace(/^\$\s*/, ""),
+			from: name
+		});
+		break;
+	}
+	const seen = new Set(look.startCommands.map((c) => c.command));
+	return found.filter((c) => {
+		if (seen.has(c.command)) return false;
+		seen.add(c.command);
+		const file = c.command.split(/\s+/).find((w) => /\.(py|m?js|ts)$/.test(w));
+		return !file || files.has(file.replace(/^\.\//, ""));
+	});
+}
 // ../../packages/scan/src/outline.ts
 /** About 60,000 tokens: enough for an app's code, small enough to be quick and cheap. */
 var BUDGET = 24e4;
@@ -5508,10 +5700,10 @@ function priority(file) {
 	return score;
 }
 /** Prompt and configuration files the code names, or that sit where prompts are kept. */
-async function documentsOf(look, outlines) {
+async function documentsOf(look, outlines, known) {
 	const named = new Set(outlines.flatMap((f) => [...f.strings.map((s) => s.text), ...f.declarations.flatMap((d) => Object.values(d.args))]));
 	const mentioned = (path) => [...named].some((text) => text.includes(basename(path)));
-	const wanted = look.documents.filter((path) => mentioned(path) || /(^|\/)(prompts?|config|instructions|agents|skills)\//i.test(path));
+	const wanted = look.documents.filter((path) => !neverRead(path) && (mentioned(path) || /(^|\/)(prompts?|config|instructions|agents|skills)\//i.test(path)));
 	const documents = [];
 	let total = 0;
 	for (const file of wanted) {
@@ -5521,7 +5713,7 @@ async function documentsOf(look, outlines) {
 		total += text.length;
 		documents.push({
 			file,
-			text: redact(text)
+			text: redact(text, known)
 		});
 	}
 	return documents;
@@ -5532,6 +5724,7 @@ var where$1 = (f) => ({
 });
 async function buildOutline(look, facts, project) {
 	const outlines = project.files.map(symbolsOf);
+	const known = await localValues(look.root, look.settingsFiles);
 	const ranked = [...outlines].sort((a, b) => priority(b) - priority(a));
 	const code = [];
 	const omitted = [];
@@ -5544,15 +5737,18 @@ async function buildOutline(look, facts, project) {
 			size += bytes;
 		}
 	}
-	return {
+	const outline = {
 		version: 2,
 		name: look.name,
 		files: look.sourceFiles,
 		dependencies: [...look.dependencies].sort(),
-		scripts: look.startCommands,
+		scripts: look.startCommands.map((s) => ({
+			...s,
+			command: redact(s.command, known)
+		})),
 		settings: look.settingNames,
 		code,
-		documents: await documentsOf(look, outlines),
+		documents: await documentsOf(look, outlines, known),
 		found: {
 			tools: facts.flatMap((f) => f.kind === "tool" ? [{
 				name: f.name,
@@ -5566,6 +5762,7 @@ async function buildOutline(look, facts, project) {
 		},
 		omitted
 	};
+	return known.length === 0 ? outline : JSON.parse(known.reduce((text, value) => text.split(JSON.stringify(value).slice(1, -1)).join("[a setting's value, left out]"), JSON.stringify(outline)));
 }
 // ../../packages/scan/src/verify.ts
 /** Names compared as people read them: case, spaces, dashes and underscores aside. */
@@ -5836,36 +6033,6 @@ function mergeFacts(read, verified) {
 	});
 	return [...read, ...extra];
 }
-// ../../packages/scan/src/bodies.ts
-var BODY_LIMIT = 8e3;
-var FUNCTIONS = /* @__PURE__ */ new Set([
-	"function_definition",
-	"decorated_definition",
-	"function_declaration",
-	"method_definition",
-	"arrow_function",
-	"function_expression",
-	"lexical_declaration"
-]);
-/** The code of each function asked for, found by the line it starts on, with secrets taken out. */
-function bodiesOf(result, wanted) {
-	return wanted.flatMap((w) => {
-		const file = result.project.files.find((f) => f.path === w.file);
-		if (!file) return [];
-		let node = file.root.descendantForPosition({
-			row: w.line - 1,
-			column: (file.text.split("\n")[w.line - 1] ?? "").search(/\S|$/)
-		});
-		while (node && !FUNCTIONS.has(node.type)) node = node.parent;
-		if (!node) return [];
-		return [{
-			file: w.file,
-			line: w.line,
-			name: w.name,
-			text: redact(node.text).slice(0, BODY_LIMIT)
-		}];
-	});
-}
 // ../../packages/scan/src/draft.ts
 var CONFIDENCE_THRESHOLD = .7;
 var MAX_QUESTIONS = 7;
@@ -6114,10 +6281,650 @@ function applyAnswer(config, question, value) {
 	}
 	return config;
 }
+// ../../packages/scan/src/graph.ts
+var SERVERS = /^(FastAPI|Flask|Starlette|Quart|Sanic|express|Hono|Koa|fastify|Elysia|APIRouter|Blueprint)$/;
+/**
+* What a file imports, as names that can resolve to files: each module, and for Python's
+* `from a import b` also `a.b`, since b may be a module of its own.
+*/
+function importsOf(file) {
+	const names = /* @__PURE__ */ new Set();
+	walk(file.root, (node) => {
+		if (node.type === "import_statement" || node.type === "import_from_statement") {
+			const module = node.childForFieldName("module_name");
+			const source = module?.text ?? stringValue(node.childForFieldName("source"));
+			if (source) names.add(source);
+			for (const child of node.namedChildren) if (child && child !== module && child.type === "dotted_name") names.add(source === void 0 ? child.text : `${source}${source.endsWith(".") ? "" : "."}${child.text}`);
+		}
+	});
+	return [...names];
+}
+function buildGraph(sources, symbols, extra = []) {
+	const files = symbols;
+	const known = new Set(sources.map((f) => f.path));
+	const imports = /* @__PURE__ */ new Map();
+	const importedBy = /* @__PURE__ */ new Map();
+	for (const source of sources) {
+		const f = {
+			file: source.path,
+			imports: importsOf(source)
+		};
+		const resolved = [...new Set(f.imports.flatMap((name) => resolveImport(f.file, name, known) ?? []))];
+		imports.set(f.file, resolved);
+		for (const target of resolved) importedBy.set(target, [...importedBy.get(target) ?? [], f.file]);
+	}
+	const entries = [...extra];
+	for (const f of files) for (const d of f.declarations) if (SERVERS.test(d.callee.split(".").at(-1) ?? "")) entries.push({
+		file: f.file,
+		line: d.line,
+		why: `${d.callee}()`
+	});
+	const distance = /* @__PURE__ */ new Map();
+	let frontier = [...new Set(entries.map((e) => e.file))].filter((f) => known.has(f));
+	for (const f of frontier) distance.set(f, 0);
+	for (let step = 1; frontier.length > 0; step++) {
+		const next = [];
+		for (const f of frontier) for (const target of imports.get(f) ?? []) if (!distance.has(target)) {
+			distance.set(target, step);
+			next.push(target);
+		}
+		frontier = next;
+	}
+	return {
+		imports,
+		importedBy,
+		entries,
+		distance
+	};
+}
+/** The repository file an import names, or null for a package from outside. */
+function resolveImport(from, name, known) {
+	const dir = from.includes("/") ? from.slice(0, from.lastIndexOf("/")) : "";
+	const join = (base, rest) => normalise(base ? `${base}/${rest}` : rest);
+	const first = (candidates) => candidates.find((c) => known.has(c)) ?? null;
+	if (name.startsWith("./") || name.startsWith("../")) {
+		const base = join(dir, name).replace(/\.(m?js|cjs)$/, "");
+		return first([...[
+			"",
+			".ts",
+			".tsx",
+			".js",
+			".mjs",
+			".jsx",
+			".cjs"
+		].map((e) => base + e), ...[
+			"ts",
+			"tsx",
+			"js",
+			"mjs"
+		].map((e) => `${base}/index.${e}`)]);
+	}
+	if (name.includes("/")) return null;
+	const dots = /^\.+/.exec(name)?.[0].length ?? 0;
+	const rest = name.slice(dots).replace(/\./g, "/");
+	let base;
+	if (dots > 0) {
+		const up = dir.split("/").filter(Boolean);
+		base = up.slice(0, Math.max(0, up.length - (dots - 1))).join("/");
+	} else base = "";
+	const path = rest ? base ? `${base}/${rest}` : rest : base;
+	return first((dots > 0 ? [""] : [
+		"",
+		"src/",
+		"app/"
+	]).flatMap((root) => [`${root}${path}.py`, `${root}${path}/__init__.py`]));
+}
+function normalise(path) {
+	const out = [];
+	for (const part of path.split("/")) {
+		if (part === "" || part === ".") continue;
+		if (part === "..") out.pop();
+		else out.push(part);
+	}
+	return out.join("/");
+}
+// ../../packages/scan/src/tools.ts
+var LIMITS = {
+	/** Lines and characters one read may return. */
+	readLines: 200,
+	readChars: 12e3,
+	grepMatches: 40,
+	listEntries: 200,
+	/** Characters of code all reads and searches in one scan may send, together. */
+	codeBudget: 2e5,
+	maxFileBytes: 1e6
+};
+var CODE_TOOLS = ["grep", "read"];
+/** Every file in the repository the tools could see, skipping what the scan never walks. */
+async function repositoryFiles(root, pattern = "**/*", most = 5e3) {
+	const found = [];
+	for await (const entry of glob(pattern, {
+		cwd: root,
+		exclude: (name) => SKIPPED.has(String(name).split(/[\\/]/).at(-1) ?? "")
+	})) {
+		const path = String(entry).split("\\").join("/");
+		if ((await stat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
+		if (found.length >= most) break;
+	}
+	return found.sort();
+}
+function createTools(input) {
+	const { root, symbols, graph, consent } = input;
+	const known = input.knownValues ?? [];
+	let spent = 0;
+	const byFile = new Map(symbols.map((s) => [s.file, s]));
+	const files = (pattern = "**/*") => repositoryFiles(root, pattern);
+	const tools = {
+		async list(args) {
+			const dir = String(args.dir ?? ".");
+			const inRepo = await insideRepository(root, dir);
+			if (inRepo === null) return refused(dir, "it is not a folder in this repository");
+			const entries = await readdir(join(root, inRepo), { withFileTypes: true }).catch(() => null);
+			if (!entries) return refused(dir, "it is not a folder in this repository");
+			return {
+				text: entries.filter((e) => !SKIPPED.has(e.name)).sort((a, b) => a.name.localeCompare(b.name)).slice(0, LIMITS.listEntries).map((e) => e.isDirectory() ? `${e.name}/` : neverRead(join(inRepo, e.name)) ? `${e.name}   (never read)` : e.name).join("\n") || "(empty)",
+				code: 0,
+				about: inRepo || "."
+			};
+		},
+		async glob(args) {
+			const pattern = String(args.pattern ?? "");
+			if (!pattern || pattern.includes("..")) return refused(pattern, "it is not a pattern inside the repository");
+			return {
+				text: (await files(pattern)).slice(0, LIMITS.listEntries).join("\n") || "(nothing matches)",
+				code: 0,
+				about: pattern
+			};
+		},
+		async grep(args) {
+			const text = String(args.text ?? "").toLowerCase();
+			if (text.length < 2) return refused(text, "the text to find is too short");
+			const lines = [];
+			for (const path of await files(String(args.glob ?? "**/*"))) {
+				if (neverRead(path)) continue;
+				if ((await stat(join(root, path))).size > LIMITS.maxFileBytes) continue;
+				const body = await readFile(join(root, path), "utf8").catch(() => "");
+				if (body.includes("\0")) continue;
+				body.split(/\r?\n/).forEach((line, i) => {
+					if (lines.length < LIMITS.grepMatches && line.toLowerCase().includes(text)) lines.push(`${path}:${(i + 1).toString()}: ${redact(line.trim(), known).slice(0, 200)}`);
+				});
+				if (lines.length >= LIMITS.grepMatches) break;
+			}
+			const out = lines.join("\n") || "(not found)";
+			return {
+				text: out,
+				code: out.length,
+				about: `"${text}"`
+			};
+		},
+		async read(args) {
+			const path = String(args.path ?? "");
+			const inRepo = await insideRepository(root, path);
+			if (inRepo === null) return refused(path, "it is not a file in this repository");
+			const why = neverRead(inRepo);
+			if (why) return refused(inRepo, why);
+			if ((await stat(join(root, inRepo))).size > LIMITS.maxFileBytes) return refused(inRepo, "it is over 1 MB");
+			const all = (await readFile(join(root, inRepo), "utf8")).split(/\r?\n/);
+			const from = Math.max(1, Number(args.from ?? (args.to === void 0 ? 1 : args.to - LIMITS.readLines + 1)));
+			const to = Math.min(all.length, Number(args.to ?? from + LIMITS.readLines - 1), from + LIMITS.readLines - 1);
+			let text = "";
+			let last = from - 1;
+			for (let n = from; n <= to; n++) {
+				const line = `${n.toString()}  ${redact(all[n - 1] ?? "", known)}\n`;
+				if (text.length + line.length > LIMITS.readChars) break;
+				text += line;
+				last = n;
+			}
+			const more = last < all.length ? `(lines ${from.toString()} to ${last.toString()} of ${all.length.toString()}; ask from ${(last + 1).toString()} for the rest)` : `(lines ${from.toString()} to ${last.toString()}, the end of the file)`;
+			return {
+				text: `${text}${more}`,
+				code: text.length,
+				about: `${inRepo}:${from.toString()}-${last.toString()}`
+			};
+		},
+		async symbols(args) {
+			if (args.path) {
+				const path = String(args.path).split("\\").join("/");
+				const s = byFile.get(path);
+				if (!s) return refused(path, "the index has no source file by that name");
+				return {
+					text: redact([
+						`${s.file}, ${s.lines.toString()} lines`,
+						`imports here: ${(graph.imports.get(s.file) ?? []).join(", ") || "none"}`,
+						`imported by: ${(graph.importedBy.get(s.file) ?? []).join(", ") || "nothing here"}`,
+						...s.symbols.map((x) => `${x.kind} ${x.name}${x.signature ?? ""} at ${x.line.toString()}-${x.end.toString()}${x.decorators?.length ? `, ${x.decorators.join(" ")}` : ""}${x.doc ? `: ${x.doc}` : ""}`)
+					].join("\n"), known),
+					code: 0,
+					about: path
+				};
+			}
+			const name = String(args.name ?? "");
+			if (!name) return refused("", "give a path or a name");
+			const defined = symbols.flatMap((s) => s.symbols.filter((x) => x.name === name).map((x) => `defined: ${s.file}:${x.line.toString()}-${x.end.toString()} ${x.kind}${x.signature ?? ""}`));
+			const used = symbols.filter((s) => s.symbols.some((x) => x.calls?.includes(name))).map((s) => `called by name in: ${s.file}`);
+			return {
+				text: `${[...defined, ...used].join("\n") || "(the index has no such name)"}\n(references are by name, not resolved)`,
+				code: 0,
+				about: name
+			};
+		}
+	};
+	return {
+		/** Where reading starts: entries first, with why each is one. */
+		entries: graph.entries,
+		allowed: () => consent === "code" ? [
+			"list",
+			"glob",
+			"grep",
+			"read",
+			"symbols"
+		] : [
+			"list",
+			"glob",
+			"symbols"
+		],
+		spent: () => spent,
+		async run(call) {
+			if (CODE_TOOLS.includes(call.tool) && consent !== "code") return {
+				id: call.id,
+				text: "Not allowed: the person agreed to send an outline, not code.",
+				codeChars: 0,
+				about: call.tool
+			};
+			if (CODE_TOOLS.includes(call.tool) && spent >= LIMITS.codeBudget) return {
+				id: call.id,
+				text: "The reading budget for this scan is spent: answer with what you have.",
+				codeChars: 0,
+				about: call.tool
+			};
+			const tool = tools[call.tool];
+			if (!tool) return {
+				id: call.id,
+				text: `No tool named ${String(call.tool)}.`,
+				codeChars: 0,
+				about: ""
+			};
+			const out = await tool(call).catch((error) => refused("", `it could not be read: ${String(error).slice(0, 120)}`));
+			spent += out.code;
+			return {
+				id: call.id,
+				text: out.text,
+				codeChars: out.code,
+				about: `${call.tool} ${out.about}`
+			};
+		}
+	};
+}
+function refused(what, why) {
+	return {
+		text: `Not read: ${what ? `${what}, because ` : ""}${why}.`,
+		code: 0,
+		about: what
+	};
+}
+// ../../packages/scan/src/explore.ts
+/** More turns than the server allows, so a server that never says stop cannot keep it reading. */
+var MOST_TURNS$1 = 24;
+var MOST_UNSURE = 10;
+async function explore(input) {
+	const { result, outline, consent } = input;
+	const symbols = result.project.files.map(symbolsOf);
+	const graph = buildGraph(result.project.files, symbols, entryHints(result));
+	const tools = createTools({
+		root: result.look.root,
+		symbols,
+		graph,
+		consent,
+		knownValues: input.knownValues
+	});
+	const base = {
+		version: 1,
+		scanId: input.scanId ?? randomUUID(),
+		consent,
+		outline,
+		entries: graph.entries.slice(0, 50)
+	};
+	const steps = [];
+	const asked = /* @__PURE__ */ new Map();
+	let turns = 0;
+	let stopped;
+	const dropped = /* @__PURE__ */ new Map();
+	const verify = (u) => {
+		const v = verifyUnderstanding(u, result.look, result.project);
+		for (const d of v.dropped) dropped.set(d.what, d);
+		return v;
+	};
+	/** Two readings, each cut to what held, the surer kept for each item. */
+	const merge = (a, va, b) => preferConfident(keepPassing(a, va), keepPassing(b, verify(b)));
+	/** Turns until the model gives a map, running its calls in between. */
+	const readUntilMap = async (mode, unsure) => {
+		while (turns < MOST_TURNS$1) {
+			turns++;
+			const reply = await input.turn({
+				...base,
+				mode,
+				steps,
+				unsure
+			});
+			if (reply.map) return reply.map;
+			if (reply.stopped || reply.calls.length === 0) {
+				stopped = reply.stopped ?? "the model asked for nothing and gave no map";
+				return null;
+			}
+			const calls = reply.calls.slice(0, 6);
+			steps.push({
+				role: "model",
+				calls,
+				note: reply.note
+			});
+			const results = [];
+			for (const call of calls) {
+				const key = JSON.stringify({
+					...call,
+					id: void 0
+				});
+				const earlier = asked.get(key);
+				if (earlier) {
+					results.push({
+						id: call.id,
+						text: `Already answered in [${earlier}]: ask for other lines or another file.`
+					});
+					continue;
+				}
+				asked.set(key, call.id);
+				const answer = await tools.run(call);
+				results.push({
+					id: call.id,
+					text: answer.text.slice(0, 2e4)
+				});
+				input.onProgress?.(answer.about);
+				await input.onSent?.({
+					what: answer.about,
+					chars: answer.text.length
+				});
+			}
+			steps.push({
+				role: "tools",
+				results
+			});
+		}
+		stopped = "turns";
+		return null;
+	};
+	let map = await readUntilMap("map");
+	if (!map) return {
+		map,
+		verified: null,
+		steps,
+		turns,
+		settled: false,
+		stopped,
+		dropped: []
+	};
+	let verified = verify(map);
+	const problems = verified.dropped.map((d) => `${d.what}: ${d.why}`);
+	if (problems.length > 0) {
+		steps.push({
+			role: "map",
+			map
+		}, {
+			role: "checks",
+			problems
+		});
+		const again = await readUntilMap("map");
+		if (again) {
+			map = merge(map, verified, again);
+			verified = verify(map);
+		}
+	}
+	const unsure = unsureOf(map, verified);
+	let settled = false;
+	if (unsure.length > 0 && !stopped) {
+		if (steps.at(-1)?.role !== "checks") steps.push({
+			role: "map",
+			map
+		});
+		const second = await readUntilMap("settle", unsure.slice(0, MOST_UNSURE));
+		if (second) {
+			map = merge(map, verified, second);
+			verified = verify(map);
+			settled = true;
+		}
+	}
+	return {
+		map,
+		verified,
+		steps,
+		turns,
+		settled,
+		stopped,
+		dropped: [...dropped.values()]
+	};
+}
+/**
+* Where the app starts, from the text the parse does not read as declarations: main blocks, server
+* starts, and files a start command names.
+*/
+function entryHints(result) {
+	const hints = [];
+	const known = new Set(result.project.files.map((f) => f.path));
+	for (const file of result.project.files) file.text.split("\n").forEach((text, i) => {
+		if (/^if __name__\s*==\s*["']__main__["']/.test(text)) hints.push({
+			file: file.path,
+			line: i + 1,
+			why: "a main block"
+		});
+		else if (/\b(uvicorn\.run|\.listen|serve)\(/.test(text)) hints.push({
+			file: file.path,
+			line: i + 1,
+			why: "starts a server"
+		});
+	});
+	for (const start of result.look.startCommands) {
+		const named = start.command.split(/\s+/).map((w) => w.replace(/^\.\//, "")).find((w) => known.has(w));
+		if (named) hints.push({
+			file: named,
+			line: 1,
+			why: `named by ${start.from}`
+		});
+	}
+	const seen = /* @__PURE__ */ new Set();
+	return hints.filter((h) => {
+		const key = `${h.file}:${h.line.toString()}`;
+		return seen.has(key) ? false : (seen.add(key), true);
+	});
+}
+/** What --explain shows: the files the reader may ask for, and those it never gets, with why. */
+async function whatMayBeRead(root) {
+	const mayRead = [];
+	const never = [];
+	for (const path of await repositoryFiles(root)) {
+		const why = neverRead(path);
+		const size = (await stat(join(root, path)).catch(() => null))?.size ?? 0;
+		if (why) never.push({
+			path,
+			why
+		});
+		else if (size > LIMITS.maxFileBytes) never.push({
+			path,
+			why: "it is over 1 MB"
+		});
+		else mayRead.push(path);
+	}
+	return {
+		mayRead,
+		neverSent: never
+	};
+}
+/** What a stronger model should look at again, each in a line it can act on. */
+function unsureOf(u, v) {
+	const at = (x) => `${x.file}:${x.line.toString()}`;
+	const low = (x) => x.confidence < CONFIDENCE_THRESHOLD;
+	const out = [
+		...v.dropped.map((d) => `${d.what} did not hold: ${d.why}`),
+		...u.tools.filter(low).map((t) => `the tool ${t.name} at ${at(t)}: what it can do`),
+		...u.tools.filter((t) => t.can === "read" && [
+			"email",
+			"subprocess",
+			"code"
+		].includes(t.leavesBy)).map((t) => `the tool ${t.name} at ${at(t)} is called read only, but its effect leaves by ${t.leavesBy}`),
+		...u.waysIn.filter(low).map((w) => `the way in ${w.name} at ${at(w)}: who controls it`),
+		...u.rules.filter(low).map((r) => `the rule "${r.never}"`)
+	];
+	if (u.modelCalls.length > 0 && u.tools.length === 0) out.push("the code calls a model but no tool was found: whether the model is given any tools");
+	if (!u.entry || low(u.entry)) out.push("how a person sends the app a message, and where the reply is");
+	if (u.start.length === 0) out.push("the command that starts the app");
+	return out;
+}
+/** The map with only what held when checked against the code. */
+function keepPassing(u, v) {
+	const at = (x) => `${x.file}:${x.line.toString()}`;
+	const facts = new Set(v.facts.map((f) => `${f.kind} ${f.file}:${f.line.toString()}`));
+	const held = (kind, x) => facts.has(`${kind} ${at(x)}`);
+	const commands = new Set(v.start.map((s) => s.command));
+	const unclear = new Set(v.unclear.map(at));
+	return {
+		...u,
+		agents: u.agents.filter((x) => held("agent", x)),
+		modelCalls: u.modelCalls.filter((x) => held("model", x)),
+		tools: u.tools.filter((t) => v.effects.has(t.name)),
+		systemPrompts: u.systemPrompts.filter((x) => held("system-prompt", x)),
+		waysIn: u.waysIn.filter((w) => w.kind === "conversation" || held("way-in", w)),
+		entry: u.entry && !v.dropped.some((d) => d.what === `the route ${u.entry?.path ?? ""}` || d.what === `the route at ${at(u.entry)}`) ? u.entry : null,
+		start: u.start.filter((s) => commands.has(s.command)),
+		rules: v.understanding.rules,
+		unclear: u.unclear.filter((x) => unclear.has(at(x)))
+	};
+}
+/** Per item, the more confident of two readings, keyed by what it is and where. */
+function preferConfident(first, second) {
+	const pick = (a, b, key) => {
+		const merged = new Map(a.map((x) => [key(x), x]));
+		for (const item of b) {
+			const existing = merged.get(key(item));
+			if (!existing || item.confidence > existing.confidence) merged.set(key(item), item);
+		}
+		return [...merged.values()];
+	};
+	const at = (x) => `${x.file}:${x.line.toString()}`;
+	return {
+		...first,
+		agents: pick(first.agents, second.agents, (x) => x.name),
+		modelCalls: pick(first.modelCalls, second.modelCalls, at),
+		tools: pick(first.tools, second.tools, (t) => t.name.toLowerCase()),
+		systemPrompts: pick(first.systemPrompts, second.systemPrompts, at),
+		waysIn: pick(first.waysIn, second.waysIn, (w) => w.name.toLowerCase()),
+		privateData: pick(first.privateData, second.privateData, (d) => d.name),
+		entry: (second.entry?.confidence ?? 0) > (first.entry?.confidence ?? 0) ? second.entry : first.entry,
+		start: pick(first.start, second.start, (s) => s.command),
+		rules: pick(first.rules, second.rules, (r) => r.never),
+		unclear: second.unclear.length > 0 ? second.unclear : first.unclear,
+		summary: second.summary || first.summary
+	};
+}
+// ../../packages/scan/src/ask.ts
+var MOST_TURNS = 12;
+/** Said when no answer held: never a guess in its place. */
+var NO_CHECKED_ANSWER = "I could not give an answer I could check against your code. Try asking about one file, one route or one tool.";
+/** The citations in a piece of text that do not hold: a file that is not here, or a line past its end. */
+async function checkCitations(text, root) {
+	const problems = [];
+	for (const m of text.matchAll(/([\w./-]+\.[A-Za-z0-9]{1,6}):(\d+)(?:-(\d+))?/g)) {
+		const [cited, path, from, to] = m;
+		const inRepo = await insideRepository(root, path);
+		if (inRepo === null) {
+			problems.push(`${cited} names ${path}, which is not in the repository`);
+			continue;
+		}
+		const lines = (await readFile(join(root, inRepo), "utf8").catch(() => "")).split("\n").length;
+		const last = Number(to ?? from);
+		if (Number(from) < 1 || last > lines) problems.push(`${cited} cites a line past the end of ${path}, which has ${lines.toString()} lines`);
+	}
+	return problems;
+}
+async function answerQuestion(input) {
+	const { result, outline, consent } = input;
+	const symbols = result.project.files.map(symbolsOf);
+	const graph = buildGraph(result.project.files, symbols, entryHints(result));
+	const tools = createTools({
+		root: result.look.root,
+		symbols,
+		graph,
+		consent,
+		knownValues: input.knownValues
+	});
+	const base = {
+		version: 1,
+		scanId: randomUUID(),
+		mode: "answer",
+		consent,
+		outline,
+		entries: graph.entries.slice(0, 50),
+		question: input.question
+	};
+	const steps = [];
+	let turns = 0;
+	let retried = false;
+	while (turns < MOST_TURNS) {
+		turns++;
+		const reply = await input.turn({
+			...base,
+			steps
+		});
+		if (reply.answer) {
+			const problems = [...reply.problems ?? [], ...await checkCitations(reply.answer, result.look.root)];
+			if (problems.length === 0) return {
+				answer: reply.answer,
+				checked: true,
+				turns
+			};
+			if (retried) break;
+			retried = true;
+			steps.push({
+				role: "answer",
+				text: reply.answer
+			}, {
+				role: "checks",
+				problems
+			});
+			continue;
+		}
+		if (reply.stopped || reply.calls.length === 0) break;
+		const calls = reply.calls.slice(0, 6);
+		steps.push({
+			role: "model",
+			calls,
+			note: reply.note
+		});
+		const results = [];
+		for (const call of calls) {
+			const answer = await tools.run(call);
+			results.push({
+				id: call.id,
+				text: answer.text.slice(0, 2e4)
+			});
+			input.onProgress?.(answer.about);
+			await input.onSent?.({
+				what: answer.about,
+				chars: answer.text.length
+			});
+		}
+		steps.push({
+			role: "tools",
+			results
+		});
+	}
+	return {
+		answer: NO_CHECKED_ANSWER,
+		checked: false,
+		turns
+	};
+}
 // ../../packages/scan/src/index.ts
 async function scanFolder(root) {
 	const found = await look(root);
 	const { facts, adapters, project } = await readFacts(found);
+	found.startCommands.push(...await startCandidates(found, project));
 	return {
 		look: found,
 		facts,
@@ -13686,7 +14493,7 @@ var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-
 /** Returns a regex for validating an RFC 9562/4122 UUID.
 *
 * @param version Optionally specify a version 1-8. If no version is specified, all versions are supported. */
-var uuid = (version) => {
+var uuid$1 = (version) => {
 	if (!version) return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
 	return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
@@ -14221,8 +15028,8 @@ var $ZodUUID = /*@__PURE__*/ $constructor("$ZodUUID", (inst, def) => {
 			v8: 8
 		}[def.version];
 		if (v === void 0) throw new Error(`Invalid UUID version: "${def.version}"`);
-		def.pattern ?? (def.pattern = uuid(v));
-	} else def.pattern ?? (def.pattern = uuid());
+		def.pattern ?? (def.pattern = uuid$1(v));
+	} else def.pattern ?? (def.pattern = uuid$1());
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodEmail = /*@__PURE__*/ $constructor("$ZodEmail", (inst, def) => {
@@ -14955,6 +15762,70 @@ var $ZodUnion = /*@__PURE__*/ $constructor("$ZodUnion", (inst, def) => {
 		});
 	};
 });
+function discriminatorMap(def) {
+	const map = /* @__PURE__ */ new Map();
+	for (const option of def.options) {
+		const values = option._zod.propValues?.[def.discriminator];
+		if (!values || values.size === 0) throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(option)}"`);
+		for (const value of values) if (map.has(value)) {
+			if (value !== void 0) throw new Error(`Duplicate discriminator value "${String(value)}"`);
+			map.set(value, null);
+		} else map.set(value, option);
+	}
+	return map;
+}
+var $ZodDiscriminatedUnion = /*@__PURE__*/ $constructor("$ZodDiscriminatedUnion", (inst, def) => {
+	def.inclusive = false;
+	$ZodUnion.init(inst, def);
+	const _super = inst._zod.parse;
+	defineLazyInternal(inst, "propValues", (zod) => {
+		const propValues = {};
+		let undefinedCount = 0;
+		for (const option of zod.def.options) {
+			const pv = option._zod.propValues;
+			if (!pv || Object.keys(pv).length === 0) throw new Error(`Invalid discriminated union option at index "${zod.def.options.indexOf(option)}"`);
+			if (pv[zod.def.discriminator]?.has(void 0)) undefinedCount++;
+			for (const [k, v] of Object.entries(pv)) {
+				if (!Object.prototype.hasOwnProperty.call(propValues, k)) assignProp(propValues, k, /* @__PURE__ */ new Set());
+				for (const val of v) propValues[k].add(val);
+			}
+		}
+		if (!zod.def.unionFallback && undefinedCount > 1) propValues[zod.def.discriminator]?.delete(void 0);
+		return propValues;
+	});
+	def.options.forEach((option, i) => {
+		const propShape = rawShape(option._zod.def);
+		if (propShape && !Object.prototype.hasOwnProperty.call(propShape, def.discriminator)) throw new Error(`Invalid discriminated union option at index "${i}"`);
+	});
+	const disc = cached(() => discriminatorMap(def));
+	inst._zod.parse = (payload, ctx) => {
+		const input = payload.value;
+		if (!isObject(input)) {
+			payload.issues.push({
+				code: "invalid_type",
+				expected: "object",
+				input,
+				inst
+			});
+			return payload;
+		}
+		const value = input?.[def.discriminator];
+		const opt = disc.value.get(value);
+		if (opt && (value !== void 0 || ctx.direction !== "backward")) return opt._zod.run(payload, ctx);
+		if (def.unionFallback || ctx.direction === "backward") return _super(payload, ctx);
+		payload.issues.push({
+			code: "invalid_union",
+			errors: [],
+			note: "No matching discriminator",
+			discriminator: def.discriminator,
+			options: Array.from(disc.value.keys()).filter((value) => disc.value.get(value) !== null),
+			input,
+			path: [def.discriminator],
+			inst
+		});
+		return payload;
+	};
+});
 var $ZodIntersection = /*@__PURE__*/ $constructor("$ZodIntersection", (inst, def) => {
 	$ZodType.init(inst, def);
 	inst._zod.parse = (payload, ctx) => {
@@ -17839,6 +18710,9 @@ var ZodUUID = /*@__PURE__*/ $constructor("ZodUUID", (inst, def) => {
 	$ZodUUID.init(inst, def);
 	ZodStringFormat.init(inst, def);
 });
+function uuid(params) {
+	return /* @__PURE__ */ _uuid(ZodUUID, params);
+}
 var ZodURL = /*@__PURE__*/ $constructor("ZodURL", (inst, def) => {
 	$ZodURL.init(inst, def);
 	ZodStringFormat.init(inst, def);
@@ -18104,6 +18978,18 @@ function union(options, params) {
 		...normalizeParams(params)
 	});
 }
+var ZodDiscriminatedUnion = /*@__PURE__*/ $constructor("ZodDiscriminatedUnion", (inst, def) => {
+	ZodUnion.init(inst, def);
+	$ZodDiscriminatedUnion.init(inst, def);
+});
+function discriminatedUnion(discriminator, options, params) {
+	return new ZodDiscriminatedUnion({
+		type: "union",
+		options,
+		discriminator,
+		...normalizeParams(params)
+	});
+}
 var ZodIntersection = /*@__PURE__*/ $constructor("ZodIntersection", (inst, def) => {
 	$ZodIntersection.init(inst, def);
 	ZodType.init(inst, def);
@@ -18529,6 +19415,11 @@ var Workspace = object({
 	*/
 	proofValue: string().optional()
 });
+/**
+* Every ID we make: a workspace's eight hex characters, a slug, R-12, F-001. Nothing with a slash,
+* so an ID from a path or a body can never name a document in another workspace's tree.
+*/
+var DocId = string().regex(/^[A-Za-z0-9_-]{1,64}$/);
 var SystemKind = _enum([
 	"agent",
 	"research-assistant",
@@ -18681,6 +19572,8 @@ var System = object({
 		}))
 	}).optional(),
 	tools: array(ToolSetup).default([]),
+	/** When a runner last asked for this system's attempts. */
+	runnerSeenAt: Timestamp.optional(),
 	summaryText: string().optional(),
 	policyId: string().optional(),
 	languages: array(string()).default(["English"]),
@@ -18877,7 +19770,9 @@ var Review = object({
 		returning: array(string()),
 		newBreaks: array(string()),
 		inBoth: array(string()),
-		fixedSoFar: array(string())
+		fixedSoFar: array(string()),
+		/** Replays that met errors more than answers, counted apart. */
+		notReplayed: array(string()).default([])
 	}).optional(),
 	/** Set when a review stops itself: the cost limit, or errors. */
 	stoppedBecause: string().optional(),
@@ -19053,8 +19948,11 @@ var Clause = object({
 		"medium"
 	]),
 	line: _enum(["not-allowed", "allowed-in-context"]),
+	/** The exact sentence it came from, when it came from the team's own document. */
 	source: string().optional(),
+	/** `proposed`: read from a document and not yet confirmed by a person, so never tested. */
 	state: _enum([
+		"proposed",
 		"confirmed",
 		"needs-decision",
 		"settled"
@@ -19062,6 +19960,26 @@ var Clause = object({
 	settledBy: number().optional(),
 	neverTested: boolean().optional()
 });
+/** One version of a team's content policy. Changing a clause makes a new version. */
+var PolicyVersion = object({
+	version: string(),
+	/** Where it was read from: a file's name, an address, or "pasted text". */
+	from: string(),
+	by: string().optional(),
+	at: Timestamp,
+	clauses: array(Clause),
+	/** Areas of the standard policy the document does not cover. */
+	gaps: array(string()),
+	/** Clauses the model proposed whose quote was not found in the document, so they were left out. */
+	dropped: number().default(0)
+});
+var PolicyRecord = object({
+	id: string(),
+	name: string(),
+	latest: string(),
+	createdAt: Timestamp,
+	createdBy: string()
+});
 var Label = object({
 	checkId: string(),
 	itemRef: string(),
@@ -19440,32 +20358,133 @@ var UnderstandingV3 = object({
 	kind: SystemKind.optional(),
 	summary: string()
 });
-/** What the scan's last step sends to connect a system. */
-var RegisterSystem = object({
-	name: string(),
-	kind: SystemKind,
-	team: string().default("Not set"),
-	waysIn: array(WayIn),
-	rules: array(MapRule),
-	tools: array(ToolSetup),
-	knot: string(),
-	reaches: string(),
-	ruleOfTwo: object({
-		untrustedInput: string(),
-		privateData: string(),
-		outsideActions: string().nullable()
-	}),
-	parts: VersionParts,
+/**
+* The scan's reader, a turn at a time: the model asks for files and searches, the person's machine
+* answers within what the person agreed to send, and the model ends with the map. The machine keeps
+* the steps and the tools; the server keeps no state but the budget. ADR 0086.
+*/
+var ReadingCall = object({
+	id: string().max(40),
+	tool: _enum([
+		"list",
+		"glob",
+		"grep",
+		"read",
+		"symbols"
+	]),
+	/** list: the folder. */
+	dir: string().max(400).optional(),
+	/** glob: a file pattern, such as every Python file under src. */
+	pattern: string().max(200).optional(),
+	/** grep: the literal text to find, and the files to look in. */
+	text: string().max(200).optional(),
+	glob: string().max(200).optional(),
+	/** read and symbols: the file; read takes lines from and to. */
+	path: string().max(400).optional(),
+	from: number().int().optional(),
+	to: number().int().optional(),
+	/** symbols: a name to find where it is defined and called. */
+	name: string().max(200).optional()
+});
+var ReadingStep = discriminatedUnion("role", [
+	object({
+		role: literal("model"),
+		calls: array(ReadingCall).max(6),
+		note: string().max(2e3).optional()
+	}),
+	object({
+		role: literal("tools"),
+		results: array(object({
+			id: string().max(40),
+			text: string().max(2e4)
+		})).max(6)
+	}),
+	object({
+		role: literal("map"),
+		map: UnderstandingV3
+	}),
+	object({
+		role: literal("answer"),
+		text: string().max(4e3)
+	}),
+	object({
+		role: literal("checks"),
+		problems: array(string().max(500)).max(60)
+	})
+]);
+var ScanTurn = object({
+	version: literal(1),
+	scanId: uuid(),
+	/**
+	* map reads and answers with the map; settle looks again at what the map left unsure; answer
+	* reads to answer the person's question in a few sentences.
+	*/
+	mode: _enum([
+		"map",
+		"settle",
+		"answer"
+	]),
+	consent: _enum(["outline", "code"]),
+	/** The same every turn, so the model's cache keeps it. */
+	outline: ScanOutlineV2,
+	entries: array(object({
+		...Where,
+		why: string().max(200)
+	})).max(50),
+	steps: array(ReadingStep).max(60),
+	/** settle: what to look at again, each with why. */
+	unsure: array(string().max(500)).max(10).optional(),
+	/** answer: the person's question, in their words. */
+	question: string().max(2e3).optional()
+});
+/** What the model answers each turn: calls, or the map when it has read enough. */
+var ReadingAnswer = object({
+	calls: array(ReadingCall).max(6),
+	note: string().max(2e3).optional(),
+	map: UnderstandingV3.nullable(),
+	/** In answer mode: the answer, citing file and line, when it has read enough. */
+	answer: string().max(4e3).nullable().optional()
+});
+var ScanTurnReply = object({
+	calls: array(ReadingCall),
+	note: string().optional(),
+	map: UnderstandingV3.nullable(),
+	answer: string().optional(),
+	/** What the text check found wrong in the answer, for one try to correct it. */
+	problems: array(string()).optional(),
+	/** Why reading ended without the model choosing to: no turns or no budget left. */
+	stopped: _enum([
+		"turns",
+		"budget",
+		"unreadable"
+	]).optional()
+});
+/** What the scan's last step sends to connect a system. */
+var RegisterSystem = object({
+	name: string(),
+	kind: SystemKind,
+	team: string().default("Not set"),
+	waysIn: array(WayIn),
+	rules: array(MapRule),
+	tools: array(ToolSetup),
+	knot: string(),
+	reaches: string(),
+	ruleOfTwo: object({
+		untrustedInput: string(),
+		privateData: string(),
+		outsideActions: string().nullable()
+	}),
+	parts: VersionParts,
 	versionLabel: string(),
 	summary: string().optional()
 });
 var StartReview = object({
-	systemId: string().optional(),
+	systemId: DocId.optional(),
 	system: string().optional(),
 	quick: boolean().default(false),
 	ci: boolean().default(false),
 	/** The most answered attempts per path. Absent means the default for quick or full. */
-	budget: number().int().positive().optional(),
+	budget: number().int().positive().max(1e4).optional(),
 	why: string().optional(),
 	startedBy: _enum([
 		"person",
@@ -19479,7 +20498,9 @@ var StartReview = object({
 	changedTools: array(string()).default([]),
 	/** Non-empty narrows the checks, otherwise every check that applies runs. */
 	checks: array(string()).default([]),
-	paths: array(string()).default([])
+	paths: array(string()).default([]),
+	/** The CLI asking serves the attempts itself, so no other runner has to be answering. */
+	runnerHere: boolean().default(false)
 });
 var ApiError = object({
 	error: string(),
@@ -19570,7 +20591,12 @@ var ModelosConfig = object({
 	system: string(),
 	kind: SystemKind.optional(),
 	workspace: string().optional(),
-	consent: _enum(["outline", "none"]).optional(),
+	/** What the scan may send: code it asks for, only the outline, or nothing. ADR 0086. */
+	consent: _enum([
+		"code",
+		"outline",
+		"none"
+	]).optional(),
 	start: object({
 		command: string().optional(),
 		settings: string().optional(),
@@ -19659,6 +20685,65 @@ function renderConfig(config) {
 async function writeConfig(dir, config) {
 	await writeFile(join(dir, CONFIG_FILE), renderConfig(config));
 }
+// src/commands-here.ts
+/** Package scripts that build, test or install. None of them starts an app. */
+var NOT_A_START = /^(build|test|lint|format|typecheck|check|install|prepare|clean|ci)(:|$)/;
+/** Whether `name` is a command this machine can run, as its shell would find it. */
+async function onPath(name, env = process.env) {
+	const key = Object.keys(env).find((k) => k.toUpperCase() === "PATH") ?? "PATH";
+	const windows = process.platform === "win32";
+	const endings = windows ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";")] : [""];
+	for (const dir of (env[key] ?? "").split(delimiter)) {
+		if (!dir) continue;
+		for (const ending of endings) {
+			const path = join(dir, name + ending.toLowerCase());
+			if (!await stat(path).then((found) => found.isFile(), () => false)) continue;
+			if (windows) return true;
+			if (await access(path, constants.X_OK).then(() => true, () => false)) return true;
+		}
+	}
+	return false;
+}
+var exists = (path) => access(path).then(() => true, () => false);
+async function scriptsIn(dir) {
+	const text = await readFile(join(dir, "package.json"), "utf8").catch(() => "{}");
+	try {
+		return JSON.parse(text).scripts ?? {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Why `command` cannot start the app in `dir`, in one sentence, or null when it can as far as can
+* be told without running it.
+*/
+async function whyNotRunnable(dir, command) {
+	const words = command.trim().split(/\s+/);
+	const first = words[0];
+	if (!first) return "it is empty";
+	if (/[?!]$/.test(command.trim()) || /, /.test(command) || words.length > 12) return "it reads as a sentence, not a command";
+	if ([
+		"npm",
+		"pnpm",
+		"yarn",
+		"bun"
+	].includes(first)) {
+		const named = words[1] === "run" || words[1] === "run-script" ? words[2] : words[1];
+		if (named && ![
+			"start",
+			"exec",
+			"dlx",
+			"x"
+		].includes(named)) {
+			if (NOT_A_START.test(named)) return `${words.slice(0, words.indexOf(named) + 1).join(" ")} does not start the app`;
+			if (!(named in await scriptsIn(dir))) return `package.json has no script named ${named}`;
+		} else if (named === "start" && !("start" in await scriptsIn(dir))) return "package.json has no start script";
+	}
+	const file = [first, ...words.slice(1)].find((w) => /\.(m?js|cjs|ts|py|sh)$/.test(w));
+	if (file && !await exists(join(dir, file))) return `${file} is not in this repository`;
+	if (!(await exists(join(dir, first)) || await exists(join(dir, "node_modules", ".bin", first))) && !await onPath(first)) return words.length >= 3 && !/[-./:=]/.test(command) ? "it reads as a sentence, not a command" : `${first} is not installed on this machine`;
+	return null;
+}
 // ../../hooks/node/src/hosts.mjs
 var MODEL_HOSTS = [
 	/(^|\.)api\.openai\.com$/,
@@ -19792,6 +20877,34 @@ function whyAppStopped(output) {
 	const lines = output.split("\n").map((l) => l.trim()).filter((l) => l && !/^at /.test(l) && !/^Node\.js v/.test(l));
 	return (lines.findLast((l) => /\b\w*(Error|Exception)\b/.test(l)) ?? lines.at(-1))?.slice(0, 200);
 }
+/**
+* PATH for the app: this Node first, then the repository's own tools, as `npm run` would have
+* them. Windows spells the key `Path` and separates with `;`.
+*/
+function appPath(dir, env = process.env) {
+	const key = Object.keys(env).find((name) => name.toUpperCase() === "PATH") ?? "PATH";
+	return { [key]: [
+		dirname(process.execPath),
+		resolve(dir, "node_modules", ".bin"),
+		env[key]
+	].filter(Boolean).join(delimiter) };
+}
+/** Stops an app and everything it started. */
+function stopTree(child) {
+	if (!child.pid) return;
+	try {
+		if (process.platform === "win32") spawn("taskkill", [
+			"/pid",
+			child.pid.toString(),
+			"/t",
+			"/f"
+		], {
+			stdio: "ignore",
+			windowsHide: true
+		});
+		else process.kill(-child.pid, "SIGTERM");
+	} catch {}
+}
 /** Starts the app with hooks attached, several times over so attempts can run side by side. */
 async function startAppPool(input) {
 	const { config, dir } = input;
@@ -19831,17 +20944,18 @@ async function startAppPool(input) {
 			cwd: dir,
 			stdio: [
 				"ignore",
-				"ignore",
+				"pipe",
 				"pipe"
 			],
-			detached: true,
+			detached: process.platform !== "win32",
+			windowsHide: true,
 			env: {
 				...process.env,
 				...input.extraEnv,
-				PATH: `${dirname(process.execPath)}:${process.env.PATH ?? ""}`,
+				...appPath(dir),
 				PORT: instance.port.toString(),
-				NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ""} --import=${hookNode()}`.trim(),
-				PYTHONPATH: `${hookPython()}:${process.env.PYTHONPATH ?? ""}`,
+				NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ""} --import=${pathToFileURL(hookNode()).href}`.trim(),
+				PYTHONPATH: [hookPython(), process.env.PYTHONPATH].filter(Boolean).join(delimiter),
 				MODELOS_SECURE_HOOK: hookJson,
 				MODELOS_SECURE_RUNNER_URL: runnerUrl,
 				MODELOS_SECURE_INSTANCE: instance.id,
@@ -19854,10 +20968,12 @@ async function startAppPool(input) {
 			}
 		});
 		instance.child = child;
-		child.stderr?.on("data", (chunk) => {
-			instance.output = (instance.output + chunk.toString()).slice(-4e3);
+		const keep = (chunk) => {
+			instance.output = (instance.output + chunk.toString()).slice(-16e3);
 			if (!input.quiet) process.stderr.write(chunk);
-		});
+		};
+		child.stdout?.on("data", keep);
+		child.stderr?.on("data", keep);
 		let exited = false;
 		child.once("exit", () => {
 			exited = true;
@@ -19900,9 +21016,7 @@ async function startAppPool(input) {
 	instances.push(...launched.map((l) => l.instance));
 	const stop = () => {
 		stopping = true;
-		for (const instance of instances) try {
-			if (instance.child.pid) process.kill(-instance.child.pid, "SIGTERM");
-		} catch {}
+		for (const instance of instances) stopTree(instance.child);
 		server.close();
 		proxy.stop();
 	};
@@ -19947,7 +21061,7 @@ async function startAppPool(input) {
 				signal: AbortSignal.timeout(17e4)
 			}).finally(() => proxy.end());
 			const reply = response.ok ? await replyText(response, entry.reply) : "";
-			const ended = await (await fetch(`${control}/end`, { method: "POST" })).json();
+			const { modelFailures = [], ...ended } = await (await fetch(`${control}/end`, { method: "POST" })).json();
 			const seen = {
 				...ended,
 				edgeHeld: [...ended.edgeHeld ?? [], ...proxy.stoppedSince(started).map(({ method, host, path, bytes }) => ({
@@ -19964,6 +21078,15 @@ async function startAppPool(input) {
 				reply: "",
 				latencyMs: Date.now() - started
 			};
+			const modelFailed = modelFailures[0];
+			const empty = !reply.trim() && seen.heldCalls.length === 0 && seen.modelCalls.length === 0 && seen.ranTools.length === 0;
+			if (modelFailed || empty) return {
+				...seen,
+				answered: false,
+				error: modelFailed ? `The app's own model call failed (${modelFailed.why}), so its reply is not counted.` : "The app answered with nothing where its reply goes.",
+				reply: "",
+				latencyMs: Date.now() - started
+			};
 			return {
 				...seen,
 				answered: true,
@@ -19982,7 +21105,8 @@ async function startAppPool(input) {
 		instances,
 		send,
 		stop,
-		lastStop: () => lastStop
+		lastStop: () => lastStop,
+		output: () => instances[0]?.output ?? ""
 	};
 }
 async function takeInstance(instances) {
@@ -20054,35 +21178,6 @@ var freePort = () => new Promise((resolve) => {
 		server.close(() => resolve(port));
 	});
 });
-/** Runs the start command briefly to read why it stopped. Nothing is kept from it. */
-async function whyItStopped(ctx, command) {
-	return new Promise((resolve) => {
-		let output = "";
-		const child = spawn(command, {
-			shell: true,
-			cwd: ctx.dir,
-			env: {
-				...process.env,
-				...ctx.extraEnv
-			},
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-		child.stdout.on("data", (c) => output += c.toString());
-		child.stderr.on("data", (c) => output += c.toString());
-		const timer = setTimeout(() => {
-			child.kill("SIGTERM");
-			resolve(null);
-		}, 8e3);
-		child.once("exit", () => {
-			clearTimeout(timer);
-			resolve(output);
-		});
-	});
-}
 function missingSetting(output) {
 	return output.match(/([A-Z][A-Z0-9_]{2,}) (?:is not set|environment variable|must be set|is required|not found)/)?.[1] ?? output.match(/KeyError: ['"]([A-Z][A-Z0-9_]+)['"]/)?.[1] ?? output.match(/process\.env\.([A-Z][A-Z0-9_]+)/)?.[1];
 }
@@ -20121,7 +21216,7 @@ function settingsFixes(ctx, name, keyInShell) {
 * error's last lines go with it, secrets taken out. Without that consent the rules alone decide.
 */
 function explainWith(api, config) {
-	if (!api || config.consent !== "outline") return void 0;
+	if (!api || config.consent !== "outline" && config.consent !== "code") return void 0;
 	return (facts) => api.post("/scan/failure", facts).then((r) => r.explanation);
 }
 /** What a fix may name, from the repository itself when the caller did not say. */
@@ -20152,22 +21247,16 @@ var RUNNERS = [
 	"bun",
 	"make"
 ];
-async function onPath(name) {
-	for (const dir of (process.env.PATH ?? "").split(":")) {
-		if (!dir) continue;
-		if (await access(join(dir, name), constants.X_OK).then(() => true, () => false)) return true;
-	}
-	return false;
-}
 /** The last lines the app printed, with secrets taken out, for the model to read. */
 async function failureFacts(known, ctx, command, output) {
 	const firstWords = [...RUNNERS, ...[command, ...ctx.startCommands.map((c) => c.command)].map((c) => c.trim().split(/\s+/)[0] ?? "")];
 	const available = [];
 	for (const name of new Set(firstWords.filter(Boolean))) if (await onPath(name)) available.push(name);
+	const values = await localValues(ctx.dir, known.settingsFiles);
 	return {
-		command,
-		output: redact(output).split("\n").filter((l) => l.trim()).slice(-60).map((l) => l.slice(0, 300)),
-		scripts: ctx.startCommands.map((c) => c.command),
+		command: redact(command, values),
+		output: redact(output, values).split("\n").filter((l) => l.trim()).slice(-60).map((l) => l.slice(0, 300)),
+		scripts: ctx.startCommands.map((c) => redact(c.command, values)),
 		settings: known.settings,
 		settingsFiles: known.settingsFiles,
 		files: known.files,
@@ -20199,12 +21288,11 @@ function toFix(ctx, fix) {
 		};
 		case "change-command": return {
 			label: fix.label,
-			apply: async () => {
+			apply: () => {
 				config.start = {
 					...config.start,
 					command: fix.command
 				};
-				await save();
 			}
 		};
 		case "change-port": return {
@@ -20214,7 +21302,6 @@ function toFix(ctx, fix) {
 					...config.start,
 					command: commandForPort(config.start?.command ?? "", await freePort())
 				};
-				await save();
 			}
 		};
 		case "run-command": return {
@@ -20254,38 +21341,70 @@ function toFix(ctx, fix) {
 		};
 	}
 }
+/** What someone types when they do not know the command. */
+var DONT_KNOW = /^(i\s+)?(don'?t|do not)\s+know|^not\s+sure|^no\s+idea|^\?$/i;
 /**
-* Asks for the start command. An empty answer, or none at all when nobody is there to type, changes
-* nothing and is never saved, so the command found in the repository is still offered next time.
+* Asks for the start command, and checks each answer before keeping it. An empty answer, "I don't
+* know", or none at all when nobody is there to type, changes nothing. Nothing is saved until the
+* app has started with it.
 */
 async function typeTheCommand(ctx) {
-	const typed = (await askText("How do you start the app?")).trim();
-	if (!typed) return;
-	ctx.config.start = {
-		...ctx.config.start,
-		command: typed
-	};
-	await ctx.onConfig(ctx.config);
+	for (let tries = 0; tries < 3; tries++) {
+		const typed = (await askText("How do you start the app?")).trim();
+		if (!typed || DONT_KNOW.test(typed)) return;
+		const why = await whyNotRunnable(ctx.dir, typed);
+		if (!why) {
+			ctx.config.start = {
+				...ctx.config.start,
+				command: typed
+			};
+			return;
+		}
+		say(`  That will not start it: ${why}.`);
+	}
 }
-/** Starts the pool, or fails with what happened and how to fix it. */
-async function startApp(ctx, instances) {
-	const { config } = ctx;
-	const command = config.start?.command;
-	if (!command) {
-		const fixes = ctx.startCommands.map((c) => ({
+/** The commands found in the repository that can run here, as fixes to choose from. */
+async function candidateFixes(ctx) {
+	const fixes = [];
+	for (const c of ctx.startCommands) {
+		if (c.command === ctx.config.start?.command) continue;
+		if (await whyNotRunnable(ctx.dir, c.command)) continue;
+		fixes.push({
 			label: `${c.command}   (from ${c.from})`,
-			apply: () => void (config.start = {
-				...config.start,
+			apply: () => void (ctx.config.start = {
+				...ctx.config.start,
 				command: c.command
 			})
-		}));
-		fixes.push({
-			label: "Type the command",
-			apply: () => typeTheCommand(ctx)
 		});
-		throw new Failure("I can't tell how to start the app.", fixes);
 	}
-	if (ctx.startCommands.length > 1 && !config.start?.settings && !config.start?.command) throw new Failure("I can't tell how to start the app.", []);
+	return fixes;
+}
+/** The way out when nobody knows the command yet: say so plainly, and stop with what is kept. */
+var notKnown = {
+	label: "I don't know",
+	apply: () => {
+		throw new Failure("Then the app cannot be started yet. Your other answers are kept. When you know the command, put it under start: in modelos-secure.yaml, or run the same command again and type it.", []);
+	}
+};
+/** Starts the pool, or fails with what happened and how to fix it. */
+async function startApp(ctx, instances) {
+	const { config } = ctx;
+	const command = config.start?.command;
+	const typeIt = {
+		label: "Type the command",
+		apply: () => typeTheCommand(ctx)
+	};
+	if (!command) throw new Failure("I can't tell how to start the app.", [
+		...await candidateFixes(ctx),
+		typeIt,
+		notKnown
+	]);
+	const wrong = await whyNotRunnable(ctx.dir, command);
+	if (wrong) throw new Failure(`The start command ${command} cannot run here: ${wrong}.`, [
+		...await candidateFixes(ctx),
+		typeIt,
+		notKnown
+	]);
 	const port = portOf(command);
 	if (port && !await portFree(port)) throw new Failure(`Port ${port.toString()} is in use.`, [{
 		label: "Use the next free port",
@@ -20295,11 +21414,12 @@ async function startApp(ctx, instances) {
 				...config.start,
 				command: commandForPort(command, await freePort())
 			};
-			await ctx.onConfig(config);
 		}
 	}, {
 		label: "Stop and let me close it",
-		apply: () => process.exit(0)
+		apply: () => {
+			throw new Interrupted();
+		}
 	}]);
 	if (!config.start?.entry) throw new Failure("I can't tell how a message reaches the app.", [{
 		label: "Type the route that takes a message",
@@ -20317,6 +21437,25 @@ async function startApp(ctx, instances) {
 			await ctx.onConfig(config);
 		}
 	}]);
+	const file = config.start?.settings;
+	if (file && !await readFile(join(ctx.dir, file)).catch(() => null)) throw new Failure(`The settings file ${file} is not in this repository.`, [{
+		label: "Point to another settings file",
+		apply: async () => {
+			const other = await askText("Which settings file? It stays on this machine.");
+			config.start = {
+				...config.start,
+				settings: other || void 0
+			};
+		}
+	}, {
+		label: "Start without a settings file",
+		apply: () => {
+			config.start = {
+				...config.start,
+				settings: void 0
+			};
+		}
+	}]);
 	const settings = await loadSettings(ctx.dir, config.start?.settings);
 	Object.assign(ctx.extraEnv, settings, ctx.extraEnv);
 	const basePort = await freePort();
@@ -20331,20 +21470,19 @@ async function startApp(ctx, instances) {
 	const up = pool.instances.filter((i) => i.ready);
 	if (up.length === 0) {
 		pool.stop();
-		const output = await whyItStopped(ctx, commandForPort(command, basePort));
+		const output = pool.output();
+		showOutput(output);
 		const explained = output && ctx.explain ? await ctx.explain(await failureFacts(await knownIn(ctx), ctx, command, output)).catch(() => null) : null;
-		if (explained) throw new Failure(explained.what, [...explained.fixes.map((f) => toFix(ctx, f)), {
-			label: "Type the command",
-			apply: () => typeTheCommand(ctx)
-		}], explained.cause);
+		const others = [
+			...await candidateFixes(ctx),
+			typeIt,
+			notKnown
+		];
+		if (explained) throw new Failure(explained.what, [...await runnableFixes(ctx, explained.fixes), ...others], explained.cause);
 		const missing = output ? missingSetting(output) : void 0;
 		if (missing && /(_API_KEY|_KEY|_TOKEN)$/.test(missing)) throw new Failure(`The app calls its model with ${missing}.`, settingsFixes(ctx, missing, Boolean(process.env[missing])));
 		if (missing) throw new Failure(`The app stopped: ${missing} is not set.`, settingsFixes(ctx, missing, false));
-		const lastLine = output?.trim().split("\n").at(-1);
-		throw new Failure(`The app stopped while starting${lastLine ? `: ${lastLine.slice(0, 160)}` : "."}`, [{
-			label: "Type the command",
-			apply: () => typeTheCommand(ctx)
-		}]);
+		throw new Failure(output.trim() ? "The app stopped while starting, with the output above." : "The app stopped while starting, and printed nothing.", others);
 	}
 	if (up.every((i) => !i.controlPort)) {
 		pool.stop();
@@ -20356,12 +21494,45 @@ async function startApp(ctx, instances) {
 					...config.start,
 					command: await askText("How do you start the unbundled source?")
 				};
-				await ctx.onConfig(config);
 			}
 		}]);
 	}
+	await ctx.onConfig(config);
 	return pool;
 }
+/** The last lines the app printed, as it printed them, for this machine's screen only. */
+function showOutput(output) {
+	const lines = output.trimEnd().split(/\r?\n/).slice(-20);
+	if (!lines.join("").trim()) return;
+	say();
+	say("  The app printed:");
+	for (const line of lines) say(`    ${line}`);
+}
+/** The model's fixes that can run here; a command it proposes is checked like a typed one. */
+async function runnableFixes(ctx, fixes) {
+	const kept = [];
+	for (const fix of fixes) if (fix.kind !== "change-command" || !await whyNotRunnable(ctx.dir, fix.command ?? "")) kept.push(toFix(ctx, fix));
+	return kept;
+}
+/**
+* One harmless request through the running app before a review: it must answer, and no tool
+* marked as held may run. What the hooks saw is said, never more. docs/spec/05-scan-and-cli.md#6-check
+*/
+async function checkConnection(pool, config) {
+	const check = await pool.send({
+		session: "connection-check",
+		message: "Connection check from ModelOS Secure",
+		canaries: {
+			record: "CONNECTION-CHECK",
+			prompt: "CONNECTION-CHECK"
+		}
+	});
+	const held = config.tools.filter((t) => t.during_reviews === "hold").map((t) => t.name);
+	const escaped = check.ranTools.filter((name) => held.includes(name));
+	if (escaped.length > 0) throw new Failure(`A tool marked as held ran for real: ${escaped.join(", ")}. No review starts until it is held.`, []);
+	if (!check.answered) throw new Failure(`The app did not answer the connection check: ${pool.lastStop() ?? check.error ?? "no reply"}.`, []);
+	step("Check", check.modelCalls.length === 0 ? "The app answered; the hooks saw no model call, so the review will say so" : `The app answered, and the hooks saw ${check.modelCalls.length === 1 ? "its model call" : "its model calls"}`);
+}
 // src/commands/others.ts
 async function connected() {
 	const connection = await readConnection();
@@ -20495,7 +21666,8 @@ async function exportCommand(reviewId, format, out) {
 	say(`Wrote ${file}.`);
 }
 // src/register.ts
-var slug$1 = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+/** A system's ID from its name, as the service stores it. */
+var slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 var hash = (text) => createHash("sha256").update(text).digest("hex").slice(0, 16);
 function ruleTool(check) {
 	return check.split(".")[0] ?? "reply";
@@ -20526,7 +21698,7 @@ function toRegister(config, parts, extra) {
 		versionLabel: extra.versionLabel,
 		parts,
 		waysIn: config.ways_in.map((way) => ({
-			id: slug$1(way.name),
+			id: slug(way.name),
 			name: way.name,
 			who: way.untrusted ? "Anyone who can reach it" : "People inside the company",
 			from: way.from,
@@ -20561,14 +21733,13 @@ function toRegister(config, parts, extra) {
 	};
 }
 // src/commands/review.ts
-var slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 async function reviewCommand(dir, options) {
 	const config = await readConfig(dir);
 	if (!config) throw new Error("There is no modelos-secure.yaml here. Run modelos-secure scan . first.");
 	if (options.ci && (config.skipped?.length ?? 0) > 0) {
 		say("These questions need answering locally, because CI never guesses:");
 		for (const name of config.skipped ?? []) say(`  Should reviews hold ${name}?`);
-		process.exitCode = 1;
+		process.exitCode = 3;
 		return;
 	}
 	const unheld = config.tools.filter((t) => t.held_by === "none" && (t.during_reviews === "hold" || t.during_reviews === "run" && !t.run_unheld));
@@ -20602,12 +21773,24 @@ async function reviewCommand(dir, options) {
 		yes: options.yes,
 		ci: options.ci
 	});
+	step("Start", `${config.start?.command ?? ""} with hooks attached`);
+	await withFixes(() => checkConnection(pool, config), {
+		yes: options.yes,
+		ci: options.ci
+	});
+	const serving = runRunner({
+		api,
+		pool,
+		systemId: slug(config.system),
+		signal: controller.signal
+	});
 	const review = await api.post("/reviews", {
 		systemId: slug(config.system),
 		quick: options.quick,
 		budget: options.budget,
 		ci: options.ci,
 		startedBy: options.ci ? "ci" : "cli",
+		runnerHere: true,
 		parts,
 		versionLabel,
 		why: options.ci ? `Fix check on ${versionLabel}` : options.quick ? "Quick first look" : "Full review"
@@ -20616,18 +21799,14 @@ async function reviewCommand(dir, options) {
 	say(`\n${bold(review.id)} ${review.why}, ${review.plan.paths.length.toString()} paths\n`);
 	if (standIn) say(`  The stand-in attacker writes these attempts, because our own attacker cannot be reached yet. It fills a few plain, published patterns with values from the system's map and replies, so a hold says less than one from our own attacker. Version: ${review.attackerVersion}.\n`);
 	let interrupted = false;
+	let paused = false;
 	const forget = beforeStopping(async () => {
 		interrupted = true;
 		controller.abort();
 		pool?.stop();
-		await api.post(`/reviews/${review.id}/stop`, {}).catch(() => void 0);
-	});
-	const serving = runRunner({
-		api,
-		pool,
-		systemId: slug(config.system),
-		signal: controller.signal
+		if (!paused) await api.post(`/reviews/${review.id}/stop`, {}).catch(() => void 0);
 	});
+	const waitsWhilePaused = !options.ci && interactive();
 	let last;
 	let lastPrinted = 0;
 	for (;;) {
@@ -20637,12 +21816,14 @@ async function reviewCommand(dir, options) {
 			lastPrinted = Date.now();
 			say(`  ${answered.toLocaleString("en-GB")} answered, ${(last.progress?.broken ?? 0).toString()} broken, ${(last.progress?.errors ?? 0).toString()} errors not counted`);
 		}
+		const nowPaused = last.review.status === "paused";
+		if (nowPaused && !paused && waitsWhilePaused) say(`  Paused: ${last.review.stoppedBecause ?? "it is pausing"}. This runner keeps serving, so Resume on the review's page carries on. Ctrl-C ends here and leaves it paused.`);
+		paused = nowPaused;
 		if ([
 			"done",
 			"stopped",
-			"failed",
-			"paused"
-		].includes(last.review.status) || interrupted) break;
+			"failed"
+		].includes(last.review.status) || paused && !waitsWhilePaused || interrupted) break;
 		await new Promise((r) => setTimeout(r, 2e3));
 	}
 	forget();
@@ -20659,7 +21840,10 @@ async function reviewCommand(dir, options) {
 	else if (relevant.length > 0 && standIn) say("  The stand-in attacker wrote the attempts that broke it.");
 	say(`\n  Review: ${connection.url}/reviews/${last.review.id}`);
 	const verdict = last.review.verdict;
-	if (verdict) say(`\n  New ${verdict.newBreaks.length.toString()}, fixed so far ${verdict.fixedSoFar.length.toString()}, in both ${verdict.inBoth.length.toString()}, came back ${verdict.returning.length.toString()}.`);
+	if (verdict) {
+		say(`\n  New ${verdict.newBreaks.length.toString()}, fixed so far ${verdict.fixedSoFar.length.toString()}, in both ${verdict.inBoth.length.toString()}, came back ${verdict.returning.length.toString()}.`);
+		if (verdict.notReplayed.length > 0) say(`  Not replayed, because the candidate answered with errors: ${verdict.notReplayed.join(", ")}. Errors are not counted, so these are neither fixed nor broken.`);
+	}
 	const failed = last.review.status !== "done";
 	if (options.ci && (failed || verdict?.blocks)) {
 		const why = failed ? "the review did not finish" : [...verdict.newBreaks, ...verdict.returning].join(", ") + " broke on this version";
@@ -20672,12 +21856,19 @@ async function reviewCommand(dir, options) {
 async function runnerCommand(connection, dir, systemId, instances) {
 	const config = await readConfig(dir);
 	if (!config) throw new Error("There is no modelos-secure.yaml here. Run modelos-secure scan . first.");
+	const system = systemId ?? slug(config.system);
 	const pool = await startAppPool({
 		config,
 		dir,
 		instances,
 		basePort: 18e3 + Math.floor(Math.random() * 2e3)
 	});
+	try {
+		await checkConnection(pool, config);
+	} catch (error) {
+		pool.stop();
+		throw error;
+	}
 	const controller = new AbortController();
 	for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => {
 		controller.abort();
@@ -20687,64 +21878,18 @@ async function runnerCommand(connection, dir, systemId, instances) {
 	await runRunner({
 		api: apiClient(connection),
 		pool,
-		systemId,
+		systemId: system,
 		signal: controller.signal
 	});
 }
-// src/reading.ts
-var outlineHash = (outline) => createHash("sha256").update(JSON.stringify(outline)).digest("hex");
-/** Asks the model, or reuses what it said about this exact outline before. */
-async function understandOutline(api, outline, state) {
-	const hash = outlineHash(ScanOutlineV2.parse(outline));
-	const cached = UnderstandingV3.safeParse(state.understood);
-	if (state.outlineHash === hash && cached.success) return cached.data;
-	const understood = UnderstandingV3.parse(await api.post("/scan/understand", outline));
-	state.understood = understood;
-	state.outlineHash = hash;
-	return understood;
-}
-/** What the model said, kept only where the code agrees, beside what the adapters read. */
-function read(result, understood) {
-	const verified = verifyUnderstanding(understood, result.look, result.project);
-	const acts = new Set(verified.understanding.tools.filter((t) => !t.can.startsWith("read")).map((t) => t.name));
-	return {
-		understood,
-		verified,
-		facts: mergeFacts(result.facts, verified.facts).filter((f) => !(f.kind === "way-in" && f.adapter !== "model" && f.function && acts.has(f.function)))
-	};
-}
-/**
-* What a closer look would read: the functions the model could not judge, and a route whose message
-* and reply fields live in its body.
-*/
-function wantsCloserLook(reading) {
-	const wanted = [...reading.verified.unclear];
-	const entry = reading.understood.entry;
-	const hasEntry = reading.facts.some((f) => f.kind === "entry");
-	if (entry?.kind === "http" && !hasEntry) wanted.push({
-		file: entry.file,
-		line: entry.line,
-		name: entry.path ?? "the route",
-		why: "to see which field carries the message and which the reply"
-	});
-	const seen = /* @__PURE__ */ new Set();
-	return wanted.filter((w) => {
-		const key = `${w.file}:${w.line.toString()}`;
-		return seen.has(key) ? false : (seen.add(key), true);
-	});
-}
 // src/state.ts
 var STATE_DIR = ".modelos-secure";
 async function readState(dir) {
 	const text = await readFile(join(dir, STATE_DIR, "state.json"), "utf8").catch(() => null);
 	return text ? {
 		answers: {},
-		doneSteps: [],
 		...JSON.parse(text)
-	} : {
-		answers: {},
-		doneSteps: []
-	};
+	} : { answers: {} };
 }
 /** Writes through a rename, so an interrupt never leaves half a file. */
 async function writeState(dir, state) {
@@ -20766,10 +21911,90 @@ async function keepError(dir, error) {
 	const file = scanned ? join(STATE_DIR, "last-error.log") : join(tmpdir(), "modelos-secure-last-error.log");
 	return writeFile(scanned ? join(dir, file) : file, details).then(() => file, () => null);
 }
+/**
+* Git ignores the folder by a file inside it, so the person's own .gitignore is never changed, and
+* a folder that is not a repository gets nothing it does not need.
+*/
 async function ensureIgnored(dir) {
-	const file = join(dir, ".gitignore");
-	const text = await readFile(file, "utf8").catch(() => "");
-	if (!text.split("\n").some((line) => line.trim().replace(/\/$/, "") === ".modelos-secure")) await appendFile(file, `${text.endsWith("\n") || text === "" ? "" : "\n"}${STATE_DIR}/\n`);
+	await writeFile(join(dir, STATE_DIR, ".gitignore"), "*\n");
+}
+/** What left this machine, one line per answer the reader sent, for the person to read. ADR 0086. */
+async function recordSent(dir, sent) {
+	await mkdir(join(dir, STATE_DIR), { recursive: true });
+	await appendFile(join(dir, STATE_DIR, "sent.jsonl"), `${JSON.stringify({
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		...sent
+	})}\n`);
+}
+// src/reading.ts
+var outlineHash = (outline, consent = "outline") => createHash("sha256").update(consent).update(JSON.stringify(outline)).digest("hex");
+/**
+* Reads the repository a turn at a time through our API, or reuses what was read for this exact
+* outline and consent before. Null when reading ended with no map, so the adapters' facts stand.
+*/
+async function readRepository(input) {
+	const { api, dir, result, outline, consent, state } = input;
+	const hash = outlineHash(ScanOutlineV2.parse(outline), consent);
+	const cached = UnderstandingV3.safeParse(state.understood);
+	if (state.outlineHash === hash && cached.success) return {
+		map: cached.data,
+		dropped: [],
+		turns: 0
+	};
+	let explored;
+	try {
+		explored = await explore({
+			result,
+			outline,
+			consent,
+			scanId: randomUUID(),
+			knownValues: await localValues(dir, result.look.settingsFiles),
+			turn: async (request) => ScanTurnReply.parse(await api.post("/scan/turn", request)),
+			onProgress: (what) => status(`Reading: ${what}`),
+			onSent: (sent) => recordSent(dir, sent)
+		});
+	} catch (error) {
+		if (error instanceof ApiError$1 && error.status === 404) {
+			status("");
+			return {
+				map: await understandOutline(api, outline, state),
+				dropped: [],
+				turns: 1
+			};
+		}
+		throw error;
+	} finally {
+		status("");
+	}
+	if (!explored.map) return null;
+	state.understood = explored.map;
+	state.outlineHash = hash;
+	return {
+		map: explored.map,
+		dropped: explored.dropped,
+		turns: explored.turns,
+		stopped: explored.stopped
+	};
+}
+/** Asks the model, or reuses what it said about this exact outline before. */
+async function understandOutline(api, outline, state) {
+	const hash = outlineHash(ScanOutlineV2.parse(outline));
+	const cached = UnderstandingV3.safeParse(state.understood);
+	if (state.outlineHash === hash && cached.success) return cached.data;
+	const understood = UnderstandingV3.parse(await api.post("/scan/understand", outline));
+	state.understood = understood;
+	state.outlineHash = hash;
+	return understood;
+}
+/** What the model said, kept only where the code agrees, beside what the adapters read. */
+function read(result, understood) {
+	const verified = verifyUnderstanding(understood, result.look, result.project);
+	const acts = new Set(verified.understanding.tools.filter((t) => !t.can.startsWith("read")).map((t) => t.name));
+	return {
+		understood,
+		verified,
+		facts: mergeFacts(result.facts, verified.facts).filter((f) => !(f.kind === "way-in" && f.adapter !== "model" && f.function && acts.has(f.function)))
+	};
 }
 // src/commands/scan.ts
 var TOOL_POWERS = [
@@ -20780,7 +22005,7 @@ var TOOL_POWERS = [
 	"move money",
 	"delete"
 ];
-var CONSENT_TEXT = "To understand your code, the scan sends an outline: file paths; the names, signatures, decorators and docstrings of functions and classes; which function calls which; the arguments where agents and tools are declared; your system prompts and the prompt files your code reads; and the names of your settings. If the app stops while starting, the last lines it printed go too, with secrets taken out, to work out the fix. It never sends function bodies, secrets, the values of settings or data. If it needs to read a function, it asks first. Run with --offline to keep everything here; the scan will ask you more questions instead.";
+var CONSENT_TEXT = "To understand your app, the scan lets a model read your code the way an engineer would, on our own Google Cloud project. It starts from an outline: file paths, the names and signatures of functions and classes, your prompts and the names of your settings. Then it asks for the files and lines it needs, and only those are sent, each through a filter that takes secrets out. It never sends settings files, keys, certificates or credential files, the values of your settings, or files over 1 MB. Every answer it sends is listed in .modelos-secure/sent.jsonl. Run with --explain to see what may be read, or --offline to keep everything here.";
 var AI_DEPENDENCIES = /"(ai|openai|@google\/genai|langchain|@langchain\/[\w-]+|@anthropic-ai\/sdk|@mastra\/core|@openai\/agents)"|^\s*"?(openai|google-genai|langgraph|langchain|anthropic|crewai|pydantic-ai|smolagents|openai-agents|llama-index|autogen-agentchat|litellm)\b/m;
 /** Only for telling a repository of several apps from one app: whether any file imports an AI library. */
 var AI_IMPORT = /^\s*(?:import|from)\b[^\n]*\b(openai|anthropic|genai|gemini|langchain|langgraph|llama_index|crewai|pydantic_ai|smolagents|autogen|mastra|ai-sdk|agents|vertexai|litellm|ollama)\b|require\(["'](openai|ai|@anthropic-ai\/sdk)["']\)/m;
@@ -20805,7 +22030,7 @@ async function appsIn(root) {
 			]) {
 				const text = await readFile(join(full, manifest), "utf8").catch(() => "");
 				if (AI_DEPENDENCIES.test(text)) {
-					found.push(relative(root, full));
+					found.push(inRepo(root, full));
 					break;
 				}
 			}
@@ -20824,7 +22049,6 @@ async function scanCommand(dir, options) {
 		ci: options.ci
 	};
 	const state = await readState(dir);
-	let closerLook;
 	let previous;
 	try {
 		previous = await readConfig(dir);
@@ -20853,40 +22077,71 @@ async function scanCommand(dir, options) {
 		}
 		if (apps.length === 1) return scanCommand(join(dir, apps[0]), options);
 	}
-	step("Read", `${plural(result.project.files.length, "file")} parsed${result.adapters.length ? `; ${result.adapters.join(", ")} read for certain` : ""}`);
+	step("Read", `${plural(result.project.files.length, "file")} parsed${result.adapters.some((a) => a !== "http") ? `, with the reader for ${result.adapters.filter((a) => a !== "http").join(" and ")}` : ""}`);
 	const outline = await buildOutline(result.look, result.facts, result.project);
 	if (options.explain) {
-		say("\nThis is the exact outline that would be sent. Nothing was sent.\n");
+		const { mayRead, neverSent } = await whatMayBeRead(dir);
+		say("\nNothing was sent. This is the exact outline the reader starts from, with secrets taken out:\n");
 		say(JSON.stringify(outline, null, 2));
+		say(`\nWith a yes to sending code, the reader may ask for lines of ${plural(mayRead.length, "file")}, each through the secret filter. With a yes to the outline only, it may list folders and ask what the index knows of a file, and no code is sent.`);
+		say(`\nNever sent, whatever is asked (${neverSent.length.toString()}):`);
+		for (const n of neverSent) say(`  ${n.path}, because ${n.why}`);
+		if (neverSent.length === 0) say("  nothing here matches");
+		say(`\nWhat was actually sent on earlier runs is in .modelos-secure/sent.jsonl.`);
 		return;
 	}
 	const connection = await readConnection();
-	let consent = options.offline ? "none" : previous?.consent ?? "outline";
-	if (!options.offline && !previous?.consent && !state.consented && !options.yes && !options.ci) {
-		say(`\n  ${CONSENT_TEXT}\n`);
-		consent = await ask("Send the outline?", void 0, [{
-			label: "Yes, send the outline",
-			value: "outline",
+	const agreed = previous?.consent ?? (state.consented ? "outline" : void 0);
+	const askable = !options.yes && !options.ci && interactive();
+	let consent = options.offline ? "none" : agreed ?? "none";
+	const choices = [
+		{
+			label: "Yes, let it read the code it needs",
+			value: "code",
 			recommended: true
-		}, {
+		},
+		{
+			label: "Send only the outline",
+			value: "outline"
+		},
+		{
 			label: "No, keep everything here and ask me more",
 			value: "none"
-		}]);
+		}
+	];
+	if (!options.offline && !agreed && !askable) say("\n  Nothing is sent: that needs a yes once at a terminal, or consent: code or outline in modelos-secure.yaml.\n");
+	if (!options.offline && !agreed && askable) {
+		say(`\n  ${CONSENT_TEXT}\n`);
+		consent = await ask("Send code to the model?", void 0, choices);
+		say();
+	}
+	if (!options.offline && agreed === "outline" && askable && !state.askedCode) {
+		say(`\n  This repository agreed to send the outline. The scan can now also read the code it needs, which gives a more exact map.\n\n  ${CONSENT_TEXT}\n`);
+		consent = await ask("Send code to the model?", void 0, [
+			choices[0],
+			{
+				...choices[1],
+				label: "Keep sending only the outline"
+			},
+			choices[2]
+		]);
+		state.askedCode = true;
 		say();
 	}
-	state.consented = consent === "outline";
+	state.consented = consent !== "none";
 	await writeState(dir, state);
 	let offline = options.offline || consent === "none";
 	let api = connection ? apiClient(connection) : null;
 	let reading;
-	const understandOnce = async (sent) => {
+	let understood = null;
+	const understandOnce = async () => {
 		await withFixes(async () => {
-			if (offline) return;
+			if (offline || consent === "none") return;
 			if (!api) throw new Failure("I need a workspace token first.", [{
 				label: "Enter a token now",
 				recommended: true,
 				apply: async () => {
-					const { loginCommand } = await import("./assets/login-CipN1qFD.js");
+					const { loginCommand } = await import("./assets/login-CvPyhFJ7.js");
 					await loginCommand();
 					const fresh = await readConnection();
 					api = fresh ? apiClient(fresh) : null;
@@ -20896,11 +22151,19 @@ async function scanCommand(dir, options) {
 				apply: () => void (offline = true)
 			}]);
 			try {
-				reading = read(result, await understandOutline(api, sent, state));
+				understood = await readRepository({
+					api,
+					dir,
+					result,
+					outline,
+					consent,
+					state
+				});
+				if (understood) reading = read(result, understood.map);
 			} catch (error) {
 				const wrongAddress = error instanceof IapRefusal && error.kind === "not-the-app" ? error.message : void 0;
 				if (error instanceof ApiError$1 && error.status < 500 && !wrongAddress) throw error;
-				throw new Failure("I can't reach ModelOS at the address in your settings.", [{
+				throw new Failure(error instanceof ApiError$1 ? "ModelOS answered with an error on its side. It is recorded there; try the scan again in a few minutes." : "I can't reach ModelOS at the address in your settings.", [{
 					label: "Check the address",
 					apply: async () => {
 						const url = await askText("What is the address?");
@@ -20915,33 +22178,16 @@ async function scanCommand(dir, options) {
 		}, retry);
 		await writeState(dir, state);
 	};
-	if (!offline) await understandOnce(outline);
-	const wanted = reading ? wantsCloserLook(reading) : [];
-	if (reading && wanted.length > 0 && !previous?.closer_look) {
-		say(`\n  To work out what the outline cannot show, the scan would send the code of ${plural(wanted.length, "function")}, and nothing else:`);
-		for (const w of wanted) say(`    ${w.name} in ${w.file}:${w.line.toString()}, ${w.why}`);
-		const yes = !options.yes && !options.ci && await ask("Send these to the model for a closer look?", void 0, [{
-			label: "Yes, send only these",
-			value: true,
-			recommended: true
-		}, {
-			label: "No, ask me instead",
-			value: false
-		}]);
-		closerLook = yes ? wanted.map((w) => `${w.file}:${w.name}`) : options.yes || options.ci ? void 0 : "no";
-		if (yes) await understandOnce({
-			...outline,
-			bodies: bodiesOf(result, wanted)
-		});
-	}
+	await understandOnce();
 	const facts = reading?.facts ?? result.facts;
 	const understanding = reading?.verified.understanding;
 	const count = (kind) => facts.filter((f) => f.kind === kind).length;
 	const changers = (understanding?.tools ?? []).filter((t) => t.can !== "read" && t.can !== "read private data");
 	const untrusted = (understanding?.waysIn ?? []).filter((w) => w.untrusted);
-	step("Understand", offline ? "Offline, so nothing was sent" : `${plural(count("tool"), "tool")}, ${plural(count("way-in") + 1, "way")} in, ${plural(count("system-prompt"), "system prompt")}; ${plural(changers.length, "tool")} ${changers.length === 1 ? "changes" : "change"} things; ${plural(untrusted.length, "input")} ${untrusted.length === 1 ? "carries" : "carry"} outside content`);
-	const dropped = reading?.verified.dropped ?? [];
+	step("Understand", offline || consent === "none" ? "Offline, so nothing was sent" : `${understood && understood.turns > 1 ? `read in ${plural(understood.turns, "turn")}; ` : ""}${plural(count("tool"), "tool")}, ${plural(count("way-in") + 1, "way")} in, ${plural(count("system-prompt"), "system prompt")}; ${plural(changers.length, "tool")} ${changers.length === 1 ? "changes" : "change"} things; ${plural(untrusted.length, "input")} ${untrusted.length === 1 ? "carries" : "carry"} outside content`);
+	const dropped = [...understood?.dropped ?? [], ...reading?.verified.dropped ?? []].filter((d, i, all) => all.findIndex((x) => x.what === d.what) === i);
 	if (dropped.length > 0) say(`  ${grey(`Dropped ${plural(dropped.length, "claim")} that did not match the code: ${dropped.map((d) => `${d.what}, because ${d.why}`).join("; ")}.`)}`);
+	if (understood?.stopped === "budget") say(`  ${grey("Reading stopped at this workspace's limit for today, so the map rests on what was read so far.")}`);
 	const drafted = draftConfig({
 		look: result.look,
 		facts,
@@ -20953,7 +22199,7 @@ async function scanCommand(dir, options) {
 	});
 	let config = {
 		...drafted.config,
-		closer_look: closerLook ?? previous?.closer_look
+		closer_look: previous?.closer_look
 	};
 	const open = drafted.questions.filter((q) => !state.answers[q.id]);
 	const summary = summaryOf(config, facts, reading);
@@ -20976,7 +22222,7 @@ async function scanCommand(dir, options) {
 	if (options.ci && open.length > 0) {
 		say("\nThese questions need answering locally, because CI never guesses:");
 		for (const q of open) say(`  ${q.text}`);
-		process.exitCode = 1;
+		process.exitCode = 3;
 		return;
 	}
 	step("Ask", open.length === 0 ? "No questions" : plural(open.length, "question"));
@@ -21042,54 +22288,18 @@ async function scanCommand(dir, options) {
 		guardrails: facts.flatMap((f) => f.kind === "guardrail" ? [f.name] : [])
 	});
 	const versionLabel = createHash("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 7);
-	if (options.offline) step("Start", `${dash} skipped offline`);
-	let pool = null;
-	const stopPool = () => pool?.stop();
-	process.once("exit", stopPool);
-	if (!options.offline) {
-		const startCtx = {
-			dir,
-			config,
-			extraEnv: {},
-			startCommands: result.look.startCommands,
-			onConfig: (c) => writeConfig(dir, c),
-			explain: explainWith(offline ? null : api, config)
-		};
-		pool = await withFixes(() => startApp(startCtx, 1), retry);
-		step("Start", `${config.start?.command ?? ""} with hooks attached`);
-		const check = await pool.send({
-			session: "connection-check",
-			message: "Connection check from ModelOS Secure",
-			canaries: {
-				record: "CONNECTION-CHECK",
-				prompt: "CONNECTION-CHECK"
-			}
-		});
-		const why = pool.lastStop();
-		pool.stop();
-		pool = null;
-		const held = config.tools.filter((t) => t.during_reviews === "hold").map((t) => t.name);
-		const heldEscaped = check.ranTools.filter((name) => held.includes(name));
-		if (heldEscaped.length > 0) throw new Failure(`A tool marked as held ran for real: ${heldEscaped.join(", ")}.`, []);
-		if (!check.answered) await withFixes(async () => {
-			throw new Failure(`The app did not answer the connection check: ${why ?? check.error ?? "no reply"}.`, []);
-		}, retry);
-		if (check.modelCalls.length === 0) say(`  ${grey("The hooks saw no model call on the connection check, so the first review will say so.")}`);
-	}
 	const register = toRegister(config, parts, {
 		summary: understanding?.summary,
 		versionLabel,
-		toolFacts: config.consent === "outline" ? facts.flatMap((f) => f.kind === "tool" ? [{
+		toolFacts: config.consent === "outline" || config.consent === "code" ? facts.flatMap((f) => f.kind === "tool" ? [{
 			name: f.name,
-			description: f.description,
-			signature: f.signature
+			description: f.description && redact(f.description),
+			signature: f.signature && redact(f.signature)
 		}] : []) : void 0
 	});
 	if (offline || !api) {
-		state.pendingRegister = register;
-		await writeState(dir, state);
-		step("Check", "Saved locally, because the scan ran offline");
-		say(config.consent === "none" ? `\n  modelos-secure.yaml says ${bold("consent: none")}, so nothing is sent. Change it to ${bold("outline")} to send the outline.` : `\n  Run ${bold("modelos-secure scan .")} when you can reach ModelOS, and it will send this.`);
+		step("Register", "Saved here only, because the scan ran offline");
+		say(config.consent === "none" ? `\n  modelos-secure.yaml says ${bold("consent: none")}, so nothing is sent. Change it to ${bold("code")} to let the scan read the code it needs, or ${bold("outline")} to send the outline only.` : `\n  Run ${bold("modelos-secure scan .")} when you can reach ModelOS, and it will send this.`);
 		return;
 	}
 	const system = await api.post("/systems", register);
@@ -21097,17 +22307,7 @@ async function scanCommand(dir, options) {
 		const csv = await readFile(join(dir, config.answer_key), "utf8").catch(() => null);
 		if (csv) await uploadAnswerKey(api, system.id, config.answer_key, csv);
 	}
-	state.pendingRegister = void 0;
-	state.doneSteps = [
-		"look",
-		"read",
-		"understand",
-		"ask",
-		"start",
-		"check"
-	];
-	await writeState(dir, state);
-	step("Check", "The hooks saw the app and held what they should");
+	step("Register", `The map is saved to the workspace`);
 	const paths = (config.ways_in.length || 1) * (config.rules.length || 1);
 	say(`\n  ${bold(`${config.system} is connected.`)}\n`);
 	say(`  ${`${plural(config.ways_in.length, "way")} in`.padEnd(14)} ${config.ways_in.map((w) => w.name).join(", ")}`);
@@ -21116,7 +22316,7 @@ async function scanCommand(dir, options) {
 	const url = connection ? `${connection.url}/systems/${system.id}` : "";
 	say(`  Map:  ${url}`);
 	if (options.noReview || options.ci) return;
-	if (options.yes ? false : await ask("Start a quick first review now? About 15 minutes, 1,200 attempts.", void 0, [{
+	if (options.yes ? false : await ask("Start a quick first review now? About 15 minutes, 1,200 attempts.", "It starts the app on this machine with the hooks attached, checks they hold what they should, then reviews it.", [{
 		label: "Yes, start it",
 		value: true,
 		recommended: true
@@ -21174,14 +22374,105 @@ async function uploadAnswerKey(api, systemId, name, csv) {
 	say(`  ${grey(`Read ${plural(answer.questions, "question")} from ${name}.`)}`);
 }
 var held = (config) => config.tools.filter((t) => t.during_reviews === "hold").map((t) => t.name);
-// src/main.ts
-var [command = "", ...rest] = process.argv.slice(2);
-var has = (name) => rest.includes(`--${name}`);
-function flag(name) {
-	const index = rest.indexOf(`--${name}`);
-	return index >= 0 ? rest[index + 1] : void 0;
+// src/session.ts
+async function sessionCommand(dir, run) {
+	const connection = await readConnection();
+	const config = await readConfig(dir).catch(() => null);
+	say(`${bold("ModelOS Secure")}  ${config?.system ?? basename(dir)}\n`);
+	say(`  ${config ? `Mapped as ${bold(config.system)} in modelos-secure.yaml.` : "No map here yet: scan reads this folder and makes one."}`);
+	say(`  ${connection ? "Signed in to a workspace." : "Not signed in: modelos-secure login connects a workspace."}`);
+	say(`\n  Ask about this app in your own words, or type ${bold("scan")}, ${bold("review")}, ${bold("help")} or ${bold("quit")}.`);
+	for (;;) {
+		say();
+		const line = await askText(">");
+		const word = line.toLowerCase();
+		if (!line || word === "quit" || word === "exit") return;
+		if (word === "help") {
+			run.help();
+			continue;
+		}
+		if (word === "scan" || word === "review") {
+			if (await ask(word === "scan" ? "Scan this folder now?" : "Start a review of this app now? It starts the app here and sends attempts to it.", void 0, [{
+				label: `Yes, ${word}`,
+				value: true,
+				recommended: true
+			}, {
+				label: "No",
+				value: false
+			}])) await (word === "scan" ? run.scan() : run.review());
+			continue;
+		}
+		await answer(dir, line, connection);
+	}
+}
+async function answer(dir, question, connection) {
+	const consent = (await readConfig(dir).catch(() => null))?.consent;
+	if (!connection) {
+		say(`\n  ${grey("Answers come from our reader, so they need a workspace: run modelos-secure login first.")}`);
+		return;
+	}
+	if (consent !== "code" && consent !== "outline") {
+		say(`\n  ${grey("Answers come from reading your code, and this folder has not agreed to send any. Run scan first, and answer its question about what may be sent.")}`);
+		return;
+	}
+	const api = apiClient(connection);
+	const result = await scanFolder(dir);
+	const outline = await buildOutline(result.look, result.facts, result.project);
+	try {
+		const answered = await answerQuestion({
+			question,
+			result,
+			outline,
+			consent,
+			knownValues: await localValues(dir, result.look.settingsFiles),
+			turn: async (request) => ScanTurnReply.parse(await api.post("/scan/turn", request)),
+			onProgress: (what) => status(`Reading: ${what}`),
+			onSent: (sent) => recordSent(dir, sent)
+		});
+		status("");
+		say();
+		for (const paragraph of answered.answer.split(/\n+/)) say(`  ${paragraph}`);
+	} catch (error) {
+		status("");
+		say(`\n  ${grey(`No answer this time: ${error instanceof Error ? error.message : String(error)}`)}`);
+	}
 }
-var positional = rest.filter((arg, i) => !arg.startsWith("--") && !rest[i - 1]?.match(/^--(format|out|system|instances|against|budget|url|client-id|client-secret|tls-name)$/));
+// src/main.ts
+var { values, positionals } = parseArgs({
+	args: process.argv.slice(2),
+	allowPositionals: true,
+	strict: false,
+	options: {
+		offline: { type: "boolean" },
+		explain: { type: "boolean" },
+		yes: { type: "boolean" },
+		ci: { type: "boolean" },
+		"no-review": { type: "boolean" },
+		quick: { type: "boolean" },
+		version: {
+			type: "boolean",
+			short: "v"
+		},
+		help: {
+			type: "boolean",
+			short: "h"
+		},
+		instances: { type: "string" },
+		budget: { type: "string" },
+		format: { type: "string" },
+		out: { type: "string" },
+		system: { type: "string" },
+		against: { type: "string" },
+		url: { type: "string" },
+		"client-id": { type: "string" },
+		"client-secret": { type: "string" },
+		"tls-name": { type: "string" }
+	}
+});
+var [command = "", ...positional] = positionals;
+var VERSION = package_default.version;
+var has = (name) => values[name] === true;
+var flag = (name) => typeof values[name] === "string" ? values[name] : void 0;
 async function connection() {
 	const found = await readConnection();
 	if (!found) throw new Error("No workspace token found. Run modelos-secure login, or set MODELOS_SECURE_TOKEN.");
@@ -21190,14 +22481,97 @@ async function connection() {
 var USAGE = `modelos-secure: test an AI system for Security, Safety and Quality.
 
   login                   Saves a workspace token, and signs in with Google when the
-                          address needs it. --url, --client-id, --client-secret,
-                          --tls-name.
-  scan .                  Connects this repository. --offline, --explain, --yes.
-  review                  Starts a review of this system. --quick, --ci, --budget.
+                          address needs it.
+  (no command)            At a terminal, a session about the app in this folder: ask
+                          about it in your own words, scan it or review it.
+  scan .                  Reads this repository and connects it.
+  review                  Starts a review of this system.
   replay F-031            Replays one finding.
   doctor                  Checks the setup and fixes what it can.
-  runner --system <id>    Runs a runner from this machine.
-  export R-1 --format sarif   Writes a review's findings as SARIF or JSON.`;
+  runner                  Serves a review's attempts from this machine, in the app's folder.
+  export R-1              Writes a review's findings as SARIF or JSON.
+
+  --help                  Says what a command does and what it takes: modelos-secure scan --help.
+  --version               Prints this CLI's version.
+
+Exit codes: 0 done, 1 failed or a fix check found a break, 2 used wrongly,
+3 questions only a person can answer, 130 stopped with Ctrl-C.`;
+/** What each command takes. A flag not listed for a command is refused, with this text. */
+var COMMANDS = {
+	login: {
+		flags: [
+			"url",
+			"client-id",
+			"client-secret",
+			"tls-name"
+		],
+		help: `modelos-secure login: saves a workspace token, from the app's tokens page.
+
+  --url <address>         The app's address, with /secure.
+  --client-id <id>        The Google client to sign in with, when the app is behind Google.
+  --client-secret <s>     Its secret, from the same page.
+  --tls-name <name>       The name the address's certificate is issued for, when it is an IP.`
+	},
+	scan: {
+		flags: [
+			"offline",
+			"explain",
+			"yes",
+			"ci",
+			"no-review"
+		],
+		help: `modelos-secure scan <folder>: reads the repository and connects it.
+
+  --offline               Keeps everything on this machine; asks more questions instead.
+  --explain               Prints what would be sent, and sends nothing.
+  --yes                   Takes the recommended answer to every question. Never sends code.
+  --ci                    Asks nothing; fails with the questions only a person can answer.
+  --no-review             Does not offer to start a review at the end.`
+	},
+	review: {
+		flags: [
+			"quick",
+			"ci",
+			"yes",
+			"instances",
+			"budget"
+		],
+		help: `modelos-secure review: starts the app with its hooks, serves the attempts, and reviews it.
+
+  --quick                 A first look: fewer attempts per path.
+  --ci                    For a pull request: replays open findings and fails on a break.
+  --yes                   Takes the recommended answer to every question.
+  --budget <n>            The most answered attempts per path.
+  --instances <n>         How many copies of the app to run side by side. Default 4.`
+	},
+	replay: {
+		flags: [],
+		help: `modelos-secure replay <finding>: replays one finding, such as F-031.`
+	},
+	doctor: {
+		flags: [],
+		help: `modelos-secure doctor: checks the setup, says what is wrong, and fixes what it can.`
+	},
+	runner: {
+		flags: ["system", "instances"],
+		help: `modelos-secure runner: serves a review's attempts from this machine.
+
+  --system <id>           The system, when not run in the app's own folder.
+  --instances <n>         How many copies of the app to run side by side. Default 4.`
+	},
+	export: {
+		flags: ["format", "out"],
+		help: `modelos-secure export <review>: writes a review's findings, such as R-1179.
+
+  --format sarif|json     Default json.
+  --out <file>            Where to write; standard output when left out.`
+	}
+};
+/** A mistake in how the command was typed: said on standard error, and exit code 2. */
+function usedWrongly(message) {
+	process.stderr.write(`${message}\n`);
+	process.exit(2);
+}
 var STOPPED = "Stopped. Run the same command again to carry on from here.";
 process.once("SIGINT", () => {
 	finishBeforeStopping().finally(() => {
@@ -21205,9 +22579,42 @@ process.once("SIGINT", () => {
 		process.exit(130);
 	});
 });
+var known = COMMANDS[command];
+if (has("version")) {
+	say(VERSION);
+	process.exit(0);
+}
+if (!command && Object.keys(values).some((k) => k !== "help")) usedWrongly(`modelos-secure on its own does not take --${Object.keys(values).find((k) => k !== "help")}. modelos-secure --help lists the commands.`);
+if (!command && (values.help || !interactive()) || values.help && !known) {
+	say(USAGE);
+	process.exit(0);
+}
+if (command && !known) usedWrongly(`There is no command ${command}. modelos-secure --help lists them.`);
+if (values.help && known) {
+	say(known.help);
+	process.exit(0);
+}
+for (const name of Object.keys(values)) if (!known?.flags.includes(name)) usedWrongly(command ? `modelos-secure ${command} does not take --${name}. modelos-secure ${command} --help lists what it does take.` : `modelos-secure on its own does not take --${name}. modelos-secure --help lists the commands.`);
 try {
 	const ci = has("ci") || Boolean(process.env.CI);
-	if (command === "login") await loginCommand({
+	if (!command) await sessionCommand(process.cwd(), {
+		scan: () => scanCommand(process.cwd(), {
+			offline: false,
+			explain: false,
+			yes: false,
+			ci: false,
+			noReview: true
+		}),
+		review: () => reviewCommand(process.cwd(), {
+			quick: false,
+			ci: false,
+			yes: false,
+			instances: 4,
+			budget: void 0
+		}),
+		help: () => say(USAGE)
+	});
+	else if (command === "login") await loginCommand({
 		url: flag("url"),
 		clientId: flag("client-id"),
 		clientSecret: flag("client-secret"),
@@ -21228,17 +22635,13 @@ try {
 		budget: flag("budget") ? Number(flag("budget")) : void 0
 	});
 	else if (command === "replay") {
-		if (!positional[0]) throw new Error("Say which finding, such as modelos-secure replay F-031.");
+		if (!positional[0]) usedWrongly("Say which finding, such as modelos-secure replay F-031.");
 		await replayCommand(process.cwd(), positional[0]);
 	} else if (command === "doctor") await doctorCommand(process.cwd());
 	else if (command === "export") {
-		if (!positional[0]) throw new Error("Say which review, such as modelos-secure export R-1179 --format sarif.");
+		if (!positional[0]) usedWrongly("Say which review, such as modelos-secure export R-1179 --format sarif.");
 		await exportCommand(positional[0], flag("format") ?? "json", flag("out"));
-	} else if (command === "runner") {
-		const systemId = flag("system");
-		if (!systemId) throw new Error("Say which system with --system.");
-		await runnerCommand(await connection(), process.cwd(), systemId, Number(flag("instances") ?? 4));
-	} else say(USAGE);
+	} else if (command === "runner") await runnerCommand(await connection(), process.cwd(), flag("system"), Number(flag("instances") ?? 4));
 } catch (error) {
 	if (error instanceof Interrupted) {
 		await finishBeforeStopping();
@@ -21247,10 +22650,12 @@ try {
 	}
 	if (!(error instanceof Failure && error.shown)) say(`\n  ${red(error instanceof Error ? error.message : String(error))}`);
 	const step = lastFinishedStep();
-	say(`  ${step ? `It stopped after ${step}. ` : ""}What it did is kept, and running the same command again carries on from there.`);
-	const log = await keepError(process.cwd(), error);
-	if (log && !(error instanceof Failure)) say(`  The details are in ${log}, on this machine only.`);
-	say("  modelos-secure doctor checks the setup and fixes what it can.");
+	if (step) say(`  It stopped after ${step}. Your answers are kept.`);
+	if (!(error instanceof Failure)) {
+		const log = await keepError(process.cwd(), error);
+		if (log) say(`  The details are in ${log}, on this machine only.`);
+		say("  modelos-secure doctor checks the setup and fixes what it can.");
+	}
 	process.exit(1);
 }
 export {};