overlane 0.1.119 → 0.1.120

package/dist/overlane.mjs

@@ -3502,15 +3502,15 @@ var init_schemas = __esm({
         const syms = normalized.symbolKeys;
         const doc = new Doc(["payload", "ctx"], { shape: shape2, inst, memo: memo3, syms });
         const parseStr = (k) => `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
-        const prefixStr = (id, k) => `
-          let ${id}_ab = false;
-          for (let i = 0; i < ${id}.issues.length; i++) {
-            const iss = ${id}.issues[i];
+        const prefixStr = (id2, k) => `
+          let ${id2}_ab = false;
+          for (let i = 0; i < ${id2}.issues.length; i++) {
+            const iss = ${id2}.issues[i];
             iss.path = iss.path ? [${k}, ...iss.path] : [${k}];
             payload.issues.push(iss);
-            if (iss.continue !== true) ${id}_ab = true;
+            if (iss.continue !== true) ${id2}_ab = true;
           }
-          if (${id}_ab && ctx && ctx.abortEarly) {
+          if (${id2}_ab && ctx && ctx.abortEarly) {
             payload.value = newResult;
             return payload;
           }`;
@@ -3524,34 +3524,34 @@ var init_schemas = __esm({
         for (const key of normalized.allKeys) {
           if (key === "__proto__")
             continue;
-          const id = ids[key];
+          const id2 = ids[key];
           const k = typeof key === "symbol" ? `syms[${syms.indexOf(key)}]` : esc(key);
           const isPresent = `${k} in input`;
           const schema = shape2[key];
           const optin = schema?._zod?.optin;
           const isOptionalIn = optin !== void 0;
           const isOptionalOut = schema?._zod?.optout === "optional";
-          doc.write(`const ${id} = ${parseStr(k)};`);
+          doc.write(`const ${id2} = ${parseStr(k)};`);
           if (isOptionalIn && isOptionalOut) {
-            const assign = optin === "optional" ? `${id}_present` : `${id}.value !== undefined || ${id}_present`;
+            const assign = optin === "optional" ? `${id2}_present` : `${id2}.value !== undefined || ${id2}_present`;
             doc.write(`
-        const ${id}_present = ${isPresent};
-        if (!${id}.issues.length || ${id}_present) {
-          if (${id}.issues.length) {${prefixStr(id, k)}
+        const ${id2}_present = ${isPresent};
+        if (!${id2}.issues.length || ${id2}_present) {
+          if (${id2}.issues.length) {${prefixStr(id2, k)}
           }
 
           if (${assign}) {
-            newResult[${k}] = ${id}.value;
+            newResult[${k}] = ${id2}.value;
           }
         }
 
       `);
           } else if (!isOptionalIn) {
             doc.write(`
-        const ${id}_present = ${isPresent};
-        if (${id}.issues.length) {${prefixStr(id, k)}
+        const ${id2}_present = ${isPresent};
+        if (${id2}.issues.length) {${prefixStr(id2, k)}
         }
-        if (!${id}_present && !${id}.issues.length) {
+        if (!${id2}_present && !${id2}.issues.length) {
           payload.issues.push({
             code: "invalid_type",
             expected: "nonoptional",
@@ -3564,22 +3564,22 @@ var init_schemas = __esm({
           }
         }
 
-        if (${id}_present) {
-          newResult[${k}] = ${id}.value;
+        if (${id2}_present) {
+          newResult[${k}] = ${id2}.value;
         }
 
       `);
           } else {
             doc.write(`
-        if (${id}.issues.length) {${prefixStr(id, k)}
+        if (${id2}.issues.length) {${prefixStr(id2, k)}
         }
       `);
             if (optin === "defaulted") {
-              doc.write(`newResult[${k}] = ${id}.value;`);
+              doc.write(`newResult[${k}] = ${id2}.value;`);
             } else {
               doc.write(`
-        if (${id}.value !== undefined || ${isPresent}) {
-          newResult[${k}] = ${id}.value;
+        if (${id2}.value !== undefined || ${isPresent}) {
+          newResult[${k}] = ${id2}.value;
         }
       `);
             }
@@ -4545,7 +4545,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve11) {
+function isRecursive(inst, stack, resolve12) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -4555,7 +4555,7 @@ function isRecursive(inst, stack, resolve11) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve11);
+      const answer = isRecursive(child, stack, resolve12);
       if (answer > result)
         result = answer;
     }
@@ -4566,7 +4566,7 @@ function isRecursive(inst, stack, resolve11) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve11) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve12) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -4630,7 +4630,7 @@ function isRecursive(inst, stack, resolve11) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve11 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve12 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -4732,14 +4732,14 @@ var init_memoizer = __esm({
         var _a3;
         (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
         inst._zod.deferred.push(() => {
-          const base3 = inst._zod.parse;
+          const base4 = inst._zod.parse;
           const wrapped = (payload, ctx) => {
             if (ctx.direction !== "backward" && isBackEdge(ctx, payload.value))
               throw new $ZodCyclicError();
-            return base3(payload, ctx);
+            return base4(payload, ctx);
           };
           inst._zod.parse = wrapped;
-          if (inst._zod.run === base3)
+          if (inst._zod.run === base4)
             inst._zod.run = wrapped;
         });
       },
@@ -4751,15 +4751,15 @@ var init_memoizer = __esm({
         let lastBucket;
         (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
         inst._zod.deferred.push(() => {
-          const base3 = inst._zod.parse;
+          const base4 = inst._zod.parse;
           const wrapped = (payload, ctx) => {
             if (isRecursiveInst === void 0) {
               const walked = isRecursive(inst, /* @__PURE__ */ new Set(), false);
               if (walked === NONE) {
-                inst._zod.parse = base3;
+                inst._zod.parse = base4;
                 if (inst._zod.run === wrapped)
-                  inst._zod.run = base3;
-                return base3(payload, ctx);
+                  inst._zod.run = base4;
+                return base4(payload, ctx);
               }
               if (walked === PROVEN || rechecked)
                 isRecursiveInst = true;
@@ -4768,7 +4768,7 @@ var init_memoizer = __esm({
             }
             const input2 = payload.value;
             if (!isRef(input2))
-              return base3(payload, ctx);
+              return base4(payload, ctx);
             let state = ctx[STATE];
             if (!state) {
               state = { buckets: /* @__PURE__ */ new WeakMap(), backEdges: void 0 };
@@ -4797,7 +4797,7 @@ var init_memoizer = __esm({
             }
             handoff = bucket;
             const depth = open.length;
-            const result = base3(payload, ctx);
+            const result = base4(payload, ctx);
             handoff = void 0;
             const entry = open.length > depth ? open.pop() : void 0;
             if (result instanceof Promise) {
@@ -4812,7 +4812,7 @@ var init_memoizer = __esm({
             return result;
           };
           inst._zod.parse = wrapped;
-          if (inst._zod.run === base3)
+          if (inst._zod.run === base4)
             inst._zod.run = wrapped;
         });
       }
@@ -15677,26 +15677,26 @@ function extractDefs(ctx, schema) {
     return;
   const idToSchema = /* @__PURE__ */ new Map();
   for (const entry of ctx.seen.entries()) {
-    const id = ctx.metadataRegistry.get(entry[0])?.id;
-    if (id) {
-      const existing = idToSchema.get(id);
+    const id2 = ctx.metadataRegistry.get(entry[0])?.id;
+    if (id2) {
+      const existing = idToSchema.get(id2);
       if (existing && existing !== entry[0]) {
-        throw new Error(`Duplicate schema id "${id}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);
+        throw new Error(`Duplicate schema id "${id2}" detected during JSON Schema conversion. Two different schemas cannot share the same id when converted together.`);
       }
-      idToSchema.set(id, entry[0]);
+      idToSchema.set(id2, entry[0]);
     }
   }
   const makeURI = (entry) => {
     const defsSegment = ctx.target === "draft-2020-12" ? "$defs" : "definitions";
     if (ctx.external) {
       const externalId = ctx.external.registry.get(entry[0])?.id;
-      const uriGenerator = ctx.external.uri ?? ((id2) => id2);
+      const uriGenerator = ctx.external.uri ?? ((id3) => id3);
       if (externalId) {
         return { ref: uriGenerator(externalId) };
       }
-      const id = entry[1].defId ?? entry[1].schema.id ?? `schema${ctx.counter++}`;
-      entry[1].defId = id;
-      return { defId: id, ref: `${uriGenerator("__shared")}#/${defsSegment}/${encodeJSONPointerSegment(id)}` };
+      const id2 = entry[1].defId ?? entry[1].schema.id ?? `schema${ctx.counter++}`;
+      entry[1].defId = id2;
+      return { defId: id2, ref: `${uriGenerator("__shared")}#/${defsSegment}/${encodeJSONPointerSegment(id2)}` };
     }
     const uriPrefix = `#`;
     const defUriPrefix = `${uriPrefix}/${defsSegment}/`;
@@ -15744,8 +15744,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         continue;
       }
     }
-    const id = ctx.metadataRegistry.get(entry[0])?.id;
-    if (id) {
+    const id2 = ctx.metadataRegistry.get(entry[0])?.id;
+    if (id2) {
       extractToDef(entry);
       continue;
     }
@@ -15976,10 +15976,10 @@ function finalize(ctx, schema) {
   } else {
   }
   if (ctx.external?.uri) {
-    const id = ctx.external.registry.get(schema)?.id;
-    if (!id)
+    const id2 = ctx.external.registry.get(schema)?.id;
+    if (!id2)
       throw new Error("Schema is missing an `id` property");
-    result.$id = ctx.external.uri(id);
+    result.$id = ctx.external.uri(id2);
   }
   assignProps(result, root.defId ? root.schema : root.def ?? root.schema);
   const rootMetaId = ctx.metadataRegistry.get(schema)?.id;
@@ -16165,7 +16165,7 @@ function stringifyKeyNames(bySchema, json2, visited) {
   const values = json2.enum ?? (json2.const !== void 0 ? [json2.const] : void 0);
   if (!numericType && !values?.some((v) => typeof v === "number"))
     return json2;
-  const { minimum, maximum, exclusiveMinimum, exclusiveMaximum, multipleOf, format, id, ...rest } = json2;
+  const { minimum, maximum, exclusiveMinimum, exclusiveMaximum, multipleOf, format, id: id2, ...rest } = json2;
   if (rest.enum)
     rest.enum = rest.enum.map((v) => typeof v === "number" ? String(v) : v);
   else if (typeof rest.const === "number")
@@ -21918,10 +21918,10 @@ var init_memory = __esm({
       /** Retrieval API (spec 7.2). The tenant comes from the caller's credential. */
       search: "/v1/memory/search",
       collection: memoryBase2,
-      one: (tenantId, id) => `${memoryBase2(tenantId)}/${encodeURIComponent(id)}`,
-      confirm: (tenantId, id) => `${memoryBase2(tenantId)}/${encodeURIComponent(id)}/confirm`,
-      promote: (tenantId, id) => `${memoryBase2(tenantId)}/${encodeURIComponent(id)}/promote`,
-      unlearn: (tenantId, id) => `${memoryBase2(tenantId)}/${encodeURIComponent(id)}/unlearn`,
+      one: (tenantId, id2) => `${memoryBase2(tenantId)}/${encodeURIComponent(id2)}`,
+      confirm: (tenantId, id2) => `${memoryBase2(tenantId)}/${encodeURIComponent(id2)}/confirm`,
+      promote: (tenantId, id2) => `${memoryBase2(tenantId)}/${encodeURIComponent(id2)}/promote`,
+      unlearn: (tenantId, id2) => `${memoryBase2(tenantId)}/${encodeURIComponent(id2)}/unlearn`,
       export: (tenantId) => `${memoryBase2(tenantId)}/export`,
       purge: (tenantId) => `${memoryBase2(tenantId)}/purge`,
       settings: (tenantId) => `${memoryBase2(tenantId)}/settings`,
@@ -22170,19 +22170,19 @@ var init_issues = __esm({
     base2 = (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}`;
     issuePaths = {
       issues: (t, p) => `${base2(t, p)}/issues`,
-      issue: (t, p, id) => `${base2(t, p)}/issues/${encodeURIComponent(id)}`,
-      assign: (t, p, id) => `${base2(t, p)}/issues/${encodeURIComponent(id)}/assign`,
-      events: (t, p, id) => `${base2(t, p)}/issues/${encodeURIComponent(id)}/events`,
+      issue: (t, p, id2) => `${base2(t, p)}/issues/${encodeURIComponent(id2)}`,
+      assign: (t, p, id2) => `${base2(t, p)}/issues/${encodeURIComponent(id2)}/assign`,
+      events: (t, p, id2) => `${base2(t, p)}/issues/${encodeURIComponent(id2)}/events`,
       import: (t, p) => `${base2(t, p)}/issues-import`,
       workProjects: (t, p) => `${base2(t, p)}/work-projects`,
-      workProject: (t, p, id) => `${base2(t, p)}/work-projects/${encodeURIComponent(id)}`,
+      workProject: (t, p, id2) => `${base2(t, p)}/work-projects/${encodeURIComponent(id2)}`,
       cycles: (t, p) => `${base2(t, p)}/cycles`,
       labels: (t, p) => `${base2(t, p)}/labels`,
       views: (t, p) => `${base2(t, p)}/views`,
-      viewRun: (t, p, id) => `${base2(t, p)}/views/${encodeURIComponent(id)}/run`,
+      viewRun: (t, p, id2) => `${base2(t, p)}/views/${encodeURIComponent(id2)}/run`,
       loops: (t, p) => `${base2(t, p)}/loops`,
-      loop: (t, p, id) => `${base2(t, p)}/loops/${encodeURIComponent(id)}`,
-      loopFire: (t, p, id) => `${base2(t, p)}/loops/${encodeURIComponent(id)}/fire`,
+      loop: (t, p, id2) => `${base2(t, p)}/loops/${encodeURIComponent(id2)}`,
+      loopFire: (t, p, id2) => `${base2(t, p)}/loops/${encodeURIComponent(id2)}/fire`,
       sync: (t, p) => `${base2(t, p)}/issue-sync`,
       syncDeliveries: (t, p) => `${base2(t, p)}/issue-sync/deliveries`
     };
@@ -22284,6 +22284,554 @@ var init_onboarding = __esm({
   }
 });
 
+// ../contracts/src/review.ts
+function base3(tenantId, projectId) {
+  return `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/review`;
+}
+var SEVERITIES, Severity, FINDING_STATUSES, FindingStatus, counts, Finding, REVIEW_SKIP_REASONS, SkipEntry, SkipList, TokenCapNotice, REVIEW_MODES, ReviewMode, REVIEW_TRIGGERS, REVIEW_STATUSES, ReviewSummary, ReviewRun, REVIEW_PRIVACY_TEXT, ReviewSettings, UpdateReviewSettingsRequest, PullFile, PullRequestSnapshot, ReviewRunRequest, ReviewRunResponse, ReviewStatusResponse, ReviewFindingsResponse, FEEDBACK_KINDS, FeedbackRequest, LearnedRule, FeedbackResponse, AutofixRequest, AutofixResponse, RawFinding, reviewPaths;
+var init_review = __esm({
+  "../contracts/src/review.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    SEVERITIES = ["low", "medium", "high", "critical"];
+    Severity = external_exports.enum(SEVERITIES);
+    FINDING_STATUSES = ["open", "fixed", "dismissed"];
+    FindingStatus = external_exports.enum(FINDING_STATUSES);
+    counts = external_exports.object({ open: external_exports.number().int().nonnegative(), fixed: external_exports.number().int().nonnegative(), dismissed: external_exports.number().int().nonnegative() }).strict();
+    Finding = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1),
+      projectId: ProjectId,
+      repository: external_exports.string().min(1),
+      pullNumber: external_exports.number().int().positive(),
+      path: external_exports.string().min(1),
+      line: external_exports.number().int().positive(),
+      endLine: external_exports.number().int().positive().optional(),
+      severity: Severity,
+      rule: external_exports.string().min(1).optional(),
+      reason: external_exports.string().min(1).max(1e3).optional(),
+      message: external_exports.string().min(1).max(2e3),
+      status: FindingStatus,
+      /** Stable across pushes: path, rule and the normalised text of the flagged line. Never contains source text. */
+      fingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+      commentId: external_exports.string().optional(),
+      firstSeenSha: CommitSha,
+      lastSeenSha: CommitSha,
+      autofixTaskId: TaskId.optional(),
+      autofixAssignee: external_exports.string().min(1).optional(),
+      createdAt: Timestamp,
+      updatedAt: Timestamp
+    }).strict().refine((finding) => finding.rule !== void 0 || finding.reason !== void 0, { message: "a finding needs a rule or a reason" });
+    REVIEW_SKIP_REASONS = ["generated", "vendored", "lockfile", "minified", "binary", "rule"];
+    SkipEntry = external_exports.object({ path: external_exports.string().min(1), reason: external_exports.enum(REVIEW_SKIP_REASONS) }).strict();
+    SkipList = external_exports.array(SkipEntry);
+    TokenCapNotice = external_exports.object({
+      tenantId: TenantId,
+      cap: external_exports.number().int().positive(),
+      used: external_exports.number().int().nonnegative(),
+      partial: external_exports.literal(true),
+      covered: external_exports.number().int().nonnegative(),
+      uncovered: external_exports.array(external_exports.string().min(1))
+    }).strict();
+    REVIEW_MODES = ["log_only", "comments"];
+    ReviewMode = external_exports.enum(REVIEW_MODES);
+    REVIEW_TRIGGERS = ["opened", "push", "manual"];
+    REVIEW_STATUSES = ["completed", "partial", "failed"];
+    ReviewSummary = external_exports.object({
+      tenantId: TenantId,
+      runId: external_exports.string().min(1),
+      headSha: CommitSha,
+      changes: external_exports.object({ files: external_exports.number().int().nonnegative(), additions: external_exports.number().int().nonnegative(), deletions: external_exports.number().int().nonnegative() }).strict(),
+      risks: external_exports.array(external_exports.string()),
+      checks: external_exports.array(external_exports.object({ name: external_exports.string().min(1), state: external_exports.enum(["pass", "fail", "pending"]) }).strict()),
+      counts,
+      skipped: SkipList,
+      notice: TokenCapNotice.optional(),
+      contextSymbols: external_exports.number().int().nonnegative(),
+      /** The rendered comment body: one per PR, updated in place (REQ-REV-03). */
+      body: external_exports.string().min(1)
+    }).strict();
+    ReviewRun = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1),
+      projectId: ProjectId,
+      repository: external_exports.string().min(1),
+      pullNumber: external_exports.number().int().positive(),
+      headSha: CommitSha,
+      trigger: external_exports.enum(REVIEW_TRIGGERS),
+      fork: external_exports.boolean(),
+      mode: ReviewMode,
+      status: external_exports.enum(REVIEW_STATUSES),
+      tokensUsed: external_exports.number().int().nonnegative(),
+      tokenCap: external_exports.number().int().positive(),
+      model: external_exports.string().min(1),
+      posted: external_exports.boolean(),
+      findings: counts,
+      startedAt: Timestamp,
+      completedAt: Timestamp
+    }).strict();
+    REVIEW_PRIVACY_TEXT = "Review sends the diff of a pull request, the code-map context around it and your review rules to a model provider only under terms that exclude training on that data. A fork pull request never receives your secrets.";
+    ReviewSettings = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      /** Log-only until the owner enables comments (REQ-REV-12). */
+      mode: ReviewMode,
+      tokenCap: external_exports.number().int().min(1e3).max(2e6),
+      skipPatterns: external_exports.array(external_exports.string().min(1).max(256)).max(100),
+      privacy: external_exports.literal(REVIEW_PRIVACY_TEXT),
+      updatedAt: Timestamp.nullable()
+    }).strict();
+    UpdateReviewSettingsRequest = external_exports.object({
+      mode: ReviewMode.optional(),
+      tokenCap: external_exports.number().int().min(1e3).max(2e6).optional(),
+      skipPatterns: external_exports.array(external_exports.string().min(1).max(256)).max(100).optional()
+    }).strict();
+    PullFile = external_exports.object({
+      path: external_exports.string().min(1),
+      status: external_exports.enum(["added", "modified", "removed", "renamed"]).default("modified"),
+      additions: external_exports.number().int().nonnegative().default(0),
+      deletions: external_exports.number().int().nonnegative().default(0),
+      /** Unified diff hunks for the file; absent for binary files. */
+      patch: external_exports.string().max(4e5).optional()
+    }).strict();
+    PullRequestSnapshot = external_exports.object({
+      repository: external_exports.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/),
+      number: external_exports.number().int().positive(),
+      headSha: CommitSha,
+      title: external_exports.string().max(500),
+      body: external_exports.string().max(6e4).default(""),
+      author: external_exports.string().min(1),
+      /** The head comes from a fork: no secrets are ever handed to the run (REQ-REV-09). */
+      fork: external_exports.boolean().default(false),
+      files: external_exports.array(PullFile).max(3e3)
+    }).strict();
+    ReviewRunRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      trigger: external_exports.enum(REVIEW_TRIGGERS).default("manual"),
+      source: external_exports.discriminatedUnion("kind", [
+        external_exports.object({ kind: external_exports.literal("github"), repository: external_exports.string().min(1), number: external_exports.number().int().positive() }).strict(),
+        external_exports.object({ kind: external_exports.literal("inline"), pull: PullRequestSnapshot }).strict()
+      ])
+    }).strict();
+    ReviewRunResponse = external_exports.object({
+      run: ReviewRun,
+      summary: ReviewSummary,
+      findings: external_exports.array(Finding),
+      replay: external_exports.boolean()
+    }).strict();
+    ReviewStatusResponse = external_exports.object({ tenantId: TenantId, projectId: ProjectId, settings: ReviewSettings, runs: external_exports.array(ReviewRun), openFindings: external_exports.number().int().nonnegative() }).strict();
+    ReviewFindingsResponse = external_exports.object({ tenantId: TenantId, findings: external_exports.array(Finding) }).strict();
+    FEEDBACK_KINDS = ["accept", "dismiss", "reply"];
+    FeedbackRequest = external_exports.object({ kind: external_exports.enum(FEEDBACK_KINDS), note: external_exports.string().max(1e3).optional(), requestId: external_exports.string().min(1).max(128) }).strict();
+    LearnedRule = external_exports.object({
+      tenantId: TenantId,
+      rule: external_exports.string().min(1),
+      direction: external_exports.enum(["suppress", "boost"]),
+      evidence: external_exports.number().int().positive(),
+      memoryId: external_exports.string().optional()
+    }).strict();
+    FeedbackResponse = external_exports.object({ finding: Finding, learned: LearnedRule.nullable() }).strict();
+    AutofixRequest = external_exports.object({ requestId: external_exports.string().min(1).max(128), assignee: external_exports.string().min(1).max(128).optional() }).strict();
+    AutofixResponse = external_exports.object({ finding: Finding, taskId: TaskId, assignee: external_exports.string().nullable(), replay: external_exports.boolean() }).strict();
+    RawFinding = external_exports.object({
+      path: external_exports.string().min(1),
+      line: external_exports.number().int().positive(),
+      endLine: external_exports.number().int().positive().optional(),
+      severity: Severity,
+      rule: external_exports.string().min(1).max(100).optional(),
+      reason: external_exports.string().min(1).max(1e3).optional(),
+      message: external_exports.string().min(1).max(2e3)
+    }).strict();
+    reviewPaths = {
+      runs: (tenantId, projectId) => `${base3(tenantId, projectId)}/runs`,
+      status: (tenantId, projectId) => `${base3(tenantId, projectId)}/status`,
+      settings: (tenantId, projectId) => `${base3(tenantId, projectId)}/settings`,
+      findings: (tenantId, projectId) => `${base3(tenantId, projectId)}/findings`,
+      feedback: (tenantId, projectId, id2) => `${base3(tenantId, projectId)}/findings/${encodeURIComponent(id2)}/feedback`,
+      autofix: (tenantId, projectId, id2) => `${base3(tenantId, projectId)}/findings/${encodeURIComponent(id2)}/autofix`
+    };
+  }
+});
+
+// ../contracts/src/guardrails.ts
+function globToRegExp(pattern) {
+  let source = "";
+  for (let i2 = 0; i2 < pattern.length; i2 += 1) {
+    const char = pattern[i2];
+    if (char === "*") {
+      if (pattern[i2 + 1] === "*") {
+        source += ".*";
+        i2 += 1;
+        if (pattern[i2 + 1] === "/") i2 += 1;
+      } else source += "[^/]*";
+    } else if (char === "?") source += "[^/]";
+    else source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${source}$`);
+}
+function globMatches(pattern, value) {
+  return globToRegExp(pattern).test(value);
+}
+function anyGlob(patterns, values) {
+  if (patterns === void 0) return true;
+  return values.some((value) => patterns.some((pattern) => globMatches(pattern, value)));
+}
+function inWindow(window3, at) {
+  if (window3 === void 0) return true;
+  const date5 = new Date(at);
+  if (window3.days !== void 0 && !window3.days.includes(date5.getUTCDay())) return false;
+  const hour = date5.getUTCHours();
+  const from = window3.fromHour ?? 0;
+  const to = window3.toHour ?? 24;
+  return from <= to ? hour >= from && hour < to : hour >= from || hour < to;
+}
+function ruleMatches(rule, request) {
+  const m = rule.match;
+  if (m.principals !== void 0 && !anyGlob(m.principals, [`${request.principal.kind}:${request.principal.id}`, request.principal.id])) return false;
+  if (m.roles !== void 0 && !m.roles.includes(request.principal.role)) return false;
+  if (m.tools !== void 0 && !anyGlob(m.tools, [request.tool])) return false;
+  if (m.paths !== void 0 && !anyGlob(m.paths, request.paths)) return false;
+  if (m.branches !== void 0 && (request.branch === void 0 || !anyGlob(m.branches, [request.branch]))) return false;
+  if (m.repositories !== void 0 && (request.repository === void 0 || !anyGlob(m.repositories, [request.repository]))) return false;
+  if (m.environments !== void 0 && (request.environment === void 0 || !anyGlob(m.environments, [request.environment]))) return false;
+  if (m.hosts !== void 0 && (request.host === void 0 || !anyGlob(m.hosts, [request.host]))) return false;
+  if (!inWindow(m.time, request.at)) return false;
+  if (m.usage !== void 0 && (request.usage[m.usage.metric] ?? 0) < m.usage.atLeast) return false;
+  if (m.taskHeld !== void 0 && request.taskHeld !== m.taskHeld) return false;
+  return true;
+}
+function describeFor(effect, ruleId, message) {
+  if (message !== void 0) return message;
+  return effect === "deny" ? `blocked by rule ${ruleId}` : `rule ${ruleId} requires approval before this runs`;
+}
+function composeDecision(tenantId, layers, request) {
+  const matched = [];
+  let winner = null;
+  let dryWinner = null;
+  const ordered = [...layers].sort((a, b) => GUARD_LAYERS.indexOf(a.layer) - GUARD_LAYERS.indexOf(b.layer));
+  for (const { layer: layer2, rules } of ordered) {
+    const live = rules.find((rule2) => !rule2.dryRun && ruleMatches(rule2, request));
+    for (const rule2 of rules) {
+      if (rule2.dryRun && ruleMatches(rule2, request)) {
+        matched.push({ ruleId: rule2.id, layer: layer2, effect: rule2.effect, dryRun: true });
+        if (rule2.effect !== "allow" && (dryWinner === null || EFFECT_STRENGTH[rule2.effect] > EFFECT_STRENGTH[dryWinner.rule.effect])) dryWinner = { layer: layer2, rule: rule2 };
+      }
+    }
+    if (live === void 0) continue;
+    matched.push({ ruleId: live.id, layer: layer2, effect: live.effect, dryRun: false });
+    if (winner === null || EFFECT_STRENGTH[live.effect] > EFFECT_STRENGTH[winner.rule.effect]) winner = { layer: layer2, rule: live };
+  }
+  if (winner === null || winner.rule.effect === "allow") {
+    const wouldBlock = dryWinner !== null;
+    return {
+      tenantId,
+      effect: "allow",
+      allowed: true,
+      code: null,
+      ruleId: winner?.rule.id ?? null,
+      layer: winner?.layer ?? null,
+      message: wouldBlock && dryWinner !== null ? `allowed; dry-run rule ${dryWinner.rule.id} would have blocked this` : "allowed",
+      nextCommand: null,
+      exitCode: 0,
+      dryRun: wouldBlock,
+      wouldBlock,
+      matched
+    };
+  }
+  const { rule, layer } = winner;
+  return {
+    tenantId,
+    effect: rule.effect,
+    allowed: false,
+    code: rule.code ?? (rule.effect === "deny" ? "policy_denied" : "approval_required"),
+    ruleId: rule.id,
+    layer,
+    message: describeFor(rule.effect, rule.id, rule.message),
+    nextCommand: rule.nextCommand ?? DEFAULT_NEXT[rule.effect],
+    exitCode: GUARD_EXIT_CODE,
+    dryRun: false,
+    wouldBlock: true,
+    matched
+  };
+}
+var GUARD_LAYERS, GuardLayer, GUARD_EFFECTS, GuardEffect, GUARD_CODES, GuardCode, GUARD_EXIT_CODE, glob, globs, GuardTimeWindow, GuardUsageMatch, GuardMatch, GuardRuleSource, GuardRuleFileSource, GuardRule, GuardRuleFileRecord, PutGuardRuleFileRequest, GuardRequest, GuardMatchedRule, GuardDecision, GUARD_APPROVAL_STATUSES, GUARD_AUTONOMY_MODES, GuardAutonomy, GuardApproval, AnswerGuardApprovalRequest, GuardEvaluateRequest, SECRET_SOURCES, SecretFinding, SecretScanResult, GuardEvaluateResponse, GuardRulesResponse, EFFECT_STRENGTH, DEFAULT_NEXT, guardPaths, APPROVAL_HEADER;
+var init_guardrails = __esm({
+  "../contracts/src/guardrails.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    init_identity();
+    GUARD_LAYERS = ["platform", "team", "project"];
+    GuardLayer = external_exports.enum(GUARD_LAYERS);
+    GUARD_EFFECTS = ["allow", "deny", "require_approval"];
+    GuardEffect = external_exports.enum(GUARD_EFFECTS);
+    GUARD_CODES = [
+      "policy_denied",
+      "approval_required",
+      "protected_branch",
+      "path_protected",
+      "spend_cap_reached",
+      "plan_limit_reached",
+      "egress_blocked",
+      "deploy_blocked",
+      "secret_detected",
+      "task_required"
+    ];
+    GuardCode = external_exports.enum(GUARD_CODES);
+    GUARD_EXIT_CODE = 6;
+    glob = external_exports.string().min(1).max(256);
+    globs = external_exports.array(glob).min(1).max(64);
+    GuardTimeWindow = external_exports.object({
+      days: external_exports.array(external_exports.number().int().min(0).max(6)).min(1).max(7).optional(),
+      fromHour: external_exports.number().int().min(0).max(23).optional(),
+      toHour: external_exports.number().int().min(1).max(24).optional()
+    }).strict();
+    GuardUsageMatch = external_exports.object({ metric: external_exports.string().min(1).max(64), atLeast: external_exports.number().nonnegative() }).strict();
+    GuardMatch = external_exports.object({
+      principals: globs.optional(),
+      roles: external_exports.array(Role).min(1).optional(),
+      tools: globs.optional(),
+      paths: globs.optional(),
+      branches: globs.optional(),
+      repositories: globs.optional(),
+      environments: globs.optional(),
+      hosts: globs.optional(),
+      time: GuardTimeWindow.optional(),
+      usage: GuardUsageMatch.optional(),
+      /** The caller holds an active task (ADR 0038). */
+      taskHeld: external_exports.boolean().optional()
+    }).strict();
+    GuardRuleSource = external_exports.object({
+      id: external_exports.string().regex(/^[a-z0-9][a-z0-9._-]{1,63}$/, "use lowercase letters, digits, . _ -"),
+      description: external_exports.string().min(1).max(400),
+      effect: GuardEffect,
+      match: GuardMatch,
+      /** Report what the rule would block without blocking (REQ-GRD-08). */
+      dryRun: external_exports.boolean().default(false),
+      code: GuardCode.optional(),
+      /** Plain-language reason shown to the person or agent that was refused. */
+      message: external_exports.string().min(1).max(400).optional(),
+      /** The exact next command or approval path (REQ-GRD-12). */
+      nextCommand: external_exports.string().min(1).max(200).optional()
+    }).strict();
+    GuardRuleFileSource = external_exports.object({
+      version: external_exports.literal("1"),
+      rules: external_exports.array(GuardRuleSource).max(200)
+    }).strict().superRefine((file2, ctx) => {
+      const seen = /* @__PURE__ */ new Set();
+      file2.rules.forEach((rule, index) => {
+        if (seen.has(rule.id)) ctx.addIssue({ code: "custom", path: ["rules", index, "id"], message: `duplicate rule id ${rule.id}` });
+        seen.add(rule.id);
+      });
+    });
+    GuardRule = GuardRuleSource.extend({
+      tenantId: TenantId,
+      layer: GuardLayer,
+      projectId: ProjectId.optional(),
+      fileVersion: external_exports.number().int().positive()
+    }).strict();
+    GuardRuleFileRecord = external_exports.object({
+      tenantId: TenantId,
+      layer: GuardLayer,
+      projectId: ProjectId.optional(),
+      version: external_exports.number().int().positive(),
+      digest: Sha256Digest,
+      ruleCount: external_exports.number().int().nonnegative(),
+      author: external_exports.string().min(1),
+      reason: external_exports.string().min(1).max(400).optional(),
+      createdAt: Timestamp
+    }).strict();
+    PutGuardRuleFileRequest = external_exports.object({
+      requestId: external_exports.string().min(1).max(128),
+      layer: GuardLayer.exclude(["platform"]).default("team"),
+      projectId: ProjectId.optional(),
+      /** The rule file text (JSON). Kept as text so the digest and the reviewed file are the same bytes. */
+      content: external_exports.string().min(2).max(256e3),
+      reason: external_exports.string().min(1).max(400).optional()
+    }).strict();
+    GuardRequest = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId.optional(),
+      principal: external_exports.object({ kind: external_exports.enum(["user", "agent", "bot", "system"]), id: external_exports.string().min(1), role: Role }).strict(),
+      /** `api.write`, `git.push`, `git.merge`, `ci.run`, `deploy.run`, `egress.fetch`, `task.create`, `review.run`, ... */
+      tool: external_exports.string().min(1).max(128),
+      paths: external_exports.array(external_exports.string().min(1)).max(2e3).default([]),
+      branch: external_exports.string().min(1).optional(),
+      repository: external_exports.string().min(1).optional(),
+      environment: external_exports.string().min(1).optional(),
+      host: external_exports.string().min(1).optional(),
+      at: Timestamp,
+      usage: external_exports.record(external_exports.string(), external_exports.number().nonnegative()).default({}),
+      taskHeld: external_exports.boolean().optional(),
+      /** For approve-before-write: what the action does in plain language and the change it would make (REQ-GRD-09). */
+      summary: external_exports.string().min(1).max(2e3).optional(),
+      diff: external_exports.string().max(1e5).optional()
+    }).strict();
+    GuardMatchedRule = external_exports.object({ ruleId: external_exports.string().min(1), layer: GuardLayer, effect: GuardEffect, dryRun: external_exports.boolean() }).strict();
+    GuardDecision = external_exports.object({
+      tenantId: TenantId,
+      effect: GuardEffect,
+      allowed: external_exports.boolean(),
+      code: GuardCode.nullable(),
+      ruleId: external_exports.string().nullable(),
+      layer: GuardLayer.nullable(),
+      message: external_exports.string().min(1),
+      nextCommand: external_exports.string().nullable(),
+      exitCode: external_exports.union([external_exports.literal(0), external_exports.literal(GUARD_EXIT_CODE)]),
+      /** True when a dry-run rule matched and would have blocked. */
+      dryRun: external_exports.boolean(),
+      wouldBlock: external_exports.boolean(),
+      approvalId: external_exports.string().optional(),
+      matched: external_exports.array(GuardMatchedRule)
+    }).strict().superRefine((decision, ctx) => {
+      if (decision.effect !== "allow" && decision.allowed) ctx.addIssue({ code: "custom", path: ["allowed"], message: "a deny or approval decision is not allowed" });
+      if (!decision.allowed && (decision.code === null || decision.ruleId === null || decision.nextCommand === null)) {
+        ctx.addIssue({ code: "custom", message: "a refusal carries a code, a rule ID and the next command" });
+      }
+      if (!decision.allowed && decision.exitCode !== GUARD_EXIT_CODE) ctx.addIssue({ code: "custom", path: ["exitCode"], message: "a refusal exits with 6" });
+    });
+    GUARD_APPROVAL_STATUSES = ["pending", "approved", "denied"];
+    GUARD_AUTONOMY_MODES = ["autonomous", "supervised", "manual"];
+    GuardAutonomy = external_exports.enum(GUARD_AUTONOMY_MODES);
+    GuardApproval = external_exports.object({
+      tenantId: TenantId,
+      id: external_exports.string().min(1),
+      projectId: ProjectId.optional(),
+      ruleId: external_exports.string().min(1),
+      tool: external_exports.string().min(1),
+      requestedBy: external_exports.string().min(1),
+      summary: external_exports.string().min(1),
+      diff: external_exports.string().nullable(),
+      status: external_exports.enum(GUARD_APPROVAL_STATUSES),
+      /** Hash of the action the approval covers; a changed action needs a new approval. */
+      actionDigest: Sha256Digest,
+      decidedBy: external_exports.string().nullable(),
+      /** Who approved: an independent second agent satisfies an approval; a person always can. */
+      approverKind: external_exports.enum(["user", "agent"]).nullable(),
+      evidence: external_exports.array(external_exports.string()),
+      reason: external_exports.string().nullable(),
+      decidedAt: Timestamp.nullable(),
+      createdAt: Timestamp
+    }).strict();
+    AnswerGuardApprovalRequest = external_exports.object({ decision: external_exports.enum(["approve", "deny"]), reason: external_exports.string().min(1).max(400).optional(), evidence: external_exports.array(external_exports.string().min(1).max(400)).max(20).optional() }).strict();
+    GuardEvaluateRequest = external_exports.object({
+      tool: external_exports.string().min(1).max(128),
+      paths: external_exports.array(external_exports.string().min(1)).max(2e3).optional(),
+      branch: external_exports.string().optional(),
+      repository: external_exports.string().optional(),
+      environment: external_exports.string().optional(),
+      host: external_exports.string().optional(),
+      taskHeld: external_exports.boolean().optional(),
+      summary: external_exports.string().min(1).max(2e3).optional(),
+      diff: external_exports.string().max(1e5).optional(),
+      /** Text the action would write (push content, log lines); scanned for secrets (REQ-GRD-05). */
+      content: external_exports.string().max(1e6).optional(),
+      /** Evaluate without recording an approval request or blocking. */
+      dryRun: external_exports.boolean().optional(),
+      /** Optional test overrides, honoured only for an explicit rule test. */
+      principalOverride: external_exports.object({ kind: external_exports.enum(["user", "agent", "bot", "system"]), id: external_exports.string().min(1), role: Role }).strict().optional(),
+      usage: external_exports.record(external_exports.string(), external_exports.number().nonnegative()).optional(),
+      at: Timestamp.optional()
+    }).strict();
+    SECRET_SOURCES = ["push", "task", "evidence", "log", "memory", "api"];
+    SecretFinding = external_exports.object({
+      tenantId: TenantId,
+      source: external_exports.enum(SECRET_SOURCES),
+      rule: external_exports.string().min(1),
+      /** Provider-prefixed keys block; generic high-entropy strings are reported only. */
+      disposition: external_exports.enum(["blocked", "reported"]),
+      path: external_exports.string().optional(),
+      line: external_exports.number().int().positive().optional()
+    }).strict();
+    SecretScanResult = external_exports.object({ tenantId: TenantId, blocked: external_exports.boolean(), findings: external_exports.array(SecretFinding) }).strict();
+    GuardEvaluateResponse = external_exports.object({ decision: GuardDecision, secrets: SecretScanResult.nullable() }).strict();
+    GuardRulesResponse = external_exports.object({ tenantId: TenantId, files: external_exports.array(GuardRuleFileRecord), rules: external_exports.array(GuardRule) }).strict();
+    EFFECT_STRENGTH = { allow: 0, require_approval: 1, deny: 2 };
+    DEFAULT_NEXT = {
+      allow: null,
+      deny: "overlane guard rules list",
+      require_approval: "overlane guard approvals list"
+    };
+    guardPaths = {
+      base: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard`,
+      rules: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard/rules`,
+      evaluate: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard/evaluate`,
+      approvals: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard/approvals`,
+      approval: (tenantId, id2) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard/approvals/${encodeURIComponent(id2)}`,
+      answer: (tenantId, id2) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard/approvals/${encodeURIComponent(id2)}/answer`,
+      scan: (tenantId) => `/v1/tenants/${encodeURIComponent(tenantId)}/guard/scan`
+    };
+    APPROVAL_HEADER = "x-overlane-approval";
+  }
+});
+
+// ../contracts/src/code-map.ts
+function codeMapDefault(setting, results = GATE_07_LATEST) {
+  const result = results[setting];
+  if (result.verdict === "failed") return { setting, on: false, basis: "gate-07-failed", reason: `off: ${result.summary} (${result.evidence})`, gate07: "failed" };
+  if (result.verdict === "passed") return { setting, on: true, basis: "gate-07-passed", reason: `on: ${result.summary} (${result.evidence})`, gate07: "passed" };
+  const on = SPEC_DEFAULT[setting];
+  if (result.verdict === "pending") {
+    return { setting, on, basis: "spec-default-provisional", reason: `${on ? "on" : "off"} by the spec default, provisional: ${result.summary} (${result.evidence})`, gate07: "pending" };
+  }
+  return { setting, on, basis: "spec-default", reason: `${on ? "on" : "off"} by the spec default: ${result.summary}`, gate07: "not-applicable" };
+}
+var CODE_MAP_SETTINGS, CodeMapSetting, GATE_07_VERDICTS, Gate07Verdict, GATE_07_LATEST, SPEC_DEFAULT, CODE_MAP_BASES, CodeMapDefault, CodeMapClientStatus, CodeMapStatus, codeMapPaths;
+var init_code_map = __esm({
+  "../contracts/src/code-map.ts"() {
+    "use strict";
+    init_zod();
+    init_clients();
+    init_common();
+    CODE_MAP_SETTINGS = ["local-agent-with-grep", "cloud-session", "bot", "review-service", "cross-repo", "wiki"];
+    CodeMapSetting = external_exports.enum(CODE_MAP_SETTINGS);
+    GATE_07_VERDICTS = ["passed", "failed", "pending", "not-applicable"];
+    Gate07Verdict = external_exports.enum(GATE_07_VERDICTS);
+    GATE_07_LATEST = {
+      "local-agent-with-grep": {
+        verdict: "failed",
+        summary: "GATE-07 failed with a local checkout and grep: cueline 115% and afltables 109% of the native-search token cost",
+        evidence: "ADR 0018, docs/findings/gate-07-preliminary.md, docs/findings/gate-07-realism-afltables.md"
+      },
+      "cloud-session": {
+        verdict: "pending",
+        summary: "re-run for agents without a checkout: the mechanical leg is recorded, the agent leg waits on a model",
+        evidence: "docs/findings/MS-A5-results.md (MS-A5.6)"
+      },
+      bot: {
+        verdict: "pending",
+        summary: "re-run for agents without a checkout: the mechanical leg is recorded, the agent leg waits on a model",
+        evidence: "docs/findings/MS-A5-results.md (MS-A5.6)"
+      },
+      "review-service": { verdict: "not-applicable", summary: "the review service has no grep to compare with; it uses the map as context", evidence: "ADR 0032 decision 3" },
+      "cross-repo": { verdict: "not-applicable", summary: "cross-repository questions have no single checkout to search", evidence: "ADR 0032 decision 2" },
+      wiki: { verdict: "not-applicable", summary: "the generated wiki is built from the map", evidence: "ADR 0032 decision 3" }
+    };
+    SPEC_DEFAULT = {
+      "local-agent-with-grep": false,
+      "cloud-session": true,
+      bot: true,
+      "review-service": true,
+      "cross-repo": true,
+      wiki: true
+    };
+    CODE_MAP_BASES = ["gate-07-failed", "gate-07-passed", "spec-default-provisional", "spec-default", "project-setting"];
+    CodeMapDefault = external_exports.object({ setting: CodeMapSetting, on: external_exports.boolean(), basis: external_exports.enum(CODE_MAP_BASES), reason: external_exports.string().min(1), gate07: Gate07Verdict }).strict();
+    CodeMapClientStatus = external_exports.object({ subject: external_exports.string().min(1), client: external_exports.string().min(1), setting: CodeMapSetting, on: external_exports.boolean(), basis: external_exports.enum(CODE_MAP_BASES), reason: external_exports.string().min(1), gate07: Gate07Verdict }).strict();
+    CodeMapStatus = external_exports.object({
+      tenantId: TenantId,
+      projectId: ProjectId,
+      /** ADR 0018: the Worker serves code routes and the MCP code tool only when the project turns the code layer on. */
+      projectCodeLayer: external_exports.boolean(),
+      clients: external_exports.array(CodeMapClientStatus)
+    }).strict();
+    codeMapPaths = {
+      status: (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/code-map/status`
+    };
+  }
+});
+
 // ../contracts/src/index.ts
 var init_src = __esm({
   "../contracts/src/index.ts"() {
@@ -22310,6 +22858,9 @@ var init_src = __esm({
     init_memory();
     init_issues();
     init_onboarding();
+    init_review();
+    init_guardrails();
+    init_code_map();
   }
 });
 
@@ -29644,12 +30195,12 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename3, join as join24, resolve as resolve8 } from "node:path";
+import { basename as basename3, join as join24, resolve as resolve9 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["MVRX_PACKAGE_ROOT"];
   if (override !== void 0 && override !== "") return override;
-  return resolve8(fileURLToPath(new URL(".", import.meta.url)), "..");
+  return resolve9(fileURLToPath(new URL(".", import.meta.url)), "..");
 }
 function assetDir(env = process.env) {
   const override = env["MVRX_ASSET_DIR"];
@@ -29662,7 +30213,7 @@ var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.119" : "0.0.0-dev";
+    VERSION = true ? "0.1.120" : "0.0.0-dev";
   }
 });
 
@@ -29757,13 +30308,13 @@ function int64FromString(dec) {
   if (minus) {
     dec = dec.slice(1);
   }
-  const base3 = 1e6;
+  const base4 = 1e6;
   let lowBits = 0;
   let highBits = 0;
   function add1e6digit(begin, end) {
     const digit1e6 = Number(dec.slice(begin, end));
-    highBits *= base3;
-    lowBits = lowBits * base3 + digit1e6;
+    highBits *= base4;
+    lowBits = lowBits * base4 + digit1e6;
     if (lowBits >= TWO_PWR_32_DBL) {
       highBits = highBits + (lowBits / TWO_PWR_32_DBL | 0);
       lowBits = lowBits % TWO_PWR_32_DBL;
@@ -29795,14 +30346,14 @@ function uInt64ToString(lo, hi) {
   let digitA = low + mid * 6777216 + high * 6710656;
   let digitB = mid + high * 8147497;
   let digitC = high * 2;
-  const base3 = 1e7;
-  if (digitA >= base3) {
-    digitB += Math.floor(digitA / base3);
-    digitA %= base3;
+  const base4 = 1e7;
+  if (digitA >= base4) {
+    digitB += Math.floor(digitA / base4);
+    digitA %= base4;
   }
-  if (digitB >= base3) {
-    digitC += Math.floor(digitB / base3);
-    digitB %= base3;
+  if (digitB >= base4) {
+    digitC += Math.floor(digitB / base4);
+    digitB %= base4;
   }
   return digitC.toString() + decimalFrom1e7WithLeadingZeros(digitB) + decimalFrom1e7WithLeadingZeros(digitA);
 }
@@ -31080,7 +31631,7 @@ function createFileRegistry(...args2) {
         if (seen.has(protoFileName)) {
           continue;
         }
-        const dep = resolve11(protoFileName);
+        const dep = resolve12(protoFileName);
         if (!dep) {
           throw new Error(`Unable to resolve ${protoFileName}, imported by ${file2.name}`);
         }
@@ -31094,7 +31645,7 @@ function createFileRegistry(...args2) {
       return deps.concat(...deps.map(recurseDeps));
     };
     const input2 = args2[0];
-    const resolve11 = args2[1];
+    const resolve12 = args2[1];
     const seen = /* @__PURE__ */ new Set();
     for (const file2 of [input2, ...recurseDeps(input2)].reverse()) {
       addFile(file2, registry2);
@@ -32627,7 +33178,7 @@ var init_codegenv2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@scip-code+scip@0.10.0/node_modules/@scip-code/scip/dist/scip_pb.js
-var file_scip, IndexSchema, Descriptor_Suffix, SymbolInformation_Kind, ProtocolVersion, TextEncoding, PositionEncoding, SymbolRole, SyntaxKind, Severity, DiagnosticTag, Language;
+var file_scip, IndexSchema, Descriptor_Suffix, SymbolInformation_Kind, ProtocolVersion, TextEncoding, PositionEncoding, SymbolRole, SyntaxKind, Severity2, DiagnosticTag, Language;
 var init_scip_pb = __esm({
   "../../node_modules/.pnpm/@scip-code+scip@0.10.0/node_modules/@scip-code/scip/dist/scip_pb.js"() {
     init_codegenv2();
@@ -32799,13 +33350,13 @@ var init_scip_pb = __esm({
       SyntaxKind2[SyntaxKind2["TagAttribute"] = 35] = "TagAttribute";
       SyntaxKind2[SyntaxKind2["TagDelimiter"] = 36] = "TagDelimiter";
     })(SyntaxKind || (SyntaxKind = {}));
-    (function(Severity2) {
-      Severity2[Severity2["UnspecifiedSeverity"] = 0] = "UnspecifiedSeverity";
-      Severity2[Severity2["Error"] = 1] = "Error";
-      Severity2[Severity2["Warning"] = 2] = "Warning";
-      Severity2[Severity2["Information"] = 3] = "Information";
-      Severity2[Severity2["Hint"] = 4] = "Hint";
-    })(Severity || (Severity = {}));
+    (function(Severity3) {
+      Severity3[Severity3["UnspecifiedSeverity"] = 0] = "UnspecifiedSeverity";
+      Severity3[Severity3["Error"] = 1] = "Error";
+      Severity3[Severity3["Warning"] = 2] = "Warning";
+      Severity3[Severity3["Information"] = 3] = "Information";
+      Severity3[Severity3["Hint"] = 4] = "Hint";
+    })(Severity2 || (Severity2 = {}));
     (function(DiagnosticTag2) {
       DiagnosticTag2[DiagnosticTag2["UnspecifiedDiagnosticTag"] = 0] = "UnspecifiedDiagnosticTag";
       DiagnosticTag2[DiagnosticTag2["Unnecessary"] = 1] = "Unnecessary";
@@ -32929,10 +33480,10 @@ var init_scip_pb = __esm({
 
 // ../index-builder/src/languages.ts
 function languageForPath(path) {
-  const base3 = path.slice(path.lastIndexOf("/") + 1);
-  const dot = base3.lastIndexOf(".");
+  const base4 = path.slice(path.lastIndexOf("/") + 1);
+  const dot = base4.lastIndexOf(".");
   if (dot <= 0) return null;
-  return BY_EXTENSION.get(base3.slice(dot).toLowerCase()) ?? null;
+  return BY_EXTENSION.get(base4.slice(dot).toLowerCase()) ?? null;
 }
 var BY_EXTENSION;
 var init_languages = __esm({
@@ -33352,9 +33903,9 @@ function marshalNode(node2, index = 0) {
   C.setValue(address, node2[0], "i32");
 }
 function unmarshalNode(tree, address = TRANSFER_BUFFER) {
-  const id = C.getValue(address, "i32");
+  const id2 = C.getValue(address, "i32");
   address += SIZE_OF_INT;
-  if (id === 0) return null;
+  if (id2 === 0) return null;
   const index = C.getValue(address, "i32");
   address += SIZE_OF_INT;
   const row = C.getValue(address, "i32");
@@ -33363,7 +33914,7 @@ function unmarshalNode(tree, address = TRANSFER_BUFFER) {
   address += SIZE_OF_INT;
   const other = C.getValue(address, "i32");
   const result = new Node(INTERNAL, {
-    id,
+    id: id2,
     tree,
     startIndex: index,
     startPosition: { row, column },
@@ -33507,13 +34058,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url2) => {
         if (isFileURI(url2)) {
-          return new Promise((resolve11, reject) => {
+          return new Promise((resolve12, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url2, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve11(xhr.response);
+                resolve12(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -33709,9 +34260,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info2 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve11, reject) => {
+      return new Promise((resolve12, reject) => {
         Module["instantiateWasm"](info2, (mod, inst) => {
-          resolve11(receiveInstance(mod, inst));
+          resolve12(receiveInstance(mod, inst));
         });
       });
     }
@@ -34452,7 +35003,7 @@ async function Module2(moduleArg = {}) {
   }, "reportUndefinedSymbols");
   var runDependencies = 0;
   var dependenciesFulfilled = null;
-  var removeRunDependency = /* @__PURE__ */ __name((id) => {
+  var removeRunDependency = /* @__PURE__ */ __name((id2) => {
     runDependencies--;
     Module["monitorRunDependencies"]?.(runDependencies);
     if (runDependencies == 0) {
@@ -34463,7 +35014,7 @@ async function Module2(moduleArg = {}) {
       }
     }
   }, "removeRunDependency");
-  var addRunDependency = /* @__PURE__ */ __name((id) => {
+  var addRunDependency = /* @__PURE__ */ __name((id2) => {
     runDependencies++;
     Module["monitorRunDependencies"]?.(runDependencies);
   }, "addRunDependency");
@@ -35044,8 +35595,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve11, reject) => {
-      readyPromiseResolve = resolve11;
+    moduleRtn = new Promise((resolve12, reject) => {
+      readyPromiseResolve = resolve12;
       readyPromiseReject = reject;
     });
   }
@@ -35383,9 +35934,9 @@ var init_web_tree_sitter = __esm({
        * Returns `null` if the iterator is not positioned on a symbol.
        */
       get currentType() {
-        const id = this.currentTypeId;
-        if (id === null) return null;
-        return this.language.types[id] ?? C.UTF8ToString(C._ts_language_symbol_name(this.language[0], id));
+        const id2 = this.currentTypeId;
+        if (id2 === null) return null;
+        return this.language.types[id2] ?? C.UTF8ToString(C._ts_language_symbol_name(this.language[0], id2));
       }
       /** Delete the lookahead iterator, freeing its resources. */
       delete() {
@@ -35849,7 +36400,7 @@ var init_web_tree_sitter = __esm({
       _namedChildren;
       /** @internal */
       constructor(internal, {
-        id,
+        id: id2,
         tree,
         startIndex,
         startPosition,
@@ -35857,7 +36408,7 @@ var init_web_tree_sitter = __esm({
       }) {
         assertInternal(internal);
         this[0] = other;
-        this.id = id;
+        this.id = id2;
         this.tree = tree;
         this.startIndex = startIndex;
         this.startPosition = startPosition;
@@ -37379,19 +37930,19 @@ function collect(extract, nodes, scope, parentId, prefix, path, symbols2, occurr
   for (const node2 of nodes) {
     for (const decl of extract(node2, scope)) {
       const qualified = prefix === "" ? decl.name : `${prefix}.${decl.name}`;
-      const id = `decl ${path}#${qualified}`;
-      if (symbols2.has(id)) continue;
+      const id2 = `decl ${path}#${qualified}`;
+      if (symbols2.has(id2)) continue;
       const range = rangeOf(decl.nameNode);
-      symbols2.set(id, {
-        symbol: id,
+      symbols2.set(id2, {
+        symbol: id2,
         name: decl.name,
         kind: decl.kind,
         range,
         enclosingRange: rangeOf(decl.outer),
         ...parentId ? { parent: parentId } : {}
       });
-      occurrences.push({ symbol: id, range, definition: true, ...parentId ? { enclosingSymbol: parentId } : {} });
-      if (decl.members.length > 0) collect(extract, decl.members, decl.memberScope, id, qualified, path, symbols2, occurrences);
+      occurrences.push({ symbol: id2, range, definition: true, ...parentId ? { enclosingSymbol: parentId } : {} });
+      if (decl.members.length > 0) collect(extract, decl.members, decl.memberScope, id2, qualified, path, symbols2, occurrences);
     }
   }
 }
@@ -37701,7 +38252,7 @@ var init_snapshot = __esm({
 // ../index-builder/src/upload.ts
 async function uploadSnapshot(options) {
   const doFetch = options.fetch ?? fetch;
-  const base3 = options.serviceUrl.replace(/\/+$/, "");
+  const base4 = options.serviceUrl.replace(/\/+$/, "");
   const manifest = SnapshotManifest.parse(options.manifest);
   const { tenantId, repository, commitSha } = manifest;
   const headers = { authorization: `Bearer ${options.token}`, "content-type": "application/json" };
@@ -37709,7 +38260,7 @@ async function uploadSnapshot(options) {
     for (let attempt2 = 1; ; attempt2 += 1) {
       let failure4;
       try {
-        const response = await doFetch(`${base3}${path}`, { method: "POST", headers, body: body2 });
+        const response = await doFetch(`${base4}${path}`, { method: "POST", headers, body: body2 });
         if (response.ok) return response;
         const retryable = response.status === 429 || response.status >= 500;
         if (!retryable || attempt2 >= ATTEMPTS) {
@@ -37721,7 +38272,7 @@ async function uploadSnapshot(options) {
         failure4 = error62 instanceof Error ? error62.message : String(error62);
         if (attempt2 >= ATTEMPTS) throw new Error(`POST ${path} failed: ${failure4}`);
       }
-      await new Promise((resolve11) => setTimeout(resolve11, (options.retryDelayMs ?? 500) * attempt2));
+      await new Promise((resolve12) => setTimeout(resolve12, (options.retryDelayMs ?? 500) * attempt2));
     }
   };
   const manifestResponse = await send2(codePaths.uploadManifest(tenantId, repository.owner, repository.name), JSON.stringify(manifest));
@@ -37799,7 +38350,7 @@ var init_oidc = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile2 } from "node:child_process";
 import { mkdir as mkdir3, readdir as readdir4, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join26, resolve as resolve9 } from "node:path";
+import { join as join26, resolve as resolve10 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify2 } from "node:util";
 async function git3(root, args2) {
@@ -37820,7 +38371,7 @@ async function repositoryFromRemote(root) {
   }
 }
 async function snapshotFromArgs(values, env) {
-  const root = resolve9(typeof values["root"] === "string" ? values["root"] : process.cwd());
+  const root = resolve10(typeof values["root"] === "string" ? values["root"] : process.cwd());
   const repoText = (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
   if (!repoText) throw new UsageError2("cannot determine the repository; pass --repo owner/name");
   const commit = (typeof values["commit"] === "string" ? values["commit"] : void 0) ?? env["GITHUB_SHA"] ?? await git3(root, ["rev-parse", "HEAD"]);
@@ -37830,7 +38381,7 @@ async function snapshotFromArgs(values, env) {
   const scip = Array.isArray(values["scip"]) ? values["scip"] : [];
   return buildSnapshot({
     repoRoot: root,
-    scipFiles: scip.map((file2) => resolve9(file2)),
+    scipFiles: scip.map((file2) => resolve10(file2)),
     tenantId: tenant,
     repository: parseRepository(repoText),
     commitSha: commit,
@@ -37845,8 +38396,8 @@ async function runCli2(argv, env, out2 = console.log, err2 = console.error) {
       const outDir = values.out;
       if (!outDir) throw new UsageError2("build needs --out DIR");
       const built = await snapshotFromArgs({ ...values, tenant: values.tenant ?? env["HARNESS_TENANT"] ?? "local" }, env);
-      await writeSnapshot(resolve9(outDir), built);
-      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve9(outDir)}`);
+      await writeSnapshot(resolve10(outDir), built);
+      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve10(outDir)}`);
       return 0;
     }
     if (command === "upload") {
@@ -39931,8 +40482,8 @@ function buildSchemas2025() {
 function isNonObjectJsonSchemaRoot(json2) {
   return json2["type"] !== "object";
 }
-function establishesNewBase(id) {
-  return id !== void 0 && !(typeof id === "string" && id.startsWith("#"));
+function establishesNewBase(id2) {
+  return id2 !== void 0 && !(typeof id2 === "string" && id2.startsWith("#"));
 }
 function wrapOutputSchemaForLegacy(natural) {
   const $schema = typeof natural["$schema"] === "string" ? natural["$schema"] : void 0;
@@ -41474,14 +42025,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve11();
+      resolve12();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -41587,8 +42138,8 @@ function setNegotiatedProtocolVersion(instance2, version2) {
 function isPlainObject$1(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function mergeCapabilities(base3, additional) {
-  const result = { ...base3 };
+function mergeCapabilities(base4, additional) {
+  const result = { ...base4 };
   for (const key in additional) {
     const k = key;
     const addValue = additional[k];
@@ -43277,7 +43828,7 @@ var init_src_CX2iR2pK = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           const earlyReject = (error62) => {
             reject(error62);
           };
@@ -43345,7 +43896,7 @@ var init_src_CX2iR2pK = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve11(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve12(manualInputRequiredValue(decoded));
               const flow = {
                 codec: codec2,
                 request,
@@ -43357,11 +43908,11 @@ var init_src_CX2iR2pK = __esm({
                   params
                 }, resultSchema2, legOptions)
               };
-              return resolve11(this._resolveNonCompleteResult(decoded, flow));
+              return resolve12(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema2, result).then((parseResult) => {
-              if (parseResult.success) resolve11(parseResult.data);
+              if (parseResult.success) resolve12(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -45552,9 +46103,9 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
         return count;
       }
-      function getFullPath(resolver, id = "", normalize) {
-        if (normalize !== false) id = normalizeId(id);
-        return _getFullPath(resolver, resolver.parse(id));
+      function getFullPath(resolver, id2 = "", normalize) {
+        if (normalize !== false) id2 = normalizeId(id2);
+        return _getFullPath(resolver, resolver.parse(id2));
       }
       exports.getFullPath = getFullPath;
       function _getFullPath(resolver, p) {
@@ -45562,13 +46113,13 @@ var init_ajvProvider_CEoC_sr = __esm({
       }
       exports._getFullPath = _getFullPath;
       const TRAILING_SLASH_HASH = /#\/?$/;
-      function normalizeId(id) {
-        return id ? id.replace(TRAILING_SLASH_HASH, "") : "";
+      function normalizeId(id2) {
+        return id2 ? id2.replace(TRAILING_SLASH_HASH, "") : "";
       }
       exports.normalizeId = normalizeId;
-      function resolveUrl(resolver, baseId, id) {
-        id = normalizeId(id);
-        return resolver.resolve(baseId, id);
+      function resolveUrl(resolver, baseId, id2) {
+        id2 = normalizeId(id2);
+        return resolver.resolve(baseId, id2);
       }
       exports.resolveUrl = resolveUrl;
       const ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -46177,7 +46728,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve11.call(this, root, ref);
+        let _sch = resolve12.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -46203,7 +46754,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve11(root, ref) {
+      function resolve12(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -46213,8 +46764,8 @@ var init_ajvProvider_CEoC_sr = __esm({
         const refPath = (0, resolve_1._getFullPath)(this.opts.uriResolver, p);
         let baseId = (0, resolve_1.getFullPath)(this.opts.uriResolver, root.baseId, void 0);
         if (Object.keys(root.schema).length > 0 && refPath === baseId) return getJsonPointer.call(this, p, root);
-        const id = (0, resolve_1.normalizeId)(refPath);
-        const schOrRef = this.refs[id] || this.schemas[id];
+        const id2 = (0, resolve_1.normalizeId)(refPath);
+        const schOrRef = this.refs[id2] || this.schemas[id2];
         if (typeof schOrRef == "string") {
           const sch = resolveSchema.call(this, root, schOrRef);
           if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object") return;
@@ -46222,7 +46773,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         }
         if (typeof (schOrRef === null || schOrRef === void 0 ? void 0 : schOrRef.schema) !== "object") return;
         if (!schOrRef.validate) compileSchema.call(this, schOrRef);
-        if (id === (0, resolve_1.normalizeId)(ref)) {
+        if (id2 === (0, resolve_1.normalizeId)(ref)) {
           const { schema } = schOrRef;
           const { schemaId } = this.opts;
           const schId = schema[schemaId];
@@ -46653,16 +47204,16 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse5(serialize(uri, options), options);
         return uri;
       }
-      function resolve11(baseURI, relativeURI, options) {
+      function resolve12(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
         return serialize(resolved, schemelessOptions);
       }
-      function resolveComponent(base3, relative4, options, skipNormalization) {
+      function resolveComponent(base4, relative4, options, skipNormalization) {
         const target = {};
         if (!skipNormalization) {
-          base3 = parse5(serialize(base3, options), options);
+          base4 = parse5(serialize(base4, options), options);
           relative4 = parse5(serialize(relative4, options), options);
         }
         options = options || {};
@@ -46682,24 +47233,24 @@ var init_ajvProvider_CEoC_sr = __esm({
             target.query = relative4.query;
           } else {
             if (!relative4.path) {
-              target.path = base3.path;
+              target.path = base4.path;
               if (relative4.query !== void 0) target.query = relative4.query;
-              else target.query = base3.query;
+              else target.query = base4.query;
             } else {
               if (relative4.path[0] === "/") target.path = removeDotSegments(relative4.path);
               else {
-                if ((base3.userinfo !== void 0 || base3.host !== void 0 || base3.port !== void 0) && !base3.path) target.path = "/" + relative4.path;
-                else if (!base3.path) target.path = relative4.path;
-                else target.path = base3.path.slice(0, base3.path.lastIndexOf("/") + 1) + relative4.path;
+                if ((base4.userinfo !== void 0 || base4.host !== void 0 || base4.port !== void 0) && !base4.path) target.path = "/" + relative4.path;
+                else if (!base4.path) target.path = relative4.path;
+                else target.path = base4.path.slice(0, base4.path.lastIndexOf("/") + 1) + relative4.path;
                 target.path = removeDotSegments(target.path);
               }
               target.query = relative4.query;
             }
-            target.userinfo = base3.userinfo;
-            target.host = base3.host;
-            target.port = base3.port;
+            target.userinfo = base4.userinfo;
+            target.host = base4.host;
+            target.port = base4.port;
           }
-          target.scheme = base3.scheme;
+          target.scheme = base4.scheme;
         }
         target.fragment = relative4.fragment;
         return target;
@@ -46827,7 +47378,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve11,
+        resolve: resolve12,
         resolveComponent,
         equal,
         serialize,
@@ -47090,13 +47641,13 @@ var init_ajvProvider_CEoC_sr = __esm({
             for (const sch of schema) this.addSchema(sch, void 0, _meta, _validateSchema);
             return this;
           }
-          let id;
+          let id2;
           if (typeof schema === "object") {
             const { schemaId } = this.opts;
-            id = schema[schemaId];
-            if (id !== void 0 && typeof id != "string") throw new Error(`schema ${schemaId} must be string`);
+            id2 = schema[schemaId];
+            if (id2 !== void 0 && typeof id2 != "string") throw new Error(`schema ${schemaId} must be string`);
           }
-          key = (0, resolve_1.normalizeId)(key || id);
+          key = (0, resolve_1.normalizeId)(key || id2);
           this._checkUnique(key);
           this.schemas[key] = this._addSchema(schema, _meta, key, _validateSchema, true);
           return this;
@@ -47161,11 +47712,11 @@ var init_ajvProvider_CEoC_sr = __esm({
             case "object": {
               const cacheKey = schemaKeyRef;
               this._cache.delete(cacheKey);
-              let id = schemaKeyRef[this.opts.schemaId];
-              if (id) {
-                id = (0, resolve_1.normalizeId)(id);
-                delete this.schemas[id];
-                delete this.refs[id];
+              let id2 = schemaKeyRef[this.opts.schemaId];
+              if (id2) {
+                id2 = (0, resolve_1.normalizeId)(id2);
+                delete this.schemas[id2];
+                delete this.refs[id2];
               }
               return this;
             }
@@ -47257,14 +47808,14 @@ var init_ajvProvider_CEoC_sr = __esm({
           }
         }
         _addSchema(schema, meta3, baseId, validateSchema = this.opts.validateSchema, addSchema = this.opts.addUsedSchema) {
-          let id;
+          let id2;
           const { schemaId } = this.opts;
-          if (typeof schema == "object") id = schema[schemaId];
+          if (typeof schema == "object") id2 = schema[schemaId];
           else if (this.opts.jtd) throw new Error("schema must be object");
           else if (typeof schema != "boolean") throw new Error("schema must be object or boolean");
           let sch = this._cache.get(schema);
           if (sch !== void 0) return sch;
-          baseId = (0, resolve_1.normalizeId)(id || baseId);
+          baseId = (0, resolve_1.normalizeId)(id2 || baseId);
           const localRefs = resolve_1.getSchemaRefs.call(this, schema, baseId);
           sch = new compile_1.SchemaEnv({
             schema,
@@ -47281,8 +47832,8 @@ var init_ajvProvider_CEoC_sr = __esm({
           if (validateSchema) this.validateSchema(schema, true);
           return sch;
         }
-        _checkUnique(id) {
-          if (this.schemas[id] || this.refs[id]) throw new Error(`schema with key or id "${id}" already exists`);
+        _checkUnique(id2) {
+          if (this.schemas[id2] || this.refs[id2]) throw new Error(`schema with key or id "${id2}" already exists`);
         }
         _compileSchemaEnv(sch) {
           if (sch.meta) this._compileMetaSchema(sch);
@@ -50816,8 +51367,8 @@ var init_mcp_DXXb3Vv3 = __esm({
         if (serverInfo !== void 0) this._serverInfo = serverInfo;
       }
       /** Whether `id` is an active listen subscription on this connection. */
-      has(id) {
-        return this._subs.has(id);
+      has(id2) {
+        return this._subs.has(id2);
       }
       /**
       * Serve one inbound `subscriptions/listen` request: registers the
@@ -50861,8 +51412,8 @@ var init_mcp_DXXb3Vv3 = __esm({
       * `true` when a subscription was removed. After this call NOTHING further
       * is delivered for that subscription id (the post-cancel hardening).
       */
-      cancel(id) {
-        return this._subs.delete(id);
+      cancel(id2) {
+        return this._subs.delete(id2);
       }
       /**
       * Route an outbound notification through the active subscriptions.
@@ -50894,13 +51445,13 @@ var init_mcp_DXXb3Vv3 = __esm({
       */
       teardownAll() {
         const out2 = [];
-        for (const id of this._subs.keys()) out2.push({
+        for (const id2 of this._subs.keys()) out2.push({
           jsonrpc: "2.0",
-          id,
+          id: id2,
           result: {
             resultType: "complete",
             _meta: {
-              [SUBSCRIPTION_ID_META_KEY]: id,
+              [SUBSCRIPTION_ID_META_KEY]: id2,
               ...this._serverInfo !== void 0 && { [SERVER_INFO_META_KEY]: this._serverInfo }
             }
           }
@@ -51468,7 +52019,7 @@ var init_mcp_DXXb3Vv3 = __esm({
           if (hasPreviousToolUse) {
             const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
             const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
-            if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "ids of tool_result blocks and tool_use blocks from previous message do not match");
+            if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id2) => toolResultIds.has(id2))) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "ids of tool_result blocks and tool_use blocks from previous message do not match");
           }
         }
         const hasTools = Boolean(params.tools || params.toolChoice);
@@ -52192,9 +52743,9 @@ function serveStdio(factory, options = {}) {
     } catch {
     }
   };
-  const writeErrorResponse = (id, code2, message, data) => wire.send({
+  const writeErrorResponse = (id2, code2, message, data) => wire.send({
     jsonrpc: "2.0",
-    id,
+    id: id2,
     error: {
       code: code2,
       message,
@@ -52524,7 +53075,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve11, reject) => {
+        return new Promise((resolve12, reject) => {
           const json2 = serializeMessage(message);
           let settled = false;
           const onError = (error62) => {
@@ -52539,14 +53090,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve11();
+            resolve12();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json2)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve11();
+            resolve12();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -52569,8 +53120,8 @@ var init_stdio = __esm({
       }
       async send(message, options) {
         if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
-          const { id } = message;
-          if (id !== void 0) this._settle(id);
+          const { id: id2 } = message;
+          if (id2 !== void 0) this._settle(id2);
         }
         if (this._closed) return;
         if (this._outboundIntercept?.(message) === "handled") return;
@@ -52600,14 +53151,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve11) => {
+        return await new Promise((resolve12) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve11(true);
+            resolve12(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve11(false);
+            resolve12(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -52623,8 +53174,8 @@ var init_stdio = __esm({
           this.onclose?.();
         }
       }
-      _settle(id) {
-        this._pendingRequests.delete(id);
+      _settle(id2) {
+        this._pendingRequests.delete(id2);
         if (this._pendingRequests.size === 0) this._releaseDrainWaiters();
       }
       _releaseDrainWaiters() {
@@ -52786,18 +53337,18 @@ var init_git = __esm({
 });
 
 // ../code-shim/src/config.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join31 } from "node:path";
 function configDir(env) {
-  const base3 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join31(homedir2(), ".config");
-  return join31(base3, "mvrx-harness");
+  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join31(homedir2(), ".config");
+  return join31(base4, "mvrx-harness");
 }
 function findToken2(env, serviceUrl, now) {
   const fromEnv = env["HARNESS_TOKEN"];
   if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
   try {
-    const file2 = JSON.parse(readFileSync10(join31(configDir(env), "credentials.json"), "utf8"));
+    const file2 = JSON.parse(readFileSync11(join31(configDir(env), "credentials.json"), "utf8"));
     const stored = file2[serviceUrl];
     if (stored === void 0 || typeof stored.accessToken !== "string" || stored.accessToken.length === 0) return null;
     if (typeof stored.expiresAt === "number" && stored.expiresAt <= now) return null;
@@ -52809,7 +53360,7 @@ function findToken2(env, serviceUrl, now) {
 function resolveCloudConfig(root, env, now) {
   let binding;
   try {
-    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync10(join31(root, ".harness", "project.json"), "utf8")));
+    const parsed = ProjectBinding.safeParse(JSON.parse(readFileSync11(join31(root, ".harness", "project.json"), "utf8")));
     if (!parsed.success) return null;
     binding = parsed.data;
   } catch {
@@ -52831,10 +53382,10 @@ var init_config = __esm({
 });
 
 // ../code-shim/src/local.ts
-import { readFileSync as readFileSync11, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve10, sep as sep2 } from "node:path";
+import { readFileSync as readFileSync12, statSync as statSync2 } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve11, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
-  const absolute = resolve10(root, path);
+  const absolute = resolve11(root, path);
   const rel = relative3(root, absolute);
   if (rel.length === 0 || rel.startsWith("..") || isAbsolute2(rel)) return null;
   return absolute;
@@ -52951,7 +53502,7 @@ var init_local = __esm({
         let shard;
         try {
           this.parses += 1;
-          shard = await this.parse(path, readFileSync11(absolute, "utf8"));
+          shard = await this.parse(path, readFileSync12(absolute, "utf8"));
         } catch {
           shard = null;
         }
@@ -52963,7 +53514,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return null;
         try {
-          return readFileSync11(absolute, "utf8");
+          return readFileSync12(absolute, "utf8");
         } catch {
           return null;
         }
@@ -52973,7 +53524,7 @@ var init_local = __esm({
         const absolute = resolveInside(this.root, path);
         if (absolute === null) return void 0;
         try {
-          const lines = readFileSync11(absolute, "utf8").split("\n");
+          const lines = readFileSync12(absolute, "utf8").split("\n");
           const start2 = range[0];
           if (start2 >= lines.length) return void 0;
           const end = Math.min(Math.max(range[2], start2), start2 + maxLines - 1, lines.length - 1);
@@ -53094,8 +53645,8 @@ async function symbolsOverview(deps, args2) {
   const dirty2 = await parseDirty(deps.index, state, (p) => isUnder(p, scope));
   const cloud = await deps.cloud.query("symbols_overview", state.head, args2, SymbolAnswer);
   const local2 = localSymbolHits(dirty2.shards, (shard, i2) => shard.symbols[i2]?.parent === void 0);
-  const base3 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state).filter((hit) => isUnder(hit.path, scope)) : [];
-  const merged = uniqueBy([...base3, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
+  const base4 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state).filter((hit) => isUnder(hit.path, scope)) : [];
+  const merged = uniqueBy([...base4, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
   const limited = limitByTokens(merged, args2.max_tokens ?? 4e3);
   return {
     provenance: mergeProvenance(state.head, cloud.kind === "ok" ? cloud.data.provenance : null, state, { overlaid: [...dirty2.shards.keys()], unparsed: dirty2.unparsed }),
@@ -53112,8 +53663,8 @@ async function findSymbol(deps, args2) {
     const symbol2 = shard.symbols[i2];
     return symbol2 !== void 0 && matchesNamePath(shard, symbol2, wanted);
   });
-  const base3 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state) : [];
-  const merged = uniqueBy([...base3, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
+  const base4 = cloud.kind === "ok" ? cloudSymbols(cloud.data.symbols, state) : [];
+  const merged = uniqueBy([...base4, ...local2], (h) => `${h.path}\0${h.symbol}\0${h.range.join(",")}`);
   return {
     provenance: mergeProvenance(state.head, cloud.kind === "ok" ? cloud.data.provenance : null, state, { overlaid: [...dirty2.shards.keys()], unparsed: dirty2.unparsed }),
     symbols: withSnippets(deps.index, merged, args2.include_snippet === true)
@@ -53133,14 +53684,14 @@ async function findReferences(deps, args2) {
       local2.push({ path, symbol: args2.name, range, source: "local" });
     }
   }
-  const base3 = [];
+  const base4 = [];
   if (cloud.kind === "ok") {
     for (const hit of cloud.data.references) {
       const path = keepCloudPath(hit.path, state);
-      if (path !== null) base3.push({ ...hit, path, source: "cloud" });
+      if (path !== null) base4.push({ ...hit, path, source: "cloud" });
     }
   }
-  const merged = uniqueBy([...base3, ...local2], (h) => `${h.path}\0${h.range.join(",")}`);
+  const merged = uniqueBy([...base4, ...local2], (h) => `${h.path}\0${h.range.join(",")}`);
   return {
     provenance: mergeProvenance(state.head, cloud.kind === "ok" ? cloud.data.provenance : null, state, { overlaid: [...dirty2.shards.keys()], unparsed: dirty2.unparsed }),
     references: withSnippets(deps.index, merged, args2.include_snippet === true)
@@ -53200,7 +53751,7 @@ var init_nav = __esm({
 
 // ../code-shim/src/edit.ts
 import { createHash as createHash8 } from "node:crypto";
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
 function lineStarts(text) {
   const starts = [0];
   for (let i2 = 0; i2 < text.length; i2 += 1) if (text[i2] === "\n") starts.push(i2 + 1);
@@ -53241,7 +53792,7 @@ async function editSymbol(index, args2) {
   if (!found.ok) return found;
   const absolute = resolveInside(index.root, args2.path);
   if (absolute === null) return { ok: false, reason: `path ${args2.path} is outside the repository` };
-  const original = readFileSync12(absolute, "utf8");
+  const original = readFileSync13(absolute, "utf8");
   const starts = lineStarts(original);
   const range = found.symbol.enclosingRange ?? found.symbol.range;
   const from = offsetOf(starts, original, range[0], range[1]);
@@ -53308,7 +53859,7 @@ async function renameSymbol(deps, args2) {
     if (absolute === null) return { ok: false, reason: `reference path ${path} is outside the repository` };
     let text;
     try {
-      text = readFileSync12(absolute, "utf8");
+      text = readFileSync13(absolute, "utf8");
     } catch {
       return { ok: false, reason: `cannot read ${path}` };
     }
@@ -53451,6 +54002,30 @@ var init_server = __esm({
   }
 });
 
+// ../code-shim/src/defaults.ts
+function shimSetting(env) {
+  const remote = env["CLAUDE_CODE_REMOTE"] === "true" || env["CODEX_CLOUD"] === "1" || env["HARNESS_SETTING"] === "cloud-session";
+  return remote ? "cloud-session" : "local-agent-with-grep";
+}
+function codeMapSwitch(env, results) {
+  const setting = shimSetting(env);
+  const base4 = results === void 0 ? codeMapDefault(setting) : codeMapDefault(setting, results);
+  const forced = env["HARNESS_CODE_MAP"];
+  if (forced === "on" || forced === "off") {
+    return { ...base4, on: forced === "on", basis: "project-setting", reason: `${forced}: set by HARNESS_CODE_MAP (the default for this setting is ${base4.on ? "on" : "off"}: ${base4.reason})`, source: "env" };
+  }
+  return { ...base4, source: "default" };
+}
+function describeSwitch(state) {
+  return `code-shim: code map ${state.on ? "on" : "off"} for ${state.setting} (${state.source}). ${state.reason}`;
+}
+var init_defaults = __esm({
+  "../code-shim/src/defaults.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
 // ../code-shim/src/index.ts
 var src_exports = {};
 __export(src_exports, {
@@ -53459,8 +54034,10 @@ __export(src_exports, {
   callHierarchy: () => callHierarchy,
   changeImpact: () => changeImpact,
   cloudArgs: () => cloudArgs,
+  codeMapSwitch: () => codeMapSwitch,
   createDeps: () => createDeps,
   createServer: () => createServer2,
+  describeSwitch: () => describeSwitch,
   editSymbol: () => editSymbol,
   findReferences: () => findReferences,
   findSymbol: () => findSymbol,
@@ -53471,6 +54048,7 @@ __export(src_exports, {
   readWorkingCopyState: () => readWorkingCopyState,
   renameSymbol: () => renameSymbol,
   resolveCloudConfig: () => resolveCloudConfig,
+  shimSetting: () => shimSetting,
   symbolsOverview: () => symbolsOverview
 });
 var init_src3 = __esm({
@@ -53484,6 +54062,7 @@ var init_src3 = __esm({
     init_merge2();
     init_nav();
     init_server();
+    init_defaults();
   }
 });
 
@@ -53741,8 +54320,8 @@ var AuthRequiredError = class extends MvrxError {
     super(message, { code: "auth_required", exit: EXIT.auth }, { hint: "overlane auth status", ...options });
   }
 };
-function unreachable(base3, cause) {
-  return new CliError(`cannot reach ${base3}: ${cause instanceof Error ? cause.message : String(cause)}`, {
+function unreachable(base4, cause) {
+  return new CliError(`cannot reach ${base4}: ${cause instanceof Error ? cause.message : String(cause)}`, {
     code: "unreachable",
     exit: EXIT.unreachable,
     retryable: true,
@@ -53773,6 +54352,19 @@ var SERVICE_CODES = {
   promotion_blocked: { exit: EXIT.blocked, hint: "overlane release list" },
   no_previous_release: { exit: EXIT.conflict, hint: "overlane release status" },
   managed_file_edited: { exit: EXIT.conflict, hint: "overlane release status" },
+  // guardrails and review (MS-A5): a refusal by policy exits 6 with the rule and the next command (REQ-GRD-12)
+  policy_denied: { exit: EXIT.blocked, hint: "overlane guard rules list" },
+  protected_branch: { exit: EXIT.blocked, hint: "overlane guard approvals list" },
+  path_protected: { exit: EXIT.blocked, hint: "overlane guard approvals list" },
+  spend_cap_reached: { exit: EXIT.blocked, hint: "overlane guard rules list" },
+  plan_limit_reached: { exit: EXIT.blocked, hint: "overlane guard rules list" },
+  egress_blocked: { exit: EXIT.blocked, hint: "overlane guard rules list" },
+  deploy_blocked: { exit: EXIT.blocked, hint: "overlane guard rules list" },
+  secret_detected: { exit: EXIT.blocked, hint: "overlane guard scan --path <file>" },
+  task_required: { exit: EXIT.blocked, hint: 'overlane task new "<title>"' },
+  invalid_rules: { exit: EXIT.usage, hint: "overlane guard rules test --file <rules.json> --tool <tool>" },
+  finding_not_open: { exit: EXIT.conflict, hint: "overlane review findings --status open" },
+  live_leg_pending: { exit: EXIT.failure, hint: "overlane review status" },
   // generic
   unauthorized: { exit: EXIT.auth, hint: "overlane auth login" },
   // identity (MS-A1): a revoked or expired token needs a new sign-in; a role that may not do this is blocked by policy
@@ -54261,19 +54853,19 @@ function pkcePair() {
   return { verifier, challenge: base64url3(createHash("sha256").update(verifier).digest()) };
 }
 function listen(server, port) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const onError = (error62) => reject(error62);
     server.once("error", onError);
     server.listen(port, "127.0.0.1", () => {
       server.off("error", onError);
-      resolve11();
+      resolve12();
     });
   });
 }
 async function startLoopback(preferredPort, state) {
   let settle2;
-  const code2 = new Promise((resolve11, reject) => {
-    settle2 = { resolve: resolve11, reject };
+  const code2 = new Promise((resolve12, reject) => {
+    settle2 = { resolve: resolve12, reject };
   });
   code2.catch(() => void 0);
   const server = createServer((request, response) => {
@@ -54620,10 +55212,10 @@ async function failure2(response) {
   }
   return { code: void 0, text: `status ${response.status}` };
 }
-async function call(deps, base3, token, schema, method, path, body2) {
+async function call(deps, base4, token, schema, method, path, body2) {
   let response;
   try {
-    response = await deps.fetch(`${base3}${path}`, {
+    response = await deps.fetch(`${base4}${path}`, {
       method,
       headers: {
         accept: "application/json",
@@ -54633,7 +55225,7 @@ async function call(deps, base3, token, schema, method, path, body2) {
       ...body2 === void 0 ? {} : { body: JSON.stringify(body2) }
     });
   } catch (error62) {
-    throw unreachable(base3, error62);
+    throw unreachable(base4, error62);
   }
   if (!response.ok) {
     const failed = await failure2(response);
@@ -54650,12 +55242,12 @@ async function call(deps, base3, token, schema, method, path, body2) {
   return parsed.data;
 }
 function releaseClient(deps, binding, token, serviceUrl = binding.serviceUrl) {
-  const base3 = serviceUrl.replace(/\/+$/, "");
+  const base4 = serviceUrl.replace(/\/+$/, "");
   return {
-    list: () => call(deps, base3, token, external_exports.array(ReleaseRecord), "GET", releasePaths.list(binding.tenantId)),
-    get: (digest) => call(deps, base3, token, ReleaseRecord, "GET", releasePaths.one(binding.tenantId, digest)),
-    pin: (digest) => call(deps, base3, token, ProjectRecord, "PUT", releasePaths.pin(binding.tenantId, binding.projectId), { digest }),
-    rollback: () => call(deps, base3, token, ProjectRecord, "POST", releasePaths.rollback(binding.tenantId, binding.projectId), {})
+    list: () => call(deps, base4, token, external_exports.array(ReleaseRecord), "GET", releasePaths.list(binding.tenantId)),
+    get: (digest) => call(deps, base4, token, ReleaseRecord, "GET", releasePaths.one(binding.tenantId, digest)),
+    pin: (digest) => call(deps, base4, token, ProjectRecord, "PUT", releasePaths.pin(binding.tenantId, binding.projectId), { digest }),
+    rollback: () => call(deps, base4, token, ProjectRecord, "POST", releasePaths.rollback(binding.tenantId, binding.projectId), {})
   };
 }
 async function fetchServicePublicKey(deps, serviceUrl, token) {
@@ -55020,8 +55612,8 @@ function withTimeout(deps, ms) {
 }
 async function attempt(deps, ms, work) {
   let timer;
-  const deadline = new Promise((resolve11) => {
-    timer = setTimeout(() => resolve11("unreachable"), ms);
+  const deadline = new Promise((resolve12) => {
+    timer = setTimeout(() => resolve12("unreachable"), ms);
   });
   try {
     return await Promise.race([work(withTimeout(deps, ms)).catch((error62) => error62 instanceof ServiceError && error62.exit === EXIT.auth ? "unauthenticated" : "unreachable"), deadline]);
@@ -55259,13 +55851,13 @@ function render(op, existing) {
     case "block":
       return withBlock(existing, op.content);
     case "json": {
-      let base3 = op.base ?? {};
+      let base4 = op.base ?? {};
       if (existing !== null && existing.trim() !== "") {
         const parsed = JSON.parse(existing);
         if (!isRecord(parsed)) throw new Error(`${op.path} is not a JSON object; fix it by hand, then run the command again`);
-        base3 = parsed;
+        base4 = parsed;
       }
-      return `${JSON.stringify(setAt(base3, op.key, op.value), null, 2)}
+      return `${JSON.stringify(setAt(base4, op.key, op.value), null, 2)}
 `;
     }
   }
@@ -55665,9 +56257,9 @@ function updateSteps(agent) {
   ];
 }
 function kindOfEachFile(diff) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const file2 of [...diff.added, ...diff.changed, ...diff.removed]) counts.set(file2.kind, (counts.get(file2.kind) ?? 0) + 1);
-  return counts.size === 0 ? "no file changes" : [...counts].map(([kind, count]) => `${count} ${kind}`).join(", ");
+  const counts2 = /* @__PURE__ */ new Map();
+  for (const file2 of [...diff.added, ...diff.changed, ...diff.removed]) counts2.set(file2.kind, (counts2.get(file2.kind) ?? 0) + 1);
+  return counts2.size === 0 ? "no file changes" : [...counts2].map(([kind, count]) => `${count} ${kind}`).join(", ");
 }
 function showDiff(deps, diff) {
   say(deps, `  files: ${diff.added.length} added, ${diff.changed.length} changed, ${diff.removed.length} removed (${kindOfEachFile(diff)})`);
@@ -55804,17 +56396,20 @@ async function failure3(response) {
   const text = await response.text();
   try {
     const parsed = ApiError.safeParse(JSON.parse(text));
-    if (parsed.success) return { text: `${parsed.data.error.code}: ${parsed.data.error.message}`, code: parsed.data.error.code };
+    if (parsed.success) {
+      const { code: code2, message, ruleId, hint } = parsed.data.error;
+      return { text: `${code2}: ${message}${ruleId === void 0 ? "" : ` [rule ${ruleId}]`}`, code: code2, hint };
+    }
   } catch {
   }
-  return { text: `status ${response.status}`, code: void 0 };
+  return { text: `status ${response.status}`, code: void 0, hint: void 0 };
 }
 function serviceCall(deps, serviceUrl, token) {
-  const base3 = serviceUrl.replace(/\/+$/, "");
+  const base4 = serviceUrl.replace(/\/+$/, "");
   return async (schema, method, path, body2, extraHeaders) => {
     let response;
     try {
-      response = await deps.fetch(`${base3}${path}`, {
+      response = await deps.fetch(`${base4}${path}`, {
         method,
         headers: {
           accept: "application/json",
@@ -55825,11 +56420,11 @@ function serviceCall(deps, serviceUrl, token) {
         ...body2 === void 0 ? {} : { body: JSON.stringify(body2) }
       });
     } catch (error62) {
-      throw unreachable(base3, error62);
+      throw unreachable(base4, error62);
     }
     if (!response.ok) {
       const failed = await failure3(response);
-      throw new ServiceError(`${method} ${path} failed (${failed.text})`, failed.code, response.status);
+      throw new ServiceError(`${method} ${path} failed (${failed.text})`, failed.code, response.status, failed.hint);
     }
     let json2;
     try {
@@ -56010,7 +56605,7 @@ function slugify2(value) {
 var PLAN_DIR = ".harness/plan";
 var planPaths = (repoDir) => {
   const root = join15(repoDir, PLAN_DIR);
-  return { root, project: join15(root, "project.md"), milestones: join15(root, "milestones.md"), tasks: join15(root, "tasks"), task: (id) => join15(root, "tasks", `${id}.md`) };
+  return { root, project: join15(root, "project.md"), milestones: join15(root, "milestones.md"), tasks: join15(root, "tasks"), task: (id2) => join15(root, "tasks", `${id2}.md`) };
 };
 function parsePlan(input2, where) {
   const result = Plan.safeParse(input2);
@@ -56111,7 +56706,7 @@ function parseMilestones(text, where) {
     }
     if (line2.trim() === "") continue;
     const depends = /^Depends on: (.+)$/.exec(line2);
-    if (depends && !inAcceptance) current2.dependsOn = (depends[1] ?? "").split(",").map((id) => id.trim());
+    if (depends && !inAcceptance) current2.dependsOn = (depends[1] ?? "").split(",").map((id2) => id2.trim());
     else if (inAcceptance && line2.startsWith("- ")) current2.acceptance.push(line2.slice(2));
     else throw new KitError(`${where}: unexpected line under ${current2.id}: "${line2}"`);
   }
@@ -56313,9 +56908,9 @@ async function draftPlanForExisting(repoDir, opts = {}) {
   const allowedPaths = opts.allowedPaths ?? ["."];
   const tasks = [];
   const starter = (title, outcome, verification, dependsOn) => {
-    const id = `T${String(tasks.length + 1).padStart(3, "0")}`;
-    tasks.push({ id, title, milestone, outcome, allowedPaths, acceptance: verification.map((command) => `\`${command}\` exits 0`), verification, evidenceLevel: "L2", dependsOn, requiresConnections: [] });
-    return id;
+    const id2 = `T${String(tasks.length + 1).padStart(3, "0")}`;
+    tasks.push({ id: id2, title, milestone, outcome, allowedPaths, acceptance: verification.map((command) => `\`${command}\` exits 0`), verification, evidenceLevel: "L2", dependsOn, requiresConnections: [] });
+    return id2;
   };
   const installId = detected.install ? starter("Install dependencies", "Dependencies install cleanly from the lockfile.", [detected.install], []) : void 0;
   const after = installId ? [installId] : [];
@@ -56509,9 +57104,9 @@ async function importSpecKit(repoDir) {
   const name2 = (parsedConstitution?.name ?? basename2(root)).slice(0, 100);
   const goal = (parsedConstitution?.goal ?? firstInput ?? `Deliver ${name2}.`).slice(0, 2e3);
   const multi = features.length > 1;
-  const counts = /* @__PURE__ */ new Map();
-  for (const feature of features) for (const phase of feature.phases) for (const task of phase.tasks) counts.set(task.id, (counts.get(task.id) ?? 0) + 1);
-  const prefixTasks = [...counts.values()].some((count) => count > 1);
+  const counts2 = /* @__PURE__ */ new Map();
+  for (const feature of features) for (const phase of feature.phases) for (const task of phase.tasks) counts2.set(task.id, (counts2.get(task.id) ?? 0) + 1);
+  const prefixTasks = [...counts2.values()].some((count) => count > 1);
   const detected = await detectCommands(root);
   const milestones = [];
   const tasks = [];
@@ -56529,17 +57124,17 @@ async function importSpecKit(repoDir) {
     let storyRun = [];
     feature.phases.forEach((phase, index) => {
       const defaultId = `${multi ? `F${feature.key}-` : ""}P${phase.number ?? index + 1}`;
-      const id = phase.id ?? defaultId;
+      const id2 = phase.id ?? defaultId;
       const story = isStoryTitle(phase.title);
       const derivedDeps = story !== void 0 ? lastNonStory ? [lastNonStory] : [] : storyRun.length > 0 ? [...storyRun] : lastNonStory ? [lastNonStory] : [];
-      if (story !== void 0) storyRun.push(id);
+      if (story !== void 0) storyRun.push(id2);
       else {
-        lastNonStory = id;
+        lastNonStory = id2;
         storyRun = [];
       }
-      const stored = feature.block.milestones[id];
+      const stored = feature.block.milestones[id2];
       const derivedAcceptance = story !== void 0 ? feature.stories.get(story) ?? [] : phase.checkpoint ? [phase.checkpoint] : [];
-      milestones.push({ id, title: phase.title || `Phase ${phase.number ?? index + 1}`, acceptance: stored?.acceptance ?? derivedAcceptance, dependsOn: stored?.dependsOn ?? derivedDeps });
+      milestones.push({ id: id2, title: phase.title || `Phase ${phase.number ?? index + 1}`, acceptance: stored?.acceptance ?? derivedAcceptance, dependsOn: stored?.dependsOn ?? derivedDeps });
       let previousGroup = [];
       let group = [];
       let groupParallel = false;
@@ -56560,7 +57155,7 @@ async function importSpecKit(repoDir) {
         tasks.push({
           id: taskId,
           title: parsed.title,
-          milestone: id,
+          milestone: id2,
           outcome: storedTask?.outcome ?? parsed.title,
           allowedPaths: storedTask?.allowedPaths ?? (paths.length > 0 ? paths : ["."]),
           acceptance: storedTask?.acceptance ?? (storyAcceptance && storyAcceptance.length > 0 ? storyAcceptance : [`Completed: ${parsed.title}`]),
@@ -57883,12 +58478,12 @@ init_zod();
 init_src();
 init_zod();
 var ErrorBody = external_exports.object({ error: external_exports.object({ code: external_exports.string(), message: external_exports.string() }).passthrough() }).passthrough();
-async function post(deps, base3, path, body2) {
+async function post(deps, base4, path, body2) {
   let response;
   try {
-    response = await deps.fetch(`${base3}${path}`, { method: "POST", headers: { "content-type": "application/json", accept: "application/json" }, body: JSON.stringify(body2) });
+    response = await deps.fetch(`${base4}${path}`, { method: "POST", headers: { "content-type": "application/json", accept: "application/json" }, body: JSON.stringify(body2) });
   } catch (error62) {
-    throw unreachable(base3, error62);
+    throw unreachable(base4, error62);
   }
   let json2 = null;
   try {
@@ -57899,7 +58494,7 @@ async function post(deps, base3, path, body2) {
   return { status: response.status, json: json2 };
 }
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 async function deviceLogin(deps, service, options) {
   const started = await post(deps, service, "/auth/device", {});
@@ -58239,28 +58834,302 @@ var tokenRevokeCommand = defineCommand({
   keywords: ["revoke", "delete token", "disable token", "kill credentials", "remove access", "leaked token"],
   result: TokenRevokeResult,
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("a token ID is required", { hint: "overlane token list" });
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("a token ID is required", { hint: "overlane token list" });
     if (inv.dryRun) {
       const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
-      return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method: "DELETE", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/tokens/${id}` }] }));
+      return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method: "DELETE", path: `/v1/tenants/${textFlag(inv, "team") ?? ":your-team"}/tokens/${id2}` }] }));
     }
     const { call: call2 } = await authed(inv);
     const tenantId = await tenantOf(call2, inv);
-    await call2(external_exports.object({ ok: external_exports.literal(true) }).passthrough(), "DELETE", `/v1/tenants/${encodeURIComponent(tenantId)}/tokens/${encodeURIComponent(id)}`);
-    say(inv.deps, `Revoked ${id}.`);
-    return { data: { tenantId, tokenId: id, revoked: true } };
+    await call2(external_exports.object({ ok: external_exports.literal(true) }).passthrough(), "DELETE", `/v1/tenants/${encodeURIComponent(tenantId)}/tokens/${encodeURIComponent(id2)}`);
+    say(inv.deps, `Revoked ${id2}.`);
+    return { data: { tenantId, tokenId: id2, revoked: true } };
   }
 });
 var identityCommands = [authLoginCommand, authLogoutCommand, authTokenCommand, teamListCommand, teamInviteCommand, tokenCreateCommand, tokenListCommand, tokenRevokeCommand];
 
-// ../cli/src/commands/memory.ts
+// ../cli/src/commands/guard.ts
 init_src();
 init_zod();
 import { randomUUID as randomUUID3 } from "node:crypto";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
+var common = { needsAuth: true, needsNetwork: true };
+var requestId3 = () => `cli-${randomUUID3()}`;
+async function connected(inv) {
+  const project = await connectedProject(inv.deps, "guard");
+  return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "guard");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+function readText3(inv, path) {
+  try {
+    return readFileSync7(resolve7(inv.deps.paths.cwd, path), "utf8");
+  } catch {
+    throw new UsageError(`could not read ${path}`, { hint: "overlane guard rules test --file rules.json --tool git.push" });
+  }
+}
+var ACTION_FLAGS = [
+  { name: "tool", type: "string", required: true, value: "TOOL", description: "The action, for example git.push, deploy.run, egress.fetch or api.write" },
+  { name: "path", type: "string", multiple: true, value: "PATH", description: "A path the action touches; repeat for more" },
+  { name: "branch", type: "string", value: "BRANCH", description: "The branch the action targets" },
+  { name: "repo", type: "string", value: "OWNER/NAME", description: "The repository the action targets" },
+  { name: "environment", type: "string", value: "NAME", description: "The environment, for example production" },
+  { name: "host", type: "string", value: "HOST", description: "The host, for an egress action" }
+];
+function actionOf(inv) {
+  const tool = textFlag(inv, "tool");
+  if (tool === void 0) throw new UsageError("this command needs --tool", { hint: "overlane guard dry-run --tool git.push --branch main" });
+  const branch = textFlag(inv, "branch");
+  const repo = textFlag(inv, "repo");
+  const environment = textFlag(inv, "environment");
+  const host = textFlag(inv, "host");
+  const paths = listFlag(inv, "path");
+  return { tool, ...paths.length === 0 ? {} : { paths }, ...branch === void 0 ? {} : { branch }, ...repo === void 0 ? {} : { repository: repo }, ...environment === void 0 ? {} : { environment }, ...host === void 0 ? {} : { host } };
+}
+function describeDecision(decision) {
+  const lines = [`${decision.allowed ? decision.wouldBlock ? "ALLOWED (dry-run: would block)" : "ALLOWED" : decision.effect === "require_approval" ? "APPROVAL REQUIRED" : "DENIED"}  ${decision.message}`];
+  if (decision.ruleId !== null) lines.push(`rule: ${decision.ruleId}${decision.layer === null ? "" : ` (${decision.layer})`}${decision.code === null ? "" : `, code: ${decision.code}`}`);
+  if (decision.nextCommand !== null) lines.push(`next: ${decision.nextCommand}`);
+  return lines;
+}
+function refusalOutcome(data, decision) {
+  const error62 = new CliError(`${decision.message}${decision.ruleId === null ? "" : ` [rule ${decision.ruleId}]`}`, {
+    code: decision.code ?? "policy_denied",
+    exit: EXIT.blocked,
+    ...decision.nextCommand === null ? {} : { hint: decision.nextCommand }
+  });
+  return { data, exit: EXIT.blocked, error: error62 };
+}
+var guardRulesListCommand = defineCommand({
+  path: ["guard", "rules", "list"],
+  summary: "List the guardrail rules in force and the versions of the rule files",
+  description: "Lists the platform rules (always in force), then the team and project rule files and their rules. A rule change is an audit event; every file version is listed with its digest and author.",
+  examples: ["overlane guard rules list", "overlane guard rules list --json"],
+  effect: "read",
+  ...common,
+  keywords: ["guardrails", "policy as code", "rules in force", "protected branches", "what is blocked", "rule files"],
+  result: GuardRulesResponse,
+  text: (d) => [...d.rules.map((rule) => `${rule.layer.padEnd(8)} ${rule.effect.padEnd(16)} ${rule.id}${rule.dryRun ? "  [dry-run]" : ""}  ${rule.description}`), ...d.files.map((file2) => `file ${file2.layer} v${file2.version} ${file2.digest.slice(0, 19)} by ${file2.author}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected(inv);
+    return { data: await call2(GuardRulesResponse, "GET", `${guardPaths.rules(tenantId)}?projectId=${encodeURIComponent(projectId)}`) };
+  }
+});
+var RuleTestResult = external_exports.object({ decision: GuardDecision, rules: external_exports.number().int().nonnegative(), note: external_exports.string() }).strict();
+var guardRulesTestCommand = defineCommand({
+  path: ["guard", "rules", "test"],
+  summary: "Test a rule file against an action, locally, before it is merged",
+  description: "Loads a rule file (JSON, version 1) and evaluates one action against it as the team layer, with no network. The server also applies the platform rules, which a team file cannot weaken; use `overlane guard dry-run` to see the combined decision. Exits 6 when the file would refuse the action.",
+  flags: [
+    { name: "file", type: "string", required: true, value: "PATH", description: "The rule file to test" },
+    ...ACTION_FLAGS,
+    { name: "role", type: "string", enum: ["owner", "admin", "member", "viewer", "agent"], default: "agent", description: "The role of the principal" },
+    { name: "usage", type: "string", multiple: true, value: "METRIC=N", description: "Measured usage, for example usd=12.5 or reviews=50" }
+  ],
+  examples: ["overlane guard rules test --file rules.json --tool git.push --branch main --role agent", "overlane guard rules test --file rules.json --tool review.run --usage reviews=50"],
+  effect: "read",
+  needsAuth: false,
+  needsNetwork: false,
+  keywords: ["test rules", "check rule file", "validate policy", "rule test", "try a rule"],
+  result: RuleTestResult,
+  text: (d) => [...describeDecision(d.decision), d.note],
+  handler: async (inv) => {
+    const file2 = textFlag(inv, "file");
+    if (file2 === void 0) throw new UsageError("rules test needs --file", { hint: "overlane guard rules test --file rules.json --tool git.push" });
+    let json2;
+    try {
+      json2 = JSON.parse(readText3(inv, file2));
+    } catch (error62) {
+      if (error62 instanceof UsageError) throw error62;
+      throw new UsageError(`${file2} is not valid JSON`);
+    }
+    const parsed = GuardRuleFileSource.safeParse(json2);
+    if (!parsed.success) throw new UsageError(`${file2} is not a valid rule file: ${parsed.error.issues.map((issue2) => `${issue2.path.join(".") || "file"}: ${issue2.message}`).join("; ")}`);
+    const usage = {};
+    for (const entry of listFlag(inv, "usage")) {
+      const [metric, value] = entry.split("=");
+      if (metric === void 0 || value === void 0 || Number.isNaN(Number(value))) throw new UsageError("--usage must be METRIC=NUMBER", { hint: "overlane guard rules test --file rules.json --tool ci.run --usage usd=12.5" });
+      usage[metric] = Number(value);
+    }
+    const role = textFlag(inv, "role") ?? "agent";
+    const action = actionOf(inv);
+    const request = GuardRequest.parse({
+      tenantId: "local",
+      principal: { kind: role === "agent" ? "agent" : "user", id: "local-test", role },
+      tool: action.tool,
+      paths: action.paths ?? [],
+      ...action.branch === void 0 ? {} : { branch: action.branch },
+      ...action.repository === void 0 ? {} : { repository: action.repository },
+      ...action.environment === void 0 ? {} : { environment: action.environment },
+      ...action.host === void 0 ? {} : { host: action.host },
+      at: new Date(inv.deps.now()).toISOString(),
+      usage
+    });
+    const decision = composeDecision("local", [{ layer: "team", rules: parsed.data.rules }], request);
+    const result = { decision, rules: parsed.data.rules.length, note: "Tested as the team layer only. The platform rules also apply on the server." };
+    return decision.allowed ? { data: result } : refusalOutcome(result, decision);
+  }
+});
+var guardRulesPutCommand = defineCommand({
+  path: ["guard", "rules", "put"],
+  summary: "Publish a new version of the team or project rule file",
+  description: "Uploads a rule file as the next version. The file is validated whole, scanned for credentials and recorded as an audit event with its digest and author. Keep the file in version control and review it by pull request; this command publishes what was reviewed.",
+  flags: [
+    { name: "file", type: "string", required: true, value: "PATH", description: "The rule file (JSON, version 1)" },
+    { name: "layer", type: "string", enum: ["team", "project"], default: "team", description: "team applies to every project; project applies to this one" },
+    { name: "reason", type: "string", value: "TEXT", description: "Why the rules changed; kept in the audit event" }
+  ],
+  examples: ['overlane guard rules put --file rules.json --reason "freeze deploys on Fridays"', "overlane guard rules put --file rules.json --layer project --dry-run"],
+  effect: "write",
+  ...common,
+  keywords: ["publish rules", "update guardrails", "change policy", "upload rule file", "freeze deploys"],
+  result: withDryRun(GuardRuleFileRecord),
+  text: (d) => "version" in d ? [`Published ${d.layer} rule file v${d.version} (${d.ruleCount} rules, ${d.digest.slice(0, 19)}).`] : [],
+  handler: async (inv) => {
+    const file2 = textFlag(inv, "file");
+    if (file2 === void 0) throw new UsageError("rules put needs --file", { hint: "overlane guard rules put --file rules.json" });
+    const layer = textFlag(inv, "layer") ?? "team";
+    const reason = textFlag(inv, "reason");
+    if (inv.dryRun) {
+      const offline = await offlineProject(inv.deps, "guard");
+      return planOutcome(inv.deps, dryRunPlan({ service: offline.serviceUrl, requests: [{ method: "PUT", path: guardPaths.rules(offline.binding.tenantId), body: { requestId: "<generated>", layer, ...layer === "project" ? { projectId: offline.binding.projectId } : {}, content: `<contents of ${file2}>`, ...reason === void 0 ? {} : { reason } }, note: "the file is validated and scanned for credentials on the server" }] }));
+    }
+    const content = readText3(inv, file2);
+    const { call: call2, tenantId, projectId } = await connected(inv);
+    return { data: await call2(GuardRuleFileRecord, "PUT", guardPaths.rules(tenantId), { requestId: requestId3(), layer, ...layer === "project" ? { projectId } : {}, content, ...reason === void 0 ? {} : { reason } }) };
+  }
+});
+async function evaluate(inv, dryRun) {
+  const { call: call2, tenantId, projectId } = await connected(inv);
+  const contentFile = textFlag(inv, "content-file");
+  const body2 = {
+    ...actionOf(inv),
+    ...textFlag(inv, "task") === void 0 ? {} : { taskHeld: textFlag(inv, "task") === "held" },
+    ...textFlag(inv, "summary") === void 0 ? {} : { summary: textFlag(inv, "summary") },
+    ...contentFile === void 0 ? {} : { content: readText3(inv, contentFile) },
+    ...dryRun ? { dryRun: true } : {}
+  };
+  const approval = textFlag(inv, "approval");
+  const reply = await call2(GuardEvaluateResponse, "POST", `${guardPaths.evaluate(tenantId)}?projectId=${encodeURIComponent(projectId)}`, body2, approval === void 0 ? void 0 : { [APPROVAL_HEADER]: approval });
+  return reply;
+}
+var DECISION_FLAGS = [
+  ...ACTION_FLAGS,
+  { name: "task", type: "string", enum: ["held", "none"], value: "held|none", description: "Whether the caller holds an active task (the task rule needs it)" },
+  { name: "summary", type: "string", value: "TEXT", description: "A plain-language summary shown to the approver if the action needs approval" },
+  { name: "content-file", type: "string", value: "PATH", description: "A file whose text the action would write; scanned for credentials" }
+];
+var guardCheckCommand = defineCommand({
+  path: ["guard", "check"],
+  summary: "Ask the server to decide an action now; exits 6 when it is refused",
+  description: "The hook point for the git layer and CI: sends the action to the guardrail engine and exits 0 when allowed, or 6 with the code, the rule ID and the exact next command. An action that needs approval opens one with your summary and prints its ID; run it again with --approval <id> after a person approves.",
+  flags: [...DECISION_FLAGS, { name: "approval", type: "string", value: "ID", description: "An approval that covers exactly this action" }],
+  examples: ["overlane guard check --tool git.push --branch main --task held", 'overlane guard check --tool deploy.run --environment production --summary "Deploy build 42" --dry-run'],
+  effect: "write",
+  ...common,
+  keywords: ["check action", "pre push check", "ci gate", "is this allowed", "approval required", "blocked by policy"],
+  result: withDryRun(GuardEvaluateResponse),
+  text: (d) => "decision" in d ? describeDecision(d.decision) : [],
+  handler: async (inv) => {
+    if (inv.dryRun) return planned(inv, "POST", guardPaths.evaluate, { ...actionOf(inv) }, "the decision is recorded; a rule that needs approval opens one");
+    const reply = await evaluate(inv, false);
+    return reply.decision.allowed ? { data: reply } : refusalOutcome(reply, reply.decision);
+  }
+});
+var guardDryRunCommand = defineCommand({
+  path: ["guard", "dry-run"],
+  summary: "Report what the guardrails would decide for an action, without blocking or recording",
+  description: "Asks the server for the combined decision (platform, team and project rules) and prints it without recording an audit entry or opening an approval. A rule in dry-run mode shows as would-block. An agent or a person sees exactly what a rule change would do before it is enforced.",
+  flags: DECISION_FLAGS,
+  examples: ["overlane guard dry-run --tool git.push --branch main --task held", "overlane guard dry-run --tool egress.fetch --host registry.example.com --json"],
+  effect: "read",
+  ...common,
+  keywords: ["dry run rules", "what would block", "test policy", "simulate", "would be refused"],
+  result: GuardEvaluateResponse,
+  text: (d) => describeDecision(d.decision),
+  handler: async (inv) => ({ data: await evaluate(inv, true) })
+});
+var guardScanCommand = defineCommand({
+  path: ["guard", "scan"],
+  summary: "Scan a file for credentials the way a push would be scanned",
+  description: "Sends the text of a file to the secret scanner and reports the rule and line of each finding, never the matched text. Provider-prefixed keys block; generic high-entropy strings are reported only. Exits 6 when something would block.",
+  flags: [
+    { name: "path", type: "string", required: true, value: "PATH", description: "The file to scan" },
+    { name: "source", type: "string", enum: SECRET_SOURCES, default: "push", description: "What the text would be: a push, task record, evidence, log or memory" }
+  ],
+  examples: ["overlane guard scan --path src/config.ts", "overlane guard scan --path ci.log --source log --json"],
+  effect: "read",
+  ...common,
+  keywords: ["secret scan", "find credentials", "leaked key", "push protection", "scan file"],
+  result: SecretScanResult,
+  text: (d) => d.findings.length === 0 ? ["No credentials found."] : d.findings.map((finding) => `${finding.disposition.padEnd(8)} ${finding.rule}${finding.path === void 0 ? "" : ` ${finding.path}`}${finding.line === void 0 ? "" : `:${finding.line}`}`),
+  handler: async (inv) => {
+    const path = textFlag(inv, "path");
+    if (path === void 0) throw new UsageError("scan needs --path", { hint: "overlane guard scan --path src/config.ts" });
+    const { call: call2, tenantId } = await connected(inv);
+    const result = await call2(SecretScanResult, "POST", guardPaths.scan(tenantId), { source: textFlag(inv, "source") ?? "push", content: readText3(inv, path), path });
+    return result.blocked ? { data: result, exit: EXIT.blocked, error: new CliError("a credential was found; nothing should be pushed until it is removed and rotated", { code: "secret_detected", exit: EXIT.blocked, hint: "overlane guard scan --path <file>" }) } : { data: result };
+  }
+});
+var ApprovalList2 = external_exports.object({ tenantId: external_exports.string(), approvals: external_exports.array(GuardApproval) }).strict();
+var guardApprovalsListCommand = defineCommand({
+  path: ["guard", "approvals", "list"],
+  summary: "List approvals waiting for an answer, with the summary and diff of each",
+  description: "Lists approvals the guardrails opened for actions that need a person. Each shows who asked, the rule, a plain-language summary and the change it would make. Nothing runs until an approval is approved.",
+  flags: [{ name: "status", type: "string", enum: ["pending", "approved", "denied"], description: "Only approvals with this status" }],
+  examples: ["overlane guard approvals list", "overlane guard approvals list --status pending --json"],
+  effect: "read",
+  ...common,
+  keywords: ["pending approvals", "approve before write", "who needs to approve", "approval queue"],
+  result: ApprovalList2,
+  text: (d) => d.approvals.length === 0 ? ["No approvals."] : d.approvals.flatMap((a) => [`${a.status.padEnd(9)} ${a.id}  ${a.tool}  by ${a.requestedBy}  (rule ${a.ruleId})`, `  ${a.summary}`]),
+  handler: async (inv) => {
+    const { call: call2, tenantId } = await connected(inv);
+    const status = textFlag(inv, "status");
+    return { data: await call2(ApprovalList2, "GET", `${guardPaths.approvals(tenantId)}${status === void 0 ? "" : `?status=${status}`}`) };
+  }
+});
+var guardApprovalsAnswerCommand = defineCommand({
+  path: ["guard", "approvals", "answer"],
+  summary: "Approve or deny an action waiting for approval, as an independent agent or a person",
+  description: "Answers one approval. An independent second agent satisfies an approval (a different principal from the one that asked, listing the evidence it checked); a person always can. Under manual autonomy only a person can. An approval covers exactly the action it describes; a changed action needs a new approval. An answered approval does not change.",
+  args: [{ name: "approval-id", required: true, description: "The approval to answer" }],
+  flags: [
+    { name: "decision", type: "string", required: true, enum: ["approve", "deny"], description: "approve lets the action run; deny keeps it refused" },
+    { name: "reason", type: "string", value: "TEXT", description: "Why; kept in the approval record" },
+    { name: "evidence", type: "string", multiple: true, value: "TEXT", description: "What you checked; repeat for more (required for an agent approver)" }
+  ],
+  examples: ["overlane guard approvals answer apr_1 --decision approve", 'overlane guard approvals answer apr_1 --decision approve --evidence "diff reviewed" --reason "matches the task" --dry-run'],
+  effect: "write",
+  ...common,
+  keywords: ["approve action", "deny action", "answer approval", "allow push", "sign off"],
+  result: withDryRun(GuardApproval),
+  text: (d) => "status" in d ? [`${d.id} is ${d.status}.`] : [],
+  handler: async (inv) => {
+    const approvalId = inv.positionals[0];
+    if (approvalId === void 0) throw new UsageError("answer needs an approval ID", { hint: "overlane guard approvals list --status pending" });
+    const reason = textFlag(inv, "reason");
+    const evidence = listFlag(inv, "evidence");
+    const parsed = AnswerGuardApprovalRequest.safeParse({ decision: textFlag(inv, "decision"), ...reason === void 0 ? {} : { reason }, ...evidence.length === 0 ? {} : { evidence } });
+    if (!parsed.success) throw new UsageError("--decision must be approve or deny", { hint: `overlane guard approvals answer ${approvalId} --decision approve` });
+    if (inv.dryRun) return planned(inv, "POST", (tenantId2) => guardPaths.answer(tenantId2, approvalId), parsed.data);
+    const { call: call2, tenantId } = await connected(inv);
+    return { data: await call2(GuardApproval, "POST", guardPaths.answer(tenantId, approvalId), parsed.data) };
+  }
+});
+var guardCommands = [guardRulesListCommand, guardRulesTestCommand, guardRulesPutCommand, guardCheckCommand, guardDryRunCommand, guardScanCommand, guardApprovalsListCommand, guardApprovalsAnswerCommand];
+
+// ../cli/src/commands/memory.ts
+init_src();
+init_zod();
+import { randomUUID as randomUUID4 } from "node:crypto";
 var SERVICE_FLAG2 = { name: "service", type: "string", value: "URL", description: "The service address (default: HARNESS_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG2 = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
-var common = { needsAuth: true, needsNetwork: true };
+var common2 = { needsAuth: true, needsNetwork: true };
 async function authed2(inv) {
   const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
   const token = await requireToken(inv.deps, target.storeKey);
@@ -58270,16 +59139,16 @@ async function tenantOf2(call2, inv) {
   return textFlag(inv, "team") ?? (await call2(WhoAmI, "GET", apiPaths.whoami)).tenantId;
 }
 function idArg(inv, what) {
-  const id = inv.positionals[0];
-  if (id === void 0) throw new UsageError(`${what} needs a memory ID`, { hint: "overlane memory search <query>" });
-  return id;
+  const id2 = inv.positionals[0];
+  if (id2 === void 0) throw new UsageError(`${what} needs a memory ID`, { hint: "overlane memory search <query>" });
+  return id2;
 }
 async function plan(inv, method, path, body2, note) {
   const target = await resolveTarget(inv.deps, textFlag(inv, "service"));
   const tenant = textFlag(inv, "team") ?? ":your-team";
   return planOutcome(inv.deps, dryRunPlan({ service: target.service, requests: [{ method, path: path(tenant), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
 }
-var requestId3 = () => `cli-${randomUUID3()}`;
+var requestId4 = () => `cli-${randomUUID4()}`;
 var memorySearchCommand = defineCommand({
   path: ["memory", "search"],
   summary: "Search memory across project, team, user and global scopes",
@@ -58294,7 +59163,7 @@ var memorySearchCommand = defineCommand({
   ],
   examples: ['overlane memory search "how do we deploy"', 'overlane memory search "indentation" --scope team --json'],
   effect: "read",
-  ...common,
+  ...common2,
   keywords: ["recall", "remember", "what do we know", "find memory", "lookup", "notes", "conventions", "decisions"],
   result: MemorySearchResponse,
   text: (d) => d.items.length === 0 ? ["No memories match."] : d.items.map((i2) => `${i2.scope.padEnd(7)} ${i2.status.padEnd(9)} ${i2.id}  ${i2.title}${i2.stale ? "  [stale]" : ""}${i2.overriddenBy === null ? "" : `  [overridden by ${i2.overriddenBy}]`}`),
@@ -58328,7 +59197,7 @@ var memoryAddCommand = defineCommand({
   ],
   examples: ['overlane memory add --title "Deploy day" "Deploys go out on Tuesdays" --project prj_1', 'overlane memory add --title "Editor" --scope user "I prefer a dark theme" --dry-run'],
   effect: "write",
-  ...common,
+  ...common2,
   keywords: ["remember this", "save a note", "record a decision", "store convention", "candidate"],
   result: AddResult,
   handler: async (inv) => {
@@ -58336,7 +59205,7 @@ var memoryAddCommand = defineCommand({
     if (title === void 0) throw new UsageError("add needs --title", { hint: 'overlane memory add --title "..." "<text>"' });
     const project = textFlag(inv, "project");
     const parsed = MemoryCandidate.safeParse({
-      requestId: requestId3(),
+      requestId: requestId4(),
       scope: textFlag(inv, "scope") ?? "project",
       ...project === void 0 ? {} : { projectId: project },
       category: textFlag(inv, "category") ?? "fact",
@@ -58367,18 +59236,18 @@ var memoryConfirmCommand = defineCommand({
   ],
   examples: ["overlane memory confirm mem_ab12", "overlane memory confirm mem_ab12 --basis ci_evidence --evidence 0123abc:unit_tests --dry-run"],
   effect: "write",
-  ...common,
+  ...common2,
   keywords: ["approve memory", "verify", "promote candidate", "second observer", "ci evidence"],
   result: ConfirmResult,
   handler: async (inv) => {
-    const id = idArg(inv, "confirm");
+    const id2 = idArg(inv, "confirm");
     const evidence = textFlag(inv, "evidence");
     const parsed = MemoryConfirmRequest.safeParse({ basis: textFlag(inv, "basis") ?? "human", ...evidence === void 0 ? {} : { evidenceRef: evidence } });
     if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
-    if (inv.dryRun) return plan(inv, "POST", (tenant) => memoryPaths.confirm(tenant, id), parsed.data);
+    if (inv.dryRun) return plan(inv, "POST", (tenant) => memoryPaths.confirm(tenant, id2), parsed.data);
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
-    const item = await call2(MemoryItem, "POST", memoryPaths.confirm(tenantId, id), parsed.data);
+    const item = await call2(MemoryItem, "POST", memoryPaths.confirm(tenantId, id2), parsed.data);
     say(inv.deps, `${item.id} is ${item.status}.`);
     return { data: item };
   }
@@ -58391,17 +59260,17 @@ var memoryPromoteCommand = defineCommand({
   flags: [SERVICE_FLAG2, TEAM_FLAG2, { name: "to", type: "string", enum: ["team", "global"], default: "team", description: "Where to promote it" }],
   examples: ["overlane memory promote mem_ab12 --to team", "overlane memory promote mem_cd34 --to global --dry-run"],
   effect: "write",
-  ...common,
+  ...common2,
   keywords: ["share with team", "contribute", "global memory", "make team wide"],
   result: withDryRun(MemoryPromoteResponse),
   handler: async (inv) => {
-    const id = idArg(inv, "promote");
+    const id2 = idArg(inv, "promote");
     const parsed = MemoryPromoteRequest.safeParse({ to: textFlag(inv, "to") ?? "team" });
     if (!parsed.success) throw new UsageError("--to must be team or global");
-    if (inv.dryRun) return plan(inv, "POST", (tenant) => memoryPaths.promote(tenant, id), parsed.data);
+    if (inv.dryRun) return plan(inv, "POST", (tenant) => memoryPaths.promote(tenant, id2), parsed.data);
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
-    const out2 = await call2(MemoryPromoteResponse, "POST", memoryPaths.promote(tenantId, id), parsed.data);
+    const out2 = await call2(MemoryPromoteResponse, "POST", memoryPaths.promote(tenantId, id2), parsed.data);
     say(inv.deps, out2.contribution === null ? `Promoted to team as ${out2.item?.id ?? "?"}.` : `Contribution ${out2.contribution.id} is ${out2.contribution.status} (${out2.contribution.tenantsSeen} of ${out2.contribution.k} teams).`);
     return { data: out2 };
   }
@@ -58419,7 +59288,7 @@ var memoryExportCommand = defineCommand({
   ],
   examples: ["overlane memory export --json", "overlane memory export --scope user --user usr_1 --json"],
   effect: "read",
-  ...common,
+  ...common2,
   keywords: ["download memory", "backup", "data portability", "gdpr", "subject access"],
   result: MemoryExportRecord,
   text: (d) => [`${d.items.length} memories exported at ${d.exportedAt}. Use --json for the full content.`],
@@ -58443,15 +59312,15 @@ var memoryDeleteCommand = defineCommand({
   flags: [SERVICE_FLAG2, TEAM_FLAG2],
   examples: ["overlane memory delete mem_ab12 --force", "overlane memory delete mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common,
+  ...common2,
   keywords: ["remove memory", "forget", "erase", "wrong memory", "gdpr deletion"],
   result: withDryRun(MemoryDeleteResponse),
   handler: async (inv) => {
-    const id = idArg(inv, "delete");
-    if (inv.dryRun) return plan(inv, "DELETE", (tenant) => memoryPaths.one(tenant, id));
+    const id2 = idArg(inv, "delete");
+    if (inv.dryRun) return plan(inv, "DELETE", (tenant) => memoryPaths.one(tenant, id2));
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
-    const out2 = await call2(MemoryDeleteResponse, "DELETE", memoryPaths.one(tenantId, id));
+    const out2 = await call2(MemoryDeleteResponse, "DELETE", memoryPaths.one(tenantId, id2));
     say(inv.deps, `Deleted ${out2.removedIds.length} memory (${out2.vectorsRemoved} vectors, ${out2.derivedRemoved} derived records).`);
     return { data: out2 };
   }
@@ -58464,15 +59333,15 @@ var memoryUnlearnCommand = defineCommand({
   flags: [SERVICE_FLAG2, TEAM_FLAG2],
   examples: ["overlane memory unlearn mem_ab12 --force", "overlane memory unlearn mem_ab12 --dry-run"],
   effect: "destructive",
-  ...common,
+  ...common2,
   keywords: ["unlearn", "forget everything derived", "retract", "poisoned memory", "bad memory"],
   result: withDryRun(MemoryUnlearnRecord),
   handler: async (inv) => {
-    const id = idArg(inv, "unlearn");
-    if (inv.dryRun) return plan(inv, "POST", (tenant) => memoryPaths.unlearn(tenant, id), {});
+    const id2 = idArg(inv, "unlearn");
+    if (inv.dryRun) return plan(inv, "POST", (tenant) => memoryPaths.unlearn(tenant, id2), {});
     const { call: call2 } = await authed2(inv);
     const tenantId = await tenantOf2(call2, inv);
-    const out2 = await call2(MemoryUnlearnRecord, "POST", memoryPaths.unlearn(tenantId, id), {});
+    const out2 = await call2(MemoryUnlearnRecord, "POST", memoryPaths.unlearn(tenantId, id2), {});
     say(inv.deps, `Unlearned ${out2.removedIds.length} memories (record ${out2.id}).`);
     return { data: out2 };
   }
@@ -58484,7 +59353,7 @@ var memoryStatusCommand = defineCommand({
   flags: [SERVICE_FLAG2, TEAM_FLAG2],
   examples: ["overlane memory status", "overlane memory status --json"],
   effect: "read",
-  ...common,
+  ...common2,
   keywords: ["memory health", "stale memory", "how many memories", "contribution", "opt in"],
   result: MemoryStatusResponse,
   text: (d) => [...Object.entries(d.counts).map(([key, n]) => `${key}: ${n}`), `stale: ${d.stale}`, `global contribution: ${d.settings.globalContribution ? "on" : "off"}`, `pending jobs: ${d.pendingJobs}`],
@@ -58502,7 +59371,7 @@ var memoryContributionCommand = defineCommand({
   flags: [SERVICE_FLAG2, TEAM_FLAG2],
   examples: ["overlane memory contribution on", "overlane memory contribution off --dry-run"],
   effect: "write",
-  ...common,
+  ...common2,
   keywords: ["opt in", "opt out", "share patterns", "global pool", "contribute"],
   result: withDryRun(MemorySettings),
   handler: async (inv) => {
@@ -58522,10 +59391,10 @@ var memoryCommands = [memorySearchCommand, memoryAddCommand, memoryConfirmComman
 // ../cli/src/commands/issue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { readFileSync as readFileSync7 } from "node:fs";
-var common2 = { needsAuth: true, needsNetwork: true };
-var requestId4 = () => `cli-${randomUUID4()}`;
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { readFileSync as readFileSync8 } from "node:fs";
+var common3 = { needsAuth: true, needsNetwork: true };
+var requestId5 = () => `cli-${randomUUID5()}`;
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var STATUSES = ["backlog", "todo", "in_progress", "in_review", "cancelled"];
 async function send(deps, label, schema, method, path, body2, dryRun) {
@@ -58562,7 +59431,7 @@ var issueListCommand = defineCommand({
   flags: [{ name: "status", type: "string", enum: ["backlog", "todo", "in_progress", "in_review", "done", "cancelled"], description: "Only issues in this status" }],
   examples: ["overlane issue list", "overlane issue list --status todo --json"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["issues", "backlog", "tickets", "work items", "what is open", "list issues"],
   result: external_exports.object({ issues: external_exports.array(IssueShown) }),
   handler: async (inv) => {
@@ -58583,14 +59452,14 @@ var issueShowCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID, for example iss_ab12cd34ef56gh78" }],
   examples: ["overlane issue show iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["issue details", "ticket", "view issue", "who is working on"],
   result: IssueShown,
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("show needs an ISSUE_ID");
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("show needs an ISSUE_ID");
     const project = await connectedProject(inv.deps, "issue");
-    const issue2 = shown(inv.deps, await serviceCall(inv.deps, project.serviceUrl, project.token)(Issue, "GET", issuePaths.issue(project.binding.tenantId, project.binding.projectId, id)));
+    const issue2 = shown(inv.deps, await serviceCall(inv.deps, project.serviceUrl, project.token)(Issue, "GET", issuePaths.issue(project.binding.tenantId, project.binding.projectId, id2)));
     if (isAgent(inv.deps)) say(inv.deps, UNTRUSTED_NOTICE);
     say(inv.deps, line(issue2));
     const active = issue2.links.tasks.find((link) => link.state === "active");
@@ -58606,14 +59475,14 @@ var issueEventsCommand = defineCommand({
   args: [{ name: "issue-id", required: true, description: "The issue ID" }],
   examples: ["overlane issue events iss_ab12cd34ef56gh78"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["audit", "history", "who changed", "field changes", "issue log"],
   result: IssueEventList,
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("events needs an ISSUE_ID");
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("events needs an ISSUE_ID");
     const project = await connectedProject(inv.deps, "issue");
-    const events = await serviceCall(inv.deps, project.serviceUrl, project.token)(IssueEventList, "GET", issuePaths.events(project.binding.tenantId, project.binding.projectId, id));
+    const events = await serviceCall(inv.deps, project.serviceUrl, project.token)(IssueEventList, "GET", issuePaths.events(project.binding.tenantId, project.binding.projectId, id2));
     for (const event of events.events) say(inv.deps, `${event.sequence}  ${event.at}  ${event.field}  by ${event.actor.type}:${event.actor.id}`);
     return { data: events };
   }
@@ -58631,12 +59500,12 @@ var issueNewCommand = defineCommand({
   ],
   examples: ['overlane issue new "Back-time drifts by a second"', 'overlane issue new "Fix export" --priority P0 --description "Fails on empty notes"'],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["create issue", "new issue", "file a ticket", "add work item", "report bug"],
   result: withDryRun(Issue),
   handler: async (inv) => {
     const estimate = textFlag(inv, "estimate");
-    const body2 = { requestId: requestId4(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
+    const body2 = { requestId: requestId5(), title: inv.positionals.join(" "), description: textFlag(inv, "description") ?? "", priority: priorityFlag(inv) ?? "P1", status: textFlag(inv, "status") ?? "backlog", ...estimate === void 0 ? {} : { estimate: Number(estimate) } };
     const result = await send(inv.deps, "issue", Issue, "POST", issuePaths.issues, body2, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Created #${result.value.number} ${result.value.issueId}`);
     return result;
@@ -58656,15 +59525,15 @@ var issueUpdateCommand = defineCommand({
   ],
   examples: ["overlane issue update iss_ab12cd34ef56gh78 --priority P0", 'overlane issue update iss_ab12cd34ef56gh78 --status in_progress --title "New title"'],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["edit issue", "change status", "change priority", "rename issue", "update ticket"],
   result: withDryRun(Issue),
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("update needs an ISSUE_ID");
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("update needs an ISSUE_ID");
     const estimate = textFlag(inv, "estimate");
     const body2 = {
-      requestId: requestId4(),
+      requestId: requestId5(),
       ...textFlag(inv, "title") === void 0 ? {} : { title: textFlag(inv, "title") },
       ...textFlag(inv, "description") === void 0 ? {} : { description: textFlag(inv, "description") },
       ...textFlag(inv, "status") === void 0 ? {} : { status: textFlag(inv, "status") },
@@ -58672,7 +59541,7 @@ var issueUpdateCommand = defineCommand({
       ...estimate === void 0 ? {} : { estimate: Number(estimate) }
     };
     if (Object.keys(body2).length === 1) throw new UsageError("update needs at least one of --title, --description, --status, --priority, --estimate");
-    return send(inv.deps, "issue", Issue, "PATCH", (t, p) => issuePaths.issue(t, p, id), body2, inv.dryRun);
+    return send(inv.deps, "issue", Issue, "PATCH", (t, p) => issuePaths.issue(t, p, id2), body2, inv.dryRun);
   }
 });
 var issueAssignCommand = defineCommand({
@@ -58685,14 +59554,14 @@ var issueAssignCommand = defineCommand({
   ],
   examples: ["overlane issue assign iss_ab12cd34ef56gh78 agent:claude-code", "overlane issue assign iss_ab12cd34ef56gh78 none"],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["assign", "give to agent", "hand to bot", "delegate", "who works on this", "unassign"],
   result: withDryRun(AssignResult),
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("assign needs an ISSUE_ID and an assignee");
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("assign needs an ISSUE_ID and an assignee");
     const assignee = parseAssignee(inv.positionals[1]);
-    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id), { requestId: requestId4(), assignee }, inv.dryRun);
+    const result = await send(inv.deps, "issue", AssignResult, "POST", (t, p) => issuePaths.assign(t, p, id2), { requestId: requestId5(), assignee }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, result.value.taskId === null ? "Assigned." : `Assigned. Task: ${result.value.taskId}${result.value.createdTask ? " (new)" : ""}`);
     return result;
   }
@@ -58708,7 +59577,7 @@ var issueImportCommand = defineCommand({
   flags: [{ name: "preview", type: "boolean", description: "Report what the import would create or update, and write nothing" }],
   examples: ["overlane issue import linear ./linear-export.json --preview", "overlane issue import jira ./jira-search.json"],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["import", "migrate from linear", "migrate from jira", "github projects import", "bring issues in"],
   result: withDryRun(ImportReport),
   handler: async (inv) => {
@@ -58717,11 +59586,11 @@ var issueImportCommand = defineCommand({
     if (file2 === void 0) throw new UsageError("import needs the path of the export file");
     let data;
     try {
-      data = JSON.parse(readFileSync7(file2, "utf8"));
+      data = JSON.parse(readFileSync8(file2, "utf8"));
     } catch {
       throw new UsageError(`${file2} is not a readable JSON file`);
     }
-    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId4(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
+    const result = await send(inv.deps, "issue", ImportReport, "POST", issuePaths.import, { requestId: requestId5(), source, dryRun: boolFlag(inv, "preview"), data }, inv.dryRun);
     if (result.value !== void 0) {
       const r = result.value;
       say(inv.deps, `${r.dryRun ? "Would import" : "Imported"} from ${r.source}: ${r.created} new, ${r.updated} updated, ${r.unchanged} unchanged, ${r.skipped.length} skipped.`);
@@ -58735,7 +59604,7 @@ var issueSyncCommand = defineCommand({
   description: "Shows the repository and mode: off (default), read_only (GitHub changes flow in, nothing is written to GitHub) or write_back (an owner or admin opted in).",
   examples: ["overlane issue sync"],
   effect: "read",
-  ...common2,
+  ...common3,
   keywords: ["github sync", "sync status", "two-way sync", "write back"],
   result: SyncConfig,
   handler: async (inv) => {
@@ -58755,13 +59624,13 @@ var issueSyncSetCommand = defineCommand({
   ],
   examples: ["overlane issue sync set acme/app read_only", "overlane issue sync set acme/app off"],
   effect: "write",
-  ...common2,
+  ...common3,
   keywords: ["enable github sync", "write back", "turn off sync", "read only sync"],
   result: withDryRun(SyncConfig),
   handler: async (inv) => {
     const [repository, mode] = inv.positionals;
     if (repository === void 0 || mode === void 0) throw new UsageError("sync set needs REPOSITORY and MODE");
-    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId4(), repository, mode }, inv.dryRun);
+    return send(inv.deps, "issue", SyncConfig, "PUT", issuePaths.sync, { requestId: requestId5(), repository, mode }, inv.dryRun);
   }
 });
 var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, issueNewCommand, issueUpdateCommand, issueAssignCommand, issueImportCommand, issueSyncCommand, issueSyncSetCommand];
@@ -58769,7 +59638,7 @@ var issueCommands = [issueListCommand, issueShowCommand, issueEventsCommand, iss
 // ../cli/src/commands/issue-views.ts
 init_src();
 init_zod();
-var common3 = { needsAuth: true, needsNetwork: true };
+var common4 = { needsAuth: true, needsNetwork: true };
 var Deleted = external_exports.object({ deleted: external_exports.literal(true) });
 var FIELDS = ["status", "priority", "assigneeType", "assignee", "labelId", "workProjectId", "cycleId", "estimate", "source", "title", "number", "createdAt", "updatedAt"];
 function parseCondition(text) {
@@ -58785,7 +59654,7 @@ var viewListCommand = defineCommand({
   description: "Lists saved views: a filter plus a group-by and sort over any issue field.",
   examples: ["overlane view list"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["saved views", "filters", "board", "group by"],
   result: ViewList,
   handler: async (inv) => {
@@ -58803,14 +59672,14 @@ var viewRunCommand = defineCommand({
   args: [{ name: "view-id", required: true, description: "The saved view ID" }],
   examples: ["overlane view run viw_ab12cd34ef56gh78"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["run view", "show board", "group issues"],
   result: ViewResult,
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("run needs a VIEW_ID");
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("run needs a VIEW_ID");
     const project = await connectedProject(inv.deps, "view");
-    const result = await serviceCall(inv.deps, project.serviceUrl, project.token)(ViewResult, "GET", issuePaths.viewRun(project.binding.tenantId, project.binding.projectId, id));
+    const result = await serviceCall(inv.deps, project.serviceUrl, project.token)(ViewResult, "GET", issuePaths.viewRun(project.binding.tenantId, project.binding.projectId, id2));
     for (const group of result.groups) {
       say(inv.deps, `${group.key} (${group.issues.length})`);
       for (const issue2 of group.issues) say(inv.deps, `  #${issue2.number}  ${issue2.status}  ${issue2.priority}`);
@@ -58831,12 +59700,12 @@ var viewNewCommand = defineCommand({
   ],
   examples: ["overlane view new Urgent --filter priority=P0 --group-by status", 'overlane view new "Agent work" --filter assigneeType=agent --group-by status'],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["create view", "save filter", "board", "group by status"],
   result: withDryRun(SavedView),
   handler: async (inv) => {
     const definition = { filter: listFlag(inv, "filter").map(parseCondition), groupBy: textFlag(inv, "group-by") ?? null, sortBy: textFlag(inv, "sort-by") ?? "number", sortDirection: boolFlag(inv, "desc") ? "desc" : "asc" };
-    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId4(), name: inv.positionals.join(" "), definition }, inv.dryRun);
+    return send(inv.deps, "view", SavedView, "POST", issuePaths.views, { requestId: requestId5(), name: inv.positionals.join(" "), definition }, inv.dryRun);
   }
 });
 var viewDeleteCommand = defineCommand({
@@ -58846,13 +59715,13 @@ var viewDeleteCommand = defineCommand({
   args: [{ name: "view-id", required: false, description: "The saved view ID (required; checked after the --force confirmation)" }],
   examples: ["overlane view delete viw_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common3,
+  ...common4,
   keywords: ["remove view", "delete filter"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("delete needs a VIEW_ID");
-    return send(inv.deps, "view", Deleted, "DELETE", (t, p) => `${issuePaths.views(t, p)}/${encodeURIComponent(id)}`, void 0, inv.dryRun);
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("delete needs a VIEW_ID");
+    return send(inv.deps, "view", Deleted, "DELETE", (t, p) => `${issuePaths.views(t, p)}/${encodeURIComponent(id2)}`, void 0, inv.dryRun);
   }
 });
 var loopListCommand = defineCommand({
@@ -58861,7 +59730,7 @@ var loopListCommand = defineCommand({
   description: "Lists loops: a trigger (schedule or event), a filter over issues and the executor they dispatch.",
   examples: ["overlane loop list"],
   effect: "read",
-  ...common3,
+  ...common4,
   keywords: ["loops", "scheduled work", "recurring", "automation"],
   result: LoopList,
   handler: async (inv) => {
@@ -58885,7 +59754,7 @@ var loopNewCommand = defineCommand({
   ],
   examples: ["overlane loop new Nightly --every 1440 --filter priority=P0", "overlane loop new OnAssign --on issue.assigned"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["schedule agent", "recurring work", "event trigger", "automation", "nightly"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
@@ -58893,7 +59762,7 @@ var loopNewCommand = defineCommand({
     const on = textFlag(inv, "on");
     if (every === void 0 === (on === void 0)) throw new UsageError("pass exactly one of --every MINUTES or --on EVENT");
     const trigger = every !== void 0 ? { kind: "schedule", everyMinutes: Number(every) } : { kind: "event", on };
-    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId4(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
+    return send(inv.deps, "loop", LoopDefinition, "POST", issuePaths.loops, { requestId: requestId5(), name: inv.positionals.join(" "), trigger, filter: listFlag(inv, "filter").map(parseCondition), executor: textFlag(inv, "executor") ?? "claude-code" }, inv.dryRun);
   }
 });
 var loopSetCommand = defineCommand({
@@ -58906,13 +59775,13 @@ var loopSetCommand = defineCommand({
   ],
   examples: ["overlane loop set lop_ab12cd34ef56gh78 off"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["disable loop", "enable loop", "stop schedule"],
   result: withDryRun(LoopDefinition),
   handler: async (inv) => {
-    const [id, state] = inv.positionals;
-    if (id === void 0 || state !== "on" && state !== "off") throw new UsageError("set needs a LOOP_ID and on or off");
-    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id), { requestId: requestId4(), enabled: state === "on" }, inv.dryRun);
+    const [id2, state] = inv.positionals;
+    if (id2 === void 0 || state !== "on" && state !== "off") throw new UsageError("set needs a LOOP_ID and on or off");
+    return send(inv.deps, "loop", LoopDefinition, "PATCH", (t, p) => issuePaths.loop(t, p, id2), { requestId: requestId5(), enabled: state === "on" }, inv.dryRun);
   }
 });
 var loopFireCommand = defineCommand({
@@ -58922,13 +59791,13 @@ var loopFireCommand = defineCommand({
   args: [{ name: "loop-id", required: true, description: "The loop ID" }],
   examples: ["overlane loop fire lop_ab12cd34ef56gh78"],
   effect: "write",
-  ...common3,
+  ...common4,
   keywords: ["run loop", "trigger loop", "dispatch agent"],
   result: withDryRun(LoopRun),
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("fire needs a LOOP_ID");
-    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id), { requestId: requestId4(), trigger: "schedule" }, inv.dryRun);
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("fire needs a LOOP_ID");
+    const result = await send(inv.deps, "loop", LoopRun, "POST", (t, p) => issuePaths.loopFire(t, p, id2), { requestId: requestId5(), trigger: "schedule" }, inv.dryRun);
     if (result.value !== void 0) say(inv.deps, `Loop run ${result.value.runId ?? "(none)"}: ${result.value.claimed.length} claimed, stopped: ${result.value.stopReason}.`);
     return result;
   }
@@ -58940,18 +59809,220 @@ var loopDeleteCommand = defineCommand({
   args: [{ name: "loop-id", required: false, description: "The loop ID (required; checked after the --force confirmation)" }],
   examples: ["overlane loop delete lop_ab12cd34ef56gh78 --force"],
   effect: "destructive",
-  ...common3,
+  ...common4,
   keywords: ["remove loop", "delete schedule"],
   result: withDryRun(Deleted),
   handler: async (inv) => {
-    const id = inv.positionals[0];
-    if (id === void 0) throw new UsageError("delete needs a LOOP_ID");
-    return send(inv.deps, "loop", Deleted, "DELETE", (t, p) => issuePaths.loop(t, p, id), void 0, inv.dryRun);
+    const id2 = inv.positionals[0];
+    if (id2 === void 0) throw new UsageError("delete needs a LOOP_ID");
+    return send(inv.deps, "loop", Deleted, "DELETE", (t, p) => issuePaths.loop(t, p, id2), void 0, inv.dryRun);
   }
 });
 var viewCommands = [viewListCommand, viewRunCommand, viewNewCommand, viewDeleteCommand];
 var loopCommands = [loopListCommand, loopNewCommand, loopSetCommand, loopFireCommand, loopDeleteCommand];
 
+// ../cli/src/commands/review.ts
+init_src();
+import { randomUUID as randomUUID6 } from "node:crypto";
+var common5 = { needsAuth: true, needsNetwork: true };
+var requestId6 = () => `cli-${randomUUID6()}`;
+async function connected2(inv) {
+  const project = await connectedProject(inv.deps, "review");
+  return { project, call: serviceCall(inv.deps, project.serviceUrl, project.token), tenantId: project.binding.tenantId, projectId: project.binding.projectId };
+}
+async function planned2(inv, method, path, body2, note) {
+  const project = await offlineProject(inv.deps, "review");
+  return planOutcome(inv.deps, dryRunPlan({ service: project.serviceUrl, requests: [{ method, path: path(project.binding.tenantId, project.binding.projectId), ...body2 === void 0 ? {} : { body: body2 }, ...note === void 0 ? {} : { note } }] }));
+}
+async function repositoryOf(inv) {
+  const flag = textFlag(inv, "repo");
+  if (flag !== void 0) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(flag)) throw new UsageError("--repo must be OWNER/NAME", { hint: "overlane review run 7 --repo acme/app" });
+    return flag;
+  }
+  const remote = await inv.deps.exec("git", ["remote", "get-url", "origin"], { cwd: inv.deps.paths.cwd });
+  const match = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\s*$/.exec(remote.stdout.trim());
+  if (remote.code !== 0 || match === null) throw new UsageError("could not read the repository from the origin remote", { hint: "overlane review run 7 --repo OWNER/NAME" });
+  return `${match[1]}/${match[2]}`;
+}
+function id(inv, what) {
+  const value = inv.positionals[0];
+  if (value === void 0) throw new UsageError(`${what} needs a finding ID`, { hint: "overlane review findings" });
+  return value;
+}
+var FINDING_LINE = (finding) => `${finding.status.padEnd(9)} ${finding.severity.padEnd(8)} ${finding.path}:${finding.line}  ${finding.rule ?? "see reason"}  ${finding.id}`;
+var reviewRunCommand = defineCommand({
+  path: ["review", "run"],
+  summary: "Review a GitHub pull request now and report the findings",
+  description: "Runs the review service on a pull request: triage, review passes under the per-PR token cap, inline findings and one updated summary. Until the project owner enables comments (`overlane review settings set --mode comments`) the run is log-only and posts nothing. Pull request text and code are data, never instructions. Needs the GitHub App's pull-request access; without it the command says the live leg is pending.",
+  args: [{ name: "pull", required: true, description: "The pull request number" }],
+  flags: [{ name: "repo", type: "string", value: "OWNER/NAME", description: "The repository (default: the origin remote of this working copy)" }],
+  examples: ["overlane review run 7", "overlane review run 7 --repo acme/app --dry-run"],
+  effect: "write",
+  ...common5,
+  keywords: ["code review", "review pull request", "review pr", "ai review", "check my pr", "findings"],
+  result: withDryRun(ReviewRunResponse),
+  text: (d) => "run" in d ? [`${d.run.status} review of ${d.run.repository}#${d.run.pullNumber} (${d.run.mode}${d.run.posted ? ", posted" : ", nothing posted"}): ${d.run.findings.open} open, ${d.run.findings.fixed} fixed, ${d.run.findings.dismissed} dismissed.`, ...d.findings.filter((finding) => finding.status === "open").map(FINDING_LINE)] : [],
+  handler: async (inv) => {
+    const number4 = Number(inv.positionals[0]);
+    if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number", { hint: "overlane review run 7" });
+    const repository = await repositoryOf(inv);
+    const body2 = { requestId: requestId6(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
+    if (inv.dryRun) return planned2(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub App and runs the review");
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const result = await call2(ReviewRunResponse, "POST", reviewPaths.runs(tenantId, projectId), body2);
+    if (result.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
+    return { data: result };
+  }
+});
+var reviewStatusCommand = defineCommand({
+  path: ["review", "status"],
+  summary: "Show the review mode, recent runs and open findings",
+  description: "Shows whether review posts comments or is log-only, the token cap, the latest runs and the number of open findings. States the data-use terms: diffs go to model providers only under terms that exclude training.",
+  examples: ["overlane review status", "overlane review status --json"],
+  effect: "read",
+  ...common5,
+  keywords: ["review mode", "log only", "review settings", "recent reviews", "how is review doing"],
+  result: ReviewStatusResponse,
+  text: (d) => [`Review mode: ${d.settings.mode}. Token cap per pull request: ${d.settings.tokenCap}. Open findings: ${d.openFindings}.`, d.settings.privacy, ...d.runs.slice(0, 5).map((run3) => `${run3.startedAt}  ${run3.repository}#${run3.pullNumber}  ${run3.status}  ${run3.tokensUsed} tokens  ${run3.model}`)],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(ReviewStatusResponse, "GET", reviewPaths.status(tenantId, projectId)) };
+  }
+});
+var reviewFindingsCommand = defineCommand({
+  path: ["review", "findings"],
+  summary: "List review findings, optionally for one pull request or status",
+  description: "Lists findings tracked across pushes with their status (open, fixed, dismissed), severity, file and line, and the rule or reason.",
+  flags: [
+    { name: "pull", type: "string", value: "N", description: "Only this pull request number" },
+    { name: "repo", type: "string", value: "OWNER/NAME", description: "Only this repository" },
+    { name: "status", type: "string", enum: ["open", "fixed", "dismissed"], description: "Only findings with this status" }
+  ],
+  examples: ["overlane review findings --status open", "overlane review findings --pull 7 --json"],
+  effect: "read",
+  ...common5,
+  keywords: ["list findings", "open comments", "review comments", "what did review find", "defects"],
+  result: ReviewFindingsResponse,
+  text: (d) => d.findings.length === 0 ? ["No findings."] : d.findings.map(FINDING_LINE),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    const params = new URLSearchParams();
+    for (const name2 of ["pull", "repo", "status"]) {
+      const value = textFlag(inv, name2);
+      if (value !== void 0) params.set(name2 === "repo" ? "repository" : name2, value);
+    }
+    const query = params.size === 0 ? "" : `?${params.toString()}`;
+    return { data: await call2(ReviewFindingsResponse, "GET", `${reviewPaths.findings(tenantId, projectId)}${query}`) };
+  }
+});
+var reviewDismissCommand = defineCommand({
+  path: ["review", "dismiss"],
+  summary: "Dismiss a finding, which teaches the reviewer",
+  description: "Marks a finding dismissed so it is not raised again on this pull request. Repeated dismissals of the same rule become a learned rule held as team memory, and the reviewer stops reporting that rule until feedback changes. Use --accept to tell the reviewer a finding was right instead.",
+  args: [{ name: "finding-id", required: true, description: "The finding to dismiss" }],
+  flags: [
+    { name: "accept", type: "boolean", description: "Record that the finding was right instead of dismissing it" },
+    { name: "note", type: "string", value: "TEXT", description: "Why; kept with the feedback" }
+  ],
+  examples: ['overlane review dismiss fnd_1 --note "intended"', "overlane review dismiss fnd_2 --accept"],
+  effect: "write",
+  ...common5,
+  keywords: ["dismiss finding", "ignore comment", "false positive", "accept finding", "teach reviewer", "feedback"],
+  result: withDryRun(FeedbackResponse),
+  text: (d) => "finding" in d ? [`${d.finding.id} is ${d.finding.status}.${d.learned === null ? "" : ` Learned: ${d.learned.direction} ${d.learned.rule} (${d.learned.evidence} reviews).`}`] : [],
+  handler: async (inv) => {
+    const findingId = id(inv, "dismiss");
+    const note = textFlag(inv, "note");
+    const body2 = { kind: inv.values["accept"] === true ? "accept" : "dismiss", ...note === void 0 ? {} : { note }, requestId: requestId6() };
+    if (inv.dryRun) return planned2(inv, "POST", (tenantId2, projectId2) => reviewPaths.feedback(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(FeedbackResponse, "POST", reviewPaths.feedback(tenantId, projectId, findingId), body2) };
+  }
+});
+var reviewAutofixCommand = defineCommand({
+  path: ["review", "autofix"],
+  summary: "Create a fix task from a finding and optionally assign it",
+  description: "Turns an open finding into a task whose scope is the finding's file and whose criteria say the finding no longer applies. The task text treats the finding as data. Repeating the command returns the same task.",
+  args: [{ name: "finding-id", required: true, description: "The open finding to fix" }],
+  flags: [{ name: "assign", type: "string", value: "AGENT", description: "The agent or bot to assign, for example agent:fixer" }],
+  examples: ["overlane review autofix fnd_1", "overlane review autofix fnd_1 --assign agent:fixer --dry-run"],
+  effect: "write",
+  ...common5,
+  keywords: ["auto fix", "autofix", "fix finding", "create task from finding", "assign to agent"],
+  result: withDryRun(AutofixResponse),
+  text: (d) => "taskId" in d ? [`Task ${d.taskId} created${d.assignee === null ? "" : ` for ${d.assignee}`}. Start it with: overlane task start ${d.taskId}`] : [],
+  handler: async (inv) => {
+    const findingId = id(inv, "autofix");
+    const assignee = textFlag(inv, "assign");
+    const body2 = { requestId: requestId6(), ...assignee === void 0 ? {} : { assignee } };
+    if (inv.dryRun) return planned2(inv, "POST", (tenantId2, projectId2) => reviewPaths.autofix(tenantId2, projectId2, findingId), body2);
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(AutofixResponse, "POST", reviewPaths.autofix(tenantId, projectId, findingId), body2) };
+  }
+});
+var reviewSettingsCommand = defineCommand({
+  path: ["review", "settings"],
+  summary: "Show the review settings, including the data-use terms",
+  description: "Shows the mode (log-only until comments are enabled), the per-PR token cap, extra skip patterns and the statement that diffs go to model providers only under terms that exclude training.",
+  examples: ["overlane review settings"],
+  effect: "read",
+  ...common5,
+  keywords: ["review configuration", "token cap", "skip patterns", "privacy", "no training", "data use"],
+  result: ReviewSettings,
+  text: (d) => [`Mode: ${d.mode}. Token cap: ${d.tokenCap}. Extra skip patterns: ${d.skipPatterns.length === 0 ? "none" : d.skipPatterns.join(", ")}.`, d.privacy],
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(ReviewSettings, "GET", reviewPaths.settings(tenantId, projectId)) };
+  }
+});
+var reviewSettingsSetCommand = defineCommand({
+  path: ["review", "settings", "set"],
+  summary: "Change the review mode, token cap or skip patterns",
+  description: "Sets how review behaves for the project. Enabling comments (`--mode comments`) lets review post inline comments and the summary on GitHub; it is log-only until then. An agent or a person can change them; a read-only viewer cannot.",
+  flags: [
+    { name: "mode", type: "string", enum: ["log_only", "comments"], description: "log_only records findings only; comments posts them" },
+    { name: "token-cap", type: "string", value: "N", description: "Most tokens one pull request may use (1,000 to 2,000,000)" },
+    { name: "skip", type: "string", multiple: true, value: "GLOB", description: "A path pattern to skip in addition to generated and vendored paths; repeat for more" }
+  ],
+  examples: ["overlane review settings set --mode comments", "overlane review settings set --token-cap 40000 --skip 'docs/**' --dry-run"],
+  effect: "write",
+  ...common5,
+  keywords: ["enable review comments", "turn on review", "log only", "set token cap", "skip files"],
+  result: withDryRun(ReviewSettings),
+  text: (d) => "mode" in d ? [`Review is ${d.mode}. Token cap ${d.tokenCap}.`] : [],
+  handler: async (inv) => {
+    const cap = textFlag(inv, "token-cap");
+    const skip = inv.values["skip"];
+    const parsed = UpdateReviewSettingsRequest.safeParse({
+      ...textFlag(inv, "mode") === void 0 ? {} : { mode: textFlag(inv, "mode") },
+      ...cap === void 0 ? {} : { tokenCap: Number(cap) },
+      ...Array.isArray(skip) ? { skipPatterns: skip } : typeof skip === "string" ? { skipPatterns: [skip] } : {}
+    });
+    if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "), { hint: "overlane review settings set --mode comments" });
+    if (Object.keys(parsed.data).length === 0) throw new UsageError("nothing to change", { hint: "overlane review settings set --mode comments" });
+    if (inv.dryRun) return planned2(inv, "PUT", reviewPaths.settings, parsed.data);
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(ReviewSettings, "PUT", reviewPaths.settings(tenantId, projectId), parsed.data) };
+  }
+});
+var codeMapStatusCommand = defineCommand({
+  path: ["code-map", "status"],
+  summary: "Show, per client, whether the code map is on and why",
+  description: "Lists every supported client in its local and cloud setting, and the bots, review service, cross-repository questions and wiki, with whether the code map is on and the reason. The default for a setting follows the latest GATE-07 result for that setting: off for a local agent with grep (the local run failed, ADR 0018), on where there is no checkout until a re-run says otherwise.",
+  examples: ["overlane code-map status", "overlane code-map status --json"],
+  effect: "read",
+  ...common5,
+  keywords: ["code map", "code tools", "is the code map on", "gate-07", "code layer", "per client"],
+  result: CodeMapStatus,
+  text: (d) => d.clients.map((row) => `${row.on ? "on " : "off"}  ${row.subject}: ${row.reason}`),
+  handler: async (inv) => {
+    const { call: call2, tenantId, projectId } = await connected2(inv);
+    return { data: await call2(CodeMapStatus, "GET", codeMapPaths.status(tenantId, projectId)) };
+  }
+});
+var reviewCommands = [reviewRunCommand, reviewStatusCommand, reviewFindingsCommand, reviewDismissCommand, reviewAutofixCommand, reviewSettingsCommand, reviewSettingsSetCommand, codeMapStatusCommand];
+
 // ../cli/src/commands/discovery.ts
 init_zod();
 
@@ -59450,7 +60521,7 @@ async function disconnect(deps, options) {
 }
 
 // ../cli/src/doctor.ts
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 init_zod();
 var DoctorResult = external_exports.object({
   project: external_exports.object({ owner: external_exports.string(), name: external_exports.string(), root: external_exports.string() }),
@@ -59470,7 +60541,7 @@ async function doctor(deps, options) {
   const root = project.root;
   const binding = readBindingFile(root);
   const owned = readOwned(root);
-  const marketplaceRoot2 = resolve7(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
+  const marketplaceRoot2 = resolve8(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
   const infos = await detectAgents(deps, options.agents, root);
   let service = "reachable";
   let hasToken = false;
@@ -59530,7 +60601,7 @@ async function doctor(deps, options) {
 
 // ../cli/src/kit/setup.ts
 init_src();
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
 import { join as join22 } from "node:path";
 
@@ -59710,19 +60781,19 @@ async function connectKit(deps, options) {
   if (options.dryRun) {
     const inner = await connect(deps, { ...options, dryRun: true });
     say(deps, "Dry run: no file was written and no branch, commit or service change was made.");
-    const base3 = inner.data !== void 0 && "dryRun" in inner.data ? inner.data : dryRunPlan({});
+    const base4 = inner.data !== void 0 && "dryRun" in inner.data ? inner.data : dryRunPlan({});
     const writes = [
       ...planExists ? [] : [{ path: `${PLAN_DIR}/`, action: "write", description: planSource }],
       ...workflow === null ? [] : [{ path: CI_FILE, action: "write", description: "CI workflow with pinned actions" }],
       ...blockChanges.map((entry) => ({ path: entry.file, action: entry.before === null ? "write" : "append", description: "the run-step block" })),
-      ...base3.writes
+      ...base4.writes
     ];
     return {
       data: {
-        ...base3,
-        commands: [`git switch -c ${KIT_BRANCH}`, ...base3.commands, `git commit -m "Set up the project kit"`],
+        ...base4,
+        commands: [`git switch -c ${KIT_BRANCH}`, ...base4.commands, `git commit -m "Set up the project kit"`],
         writes,
-        notes: [...base3.notes, `Plan: ${planSource} (${summary.milestones} milestone(s), ${summary.tasks} task(s)); CI: ${ciSummary}; then the run policy is set, the plan synced and one pull request opened (or its commands printed).`]
+        notes: [...base4.notes, `Plan: ${planSource} (${summary.milestones} milestone(s), ${summary.tasks} task(s)); CI: ${ciSummary}; then the run policy is set, the plan synced and one pull request opened (or its commands printed).`]
       }
     };
   }
@@ -59746,11 +60817,11 @@ async function connectKit(deps, options) {
   const agentConfig = [join22(".claude", "settings.json"), join22(".codex", "config.toml")];
   const preDirty = new Set(await dirty(deps, root, agentConfig));
   const preExisting = new Set(agentConfig.filter((file2) => existsSync5(join22(root, file2))));
-  const connected = await connect(deps, { ...options, yes: true });
-  if (connected.error !== void 0 || readBindingFile(root).kind !== "ok") {
+  const connected3 = await connect(deps, { ...options, yes: true });
+  if (connected3.error !== void 0 || readBindingFile(root).kind !== "ok") {
     throw new CliError(`connect did not finish; the kit files are on ${KIT_BRANCH}, uncommitted. Fix the cause and run \`overlane connect\`, then commit`, { code: "connect_incomplete", hint: "overlane connect --yes" });
   }
-  const connectData = connected.data !== void 0 && !("dryRun" in connected.data) ? connected.data : void 0;
+  const connectData = connected3.data !== void 0 && !("dryRun" in connected3.data) ? connected3.data : void 0;
   for (const file2 of agentConfig) {
     if (!existsSync5(join22(root, file2)) || preDirty.has(file2) || preExisting.has(file2) && (await dirty(deps, root, [file2])).length === 0) continue;
     if ((await gitOut(deps, root, "check-ignore", "-q", "--", file2)).code === 0) continue;
@@ -59769,7 +60840,7 @@ async function connectKit(deps, options) {
   const kit = kitClient(deps, serviceUrl, binding.binding, token.token);
   await kit.putPolicy({ ...DEFAULT_RUN_POLICY, buildAheadLimit: firstMilestone });
   say(deps, `Run policy set (build-ahead limit ${firstMilestone}).`);
-  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID5()}`, sourceCommit: sha, plan: await readPlan(root) }));
+  const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID7()}`, sourceCommit: sha, plan: await readPlan(root) }));
   say(deps, `Plan synced: ${synced.created.length} created, ${synced.updated.length} updated, ${synced.unchanged.length} unchanged, ${synced.deferred.length} deferred.`);
   const pr = await openPullRequest(deps, root, repository.name);
   say(deps);
@@ -59834,7 +60905,7 @@ var connectCommand = defineCommand({
   keywords: ["setup", "install", "bind", "link", "onboard", "register plugin", "bootstrap", "autonomous", "plan", "kit", "get started", "initialise", "enable harness", "ci workflow", "pull request"],
   result: external_exports.union([ConnectAny, ConnectKitResult]),
   handler: async (inv) => {
-    const base3 = {
+    const base4 = {
       service: textFlag(inv, "service"),
       marketplaceRoot: textFlag(inv, "marketplace-root"),
       agents: parseAgentList(textFlag(inv, "agents")),
@@ -59845,10 +60916,10 @@ var connectCommand = defineCommand({
     const goal = textFlag(inv, "goal");
     if (kit === void 0) {
       if (goal !== void 0) throw new UsageError("--goal belongs to --kit new", { hint: "overlane schema connect" });
-      return connect(inv.deps, base3);
+      return connect(inv.deps, base4);
     }
     if (kit !== "existing" && kit !== "new") throw new UsageError("--kit must be existing or new");
-    return connectKit(inv.deps, { ...base3, mode: kit, goal });
+    return connectKit(inv.deps, { ...base4, mode: kit, goal });
   }
 });
 var doctorCommand = defineCommand({
@@ -59917,7 +60988,7 @@ async function listReleases(deps) {
     record3.manifest.changeKinds.length === 0 ? "-" : record3.manifest.changeKinds.join(","),
     record3.manifest.restart,
     compatSummary(record3),
-    record3.pinnedBy.length === 0 ? "-" : record3.pinnedBy.map((id) => id === ctx.binding.projectId ? `${id} (this)` : id).join(",")
+    record3.pinnedBy.length === 0 ? "-" : record3.pinnedBy.map((id2) => id2 === ctx.binding.projectId ? `${id2} (this)` : id2).join(",")
   ]);
   for (const line2 of table([header, ...rows])) say(deps, line2);
   return { data };
@@ -60053,7 +61124,7 @@ var ReleaseRollbackResult = external_exports.union([
 ]);
 
 // ../cli/src/commands/release.ts
-var common4 = { needsAuth: true, needsNetwork: true };
+var common6 = { needsAuth: true, needsNetwork: true };
 var APPROVE = { name: "approve", type: "string", value: "DIGEST", description: "Approve this exact release digest when it changes executable files or policy" };
 var releaseListCommand = defineCommand({
   path: ["release", "list"],
@@ -60061,7 +61132,7 @@ var releaseListCommand = defineCommand({
   description: "Lists releases with version, short digest, channel, change kinds, restart rule, compatibility and which projects pin them.",
   examples: ["overlane release list"],
   effect: "read",
-  ...common4,
+  ...common6,
   keywords: ["releases", "versions", "available", "published", "what versions", "all releases"],
   result: ReleaseListResult,
   handler: async (inv) => listReleases(inv.deps)
@@ -60072,7 +61143,7 @@ var releaseStatusCommand = defineCommand({
   description: `Compares the installed release (.harness/release.json) with the project binding and the service's pin, and lists approvals recorded on this machine. Works when the service is down (the pin then reads "unreachable").`,
   examples: ["overlane release status"],
   effect: "read",
-  ...common4,
+  ...common6,
   keywords: ["installed", "version", "in sync", "update available", "which release", "pinned", "am i up to date", "current release"],
   result: ReleaseStatusResult,
   handler: async (inv) => releaseStatus(inv.deps)
@@ -60084,7 +61155,7 @@ var releaseUpdateCommand = defineCommand({
   flags: [{ name: "to", type: "string", value: "DIGEST", description: "Install this release instead of the project's pin" }, APPROVE],
   examples: ["overlane release update --dry-run", "overlane release update", "overlane release update --approve sha256:..."],
   effect: "write",
-  ...common4,
+  ...common6,
   keywords: ["upgrade", "install release", "new version", "pull latest", "plugin update", "approve", "update plugin", "get newest"],
   result: ReleaseUpdateResult,
   handler: async (inv) => updateRelease(inv.deps, { to: textFlag(inv, "to"), approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -60096,7 +61167,7 @@ var releaseRollbackCommand = defineCommand({
   flags: [APPROVE],
   examples: ["overlane release rollback --dry-run", "overlane release rollback --force"],
   effect: "destructive",
-  ...common4,
+  ...common6,
   keywords: ["roll back", "revert", "undo update", "previous version", "downgrade", "go back", "restore", "undo release", "bad release"],
   result: ReleaseRollbackResult,
   handler: async (inv) => rollbackRelease(inv.deps, { approve: textFlag(inv, "approve"), dryRun: inv.dryRun })
@@ -60163,7 +61234,7 @@ var RunStatusResult = external_exports.object({
 var RunPolicyChangeResult = withDryRun(external_exports.object({ changed: external_exports.boolean(), policy: PolicyShape }));
 
 // ../cli/src/commands/run.ts
-var common5 = { needsAuth: true, needsNetwork: true };
+var common7 = { needsAuth: true, needsNetwork: true };
 var EXECUTOR = { name: "executor", type: "string", enum: ["claude-code", "codex"], description: "Which agent this is (default: detected from the environment)" };
 var STOP_NOTE = "A stop (policy paused, a budget spent, nothing runnable) exits 6 with the reason in the error code and the exact `overlane run end --reason ...` as the hint.";
 var runStartCommand = defineCommand({
@@ -60173,7 +61244,7 @@ var runStartCommand = defineCommand({
   flags: [{ name: "trigger", type: "string", enum: ["schedule", "interactive", "event"], default: "interactive", description: "What started the run" }, EXECUTOR],
   examples: ["overlane run start --trigger schedule", "overlane run start --dry-run"],
   effect: "write",
-  ...common5,
+  ...common7,
   keywords: ["begin run", "bounded step", "autonomous", "start working", "new run", "schedule", "kick off"],
   result: RunStartResult,
   handler: async (inv) => startRun(inv.deps, { trigger: textFlag(inv, "trigger"), executor: textFlag(inv, "executor"), dryRun: inv.dryRun })
@@ -60185,7 +61256,7 @@ var runNextCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run next"],
   effect: "read",
-  ...common5,
+  ...common7,
   keywords: ["what should I work on next", "next task", "runnable", "what to do", "pick a task", "which task", "what's next", "work on", "what is next", "todo"],
   result: RunNextResult,
   handler: async (inv) => nextTask(inv.deps, { executor: textFlag(inv, "executor") })
@@ -60197,7 +61268,7 @@ var runClaimCommand = defineCommand({
   args: [{ name: "task-id", required: false, description: "The task to claim (default: the next runnable one)" }],
   examples: ["overlane run claim", "overlane run claim T003"],
   effect: "write",
-  ...common5,
+  ...common7,
   keywords: ["take task", "lease task", "grab", "assign", "pick up task", "get a task"],
   result: RunClaimResult,
   handler: async (inv) => claimTask(inv.deps, { positionals: inv.positionals, dryRun: inv.dryRun })
@@ -60214,7 +61285,7 @@ var runDecideCommand = defineCommand({
   ],
   examples: ['overlane run decide --question "Which date library?" --decision "Use the built-in Intl" --evidence "package.json has no date library"'],
   effect: "write",
-  ...common5,
+  ...common7,
   keywords: ["record decision", "question", "unblocked", "owner override", "judgement call", "log choice", "do not ask", "decide"],
   result: RunDecideResult,
   handler: async (inv) => decide(inv.deps, { question: textFlag(inv, "question"), decision: textFlag(inv, "decision"), evidence: listFlag(inv, "evidence"), task: textFlag(inv, "task"), dryRun: inv.dryRun })
@@ -60226,7 +61297,7 @@ var runEndCommand = defineCommand({
   flags: [{ name: "reason", type: "string", required: true, enum: RUN_STOP_REASONS, description: "Why the run ended" }],
   examples: ["overlane run end --reason nothing_runnable", "overlane run end --reason error"],
   effect: "write",
-  ...common5,
+  ...common7,
   keywords: ["finish run", "stop", "wrap up", "close run", "release leases", "done with run", "end the run"],
   result: RunEndResult,
   handler: async (inv) => endRun(inv.deps, { reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -60238,7 +61309,7 @@ var runStatusCommand = defineCommand({
   flags: [EXECUTOR],
   examples: ["overlane run status"],
   effect: "read",
-  ...common5,
+  ...common7,
   keywords: ["policy", "budget", "limits", "how much left", "remaining", "state of run", "is it paused", "run policy"],
   result: RunStatusResult,
   handler: async (inv) => runStatus(inv.deps, { executor: textFlag(inv, "executor") })
@@ -60249,7 +61320,7 @@ var runPauseCommand = defineCommand({
   description: "Sets the project's run policy to paused. Every run then stops at its next check (`STOP paused`). Undo with `overlane run resume`. Safe to repeat.",
   examples: ["overlane run pause", "overlane run pause --dry-run"],
   effect: "write",
-  ...common5,
+  ...common7,
   keywords: ["pause", "halt", "freeze", "stop all", "emergency brake", "disable autonomous runs", "policy", "no new runs", "stop agents", "turn off", "suspend"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "paused", inv.dryRun)
@@ -60260,7 +61331,7 @@ var runResumeCommand = defineCommand({
   description: "Sets the project's run policy back to active so runs can start and tasks can be claimed again. Safe to repeat.",
   examples: ["overlane run resume", "overlane run resume --dry-run"],
   effect: "write",
-  ...common5,
+  ...common7,
   keywords: ["unpause", "re-enable", "continue autonomous", "reactivate", "policy active", "turn on", "restart runs", "lift the pause"],
   result: RunPolicyChangeResult,
   handler: async (inv) => setPolicyStatus(inv.deps, "active", inv.dryRun)
@@ -60270,7 +61341,7 @@ var runCommands = [runStartCommand, runNextCommand, runClaimCommand, runDecideCo
 // ../cli/src/task/queue.ts
 init_src();
 init_zod();
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { mkdirSync as mkdirSync8, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname8, join as join23 } from "node:path";
 var TASK_POLICY_PATH = join23(".harness", "task-policy.json");
@@ -60290,7 +61361,7 @@ var TaskQueueResult = TaskQueue;
 var TaskPrioritiseResult = withDryRun(external_exports.object({ ...PrioritiseResult.shape, next: external_exports.string() }));
 var TaskPolicyResult = external_exports.object({ enforcement: TaskEnforcement, reason: external_exports.string().optional(), changedBy: external_exports.string().optional(), updatedAt: external_exports.string().optional(), localFile: external_exports.string() });
 var TaskPolicySetResult = withDryRun(TaskPolicyResult);
-var requestId5 = () => `cli-${randomUUID6()}`;
+var requestId7 = () => `cli-${randomUUID8()}`;
 function priorityOf(value, fallback) {
   const parsed = TaskPriority.safeParse(value ?? fallback);
   if (!parsed.success) throw new UsageError(`--priority must be one of ${TASK_PRIORITIES.join(", ")}`);
@@ -60329,7 +61400,7 @@ async function prioritiseTask(deps, input2) {
   const name2 = detectExecutorName(deps.env);
   let request;
   try {
-    request = PrioritiseRequest.parse({ requestId: requestId5(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+    request = PrioritiseRequest.parse({ requestId: requestId7(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   } catch (error62) {
     throw new UsageError(String(error62));
   }
@@ -60358,7 +61429,7 @@ async function newTask(deps, input2) {
   const begun = data;
   const project = await connectedProject(deps, "task");
   const name2 = detectExecutorName(deps.env);
-  const request = PrioritiseRequest.parse({ requestId: requestId5(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
+  const request = PrioritiseRequest.parse({ requestId: requestId7(), priority, top: input2.top, origin: name2 === "terminal" ? "user" : "agent", executor: executorFor(name2) });
   try {
     const ranked = await serviceCall(deps, project.serviceUrl, project.token)(PrioritiseResult, "POST", taskQueuePaths.prioritise(project.binding.tenantId, project.binding.projectId, begun.taskId), request);
     say(deps, `Ranked ${begun.taskId} ${ranked.priority}${input2.top ? " (first)" : ""}.`);
@@ -60379,7 +61450,7 @@ async function setPolicy(deps, input2) {
   const enforcement = TaskEnforcement.safeParse(input2.enforcement);
   if (!enforcement.success) throw new UsageError(`set needs ${TASK_ENFORCEMENT.join(" or ")}`);
   const name2 = detectExecutorName(deps.env);
-  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId5(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
+  const parsed = SetTaskPolicyRequest.safeParse({ requestId: requestId7(), enforcement: enforcement.data, ...input2.reason === void 0 ? {} : { reason: input2.reason }, executor: executorFor(name2) });
   if (!parsed.success) throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
   if (input2.dryRun) {
     const project2 = await offlineProject(deps, "task");
@@ -60406,7 +61477,7 @@ async function startExisting(deps, taskId, dryRun) {
 }
 
 // ../cli/src/commands/queue.ts
-var common6 = { needsAuth: true, needsNetwork: true };
+var common8 = { needsAuth: true, needsNetwork: true };
 var PRIORITIES2 = ["P0", "P1", "P2", "P3"];
 var taskNewCommand = defineCommand({
   path: ["task", "new"],
@@ -60422,7 +61493,7 @@ var taskNewCommand = defineCommand({
   ],
   examples: ['overlane task new "Fix login redirect"', 'overlane task new "Hotfix the build" --priority P0 --top'],
   effect: "write",
-  ...common6,
+  ...common8,
   keywords: ["new task", "create task", "no active task", "blocked no task", "start work", "need a task", "begin", "quick task"],
   result: TaskNewResult,
   handler: async (inv) => newTask(inv.deps, {
@@ -60441,7 +61512,7 @@ var taskNextCommand = defineCommand({
   description: "Picks the best ready or paused task: P0 before P3, then rank, then milestone and dependency order. When this working copy holds a task and the next one outranks it, says so (preempt) and prints the commands to checkpoint and switch; the preempted task comes back through this command afterwards.",
   examples: ["overlane task next"],
   effect: "read",
-  ...common6,
+  ...common8,
   keywords: ["what next", "next task", "priority", "what should i work on", "pick work", "resume after", "queue"],
   result: TaskNextResult,
   handler: async (inv) => taskNext(inv.deps)
@@ -60452,7 +61523,7 @@ var taskQueueCommand = defineCommand({
   description: "Lists ready, running, paused and blocked tasks by priority, then rank, then plan order, with each task's priority.",
   examples: ["overlane task queue"],
   effect: "read",
-  ...common6,
+  ...common8,
   keywords: ["priority list", "ranking", "order", "backlog", "what is queued", "p0"],
   result: TaskQueueResult,
   handler: async (inv) => taskQueue(inv.deps)
@@ -60469,7 +61540,7 @@ var taskPrioritiseCommand = defineCommand({
   ],
   examples: ["overlane task prioritise task-7 --priority P0 --top", 'overlane task prioritise task-9 --priority P2 --reason "user said later"'],
   effect: "write",
-  ...common6,
+  ...common8,
   keywords: ["reprioritize", "reprioritise", "bump", "urgent", "move to top", "rank", "lower priority", "p0", "p1", "p2", "p3"],
   result: TaskPrioritiseResult,
   handler: async (inv) => prioritiseTask(inv.deps, { taskId: inv.positionals[0], priority: textFlag(inv, "priority"), top: boolFlag(inv, "top"), reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -60480,7 +61551,7 @@ var taskPolicyCommand = defineCommand({
   description: "Reads the project's task requirement (default `required`: edits and mutating shell commands are refused without an active task) and writes it to .harness/task-policy.json for the hooks.",
   examples: ["overlane task policy"],
   effect: "read",
-  ...common6,
+  ...common8,
   keywords: ["enforcement", "require task", "task gate", "relax", "blocked", "policy"],
   result: TaskPolicyResult,
   handler: async (inv) => showPolicy2(inv.deps)
@@ -60493,7 +61564,7 @@ var taskPolicySetCommand = defineCommand({
   flags: [{ name: "reason", type: "string", value: "TEXT", description: "Why the rule is relaxed (required for relaxed)" }],
   examples: ["overlane task policy set required", 'overlane task policy set relaxed --reason "docs-only repository"'],
   effect: "write",
-  ...common6,
+  ...common8,
   keywords: ["relax", "turn off task requirement", "require tasks", "allow edits without task", "enforcement"],
   result: TaskPolicySetResult,
   handler: async (inv) => setPolicy(inv.deps, { enforcement: inv.positionals[0], reason: textFlag(inv, "reason"), dryRun: inv.dryRun })
@@ -60538,14 +61609,14 @@ var TaskHandoffResult = withDryRun(
 );
 
 // ../cli/src/commands/task.ts
-var common7 = { needsAuth: true, needsNetwork: true };
+var common9 = { needsAuth: true, needsNetwork: true };
 var taskListCommand = defineCommand({
   path: ["task", "list"],
   summary: "List the project's tasks and their states",
   description: "Lists every task of the connected project with its state, pause reason, version, lease holder, checks and latest checkpoint.",
   examples: ["overlane task list"],
   effect: "read",
-  ...common7,
+  ...common9,
   keywords: ["tasks", "show all tasks", "see tasks", "backlog", "what tasks exist", "work items"],
   result: TaskListResult,
   handler: async (inv) => listTasks(inv.deps)
@@ -60563,7 +61634,7 @@ var taskStartCommand = defineCommand({
   ],
   examples: ["overlane task start task-7", 'overlane task start --outcome "Add CSV export" --criterion "export works" --check unit_tests:L2 --path "src/**"', 'overlane task start --outcome "Fix login" --criterion "login passes" --path "src/auth/**" --dry-run'],
   effect: "write",
-  ...common7,
+  ...common9,
   keywords: ["begin", "create task", "new task", "open", "claim new", "work item", "contract", "acceptance criteria", "start working"],
   result: TaskStartResult,
   handler: async (inv) => inv.positionals[0] !== void 0 ? startExisting(inv.deps, inv.positionals[0], inv.dryRun) : startTask(inv.deps, { outcome: textFlag(inv, "outcome"), criteria: listFlag(inv, "criterion"), paths: listFlag(inv, "path"), checks: listFlag(inv, "check"), dryRun: inv.dryRun })
@@ -60574,7 +61645,7 @@ var taskStatusCommand = defineCommand({
   description: "Shows the held task from the service: state, lease, acceptance criteria, checks, evidence count and the latest checkpoint. Says so when nothing is held or the lease was lost.",
   examples: ["overlane task status"],
   effect: "read",
-  ...common7,
+  ...common9,
   keywords: ["current task", "what am i working on", "lease", "active task", "progress", "held task"],
   result: TaskStatusResult,
   handler: async (inv) => taskStatus(inv.deps)
@@ -60590,7 +61661,7 @@ var taskCheckpointCommand = defineCommand({
   ],
   examples: ['overlane task checkpoint --summary "Parser done" --next "Write the tests"', 'overlane task checkpoint --summary "Out of budget" --next "Resume" --pause quota'],
   effect: "write",
-  ...common7,
+  ...common9,
   keywords: ["save", "progress", "pause", "stop work", "park", "quota", "limit reached", "remember place", "snapshot", "save state", "out of budget"],
   result: TaskCheckpointResult,
   handler: async (inv) => checkpointTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), pause: textFlag(inv, "pause"), dryRun: inv.dryRun })
@@ -60602,7 +61673,7 @@ var taskResumeCommand = defineCommand({
   args: [{ name: "task-id", required: true, description: "The task to resume" }],
   examples: ["overlane task resume task-1"],
   effect: "write",
-  ...common7,
+  ...common9,
   keywords: ["continue", "pick up", "restart", "reclaim", "after pause", "take over", "carry on"],
   result: TaskResumeResult,
   handler: async (inv) => resumeTask(inv.deps, { taskId: inv.positionals[0], dryRun: inv.dryRun })
@@ -60613,7 +61684,7 @@ var taskSubmitCommand = defineCommand({
   description: "Asks for verification at HEAD. The task is verified only when evidence at or above each required check's level exists for that commit: L2 comes from CI on the pushed commit, L1 from `overlane task evidence`.",
   examples: ["overlane task submit", "overlane task submit --dry-run"],
   effect: "write",
-  ...common7,
+  ...common9,
   keywords: ["finish", "done", "complete", "verify", "ready for review", "request verification", "hand in", "turn in"],
   result: TaskSubmitResult,
   handler: async (inv) => submitTask(inv.deps, { dryRun: inv.dryRun })
@@ -60629,7 +61700,7 @@ var taskEvidenceCommand = defineCommand({
   ],
   examples: ["overlane task evidence --level L1 -- pnpm test"],
   effect: "write",
-  ...common7,
+  ...common9,
   keywords: ["tests", "prove", "record test result", "verification", "run checks", "L1", "attest", "run the tests and record"],
   result: TaskEvidenceResult,
   handler: async (inv) => recordEvidence(inv.deps, { level: textFlag(inv, "level"), task: textFlag(inv, "task"), words: inv.positionals, dryRun: inv.dryRun })
@@ -60645,7 +61716,7 @@ var taskHandoffCommand = defineCommand({
   ],
   examples: ["overlane task handoff --to codex", 'overlane task handoff --to claude --summary "API done" --next "Add tests"'],
   effect: "write",
-  ...common7,
+  ...common9,
   keywords: ["hand off", "transfer", "give to", "switch agent", "other agent", "codex", "claude", "pass the task", "delegate", "move work", "swap agents"],
   result: TaskHandoffResult,
   handler: async (inv) => handoffTask(inv.deps, { summary: textFlag(inv, "summary"), next: textFlag(inv, "next"), to: textFlag(inv, "to"), dryRun: inv.dryRun })
@@ -60673,7 +61744,9 @@ function coreCommands() {
     ...viewCommands,
     ...loopCommands,
     clientInstallCommand,
-    ...memoryCommands
+    ...memoryCommands,
+    ...reviewCommands,
+    ...guardCommands
   ];
 }
 function createRegistry(extra = []) {
@@ -60896,22 +61969,22 @@ import { join as join27 } from "node:path";
 function dataDir(env = process.env, home = homedir()) {
   const override = env["MVRX_DATA_DIR"];
   if (override !== void 0 && override !== "") return override;
-  const base3 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join27(home, "Library", "Application Support") : join27(home, ".local", "share"));
-  return join27(base3, "mvrx-harness");
+  const base4 = env["XDG_DATA_HOME"] ?? (process.platform === "win32" ? env["LOCALAPPDATA"] : void 0) ?? (process.platform === "darwin" ? join27(home, "Library", "Application Support") : join27(home, ".local", "share"));
+  return join27(base4, "mvrx-harness");
 }
 function marketplaceRoot(env = process.env, home = homedir()) {
   return join27(dataDir(env, home), "marketplace");
 }
 
 // src/plugin.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { join as join29 } from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/marketplace.ts
 init_src();
 import { createHash as createHash7 } from "node:crypto";
-import { cpSync, existsSync as existsSync6, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync8, renameSync as renameSync6, rmSync as rmSync4, statSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { cpSync, existsSync as existsSync6, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync9, renameSync as renameSync6, rmSync as rmSync4, statSync, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname9, join as join28, relative as relative2, sep } from "node:path";
 var CLIENT_DIRS = ["claude", "codex"];
 var EMBEDDED_MANIFEST = "release-manifest.json";
@@ -60922,7 +61995,7 @@ function loadEmbedded(packageRoot2) {
   const dir = join28(packageRoot2, "plugins");
   const path = join28(dir, EMBEDDED_MANIFEST);
   if (!existsSync6(path)) throw new MarketplaceError(`this package has no embedded plugin release (${path} is missing)`);
-  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync8(path, "utf8")));
+  const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync9(path, "utf8")));
   if (!parsed.success) throw new MarketplaceError(`the embedded release manifest is invalid: ${parsed.error.message}`);
   return { dir, manifest: parsed.data };
 }
@@ -60950,7 +62023,7 @@ async function verifyTree(treeRoot, manifest) {
       problems.push(`missing: ${file2.path}`);
       continue;
     }
-    if (sha2562(readFileSync8(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
+    if (sha2562(readFileSync9(path)) !== file2.digest) problems.push(`modified: ${file2.path}`);
   }
   for (const client of CLIENT_DIRS) {
     for (const found of listFiles(join28(treeRoot, client))) {
@@ -60961,7 +62034,7 @@ async function verifyTree(treeRoot, manifest) {
 }
 function readInstalledManifest(target) {
   try {
-    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync8(join28(target, INSTALLED_MANIFEST), "utf8")));
+    const parsed = ReleaseManifest.safeParse(JSON.parse(readFileSync9(join28(target, INSTALLED_MANIFEST), "utf8")));
     return parsed.success ? parsed.data : null;
   } catch {
     return null;
@@ -61025,7 +62098,7 @@ var PluginUsageError = class extends Error {
 };
 function readNames(treeRoot, client) {
   const file2 = client === "claude" ? join29(treeRoot, "claude", ".claude-plugin", "marketplace.json") : join29(treeRoot, "codex", ".agents", "plugins", "marketplace.json");
-  const parsed = JSON.parse(readFileSync9(file2, "utf8"));
+  const parsed = JSON.parse(readFileSync10(file2, "utf8"));
   const record3 = parsed;
   const plugin = record3.plugins?.[0]?.name;
   if (typeof record3.name !== "string" || typeof plugin !== "string") throw new MarketplaceError(`${file2} names no marketplace or plugin`);
@@ -61297,8 +62370,8 @@ async function confirm(question) {
   }
 }
 function configDir2(env) {
-  const base3 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join32(homedir3(), ".config");
-  return join32(base3, "mvrx-harness");
+  const base4 = env["XDG_CONFIG_HOME"] ?? (process.platform === "win32" ? env["APPDATA"] : void 0) ?? join32(homedir3(), ".config");
+  return join32(base4, "mvrx-harness");
 }
 function createDeps2(env = process.env) {
   return {