project-athena 0.3.0 → 0.5.0

package/dist/chunk-Y6SDMZET.js

@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+import {
+  MAX_SECRET_FINDINGS,
+  scanFilesForSecrets
+} from "./chunk-44EGCEB2.js";
+import {
+  walkProject
+} from "./chunk-ELKFRTZT.js";
+import {
+  MAX_GENERIC_LINE,
+  SECRET_PATTERNS,
+  ephemeralFingerprint
+} from "./chunk-WWQ5NKEC.js";
+
+// src/core/findings/finding.ts
+import { z } from "zod";
+var CATEGORIES = ["secret", "dependency", "sast", "iac", "license", "quality", "review", "memory"];
+var SEVERITIES = ["critical", "high", "medium", "low", "info", "unrated"];
+var SEVERITY_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1, unrated: 0 };
+var CONFIDENCES = ["high", "medium", "low"];
+var CONFIDENCE_RANK = { high: 3, medium: 2, low: 1 };
+var Location = z.object({
+  file: z.string(),
+  startLine: z.number().int().positive().optional(),
+  startColumn: z.number().int().positive().optional(),
+  endLine: z.number().int().positive().optional(),
+  endColumn: z.number().int().positive().optional()
+});
+var PackageRef = z.object({
+  ecosystem: z.string(),
+  name: z.string(),
+  version: z.string().optional(),
+  /** Manifest or lockfile the package comes from, if known. */
+  manifest: z.string().optional(),
+  advisoryIds: z.array(z.string()).default([]),
+  vulnerableRange: z.string().optional(),
+  fixedIn: z.string().optional(),
+  fixAvailable: z.boolean().optional()
+});
+var Finding = z.object({
+  /** Stable identity (32 hex). Never derived from a secret's value; see fingerprint.ts. */
+  fingerprint: z.string().regex(/^[a-f0-9]{32}$/),
+  /** e.g. `secret/stripe-key`, `dependency/vulnerable-package`, `review/env-file`, `sast/js/sql-concat`. */
+  ruleId: z.string().regex(/^[a-z0-9][a-z0-9._/-]{1,120}$/),
+  category: z.enum(CATEGORIES),
+  severity: z.enum(SEVERITIES),
+  confidence: z.enum(CONFIDENCES),
+  label: z.enum(["FACT", "DETECTED", "INFERRED"]),
+  /** Heuristic: "worth checking", not a confirmed problem. Rendered as "Potential …". */
+  potential: z.boolean().default(false),
+  title: z.string(),
+  message: z.string(),
+  cwe: z.array(z.string().regex(/^CWE-\d+$/)).default([]),
+  owasp: z.array(z.string()).default([]),
+  location: Location.optional(),
+  package: PackageRef.optional(),
+  /** Which engine produced it: `athena`, `npm-audit`, `semgrep`, … */
+  engine: z.object({ id: z.string(), version: z.string().optional() }),
+  /** Other engines that reported the same problem (after de-duplication). */
+  alsoReportedBy: z.array(z.string()).default([]),
+  help: z.object({ text: z.string(), url: z.string().optional() }).optional()
+});
+var Coverage = z.object({
+  engine: z.string(),
+  category: z.enum(CATEGORIES),
+  /** ok: ran · unavailable: not installed / nothing to scan · skipped: excluded by policy or options · failed/timeout: ran without usable output */
+  status: z.enum(["ok", "unavailable", "skipped", "failed", "timeout"]),
+  reason: z.string().optional(),
+  /** What was scanned when an engine runs per input (e.g. a requirements file). */
+  target: z.string().optional(),
+  languages: z.array(z.string()).default([]),
+  filesScanned: z.number().int().nonnegative().optional(),
+  filesSkipped: z.object({
+    tooLarge: z.number().int().nonnegative().default(0),
+    binary: z.number().int().nonnegative().default(0),
+    minified: z.number().int().nonnegative().default(0),
+    unreadable: z.number().int().nonnegative().default(0),
+    unsupported: z.number().int().nonnegative().default(0)
+  }).optional(),
+  /** Whether the engine contacted the network (e.g. an audit tool querying an advisory database). */
+  network: z.boolean().default(false),
+  durationMs: z.number().nonnegative()
+});
+var SCAN_SCOPES = ["all", "base", "staged", "changed"];
+var ScanResult = z.object({
+  schemaVersion: z.literal(1),
+  scannedAt: z.string(),
+  durationMs: z.number().nonnegative(),
+  scope: z.object({ mode: z.enum(SCAN_SCOPES), base: z.string().optional(), files: z.number().int().nonnegative().optional() }),
+  findings: z.array(Finding),
+  coverage: z.array(Coverage)
+});
+function compareFindings(a, b) {
+  return SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || CONFIDENCE_RANK[b.confidence] - CONFIDENCE_RANK[a.confidence] || a.category.localeCompare(b.category) || a.ruleId.localeCompare(b.ruleId) || (a.location?.file ?? "").localeCompare(b.location?.file ?? "") || (a.location?.startLine ?? 0) - (b.location?.startLine ?? 0) || a.fingerprint.localeCompare(b.fingerprint);
+}
+function dedupeFindings(findings) {
+  const byFp = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const prev = byFp.get(f.fingerprint);
+    if (!prev) {
+      byFp.set(f.fingerprint, { ...f, alsoReportedBy: [...f.alsoReportedBy] });
+      continue;
+    }
+    const other = f.engine.id;
+    if (other !== prev.engine.id && !prev.alsoReportedBy.includes(other)) prev.alsoReportedBy.push(other);
+    if (SEVERITY_RANK[f.severity] > SEVERITY_RANK[prev.severity]) prev.severity = f.severity;
+    if (CONFIDENCE_RANK[f.confidence] > CONFIDENCE_RANK[prev.confidence]) prev.confidence = f.confidence;
+  }
+  return [...byFp.values()].sort(compareFindings);
+}
+
+// src/core/scanners/secrets.ts
+import { promises as fs } from "fs";
+import path from "path";
+
+// src/core/findings/fingerprint.ts
+import crypto from "crypto";
+var FINGERPRINT_VERSION = 1;
+var hash = (parts) => crypto.createHash("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
+function normalizeLine(text, mask) {
+  const masked = mask ? `${text.slice(0, mask[0])}\u27E8v\u27E9${text.slice(mask[1])}` : text;
+  return masked.replace(/\s+/g, " ").trim();
+}
+function codeFingerprint(input) {
+  return hash(["v1", "code", input.ruleId, input.file, normalizeLine(input.lineText, input.mask), String(input.occurrence ?? 0)]);
+}
+function packageFingerprint(input) {
+  return hash(["v1", "package", input.ruleId, input.ecosystem, input.name, input.manifest ?? "", input.advisoryId ?? ""]);
+}
+function fileFingerprint(input) {
+  return hash(["v1", "file", input.ruleId, input.file ?? "", input.key ?? ""]);
+}
+function occurrenceCounter() {
+  const seen = /* @__PURE__ */ new Map();
+  return (ruleId, file, normalized) => {
+    const key = `${ruleId}\0${file}\0${normalized}`;
+    const n = seen.get(key) ?? 0;
+    seen.set(key, n + 1);
+    return n;
+  };
+}
+
+// src/core/scanners/secrets.ts
+var SECRETS_ENGINE = "athena-secrets";
+var CRITICAL = /* @__PURE__ */ new Set(["private-key", "aws-access-key-id", "aws-secret-access-key", "gcp-service-account", "azure-storage-key"]);
+var GENERIC = /* @__PURE__ */ new Set(["generic-secret-assignment", "env-secret-assignment"]);
+var MEDIUM_CONFIDENCE = /* @__PURE__ */ new Set(["jwt", "connection-string-credentials"]);
+var DESCRIPTION = new Map(SECRET_PATTERNS.map((p) => [p.id, p.description]));
+function secretSeverity(type) {
+  if (CRITICAL.has(type)) return { severity: "critical", confidence: "high", potential: false };
+  if (GENERIC.has(type)) return { severity: "medium", confidence: "low", potential: true };
+  return { severity: "high", confidence: MEDIUM_CONFIDENCE.has(type) ? "medium" : "high", potential: false };
+}
+function secretFinding(hit, occurrence = 0, engineId = "athena") {
+  const ruleId = `secret/${hit.type}`;
+  const { severity, confidence, potential } = secretSeverity(hit.type);
+  const description = DESCRIPTION.get(hit.type) ?? hit.type;
+  return {
+    fingerprint: codeFingerprint({ ruleId, file: hit.file, lineText: hit.lineText, mask: hit.mask, occurrence }),
+    ruleId,
+    category: "secret",
+    severity,
+    confidence,
+    label: "DETECTED",
+    potential,
+    title: potential ? `Potential hardcoded secret (${description.toLowerCase()})` : `Hardcoded ${description}`,
+    message: `${potential ? "A value that looks like a secret" : `A ${description}`} appears in ${hit.file}:${hit.line}. Athena does not store the value.`,
+    cwe: ["CWE-798"],
+    owasp: ["A07:2021"],
+    location: {
+      file: hit.file,
+      startLine: hit.line,
+      ...hit.column ? { startColumn: hit.column } : {},
+      ...hit.endLine ? { endLine: hit.endLine } : {},
+      ...hit.endColumn ? { endColumn: hit.endColumn } : {}
+    },
+    engine: { id: engineId },
+    help: {
+      text: potential ? "Check whether this is a real credential. If it is, move it to an environment variable or secret manager and rotate it." : "Remove the value, load it from an environment variable or secret manager, and rotate the credential \u2014 assume it is compromised once committed."
+    }
+  };
+}
+function hitsFromMatches(file, text, matches) {
+  const lineStart = (offset) => text.lastIndexOf("\n", offset - 1) + 1;
+  return matches.map((m) => {
+    const start = lineStart(m.start);
+    let end = text.indexOf("\n", m.start);
+    if (end < 0) end = text.length;
+    let lineText = text.slice(start, end);
+    if (lineText.endsWith("\r")) lineText = lineText.slice(0, -1);
+    const maskEnd = Math.min(m.end, start + lineText.length) - start;
+    const span = text.slice(m.start, m.end);
+    const extraLines = (span.match(/\n/g) ?? []).length;
+    const lastStart = extraLines ? lineStart(m.end) : start;
+    return {
+      type: m.type,
+      file,
+      line: m.line,
+      column: m.start - start + 1,
+      endLine: m.line + extraLines,
+      endColumn: m.end - lastStart + 1,
+      lineText,
+      mask: [m.start - start, Math.max(maskEnd, m.start - start)]
+    };
+  });
+}
+function secretFindings(hits, engineId = "athena") {
+  const occurrence = occurrenceCounter();
+  return hits.map((h) => secretFinding(h, occurrence(`secret/${h.type}`, h.file, normalizeLine(h.lineText, h.mask)), engineId));
+}
+async function scanSecrets(ctx, opts = {}) {
+  const started = Date.now();
+  let files = opts.walk ?? (await walkProject(ctx.root, { config: ctx.config, signal: ctx.signal })).files;
+  if (ctx.files) {
+    const scope = new Set(ctx.files);
+    files = files.filter((f) => scope.has(f.path));
+  }
+  const hits = [];
+  const read = async (rel) => fs.readFile(path.join(ctx.root, rel), "utf8").catch(() => null);
+  const r = await scanFilesForSecrets(files, read, {
+    fingerprint: ephemeralFingerprint,
+    signal: ctx.signal,
+    onFile: (file, text, matches) => hits.push(...hitsFromMatches(file, text, matches))
+  });
+  const notes = [];
+  if (r.truncated) notes.push(`stopped after ${MAX_SECRET_FINDINGS} findings; remaining files were not scanned`);
+  if (r.skippedLongLines) notes.push(`generic keyword patterns not applied to ${r.skippedLongLines} line(s) longer than ${MAX_GENERIC_LINE} characters`);
+  if (r.files.excluded) notes.push(`${r.files.excluded} lockfile/snapshot/SVG file(s) not scanned`);
+  const coverage = {
+    engine: SECRETS_ENGINE,
+    category: "secret",
+    status: "ok",
+    ...notes.length ? { reason: notes.join("; ") } : {},
+    filesScanned: r.files.scanned,
+    filesSkipped: { tooLarge: r.files.tooLarge, binary: r.files.binary, minified: r.files.minified, unreadable: r.files.unreadable, unsupported: r.files.excluded },
+    network: false,
+    durationMs: Date.now() - started
+  };
+  return {
+    findings: secretFindings(hits),
+    coverage: [coverage],
+    summary: { count: hits.length, files: [...new Set(hits.map((h) => h.file))], skippedLongLines: r.skippedLongLines, truncated: r.truncated }
+  };
+}
+var secretsScanner = {
+  id: SECRETS_ENGINE,
+  category: "secret",
+  title: "Hardcoded secrets",
+  async run(ctx) {
+    const { findings, coverage } = await scanSecrets(ctx);
+    return { findings, coverage };
+  }
+};
+
+export {
+  FINGERPRINT_VERSION,
+  normalizeLine,
+  codeFingerprint,
+  packageFingerprint,
+  fileFingerprint,
+  occurrenceCounter,
+  SECRETS_ENGINE,
+  hitsFromMatches,
+  secretFindings,
+  scanSecrets,
+  secretsScanner,
+  CATEGORIES,
+  SEVERITIES,
+  SEVERITY_RANK,
+  CONFIDENCES,
+  CONFIDENCE_RANK,
+  Finding,
+  Coverage,
+  ScanResult,
+  compareFindings,
+  dedupeFindings
+};
+//# sourceMappingURL=chunk-Y6SDMZET.js.map

package/dist/{chunk-2RS6TA3D.js → chunk-YRIS7ZS6.js}

@@ -12,6 +12,13 @@ import {
   removeJsonHooks,
   stripMcpServers
 } from "./chunk-GHFRQAYT.js";
+import {
+  CLAUDE_HOOK_EVENTS,
+  CODEX_HOOK_EVENTS,
+  COPILOT_HOOK_EVENTS,
+  CURSOR_HOOK_EVENTS,
+  GEMINI_HOOK_EVENTS
+} from "./chunk-INT3IGMQ.js";
 import {
   INTEGRATION_END,
   INTEGRATION_START,
@@ -27,13 +34,6 @@ import {
   readTextIfExists,
   writeFileAtomic
 } from "./chunk-IQQBAWSM.js";
-import {
-  CLAUDE_HOOK_EVENTS,
-  CODEX_HOOK_EVENTS,
-  COPILOT_HOOK_EVENTS,
-  CURSOR_HOOK_EVENTS,
-  GEMINI_HOOK_EVENTS
-} from "./chunk-INT3IGMQ.js";
 import {
   resolveInside
 } from "./chunk-XW3MLHI2.js";
@@ -49,14 +49,16 @@ import path2 from "path";
 function workflowSteps() {
   return [
     "1. Read `.athena/rules.md` and follow every enabled rule (lines marked `[disabled]` do not apply).",
-    "2. Classify the task and read only the relevant Athena documents (see the relevance map below).",
-    "3. Identify the affected modules and architecture boundaries.",
-    "4. Check security implications (`.athena/security.md`, `.athena/auth.md`) when touching input handling, auth, data access or secrets.",
-    "5. Check database and API implications when the change touches schema, queries or endpoints.",
-    "6. For non-trivial work, state a short implementation plan before editing.",
-    "7. Implement only the required changes.",
-    "8. Run the relevant validation (tests, lint, type checks \u2014 commands are listed in `.athena/project.md` and `.athena/testing.md`).",
-    "9. If you changed project structure, dependencies, routes, schema or infrastructure, run `athena sync --dry-run` to see which knowledge is affected, and tell the developer to review it with `athena sync` (apply it yourself only if permitted)."
+    "2. Recall project memory for the task and files: call the Athena `recall` MCP tool, or skim `.athena/memory/` if MCP is unavailable.",
+    "3. Classify the task and read only the relevant Athena documents (see the relevance map below).",
+    "4. Identify the affected modules and architecture boundaries.",
+    "5. Check security implications (`.athena/security.md`, `.athena/auth.md`) when touching input handling, auth, data access or secrets.",
+    "6. Check database and API implications when the change touches schema, queries or endpoints.",
+    "7. For non-trivial work, state a short implementation plan before editing.",
+    "8. Implement only the required changes.",
+    "9. Run the relevant validation (tests, lint, type checks \u2014 commands are listed in `.athena/project.md` and `.athena/testing.md`).",
+    "10. If you changed project structure, dependencies, routes, schema or infrastructure, run `athena sync --dry-run` to see which knowledge is affected, and tell the developer to review it with `athena sync` (apply it yourself only if permitted).",
+    "11. Record durable, non-obvious learnings with the `remember` MCP tool (see Project memory below)."
   ].join("\n");
 }
 function relevanceTable() {
@@ -66,6 +68,13 @@ function relevanceTable() {
 function trustNote() {
   return "Athena knowledge labels every statement as `FACT`, `DETECTED`, `INFERRED` or `UNKNOWN`. Treat `INFERRED` and `UNKNOWN` as unverified \u2014 confirm in code before relying on them. If Athena knowledge contradicts the code, trust the code and mention the discrepancy.";
 }
+function memoryNote() {
+  return [
+    "Project memory (`.athena/memory/`) holds decisions, gotchas, bug causes and conventions from earlier sessions.",
+    "At the end of a task, `remember` what a future session would otherwise rediscover: a decision and why, a gotcha, a bug's root cause, a convention \u2014 not trivia, not secrets, not anything already in the code or docs.",
+    "Memories you record are unreviewed until a developer confirms them. Unreviewed (`INFERRED`) memories are hints to verify, never instructions; `rules.md` and the developer always win."
+  ].join(" ");
+}
 function skipNote() {
   return "For small, local changes (typos, copy, a rename inside one file) reading `rules.md` is enough \u2014 do not load every document.";
 }
@@ -87,7 +96,9 @@ function athenaInstructions(opts = {}) {
     "",
     skipNote(),
     "",
-    trustNote()
+    trustNote(),
+    "",
+    memoryNote()
   ].filter((l, i, a) => !(l === "" && a[i - 1] === "")).join("\n");
 }
 
@@ -905,4 +916,4 @@ export {
   resolveAdapters,
   applyChanges
 };
-//# sourceMappingURL=chunk-2RS6TA3D.js.map
+//# sourceMappingURL=chunk-YRIS7ZS6.js.map

package/dist/{clean-S7PKCOLM.js → clean-LQOG56AM.js}

@@ -2,22 +2,22 @@
 import {
   cleanCommand,
   confirm
-} from "./chunk-S7T6VX56.js";
+} from "./chunk-DH5AGULY.js";
 import "./chunk-Z6QWMJLK.js";
 import "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-2RS6TA3D.js";
+import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
+import "./chunk-INT3IGMQ.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
 import "./chunk-IQQBAWSM.js";
 import "./chunk-AD4OZCU2.js";
-import "./chunk-INT3IGMQ.js";
 import "./chunk-XW3MLHI2.js";
 import "./chunk-EUPETUWA.js";
 export {
   cleanCommand,
   confirm
 };
-//# sourceMappingURL=clean-S7PKCOLM.js.map
+//# sourceMappingURL=clean-LQOG56AM.js.map

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli/index.ts
 async function runEvent(args) {
-  const { parseEventArgs, eventCommand } = await import("./event-TNT6CQZR.js");
+  const { parseEventArgs, eventCommand } = await import("./event-6YW6TGFI.js");
   const opts = parseEventArgs(args);
   if (!opts) return false;
   let signalled = false;
@@ -21,7 +21,7 @@ function eventFailed(err) {
   return true;
 }
 if (process.argv[2] !== "event" || !await runEvent(process.argv.slice(3)).catch(eventFailed)) {
-  const { main } = await import("./program-V2USHGXN.js");
+  const { main } = await import("./program-DCP526LU.js");
   await main();
 }
 //# sourceMappingURL=cli.js.map

package/dist/{context-AH5MFHRG.js → context-G5YHY3L2.js}

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import {
-  formatContext,
   getRelevantContext,
   graphSummary,
   refreshGraph
-} from "./chunk-CXUTYCZX.js";
+} from "./chunk-GYQG4Q2N.js";
+import {
+  formatContext
+} from "./chunk-F65QINMR.js";
 import "./chunk-3IS2X2Z7.js";
 import {
   bullet,
@@ -22,15 +24,17 @@ import {
   requireProjectRoot
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
+import "./chunk-GU3ZX2J7.js";
+import "./chunk-44EGCEB2.js";
+import "./chunk-PVCIGUIT.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import {
   loadGraph,
   neighbors
-} from "./chunk-PDFQ5BFG.js";
-import "./chunk-PANVPNYF.js";
-import "./chunk-ELKFRTZT.js";
-import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
-import "./chunk-JCGDR4UV.js";
+} from "./chunk-SVTEJYMS.js";
+import "./chunk-QCC4VJUH.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
@@ -70,11 +74,21 @@ async function contextCommand(task, opts) {
     for (const n of ctx.graphNodes.slice(0, 12)) line(`  ${dim(`${n.kind}:`)} ${n.name}${n.path ? dim(` (${n.path})`) : ""}`);
     if (ctx.graphNodes.length > 12) line(dim(`  +${ctx.graphNodes.length - 12} more`));
   }
+  if (ctx.memories.length) {
+    line();
+    heading("Project memory");
+    for (const m of ctx.memories) {
+      const label = m.label === "FACT" ? c.green(m.label) : c.yellow(m.label);
+      line(`  ${label} ${m.title} ${dim(`(${m.id}, ${m.kind}${m.status === "unreviewed" ? ", unreviewed" : ""}${m.stale ? ", stale" : ""})`)}`);
+      line(dim(`    ${m.why.join("; ")}`));
+    }
+    if (ctx.memories.some((m) => m.status === "unreviewed")) line(dim("  Unreviewed memories were written by an agent; confirm or forget them with `athena memory`."));
+  }
   line();
   heading("Sections selected");
   for (const s of ctx.sections) line(`  ${dim(`${s.file} \u2192`)} ${s.section}`);
   line();
-  line(dim(`${ctx.sections.length} sections \xB7 ~${ctx.approxChars} characters \xB7 ${ctx.rules.length} rules${ctx.truncated ? " \xB7 some sections omitted for budget" : ""}`));
+  line(dim(`${ctx.sections.length} sections \xB7 ${ctx.memories.length} memories \xB7 ~${ctx.approxChars} characters \xB7 ${ctx.rules.length} rules${ctx.truncated ? " \xB7 some content omitted for budget" : ""}`));
   line(dim("Use --full to print the context an agent would read, or --json for tooling."));
 }
 async function graphCommand(opts) {
@@ -144,4 +158,4 @@ export {
   contextCommand,
   graphCommand
 };
-//# sourceMappingURL=context-AH5MFHRG.js.map
+//# sourceMappingURL=context-G5YHY3L2.js.map

package/dist/{doctor-RSJMLE2P.js → doctor-L34QJ7WR.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   runDoctor
-} from "./chunk-PR53DT7I.js";
-import "./chunk-RXNRMIZP.js";
-import "./chunk-VSYBC3VY.js";
+} from "./chunk-L2EHJCH4.js";
+import "./chunk-WUIC65QO.js";
+import "./chunk-UMWX4UTK.js";
+import "./chunk-P4TRQMES.js";
 import "./chunk-3IS2X2Z7.js";
-import "./chunk-65TSRDQ3.js";
 import {
   c,
   dim,
@@ -21,23 +21,30 @@ import {
 import "./chunk-KBO7XRBW.js";
 import "./chunk-2R6PXY6Z.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
-import "./chunk-JCGDR4UV.js";
-import "./chunk-2RS6TA3D.js";
+import "./chunk-AKOI4VTD.js";
+import "./chunk-WWQ5NKEC.js";
+import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
+import "./chunk-INT3IGMQ.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
 import "./chunk-IQQBAWSM.js";
 import "./chunk-AD4OZCU2.js";
-import "./chunk-INT3IGMQ.js";
 import "./chunk-XW3MLHI2.js";
 import "./chunk-EUPETUWA.js";
 
 // src/cli/commands/doctor.ts
 async function doctorCommand(opts) {
   const cwd = await resolveCwd(opts);
-  const { checks } = await runDoctor(cwd);
+  const { checks, root } = await runDoctor(cwd);
+  if (root) {
+    const m = await (await import("./memory-XBZCYQLW.js")).memorySummary(root);
+    if (m?.total) {
+      const pending = [m.unreviewed ? `${m.unreviewed} unreviewed` : "", m.stale ? `${m.stale} stale` : ""].filter(Boolean);
+      checks.push({ area: "Memory", level: "info", message: `${m.total} project memory ${m.total === 1 ? "entry" : "entries"}${pending.length ? ` (${pending.join(", ")})` : ""}`, hint: pending.length ? "Review with `athena memory review` and `athena memory stale`." : void 0 });
+    }
+  }
   const errors = checks.filter((c2) => c2.level === "error").length;
   if (isJson()) {
     json({ ok: errors === 0, checks });
@@ -59,4 +66,4 @@ async function doctorCommand(opts) {
 export {
   doctorCommand
 };
-//# sourceMappingURL=doctor-RSJMLE2P.js.map
+//# sourceMappingURL=doctor-L34QJ7WR.js.map

package/dist/{event-TNT6CQZR.js → event-6YW6TGFI.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   appendEvent
-} from "./chunk-65TSRDQ3.js";
+} from "./chunk-P4TRQMES.js";
 import {
   findProjectRoot
 } from "./chunk-KBO7XRBW.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import {
   normalizeHookEvent
 } from "./chunk-INT3IGMQ.js";
@@ -98,4 +98,4 @@ export {
   eventCommand,
   parseEventArgs
 };
-//# sourceMappingURL=event-TNT6CQZR.js.map
+//# sourceMappingURL=event-6YW6TGFI.js.map

package/dist/{git-hook-YZNZGAAP.js → git-hook-Y7Y262F7.js}

@@ -15,7 +15,7 @@ import {
 import "./chunk-KBO7XRBW.js";
 import {
   git
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   hookCommand
 } from "./chunk-GHFRQAYT.js";
@@ -249,4 +249,4 @@ export {
   gitHookStatusCommand,
   gitHookUninstallCommand
 };
-//# sourceMappingURL=git-hook-YZNZGAAP.js.map
+//# sourceMappingURL=git-hook-Y7Y262F7.js.map

package/dist/{init-2V34DVRQ.js → init-427QR5AS.js}

@@ -5,26 +5,27 @@ import {
   printSummary,
   runWithProgress,
   summarize
-} from "./chunk-DOQMAZL5.js";
+} from "./chunk-R5AX7VST.js";
 import "./chunk-SHKXELUX.js";
 import "./chunk-Z6QWMJLK.js";
 import "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-SJOOXO34.js";
-import "./chunk-PANVPNYF.js";
-import "./chunk-ELKFRTZT.js";
+import "./chunk-4FETKOY3.js";
 import "./chunk-2R6PXY6Z.js";
+import "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
-import "./chunk-JCGDR4UV.js";
-import "./chunk-2RS6TA3D.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
+import "./chunk-QCC4VJUH.js";
+import "./chunk-WWQ5NKEC.js";
+import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
+import "./chunk-INT3IGMQ.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
 import "./chunk-IQQBAWSM.js";
 import "./chunk-AD4OZCU2.js";
-import "./chunk-INT3IGMQ.js";
 import "./chunk-XW3MLHI2.js";
 import "./chunk-EUPETUWA.js";
 export {
@@ -34,4 +35,4 @@ export {
   runWithProgress,
   summarize
 };
-//# sourceMappingURL=init-2V34DVRQ.js.map
+//# sourceMappingURL=init-427QR5AS.js.map