project-athena 0.4.0 → 0.5.0

package/dist/{mcp-U7EPH43L.js → mcp-DWNWRGJW.js}

@@ -1,15 +1,25 @@
 #!/usr/bin/env node
 import {
   AnalysisScheduler
-} from "./chunk-RVTNSNGK.js";
+} from "./chunk-X7EYOAEX.js";
 import {
   getGraph,
   getRelevantContext,
   graphSummary
-} from "./chunk-UAZLPNVC.js";
+} from "./chunk-GYQG4Q2N.js";
+import {
+  evaluateFindings
+} from "./chunk-KJYSNZXS.js";
+import {
+  loadFindings
+} from "./chunk-IDODPGTX.js";
+import "./chunk-UMWX4UTK.js";
+import {
+  CATEGORIES
+} from "./chunk-Y6SDMZET.js";
 import {
   buildStatus
-} from "./chunk-ZB7LC6FP.js";
+} from "./chunk-3KFOI2X4.js";
 import {
   MEMORY_KINDS,
   MEMORY_STATUSES,
@@ -17,7 +27,7 @@ import {
   formatContext,
   listMemory,
   recall
-} from "./chunk-TDNZ2RYA.js";
+} from "./chunk-F65QINMR.js";
 import {
   listRules,
   parseRules
@@ -28,24 +38,24 @@ import {
 import "./chunk-KBO7XRBW.js";
 import {
   applySync
-} from "./chunk-KHMBNT66.js";
-import "./chunk-WVQC2EGO.js";
+} from "./chunk-PZPMWCXS.js";
+import "./chunk-GU3ZX2J7.js";
 import "./chunk-GR4DL2VM.js";
-import "./chunk-GGXPG6OE.js";
-import {
-  loadScan
-} from "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+import "./chunk-4FETKOY3.js";
 import {
   ATHENA_VERSION
 } from "./chunk-2R6PXY6Z.js";
+import {
+  loadScan
+} from "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
 import {
   redact
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -185,6 +195,33 @@ _Last dependency scan: ${scan.scannedAt}._` : "\n\n_No dependency audit has been
       return textResult(await docText(root, "security.md", suffix));
     }
   );
+  server.registerTool(
+    "findings",
+    {
+      title: "Security findings",
+      description: "Summary of the last `athena scan`: gate verdict, ratings, coverage gaps and active findings (rule, severity, confidence, location \u2014 never secret values). Read-only; it does not run a scan. Heuristic findings are marked potential: verify before acting.",
+      inputSchema: { category: z.enum(CATEGORIES).optional(), limit: z.number().int().min(1).max(100).optional() }
+    },
+    async ({ category, limit }) => {
+      const result = await loadFindings(root);
+      if (!result) return textResult("No scan results yet. Ask the developer to run `athena scan` (Athena does not scan from MCP).");
+      const ev = await evaluateFindings(root, result);
+      const active = ev.findings.filter((f) => ev.statuses[f.fingerprint]?.active && (!category || f.category === category));
+      const max = limit ?? 30;
+      const where = (f) => f.location ? ` ${f.location.file}${f.location.startLine ? `:${f.location.startLine}` : ""}` : f.package ? ` ${f.package.name}${f.package.version ? `@${f.package.version}` : ""}` : "";
+      const gaps = result.coverage.filter((c) => c.status !== "ok");
+      const lines = [
+        `Last scan: ${result.scannedAt} (scope ${result.scope.mode}${result.scope.base ? ` vs ${result.scope.base}` : ""}).`,
+        `Gate: ${ev.gate.passed ? "passed" : `failed \u2014 ${ev.gate.reasons.join("; ")}`}`,
+        `Ratings: ${ev.ratings.map((r) => `${r.category} ${r.rating ?? "not scanned"}`).join(", ")}`,
+        ...gaps.length ? [`Not fully covered: ${gaps.map((c) => `${c.engine} (${c.category}) ${c.status}`).join(", ")}`] : [],
+        "",
+        `Active findings${category ? ` (${category})` : ""}: ${active.length}${active.length > max ? ` (first ${max})` : ""}`,
+        ...active.slice(0, max).map((f) => `- [${f.severity}/${f.confidence}] ${f.potential ? "Potential: " : ""}${f.title} \u2014${where(f)} (${f.ruleId}, ${f.label}, fp ${f.fingerprint.slice(0, 12)})`)
+      ];
+      return textResult(untrustedDocument(".athena/findings.json", lines.join("\n")));
+    }
+  );
   server.registerTool(
     "get_project_rules",
     { title: "Project rules", description: "Developer-defined rules this project expects agents to follow. Disabled rules are excluded.", inputSchema: {} },
@@ -390,4 +427,4 @@ async function mcpCommand(opts) {
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-U7EPH43L.js.map
+//# sourceMappingURL=mcp-DWNWRGJW.js.map

package/dist/{memory-VSVNLEJC.js → memory-XBZCYQLW.js}

@@ -12,7 +12,7 @@ import {
   searchMemory,
   supersedeMemory,
   updateMemory
-} from "./chunk-TDNZ2RYA.js";
+} from "./chunk-F65QINMR.js";
 import "./chunk-3IS2X2Z7.js";
 import {
   c,
@@ -32,7 +32,7 @@ import {
 import "./chunk-KBO7XRBW.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
@@ -390,4 +390,4 @@ export {
   memorySummary,
   memorySupersedeCommand
 };
-//# sourceMappingURL=memory-VSVNLEJC.js.map
+//# sourceMappingURL=memory-XBZCYQLW.js.map

package/dist/{open-UJZRYF4E.js → open-LJMOB6U2.js}

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import {
+  INSTANCE_FILE,
+  findRunningInstance,
+  runDoctor
+} from "./chunk-L2EHJCH4.js";
 import {
   contentHash,
   docAtRevision,
@@ -11,41 +16,39 @@ import {
   rulesUpdate,
   saveDoc,
   searchDocs
-} from "./chunk-LEMPCNAY.js";
+} from "./chunk-56EXAGTM.js";
 import {
   configureAgents,
   listAgents,
   removeAgents
-} from "./chunk-QLW657NT.js";
+} from "./chunk-RQKGT2EK.js";
 import {
   watchProject
-} from "./chunk-DZDI2HRT.js";
+} from "./chunk-6OSQMXUP.js";
 import {
   AnalysisScheduler
-} from "./chunk-RVTNSNGK.js";
+} from "./chunk-X7EYOAEX.js";
 import {
   getRelevantContext,
   graphSummary,
   refreshGraph
-} from "./chunk-UAZLPNVC.js";
+} from "./chunk-GYQG4Q2N.js";
 import {
-  runSecurityScan
-} from "./chunk-SJ4DQFIJ.js";
+  aiStatus
+} from "./chunk-WUIC65QO.js";
+import {
+  runSecurityScan,
+  saveScan
+} from "./chunk-4IIBVTBS.js";
+import "./chunk-IDODPGTX.js";
+import "./chunk-UMWX4UTK.js";
 import {
   reviewChanges
-} from "./chunk-FVCDMQUQ.js";
+} from "./chunk-C25FDXOO.js";
+import "./chunk-Y6SDMZET.js";
 import {
   buildStatus
-} from "./chunk-ZB7LC6FP.js";
-import {
-  INSTANCE_FILE,
-  findRunningInstance,
-  runDoctor
-} from "./chunk-3XSDI5WF.js";
-import {
-  aiStatus
-} from "./chunk-RXNRMIZP.js";
-import "./chunk-VSYBC3VY.js";
+} from "./chunk-3KFOI2X4.js";
 import {
   ACTIVITY_FILE,
   activityFile,
@@ -53,7 +56,7 @@ import {
   readRecentEvents,
   rotatedActivityFile,
   summarizeSessions
-} from "./chunk-65TSRDQ3.js";
+} from "./chunk-P4TRQMES.js";
 import {
   printHeader
 } from "./chunk-SHKXELUX.js";
@@ -70,7 +73,7 @@ import {
   memoryDir,
   supersedeMemory,
   updateMemory
-} from "./chunk-TDNZ2RYA.js";
+} from "./chunk-F65QINMR.js";
 import "./chunk-3IS2X2Z7.js";
 import {
   c,
@@ -90,28 +93,27 @@ import {
   applySync,
   ignorePlan,
   staleForCheck
-} from "./chunk-KHMBNT66.js";
+} from "./chunk-PZPMWCXS.js";
 import {
   projectSession,
   releaseProjectSession
-} from "./chunk-WVQC2EGO.js";
+} from "./chunk-GU3ZX2J7.js";
 import "./chunk-GR4DL2VM.js";
 import {
   runPipeline
-} from "./chunk-GGXPG6OE.js";
-import {
-  SCAN_FILE,
-  saveScan
-} from "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+} from "./chunk-4FETKOY3.js";
 import {
   ATHENA_VERSION
 } from "./chunk-2R6PXY6Z.js";
+import {
+  SCAN_FILE
+} from "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -1447,4 +1449,4 @@ export {
   openBrowser,
   openCommand
 };
-//# sourceMappingURL=open-UJZRYF4E.js.map
+//# sourceMappingURL=open-LJMOB6U2.js.map

package/dist/{program-CWJNGCTZ.js → program-DCP526LU.js}

@@ -58,32 +58,46 @@ function buildProgram() {
   program.command("init").description("Analyze the project and create .athena/ knowledge").option("--agents <list>", 'Agents to configure: comma-separated ids (claude-code, cursor, codex, copilot, gemini-cli, antigravity, windsurf, cline, agents-md), "all" or "none". Default: detected agents + AGENTS.md').option("--no-agents", "Do not configure any agent integration").option("--dry-run", "Analyze and show what would be written, without writing").action(
     run(async (cmdOpts, cmd) => {
       const g = globals(cmd);
-      await (await import("./init-WQCAOJ2R.js")).initCommand({ ...g, agents: typeof cmdOpts.agents === "string" ? cmdOpts.agents : void 0, noAgents: cmdOpts.agents === false, dryRun: cmdOpts.dryRun, signal: controller.signal });
+      await (await import("./init-427QR5AS.js")).initCommand({ ...g, agents: typeof cmdOpts.agents === "string" ? cmdOpts.agents : void 0, noAgents: cmdOpts.agents === false, dryRun: cmdOpts.dryRun, signal: controller.signal });
     })
   );
-  program.command("analyze").description("Re-analyze the project and refresh generated knowledge (developer edits are preserved)").option("--force", "Regenerate sections even if they were edited by hand").option("--agents <list>", "Reconfigure these agent integrations").action(run(async (o, cmd) => (await import("./analyze-ZY3MXBOI.js")).analyzeCommand({ ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("sync").description("Review and apply knowledge updates for changes since the last analysis").option("-y, --yes", "Apply without asking").option("--dry-run", "Show the plan without writing").option("--check", "Exit with code 1 if knowledge is out of date (for CI/hooks)").option("--staged", "With --check: check the staged knowledge against the staged code (the index), ignoring untracked and unstaged changes").option("--diff", "Print full diffs of proposed document changes").option("--force", "Also regenerate sections that were edited by hand").action(run(async (o, cmd) => (await import("./sync-KFJANRXF.js")).syncCommand({ ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("watch").description("Watch the project and propose knowledge updates as files change").option("--auto-apply", "Apply updates automatically instead of proposing them").option("--debounce <ms>", "Quiet period before checking changes (default 1500)").action(run(async (o, cmd) => (await import("./watch-CY7QHIYN.js")).watchCommand({ ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("context <task>").description("Show which knowledge an agent should read for a task (deterministic)").option("--full", "Print the full context an agent would receive").option("--max-chars <n>", "Character budget for selected sections").action(run(async (task, o, cmd) => (await import("./context-PLPCAPCO.js")).contextCommand(task, { ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("graph").description("Inspect the project graph (packages, files, routes, entities and their relationships)").option("--build", "Rebuild the graph from the current code").option("--node <id>", "Show one node and its relationships").option("--kind <kind>", "Filter by node kind (package, file, route, entity, framework, command, infra)").option("--search <term>", "Filter nodes by name or path").action(run(async (o, cmd) => (await import("./context-PLPCAPCO.js")).graphCommand({ ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("architecture").description("Summarize the project graph").action(run(async (_o, cmd) => (await import("./context-PLPCAPCO.js")).architectureCommand({ ...globals(cmd), signal: controller.signal })));
-  program.command("mcp").description("Serve Athena project intelligence over MCP (stdio) for AI agents").option("--allow-write", "Permit the update_knowledge tool to apply changes (read-only by default)").option("--no-memory-write", "Disable the remember tool (agents cannot record unreviewed memories)").action(run(async (o, cmd) => (await import("./mcp-U7EPH43L.js")).mcpCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("analyze").description("Re-analyze the project and refresh generated knowledge (developer edits are preserved)").option("--force", "Regenerate sections even if they were edited by hand").option("--agents <list>", "Reconfigure these agent integrations").action(run(async (o, cmd) => (await import("./analyze-AP4XJT7D.js")).analyzeCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("sync").description("Review and apply knowledge updates for changes since the last analysis").option("-y, --yes", "Apply without asking").option("--dry-run", "Show the plan without writing").option("--check", "Exit with code 1 if knowledge is out of date (for CI/hooks)").option("--staged", "With --check: check the staged knowledge against the staged code (the index), ignoring untracked and unstaged changes").option("--diff", "Print full diffs of proposed document changes").option("--force", "Also regenerate sections that were edited by hand").action(run(async (o, cmd) => (await import("./sync-GVO2VHPI.js")).syncCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("watch").description("Watch the project and propose knowledge updates as files change").option("--auto-apply", "Apply updates automatically instead of proposing them").option("--debounce <ms>", "Quiet period before checking changes (default 1500)").action(run(async (o, cmd) => (await import("./watch-TEHFO47V.js")).watchCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("context <task>").description("Show which knowledge an agent should read for a task (deterministic)").option("--full", "Print the full context an agent would receive").option("--max-chars <n>", "Character budget for selected sections").action(run(async (task, o, cmd) => (await import("./context-G5YHY3L2.js")).contextCommand(task, { ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("graph").description("Inspect the project graph (packages, files, routes, entities and their relationships)").option("--build", "Rebuild the graph from the current code").option("--node <id>", "Show one node and its relationships").option("--kind <kind>", "Filter by node kind (package, file, route, entity, framework, command, infra)").option("--search <term>", "Filter nodes by name or path").action(run(async (o, cmd) => (await import("./context-G5YHY3L2.js")).graphCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("architecture").description("Summarize the project graph").action(run(async (_o, cmd) => (await import("./context-G5YHY3L2.js")).architectureCommand({ ...globals(cmd), signal: controller.signal })));
+  program.command("mcp").description("Serve Athena project intelligence over MCP (stdio) for AI agents").option("--allow-write", "Permit the update_knowledge tool to apply changes (read-only by default)").option("--no-memory-write", "Disable the remember tool (agents cannot record unreviewed memories)").action(run(async (o, cmd) => (await import("./mcp-DWNWRGJW.js")).mcpCommand({ ...globals(cmd), ...o, signal: controller.signal })));
   const ai = program.command("ai").description("Optional AI provider integration (never required)");
-  ai.command("status", { isDefault: true }).description("Show configured and available AI providers").action(run(async (_o, cmd) => (await import("./ai-ASL4FFQ7.js")).aiStatusCommand(globals(cmd))));
-  ai.command("enrich").description("Ask the configured provider for INFERRED suggestions based on your knowledge documents").option("--docs <list>", "Documents to send (default: project,architecture,database,api)").option("--consent", "Consent to sending redacted knowledge to a remote provider for this run").option("--dry-run", "Show exactly what would be sent, and send nothing").action(run(async (o, cmd) => (await import("./ai-ASL4FFQ7.js")).aiEnrichCommand({ ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("security").description("Scan dependencies with the audit tools installed for this project, and report secret findings").option("--no-audit", "Skip dependency audits (report secrets only)").option("--fail-on <severity>", "Exit 1 when a finding at or above this severity exists (critical, high, moderate, low)").option("--last", "Show the last scan instead of running a new one").option("--unrated <policy>", 'With --fail-on: "fail" (default) also fails on findings the tool did not rate (pip-audit, govulncheck); "warn" only reports them', "fail").action(run(async (o, cmd) => (await import("./security-LME3XFL3.js")).securityCommand({ ...globals(cmd), noAudit: o.audit === false, failOn: o.failOn, unrated: o.unrated, last: o.last, signal: controller.signal })));
-  program.command("review").description("Check the current diff for facts worth reviewing, and list the project rules and checklist").option("--base <ref>", "Compare against this Git ref instead of the working tree").option("--staged", "Review only what is staged for commit (used by the pre-commit hook)").option("--no-sync", "Skip the knowledge freshness check").option("--no-fail", "Always exit 0, even when blockers are found").action(run(async (o, cmd) => (await import("./review-OOKXSYMP.js")).reviewCommand({ ...globals(cmd), base: o.base, staged: o.staged, noSync: o.sync === false, noFail: o.fail === false, signal: controller.signal })));
-  program.command("status").description("Show knowledge health and changes since the last analysis").action(run(async (_o, cmd) => (await import("./status-RR57ZNGI.js")).statusCommand({ ...globals(cmd), signal: controller.signal })));
-  program.command("doctor").description("Check the Athena installation, project and integrations").action(run(async (_o, cmd) => (await import("./doctor-BX677KRE.js")).doctorCommand(globals(cmd))));
+  ai.command("status", { isDefault: true }).description("Show configured and available AI providers").action(run(async (_o, cmd) => (await import("./ai-LGTLQKL4.js")).aiStatusCommand(globals(cmd))));
+  ai.command("enrich").description("Ask the configured provider for INFERRED suggestions based on your knowledge documents").option("--docs <list>", "Documents to send (default: project,architecture,database,api)").option("--consent", "Consent to sending redacted knowledge to a remote provider for this run").option("--dry-run", "Show exactly what would be sent, and send nothing").action(run(async (o, cmd) => (await import("./ai-LGTLQKL4.js")).aiEnrichCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("security").description("Scan dependencies with the audit tools installed for this project, and report secret findings").option("--no-audit", "Skip dependency audits (report secrets only)").option("--fail-on <severity>", "Exit 1 when a finding at or above this severity exists (critical, high, moderate, low)").option("--last", "Show the last scan instead of running a new one").option("--unrated <policy>", 'With --fail-on: "fail" (default) also fails on findings the tool did not rate (pip-audit, govulncheck); "warn" only reports them', "fail").action(run(async (o, cmd) => (await import("./security-JTJN3E7K.js")).securityCommand({ ...globals(cmd), noAudit: o.audit === false, failOn: o.failOn, unrated: o.unrated, last: o.last, signal: controller.signal })));
+  const scanCmds = () => import("./scan-JVKCVHPD.js");
+  program.command("scan").description("Scan for secrets, vulnerable dependencies and review issues; apply the policy, baseline and triage; evaluate the quality gate").option("--only <scanners>", "Comma-separated: secrets, deps, review (default: secrets,deps; plus review when scanning a change)").option("--base <ref>", "Scan the changes since this ref (merge-base..HEAD, like a pull request)").option("--staged", "Scan what is staged for commit").option("--changed", "Scan working-tree changes").option("-f, --format <format>", "text, json, markdown, github or sarif").option("-o, --output <file>", "Write the report to a file").option("--fail-on <severity>", "Override the gate threshold: critical, high, medium, low, info").option("--min-confidence <level>", "Override the gate confidence: high, medium, low").option("--unrated <policy>", "Override how unrated findings affect the gate: fail or warn").option("--no-baseline", "Ignore .athena/baseline.json (every finding counts as new)").option("--policy-from <ref>", "Use the policy, baseline and triage committed at this ref, and report changes to them (CI)").option("--offline", "Do not contact the network (dependency audits are skipped and reported as skipped)").option("--no-fail", "Always exit 0, even when the gate fails").option("--list-rules", "List the rules Athena knows and exit").action(run(
+    async (o, cmd) => (await scanCmds()).scanCommand({ ...globals(cmd), ...o, noBaseline: o.baseline === false, noFail: o.fail === false, signal: controller.signal })
+  ));
+  program.command("explain <ruleId>").description("Explain a rule: what it detects, why it matters and what to do").action(run(async (ruleId, _o, cmd) => (await scanCmds()).explainCommand(ruleId, globals(cmd))));
+  const baseline = program.command("baseline").description("Record existing findings so only new ones fail the gate (.athena/baseline.json)");
+  baseline.command("show", { isDefault: true }).description("Summarize the baseline").action(run(async (_o, cmd) => (await scanCmds()).baselineShowCommand(globals(cmd))));
+  baseline.command("create").description("Scan the whole project and baseline every current finding").option("--reason <text>", "Why these findings are accepted for now").option("--last", "Use the last full scan instead of scanning again").option("--offline", "Do not contact the network").option("--force", "Add to an existing baseline").action(run(async (o, cmd) => (await scanCmds()).baselineCreateCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  baseline.command("update").description("Add findings that are not in the baseline yet").option("--reason <text>", "Why these findings are accepted for now").option("--last", "Use the last full scan instead of scanning again").option("--offline", "Do not contact the network").action(run(async (o, cmd) => (await scanCmds()).baselineCreateCommand({ ...globals(cmd), ...o, update: true, signal: controller.signal })));
+  baseline.command("prune").description("Remove entries a full scan no longer reports").option("--last", "Use the last full scan instead of scanning again").option("--offline", "Do not contact the network").action(run(async (o, cmd) => (await scanCmds()).baselinePruneCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  const findings = program.command("findings").description("Inspect and triage findings from the last scan");
+  findings.command("list", { isDefault: true }).description("List active findings with their fingerprints").option("--status <status>", "open, baselined, suppressed, excluded, triaged, or a triage decision such as to-review").option("--severity <severity>", "Only this severity").option("--category <category>", "Only this category").option("--all", "Include baselined, suppressed, triaged and excluded findings").action(run(async (o, cmd) => (await scanCmds()).findingsListCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  findings.command("show <fingerprint>").description("Show one finding (a fingerprint prefix of 6+ characters is enough)").action(run(async (fp, _o, cmd) => (await scanCmds()).findingsShowCommand(fp, { ...globals(cmd), signal: controller.signal })));
+  findings.command("triage <fingerprint> <status>").description('Record a review decision: safe, false-positive, accepted-risk, fixed, to-review (or "clear")').option("--reason <text>", "Why (required; committed in .athena/triage.json)").option("--by <name>", "Who decided").action(run(async (fp, status, o, cmd) => (await scanCmds()).findingsTriageCommand(fp, status, { ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("review").description("Check the current diff for facts worth reviewing, and list the project rules and checklist").option("--base <ref>", "Compare against this Git ref instead of the working tree").option("--staged", "Review only what is staged for commit (used by the pre-commit hook)").option("--no-sync", "Skip the knowledge freshness check").option("--no-fail", "Always exit 0, even when blockers are found").action(run(async (o, cmd) => (await import("./review-VEJBPACX.js")).reviewCommand({ ...globals(cmd), base: o.base, staged: o.staged, noSync: o.sync === false, noFail: o.fail === false, signal: controller.signal })));
+  program.command("status").description("Show knowledge health and changes since the last analysis").action(run(async (_o, cmd) => (await import("./status-PO27BSOZ.js")).statusCommand({ ...globals(cmd), signal: controller.signal })));
+  program.command("doctor").description("Check the Athena installation, project and integrations").action(run(async (_o, cmd) => (await import("./doctor-L34QJ7WR.js")).doctorCommand(globals(cmd))));
   const rules = program.command("rules").description("List and edit project rules (.athena/rules.md)");
-  rules.command("list", { isDefault: true }).description("List rules with their numbers").action(run(async (_o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesListCommand(globals(cmd))));
-  rules.command("add <text>").description("Add a rule").option("-s, --section <name>", "Section heading", "General").action(run(async (text, o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesAddCommand(text, { ...globals(cmd), ...o })));
-  rules.command("edit <number> <text>").description("Replace the text of a rule").action(run(async (n, text, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesEditCommand(n, text, globals(cmd))));
-  rules.command("enable <number>").description("Enable a rule").action(run(async (n, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesEnableCommand(n, globals(cmd))));
-  rules.command("disable <number>").description("Disable a rule without deleting it").action(run(async (n, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesDisableCommand(n, globals(cmd))));
-  rules.command("remove <number>").description("Delete a rule").action(run(async (n, _o, cmd) => (await import("./rules-4FXJUCXB.js")).rulesRemoveCommand(n, globals(cmd))));
+  rules.command("list", { isDefault: true }).description("List rules with their numbers").action(run(async (_o, cmd) => (await import("./rules-M4DLLXBL.js")).rulesListCommand(globals(cmd))));
+  rules.command("add <text>").description("Add a rule").option("-s, --section <name>", "Section heading", "General").action(run(async (text, o, cmd) => (await import("./rules-M4DLLXBL.js")).rulesAddCommand(text, { ...globals(cmd), ...o })));
+  rules.command("edit <number> <text>").description("Replace the text of a rule").action(run(async (n, text, _o, cmd) => (await import("./rules-M4DLLXBL.js")).rulesEditCommand(n, text, globals(cmd))));
+  rules.command("enable <number>").description("Enable a rule").action(run(async (n, _o, cmd) => (await import("./rules-M4DLLXBL.js")).rulesEnableCommand(n, globals(cmd))));
+  rules.command("disable <number>").description("Disable a rule without deleting it").action(run(async (n, _o, cmd) => (await import("./rules-M4DLLXBL.js")).rulesDisableCommand(n, globals(cmd))));
+  rules.command("remove <number>").description("Delete a rule").action(run(async (n, _o, cmd) => (await import("./rules-M4DLLXBL.js")).rulesRemoveCommand(n, globals(cmd))));
   const repeat = (value, prev = []) => [...prev, ...value.split(",").map((s) => s.trim()).filter(Boolean)];
-  const mem = () => import("./memory-VSVNLEJC.js");
+  const mem = () => import("./memory-XBZCYQLW.js");
   const memory = program.command("memory").description("Record, review and recall project memory (.athena/memory/)");
   memory.command("list", { isDefault: true }).description("List memory entries with their label (FACT/INFERRED), status and staleness").option("--kind <kind>", "Only this kind (decision, gotcha, bug, convention, todo, fact)").option("--status <status>", "Only this status (unreviewed, confirmed, superseded)").option("--stale", "Only entries whose linked files changed since").action(run(async (o, cmd) => (await mem()).memoryListCommand({ ...globals(cmd), ...o })));
   memory.command("show <id>").description("Show one entry in full: files, tags, evidence, staleness, warnings").action(run(async (id, _o, cmd) => (await mem()).memoryShowCommand(id, globals(cmd))));
@@ -97,22 +111,22 @@ function buildProgram() {
   memory.command("stale").description("Entries whose linked files changed since they were recorded or confirmed").action(run(async (_o, cmd) => (await mem()).memoryStaleCommand(globals(cmd))));
   memory.command("review").description("Walk through unreviewed (agent-written) entries: confirm, forget or skip").action(run(async (_o, cmd) => (await mem()).memoryReviewCommand(globals(cmd))));
   const agents = program.command("agents").description("Manage AI agent integrations");
-  agents.command("list", { isDefault: true }).description("Show supported agents and integration status").action(run(async (_o, cmd) => (await import("./agents-DFSNEOP5.js")).agentsListCommand(globals(cmd))));
-  agents.command("add <agents...>").description('Configure integrations (claude-code, cursor, codex, copilot, gemini-cli, antigravity, windsurf, cline, agents-md, or "all")').action(run(async (names, _o, cmd) => (await import("./agents-DFSNEOP5.js")).agentsAddCommand(names, globals(cmd))));
-  agents.command("remove <agents...>").description("Remove Athena-managed integration files/blocks").action(run(async (names, _o, cmd) => (await import("./agents-DFSNEOP5.js")).agentsRemoveCommand(names, globals(cmd))));
+  agents.command("list", { isDefault: true }).description("Show supported agents and integration status").action(run(async (_o, cmd) => (await import("./agents-HUJ4JXIB.js")).agentsListCommand(globals(cmd))));
+  agents.command("add <agents...>").description('Configure integrations (claude-code, cursor, codex, copilot, gemini-cli, antigravity, windsurf, cline, agents-md, or "all")').action(run(async (names, _o, cmd) => (await import("./agents-HUJ4JXIB.js")).agentsAddCommand(names, globals(cmd))));
+  agents.command("remove <agents...>").description("Remove Athena-managed integration files/blocks").action(run(async (names, _o, cmd) => (await import("./agents-HUJ4JXIB.js")).agentsRemoveCommand(names, globals(cmd))));
   const gitHook = program.command("git-hook").description("Install a Git pre-commit hook that blocks commits when knowledge is out of date");
-  gitHook.command("status", { isDefault: true }).description("Show whether the Athena pre-commit hook is installed").action(run(async (_o, cmd) => (await import("./git-hook-YZNZGAAP.js")).gitHookStatusCommand(globals(cmd))));
-  gitHook.command("install").description("Add the Athena pre-commit hook (existing hooks are kept; Athena adds a marked block)").option("--review", "Also run `athena review` and block commits with possible secrets or env files").action(run(async (o, cmd) => (await import("./git-hook-YZNZGAAP.js")).gitHookInstallCommand({ ...globals(cmd), review: o.review })));
-  gitHook.command("uninstall").description("Remove Athena's pre-commit hook or block").action(run(async (_o, cmd) => (await import("./git-hook-YZNZGAAP.js")).gitHookUninstallCommand(globals(cmd))));
-  program.command("open").description("Start (or reuse) the local web UI and open it in your browser").option("-p, --port <port>", "Port to bind (default: first free port from 7432)").option("--host <host>", "Interface to bind (default: 127.0.0.1)").option("--allow-remote", "Allow binding to a non-loopback interface").option("--no-open", "Do not launch a browser").option("--no-watch", "Do not watch the project for changes").action(run(async (o, cmd) => (await import("./open-UJZRYF4E.js")).openCommand({ ...globals(cmd), ...o, signal: controller.signal })));
-  program.command("activity").description("Show AI agent activity observed through hooks").option("-n, --limit <count>", "Number of events to show (default 30)").option("--agent <id>", "Only show events from this agent").action(run(async (o, cmd) => (await import("./activity-BKW7G4I5.js")).activityCommand({ ...globals(cmd), ...o })));
+  gitHook.command("status", { isDefault: true }).description("Show whether the Athena pre-commit hook is installed").action(run(async (_o, cmd) => (await import("./git-hook-Y7Y262F7.js")).gitHookStatusCommand(globals(cmd))));
+  gitHook.command("install").description("Add the Athena pre-commit hook (existing hooks are kept; Athena adds a marked block)").option("--review", "Also run `athena review` and block commits with possible secrets or env files").action(run(async (o, cmd) => (await import("./git-hook-Y7Y262F7.js")).gitHookInstallCommand({ ...globals(cmd), review: o.review })));
+  gitHook.command("uninstall").description("Remove Athena's pre-commit hook or block").action(run(async (_o, cmd) => (await import("./git-hook-Y7Y262F7.js")).gitHookUninstallCommand(globals(cmd))));
+  program.command("open").description("Start (or reuse) the local web UI and open it in your browser").option("-p, --port <port>", "Port to bind (default: first free port from 7432)").option("--host <host>", "Interface to bind (default: 127.0.0.1)").option("--allow-remote", "Allow binding to a non-loopback interface").option("--no-open", "Do not launch a browser").option("--no-watch", "Do not watch the project for changes").action(run(async (o, cmd) => (await import("./open-LJMOB6U2.js")).openCommand({ ...globals(cmd), ...o, signal: controller.signal })));
+  program.command("activity").description("Show AI agent activity observed through hooks").option("-n, --limit <count>", "Number of events to show (default 30)").option("--agent <id>", "Only show events from this agent").action(run(async (o, cmd) => (await import("./activity-XCHKBZTG.js")).activityCommand({ ...globals(cmd), ...o })));
   program.command("event").description("Record an agent hook event (called by AI coding agents, reads JSON on stdin)").option("--agent <id>", "Agent that fired the hook").option("--hook <name>", "Hook event name").option("--athena-hook", "Marker used to identify Athena-managed hook entries").option("--verbose-errors", "Print errors to stderr (hooks stay silent by default)").action(
     run(async (o, cmd) => {
       const g = globals(cmd);
-      await (await import("./event-TNT6CQZR.js")).eventCommand({ agent: o.agent, hook: o.hook, cwd: g.cwd, verbose: o.verboseErrors });
+      await (await import("./event-6YW6TGFI.js")).eventCommand({ agent: o.agent, hook: o.hook, cwd: g.cwd, verbose: o.verboseErrors });
     })
   );
-  program.command("clean").description("Remove .athena/ and Athena agent integrations").option("-y, --yes", "Skip confirmation").option("--keep-agents", "Keep agent integration files/blocks").action(run(async (o, cmd) => (await import("./clean-MDBYH62P.js")).cleanCommand({ ...globals(cmd), ...o })));
+  program.command("clean").description("Remove .athena/ and Athena agent integrations").option("-y, --yes", "Skip confirmation").option("--keep-agents", "Keep agent integration files/blocks").action(run(async (o, cmd) => (await import("./clean-LQOG56AM.js")).cleanCommand({ ...globals(cmd), ...o })));
   program.command("version").description("Print the Athena version").action(run(async (_o, cmd) => {
     if (globals(cmd).json) json({ version: ATHENA_VERSION, node: process.versions.node, platform: process.platform });
     else line(ATHENA_VERSION);
@@ -162,4 +176,4 @@ export {
   buildProgram,
   main
 };
-//# sourceMappingURL=program-CWJNGCTZ.js.map
+//# sourceMappingURL=program-DCP526LU.js.map

package/dist/{review-OOKXSYMP.js → review-VEJBPACX.js}

@@ -2,7 +2,8 @@
 import {
   hasBlockers,
   reviewChanges
-} from "./chunk-FVCDMQUQ.js";
+} from "./chunk-C25FDXOO.js";
+import "./chunk-Y6SDMZET.js";
 import "./chunk-3IS2X2Z7.js";
 import {
   c,
@@ -22,18 +23,18 @@ import "./chunk-KBO7XRBW.js";
 import {
   planSync,
   staleForCheck
-} from "./chunk-KHMBNT66.js";
-import "./chunk-WVQC2EGO.js";
+} from "./chunk-PZPMWCXS.js";
+import "./chunk-GU3ZX2J7.js";
 import "./chunk-GR4DL2VM.js";
-import "./chunk-GGXPG6OE.js";
-import "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+import "./chunk-4FETKOY3.js";
 import "./chunk-2R6PXY6Z.js";
+import "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -114,4 +115,4 @@ ${blockers} blocker${blockers === 1 ? "" : "s"} found.`));
 export {
   reviewCommand
 };
-//# sourceMappingURL=review-OOKXSYMP.js.map
+//# sourceMappingURL=review-VEJBPACX.js.map

package/dist/{rules-4FXJUCXB.js → rules-M4DLLXBL.js}

@@ -2,7 +2,7 @@
 import {
   getRules,
   mutateRules
-} from "./chunk-LEMPCNAY.js";
+} from "./chunk-56EXAGTM.js";
 import {
   addRule,
   removeRule,
@@ -20,8 +20,8 @@ import {
   requireProjectRoot
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-OLPSEQS5.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-AKOI4VTD.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
@@ -80,4 +80,4 @@ export {
   rulesListCommand,
   rulesRemoveCommand
 };
-//# sourceMappingURL=rules-4FXJUCXB.js.map
+//# sourceMappingURL=rules-M4DLLXBL.js.map