runbrief 0.1.2 → 0.1.3

package/dist/cli.js

@@ -6,7 +6,7 @@ var __esm = (fn, res) => function __init() {
 
 // ../contracts/dist/index.js
 import { z } from "zod";
-var privacyModeSchema, enforcementSchema, skillStatusSchema, learningStatusSchema, findingSeveritySchema, prReadinessVerdictSchema, preCodingContextProofSchema, prReadinessCheckStatusSchema, prReadinessGateIdSchema, prReadinessGateStatusSchema, prReadinessStatusSchema, prReadinessDeliveryModeSchema, githubCheckConclusionSchema, agentSurfaceModeSchema, agentSurfaceCategorySchema, agentSurfaceCredentialStorageSchema, agentSurfaceRepoResolutionSchema, agentSurfaceTrustBoundarySchema, briefProofStateSchema, briefToolNameSchema, agentSurfaceContractSchema, briefRunPhaseSchema, briefRunContractSchema, briefProofContractSchema, repoRefSchema, scanStatsSchema, sourceDocumentSchema, ruleSchema, betaReadinessSchema, skillSchema, mapNodeSchema, reviewMemorySchema, wikiEvidenceItemSchema, wikiPageTypeSchema, wikiPageEvidenceMixSchema, wikiPageEntitySchema, wikiPageFreshnessSchema, wikiPageSourceProofSchema, wikiPageAgentBriefSchema, wikiPageQualitySchema, wikiPageSchema, prReadinessFindingSchema, prReadinessPullRequestSchema, prReadinessContextProofInputSchema, prReadinessCheckSchema, prReadinessGateResultSchema, prReadinessContractSchema, prReadinessReportRequestSchema, severityCountsSchema, prReadinessAnnotationSchema, prReadinessGithubCheckSchema, prReadinessReportSchema, prReadinessReportResponseSchema, repoScanSummarySchema, syncScanRequestSchema, teamGuidanceItemSchema, teamGuidanceDeliverySchema, contextPacketSchema, contextReceiptRequestSchema, missionRecipeIdSchema, missionWorkItemSchema, missionRuntimeEvidenceSchema, runtimeEvidencePullInstructionSchema, runtimeEvidencePacketSchema, missionHandoffValidationSchema, missionHandoffReviewReadinessSchema, missionHandoffReviewSchema, missionHandoffProofStatusSchema, missionHandoffValidationSummarySchema, missionHandoffArtifactEvidenceSchema, missionHandoffArtifactProofSchema, missionHandoffChangedFileAttributionSchema, missionHandoffProofBundleSchema, missionHandoffRequestSchema, evidenceRedactionFindingSchema, evidenceRedactionReportSchema, learningCreateRequestSchema, teamContextRequestSchema, teamContextResponseSchema, apiAcceptedResponseSchema;
+var privacyModeSchema, loopRunStatusSchema, loopRunProofSchema, loopRunSummarySchema, createLoopRunRequestSchema, claimLoopRunRequestSchema, updateLoopRunRequestSchema, enforcementSchema, skillStatusSchema, learningStatusSchema, findingSeveritySchema, prReadinessVerdictSchema, preCodingContextProofSchema, prReadinessCheckStatusSchema, prReadinessGateIdSchema, prReadinessGateStatusSchema, prReadinessStatusSchema, prReadinessDeliveryModeSchema, githubCheckConclusionSchema, agentSurfaceModeSchema, agentSurfaceCategorySchema, agentSurfaceCredentialStorageSchema, agentSurfaceRepoResolutionSchema, agentSurfaceTrustBoundarySchema, briefProofStateSchema, briefToolNameSchema, agentSurfaceContractSchema, briefRunPhaseSchema, briefRunContractSchema, briefProofContractSchema, repoRefSchema, scanStatsSchema, sourceDocumentSchema, ruleSchema, betaReadinessSchema, skillSchema, mapNodeSchema, reviewMemorySchema, wikiEvidenceItemSchema, wikiPageTypeSchema, wikiPageEvidenceMixSchema, wikiPageEntitySchema, wikiPageFreshnessSchema, wikiPageSourceProofSchema, wikiPageAgentBriefSchema, wikiPageQualitySchema, wikiPageSchema, prReadinessFindingSchema, prReadinessPullRequestSchema, prReadinessContextProofInputSchema, prReadinessCheckSchema, prReadinessGateResultSchema, prReadinessContractSchema, prReadinessReportRequestSchema, severityCountsSchema, prReadinessAnnotationSchema, prReadinessGithubCheckSchema, prReadinessReportSchema, prReadinessReportResponseSchema, repoScanSummarySchema, syncScanRequestSchema, teamGuidanceItemSchema, teamGuidanceDeliverySchema, dependencyPackageSignalSchema, dependencyRemediationSchema, contextPacketSchema, contextReceiptRequestSchema, missionRecipeIdSchema, missionWorkItemSchema, missionRuntimeEvidenceSchema, runtimeEvidencePullInstructionSchema, runtimeEvidencePacketSchema, missionHandoffValidationSchema, missionHandoffReviewReadinessSchema, missionHandoffReviewSchema, missionHandoffProofStatusSchema, missionHandoffValidationSummarySchema, missionHandoffArtifactEvidenceSchema, missionHandoffArtifactProofSchema, missionHandoffChangedFileAttributionSchema, missionHandoffProofBundleSchema, missionHandoffRequestSchema, evidenceRedactionFindingSchema, evidenceRedactionReportSchema, learningCreateRequestSchema, teamContextRequestSchema, teamContextResponseSchema, apiAcceptedResponseSchema;
 var init_dist = __esm({
   "../contracts/dist/index.js"() {
     "use strict";
@@ -15,6 +15,56 @@ var init_dist = __esm({
       "cloud-sync-derived",
       "team-cloud"
     ]);
+    loopRunStatusSchema = z.enum([
+      "queued",
+      "running",
+      "succeeded",
+      "failed",
+      "cancelled"
+    ]);
+    loopRunProofSchema = z.record(z.string(), z.unknown());
+    loopRunSummarySchema = z.object({
+      id: z.string().uuid(),
+      workspaceId: z.string().uuid(),
+      loopId: z.string().uuid(),
+      loopName: z.string().min(1),
+      loopBody: z.string().min(1),
+      guardrails: z.array(z.string().min(1)).max(30),
+      loopVersion: z.number().int().positive(),
+      task: z.string().min(1).max(12e3),
+      repoFullName: z.string().min(1).max(240).optional(),
+      autonomy: z.enum(["read_only", "repo_edit", "validate", "handoff"]),
+      status: loopRunStatusSchema,
+      attemptCount: z.number().int().nonnegative(),
+      runnerId: z.string().min(1).max(160).nullable(),
+      leaseExpiresAt: z.string().datetime().nullable(),
+      lastEvent: z.string().max(2e3).nullable(),
+      resultSummary: z.string().max(12e3).nullable(),
+      proof: loopRunProofSchema,
+      errorMessage: z.string().max(4e3).nullable(),
+      createdAt: z.string().datetime(),
+      startedAt: z.string().datetime().nullable(),
+      completedAt: z.string().datetime().nullable()
+    });
+    createLoopRunRequestSchema = z.object({
+      loopId: z.string().uuid(),
+      task: z.string().trim().min(1).max(12e3),
+      repoFullName: z.string().trim().min(1).max(240).optional(),
+      idempotencyKey: z.string().trim().min(16).max(160)
+    });
+    claimLoopRunRequestSchema = z.object({
+      runnerId: z.string().trim().min(1).max(160),
+      leaseSeconds: z.number().int().min(30).max(900).default(180)
+    });
+    updateLoopRunRequestSchema = z.object({
+      runnerId: z.string().trim().min(1).max(160),
+      status: loopRunStatusSchema,
+      lastEvent: z.string().trim().max(2e3).optional(),
+      resultSummary: z.string().trim().max(12e3).optional(),
+      proof: loopRunProofSchema.optional(),
+      errorMessage: z.string().trim().max(4e3).optional(),
+      leaseSeconds: z.number().int().min(30).max(900).optional()
+    });
     enforcementSchema = z.enum([
       "advisory",
       "warn",
@@ -621,6 +671,46 @@ var init_dist = __esm({
       applied: z.array(teamGuidanceItemSchema).max(100),
       omittedCount: z.number().int().nonnegative()
     });
+    dependencyPackageSignalSchema = z.object({
+      name: z.string().min(1).max(160),
+      changeKind: z.enum([
+        "patch_or_minor",
+        "major",
+        "added_or_overridden",
+        "unknown"
+      ]),
+      manifestPaths: z.array(z.string().min(1).max(500)).max(20),
+      lockfilePaths: z.array(z.string().min(1).max(500)).max(20),
+      evidence: z.array(z.string().min(1).max(120)).max(10)
+    });
+    dependencyRemediationSchema = z.object({
+      id: z.string().min(1).max(120),
+      status: z.enum(["ready", "needs_evidence"]),
+      packageManager: z.enum([
+        "pnpm",
+        "npm",
+        "yarn",
+        "bun",
+        "pip",
+        "bundler",
+        "go",
+        "cargo",
+        "unknown"
+      ]),
+      manifestFiles: z.array(z.string().min(1).max(500)).max(30),
+      lockfiles: z.array(z.string().min(1).max(500)).max(20),
+      workspaceFiles: z.array(z.string().min(1).max(500)).max(20),
+      changedDependencyFiles: z.array(z.string().min(1).max(500)).max(30),
+      directDependencyFiles: z.array(z.string().min(1).max(500)).max(30),
+      packageSignals: z.array(dependencyPackageSignalSchema).max(20),
+      graphCommands: z.array(z.string().min(1).max(500)).max(20),
+      remediationCommands: z.array(z.string().min(1).max(500)).max(20),
+      validationCommands: z.array(z.string().min(1).max(500)).max(20),
+      residualRiskChecks: z.array(z.string().min(1).max(800)).max(20),
+      handoffRequirements: z.array(z.string().min(1).max(800)).max(20),
+      summary: z.string().max(1200),
+      confidence: z.number().min(0).max(100)
+    });
     contextPacketSchema = z.object({
       packetId: z.string().min(1),
       createdAt: z.string().datetime(),
@@ -643,7 +733,8 @@ var init_dist = __esm({
         appliedTeamGuidanceCount: z.number().int().nonnegative(),
         suggestedTestCount: z.number().int().nonnegative()
       }).optional(),
-      teamGuidance: teamGuidanceDeliverySchema.optional()
+      teamGuidance: teamGuidanceDeliverySchema.optional(),
+      dependencyRemediation: dependencyRemediationSchema.optional()
     });
     contextReceiptRequestSchema = z.object({
       workspaceId: z.string().uuid().optional(),
@@ -5296,22 +5387,22 @@ function likelyRuleLine(line) {
   return hasStrongRule || hasOperationalRule;
 }
 function scopeFromPath(sourcePath, kind) {
-  const path20 = sourcePath.replaceAll("\\", "/");
-  const directoryScope = scopedDirectory(path20);
-  if (directoryScope && (path20.endsWith("/AGENTS.md") || path20.endsWith("/CLAUDE.md")))
+  const path21 = sourcePath.replaceAll("\\", "/");
+  const directoryScope = scopedDirectory(path21);
+  if (directoryScope && (path21.endsWith("/AGENTS.md") || path21.endsWith("/CLAUDE.md")))
     return [directoryScope];
-  if (path20.includes("client/") || kind === "frontend")
+  if (path21.includes("client/") || kind === "frontend")
     return ["client/**", "packages/ui/**"];
-  if (path20.includes("server/") || kind === "persistence")
+  if (path21.includes("server/") || kind === "persistence")
     return ["server/**"];
-  if (path20.includes(".github/") || kind === "workflow")
+  if (path21.includes(".github/") || kind === "workflow")
     return ["**/*"];
-  if (path20.includes("test") || kind === "testing")
+  if (path21.includes("test") || kind === "testing")
     return ["**/*.test.*", "**/*.spec.*", "tests/**"];
   return ["**/*"];
 }
-function scopedDirectory(path20) {
-  const parts = path20.split("/");
+function scopedDirectory(path21) {
+  const parts = path21.split("/");
   if (parts.length <= 1)
     return null;
   const directory = parts.slice(0, -1).join("/");
@@ -8605,7 +8696,7 @@ function agentPacketPrompt(input) {
   ].filter(Boolean).join(" ");
 }
 function inspectReasonForNode(node) {
-  const path20 = pathKey(node);
+  const path21 = pathKey(node);
   const systems = metadataStrings2(node, "systems");
   const tables = metadataStrings2(node, "tables");
   const access = metadataStrings2(node, "accessControls");
@@ -8625,7 +8716,7 @@ function inspectReasonForNode(node) {
     return "Entrypoint that frames runtime flow.";
   if (node.type === "component")
     return "UI component surface in mapped scope.";
-  return `Mapped ${node.type} node for ${path20}.`;
+  return `Mapped ${node.type} node for ${path21}.`;
 }
 function strongestEntityEvidenceKind(nodes, kind, name) {
   const matchingNodes = nodes.filter((node) => metadataStrings2(node, metadataKeyForEntity(kind)).includes(name));
@@ -8698,17 +8789,17 @@ function topFacet(nodes, key, limit) {
 function topAreaFacet(nodes, limit) {
   const areas = /* @__PURE__ */ new Map();
   for (const node of nodes) {
-    const path20 = pathKey(node);
-    const prefix = areaPrefix(path20);
+    const path21 = pathKey(node);
+    const prefix = areaPrefix(path21);
     const entry = areas.get(prefix) ?? {
       paths: /* @__PURE__ */ new Set(),
       codeSurfaceCount: 0,
       systems: /* @__PURE__ */ new Set()
     };
-    if (!entry.paths.has(path20) && CODE_SURFACE_TYPES.has(node.type)) {
+    if (!entry.paths.has(path21) && CODE_SURFACE_TYPES.has(node.type)) {
       entry.codeSurfaceCount += 1;
     }
-    entry.paths.add(path20);
+    entry.paths.add(path21);
     for (const system of metadataStrings2(node, "systems")) {
       entry.systems.add(system);
     }
@@ -10564,7 +10655,7 @@ function wikiBuildPipeline(scan, pages, operationalAtlas, loopPlaybooks, refresh
     },
     {
       id: "publish",
-      title: "Publish for loops",
+      title: "Share with loops",
       status: "ready",
       summary: "Mission planning and context packets can cite wiki pages as source-grounded operating context.",
       evidence: ["brief.wiki_outline", "brief.context_for_task"]
@@ -10992,7 +11083,7 @@ function loopPlaybookSpec(loopId) {
   if (loopId === "session_library") {
     return {
       title: "Session library loop",
-      summary: "Promote proven agent runs into reusable team skills, loops, styles, and run cards without publishing raw transcripts by default.",
+      summary: "Promote proven agent runs into reusable team skills, loops, styles, and run cards without sharing raw transcripts by default.",
       tools: [
         "brief.agent_session_insights",
         "brief.value_report",
@@ -11013,7 +11104,7 @@ function loopPlaybookSpec(loopId) {
       ],
       privacyBoundary: [
         ...common.privacyBoundary,
-        "Publish concise run cards and styles, not raw private sessions, unless explicitly approved."
+        "Share concise run cards and styles, not raw private sessions, unless explicitly approved."
       ],
       systemHints: ["github", "ci"],
       queryHint: "agent session receipts run cards skills loops styles",
@@ -11204,7 +11295,7 @@ function wikiUsageReceipts(pages, options2) {
       loopId: "session_library",
       tool: "brief.mission_plan",
       pageIds: pageIds("Session Library", "Review Memory", "Team Standards", "Maintainers"),
-      reason: "Session library loops need approved examples, privacy decisions, maintainer context, and reusable team standards before publishing run cards or skills."
+      reason: "Session library loops need approved examples, privacy decisions, maintainer context, and reusable team standards before sharing run cards or skills."
     },
     {
       id: `wiki_use_${contentHash("docs:overview:structure")}`,
@@ -11387,9 +11478,9 @@ var init_contextWiki = __esm({
 });
 
 // ../core/dist/pathIntent.js
-function namedCodePathIntentScore(path20, task) {
+function namedCodePathIntentScore(path21, task) {
   const normalizedTask = task.toLowerCase().replace(/[_-]+/g, " ");
-  const normalizedPath = (path20.split("#", 1)[0] ?? path20).toLowerCase();
+  const normalizedPath = (path21.split("#", 1)[0] ?? path21).toLowerCase();
   let score = 0;
   const namedTargets = [
     [/\breview diff\b/, /diffreview|diff[-_]review/],
@@ -11535,9 +11626,476 @@ var init_pathIntent = __esm({
   }
 });
 
+// ../core/dist/dependencyRemediation.js
+import path6 from "node:path";
+function buildDependencyRemediationPlan(repoRoot, request) {
+  const files = walkFiles(repoRoot, request.maxFiles ?? 6e3);
+  const manifests = files.filter(isDependencyManifest);
+  const lockfiles = files.filter(isDependencyLockfile);
+  const workspaceFiles = files.filter(isDependencyWorkspaceFile);
+  const changedDependencyFiles = unique((request.changedFiles ?? []).filter(isDependencyFile));
+  const packageManager = inferPackageManager(repoRoot, manifests, lockfiles);
+  const packageSignalInput = {
+    task: request.task,
+    manifests,
+    changedDependencyFiles
+  };
+  if (request.diff)
+    packageSignalInput.diff = request.diff;
+  const packageSignals = packageSignalsFor(repoRoot, packageSignalInput);
+  const directDependencyFiles = unique(packageSignals.flatMap((signal2) => signal2.manifestPaths));
+  const packageNames = packageSignals.map((signal2) => signal2.name);
+  const validationCommands2 = validationCommandsFor2(repoRoot, packageManager);
+  const graphCommands = dependencyGraphCommandsFor(packageManager, packageNames);
+  const remediationCommands = remediationCommandsFor(packageManager, packageNames);
+  const residualRiskChecks = residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles);
+  const confidence = confidenceFor({
+    changedDependencyFiles,
+    packageSignals,
+    lockfiles,
+    validationCommands: validationCommands2
+  });
+  return {
+    id: `dep_${contentHash([
+      request.task,
+      packageManager,
+      changedDependencyFiles.join(","),
+      packageNames.join(",")
+    ].join(":"))}`,
+    status: changedDependencyFiles.length > 0 || packageSignals.length > 0 ? "ready" : "needs_evidence",
+    packageManager,
+    manifestFiles: manifests.slice(0, 20),
+    lockfiles,
+    workspaceFiles,
+    changedDependencyFiles,
+    directDependencyFiles,
+    packageSignals,
+    graphCommands,
+    remediationCommands,
+    validationCommands: validationCommands2,
+    residualRiskChecks,
+    handoffRequirements: [
+      "List advisory ids or scanner finding ids that were fixed.",
+      "Name packages still present in the lockfile with vulnerable versions, or state that the scan/audit is clean.",
+      "Explain any major-version upgrades, overrides, peer dependency changes, skipped advisories, or remaining advisory ids.",
+      "Attach validation commands and CI follow-up results before marking the security mission done."
+    ],
+    summary: summaryFor3({
+      packageManager,
+      manifests,
+      lockfiles,
+      changedDependencyFiles,
+      packageSignals,
+      validationCommands: validationCommands2
+    }),
+    confidence
+  };
+}
+function isDependencyRemediationTask(task, files = []) {
+  const normalized = task.toLowerCase();
+  const hasSecuritySignal = /\b(dependabot|vulnerab\w*|cve-|ghsa-|security advisory|security finding|audit finding|osv|sca|dependency-review)\b/.test(normalized);
+  const hasDependencyChangeSignal = /\b(dependency|dependencies|lockfile|package upgrade|package update|package bump|transitive|override|resolution)\b/.test(normalized);
+  return hasSecuritySignal || hasDependencyChangeSignal && files.some(isDependencyFile);
+}
+function isDependencyFile(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return dependencyFilePatterns.some((pattern) => normalized === pattern || normalized.endsWith(`/${pattern}`) || pattern === "package.json" && normalized.endsWith("/package.json"));
+}
+function isDependencyLockfile(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized === "pnpm-lock.yaml" || normalized.endsWith("/pnpm-lock.yaml") || normalized === "package-lock.json" || normalized.endsWith("/package-lock.json") || normalized === "yarn.lock" || normalized.endsWith("/yarn.lock") || normalized === "bun.lock" || normalized.endsWith("/bun.lock") || normalized === "npm-shrinkwrap.json" || normalized.endsWith("/npm-shrinkwrap.json") || normalized === "poetry.lock" || normalized.endsWith("/poetry.lock") || normalized === "Pipfile.lock" || normalized.endsWith("/Pipfile.lock") || normalized === "Gemfile.lock" || normalized.endsWith("/Gemfile.lock") || normalized === "go.sum" || normalized.endsWith("/go.sum") || normalized === "Cargo.lock" || normalized.endsWith("/Cargo.lock");
+}
+function isDependencyManifest(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized === "package.json" || normalized.endsWith("/package.json") || normalized === "requirements.txt" || normalized.endsWith("/requirements.txt") || normalized === "pyproject.toml" || normalized.endsWith("/pyproject.toml") || normalized === "Gemfile" || normalized.endsWith("/Gemfile") || normalized === "go.mod" || normalized.endsWith("/go.mod") || normalized === "Cargo.toml" || normalized.endsWith("/Cargo.toml");
+}
+function isDependencyWorkspaceFile(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized === "pnpm-workspace.yaml" || normalized.endsWith("/pnpm-workspace.yaml") || normalized === "lerna.json" || normalized.endsWith("/lerna.json") || normalized === "turbo.json" || normalized.endsWith("/turbo.json") || normalized === "nx.json" || normalized.endsWith("/nx.json");
+}
+function inferPackageManager(repoRoot, manifests, lockfiles) {
+  const rootPackageJson = readPackageJson(repoRoot, "package.json");
+  const packageManager = rootPackageJson?.packageManager;
+  if (typeof packageManager === "string") {
+    if (packageManager.startsWith("pnpm@"))
+      return "pnpm";
+    if (packageManager.startsWith("yarn@"))
+      return "yarn";
+    if (packageManager.startsWith("npm@"))
+      return "npm";
+    if (packageManager.startsWith("bun@"))
+      return "bun";
+  }
+  if (lockfiles.some((file) => file.endsWith("pnpm-lock.yaml")))
+    return "pnpm";
+  if (lockfiles.some((file) => file.endsWith("yarn.lock")))
+    return "yarn";
+  if (lockfiles.some((file) => file.endsWith("package-lock.json"))) {
+    return "npm";
+  }
+  if (lockfiles.some((file) => file.endsWith("bun.lock")))
+    return "bun";
+  if (manifests.some((file) => file.endsWith("requirements.txt") || file.endsWith("pyproject.toml") || file.endsWith("Pipfile"))) {
+    return "pip";
+  }
+  if (manifests.some((file) => file.endsWith("Gemfile")))
+    return "bundler";
+  if (manifests.some((file) => file.endsWith("go.mod")))
+    return "go";
+  if (manifests.some((file) => file.endsWith("Cargo.toml")))
+    return "cargo";
+  return "unknown";
+}
+function packageSignalsFor(repoRoot, input) {
+  const manifestDeps = dependencyNamesByManifest(repoRoot, input.manifests);
+  const explicitPackageNames = unique([
+    ...packagesMentionedInText(input.task),
+    ...packagesMentionedInDiff(input.diff ?? "")
+  ]).filter((name) => !looksLikeVersionOrAdvisory(name));
+  const fallbackPackageNames = input.changedDependencyFiles.flatMap((file) => packagesFromChangedDependencyFile(repoRoot, file));
+  const packageNames = unique(explicitPackageNames.length > 0 ? explicitPackageNames : fallbackPackageNames).filter((name) => !looksLikeVersionOrAdvisory(name));
+  return packageNames.slice(0, 16).map((name) => ({
+    name,
+    changeKind: changeKindFor(name, input.diff ?? ""),
+    manifestPaths: manifestsForPackage(name, manifestDeps),
+    lockfilePaths: input.changedDependencyFiles.filter(isDependencyLockfile),
+    evidence: evidenceForPackage(name, input.task, input.diff ?? "")
+  }));
+}
+function dependencyNamesByManifest(repoRoot, manifests) {
+  const byPackage = /* @__PURE__ */ new Map();
+  for (const manifest of manifests) {
+    if (!manifest.endsWith("package.json"))
+      continue;
+    const parsed = readPackageJson(repoRoot, manifest);
+    if (!parsed)
+      continue;
+    for (const name of packageJsonDependencyNames(parsed)) {
+      const current = byPackage.get(name) ?? [];
+      current.push(manifest);
+      byPackage.set(name, current);
+    }
+  }
+  return byPackage;
+}
+function packageJsonDependencyNames(parsed) {
+  return unique([
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies",
+    "overrides",
+    "resolutions",
+    "pnpm"
+  ].flatMap((field) => nestedDependencyNames(parsed[field])));
+}
+function nestedDependencyNames(value) {
+  if (!value || typeof value !== "object")
+    return [];
+  return Object.entries(value).flatMap(([key, nested]) => [
+    looksLikePackageName(key) ? key : "",
+    ...nestedDependencyNames(nested)
+  ]);
+}
+function packagesMentionedInText(text) {
+  const names = [];
+  const quoted = text.matchAll(/[`'"](@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)[`'"]/gi);
+  for (const match of quoted)
+    names.push(match[1] ?? "");
+  const advisoryContext = text.matchAll(/\b(?:package|dependency|upgrade|update|override|transitive|vulnerable|dependabot|cve|ghsa|audit)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
+  for (const match of advisoryContext)
+    names.push(match[1] ?? "");
+  const atVersion = text.matchAll(/\b(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/gi);
+  for (const match of atVersion)
+    names.push(match[1] ?? "");
+  if (/\b(dependabot|cve-|ghsa-|audit|vulnerab|advisory)\b/i.test(text)) {
+    const affectedPackageContext = text.matchAll(/\b(?:for|affects?|in)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
+    for (const match of affectedPackageContext)
+      names.push(match[1] ?? "");
+  }
+  return unique(names.map(cleanPackageName).filter(looksLikePackageName).filter((name) => !genericDependencyWords.has(name.toLowerCase())));
+}
+function packagesMentionedInDiff(diff) {
+  const names = [];
+  for (const line of diff.split(/\r?\n/)) {
+    if (!/^[+-]/.test(line) || /^[+-]{3}/.test(line))
+      continue;
+    const packageJsonMatch = line.match(/"(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)"\s*:/i);
+    if (packageJsonMatch?.[1])
+      names.push(packageJsonMatch[1]);
+    const pnpmMatch = line.match(/^\s*[+-]\s{0,8}(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
+    if (pnpmMatch?.[1])
+      names.push(pnpmMatch[1]);
+    const lockPathMatch = line.match(/\/(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
+    if (lockPathMatch?.[1])
+      names.push(lockPathMatch[1]);
+  }
+  return unique(names.map(cleanPackageName).filter(looksLikePackageName).filter((name) => !genericDependencyWords.has(name.toLowerCase())));
+}
+function packagesFromChangedDependencyFile(repoRoot, filePath) {
+  if (!filePath.endsWith("package.json"))
+    return [];
+  const parsed = readPackageJson(repoRoot, filePath);
+  return parsed ? packageJsonDependencyNames(parsed).slice(0, 20) : [];
+}
+function readPackageJson(repoRoot, filePath) {
+  const content = safeRead(path6.join(repoRoot, filePath), 4e5);
+  if (!content)
+    return null;
+  try {
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function changeKindFor(packageName, diff) {
+  const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const removedVersions = [
+    ...diff.matchAll(new RegExp(`^-.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
+  ].map((match) => match[1] ?? "");
+  const addedVersions = [
+    ...diff.matchAll(new RegExp(`^\\+.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
+  ].map((match) => match[1] ?? "");
+  const removed = removedVersions[0];
+  const added = addedVersions[0];
+  if (removed && added) {
+    const [removedMajor] = removed.split(".");
+    const [addedMajor] = added.split(".");
+    return removedMajor && addedMajor && removedMajor !== addedMajor ? "major" : "patch_or_minor";
+  }
+  if (added && !removed)
+    return "added_or_overridden";
+  return "unknown";
+}
+function manifestsForPackage(packageName, manifestDeps) {
+  return unique([
+    ...manifestDeps.get(packageName) ?? [],
+    ...[...manifestDeps.entries()].filter(([name]) => name.endsWith(`/${packageName}`)).flatMap(([, manifests]) => manifests)
+  ]).slice(0, 8);
+}
+function evidenceForPackage(packageName, task, diff) {
+  const evidence = [];
+  if (task.toLowerCase().includes(packageName.toLowerCase())) {
+    evidence.push("mentioned_in_task");
+  }
+  if (diff.toLowerCase().includes(packageName.toLowerCase())) {
+    evidence.push("mentioned_in_diff");
+  }
+  if (evidence.length === 0)
+    evidence.push("manifest_candidate");
+  return evidence;
+}
+function validationCommandsFor2(repoRoot, packageManager) {
+  const scripts = packageScripts(repoRoot);
+  const run = packageRunCommand(packageManager);
+  return unique([
+    ...auditCommandsFor(packageManager),
+    ...scriptCommand(scripts, "check", run),
+    ...scriptCommand(scripts, "test", run),
+    ...scriptCommand(scripts, "test:client", run),
+    ...scriptCommand(scripts, "test:e2e:smoke", run),
+    ...scriptCommand(scripts, "build", run)
+  ]).slice(0, 10);
+}
+function packageScripts(repoRoot) {
+  const parsed = readPackageJson(repoRoot, "package.json");
+  const scripts = parsed?.scripts;
+  return scripts && typeof scripts === "object" ? Object.fromEntries(Object.entries(scripts).filter((entry) => typeof entry[1] === "string")) : {};
+}
+function scriptCommand(scripts, scriptName, runCommand) {
+  return scripts[scriptName] ? [`${runCommand} ${scriptName}`] : [];
+}
+function packageRunCommand(packageManager) {
+  switch (packageManager) {
+    case "npm":
+      return "npm run";
+    case "yarn":
+      return "yarn";
+    case "bun":
+      return "bun run";
+    default:
+      return "pnpm";
+  }
+}
+function auditCommandsFor(packageManager) {
+  switch (packageManager) {
+    case "pnpm":
+      return ["pnpm audit --prod"];
+    case "npm":
+      return ["npm audit --omit=dev"];
+    case "yarn":
+      return ["yarn npm audit --environment production"];
+    case "bun":
+      return ["bun audit"];
+    case "pip":
+      return ["pip-audit"];
+    case "bundler":
+      return ["bundle audit check"];
+    case "go":
+      return ["govulncheck ./..."];
+    case "cargo":
+      return ["cargo audit"];
+    default:
+      return [];
+  }
+}
+function dependencyGraphCommandsFor(packageManager, packageNames) {
+  const selected = packageNames.slice(0, 5);
+  if (selected.length === 0)
+    return [];
+  switch (packageManager) {
+    case "pnpm":
+      return selected.map((name) => `pnpm why ${name}`);
+    case "npm":
+      return selected.map((name) => `npm explain ${name}`);
+    case "yarn":
+      return selected.map((name) => `yarn why ${name}`);
+    case "bun":
+      return selected.map((name) => `bun pm why ${name}`);
+    case "go":
+      return selected.map((name) => `go mod why -m ${name}`);
+    case "cargo":
+      return selected.map((name) => `cargo tree -i ${name}`);
+    default:
+      return [];
+  }
+}
+function remediationCommandsFor(packageManager, packageNames) {
+  const selected = packageNames.slice(0, 5);
+  if (selected.length === 0)
+    return [];
+  switch (packageManager) {
+    case "pnpm":
+      return selected.map((name) => `pnpm up ${name} --latest --interactive=false`);
+    case "npm":
+      return selected.map((name) => `npm update ${name}`);
+    case "yarn":
+      return selected.map((name) => `yarn up ${name}`);
+    case "bun":
+      return selected.map((name) => `bun update ${name}`);
+    case "go":
+      return selected.map((name) => `go get ${name}@latest`);
+    case "cargo":
+      return selected.map((name) => `cargo update -p ${name}`);
+    default:
+      return [];
+  }
+}
+function residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles) {
+  return unique([
+    packageNames.length > 0 ? `Confirm vulnerable versions are gone for: ${packageNames.slice(0, 8).join(", ")}.` : "Name each advisory/package from the scanner before editing.",
+    changedDependencyFiles.some(isDependencyLockfile) ? "Inspect the lockfile diff for unexpected package churn outside the advisory path." : "Regenerate and inspect the lockfile if the fix changes dependency resolution.",
+    "Split major-version upgrades or broad framework upgrades into a separate mission unless the advisory requires them.",
+    "Record any remaining advisory ids, ignored dev-only findings, or transitive paths that still need owner judgment.",
+    ...auditCommandsFor(packageManager).map((command2) => `Rerun ${command2} after the lockfile update.`)
+  ]);
+}
+function confidenceFor(input) {
+  let score = 35;
+  if (input.changedDependencyFiles.length > 0)
+    score += 20;
+  if (input.packageSignals.length > 0)
+    score += 20;
+  if (input.lockfiles.length > 0)
+    score += 10;
+  if (input.validationCommands.length > 0)
+    score += 10;
+  return Math.min(95, score);
+}
+function summaryFor3(input) {
+  const packages = input.packageSignals.map((signal2) => signal2.name);
+  return [
+    `Detected ${input.packageManager} dependency remediation context.`,
+    `${input.manifests.length} manifest${input.manifests.length === 1 ? "" : "s"}, ${input.lockfiles.length} lockfile${input.lockfiles.length === 1 ? "" : "s"}.`,
+    input.changedDependencyFiles.length > 0 ? `Changed dependency files: ${input.changedDependencyFiles.slice(0, 6).join(", ")}.` : "No dependency files are changed yet.",
+    packages.length > 0 ? `Likely packages: ${packages.slice(0, 8).join(", ")}.` : "Package names still need advisory/scanner evidence.",
+    input.validationCommands.length > 0 ? `Validation starts with ${input.validationCommands[0]}.` : "Validation commands need repo-specific confirmation."
+  ].join(" ");
+}
+function cleanPackageName(input) {
+  return input.replace(/[),.;\]]+$/g, "").trim();
+}
+function looksLikePackageName(input) {
+  return /^@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?$/i.test(input);
+}
+function looksLikeVersionOrAdvisory(input) {
+  const normalized = input.toLowerCase();
+  return /^\d/.test(input) || /^cve-\d/i.test(input) || /^ghsa-/i.test(input) || [
+    "advisory",
+    "advisories",
+    "change",
+    "changes",
+    "dependency",
+    "dependencies",
+    "dependabot",
+    "finding",
+    "findings",
+    "package",
+    "packages",
+    "security",
+    "transitive",
+    "upgrade",
+    "upgrades",
+    "vulnerabilities",
+    "vulnerability",
+    "vulnerable"
+  ].includes(normalized);
+}
+var dependencyFilePatterns, genericDependencyWords;
+var init_dependencyRemediation = __esm({
+  "../core/dist/dependencyRemediation.js"() {
+    "use strict";
+    init_utils();
+    dependencyFilePatterns = [
+      "package.json",
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "package-lock.json",
+      "yarn.lock",
+      "bun.lock",
+      "npm-shrinkwrap.json",
+      "requirements.txt",
+      "poetry.lock",
+      "pyproject.toml",
+      "Pipfile.lock",
+      "Gemfile",
+      "Gemfile.lock",
+      "go.mod",
+      "go.sum",
+      "Cargo.toml",
+      "Cargo.lock"
+    ];
+    genericDependencyWords = /* @__PURE__ */ new Set([
+      "advisory",
+      "audit",
+      "build",
+      "change",
+      "dependency",
+      "dev",
+      "exact",
+      "existing",
+      "focused",
+      "for",
+      "finding",
+      "lockfile",
+      "package",
+      "path",
+      "security",
+      "test",
+      "the",
+      "toolchain",
+      "transitive",
+      "vulnerability",
+      "workflow",
+      "without"
+    ]);
+  }
+});
+
 // ../core/dist/testRecommendations.js
 import { existsSync as existsSync3 } from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 function recommendExactTestsForFiles(input) {
   const packageManager = detectPackageManager(input.repoRoot);
   if (isDocsOnlyChange(input.changedFiles)) {
@@ -11691,7 +12249,7 @@ function taskRelevantTests(repoRoot, scanMap, scanSources, task, excluded) {
   }));
   return [...mapTests, ...sourceTests].filter((test) => !excludedSet.has(test.path)).map((test) => {
     const pathScore = tokens.reduce((total, token) => total + (test.seed.includes(token) ? 2 : 0), 0);
-    const content = pathScore > 0 ? (safeRead(path6.join(repoRoot, test.path), 6e4) ?? "").toLowerCase() : "";
+    const content = pathScore > 0 ? (safeRead(path7.join(repoRoot, test.path), 6e4) ?? "").toLowerCase() : "";
     return {
       path: test.path,
       score: pathScore + tokens.reduce((total, token) => total + (test.context.includes(token) ? 1 : 0), 0) + tokens.reduce((total, token) => total + (content.includes(token) ? 1 : 0), 0)
@@ -11755,8 +12313,8 @@ function testCommandForFile(repoRoot, file, packageManager) {
   if (packageManager === "pnpm") {
     const packageInfo = nearestPackageInfo(repoRoot, file);
     if (packageInfo?.name && packageInfo.root !== repoRoot) {
-      const packageRelativeFile = path6.relative(packageInfo.root, path6.join(repoRoot, file)).replaceAll("\\", "/");
-      const testScript = readPackageJson(packageInfo.root)?.scripts?.test;
+      const packageRelativeFile = path7.relative(packageInfo.root, path7.join(repoRoot, file)).replaceAll("\\", "/");
+      const testScript = readPackageJson2(packageInfo.root)?.scripts?.test;
       if (typeof testScript === "string") {
         if (/\bvitest\b/.test(testScript)) {
           return `pnpm --filter ${packageInfo.name} exec vitest run ${packageRelativeFile}`;
@@ -11774,11 +12332,11 @@ function testCommandForFile(repoRoot, file, packageManager) {
   return `${packageManager} test -- ${file}`;
 }
 function nearestPackageInfo(repoRoot, file) {
-  let current = path6.dirname(path6.join(repoRoot, file));
+  let current = path7.dirname(path7.join(repoRoot, file));
   while (current.startsWith(repoRoot)) {
-    const packageJsonPath = path6.join(current, "package.json");
+    const packageJsonPath = path7.join(current, "package.json");
     if (existsSync3(packageJsonPath)) {
-      const pkg = readPackageJson(current);
+      const pkg = readPackageJson2(current);
       return {
         root: current,
         ...typeof pkg?.name === "string" ? { name: pkg.name } : {}
@@ -11786,18 +12344,18 @@ function nearestPackageInfo(repoRoot, file) {
     }
     if (current === repoRoot)
       break;
-    current = path6.dirname(current);
+    current = path7.dirname(current);
   }
   return null;
 }
 function coLocatedTestCandidates(repoRoot, file) {
-  const parsed = path6.parse(file);
+  const parsed = path7.parse(file);
   const extensions = parsed.ext === ".tsx" ? [".test.tsx", ".spec.tsx", ".test.ts", ".spec.ts"] : parsed.ext === ".jsx" ? [".test.jsx", ".spec.jsx", ".test.js", ".spec.js"] : [`.test${parsed.ext}`, `.spec${parsed.ext}`];
   const candidates = [
-    ...extensions.map((extension) => path6.join(parsed.dir, `${parsed.name}${extension}`)),
-    ...extensions.map((extension) => path6.join(parsed.dir, "__tests__", `${parsed.name}${extension}`))
+    ...extensions.map((extension) => path7.join(parsed.dir, `${parsed.name}${extension}`)),
+    ...extensions.map((extension) => path7.join(parsed.dir, "__tests__", `${parsed.name}${extension}`))
   ].map((candidate) => candidate.replaceAll("\\", "/"));
-  return candidates.filter((candidate) => existsSync3(path6.join(repoRoot, candidate)));
+  return candidates.filter((candidate) => existsSync3(path7.join(repoRoot, candidate)));
 }
 function importedByTests(scanMap, sourceFiles) {
   const fromSourceMetadata = scanMap.filter((node) => sourceFiles.includes(sourcePathForNode(node))).flatMap((node) => metadataStrings3(node, "importedBy")).filter(isTestPath);
@@ -11819,11 +12377,11 @@ function isDocsOnlyChange(files) {
 }
 function isDocsOrProductDocPath(file) {
   const normalized = file.replaceAll("\\", "/");
-  const basename = path6.basename(normalized).toLowerCase();
+  const basename = path7.basename(normalized).toLowerCase();
   return normalized.startsWith("docs/") || normalized.includes("/docs/") || normalized.startsWith(".github/") || basename === "readme.md" || basename === "agents.md" || basename === "claude.md" || basename.endsWith(".md") || basename.endsWith(".mdx") || basename.endsWith(".rst") || basename.endsWith(".adoc");
 }
 function docsOnlyRecommendations(repoRoot, packageManager, changedFiles) {
-  const pkg = readPackageJson(repoRoot);
+  const pkg = readPackageJson2(repoRoot);
   const scripts = pkg?.scripts ?? {};
   const recommendations = [
     {
@@ -11847,7 +12405,7 @@ function docsOnlyRecommendations(repoRoot, packageManager, changedFiles) {
     if (typeof scripts[script] === "string") {
       recommendations.push({
         command: `${packageManager} ${script}`,
-        reason: `Repo package.json defines ${script}; run it when docs or agent guidance can affect generated output or published docs.`,
+        reason: `Repo package.json defines ${script}; run it when docs or agent guidance can affect generated output or shared docs.`,
         files: [],
         source: "script",
         confidence: script === "check" ? "low" : "medium"
@@ -11857,7 +12415,7 @@ function docsOnlyRecommendations(repoRoot, packageManager, changedFiles) {
   return recommendations.slice(0, 4);
 }
 function packageScriptRecommendations(repoRoot, packageManager) {
-  const pkg = readPackageJson(repoRoot);
+  const pkg = readPackageJson2(repoRoot);
   const scripts = pkg?.scripts ?? {};
   const commands = [];
   for (const script of [
@@ -11890,7 +12448,7 @@ function taskRelevantPackageScriptRecommendations(repoRoot, packageManager, task
   const packageRoots = unique(sourceFiles.map((file) => nearestPackageInfo(repoRoot, file)?.root).filter((root) => Boolean(root)));
   const recommendations = [];
   for (const packageRoot of packageRoots) {
-    const pkg = readPackageJson(packageRoot);
+    const pkg = readPackageJson2(packageRoot);
     const scripts = pkg?.scripts ?? {};
     const packageName = typeof pkg?.name === "string" ? pkg.name : void 0;
     if (wantsPackageRelease) {
@@ -11923,8 +12481,8 @@ function packageScriptCommand(packageManager, packageRoot, repoRoot, packageName
   }
   return packageManager === "npm" ? `npm run ${script}` : `${packageManager} ${script}`;
 }
-function readPackageJson(packageRoot) {
-  const content = safeRead(path6.join(packageRoot, "package.json"), 2e5);
+function readPackageJson2(packageRoot) {
+  const content = safeRead(path7.join(packageRoot, "package.json"), 2e5);
   if (!content)
     return null;
   try {
@@ -11940,17 +12498,17 @@ function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 function detectPackageManager(repoRoot) {
-  const pkg = readPackageJson(repoRoot);
+  const pkg = readPackageJson2(repoRoot);
   if (typeof pkg?.packageManager === "string") {
     const name = pkg.packageManager.split("@")[0];
     if (name)
       return name;
   }
-  if (existsSync3(path6.join(repoRoot, "pnpm-lock.yaml")))
+  if (existsSync3(path7.join(repoRoot, "pnpm-lock.yaml")))
     return "pnpm";
-  if (existsSync3(path6.join(repoRoot, "yarn.lock")))
+  if (existsSync3(path7.join(repoRoot, "yarn.lock")))
     return "yarn";
-  if (existsSync3(path6.join(repoRoot, "bun.lockb")))
+  if (existsSync3(path7.join(repoRoot, "bun.lockb")))
     return "bun";
   return "npm";
 }
@@ -11967,6 +12525,10 @@ function contextForTask(scan, request) {
   const files = request.files ?? [];
   const maxTokens = request.maxTokens ?? 6e3;
   const scoped = files.length > 0;
+  const dependencyRemediation = isDependencyRemediationTask(task, files) ? buildDependencyRemediationPlan(request.repoRoot ?? scan.repoRoot, {
+    task,
+    changedFiles: files
+  }) : void 0;
   const rankedRules = rankRules(scan.rules, task, files);
   const initialRules = rankedRules.slice(0, scoped ? 8 : 12);
   const initialSkills = selectSkills(scan.skills, task, files, scoped).map(compactSkillForContext);
@@ -11974,13 +12536,18 @@ function contextForTask(scan, request) {
   const rankedMap = rankMap(mapCandidates, task, files);
   const selectedMap = takeGuidanceGroundedMapNodes(mapCandidates, scan.sources, rulesStronglyRelevantForGrounding(initialRules, task), initialSkills, rankedMap, files, scoped ? 14 : 18).map(compactMapNodeForContext);
   const suggestedTests = selectValidationForContext(scan.map, scan.sources, task, files, selectedMap, request.repoRoot);
+  const dependencyTests = dependencyValidationForContext(dependencyRemediation, task);
+  const focusedSuggestedTests = dependencyRemediation ? dependencyTests : suggestedTests;
   const initialSelection = {
     rules: initialRules,
     skills: initialSkills,
     map: selectedMap,
-    wikiPages: selectWikiPages(buildContextWiki(scan).pages, task, files, scoped, suggestedTests).map(compactWikiPageForContext),
+    wikiPages: selectWikiPages(buildContextWiki(scan).pages, task, files, scoped, focusedSuggestedTests).map(compactWikiPageForContext),
     memories: rankMemories(scan.memories, task, files).slice(0, scoped ? 4 : 8).map(compactMemoryForContext),
-    suggestedTests
+    suggestedTests: unique([...dependencyTests, ...focusedSuggestedTests]),
+    ...dependencyRemediation ? {
+      dependencyRemediation: compactDependencyRemediationForContext(dependencyRemediation)
+    } : {}
   };
   const { selection, tokenEstimate, omitted } = fitSelectionToBudget(initialSelection, {
     maxTokens,
@@ -11991,32 +12558,39 @@ function contextForTask(scan, request) {
   const { rules: selectedRules, skills: selectedSkills, map: budgetedMap, wikiPages: selectedWikiPages, memories: selectedMemories } = selection;
   const finalMap = takeGuidanceGroundedMapNodes(mapCandidates, scan.sources, rulesStronglyRelevantForGrounding(selectedRules, task), selectedSkills, budgetedMap, files, Math.max(budgetedMap.length, scoped ? 2 : 4)).map(compactMapNodeForContext);
   const finalSuggestedTests = selectValidationForContext(scan.map, scan.sources, task, files, finalMap, request.repoRoot);
+  const packetSuggestedTests = unique([
+    ...dependencyRemediation ? dependencyValidationForContext(dependencyRemediation, task) : finalSuggestedTests
+  ]);
   const owners = selectOwners(scan.map, files);
   const sources = unique([
     ...selectedRules.flatMap((rule) => rule.sourcePaths),
     ...selectedSkills.map((skill) => skill.sourcePath),
     ...finalMap.map(mapNodeSourcePath),
     ...selectedWikiPages.flatMap((page2) => page2.sourcePaths),
-    ...selectedMemories.flatMap((memory) => memory.sourcePaths)
+    ...selectedMemories.flatMap((memory) => memory.sourcePaths),
+    ...dependencySourcePaths(dependencyRemediation)
   ]);
   const teamGuidance = scan.teamGuidanceCatalog ? teamGuidanceDeliveryFor(scan, selectedRules, selectedSkills, selectedMemories) : void 0;
   const packet = {
     packetId: packetId(),
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     task,
-    summary: summarizeContext(task, selectedRules, finalSuggestedTests, finalMap),
+    summary: summarizeContext(task, selectedRules, packetSuggestedTests, finalMap),
     rules: selectedRules,
     skills: selectedSkills,
     map: finalMap,
     wikiPages: selectedWikiPages,
     memories: selectedMemories,
-    suggestedTests: finalSuggestedTests,
+    suggestedTests: packetSuggestedTests,
     owners,
     sources,
     tokenEstimate,
     omitted,
-    valueSignals: contextValueSignals(finalMap, finalSuggestedTests, sources.length, teamGuidance?.applied.length ?? 0),
-    ...teamGuidance ? { teamGuidance } : {}
+    valueSignals: contextValueSignals(finalMap, packetSuggestedTests, sources.length, teamGuidance?.applied.length ?? 0),
+    ...teamGuidance ? { teamGuidance } : {},
+    ...dependencyRemediation ? {
+      dependencyRemediation: compactDependencyRemediationForContext(dependencyRemediation)
+    } : {}
   };
   return enforceContextPacketBudget(packet, maxTokens, files);
 }
@@ -12050,6 +12624,47 @@ function contextValueSignals(map, suggestedTests, relevantSourceCount, appliedTe
     suggestedTestCount: suggestedTests.length
   };
 }
+function dependencyValidationForContext(plan, task) {
+  if (!plan)
+    return [];
+  const allowsRuntimeProof = /\b(runtime|smoke|e2e|browser|production|integration)\b/i.test(task);
+  return plan.validationCommands.filter((command2) => allowsRuntimeProof ? true : !/\b(e2e|smoke|ux)\b/i.test(command2)).slice(0, allowsRuntimeProof ? 5 : 4);
+}
+function dependencySourcePaths(plan) {
+  if (!plan)
+    return [];
+  return unique([
+    ...plan.manifestFiles,
+    ...plan.lockfiles,
+    ...plan.workspaceFiles,
+    ...plan.changedDependencyFiles,
+    ...plan.directDependencyFiles
+  ]);
+}
+function compactDependencyRemediationForContext(plan) {
+  if (!plan)
+    return void 0;
+  return {
+    ...plan,
+    manifestFiles: plan.manifestFiles.slice(0, 8),
+    lockfiles: plan.lockfiles.slice(0, 6),
+    workspaceFiles: plan.workspaceFiles.slice(0, 4),
+    changedDependencyFiles: plan.changedDependencyFiles.slice(0, 8),
+    directDependencyFiles: plan.directDependencyFiles.slice(0, 8),
+    packageSignals: plan.packageSignals.slice(0, 8).map((signal2) => ({
+      ...signal2,
+      manifestPaths: signal2.manifestPaths.slice(0, 4),
+      lockfilePaths: signal2.lockfilePaths.slice(0, 4),
+      evidence: signal2.evidence.slice(0, 3)
+    })),
+    graphCommands: plan.graphCommands.slice(0, 6),
+    remediationCommands: plan.remediationCommands.slice(0, 6),
+    validationCommands: plan.validationCommands.slice(0, 8),
+    residualRiskChecks: plan.residualRiskChecks.slice(0, 6),
+    handoffRequirements: plan.handoffRequirements.slice(0, 4),
+    summary: truncateText(plan.summary, 520)
+  };
+}
 function codebaseMapForTask(scan, request, limit = 80) {
   const files = request.files ?? [];
   const hasSpecificScope = files.length > 0 || wordsFor3(request.task).length > 1;
@@ -12927,7 +13542,8 @@ function cloneSelection(selection) {
     map: [...selection.map],
     wikiPages: [...selection.wikiPages],
     memories: [...selection.memories],
-    suggestedTests: [...selection.suggestedTests]
+    suggestedTests: [...selection.suggestedTests],
+    ...selection.dependencyRemediation ? { dependencyRemediation: selection.dependencyRemediation } : {}
   };
 }
 function estimateSelectionTokens(selection, task) {
@@ -12942,6 +13558,7 @@ function estimateSelectionTokens(selection, task) {
     wikiPages: selection.wikiPages,
     memories: selection.memories,
     suggestedTests: selection.suggestedTests,
+    ...selection.dependencyRemediation ? { dependencyRemediation: selection.dependencyRemediation } : {},
     owners: [],
     sources: selectionSources(selection),
     tokenEstimate: 0,
@@ -13038,10 +13655,6 @@ function trimContextPacket(packet, protectedMapPaths) {
     packet.suggestedTests.pop();
     return true;
   }
-  if (packet.rules.length > 0) {
-    packet.rules.pop();
-    return true;
-  }
   if (packet.map.length > protectedMapPaths.size) {
     packet.map.pop();
     return true;
@@ -13136,7 +13749,8 @@ function refreshContextPacketDerivedFields(packet) {
     map: packet.map,
     wikiPages: packet.wikiPages,
     memories: packet.memories,
-    suggestedTests: packet.suggestedTests
+    suggestedTests: packet.suggestedTests,
+    ...packet.dependencyRemediation ? { dependencyRemediation: packet.dependencyRemediation } : {}
   });
   refreshTeamGuidanceDelivery(packet);
   packet.valueSignals = contextValueSignals(packet.map, packet.suggestedTests, packet.sources.length, packet.teamGuidance?.applied.length ?? 0);
@@ -13188,7 +13802,8 @@ function selectionSources(selection) {
     ...selection.skills.map((skill) => skill.sourcePath),
     ...selection.map.map((node) => node.path),
     ...selection.wikiPages.flatMap((page2) => page2.sourcePaths),
-    ...selection.memories.flatMap((memory) => memory.sourcePaths)
+    ...selection.memories.flatMap((memory) => memory.sourcePaths),
+    ...dependencySourcePaths(selection.dependencyRemediation)
   ]);
 }
 function trimSelection(selection, minimums, protectedMapPaths) {
@@ -13333,6 +13948,7 @@ var init_context = __esm({
     init_scanner();
     init_contextWiki();
     init_pathIntent();
+    init_dependencyRemediation();
     init_testRecommendations();
     init_utils();
     contextStopWords = /* @__PURE__ */ new Set([
@@ -13405,443 +14021,6 @@ var init_context = __esm({
   }
 });
 
-// ../core/dist/dependencyRemediation.js
-import path7 from "node:path";
-function buildDependencyRemediationPlan(repoRoot, request) {
-  const files = walkFiles(repoRoot, request.maxFiles ?? 6e3);
-  const manifests = files.filter(isDependencyManifest);
-  const lockfiles = files.filter(isDependencyLockfile);
-  const workspaceFiles = files.filter(isDependencyWorkspaceFile);
-  const changedDependencyFiles = unique((request.changedFiles ?? []).filter(isDependencyFile));
-  const packageManager = inferPackageManager(repoRoot, manifests, lockfiles);
-  const packageSignalInput = {
-    task: request.task,
-    manifests,
-    changedDependencyFiles
-  };
-  if (request.diff)
-    packageSignalInput.diff = request.diff;
-  const packageSignals = packageSignalsFor(repoRoot, packageSignalInput);
-  const directDependencyFiles = unique(packageSignals.flatMap((signal2) => signal2.manifestPaths));
-  const packageNames = packageSignals.map((signal2) => signal2.name);
-  const validationCommands2 = validationCommandsFor2(repoRoot, packageManager);
-  const graphCommands = dependencyGraphCommandsFor(packageManager, packageNames);
-  const remediationCommands = remediationCommandsFor(packageManager, packageNames);
-  const residualRiskChecks = residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles);
-  const confidence = confidenceFor({
-    changedDependencyFiles,
-    packageSignals,
-    lockfiles,
-    validationCommands: validationCommands2
-  });
-  return {
-    id: `dep_${contentHash([
-      request.task,
-      packageManager,
-      changedDependencyFiles.join(","),
-      packageNames.join(",")
-    ].join(":"))}`,
-    status: changedDependencyFiles.length > 0 || packageSignals.length > 0 ? "ready" : "needs_evidence",
-    packageManager,
-    manifestFiles: manifests.slice(0, 20),
-    lockfiles,
-    workspaceFiles,
-    changedDependencyFiles,
-    directDependencyFiles,
-    packageSignals,
-    graphCommands,
-    remediationCommands,
-    validationCommands: validationCommands2,
-    residualRiskChecks,
-    handoffRequirements: [
-      "List advisory ids or scanner finding ids that were fixed.",
-      "Name packages still present in the lockfile with vulnerable versions, or state that the scan/audit is clean.",
-      "Explain any major-version upgrades, overrides, peer dependency changes, skipped advisories, or remaining advisory ids.",
-      "Attach validation commands and CI follow-up results before marking the security mission done."
-    ],
-    summary: summaryFor3({
-      packageManager,
-      manifests,
-      lockfiles,
-      changedDependencyFiles,
-      packageSignals,
-      validationCommands: validationCommands2
-    }),
-    confidence
-  };
-}
-function isDependencyFile(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return dependencyFilePatterns.some((pattern) => normalized === pattern || normalized.endsWith(`/${pattern}`) || pattern === "package.json" && normalized.endsWith("/package.json"));
-}
-function isDependencyLockfile(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return normalized === "pnpm-lock.yaml" || normalized.endsWith("/pnpm-lock.yaml") || normalized === "package-lock.json" || normalized.endsWith("/package-lock.json") || normalized === "yarn.lock" || normalized.endsWith("/yarn.lock") || normalized === "bun.lock" || normalized.endsWith("/bun.lock") || normalized === "npm-shrinkwrap.json" || normalized.endsWith("/npm-shrinkwrap.json") || normalized === "poetry.lock" || normalized.endsWith("/poetry.lock") || normalized === "Pipfile.lock" || normalized.endsWith("/Pipfile.lock") || normalized === "Gemfile.lock" || normalized.endsWith("/Gemfile.lock") || normalized === "go.sum" || normalized.endsWith("/go.sum") || normalized === "Cargo.lock" || normalized.endsWith("/Cargo.lock");
-}
-function isDependencyManifest(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return normalized === "package.json" || normalized.endsWith("/package.json") || normalized === "requirements.txt" || normalized.endsWith("/requirements.txt") || normalized === "pyproject.toml" || normalized.endsWith("/pyproject.toml") || normalized === "Gemfile" || normalized.endsWith("/Gemfile") || normalized === "go.mod" || normalized.endsWith("/go.mod") || normalized === "Cargo.toml" || normalized.endsWith("/Cargo.toml");
-}
-function isDependencyWorkspaceFile(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return normalized === "pnpm-workspace.yaml" || normalized.endsWith("/pnpm-workspace.yaml") || normalized === "lerna.json" || normalized.endsWith("/lerna.json") || normalized === "turbo.json" || normalized.endsWith("/turbo.json") || normalized === "nx.json" || normalized.endsWith("/nx.json");
-}
-function inferPackageManager(repoRoot, manifests, lockfiles) {
-  const rootPackageJson = readPackageJson2(repoRoot, "package.json");
-  const packageManager = rootPackageJson?.packageManager;
-  if (typeof packageManager === "string") {
-    if (packageManager.startsWith("pnpm@"))
-      return "pnpm";
-    if (packageManager.startsWith("yarn@"))
-      return "yarn";
-    if (packageManager.startsWith("npm@"))
-      return "npm";
-    if (packageManager.startsWith("bun@"))
-      return "bun";
-  }
-  if (lockfiles.some((file) => file.endsWith("pnpm-lock.yaml")))
-    return "pnpm";
-  if (lockfiles.some((file) => file.endsWith("yarn.lock")))
-    return "yarn";
-  if (lockfiles.some((file) => file.endsWith("package-lock.json"))) {
-    return "npm";
-  }
-  if (lockfiles.some((file) => file.endsWith("bun.lock")))
-    return "bun";
-  if (manifests.some((file) => file.endsWith("requirements.txt") || file.endsWith("pyproject.toml") || file.endsWith("Pipfile"))) {
-    return "pip";
-  }
-  if (manifests.some((file) => file.endsWith("Gemfile")))
-    return "bundler";
-  if (manifests.some((file) => file.endsWith("go.mod")))
-    return "go";
-  if (manifests.some((file) => file.endsWith("Cargo.toml")))
-    return "cargo";
-  return "unknown";
-}
-function packageSignalsFor(repoRoot, input) {
-  const manifestDeps = dependencyNamesByManifest(repoRoot, input.manifests);
-  const explicitPackageNames = unique([
-    ...packagesMentionedInText(input.task),
-    ...packagesMentionedInDiff(input.diff ?? "")
-  ]).filter((name) => !looksLikeVersionOrAdvisory(name));
-  const fallbackPackageNames = input.changedDependencyFiles.flatMap((file) => packagesFromChangedDependencyFile(repoRoot, file));
-  const packageNames = unique(explicitPackageNames.length > 0 ? explicitPackageNames : fallbackPackageNames).filter((name) => !looksLikeVersionOrAdvisory(name));
-  return packageNames.slice(0, 16).map((name) => ({
-    name,
-    changeKind: changeKindFor(name, input.diff ?? ""),
-    manifestPaths: manifestsForPackage(name, manifestDeps),
-    lockfilePaths: input.changedDependencyFiles.filter(isDependencyLockfile),
-    evidence: evidenceForPackage(name, input.task, input.diff ?? "")
-  }));
-}
-function dependencyNamesByManifest(repoRoot, manifests) {
-  const byPackage = /* @__PURE__ */ new Map();
-  for (const manifest of manifests) {
-    if (!manifest.endsWith("package.json"))
-      continue;
-    const parsed = readPackageJson2(repoRoot, manifest);
-    if (!parsed)
-      continue;
-    for (const name of packageJsonDependencyNames(parsed)) {
-      const current = byPackage.get(name) ?? [];
-      current.push(manifest);
-      byPackage.set(name, current);
-    }
-  }
-  return byPackage;
-}
-function packageJsonDependencyNames(parsed) {
-  return unique([
-    "dependencies",
-    "devDependencies",
-    "optionalDependencies",
-    "peerDependencies",
-    "overrides",
-    "resolutions",
-    "pnpm"
-  ].flatMap((field) => nestedDependencyNames(parsed[field])));
-}
-function nestedDependencyNames(value) {
-  if (!value || typeof value !== "object")
-    return [];
-  return Object.entries(value).flatMap(([key, nested]) => [
-    looksLikePackageName(key) ? key : "",
-    ...nestedDependencyNames(nested)
-  ]);
-}
-function packagesMentionedInText(text) {
-  const names = [];
-  const quoted = text.matchAll(/[`'"](@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)[`'"]/gi);
-  for (const match of quoted)
-    names.push(match[1] ?? "");
-  const advisoryContext = text.matchAll(/\b(?:package|dependency|upgrade|update|override|transitive|vulnerable|dependabot|cve|ghsa|audit)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
-  for (const match of advisoryContext)
-    names.push(match[1] ?? "");
-  const atVersion = text.matchAll(/\b(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/gi);
-  for (const match of atVersion)
-    names.push(match[1] ?? "");
-  if (/\b(dependabot|cve-|ghsa-|audit|vulnerab|advisory)\b/i.test(text)) {
-    const affectedPackageContext = text.matchAll(/\b(?:for|affects?|in)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
-    for (const match of affectedPackageContext)
-      names.push(match[1] ?? "");
-  }
-  return unique(names.map(cleanPackageName).filter(looksLikePackageName));
-}
-function packagesMentionedInDiff(diff) {
-  const names = [];
-  for (const line of diff.split(/\r?\n/)) {
-    if (!/^[+-]/.test(line) || /^[+-]{3}/.test(line))
-      continue;
-    const packageJsonMatch = line.match(/"(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)"\s*:/i);
-    if (packageJsonMatch?.[1])
-      names.push(packageJsonMatch[1]);
-    const pnpmMatch = line.match(/^\s*[+-]\s{0,8}(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
-    if (pnpmMatch?.[1])
-      names.push(pnpmMatch[1]);
-    const lockPathMatch = line.match(/\/(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
-    if (lockPathMatch?.[1])
-      names.push(lockPathMatch[1]);
-  }
-  return unique(names.map(cleanPackageName).filter(looksLikePackageName));
-}
-function packagesFromChangedDependencyFile(repoRoot, filePath) {
-  if (!filePath.endsWith("package.json"))
-    return [];
-  const parsed = readPackageJson2(repoRoot, filePath);
-  return parsed ? packageJsonDependencyNames(parsed).slice(0, 20) : [];
-}
-function readPackageJson2(repoRoot, filePath) {
-  const content = safeRead(path7.join(repoRoot, filePath), 4e5);
-  if (!content)
-    return null;
-  try {
-    const parsed = JSON.parse(content);
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function changeKindFor(packageName, diff) {
-  const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const removedVersions = [
-    ...diff.matchAll(new RegExp(`^-.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
-  ].map((match) => match[1] ?? "");
-  const addedVersions = [
-    ...diff.matchAll(new RegExp(`^\\+.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
-  ].map((match) => match[1] ?? "");
-  const removed = removedVersions[0];
-  const added = addedVersions[0];
-  if (removed && added) {
-    const [removedMajor] = removed.split(".");
-    const [addedMajor] = added.split(".");
-    return removedMajor && addedMajor && removedMajor !== addedMajor ? "major" : "patch_or_minor";
-  }
-  if (added && !removed)
-    return "added_or_overridden";
-  return "unknown";
-}
-function manifestsForPackage(packageName, manifestDeps) {
-  return unique([
-    ...manifestDeps.get(packageName) ?? [],
-    ...[...manifestDeps.entries()].filter(([name]) => name.endsWith(`/${packageName}`)).flatMap(([, manifests]) => manifests)
-  ]).slice(0, 8);
-}
-function evidenceForPackage(packageName, task, diff) {
-  const evidence = [];
-  if (task.toLowerCase().includes(packageName.toLowerCase())) {
-    evidence.push("mentioned_in_task");
-  }
-  if (diff.toLowerCase().includes(packageName.toLowerCase())) {
-    evidence.push("mentioned_in_diff");
-  }
-  if (evidence.length === 0)
-    evidence.push("manifest_candidate");
-  return evidence;
-}
-function validationCommandsFor2(repoRoot, packageManager) {
-  const scripts = packageScripts(repoRoot);
-  const run = packageRunCommand(packageManager);
-  return unique([
-    ...auditCommandsFor(packageManager),
-    ...scriptCommand(scripts, "check", run),
-    ...scriptCommand(scripts, "test", run),
-    ...scriptCommand(scripts, "test:client", run),
-    ...scriptCommand(scripts, "test:e2e:smoke", run),
-    ...scriptCommand(scripts, "build", run)
-  ]).slice(0, 10);
-}
-function packageScripts(repoRoot) {
-  const parsed = readPackageJson2(repoRoot, "package.json");
-  const scripts = parsed?.scripts;
-  return scripts && typeof scripts === "object" ? Object.fromEntries(Object.entries(scripts).filter((entry) => typeof entry[1] === "string")) : {};
-}
-function scriptCommand(scripts, scriptName, runCommand) {
-  return scripts[scriptName] ? [`${runCommand} ${scriptName}`] : [];
-}
-function packageRunCommand(packageManager) {
-  switch (packageManager) {
-    case "npm":
-      return "npm run";
-    case "yarn":
-      return "yarn";
-    case "bun":
-      return "bun run";
-    default:
-      return "pnpm";
-  }
-}
-function auditCommandsFor(packageManager) {
-  switch (packageManager) {
-    case "pnpm":
-      return ["pnpm audit --prod"];
-    case "npm":
-      return ["npm audit --omit=dev"];
-    case "yarn":
-      return ["yarn npm audit --environment production"];
-    case "bun":
-      return ["bun audit"];
-    case "pip":
-      return ["pip-audit"];
-    case "bundler":
-      return ["bundle audit check"];
-    case "go":
-      return ["govulncheck ./..."];
-    case "cargo":
-      return ["cargo audit"];
-    default:
-      return [];
-  }
-}
-function dependencyGraphCommandsFor(packageManager, packageNames) {
-  const selected = packageNames.slice(0, 5);
-  if (selected.length === 0)
-    return [];
-  switch (packageManager) {
-    case "pnpm":
-      return selected.map((name) => `pnpm why ${name}`);
-    case "npm":
-      return selected.map((name) => `npm explain ${name}`);
-    case "yarn":
-      return selected.map((name) => `yarn why ${name}`);
-    case "bun":
-      return selected.map((name) => `bun pm why ${name}`);
-    case "go":
-      return selected.map((name) => `go mod why -m ${name}`);
-    case "cargo":
-      return selected.map((name) => `cargo tree -i ${name}`);
-    default:
-      return [];
-  }
-}
-function remediationCommandsFor(packageManager, packageNames) {
-  const selected = packageNames.slice(0, 5);
-  if (selected.length === 0)
-    return [];
-  switch (packageManager) {
-    case "pnpm":
-      return selected.map((name) => `pnpm up ${name} --latest --interactive=false`);
-    case "npm":
-      return selected.map((name) => `npm update ${name}`);
-    case "yarn":
-      return selected.map((name) => `yarn up ${name}`);
-    case "bun":
-      return selected.map((name) => `bun update ${name}`);
-    case "go":
-      return selected.map((name) => `go get ${name}@latest`);
-    case "cargo":
-      return selected.map((name) => `cargo update -p ${name}`);
-    default:
-      return [];
-  }
-}
-function residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles) {
-  return unique([
-    packageNames.length > 0 ? `Confirm vulnerable versions are gone for: ${packageNames.slice(0, 8).join(", ")}.` : "Name each advisory/package from the scanner before editing.",
-    changedDependencyFiles.some(isDependencyLockfile) ? "Inspect the lockfile diff for unexpected package churn outside the advisory path." : "Regenerate and inspect the lockfile if the fix changes dependency resolution.",
-    "Split major-version upgrades or broad framework upgrades into a separate mission unless the advisory requires them.",
-    "Record any remaining advisory ids, ignored dev-only findings, or transitive paths that still need owner judgment.",
-    ...auditCommandsFor(packageManager).map((command2) => `Rerun ${command2} after the lockfile update.`)
-  ]);
-}
-function confidenceFor(input) {
-  let score = 35;
-  if (input.changedDependencyFiles.length > 0)
-    score += 20;
-  if (input.packageSignals.length > 0)
-    score += 20;
-  if (input.lockfiles.length > 0)
-    score += 10;
-  if (input.validationCommands.length > 0)
-    score += 10;
-  return Math.min(95, score);
-}
-function summaryFor3(input) {
-  const packages = input.packageSignals.map((signal2) => signal2.name);
-  return [
-    `Detected ${input.packageManager} dependency remediation context.`,
-    `${input.manifests.length} manifest${input.manifests.length === 1 ? "" : "s"}, ${input.lockfiles.length} lockfile${input.lockfiles.length === 1 ? "" : "s"}.`,
-    input.changedDependencyFiles.length > 0 ? `Changed dependency files: ${input.changedDependencyFiles.slice(0, 6).join(", ")}.` : "No dependency files are changed yet.",
-    packages.length > 0 ? `Likely packages: ${packages.slice(0, 8).join(", ")}.` : "Package names still need advisory/scanner evidence.",
-    input.validationCommands.length > 0 ? `Validation starts with ${input.validationCommands[0]}.` : "Validation commands need repo-specific confirmation."
-  ].join(" ");
-}
-function cleanPackageName(input) {
-  return input.replace(/[),.;\]]+$/g, "").trim();
-}
-function looksLikePackageName(input) {
-  return /^@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?$/i.test(input);
-}
-function looksLikeVersionOrAdvisory(input) {
-  const normalized = input.toLowerCase();
-  return /^\d/.test(input) || /^cve-\d/i.test(input) || /^ghsa-/i.test(input) || [
-    "advisory",
-    "advisories",
-    "change",
-    "changes",
-    "dependency",
-    "dependencies",
-    "dependabot",
-    "finding",
-    "findings",
-    "package",
-    "packages",
-    "security",
-    "transitive",
-    "upgrade",
-    "upgrades",
-    "vulnerabilities",
-    "vulnerability",
-    "vulnerable"
-  ].includes(normalized);
-}
-var dependencyFilePatterns;
-var init_dependencyRemediation = __esm({
-  "../core/dist/dependencyRemediation.js"() {
-    "use strict";
-    init_utils();
-    dependencyFilePatterns = [
-      "package.json",
-      "pnpm-lock.yaml",
-      "pnpm-workspace.yaml",
-      "package-lock.json",
-      "yarn.lock",
-      "bun.lock",
-      "npm-shrinkwrap.json",
-      "requirements.txt",
-      "poetry.lock",
-      "pyproject.toml",
-      "Pipfile.lock",
-      "Gemfile",
-      "Gemfile.lock",
-      "go.mod",
-      "go.sum",
-      "Cargo.toml",
-      "Cargo.lock"
-    ];
-  }
-});
-
 // ../core/dist/productOperatingContext.js
 function buildProductOperatingContext(scan, request) {
   const files = unique(request.files ?? []);
@@ -17164,7 +17343,7 @@ function missionGates(autonomy, recipe, options2) {
       label: "Library privacy gate",
       requiredTool: "brief.agent_session_insights",
       passCriteria: "Every candidate example is classified as derived-only, redacted transcript, or explicitly approved raw import before sharing.",
-      failureMode: "Do not publish raw prompts, secrets, customer data, private logs, or sensitive repo context without explicit approval."
+      failureMode: "Do not share raw prompts, secrets, customer data, private logs, or sensitive repo context without explicit approval."
     }, {
       id: "reuse_quality",
       label: "Reuse quality gate",
@@ -17548,7 +17727,7 @@ function missionSteps(task, autonomy, recipe, options2) {
       id: "verify_receipts",
       title: "Verify ticket receipt ledger",
       objective: "Prove the ticket-writing receipt chain before another agent runs the ticket.",
-      agentAction: "Run Brief receipt verification and fix missing, mismatched, or broken-chain ticket proof before publishing the ticket.",
+      agentAction: "Run Brief receipt verification and fix missing, mismatched, or broken-chain ticket proof before sending the ticket.",
       briefTool: "brief.verify_receipts",
       expectedOutput: "Receipt ledger verification with digest and chain-link status.",
       gateId: "ticket"
@@ -17777,7 +17956,7 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
         "executionContract.evidenceContract.mapProof",
         "context.likelyFiles"
       ],
-      stopIfMissing: isTicketWriter ? "Do not publish the ticket until product intent, owner judgment, acceptance criteria, and stop conditions are explicit." : "Do not edit until likely files, rules, tests, owners, and affected systems are grounded in Brief context."
+      stopIfMissing: isTicketWriter ? "Do not send the ticket until product intent, owner judgment, acceptance criteria, and stop conditions are explicit." : "Do not edit until likely files, rules, tests, owners, and affected systems are grounded in Brief context."
     },
     ...isRuntimeFix ? [
       {
@@ -18173,7 +18352,7 @@ function missionRunContract(autonomy, recipe, validation, options2, deliveryMode
     successCriteria: [
       "The context receipt cites the rules, source paths, tests, owners, and memories used by the agent.",
       recipe.id === "ticket_write" ? "The ticket separates human judgment from execution instructions and names unresolved decisions before automation starts." : recipe.id === "security_dependency" ? "The dependency vulnerability packet names advisory id, package, affected range, fixed range, manifest, lockfile, direct/transitive path, reachability, remediation choice, and rollback." : recipe.id === "security_finding" ? "The security finding packet names alert source, rule id, classification, source-to-sink or trust boundary, affected users/data, owner, exploitability, and validation path." : recipe.id === "security_testing" ? "The security test plan names the protected property, bad case, safe case, command, severity threshold, false-positive policy, owner, privacy boundary, and rollout mode." : recipe.id === "internal_app" ? "The app contract names the internal route, data source, auth context, allowed roles, row filters, audit events, and redaction rules before implementation." : recipe.id === "stale_pr" ? "The PR intent packet names original scope, unresolved review feedback, stale assumptions, validation, and handoff expectation." : recipe.id === "merge_conflict" ? "The conflict packet names conflicted files, both sides' intent, semantic conflicts, and validation before resolution." : recipe.id === "flaky_test" ? "The CI evidence packet names failing job or test, sample failure, platform, seed or timing signal, hypothesis, and validation path." : recipe.id === "small_refactor" ? "The mechanical scope packet names exact pattern, allowed files, exclusions, and expected behavior preservation." : recipe.id === "bug_investigation" ? "The hypothesis ledger names observed facts, prior attempts, plausible causes, disproven causes, next probes, and confidence." : recipe.id === "qa_edge_cases" ? "The edge-case inventory names current coverage, missing boundary cases, risky inputs, and validation commands." : recipe.id === "performance" ? "The benchmark packet names workload, command, metric, baseline, variance, success threshold, and rollback signal before edits." : recipe.id === "porting" ? "The source behavior packet names source paths, target paths, incompatible assumptions, owner decision, validation, and attribution notes." : recipe.id === "experiment" ? "The experiment contract names the hypothesis, success signal, throwaway boundary, rollback or discard path, and decision owner." : recipe.id === "session_review" ? "The session review uses receipt-derived activity and marks any need for raw prompts, logs, or transcripts explicitly." : recipe.id === "session_library" ? "The session library classifies every reusable example by proof quality, privacy posture, owner approval, and reuse trigger." : options2.needsRuntimeEvidence ? "The runtime evidence packet names the observed failure source, identifier, environment, time window, symptom, and open gaps." : options2.needsWorkItem ? "The work item packet names source, id, acceptance criteria, non-goals, and the update expected after execution." : recipe.id === "research" ? "The answer names sources, risks, and next steps without editing the repo." : "Required validation evidence is attached or the missing environment is explicitly explained.",
-      recipe.id === "ticket_write" ? "Acceptance criteria, constraints, validation plan, review bar, stop conditions, and update template are parseable from the ticket body." : recipe.id === "security_dependency" ? "Install integrity, build/typecheck, targeted tests, and scanner/audit evidence show the vulnerability is remediated without breaking the dependency path." : recipe.id === "security_finding" ? "The root cause is fixed with negative regression, safe abuse-case proof, or scanner rerun evidence; suppression-only fixes are explicitly rejected or owner-approved." : recipe.id === "security_testing" ? "The added test or scanner catches the intended bad case or has a clear preventive rationale, and rollout mode is calibrated for developer workflow." : recipe.id === "internal_app" ? "The built app follows repo-native UI/data patterns and validation proves the access-control contract." : recipe.id === "stale_pr" ? "The handoff names review feedback addressed, validation, remaining risk, and next reviewer action." : recipe.id === "merge_conflict" ? "The resolution preserves intended behavior from both sides or clearly escalates unresolved semantic conflicts." : recipe.id === "flaky_test" ? "The result stabilizes the test or explains the product root cause with evidence rather than hiding the signal." : recipe.id === "small_refactor" ? "The diff stays mechanical and validation proves no intended behavior changed." : recipe.id === "bug_investigation" ? "The root cause, fix, no-fix decision, or escalation is tied to evidence and includes a follow-up watch signal." : recipe.id === "qa_edge_cases" ? "The added or improved tests cover meaningful behavior risk and do not mute, skip, or obscure the signal." : recipe.id === "performance" ? "Before/after measurements, tradeoffs, and rollback signals are recorded before the optimization is accepted." : recipe.id === "porting" ? "The target behavior preserves source intent, attribution is handled, and intentional differences are explicit." : recipe.id === "experiment" ? "The keep, discard, or formalize decision is recorded with validation and remaining production-readiness gaps." : recipe.id === "session_review" ? "Run cards or skill drafts are tied to actual receipts, validation quality, review outcomes, and privacy posture." : recipe.id === "session_library" ? "The published examples are derived from approved receipts or explicitly approved imports and include first-run commands, stop conditions, and validation expectations." : options2.needsRuntimeEvidence ? "The root cause, fix, validation, and incident or ticket update are tied back to the runtime evidence." : "The mission output is tied back to the selected recipe and context receipt.",
+      recipe.id === "ticket_write" ? "Acceptance criteria, constraints, validation plan, review bar, stop conditions, and update template are parseable from the ticket body." : recipe.id === "security_dependency" ? "Install integrity, build/typecheck, targeted tests, and scanner/audit evidence show the vulnerability is remediated without breaking the dependency path." : recipe.id === "security_finding" ? "The root cause is fixed with negative regression, safe abuse-case proof, or scanner rerun evidence; suppression-only fixes are explicitly rejected or owner-approved." : recipe.id === "security_testing" ? "The added test or scanner catches the intended bad case or has a clear preventive rationale, and rollout mode is calibrated for developer workflow." : recipe.id === "internal_app" ? "The built app follows repo-native UI/data patterns and validation proves the access-control contract." : recipe.id === "stale_pr" ? "The handoff names review feedback addressed, validation, remaining risk, and next reviewer action." : recipe.id === "merge_conflict" ? "The resolution preserves intended behavior from both sides or clearly escalates unresolved semantic conflicts." : recipe.id === "flaky_test" ? "The result stabilizes the test or explains the product root cause with evidence rather than hiding the signal." : recipe.id === "small_refactor" ? "The diff stays mechanical and validation proves no intended behavior changed." : recipe.id === "bug_investigation" ? "The root cause, fix, no-fix decision, or escalation is tied to evidence and includes a follow-up watch signal." : recipe.id === "qa_edge_cases" ? "The added or improved tests cover meaningful behavior risk and do not mute, skip, or obscure the signal." : recipe.id === "performance" ? "Before/after measurements, tradeoffs, and rollback signals are recorded before the optimization is accepted." : recipe.id === "porting" ? "The target behavior preserves source intent, attribution is handled, and intentional differences are explicit." : recipe.id === "experiment" ? "The keep, discard, or formalize decision is recorded with validation and remaining production-readiness gaps." : recipe.id === "session_review" ? "Run cards or skill drafts are tied to actual receipts, validation quality, review outcomes, and privacy posture." : recipe.id === "session_library" ? "The shared examples are derived from approved receipts or explicitly approved imports and include first-run commands, stop conditions, and validation expectations." : options2.needsRuntimeEvidence ? "The root cause, fix, validation, and incident or ticket update are tied back to the runtime evidence." : "The mission output is tied back to the selected recipe and context receipt.",
       autonomy === "read_only" ? "No repo files are changed." : "The local diff has no blocker or high Brief findings before human review.",
       "Useful repeated feedback is saved or intentionally skipped with a reason."
     ],
@@ -19012,10 +19191,10 @@ function missionHookEvents(recipe, autonomy, options2) {
   if (recipe.id === "session_library") {
     events.push({
       id: "before_session_library_publish",
-      label: "Before library publish",
+      label: "Before team sharing",
       timing: "before",
       trigger: "An agent turns previous sessions, transcripts, prompts, or run cards into shared examples.",
-      action: "Require receipt proof, privacy classification, owner approval, and explicit raw-import approval before publishing examples to the team.",
+      action: "Require receipt proof, privacy classification, owner approval, and explicit raw-import approval before sharing examples with the team.",
       mode: "blocking"
     });
   }
@@ -20251,7 +20430,7 @@ var init_missionPlan = __esm({
           guidance: [
             "Keep one curator responsible for privacy classification and final library shape.",
             "Use parallel agents only to summarize candidate receipts or draft examples from approved sources.",
-            "Do not publish raw transcripts, secrets, logs, or customer data without explicit approval."
+            "Do not share raw transcripts, secrets, logs, or customer data without explicit approval."
           ]
         }
       }),
@@ -20758,7 +20937,7 @@ function privacyBoundaryForRecipe(recipeId) {
   if (recipeId === "security_finding") {
     return [
       "redact raw secrets, tokens, cookies, customer payloads, and private logs before agent use",
-      "do not publish exploit strings or abuse-case details outside the approved repo/security channel",
+      "do not share exploit strings or abuse-case details outside the approved repo/security channel",
       "provider rotation or invalidation status is tracked without exposing the replacement credential",
       "false-positive and accepted-risk decisions need named owner approval and audit trail"
     ];
@@ -20789,7 +20968,7 @@ function privacyBoundaryForRecipe(recipeId) {
     return [
       "derive examples from receipts before raw transcripts",
       "require approval for prompts, logs, secrets, or customer data",
-      "publish concise run cards, not private session dumps"
+      "share concise run cards, not private session dumps"
     ];
   }
   return [
@@ -26220,7 +26399,7 @@ var init_agentSetup = __esm({
       "ide",
       "generic"
     ];
-    briefPublishedPackageSpec = "runbrief@0.1.2";
+    briefPublishedPackageSpec = "runbrief@0.1.3";
     TARGET_LABELS = {
       terminal: "Terminal agent",
       vscode: "VS Code",
@@ -27281,7 +27460,7 @@ function summarizeBeforeYouCodeSharedContext(delivery) {
       next: "Shared guidance is not available in this session; keep new learning personal until the workspace connection is ready."
     };
   }
-  const next = delivery.status === "applied" ? "Use the applied shared guidance, then save a focused learning or reference when the pass proves a reusable pattern." : delivery.status === "available_not_applied" ? "Shared guidance exists but did not match this task; inspect the relevant team item before creating a new pattern." : "No approved shared guidance exists yet; keep this pass personal and publish only after the pattern is proven.";
+  const next = delivery.status === "applied" ? "Use the applied shared guidance, then save a focused learning or reference when the pass proves a reusable pattern." : delivery.status === "available_not_applied" ? "Shared guidance exists but did not match this task; inspect the relevant team item before creating a new pattern." : "No approved shared guidance exists yet; keep this pass personal and make it available to the team only after the pattern is proven.";
   return {
     status: delivery.status,
     workspaceId: delivery.workspaceId,
@@ -27424,11 +27603,13 @@ function buildBeforeYouCodeMap(scan, input) {
     files,
     maxLines: 18
   });
+  const mapCoverage = mapCoverageFor2(scan);
   const stopSignals2 = unique([
     "Wrong repo, branch, or worktree.",
     ...target.branch?.startsWith("detached@") ? ["Detached HEAD; select the intended feature branch before editing."] : [],
     ...insights.agentPacket.stopSignals,
     ...productOperatingContext.stopSignals.slice(0, 3),
+    ...mapCoverage.status === "partial" ? [mapCoverage.summary] : [],
     ...target.dirty && files.length === 0 ? ["Dirty worktree is broad; classify baseline before editing."] : []
   ]).slice(0, 5);
   const status = inspectFirst.length === 0 && reuseCandidates.length === 0 ? "needs_narrower_scope" : "ready";
@@ -27448,6 +27629,7 @@ function buildBeforeYouCodeMap(scan, input) {
     reuseCandidates,
     likelyTests,
     productOperatingContext,
+    mapCoverage,
     ...context.teamGuidance ? { teamGuidance: context.teamGuidance } : {},
     referenceFirst,
     validationChecklist,
@@ -27460,6 +27642,7 @@ function buildBeforeYouCodeMap(scan, input) {
     reuseCandidates,
     likelyTests,
     productOperatingContext,
+    mapCoverage,
     validationChecklist,
     stopSignals: stopSignals2,
     ...context.teamGuidance ? { teamGuidance: context.teamGuidance } : {},
@@ -27479,7 +27662,9 @@ function buildBeforeYouCodeMap(scan, input) {
       candidates: reuseCandidates,
       decision: reuseCandidates.length > 0 ? "For each candidate, choose reuse, adapt, or rule out and record the decision before creating a new primitive." : "No reuse candidate is grounded yet; run one focused search before creating a new primitive."
     },
+    mapCoverage,
     ...context.teamGuidance ? { teamGuidance: context.teamGuidance } : {},
+    rules: context.rules.slice(0, 8),
     referenceFirst,
     likelyTests,
     exactTests,
@@ -27491,6 +27676,19 @@ function buildBeforeYouCodeMap(scan, input) {
     next: status === "ready" ? "Inspect these files and reuse candidates before editing; cite the reuse decision in the final handoff." : "Run brief.codebase_map or brief.context_for_task with a narrower task, folder, or file list before editing."
   };
 }
+function mapCoverageFor2(scan) {
+  const mappedNodes = scan.stats.mapNodeCount;
+  const omittedNodes = Math.max(0, scan.stats.mapOmittedCount ?? 0);
+  const candidateNodes = Math.max(mappedNodes, scan.stats.mapTotalCandidateCount ?? mappedNodes + omittedNodes);
+  const partial = Boolean(scan.stats.mapPartial) || omittedNodes > 0;
+  return {
+    status: partial ? "partial" : "complete",
+    mappedNodes,
+    candidateNodes,
+    omittedNodes,
+    summary: partial ? `Code map is partial: ${mappedNodes} of ${candidateNodes} candidate nodes are available; narrow by feature, folder, or symbol before treating a missing reuse candidate as proof none exists.` : `Code map covers all ${mappedNodes} indexed candidate nodes for this repo.`
+  };
+}
 function reuseStatusFor(candidates) {
   if (candidates.length === 0)
     return "missing";
@@ -27611,6 +27809,7 @@ function cockpitFor(input) {
     "Broad e2e or full-suite tests unless routing, auth, persistence, or cross-page state changed."
   ];
   const stopSignals2 = unique([
+    ...input.mapCoverage.status === "partial" ? [input.mapCoverage.summary] : [],
     ...input.stopSignals.slice(0, 3),
     ...mode === "lightweight" ? [
       "The tiny pass starts touching behavior, state, data, auth, or multiple surfaces."
@@ -27798,55 +27997,55 @@ function diversifyJourneyStages(ranked, task) {
   ];
 }
 function journeyStagePathPreference(stage, filePath) {
-  const path20 = filePath.toLowerCase();
+  const path21 = filePath.toLowerCase();
   if (stage === "acquisition") {
-    if (/landinginteractive\.[cm]?[tj]sx?$/.test(path20))
+    if (/landinginteractive\.[cm]?[tj]sx?$/.test(path21))
       return 40;
-    if (/apps\/web\/src\/app\/page\.[cm]?[tj]sx?$/.test(path20))
+    if (/apps\/web\/src\/app\/page\.[cm]?[tj]sx?$/.test(path21))
       return 35;
   }
   if (stage === "access") {
-    if (/apps\/web\/src\/app\/login\/page\.[cm]?[tj]sx?$/.test(path20))
+    if (/apps\/web\/src\/app\/login\/page\.[cm]?[tj]sx?$/.test(path21))
       return 40;
-    if (/api\/auth\/magic-link\/route\.[cm]?[tj]s$/.test(path20))
+    if (/api\/auth\/magic-link\/route\.[cm]?[tj]s$/.test(path21))
       return 35;
   }
   if (stage === "workspace") {
-    if (/api\/v1\/workspaces\/bootstrap\/route\.[cm]?[tj]s$/.test(path20)) {
+    if (/api\/v1\/workspaces\/bootstrap\/route\.[cm]?[tj]s$/.test(path21)) {
       return 40;
     }
   }
   if (stage === "activation") {
-    if (/api\/v1\/workspaces\/[^/]+\/api-keys\/route\.[cm]?[tj]s$/.test(path20)) {
+    if (/api\/v1\/workspaces\/[^/]+\/api-keys\/route\.[cm]?[tj]s$/.test(path21)) {
       return 40;
     }
-    if (/workspace-agent-actions\.[cm]?[tj]s$/.test(path20))
+    if (/workspace-agent-actions\.[cm]?[tj]s$/.test(path21))
       return 35;
-    if (/agent-handoff-composer\.[cm]?[tj]s$/.test(path20))
+    if (/agent-handoff-composer\.[cm]?[tj]s$/.test(path21))
       return 30;
   }
   if (stage === "collaboration") {
-    if (/api\/v1\/workspaces\/[^/]+\/invitations\/route\.[cm]?[tj]s$/.test(path20)) {
+    if (/api\/v1\/workspaces\/[^/]+\/invitations\/route\.[cm]?[tj]s$/.test(path21)) {
       return 40;
     }
-    if (/api\/v1\/workspaces\/[^/]+\/members\/[^/]+\/route/.test(path20)) {
+    if (/api\/v1\/workspaces\/[^/]+\/members\/[^/]+\/route/.test(path21)) {
       return 30;
     }
   }
   if (stage === "monetization") {
-    if (/billing\/checkout\/route\.[cm]?[tj]s$/.test(path20))
+    if (/billing\/checkout\/route\.[cm]?[tj]s$/.test(path21))
       return 40;
-    if (/pricing\/page\.[cm]?[tj]sx?$/.test(path20))
+    if (/pricing\/page\.[cm]?[tj]sx?$/.test(path21))
       return 35;
   }
   return 0;
 }
-function beforeYouCodePathIntentScore(path20, task) {
-  const lowerPath = (path20.split("#", 1)[0] ?? path20).toLowerCase();
+function beforeYouCodePathIntentScore(path21, task) {
+  const lowerPath = (path21.split("#", 1)[0] ?? path21).toLowerCase();
   const lowerTask = task.toLowerCase();
-  let score = namedCodePathIntentScore(path20, task);
+  let score = namedCodePathIntentScore(path21, task);
   const wantsInterface = /\b(app|design|header|interface|landing|layout|mobile|navigation|page|responsive|spacing|ui|ux|visual|workspace)\b/.test(lowerTask);
-  score += lexicalPathTaskScore(path20, task);
+  score += lexicalPathTaskScore(path21, task);
   const wantsLanding = /\b(hero|homepage|landing)\b/.test(lowerTask);
   const wantsAppShell = /\b(app|header|internal|mobile|navigation|responsive|sidebar|workspace)\b/.test(lowerTask);
   const wantsAuth = /\b(auth|authentication|callback|login|magic link|otp|session|sign[ -]?in|sign[ -]?out)\b/.test(lowerTask);
@@ -27996,8 +28195,8 @@ function beforeYouCodePathIntentScore(path20, task) {
   }
   return score;
 }
-function beforeYouCodeIntentSummary(path20, task) {
-  const normalizedPath = (path20.split("#", 1)[0] ?? path20).toLowerCase();
+function beforeYouCodeIntentSummary(path21, task) {
+  const normalizedPath = (path21.split("#", 1)[0] ?? path21).toLowerCase();
   if (!isInternalAppTask(task))
     return void 0;
   if (/apps\/web\/src\/app\/app\/page\.[cm]?[tj]sx?$/.test(normalizedPath)) {
@@ -28023,7 +28222,7 @@ function prefersPrimaryWorkspaceTask(task) {
     return true;
   return /\b(design|designer|figma|screenshot|visual|ui|ux|layout|spacing|typography|responsive|mobile)\b/i.test(task);
 }
-function lexicalPathTaskScore(path20, task) {
+function lexicalPathTaskScore(path21, task) {
   const ignored = /* @__PURE__ */ new Set([
     "agent",
     "brief",
@@ -28043,7 +28242,7 @@ function lexicalPathTaskScore(path20, task) {
     taskWords.add("workspace");
     taskWords.add("pane");
   }
-  const pathWords = path20.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 4 && !ignored.has(word));
+  const pathWords = path21.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 4 && !ignored.has(word));
   const matches = unique(pathWords.filter((word) => taskWords.has(word)));
   const structuralBonus = matches.reduce((score, word) => {
     if (!["header", "pane", "shell", "sidebar", "workspace"].includes(word)) {
@@ -28117,6 +28316,7 @@ function compactTextFor2(input) {
     `Before coding: ${input.headline}`,
     `Target: ${input.target.repoName} | ${input.target.branch ?? "branch unknown"} | ${input.target.repoRoot}`,
     `Worktree: ${input.target.dirty ? "dirty" : "clean"}${input.target.changedFiles.length ? `; changed ${input.target.changedFiles.slice(0, 4).join(", ")}` : ""}${input.target.untrackedFiles.length ? `; untracked ${input.target.untrackedFiles.slice(0, 3).join(", ")}` : ""}`,
+    `Map coverage: ${input.mapCoverage.summary}`,
     ...input.target.requestedFiles.length ? [`Scope files: ${input.target.requestedFiles.slice(0, 5).join(", ")}`] : [],
     ...input.teamGuidance ? [
       `Shared guidance: ${input.teamGuidance.applied.length > 0 ? input.teamGuidance.applied.slice(0, 2).map((item) => item.label).join(", ") : input.teamGuidance.status === "available_not_applied" ? "available, but none matched this task" : "none approved yet"}`
@@ -28167,16 +28367,20 @@ var init_agentBeforeYouCode = __esm({
 // ../core/dist/agentWorkPacket.js
 function buildAgentWorkPacket(input) {
   const before = input.beforeYouCode;
-  const rules = [
+  const rules = uniqueRules2([
     ...(before.teamGuidance?.applied ?? []).map((item) => ({
       rule: item.label,
       source: `team:${item.kind}`
     })),
+    ...(before.rules ?? []).map((item) => ({
+      rule: compact(item.body || item.title, 180),
+      source: item.sourcePaths[0] ?? "repo guidance"
+    })),
     ...before.productOperatingContext.productRules.map((item) => ({
       rule: item.rule,
       source: item.source
     }))
-  ].slice(0, 3);
+  ]).slice(0, 3);
   const tests = before.exactTests.length > 0 ? before.exactTests.slice(0, 3).map((test) => ({
     command: compact(test.command, 180),
     reason: compact(test.reason, 180),
@@ -28192,7 +28396,8 @@ function buildAgentWorkPacket(input) {
   ]).slice(0, 3);
   const stopConditions = unique2([
     ...before.stopSignals,
-    ...before.productOperatingContext.stopSignals
+    ...before.productOperatingContext.stopSignals,
+    ...before.mapCoverage.status === "partial" ? [before.mapCoverage.summary] : []
   ]).slice(0, 3);
   const nextAction = input.nextAction ?? before.next ?? "Inspect the listed files and make the reuse decision before editing.";
   const packet = {
@@ -28220,6 +28425,7 @@ function buildAgentWorkPacket(input) {
         why: compact(item.why, 140)
       }))
     },
+    mapCoverage: before.mapCoverage,
     rules,
     tests,
     acceptance,
@@ -28236,6 +28442,7 @@ function formatAgentWorkPacket(packet) {
     `Interpretation: ${packet.interpretation}`,
     `Inspect first: ${inlineList(packet.inspectFirst.map((item) => `${item.path} - ${item.why}`))}`,
     `Reuse (${packet.reuse.status}): ${packet.reuse.decision}; ${inlineList(packet.reuse.candidates.map((item) => `${item.path} - ${item.action}`))}`,
+    `Map: ${packet.mapCoverage.summary}`,
     `Rules: ${inlineList(packet.rules.map((item) => `${item.rule} [${item.source}]`))}`,
     `Focused tests: ${inlineList(packet.tests.map((item) => `${item.command} - ${item.reason}`))}`,
     `Acceptance: ${inlineList(packet.acceptance)}`,
@@ -28254,6 +28461,16 @@ function compact(value, maxLength) {
 function unique2(values) {
   return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
 }
+function uniqueRules2(rules) {
+  const seen = /* @__PURE__ */ new Set();
+  return rules.filter((item) => {
+    const key = item.rule.toLowerCase();
+    if (!item.rule || seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
 var init_agentWorkPacket = __esm({
   "../core/dist/agentWorkPacket.js"() {
     "use strict";
@@ -31192,6 +31409,7 @@ var init_diffReview = __esm({
       "handler",
       "helpers",
       "delete",
+      "dynamic",
       "get",
       "head",
       "input",
@@ -33102,7 +33320,7 @@ function cloudSyncStatus(env = process.env) {
     return {
       configured: false,
       privacyMode,
-      reason: privacyMode === "local-only" ? "Cloud sync is disabled by privacy mode." : "Set BRIEF_API_URL and BRIEF_API_KEY to enable MCP cloud sync."
+      reason: privacyMode === "local-only" ? "Cloud sync is disabled by privacy mode." : "Connect Brief from the app to authorize this device, or provide BRIEF_API_URL and BRIEF_API_KEY for an approved legacy setup."
     };
   }
   const status = {
@@ -33259,6 +33477,64 @@ async function fetchTeamContext(repoRoot, env = process.env, fetcher = fetch) {
   });
   return getTeamContextCloud(config, payload, fetcher);
 }
+async function claimRemoteLoopRun(runnerId, leaseSeconds = 180, env = process.env, fetcher = fetch) {
+  const config = cloudConfigFromEnv(env);
+  if (!config) throw new Error("Brief cloud connection is not configured for the runner.");
+  const payload = claimLoopRunRequestSchema.parse({ runnerId, leaseSeconds });
+  const body = await loopRunRequest(
+    config,
+    "/api/v1/mcp/loop-runs/claim",
+    "POST",
+    payload,
+    fetcher
+  );
+  if (!body.ok) throw new Error(body.message ?? "Brief could not claim a loop run.");
+  if (!body.run) return null;
+  const parsed = loopRunSummarySchema.safeParse(body.run);
+  if (!parsed.success) throw new Error("Brief returned an invalid loop run.");
+  return parsed.data;
+}
+async function updateRemoteLoopRun(runId, input, env = process.env, fetcher = fetch) {
+  const config = cloudConfigFromEnv(env);
+  if (!config) throw new Error("Brief cloud connection is not configured for the runner.");
+  const payload = updateLoopRunRequestSchema.parse(input);
+  const body = await loopRunRequest(
+    config,
+    `/api/v1/mcp/loop-runs/${encodeURIComponent(runId)}`,
+    "PATCH",
+    payload,
+    fetcher
+  );
+  if (!body.ok) throw new Error(body.message ?? "Brief could not update the loop run.");
+  const parsed = loopRunSummarySchema.safeParse(body.run);
+  if (!parsed.success) throw new Error("Brief returned an invalid updated loop run.");
+  return parsed.data;
+}
+async function loopRunRequest(config, route, method, payload, fetcher) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), syncTimeoutMs);
+  try {
+    const response = await fetcher(`${config.apiUrl}${route}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${config.apiKey}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal
+    });
+    const body = await safeJson(response);
+    const record = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+    const result = {
+      ok: response.ok && record.ok === true
+    };
+    if (typeof record.message === "string") result.message = record.message;
+    if (record.run !== void 0) result.run = record.run;
+    return result;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function toRepoScanSummary(scan, privacyMode) {
   return {
     repoName: scan.repoName,
@@ -33304,7 +33580,7 @@ function skippedResult(env) {
   return {
     status: "skipped",
     privacyMode,
-    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because BRIEF_API_URL or BRIEF_API_KEY is missing."
+    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because this device is not connected. Create a browser-authorized connection from the Brief app, then restart the agent."
   };
 }
 function skippedTeamContextResult(env) {
@@ -33312,7 +33588,7 @@ function skippedTeamContextResult(env) {
   return {
     status: "skipped",
     privacyMode,
-    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because BRIEF_API_URL or BRIEF_API_KEY is missing."
+    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because this device is not connected. Create a browser-authorized connection from the Brief app, then restart the agent."
   };
 }
 function normalizeApiUrl(apiUrl) {
@@ -33736,9 +34012,9 @@ function issuesValue(value) {
     if (typeof item === "string") return item;
     if (!item || typeof item !== "object") return "";
     const record = item;
-    const path20 = Array.isArray(record.path) ? record.path.join(".") : "";
+    const path21 = Array.isArray(record.path) ? record.path.join(".") : "";
     const message = stringValue(record.message);
-    return [path20, message].filter(Boolean).join(": ");
+    return [path21, message].filter(Boolean).join(": ");
   }).filter(Boolean).slice(0, 5).join("; ");
 }
 var syncTimeoutMs, canonicalBriefApiUrl, legacyBriefApiUrls;
@@ -34129,14 +34405,178 @@ var init_missionInputOptions = __esm({
   }
 });
 
-// ../mcp/src/workspace.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
+// ../mcp/src/cloudCredentials.ts
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import os from "node:os";
 import path14 from "node:path";
+async function bootstrapCloudCredentials(env = process.env) {
+  if (env.BRIEF_PRIVACY_MODE === "local-only") {
+    return { status: "skipped", reason: "local_only" };
+  }
+  if (env.BRIEF_API_URL && env.BRIEF_API_KEY) {
+    return { status: "configured", source: "env" };
+  }
+  const credentialPath = credentialsPath(env);
+  const requestedOrigin = originFrom(
+    env.BRIEF_API_URL ?? env.BRIEF_CONNECT_URL
+  );
+  const requestedWorkspace = env.BRIEF_WORKSPACE_ID?.trim();
+  const stored = readCredentialFile(credentialPath);
+  const existing = stored.credentials.find((credential2) => {
+    if (requestedOrigin && originFrom(credential2.apiUrl) !== requestedOrigin) {
+      return false;
+    }
+    return !requestedWorkspace || credential2.workspaceId === requestedWorkspace;
+  });
+  if (existing) {
+    applyCredential(env, existing);
+    return { status: "configured", source: "local_store" };
+  }
+  const connectUrl = env.BRIEF_CONNECT_URL?.trim();
+  const connectCode = env.BRIEF_CONNECT_CODE?.trim();
+  if (!connectUrl || !connectCode) {
+    return {
+      status: "skipped",
+      reason: "no_cloud_credential_or_pairing_setup"
+    };
+  }
+  let response;
+  try {
+    response = await fetch(connectUrl, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ code: connectCode }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    return {
+      status: "failed",
+      reason: "Could not reach the Brief connection service. Check your network and try a fresh setup from the Brief app."
+    };
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.ok || !body.apiUrl || !body.apiKey || !apiKeyPattern.test(body.apiKey) || !body.workspaceId || !body.privacyMode) {
+    return {
+      status: "failed",
+      reason: body?.message ?? "This Brief setup link is expired or already used. Create a fresh connection from the Brief app."
+    };
+  }
+  const credential = {
+    apiUrl: body.apiUrl,
+    apiKey: body.apiKey,
+    workspaceId: body.workspaceId,
+    privacyMode: body.privacyMode,
+    ...body.connectorId ? { connectorId: body.connectorId } : {},
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    writeCredentialFile(credentialPath, [
+      ...stored.credentials.filter(
+        (item) => item.workspaceId !== credential.workspaceId || originFrom(item.apiUrl) !== originFrom(credential.apiUrl)
+      ),
+      credential
+    ]);
+  } catch {
+    return {
+      status: "failed",
+      reason: "Brief connected, but could not save the local credential. Check permissions for the local Brief config directory and try again."
+    };
+  }
+  applyCredential(env, credential);
+  return { status: "configured", source: "pairing" };
+}
+function forgetCloudCredentials(env = process.env) {
+  const credentialPath = credentialsPath(env);
+  const stored = readCredentialFile(credentialPath);
+  const requestedOrigin = originFrom(
+    env.BRIEF_API_URL ?? env.BRIEF_CONNECT_URL
+  );
+  const requestedWorkspace = env.BRIEF_WORKSPACE_ID?.trim();
+  const remaining = stored.credentials.filter((credential) => {
+    if (requestedOrigin && originFrom(credential.apiUrl) !== requestedOrigin) {
+      return true;
+    }
+    return Boolean(
+      requestedWorkspace && credential.workspaceId !== requestedWorkspace
+    );
+  });
+  writeCredentialFile(credentialPath, remaining);
+}
+function defaultCredentialsPath(env = process.env) {
+  return credentialsPath(env);
+}
+function credentialsPath(env) {
+  return env.BRIEF_CREDENTIALS_FILE?.trim() || path14.join(
+    env.XDG_CONFIG_HOME?.trim() || path14.join(os.homedir(), ".config"),
+    "runbrief",
+    "credentials.json"
+  );
+}
+function readCredentialFile(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync3(filePath, "utf8"));
+    if (parsed.version !== 1 || !Array.isArray(parsed.credentials)) {
+      return { version: 1, credentials: [] };
+    }
+    return {
+      version: 1,
+      credentials: parsed.credentials.filter(isStoredCredential)
+    };
+  } catch {
+    return { version: 1, credentials: [] };
+  }
+}
+function writeCredentialFile(filePath, credentials) {
+  mkdirSync2(path14.dirname(filePath), { recursive: true, mode: 448 });
+  chmodSync(path14.dirname(filePath), 448);
+  writeFileSync5(
+    filePath,
+    `${JSON.stringify({ version: 1, credentials }, null, 2)}
+`,
+    { encoding: "utf8", mode: 384 }
+  );
+  chmodSync(filePath, 384);
+}
+function applyCredential(env, credential) {
+  env.BRIEF_API_URL = credential.apiUrl;
+  env.BRIEF_API_KEY = credential.apiKey;
+  env.BRIEF_WORKSPACE_ID = credential.workspaceId;
+  env.BRIEF_PRIVACY_MODE = credential.privacyMode;
+}
+function originFrom(value) {
+  if (!value) return void 0;
+  try {
+    return new URL(value).origin;
+  } catch {
+    return void 0;
+  }
+}
+function isStoredCredential(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return Boolean(
+    typeof candidate.apiUrl === "string" && typeof candidate.apiKey === "string" && apiKeyPattern.test(candidate.apiKey) && typeof candidate.workspaceId === "string" && typeof candidate.privacyMode === "string" && typeof candidate.updatedAt === "string"
+  );
+}
+var apiKeyPattern;
+var init_cloudCredentials = __esm({
+  "../mcp/src/cloudCredentials.ts"() {
+    "use strict";
+    apiKeyPattern = /^brf_(live|test)_[a-zA-Z0-9]{8,}_[a-zA-Z0-9]{24,}$/;
+  }
+});
+
+// ../mcp/src/workspace.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync4 } from "node:fs";
+import path15 from "node:path";
 function resolveRepoRoot(repoPath, options2 = {}) {
   return resolveRepoRootDetails(repoPath, options2).repoRoot;
 }
 function resolveRepoRootDetails(repoPath, options2 = {}) {
-  const cwd = path14.resolve(options2.cwd ?? process.cwd());
+  const cwd = path15.resolve(options2.cwd ?? process.cwd());
   const env = options2.env ?? process.env;
   const cwdResolution = resolveExistingRoot(cwd, "cwd");
   const cwdIsCustomerWorktree = isGitWorktree(cwdResolution.repoRoot) && !looksLikeBriefSourceCheckout(cwdResolution.repoRoot);
@@ -34150,7 +34590,7 @@ function resolveRepoRootDetails(repoPath, options2 = {}) {
   ]);
   const explicitRepoPath = repoPath?.trim();
   if (explicitRepoPath) {
-    const explicitPathKind = path14.isAbsolute(explicitRepoPath) ? "absolute" : "relative";
+    const explicitPathKind = path15.isAbsolute(explicitRepoPath) ? "absolute" : "relative";
     if (explicitPathKind === "relative" && envCandidates.length > 1) {
       return {
         ...cwdResolution,
@@ -34162,7 +34602,7 @@ function resolveRepoRootDetails(repoPath, options2 = {}) {
     const relativeBase = cwdIsCustomerWorktree ? cwdResolution.repoRoot : envCandidates[0]?.repoRoot ?? cwd;
     return {
       ...resolveExistingRoot(
-        path14.resolve(
+        path15.resolve(
           explicitPathKind === "absolute" ? cwd : relativeBase,
           explicitRepoPath
         ),
@@ -34200,7 +34640,7 @@ function resolveFromEnvVars(cwd, env, envVars, options2 = {}) {
   for (const envVar of envVars) {
     const value = cleanWorkspacePath(env[envVar]);
     if (!value) continue;
-    const start = path14.resolve(cwd, value);
+    const start = path15.resolve(cwd, value);
     if (existsSync5(start)) {
       const resolution = resolveExistingRoot(start, "environment", envVar);
       if (options2.skipBriefSource && looksLikeBriefSourceCheckout(resolution.repoRoot)) {
@@ -34213,7 +34653,7 @@ function resolveFromEnvVars(cwd, env, envVars, options2 = {}) {
 }
 function repoTargetHealth(resolution, options2 = {}) {
   const env = options2.env ?? process.env;
-  const cwd = path14.resolve(options2.cwd ?? process.cwd());
+  const cwd = path15.resolve(options2.cwd ?? process.cwd());
   const gitRoot = runGit(resolution.repoRoot, ["rev-parse", "--show-toplevel"]);
   const evidence = [
     ...rootEvidence(resolution, cwd, env),
@@ -34274,7 +34714,7 @@ function repoTargetHealth(resolution, options2 = {}) {
   };
 }
 function resolveExistingRoot(start, source, envVar) {
-  const gitStart = existsSync5(start) && !statSync4(start).isDirectory() ? path14.dirname(start) : start;
+  const gitStart = existsSync5(start) && !statSync4(start).isDirectory() ? path15.dirname(start) : start;
   const gitRoot = runGit(gitStart, ["rev-parse", "--show-toplevel"]);
   return {
     repoRoot: gitRoot && existsSync5(gitRoot) ? gitRoot : start,
@@ -34325,12 +34765,12 @@ function preferPinnedRepoRoot(env) {
   return env.BRIEF_REPO_ROOT_MODE === "pinned" || env.BRIEF_REPO_ROOT_PINNED === "true";
 }
 function looksLikeBriefSourceCheckout(repoRoot) {
-  if (!existsSync5(path14.join(repoRoot, "packages", "mcp", "src", "server.ts"))) {
+  if (!existsSync5(path15.join(repoRoot, "packages", "mcp", "src", "server.ts"))) {
     return false;
   }
   try {
     const pkg = JSON.parse(
-      readFileSync3(path14.join(repoRoot, "package.json"), "utf8")
+      readFileSync4(path15.join(repoRoot, "package.json"), "utf8")
     );
     return pkg.name === "brief";
   } catch {
@@ -34359,7 +34799,7 @@ var init_workspace = __esm({
 });
 
 // ../mcp/src/connectorReadiness.ts
-import path15 from "node:path";
+import path16 from "node:path";
 function connectorReadiness(input) {
   const runtimeLabel = input.mode === "cli" ? "Brief CLI process" : "Brief MCP connector";
   const installStatusTool = input.mode === "cli" ? "install-status or brief.install_status" : "brief.install_status";
@@ -34453,8 +34893,8 @@ function connectorReadiness(input) {
   };
 }
 function briefSourceCheckoutMismatch(input) {
-  const repoRoot = input.repoRoot ? path15.resolve(input.repoRoot) : void 0;
-  const sourceRoot = input.freshness.sourceRoot ? path15.resolve(input.freshness.sourceRoot) : void 0;
+  const repoRoot = input.repoRoot ? path16.resolve(input.repoRoot) : void 0;
+  const sourceRoot = input.freshness.sourceRoot ? path16.resolve(input.freshness.sourceRoot) : void 0;
   if (!repoRoot || !sourceRoot) return void 0;
   if (samePath(repoRoot, sourceRoot)) return void 0;
   if (!looksLikeBriefSourceCheckout(repoRoot)) return void 0;
@@ -34469,7 +34909,7 @@ function briefSourceCheckoutMismatch(input) {
   };
 }
 function samePath(left, right) {
-  return path15.normalize(left) === path15.normalize(right);
+  return path16.normalize(left) === path16.normalize(right);
 }
 var init_connectorReadiness = __esm({
   "../mcp/src/connectorReadiness.ts"() {
@@ -34603,8 +35043,8 @@ var init_connectorRecovery = __esm({
 });
 
 // ../mcp/src/serverFreshness.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
-import path16 from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync5 } from "node:fs";
+import path17 from "node:path";
 function mcpServerFreshness(options2) {
   const cwd = options2.cwd ?? process.cwd();
   const now = options2.now ?? /* @__PURE__ */ new Date();
@@ -34615,10 +35055,12 @@ function mcpServerFreshness(options2) {
     cwd,
     sourceRoot: options2.sourceRoot
   });
+  const sourceKind = options2.distribution ?? connectorDistributionFor(options2.entrypoint);
   const watchedGlobs = watchedSourceGlobs();
   const base = {
     serverStartedAt: options2.serverStartedAt.toISOString(),
     checkedAt: now.toISOString(),
+    sourceKind,
     process: {
       pid: process.pid,
       cwd,
@@ -34633,6 +35075,15 @@ function mcpServerFreshness(options2) {
     changedSinceStartCount: 0
   };
   if (!sourceRoot) {
+    if (sourceKind === "package") {
+      return {
+        status: "current",
+        ...base,
+        action: freshnessAction("current"),
+        summary: "The published Brief connector is running from an immutable package; source-checkout freshness checks are not applicable.",
+        next: "Continue using Brief normally. Update the package when you want a newer connector release."
+      };
+    }
     return {
       status: "unknown",
       ...base,
@@ -34673,6 +35124,21 @@ function mcpServerFreshness(options2) {
     next: status === "restart_recommended" ? "Call brief.restart_connector from the coding agent, then call brief.install_status again and confirm serverFreshness.status is current." : "Continue using Brief normally."
   };
 }
+function connectorDistributionFor(entrypoint) {
+  const configured = process.env.BRIEF_CONNECTOR_DISTRIBUTION;
+  if (configured === "package" || configured === "source_checkout") {
+    return configured;
+  }
+  const normalizedEntrypoint = path17.normalize(entrypoint);
+  if (normalizedEntrypoint.includes(
+    `${path17.sep}node_modules${path17.sep}runbrief${path17.sep}`
+  ) || normalizedEntrypoint.includes(
+    `${path17.sep}packages${path17.sep}runbrief${path17.sep}`
+  )) {
+    return "package";
+  }
+  return "unknown";
+}
 function freshnessAction(status) {
   if (status === "current") {
     return {
@@ -34707,30 +35173,30 @@ function findBriefSourceRoot(options2) {
   const candidates = [
     options2.sourceRoot,
     process.env.BRIEF_SOURCE_ROOT,
-    options2.entrypoint ? path16.dirname(options2.entrypoint) : void 0,
+    options2.entrypoint ? path17.dirname(options2.entrypoint) : void 0,
     options2.cwd
   ].filter((candidate) => Boolean(candidate));
   for (const candidate of candidates) {
-    const root = walkUpForBriefRoot(path16.resolve(candidate));
+    const root = walkUpForBriefRoot(path17.resolve(candidate));
     if (root) return root;
   }
   return void 0;
 }
 function walkUpForBriefRoot(start) {
-  let current = existsSync6(start) && statSafe(start)?.isFile() ? path16.dirname(start) : start;
+  let current = existsSync6(start) && statSafe(start)?.isFile() ? path17.dirname(start) : start;
   while (true) {
     if (isBriefSourceRoot(current)) return current;
-    const parent = path16.dirname(current);
+    const parent = path17.dirname(current);
     if (parent === current) return void 0;
     current = parent;
   }
 }
 function isBriefSourceRoot(candidate) {
-  const packageJsonPath = path16.join(candidate, "package.json");
+  const packageJsonPath = path17.join(candidate, "package.json");
   if (!existsSync6(packageJsonPath)) return false;
   const packageJson = readJson(packageJsonPath);
   if (packageJson?.name !== "brief") return false;
-  return existsSync6(path16.join(candidate, "packages", "mcp")) && existsSync6(path16.join(candidate, "packages", "core")) && existsSync6(path16.join(candidate, "packages", "contracts"));
+  return existsSync6(path17.join(candidate, "packages", "mcp")) && existsSync6(path17.join(candidate, "packages", "core")) && existsSync6(path17.join(candidate, "packages", "contracts"));
 }
 function watchedSourceGlobs() {
   return [
@@ -34768,7 +35234,7 @@ function collectWatchedFiles(sourceRoot, maxWatchedFiles) {
       truncated = true;
       break;
     }
-    const absolutePath = path16.join(sourceRoot, relativePath);
+    const absolutePath = path17.join(sourceRoot, relativePath);
     const stats = statSafe(absolutePath);
     if (!stats) continue;
     if (stats.isDirectory()) {
@@ -34785,7 +35251,7 @@ function collectWatchedFiles(sourceRoot, maxWatchedFiles) {
         break;
       }
       files.push({
-        path: normalizePath(path16.relative(sourceRoot, absolutePath)),
+        path: normalizePath(path17.relative(sourceRoot, absolutePath)),
         modifiedAtMs: stats.mtimeMs
       });
     }
@@ -34796,7 +35262,7 @@ function walkFiles2(sourceRoot, directory, files, maxWatchedFiles) {
   const entries = readdirSafe(directory);
   for (const entry of entries) {
     if (files.length >= maxWatchedFiles) return { truncated: true };
-    const absolutePath = path16.join(directory, entry.name);
+    const absolutePath = path17.join(directory, entry.name);
     if (entry.isDirectory()) {
       if (shouldSkipDirectory(entry.name)) continue;
       const result = walkFiles2(
@@ -34812,7 +35278,7 @@ function walkFiles2(sourceRoot, directory, files, maxWatchedFiles) {
     const stats = statSafe(absolutePath);
     if (!stats) continue;
     files.push({
-      path: normalizePath(path16.relative(sourceRoot, absolutePath)),
+      path: normalizePath(path17.relative(sourceRoot, absolutePath)),
       modifiedAtMs: stats.mtimeMs
     });
   }
@@ -34831,13 +35297,13 @@ function shouldSkipDirectory(name) {
   );
 }
 function shouldWatchFile(filePath) {
-  const base = path16.basename(filePath);
+  const base = path17.basename(filePath);
   if (base.endsWith(".tsbuildinfo")) return false;
   if (base === ".DS_Store") return false;
   return true;
 }
 function normalizePath(value) {
-  return value.split(path16.sep).join("/");
+  return value.split(path17.sep).join("/");
 }
 function statSafe(filePath) {
   try {
@@ -34855,7 +35321,7 @@ function readdirSafe(directory) {
 }
 function readJson(filePath) {
   try {
-    return JSON.parse(readFileSync4(filePath, "utf8"));
+    return JSON.parse(readFileSync5(filePath, "utf8"));
   } catch {
     return void 0;
   }
@@ -34920,7 +35386,8 @@ var init_serverInstructions = __esm({
     briefMcpInstructions = [
       "Brief is the default repo-context, reuse, review, and handoff companion for non-trivial coding work. This is the normal path, not an optional reminder. Do not wait for the user to repeat 'use Brief'.",
       "At the first Brief-relevant task in a session, call brief.install_status once and confirm the repo target and connector freshness.",
-      "When the user asks for non-trivial work, call brief.next with the user's actual request before inspecting or editing files, then follow its compact workPacket and recommendation. Keep micro changes lightweight.",
+      "Local mode is the default and does not require an account. Team mode is optional: it adds approved shared guidance through browser-authorized sync. If team sync is unavailable, continue local repo work and mention the team-sync limitation only when it affects the task.",
+      "When the user asks for non-trivial work, call brief.next with the user's actual request before inspecting or editing files, read the returned compact workPacket, and follow its recommendation before editing. Keep micro changes lightweight.",
       "Before creating a helper, component, route, workflow, command, or skill, use the returned reuse candidates or call brief.reference_implementations and brief.codebase_map.",
       "Refresh Brief context when the task, files, risk, or validation plan changes.",
       "Before a meaningful handoff, call brief.review_diff. Save and verify a handoff only for multi-step, high-risk, or durable work.",
@@ -34968,6 +35435,8 @@ function compactInstallStatus(input) {
   const degraded = !blocked && (Boolean(cloudIssue) || input.readiness.verdict !== "agent_ready" || input.workflowWiring.status === "missing" || input.workflowWiring.status === "manual_workflow_only");
   const stats = input.scan.stats;
   const mcpContractActive = input.serverInstructionsActive && input.connectorReadiness.safeToUseBrief;
+  const teamSyncStatus = input.cloudSync.configured ? input.teamContext.status === "failed" ? "unavailable" : input.teamContext.status === "fetched" ? "connected" : "checking" : "not_connected";
+  const connectionMode = teamSyncStatus === "unavailable" ? "team_degraded" : teamSyncStatus === "connected" ? "team" : "local";
   const totalMapCandidates = stats.mapTotalCandidateCount ?? stats.mapNodeCount + (stats.mapOmittedCount ?? 0);
   const mapCoveragePercent = totalMapCandidates ? Math.round(stats.mapNodeCount / totalMapCandidates * 100) : 100;
   const repoGuidanceSignals = unique4(
@@ -34996,9 +35465,16 @@ function compactInstallStatus(input) {
       status: input.connectorReadiness.status,
       safeToUse: input.connectorReadiness.safeToUseBrief,
       fresh: input.serverFreshness.status === "current",
+      distribution: input.serverFreshness.sourceKind,
       sourceRoot: input.serverFreshness.sourceRoot,
       summary: input.connectorReadiness.summary
     },
+    connection: {
+      mode: connectionMode,
+      localAvailable: input.connectorReadiness.safeToUseBrief,
+      teamSync: teamSyncStatus,
+      summary: connectionMode === "team_degraded" ? "Local repo work is available. Team sync needs attention and will not block local analysis." : connectionMode === "team" ? "Local repo work and approved team context are available." : "Local repo work is available without an account. Team sync is optional."
+    },
     cloud: {
       configured: input.cloudSync.configured,
       privacyMode: input.cloudSync.privacyMode,
@@ -35055,7 +35531,7 @@ var init_installStatus = __esm({
   "../mcp/src/installStatus.ts"() {
     "use strict";
     init_serverInstructions();
-    briefConnectorVersion = "0.1.2";
+    briefConnectorVersion = "0.1.3";
   }
 });
 
@@ -35075,8 +35551,7 @@ function buildCompactStartEnvelope(input) {
     route: {
       tool: start.intent.tool,
       ...start.intent.recipe ? { recipe: start.intent.recipe } : {},
-      ...start.intent.autonomy ? { autonomy: start.intent.autonomy } : {},
-      ...start.intent.reviewBar ? { reviewBar: start.intent.reviewBar } : {}
+      ...start.intent.autonomy ? { autonomy: start.intent.autonomy } : {}
     },
     workPacket: (() => {
       const packet = buildAgentWorkPacket({
@@ -35086,7 +35561,6 @@ function buildCompactStartEnvelope(input) {
         nextAction: input.next
       });
       return {
-        schemaVersion: packet.schemaVersion,
         compactText: packet.compactText
       };
     })(),
@@ -35241,15 +35715,15 @@ var init_startSummary = __esm({
 });
 
 // ../mcp/src/wikiInit.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import path17 from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import path18 from "node:path";
 function writeWikiInitArtifacts(repoRoot, wiki, options2) {
-  const wikiDir = path17.join(repoRoot, ".brief", "wiki");
-  const pagesDir = path17.join(wikiDir, "pages");
-  mkdirSync2(pagesDir, { recursive: true });
+  const wikiDir = path18.join(repoRoot, ".brief", "wiki");
+  const pagesDir = path18.join(wikiDir, "pages");
+  mkdirSync3(pagesDir, { recursive: true });
   const pageArtifacts = wiki.pages.map((page2) => {
-    const pagePath = path17.join(pagesDir, `${wikiPageSlug(page2)}.md`);
-    writeFileSync5(pagePath, renderWikiPageMarkdown(wiki, page2));
+    const pagePath = path18.join(pagesDir, `${wikiPageSlug(page2)}.md`);
+    writeFileSync6(pagePath, renderWikiPageMarkdown(wiki, page2));
     return {
       id: page2.id,
       title: page2.title,
@@ -35258,32 +35732,32 @@ function writeWikiInitArtifacts(repoRoot, wiki, options2) {
       quality: page2.quality.status
     };
   });
-  const readmePath = path17.join(wikiDir, "README.md");
-  writeFileSync5(readmePath, renderWikiReadme(wiki, pageArtifacts));
-  const manifestPath = path17.join(wikiDir, "manifest.json");
-  writeFileSync5(
+  const readmePath = path18.join(wikiDir, "README.md");
+  writeFileSync6(readmePath, renderWikiReadme(wiki, pageArtifacts));
+  const manifestPath = path18.join(wikiDir, "manifest.json");
+  writeFileSync6(
     manifestPath,
     `${JSON.stringify(wikiInitManifest(wiki, pageArtifacts), null, 2)}
 `
   );
-  const workflowTemplatePath = path17.join(
+  const workflowTemplatePath = path18.join(
     wikiDir,
     "brief-wiki-refresh.github-actions.yml"
   );
-  writeFileSync5(workflowTemplatePath, renderWikiRefreshWorkflow());
+  writeFileSync6(workflowTemplatePath, renderWikiRefreshWorkflow());
   const agentFiles = options2.writeAgentFiles ? ["AGENTS.md", "CLAUDE.md"].map(
     (fileName) => upsertWikiAgentInstructions(repoRoot, fileName)
   ) : [];
   let githubWorkflow2;
   if (options2.writeGithubWorkflow) {
-    const workflowPath = path17.join(
+    const workflowPath = path18.join(
       repoRoot,
       ".github",
       "workflows",
       "brief-wiki-refresh.yml"
     );
-    mkdirSync2(path17.dirname(workflowPath), { recursive: true });
-    writeFileSync5(workflowPath, renderWikiRefreshWorkflow({ active: true }));
+    mkdirSync3(path18.dirname(workflowPath), { recursive: true });
+    writeFileSync6(workflowPath, renderWikiRefreshWorkflow({ active: true }));
     githubWorkflow2 = {
       path: repoRelativePath(repoRoot, workflowPath),
       status: "written",
@@ -35473,12 +35947,12 @@ function wikiInitManifest(wiki, pageArtifacts) {
   };
 }
 function upsertWikiAgentInstructions(repoRoot, fileName) {
-  const filePath = path17.join(repoRoot, fileName);
+  const filePath = path18.join(repoRoot, fileName);
   const status = existsSync7(filePath) ? "updated" : "created";
-  const existing = status === "updated" ? readFileSync5(filePath, "utf8") : "";
+  const existing = status === "updated" ? readFileSync6(filePath, "utf8") : "";
   const initial = existing || `# ${fileName}
 `;
-  writeFileSync5(filePath, upsertMarkedBlock(initial, wikiAgentBlock()));
+  writeFileSync6(filePath, upsertMarkedBlock(initial, wikiAgentBlock()));
   return {
     path: repoRelativePath(repoRoot, filePath),
     status,
@@ -35550,7 +36024,7 @@ function renderWikiRefreshWorkflow(options2 = {}) {
     "        with:",
     "          node-version: 22",
     "      - name: Refresh wiki",
-    '        run: npx -y runbrief@0.1.2 wiki init --repo "$GITHUB_WORKSPACE" --update --no-agent-files',
+    '        run: npx -y runbrief@0.1.3 wiki init --repo "$GITHUB_WORKSPACE" --update --no-agent-files',
     "      - name: Open refresh PR",
     "        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11",
     "        with:",
@@ -35571,7 +36045,7 @@ function markdownList(items) {
   return items.map((item) => `- ${item}`).join("\n");
 }
 function repoRelativePath(repoRoot, filePath) {
-  return path17.relative(repoRoot, filePath).split(path17.sep).join("/");
+  return path18.relative(repoRoot, filePath).split(path18.sep).join("/");
 }
 function wikiReadmeRelativePath(repoRelativeFilePath) {
   return repoRelativeFilePath.replace(/^\.brief\/wiki\//, "");
@@ -35875,8 +36349,8 @@ var init_workflowWiringResponse = __esm({
 
 // ../mcp/src/server.ts
 var server_exports = {};
-import { chmodSync, mkdirSync as mkdirSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import path18 from "node:path";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import path19 from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   McpServer
@@ -36137,7 +36611,8 @@ function serverFreshness() {
   return mcpServerFreshness({
     serverStartedAt,
     entrypoint: serverModulePath,
-    mode: "server"
+    mode: "server",
+    distribution: connectorDistributionFor(serverModulePath)
   });
 }
 function summarizePacket(packet) {
@@ -36155,7 +36630,8 @@ function summarizePacket(packet) {
     sources: packet.sources,
     omitted: packet.omitted,
     ...packet.valueSignals ? { valueSignals: packet.valueSignals } : {},
-    ...packet.teamGuidance ? { teamGuidance: packet.teamGuidance } : {}
+    ...packet.teamGuidance ? { teamGuidance: packet.teamGuidance } : {},
+    ...packet.dependencyRemediation ? { dependencyRemediation: packet.dependencyRemediation } : {}
   };
 }
 function summarizeReview(review, detail = "auto") {
@@ -36593,6 +37069,7 @@ function summarizeBeforeYouCodeForStart(beforeYouCode) {
       decision: beforeYouCode.reuseFirst.decision,
       candidates: beforeYouCode.reuseFirst.candidates.slice(0, 2)
     },
+    mapCoverage: beforeYouCode.mapCoverage,
     sharedContext: summarizeBeforeYouCodeSharedContext(
       beforeYouCode.teamGuidance
     ),
@@ -36656,7 +37133,7 @@ function summarizeWorkflowWiringForStart(wiring) {
     defaultAsk: wiring.defaultAsk,
     gaps: wiring.gaps.slice(0, 3),
     chatFeedback: wiring.chatFeedback.slice(0, 2),
-    finalRecapPolicy: wiring.finalRecapPolicy,
+    finalRecapPolicy: compactFinalRecapPolicy(wiring.finalRecapPolicy),
     nextActions: wiring.nextActions.slice(0, 3)
   };
 }
@@ -36665,7 +37142,7 @@ function summarizeAutoEngageForStart(autoEngage) {
     status: autoEngage.status,
     summary: autoEngage.summary,
     chatFeedback: autoEngage.chatFeedback.slice(0, 1),
-    finalRecapPolicy: autoEngage.finalRecapPolicy,
+    finalRecapPolicy: compactFinalRecapPolicy(autoEngage.finalRecapPolicy),
     triggers: autoEngage.triggerMatrix.slice(0, 3).map((trigger) => ({
       id: trigger.id,
       label: trigger.label,
@@ -36674,6 +37151,13 @@ function summarizeAutoEngageForStart(autoEngage) {
     nextActions: autoEngage.nextActions.slice(0, 2)
   };
 }
+function compactFinalRecapPolicy(policy) {
+  return {
+    maxLines: policy.maxLines,
+    template: policy.defaultTemplate,
+    fallbackWhenNotHelpful: policy.fallbackWhenNotHelpful
+  };
+}
 function summarizeWiki(wiki) {
   return {
     wikiId: wiki.wikiId,
@@ -36726,21 +37210,22 @@ function summarizeLocalReceipt(receipt) {
 function writeHookFiles(repoRoot, files) {
   const written = [];
   for (const file of files) {
-    const targetPath = path18.join(repoRoot, file.path);
-    mkdirSync3(path18.dirname(targetPath), { recursive: true });
-    writeFileSync6(targetPath, file.body);
-    if (file.path.endsWith(".sh")) chmodSync(targetPath, 493);
+    const targetPath = path19.join(repoRoot, file.path);
+    mkdirSync4(path19.dirname(targetPath), { recursive: true });
+    writeFileSync7(targetPath, file.body);
+    if (file.path.endsWith(".sh")) chmodSync2(targetPath, 493);
     written.push(file.path);
   }
   return written;
 }
-var server, personalizationKindSchema, referenceImplementationKindSchema, referenceImplementationStatusSchema, savePersonalizationToolSchema, workItemSchema, runtimeEvidenceSchema, handoffValidationSchema, artifactEvidenceSchema, loopCatalogFocusSchema, missionRecipeIdSchema2, startIntentSchema, nextStageSchema, responseDetailSchema, serverStartedAt, serverModulePath, repoTargetGuardExemptTools;
+var cloudBootstrap, server, personalizationKindSchema, referenceImplementationKindSchema, referenceImplementationStatusSchema, savePersonalizationToolSchema, workItemSchema, runtimeEvidenceSchema, handoffValidationSchema, artifactEvidenceSchema, loopCatalogFocusSchema, missionRecipeIdSchema2, startIntentSchema, nextStageSchema, responseDetailSchema, serverStartedAt, serverModulePath, repoTargetGuardExemptTools;
 var init_server = __esm({
-  "../mcp/src/server.ts"() {
+  async "../mcp/src/server.ts"() {
     "use strict";
     init_dist();
     init_dist2();
     init_cloud();
+    init_cloudCredentials();
     init_teamContext();
     init_missionInputOptions();
     init_connectorReadiness();
@@ -36756,10 +37241,15 @@ var init_server = __esm({
     init_workspace();
     init_handoffAutofill();
     init_scanFreshness();
+    cloudBootstrap = await bootstrapCloudCredentials();
+    if (cloudBootstrap.status === "failed") {
+      console.error(`Brief cloud setup: ${cloudBootstrap.reason}`);
+      process.exit(1);
+    }
     server = new McpServer(
       {
         name: "brief",
-        version: "0.1.2"
+        version: "0.1.3"
       },
       {
         instructions: briefMcpInstructions
@@ -37214,9 +37704,12 @@ var init_server = __esm({
       {
         repoPath: z2.string().optional().describe(
           "Path inside the repo. Defaults to BRIEF_REPO_ROOT captured from the agent workspace, then current working directory."
+        ),
+        detail: z2.enum(["compact", "expanded"]).optional().describe(
+          "Use compact by default for the agent loop; request expanded only when diagnosing wiring or setup."
         )
       },
-      async ({ repoPath }) => {
+      async ({ repoPath, detail }) => {
         const repoTargetInfo = resolveRepoTarget(repoPath);
         if (repoTargetInfo.repoTarget.status === "needs_repo_target") {
           return repoTargetBlock(repoTargetInfo);
@@ -37226,14 +37719,19 @@ var init_server = __esm({
         const skillLearning = buildRepoSkillLearningReport(repoRoot, {
           maxFiles: 6e3
         });
+        const autoEngage = buildAgentAutoEngagementPlan(scan, skillLearning);
+        const workflowWiring = evaluateAgentWorkflowWiring(scan);
+        const responseDetail = detail ?? "compact";
         return jsonText({
           repoRoot,
           rootResolution,
           repoTarget,
-          autoEngage: buildAgentAutoEngagementPlan(scan, skillLearning),
-          workflowWiring: evaluateAgentWorkflowWiring(scan),
+          detail: responseDetail,
+          autoEngage: responseDetail === "expanded" ? autoEngage : summarizeAutoEngageForStart(autoEngage),
+          workflowWiring: responseDetail === "expanded" ? workflowWiring : summarizeWorkflowWiringForStart(workflowWiring),
           skillLearning: summarizeSkillLearningForStart(skillLearning, void 0),
-          next: "Install the default instruction into always-on agent guidance, then run the smoke test from the connected coding agent to prove Brief stays engaged from natural task asks."
+          next: responseDetail === "expanded" ? "Install the default instruction into always-on agent guidance, then run the smoke test from the connected coding agent to prove Brief stays engaged from natural task asks." : "Install the default instruction, then give the connected agent a normal task and confirm it calls brief.next before editing. Request detail: expanded only to diagnose wiring.",
+          detailHint: 'Call brief.auto_engage with detail: "expanded" only when diagnosing setup or workflow wiring.'
         });
       }
     );
@@ -37352,7 +37850,7 @@ var init_server = __esm({
               skills: scan.stats.skillCount
             }
           },
-          next: teamContext.status === "fetched" ? "Use brief.context_for_task to route this team context into the next task." : "Set BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID to fetch approved team context from the Brief app."
+          next: teamContext.status === "fetched" ? "Use brief.context_for_task to route this team context into the next task." : "Create a browser-authorized connection from the Brief app, then restart the agent. Approved legacy setups can provide BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID."
         });
       }
     );
@@ -38127,7 +38625,7 @@ var init_server = __esm({
         const sourceRepos = sourceRepoPaths && sourceRepoPaths.length > 0 ? sourceRepoPaths : [repoRoot];
         const inventories = sourceRepos.map(
           (sourceRepo) => buildAgentPackInventory(
-            path18.isAbsolute(sourceRepo) ? sourceRepo : path18.resolve(repoRoot, sourceRepo),
+            path19.isAbsolute(sourceRepo) ? sourceRepo : path19.resolve(repoRoot, sourceRepo),
             maxFiles === void 0 ? {} : { maxFiles }
           )
         );
@@ -39502,6 +40000,7 @@ init_dist2();
 init_teamContext();
 init_missionInputOptions();
 init_cloud();
+init_cloudCredentials();
 init_workspace();
 init_connectorReadiness();
 init_connectorRecovery();
@@ -39513,15 +40012,139 @@ init_wikiInit();
 init_handoffAutofill();
 init_mapResponse();
 init_scanFreshness();
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import path19 from "node:path";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "node:fs";
+import path20 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// ../mcp/src/runner.ts
+init_cloud();
+import { hostname } from "node:os";
+import { spawn } from "node:child_process";
+async function runLoopRunner(options2, log = console.log) {
+  const runnerId = options2.runnerId ?? `${hostname()}-${process.pid}`;
+  const intervalMs = Math.max(options2.intervalMs ?? 4e3, 1e3);
+  const env = options2.env ?? process.env;
+  let didRun = false;
+  do {
+    const run = await claimRemoteLoopRun(runnerId, 180, env);
+    if (!run) {
+      if (options2.once) return;
+      await sleep(intervalMs);
+      continue;
+    }
+    didRun = true;
+    log({ status: "running", runId: run.id, loop: run.loopName });
+    try {
+      const result = await executeAgentCommand(
+        options2.agentCommand,
+        run,
+        options2.repoRoot,
+        options2.commandTimeoutMs ?? 30 * 60 * 1e3
+      );
+      const proof = {
+        runnerId,
+        exitCode: result.exitCode,
+        stdoutBytes: Buffer.byteLength(result.stdout, "utf8"),
+        stderrBytes: Buffer.byteLength(result.stderr, "utf8"),
+        completedLocallyAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const updated = await updateRemoteLoopRun(run.id, {
+        runnerId,
+        status: result.exitCode === 0 ? "succeeded" : "failed",
+        lastEvent: result.exitCode === 0 ? "The local agent completed the loop." : "The local agent exited with a failure.",
+        resultSummary: compactOutput(result.stdout || result.stderr),
+        proof,
+        ...result.exitCode === 0 ? {} : { errorMessage: compactOutput(result.stderr || result.stdout) }
+      }, env);
+      log({ status: updated.status, runId: updated.id, proof });
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "Local runner failed.";
+      try {
+        const updated = await updateRemoteLoopRun(run.id, {
+          runnerId,
+          status: "failed",
+          lastEvent: "The local runner could not execute the agent command.",
+          errorMessage: message,
+          proof: { runnerId, completedLocallyAt: (/* @__PURE__ */ new Date()).toISOString() }
+        }, env);
+        log({ status: updated.status, runId: updated.id, error: message });
+      } catch (updateError) {
+        log({ status: "failed", runId: run.id, error: message, updateError });
+        throw new Error(
+          `The runner could not persist the failed loop state: ${updateError instanceof Error ? updateError.message : "unknown update error"}`
+        );
+      }
+    }
+  } while (!options2.once || !didRun);
+}
+async function executeAgentCommand(command2, run, repoRoot, timeoutMs) {
+  const prompt = [
+    `You are running the approved Brief team loop: ${run.loopName}.`,
+    `Run id: ${run.id}`,
+    `Repository: ${run.repoFullName ?? repoRoot}`,
+    "",
+    "Approved loop guidance:",
+    run.loopBody,
+    "",
+    "Guardrails:",
+    ...run.guardrails.length > 0 ? run.guardrails.map((item) => `- ${item}`) : ["- Stop before external side effects without approval."],
+    "",
+    "Task:",
+    run.task,
+    "",
+    "Return a concise summary of what you changed, validation run, proof, and remaining risk."
+  ].join("\n");
+  return await new Promise((resolve, reject) => {
+    const child = spawn("/bin/sh", ["-lc", command2], {
+      cwd: repoRoot,
+      env: process.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error(`Agent command timed out after ${Math.round(timeoutMs / 6e4)} minutes.`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout = `${stdout}${chunk.toString()}`.slice(-6e4);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = `${stderr}${chunk.toString()}`.slice(-2e4);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({ exitCode: code ?? 1, stdout, stderr });
+    });
+    child.stdin.end(prompt);
+  });
+}
+function compactOutput(value) {
+  return value.trim().slice(-12e3) || "The agent returned no summary.";
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// ../mcp/src/cli.ts
 var args = process.argv.slice(2);
 var command = args[0];
 var cliStartedAt = /* @__PURE__ */ new Date();
 var cliModulePath = fileURLToPath2(import.meta.url);
+if (!isCloudLogoutCommand(command)) {
+  const cloudBootstrap2 = await bootstrapCloudCredentials();
+  if (cloudBootstrap2.status === "failed") {
+    console.error(
+      `Brief team sync is unavailable: ${cloudBootstrap2.reason} Continuing in local mode.`
+    );
+  }
+}
 if (!command || command === "--stdio" || command === "stdio" || command === "mcp") {
-  await Promise.resolve().then(() => (init_server(), server_exports));
+  await init_server().then(() => server_exports);
 } else {
   await runCli(command, args.slice(1));
 }
@@ -39530,11 +40153,41 @@ async function runCli(commandName, commandArgs) {
     printJson(buildCliHelp(commandName));
     return;
   }
+  if (isCloudLogoutCommand(commandName)) {
+    forgetCloudCredentials();
+    printJson({
+      status: "cloud_credentials_removed",
+      path: defaultCredentialsPath(),
+      next: "Create a fresh browser-authorized connection from the Brief app before using team sync again."
+    });
+    return;
+  }
   const rootResolution = resolveRepoRootDetails(
     option2(commandArgs, "repo") ?? option2(commandArgs, "repoPath") ?? option2(commandArgs, "repo-path")
   );
   const repoRoot = rootResolution.repoRoot;
   const repoTarget = repoTargetHealth(rootResolution);
+  if (isCommand(commandName, "runner", "loop-runner", "run-loop")) {
+    const agentCommand = option2(commandArgs, "agent-command") ?? process.env.BRIEF_AGENT_COMMAND;
+    if (!agentCommand) {
+      fail(
+        "Missing --agent-command. Set BRIEF_AGENT_COMMAND to the local Claude, Codex, or compatible agent command."
+      );
+    }
+    const runnerOptions = {
+      repoRoot,
+      agentCommand,
+      once: hasFlag(commandArgs, "once")
+    };
+    const runnerId = option2(commandArgs, "runner-id");
+    const intervalMs = numberOption(commandArgs, "interval-ms");
+    const commandTimeoutMs = numberOption(commandArgs, "timeout-ms");
+    if (runnerId) runnerOptions.runnerId = runnerId;
+    if (intervalMs) runnerOptions.intervalMs = intervalMs;
+    if (commandTimeoutMs) runnerOptions.commandTimeoutMs = commandTimeoutMs;
+    await runLoopRunner(runnerOptions);
+    return;
+  }
   if (isCommand(commandName, "install-status", "install_status")) {
     const freshness = cliServerFreshness();
     const connector = connectorReadiness({
@@ -40200,7 +40853,7 @@ async function runCli(commandName, commandArgs) {
     const sourceRepos = filesOption2(commandArgs, "source-repos") ?? filesOption2(commandArgs, "sourceRepos") ?? filesOption2(commandArgs, "sources") ?? [repoRoot];
     const inventories = sourceRepos.map(
       (sourceRepo) => buildAgentPackInventory(
-        path19.isAbsolute(sourceRepo) ? sourceRepo : path19.resolve(repoRoot, sourceRepo),
+        path20.isAbsolute(sourceRepo) ? sourceRepo : path20.resolve(repoRoot, sourceRepo),
         maxFiles === void 0 ? {} : { maxFiles }
       )
     );
@@ -41072,7 +41725,7 @@ async function runCli(commandName, commandArgs) {
           skills: scan.stats.skillCount
         }
       },
-      next: teamContext.status === "fetched" ? "Use context_for_task to route this team context into the next task." : "Set BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID to fetch approved team context from the Brief app."
+      next: teamContext.status === "fetched" ? "Use context_for_task to route this team context into the next task." : "Create a browser-authorized connection from the Brief app, then restart the agent. Approved legacy setups can provide BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID."
     });
     return;
   }
@@ -41269,6 +41922,11 @@ async function runCli(commandName, commandArgs) {
 function isCommand(commandName, ...aliases) {
   return aliases.includes(commandName);
 }
+function isCloudLogoutCommand(commandName) {
+  return Boolean(
+    commandName && ["cloud-logout", "cloud_logout", "disconnect-cloud"].includes(commandName)
+  );
+}
 function wikiInitMode(argsList) {
   if (hasFlag(argsList, "init")) return "init";
   if (hasFlag(argsList, "update")) return "update";
@@ -41352,6 +42010,33 @@ function cliCommandHelp() {
         "After changing Brief source to confirm the running connector is fresh."
       ]
     },
+    {
+      command: "cloud-logout",
+      aliases: ["cloud_logout", "disconnect-cloud"],
+      purpose: "Remove the locally stored cloud credential so the next setup can pair a device again.",
+      repoBound: false,
+      usage: "brief cloud-logout",
+      examples: ["brief cloud-logout"],
+      whenToUse: [
+        "When a device needs to be disconnected from a Brief workspace.",
+        "When a one-time browser pairing has expired before the connector started."
+      ]
+    },
+    {
+      command: "runner",
+      aliases: ["loop-runner", "run-loop"],
+      purpose: "Poll for an approved team loop and execute it with the developer's local agent command.",
+      repoBound: true,
+      usage: 'runbrief runner --repo $PWD --agent-command "claude -p"',
+      examples: [
+        'runbrief runner --repo $PWD --agent-command "claude -p"',
+        'runbrief runner --repo $PWD --agent-command "codex exec" --once'
+      ],
+      whenToUse: [
+        "After pairing a connector from the Brief app.",
+        "When a team-approved loop is queued in the web app."
+      ]
+    },
     {
       command: "next",
       aliases: ["brief-next", "brief_next"],
@@ -41697,7 +42382,11 @@ function positionalText(argsList) {
     "owner",
     "receipts",
     "added-by",
-    "addedBy"
+    "addedBy",
+    "agent-command",
+    "runner-id",
+    "interval-ms",
+    "timeout-ms"
   ]);
   const parts = [];
   for (let index = 0; index < argsList.length; index += 1) {
@@ -41953,7 +42642,7 @@ function artifactEvidenceFromOptions(argsList) {
   );
   const evidence = [];
   for (const raw of rawEvidenceValues) {
-    const json = raw.startsWith("@") ? readFileSync6(path19.resolve(raw.slice(1)), "utf8") : raw;
+    const json = raw.startsWith("@") ? readFileSync7(path20.resolve(raw.slice(1)), "utf8") : raw;
     try {
       const parsed = JSON.parse(json);
       const items = Array.isArray(parsed) ? parsed : [parsed];
@@ -42031,7 +42720,7 @@ function missionSummaryFromLocalReceipt2(repoRoot, missionReceiptId) {
 function runtimeEvidencePacketFromOptions(argsList) {
   const raw = option2(argsList, "runtime-packet") ?? option2(argsList, "runtime-evidence-packet") ?? option2(argsList, "runtimeEvidencePacket");
   if (!raw) return void 0;
-  const json = raw.startsWith("@") ? readFileSync6(path19.resolve(raw.slice(1)), "utf8") : raw;
+  const json = raw.startsWith("@") ? readFileSync7(path20.resolve(raw.slice(1)), "utf8") : raw;
   try {
     return cleanRuntimeEvidencePacket2(
       runtimeEvidencePacketSchema.parse(JSON.parse(json))
@@ -42200,6 +42889,15 @@ function printContextSummary(packet, localReceipt, teamContext) {
     teamContextLine(teamContext),
     teamGuidanceLine(packet),
     valueSignalLine(packet),
+    ...packet.dependencyRemediation ? [
+      "",
+      "Dependency plan:",
+      `- ${packet.dependencyRemediation.packageManager} \xB7 ${packet.dependencyRemediation.status}`,
+      `- manifests: ${packet.dependencyRemediation.manifestFiles.slice(0, 4).join(", ") || "none found"}`,
+      `- lockfiles: ${packet.dependencyRemediation.lockfiles.slice(0, 3).join(", ") || "none found"}`,
+      `- packages: ${packet.dependencyRemediation.packageSignals.map((item) => item.name).join(", ") || "need advisory/scanner evidence"}`,
+      `- graph proof: ${packet.dependencyRemediation.graphCommands.slice(0, 2).join(", ") || "name the direct/transitive path"}`
+    ] : [],
     "",
     "Rules:",
     ...packet.rules.length > 0 ? packet.rules.slice(0, 8).map((rule) => `- [${rule.enforcement}] ${rule.title}`) : ["- none"],
@@ -42252,10 +42950,10 @@ function valueSignalLine(packet) {
 function writeHookFiles2(repoRoot, files) {
   const written = [];
   for (const file of files) {
-    const targetPath = path19.join(repoRoot, file.path);
-    mkdirSync4(path19.dirname(targetPath), { recursive: true });
-    writeFileSync7(targetPath, file.body);
-    if (file.path.endsWith(".sh")) chmodSync2(targetPath, 493);
+    const targetPath = path20.join(repoRoot, file.path);
+    mkdirSync5(path20.dirname(targetPath), { recursive: true });
+    writeFileSync8(targetPath, file.body);
+    if (file.path.endsWith(".sh")) chmodSync3(targetPath, 493);
     written.push(file.path);
   }
   return written;
@@ -42383,7 +43081,8 @@ function cliServerFreshness() {
   return mcpServerFreshness({
     serverStartedAt: cliStartedAt,
     entrypoint: cliModulePath,
-    mode: "cli"
+    mode: "cli",
+    distribution: connectorDistributionFor(cliModulePath)
   });
 }
 function printJson(value) {
@@ -42407,7 +43106,7 @@ function nextScanStep(cloudSync) {
   if (cloudSync.status === "failed") {
     return `The local scan succeeded, but the web app did not update because cloud sync failed: ${cloudSync.reason}. Fix cloud sync before trusting hosted freshness; refresh local wiki separately with brief.initialize_repo_wiki update: true.`;
   }
-  return "The local scan succeeded, but the web app did not update. Set BRIEF_API_URL, BRIEF_API_KEY, BRIEF_WORKSPACE_ID, and BRIEF_PRIVACY_MODE=cloud-sync-derived to sync scans to Brief. To refresh repo-local wiki docs, ask the agent to call brief.initialize_repo_wiki with update: true.";
+  return "The local scan succeeded, but the web app did not update. Create a browser-authorized connection from the Brief app and restart the agent; approved legacy setups can provide BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID. To refresh repo-local wiki docs, ask the agent to call brief.initialize_repo_wiki with update: true.";
 }
 function fail(message) {
   process.stderr.write(`${message}