runbrief 0.1.2 → 0.1.4

package/dist/cli.js

@@ -6,7 +6,7 @@ var __esm = (fn, res) => function __init() {
 
 // ../contracts/dist/index.js
 import { z } from "zod";
-var privacyModeSchema, enforcementSchema, skillStatusSchema, learningStatusSchema, findingSeveritySchema, prReadinessVerdictSchema, preCodingContextProofSchema, prReadinessCheckStatusSchema, prReadinessGateIdSchema, prReadinessGateStatusSchema, prReadinessStatusSchema, prReadinessDeliveryModeSchema, githubCheckConclusionSchema, agentSurfaceModeSchema, agentSurfaceCategorySchema, agentSurfaceCredentialStorageSchema, agentSurfaceRepoResolutionSchema, agentSurfaceTrustBoundarySchema, briefProofStateSchema, briefToolNameSchema, agentSurfaceContractSchema, briefRunPhaseSchema, briefRunContractSchema, briefProofContractSchema, repoRefSchema, scanStatsSchema, sourceDocumentSchema, ruleSchema, betaReadinessSchema, skillSchema, mapNodeSchema, reviewMemorySchema, wikiEvidenceItemSchema, wikiPageTypeSchema, wikiPageEvidenceMixSchema, wikiPageEntitySchema, wikiPageFreshnessSchema, wikiPageSourceProofSchema, wikiPageAgentBriefSchema, wikiPageQualitySchema, wikiPageSchema, prReadinessFindingSchema, prReadinessPullRequestSchema, prReadinessContextProofInputSchema, prReadinessCheckSchema, prReadinessGateResultSchema, prReadinessContractSchema, prReadinessReportRequestSchema, severityCountsSchema, prReadinessAnnotationSchema, prReadinessGithubCheckSchema, prReadinessReportSchema, prReadinessReportResponseSchema, repoScanSummarySchema, syncScanRequestSchema, teamGuidanceItemSchema, teamGuidanceDeliverySchema, contextPacketSchema, contextReceiptRequestSchema, missionRecipeIdSchema, missionWorkItemSchema, missionRuntimeEvidenceSchema, runtimeEvidencePullInstructionSchema, runtimeEvidencePacketSchema, missionHandoffValidationSchema, missionHandoffReviewReadinessSchema, missionHandoffReviewSchema, missionHandoffProofStatusSchema, missionHandoffValidationSummarySchema, missionHandoffArtifactEvidenceSchema, missionHandoffArtifactProofSchema, missionHandoffChangedFileAttributionSchema, missionHandoffProofBundleSchema, missionHandoffRequestSchema, evidenceRedactionFindingSchema, evidenceRedactionReportSchema, learningCreateRequestSchema, teamContextRequestSchema, teamContextResponseSchema, apiAcceptedResponseSchema;
+var privacyModeSchema, loopRunStatusSchema, loopRunProofSchema, loopRunSummarySchema, createLoopRunRequestSchema, claimLoopRunRequestSchema, updateLoopRunRequestSchema, enforcementSchema, skillStatusSchema, learningStatusSchema, findingSeveritySchema, prReadinessVerdictSchema, preCodingContextProofSchema, prReadinessCheckStatusSchema, prReadinessGateIdSchema, prReadinessGateStatusSchema, prReadinessStatusSchema, prReadinessDeliveryModeSchema, githubCheckConclusionSchema, agentSurfaceModeSchema, agentSurfaceCategorySchema, agentSurfaceCredentialStorageSchema, agentSurfaceRepoResolutionSchema, agentSurfaceTrustBoundarySchema, briefProofStateSchema, briefToolNameSchema, agentSurfaceContractSchema, briefRunPhaseSchema, briefRunContractSchema, briefProofContractSchema, repoRefSchema, scanStatsSchema, sourceDocumentSchema, ruleSchema, betaReadinessSchema, skillSchema, mapNodeSchema, reviewMemorySchema, wikiEvidenceItemSchema, wikiPageTypeSchema, wikiPageEvidenceMixSchema, wikiPageEntitySchema, wikiPageFreshnessSchema, wikiPageSourceProofSchema, wikiPageAgentBriefSchema, wikiPageQualitySchema, wikiPageSchema, prReadinessFindingSchema, prReadinessPullRequestSchema, prReadinessContextProofInputSchema, prReadinessCheckSchema, prReadinessGateResultSchema, prReadinessContractSchema, prReadinessReportRequestSchema, severityCountsSchema, prReadinessAnnotationSchema, prReadinessGithubCheckSchema, prReadinessReportSchema, prReadinessReportResponseSchema, repoScanSummarySchema, syncScanRequestSchema, teamGuidanceItemSchema, teamGuidanceDeliverySchema, dependencyPackageSignalSchema, dependencyRemediationSchema, contextPacketSchema, contextReceiptRequestSchema, missionRecipeIdSchema, missionWorkItemSchema, missionRuntimeEvidenceSchema, runtimeEvidencePullInstructionSchema, runtimeEvidencePacketSchema, missionHandoffValidationSchema, missionHandoffReviewReadinessSchema, missionHandoffReviewSchema, missionHandoffProofStatusSchema, missionHandoffValidationSummarySchema, missionHandoffArtifactEvidenceSchema, missionHandoffArtifactProofSchema, missionHandoffChangedFileAttributionSchema, missionHandoffProofBundleSchema, missionHandoffRequestSchema, evidenceRedactionFindingSchema, evidenceRedactionReportSchema, learningCreateRequestSchema, teamContextRequestSchema, teamContextResponseSchema, apiAcceptedResponseSchema;
 var init_dist = __esm({
   "../contracts/dist/index.js"() {
     "use strict";
@@ -15,6 +15,56 @@ var init_dist = __esm({
       "cloud-sync-derived",
       "team-cloud"
     ]);
+    loopRunStatusSchema = z.enum([
+      "queued",
+      "running",
+      "succeeded",
+      "failed",
+      "cancelled"
+    ]);
+    loopRunProofSchema = z.record(z.string(), z.unknown());
+    loopRunSummarySchema = z.object({
+      id: z.string().uuid(),
+      workspaceId: z.string().uuid(),
+      loopId: z.string().uuid(),
+      loopName: z.string().min(1),
+      loopBody: z.string().min(1),
+      guardrails: z.array(z.string().min(1)).max(30),
+      loopVersion: z.number().int().positive(),
+      task: z.string().min(1).max(12e3),
+      repoFullName: z.string().min(1).max(240).optional(),
+      autonomy: z.enum(["read_only", "repo_edit", "validate", "handoff"]),
+      status: loopRunStatusSchema,
+      attemptCount: z.number().int().nonnegative(),
+      runnerId: z.string().min(1).max(160).nullable(),
+      leaseExpiresAt: z.string().datetime().nullable(),
+      lastEvent: z.string().max(2e3).nullable(),
+      resultSummary: z.string().max(12e3).nullable(),
+      proof: loopRunProofSchema,
+      errorMessage: z.string().max(4e3).nullable(),
+      createdAt: z.string().datetime(),
+      startedAt: z.string().datetime().nullable(),
+      completedAt: z.string().datetime().nullable()
+    });
+    createLoopRunRequestSchema = z.object({
+      loopId: z.string().uuid(),
+      task: z.string().trim().min(1).max(12e3),
+      repoFullName: z.string().trim().min(1).max(240).optional(),
+      idempotencyKey: z.string().trim().min(16).max(160)
+    });
+    claimLoopRunRequestSchema = z.object({
+      runnerId: z.string().trim().min(1).max(160),
+      leaseSeconds: z.number().int().min(30).max(900).default(180)
+    });
+    updateLoopRunRequestSchema = z.object({
+      runnerId: z.string().trim().min(1).max(160),
+      status: loopRunStatusSchema,
+      lastEvent: z.string().trim().max(2e3).optional(),
+      resultSummary: z.string().trim().max(12e3).optional(),
+      proof: loopRunProofSchema.optional(),
+      errorMessage: z.string().trim().max(4e3).optional(),
+      leaseSeconds: z.number().int().min(30).max(900).optional()
+    });
     enforcementSchema = z.enum([
       "advisory",
       "warn",
@@ -621,6 +671,46 @@ var init_dist = __esm({
       applied: z.array(teamGuidanceItemSchema).max(100),
       omittedCount: z.number().int().nonnegative()
     });
+    dependencyPackageSignalSchema = z.object({
+      name: z.string().min(1).max(160),
+      changeKind: z.enum([
+        "patch_or_minor",
+        "major",
+        "added_or_overridden",
+        "unknown"
+      ]),
+      manifestPaths: z.array(z.string().min(1).max(500)).max(20),
+      lockfilePaths: z.array(z.string().min(1).max(500)).max(20),
+      evidence: z.array(z.string().min(1).max(120)).max(10)
+    });
+    dependencyRemediationSchema = z.object({
+      id: z.string().min(1).max(120),
+      status: z.enum(["ready", "needs_evidence"]),
+      packageManager: z.enum([
+        "pnpm",
+        "npm",
+        "yarn",
+        "bun",
+        "pip",
+        "bundler",
+        "go",
+        "cargo",
+        "unknown"
+      ]),
+      manifestFiles: z.array(z.string().min(1).max(500)).max(30),
+      lockfiles: z.array(z.string().min(1).max(500)).max(20),
+      workspaceFiles: z.array(z.string().min(1).max(500)).max(20),
+      changedDependencyFiles: z.array(z.string().min(1).max(500)).max(30),
+      directDependencyFiles: z.array(z.string().min(1).max(500)).max(30),
+      packageSignals: z.array(dependencyPackageSignalSchema).max(20),
+      graphCommands: z.array(z.string().min(1).max(500)).max(20),
+      remediationCommands: z.array(z.string().min(1).max(500)).max(20),
+      validationCommands: z.array(z.string().min(1).max(500)).max(20),
+      residualRiskChecks: z.array(z.string().min(1).max(800)).max(20),
+      handoffRequirements: z.array(z.string().min(1).max(800)).max(20),
+      summary: z.string().max(1200),
+      confidence: z.number().min(0).max(100)
+    });
     contextPacketSchema = z.object({
       packetId: z.string().min(1),
       createdAt: z.string().datetime(),
@@ -643,7 +733,8 @@ var init_dist = __esm({
         appliedTeamGuidanceCount: z.number().int().nonnegative(),
         suggestedTestCount: z.number().int().nonnegative()
       }).optional(),
-      teamGuidance: teamGuidanceDeliverySchema.optional()
+      teamGuidance: teamGuidanceDeliverySchema.optional(),
+      dependencyRemediation: dependencyRemediationSchema.optional()
     });
     contextReceiptRequestSchema = z.object({
       workspaceId: z.string().uuid().optional(),
@@ -674,6 +765,7 @@ var init_dist = __esm({
       "small_refactor",
       "bug_investigation",
       "qa_edge_cases",
+      "web_dogfood",
       "performance",
       "porting",
       "experiment",
@@ -5296,22 +5388,22 @@ function likelyRuleLine(line) {
   return hasStrongRule || hasOperationalRule;
 }
 function scopeFromPath(sourcePath, kind) {
-  const path20 = sourcePath.replaceAll("\\", "/");
-  const directoryScope = scopedDirectory(path20);
-  if (directoryScope && (path20.endsWith("/AGENTS.md") || path20.endsWith("/CLAUDE.md")))
+  const path21 = sourcePath.replaceAll("\\", "/");
+  const directoryScope = scopedDirectory(path21);
+  if (directoryScope && (path21.endsWith("/AGENTS.md") || path21.endsWith("/CLAUDE.md")))
     return [directoryScope];
-  if (path20.includes("client/") || kind === "frontend")
+  if (path21.includes("client/") || kind === "frontend")
     return ["client/**", "packages/ui/**"];
-  if (path20.includes("server/") || kind === "persistence")
+  if (path21.includes("server/") || kind === "persistence")
     return ["server/**"];
-  if (path20.includes(".github/") || kind === "workflow")
+  if (path21.includes(".github/") || kind === "workflow")
     return ["**/*"];
-  if (path20.includes("test") || kind === "testing")
+  if (path21.includes("test") || kind === "testing")
     return ["**/*.test.*", "**/*.spec.*", "tests/**"];
   return ["**/*"];
 }
-function scopedDirectory(path20) {
-  const parts = path20.split("/");
+function scopedDirectory(path21) {
+  const parts = path21.split("/");
   if (parts.length <= 1)
     return null;
   const directory = parts.slice(0, -1).join("/");
@@ -5381,12 +5473,12 @@ function sourceReadLimit(type) {
     return CODE_SOURCE_MAX_BYTES;
   return void 0;
 }
-function sourceDocument(pathName, type, content) {
+function sourceDocument(pathName2, type, content) {
   return {
-    id: idFor("src", `${pathName}:${content}`),
-    path: pathName,
+    id: idFor("src", `${pathName2}:${content}`),
+    path: pathName2,
     type,
-    title: titleFromPath(pathName),
+    title: titleFromPath(pathName2),
     excerpt: firstLines(content, 14),
     content,
     contentHash: contentHash(content),
@@ -7531,12 +7623,12 @@ function extractReviewMemories(sources, rules) {
   }
   return memories.slice(0, 32);
 }
-function mapNode(type, pathName, summary, tags, metadata) {
+function mapNode(type, pathName2, summary, tags, metadata) {
   const node = {
-    id: idFor("map", `${type}:${pathName}`),
+    id: idFor("map", `${type}:${pathName2}`),
     type,
-    name: titleFromPath(pathName),
-    path: pathName,
+    name: titleFromPath(pathName2),
+    path: pathName2,
     summary,
     tags
   };
@@ -8605,7 +8697,7 @@ function agentPacketPrompt(input) {
   ].filter(Boolean).join(" ");
 }
 function inspectReasonForNode(node) {
-  const path20 = pathKey(node);
+  const path21 = pathKey(node);
   const systems = metadataStrings2(node, "systems");
   const tables = metadataStrings2(node, "tables");
   const access = metadataStrings2(node, "accessControls");
@@ -8625,7 +8717,7 @@ function inspectReasonForNode(node) {
     return "Entrypoint that frames runtime flow.";
   if (node.type === "component")
     return "UI component surface in mapped scope.";
-  return `Mapped ${node.type} node for ${path20}.`;
+  return `Mapped ${node.type} node for ${path21}.`;
 }
 function strongestEntityEvidenceKind(nodes, kind, name) {
   const matchingNodes = nodes.filter((node) => metadataStrings2(node, metadataKeyForEntity(kind)).includes(name));
@@ -8698,17 +8790,17 @@ function topFacet(nodes, key, limit) {
 function topAreaFacet(nodes, limit) {
   const areas = /* @__PURE__ */ new Map();
   for (const node of nodes) {
-    const path20 = pathKey(node);
-    const prefix = areaPrefix(path20);
+    const path21 = pathKey(node);
+    const prefix = areaPrefix(path21);
     const entry = areas.get(prefix) ?? {
       paths: /* @__PURE__ */ new Set(),
       codeSurfaceCount: 0,
       systems: /* @__PURE__ */ new Set()
     };
-    if (!entry.paths.has(path20) && CODE_SURFACE_TYPES.has(node.type)) {
+    if (!entry.paths.has(path21) && CODE_SURFACE_TYPES.has(node.type)) {
       entry.codeSurfaceCount += 1;
     }
-    entry.paths.add(path20);
+    entry.paths.add(path21);
     for (const system of metadataStrings2(node, "systems")) {
       entry.systems.add(system);
     }
@@ -10564,7 +10656,7 @@ function wikiBuildPipeline(scan, pages, operationalAtlas, loopPlaybooks, refresh
     },
     {
       id: "publish",
-      title: "Publish for loops",
+      title: "Share with loops",
       status: "ready",
       summary: "Mission planning and context packets can cite wiki pages as source-grounded operating context.",
       evidence: ["brief.wiki_outline", "brief.context_for_task"]
@@ -10992,7 +11084,7 @@ function loopPlaybookSpec(loopId) {
   if (loopId === "session_library") {
     return {
       title: "Session library loop",
-      summary: "Promote proven agent runs into reusable team skills, loops, styles, and run cards without publishing raw transcripts by default.",
+      summary: "Promote proven agent runs into reusable team skills, loops, styles, and run cards without sharing raw transcripts by default.",
       tools: [
         "brief.agent_session_insights",
         "brief.value_report",
@@ -11013,7 +11105,7 @@ function loopPlaybookSpec(loopId) {
       ],
       privacyBoundary: [
         ...common.privacyBoundary,
-        "Publish concise run cards and styles, not raw private sessions, unless explicitly approved."
+        "Share concise run cards and styles, not raw private sessions, unless explicitly approved."
       ],
       systemHints: ["github", "ci"],
       queryHint: "agent session receipts run cards skills loops styles",
@@ -11204,7 +11296,7 @@ function wikiUsageReceipts(pages, options2) {
       loopId: "session_library",
       tool: "brief.mission_plan",
       pageIds: pageIds("Session Library", "Review Memory", "Team Standards", "Maintainers"),
-      reason: "Session library loops need approved examples, privacy decisions, maintainer context, and reusable team standards before publishing run cards or skills."
+      reason: "Session library loops need approved examples, privacy decisions, maintainer context, and reusable team standards before sharing run cards or skills."
     },
     {
       id: `wiki_use_${contentHash("docs:overview:structure")}`,
@@ -11387,9 +11479,9 @@ var init_contextWiki = __esm({
 });
 
 // ../core/dist/pathIntent.js
-function namedCodePathIntentScore(path20, task) {
+function namedCodePathIntentScore(path21, task) {
   const normalizedTask = task.toLowerCase().replace(/[_-]+/g, " ");
-  const normalizedPath = (path20.split("#", 1)[0] ?? path20).toLowerCase();
+  const normalizedPath = (path21.split("#", 1)[0] ?? path21).toLowerCase();
   let score = 0;
   const namedTargets = [
     [/\breview diff\b/, /diffreview|diff[-_]review/],
@@ -11535,9 +11627,476 @@ var init_pathIntent = __esm({
   }
 });
 
+// ../core/dist/dependencyRemediation.js
+import path6 from "node:path";
+function buildDependencyRemediationPlan(repoRoot, request) {
+  const files = walkFiles(repoRoot, request.maxFiles ?? 6e3);
+  const manifests = files.filter(isDependencyManifest);
+  const lockfiles = files.filter(isDependencyLockfile);
+  const workspaceFiles = files.filter(isDependencyWorkspaceFile);
+  const changedDependencyFiles = unique((request.changedFiles ?? []).filter(isDependencyFile));
+  const packageManager = inferPackageManager(repoRoot, manifests, lockfiles);
+  const packageSignalInput = {
+    task: request.task,
+    manifests,
+    changedDependencyFiles
+  };
+  if (request.diff)
+    packageSignalInput.diff = request.diff;
+  const packageSignals = packageSignalsFor(repoRoot, packageSignalInput);
+  const directDependencyFiles = unique(packageSignals.flatMap((signal2) => signal2.manifestPaths));
+  const packageNames = packageSignals.map((signal2) => signal2.name);
+  const validationCommands2 = validationCommandsFor2(repoRoot, packageManager);
+  const graphCommands = dependencyGraphCommandsFor(packageManager, packageNames);
+  const remediationCommands = remediationCommandsFor(packageManager, packageNames);
+  const residualRiskChecks = residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles);
+  const confidence = confidenceFor({
+    changedDependencyFiles,
+    packageSignals,
+    lockfiles,
+    validationCommands: validationCommands2
+  });
+  return {
+    id: `dep_${contentHash([
+      request.task,
+      packageManager,
+      changedDependencyFiles.join(","),
+      packageNames.join(",")
+    ].join(":"))}`,
+    status: changedDependencyFiles.length > 0 || packageSignals.length > 0 ? "ready" : "needs_evidence",
+    packageManager,
+    manifestFiles: manifests.slice(0, 20),
+    lockfiles,
+    workspaceFiles,
+    changedDependencyFiles,
+    directDependencyFiles,
+    packageSignals,
+    graphCommands,
+    remediationCommands,
+    validationCommands: validationCommands2,
+    residualRiskChecks,
+    handoffRequirements: [
+      "List advisory ids or scanner finding ids that were fixed.",
+      "Name packages still present in the lockfile with vulnerable versions, or state that the scan/audit is clean.",
+      "Explain any major-version upgrades, overrides, peer dependency changes, skipped advisories, or remaining advisory ids.",
+      "Attach validation commands and CI follow-up results before marking the security mission done."
+    ],
+    summary: summaryFor3({
+      packageManager,
+      manifests,
+      lockfiles,
+      changedDependencyFiles,
+      packageSignals,
+      validationCommands: validationCommands2
+    }),
+    confidence
+  };
+}
+function isDependencyRemediationTask(task, files = []) {
+  const normalized = task.toLowerCase();
+  const hasSecuritySignal = /\b(dependabot|vulnerab\w*|cve-|ghsa-|security advisory|security finding|audit finding|osv|sca|dependency-review)\b/.test(normalized);
+  const hasDependencyChangeSignal = /\b(dependency|dependencies|lockfile|package upgrade|package update|package bump|transitive|override|resolution)\b/.test(normalized);
+  return hasSecuritySignal || hasDependencyChangeSignal && files.some(isDependencyFile);
+}
+function isDependencyFile(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return dependencyFilePatterns.some((pattern) => normalized === pattern || normalized.endsWith(`/${pattern}`) || pattern === "package.json" && normalized.endsWith("/package.json"));
+}
+function isDependencyLockfile(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized === "pnpm-lock.yaml" || normalized.endsWith("/pnpm-lock.yaml") || normalized === "package-lock.json" || normalized.endsWith("/package-lock.json") || normalized === "yarn.lock" || normalized.endsWith("/yarn.lock") || normalized === "bun.lock" || normalized.endsWith("/bun.lock") || normalized === "npm-shrinkwrap.json" || normalized.endsWith("/npm-shrinkwrap.json") || normalized === "poetry.lock" || normalized.endsWith("/poetry.lock") || normalized === "Pipfile.lock" || normalized.endsWith("/Pipfile.lock") || normalized === "Gemfile.lock" || normalized.endsWith("/Gemfile.lock") || normalized === "go.sum" || normalized.endsWith("/go.sum") || normalized === "Cargo.lock" || normalized.endsWith("/Cargo.lock");
+}
+function isDependencyManifest(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized === "package.json" || normalized.endsWith("/package.json") || normalized === "requirements.txt" || normalized.endsWith("/requirements.txt") || normalized === "pyproject.toml" || normalized.endsWith("/pyproject.toml") || normalized === "Gemfile" || normalized.endsWith("/Gemfile") || normalized === "go.mod" || normalized.endsWith("/go.mod") || normalized === "Cargo.toml" || normalized.endsWith("/Cargo.toml");
+}
+function isDependencyWorkspaceFile(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized === "pnpm-workspace.yaml" || normalized.endsWith("/pnpm-workspace.yaml") || normalized === "lerna.json" || normalized.endsWith("/lerna.json") || normalized === "turbo.json" || normalized.endsWith("/turbo.json") || normalized === "nx.json" || normalized.endsWith("/nx.json");
+}
+function inferPackageManager(repoRoot, manifests, lockfiles) {
+  const rootPackageJson = readPackageJson(repoRoot, "package.json");
+  const packageManager = rootPackageJson?.packageManager;
+  if (typeof packageManager === "string") {
+    if (packageManager.startsWith("pnpm@"))
+      return "pnpm";
+    if (packageManager.startsWith("yarn@"))
+      return "yarn";
+    if (packageManager.startsWith("npm@"))
+      return "npm";
+    if (packageManager.startsWith("bun@"))
+      return "bun";
+  }
+  if (lockfiles.some((file) => file.endsWith("pnpm-lock.yaml")))
+    return "pnpm";
+  if (lockfiles.some((file) => file.endsWith("yarn.lock")))
+    return "yarn";
+  if (lockfiles.some((file) => file.endsWith("package-lock.json"))) {
+    return "npm";
+  }
+  if (lockfiles.some((file) => file.endsWith("bun.lock")))
+    return "bun";
+  if (manifests.some((file) => file.endsWith("requirements.txt") || file.endsWith("pyproject.toml") || file.endsWith("Pipfile"))) {
+    return "pip";
+  }
+  if (manifests.some((file) => file.endsWith("Gemfile")))
+    return "bundler";
+  if (manifests.some((file) => file.endsWith("go.mod")))
+    return "go";
+  if (manifests.some((file) => file.endsWith("Cargo.toml")))
+    return "cargo";
+  return "unknown";
+}
+function packageSignalsFor(repoRoot, input) {
+  const manifestDeps = dependencyNamesByManifest(repoRoot, input.manifests);
+  const explicitPackageNames = unique([
+    ...packagesMentionedInText(input.task),
+    ...packagesMentionedInDiff(input.diff ?? "")
+  ]).filter((name) => !looksLikeVersionOrAdvisory(name));
+  const fallbackPackageNames = input.changedDependencyFiles.flatMap((file) => packagesFromChangedDependencyFile(repoRoot, file));
+  const packageNames = unique(explicitPackageNames.length > 0 ? explicitPackageNames : fallbackPackageNames).filter((name) => !looksLikeVersionOrAdvisory(name));
+  return packageNames.slice(0, 16).map((name) => ({
+    name,
+    changeKind: changeKindFor(name, input.diff ?? ""),
+    manifestPaths: manifestsForPackage(name, manifestDeps),
+    lockfilePaths: input.changedDependencyFiles.filter(isDependencyLockfile),
+    evidence: evidenceForPackage(name, input.task, input.diff ?? "")
+  }));
+}
+function dependencyNamesByManifest(repoRoot, manifests) {
+  const byPackage = /* @__PURE__ */ new Map();
+  for (const manifest of manifests) {
+    if (!manifest.endsWith("package.json"))
+      continue;
+    const parsed = readPackageJson(repoRoot, manifest);
+    if (!parsed)
+      continue;
+    for (const name of packageJsonDependencyNames(parsed)) {
+      const current = byPackage.get(name) ?? [];
+      current.push(manifest);
+      byPackage.set(name, current);
+    }
+  }
+  return byPackage;
+}
+function packageJsonDependencyNames(parsed) {
+  return unique([
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies",
+    "overrides",
+    "resolutions",
+    "pnpm"
+  ].flatMap((field) => nestedDependencyNames(parsed[field])));
+}
+function nestedDependencyNames(value) {
+  if (!value || typeof value !== "object")
+    return [];
+  return Object.entries(value).flatMap(([key, nested]) => [
+    looksLikePackageName(key) ? key : "",
+    ...nestedDependencyNames(nested)
+  ]);
+}
+function packagesMentionedInText(text) {
+  const names = [];
+  const quoted = text.matchAll(/[`'"](@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)[`'"]/gi);
+  for (const match of quoted)
+    names.push(match[1] ?? "");
+  const advisoryContext = text.matchAll(/\b(?:package|dependency|upgrade|update|override|transitive|vulnerable|dependabot|cve|ghsa|audit)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
+  for (const match of advisoryContext)
+    names.push(match[1] ?? "");
+  const atVersion = text.matchAll(/\b(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/gi);
+  for (const match of atVersion)
+    names.push(match[1] ?? "");
+  if (/\b(dependabot|cve-|ghsa-|audit|vulnerab|advisory)\b/i.test(text)) {
+    const affectedPackageContext = text.matchAll(/\b(?:for|affects?|in)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
+    for (const match of affectedPackageContext)
+      names.push(match[1] ?? "");
+  }
+  return unique(names.map(cleanPackageName).filter(looksLikePackageName).filter((name) => !genericDependencyWords.has(name.toLowerCase())));
+}
+function packagesMentionedInDiff(diff) {
+  const names = [];
+  for (const line of diff.split(/\r?\n/)) {
+    if (!/^[+-]/.test(line) || /^[+-]{3}/.test(line))
+      continue;
+    const packageJsonMatch = line.match(/"(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)"\s*:/i);
+    if (packageJsonMatch?.[1])
+      names.push(packageJsonMatch[1]);
+    const pnpmMatch = line.match(/^\s*[+-]\s{0,8}(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
+    if (pnpmMatch?.[1])
+      names.push(pnpmMatch[1]);
+    const lockPathMatch = line.match(/\/(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
+    if (lockPathMatch?.[1])
+      names.push(lockPathMatch[1]);
+  }
+  return unique(names.map(cleanPackageName).filter(looksLikePackageName).filter((name) => !genericDependencyWords.has(name.toLowerCase())));
+}
+function packagesFromChangedDependencyFile(repoRoot, filePath) {
+  if (!filePath.endsWith("package.json"))
+    return [];
+  const parsed = readPackageJson(repoRoot, filePath);
+  return parsed ? packageJsonDependencyNames(parsed).slice(0, 20) : [];
+}
+function readPackageJson(repoRoot, filePath) {
+  const content = safeRead(path6.join(repoRoot, filePath), 4e5);
+  if (!content)
+    return null;
+  try {
+    const parsed = JSON.parse(content);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function changeKindFor(packageName, diff) {
+  const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const removedVersions = [
+    ...diff.matchAll(new RegExp(`^-.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
+  ].map((match) => match[1] ?? "");
+  const addedVersions = [
+    ...diff.matchAll(new RegExp(`^\\+.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
+  ].map((match) => match[1] ?? "");
+  const removed = removedVersions[0];
+  const added = addedVersions[0];
+  if (removed && added) {
+    const [removedMajor] = removed.split(".");
+    const [addedMajor] = added.split(".");
+    return removedMajor && addedMajor && removedMajor !== addedMajor ? "major" : "patch_or_minor";
+  }
+  if (added && !removed)
+    return "added_or_overridden";
+  return "unknown";
+}
+function manifestsForPackage(packageName, manifestDeps) {
+  return unique([
+    ...manifestDeps.get(packageName) ?? [],
+    ...[...manifestDeps.entries()].filter(([name]) => name.endsWith(`/${packageName}`)).flatMap(([, manifests]) => manifests)
+  ]).slice(0, 8);
+}
+function evidenceForPackage(packageName, task, diff) {
+  const evidence = [];
+  if (task.toLowerCase().includes(packageName.toLowerCase())) {
+    evidence.push("mentioned_in_task");
+  }
+  if (diff.toLowerCase().includes(packageName.toLowerCase())) {
+    evidence.push("mentioned_in_diff");
+  }
+  if (evidence.length === 0)
+    evidence.push("manifest_candidate");
+  return evidence;
+}
+function validationCommandsFor2(repoRoot, packageManager) {
+  const scripts = packageScripts(repoRoot);
+  const run = packageRunCommand(packageManager);
+  return unique([
+    ...auditCommandsFor(packageManager),
+    ...scriptCommand(scripts, "check", run),
+    ...scriptCommand(scripts, "test", run),
+    ...scriptCommand(scripts, "test:client", run),
+    ...scriptCommand(scripts, "test:e2e:smoke", run),
+    ...scriptCommand(scripts, "build", run)
+  ]).slice(0, 10);
+}
+function packageScripts(repoRoot) {
+  const parsed = readPackageJson(repoRoot, "package.json");
+  const scripts = parsed?.scripts;
+  return scripts && typeof scripts === "object" ? Object.fromEntries(Object.entries(scripts).filter((entry) => typeof entry[1] === "string")) : {};
+}
+function scriptCommand(scripts, scriptName, runCommand) {
+  return scripts[scriptName] ? [`${runCommand} ${scriptName}`] : [];
+}
+function packageRunCommand(packageManager) {
+  switch (packageManager) {
+    case "npm":
+      return "npm run";
+    case "yarn":
+      return "yarn";
+    case "bun":
+      return "bun run";
+    default:
+      return "pnpm";
+  }
+}
+function auditCommandsFor(packageManager) {
+  switch (packageManager) {
+    case "pnpm":
+      return ["pnpm audit --prod"];
+    case "npm":
+      return ["npm audit --omit=dev"];
+    case "yarn":
+      return ["yarn npm audit --environment production"];
+    case "bun":
+      return ["bun audit"];
+    case "pip":
+      return ["pip-audit"];
+    case "bundler":
+      return ["bundle audit check"];
+    case "go":
+      return ["govulncheck ./..."];
+    case "cargo":
+      return ["cargo audit"];
+    default:
+      return [];
+  }
+}
+function dependencyGraphCommandsFor(packageManager, packageNames) {
+  const selected = packageNames.slice(0, 5);
+  if (selected.length === 0)
+    return [];
+  switch (packageManager) {
+    case "pnpm":
+      return selected.map((name) => `pnpm why ${name}`);
+    case "npm":
+      return selected.map((name) => `npm explain ${name}`);
+    case "yarn":
+      return selected.map((name) => `yarn why ${name}`);
+    case "bun":
+      return selected.map((name) => `bun pm why ${name}`);
+    case "go":
+      return selected.map((name) => `go mod why -m ${name}`);
+    case "cargo":
+      return selected.map((name) => `cargo tree -i ${name}`);
+    default:
+      return [];
+  }
+}
+function remediationCommandsFor(packageManager, packageNames) {
+  const selected = packageNames.slice(0, 5);
+  if (selected.length === 0)
+    return [];
+  switch (packageManager) {
+    case "pnpm":
+      return selected.map((name) => `pnpm up ${name} --latest --interactive=false`);
+    case "npm":
+      return selected.map((name) => `npm update ${name}`);
+    case "yarn":
+      return selected.map((name) => `yarn up ${name}`);
+    case "bun":
+      return selected.map((name) => `bun update ${name}`);
+    case "go":
+      return selected.map((name) => `go get ${name}@latest`);
+    case "cargo":
+      return selected.map((name) => `cargo update -p ${name}`);
+    default:
+      return [];
+  }
+}
+function residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles) {
+  return unique([
+    packageNames.length > 0 ? `Confirm vulnerable versions are gone for: ${packageNames.slice(0, 8).join(", ")}.` : "Name each advisory/package from the scanner before editing.",
+    changedDependencyFiles.some(isDependencyLockfile) ? "Inspect the lockfile diff for unexpected package churn outside the advisory path." : "Regenerate and inspect the lockfile if the fix changes dependency resolution.",
+    "Split major-version upgrades or broad framework upgrades into a separate mission unless the advisory requires them.",
+    "Record any remaining advisory ids, ignored dev-only findings, or transitive paths that still need owner judgment.",
+    ...auditCommandsFor(packageManager).map((command2) => `Rerun ${command2} after the lockfile update.`)
+  ]);
+}
+function confidenceFor(input) {
+  let score = 35;
+  if (input.changedDependencyFiles.length > 0)
+    score += 20;
+  if (input.packageSignals.length > 0)
+    score += 20;
+  if (input.lockfiles.length > 0)
+    score += 10;
+  if (input.validationCommands.length > 0)
+    score += 10;
+  return Math.min(95, score);
+}
+function summaryFor3(input) {
+  const packages = input.packageSignals.map((signal2) => signal2.name);
+  return [
+    `Detected ${input.packageManager} dependency remediation context.`,
+    `${input.manifests.length} manifest${input.manifests.length === 1 ? "" : "s"}, ${input.lockfiles.length} lockfile${input.lockfiles.length === 1 ? "" : "s"}.`,
+    input.changedDependencyFiles.length > 0 ? `Changed dependency files: ${input.changedDependencyFiles.slice(0, 6).join(", ")}.` : "No dependency files are changed yet.",
+    packages.length > 0 ? `Likely packages: ${packages.slice(0, 8).join(", ")}.` : "Package names still need advisory/scanner evidence.",
+    input.validationCommands.length > 0 ? `Validation starts with ${input.validationCommands[0]}.` : "Validation commands need repo-specific confirmation."
+  ].join(" ");
+}
+function cleanPackageName(input) {
+  return input.replace(/[),.;\]]+$/g, "").trim();
+}
+function looksLikePackageName(input) {
+  return /^@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?$/i.test(input);
+}
+function looksLikeVersionOrAdvisory(input) {
+  const normalized = input.toLowerCase();
+  return /^\d/.test(input) || /^cve-\d/i.test(input) || /^ghsa-/i.test(input) || [
+    "advisory",
+    "advisories",
+    "change",
+    "changes",
+    "dependency",
+    "dependencies",
+    "dependabot",
+    "finding",
+    "findings",
+    "package",
+    "packages",
+    "security",
+    "transitive",
+    "upgrade",
+    "upgrades",
+    "vulnerabilities",
+    "vulnerability",
+    "vulnerable"
+  ].includes(normalized);
+}
+var dependencyFilePatterns, genericDependencyWords;
+var init_dependencyRemediation = __esm({
+  "../core/dist/dependencyRemediation.js"() {
+    "use strict";
+    init_utils();
+    dependencyFilePatterns = [
+      "package.json",
+      "pnpm-lock.yaml",
+      "pnpm-workspace.yaml",
+      "package-lock.json",
+      "yarn.lock",
+      "bun.lock",
+      "npm-shrinkwrap.json",
+      "requirements.txt",
+      "poetry.lock",
+      "pyproject.toml",
+      "Pipfile.lock",
+      "Gemfile",
+      "Gemfile.lock",
+      "go.mod",
+      "go.sum",
+      "Cargo.toml",
+      "Cargo.lock"
+    ];
+    genericDependencyWords = /* @__PURE__ */ new Set([
+      "advisory",
+      "audit",
+      "build",
+      "change",
+      "dependency",
+      "dev",
+      "exact",
+      "existing",
+      "focused",
+      "for",
+      "finding",
+      "lockfile",
+      "package",
+      "path",
+      "security",
+      "test",
+      "the",
+      "toolchain",
+      "transitive",
+      "vulnerability",
+      "workflow",
+      "without"
+    ]);
+  }
+});
+
 // ../core/dist/testRecommendations.js
 import { existsSync as existsSync3 } from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 function recommendExactTestsForFiles(input) {
   const packageManager = detectPackageManager(input.repoRoot);
   if (isDocsOnlyChange(input.changedFiles)) {
@@ -11691,7 +12250,7 @@ function taskRelevantTests(repoRoot, scanMap, scanSources, task, excluded) {
   }));
   return [...mapTests, ...sourceTests].filter((test) => !excludedSet.has(test.path)).map((test) => {
     const pathScore = tokens.reduce((total, token) => total + (test.seed.includes(token) ? 2 : 0), 0);
-    const content = pathScore > 0 ? (safeRead(path6.join(repoRoot, test.path), 6e4) ?? "").toLowerCase() : "";
+    const content = pathScore > 0 ? (safeRead(path7.join(repoRoot, test.path), 6e4) ?? "").toLowerCase() : "";
     return {
       path: test.path,
       score: pathScore + tokens.reduce((total, token) => total + (test.context.includes(token) ? 1 : 0), 0) + tokens.reduce((total, token) => total + (content.includes(token) ? 1 : 0), 0)
@@ -11755,8 +12314,8 @@ function testCommandForFile(repoRoot, file, packageManager) {
   if (packageManager === "pnpm") {
     const packageInfo = nearestPackageInfo(repoRoot, file);
     if (packageInfo?.name && packageInfo.root !== repoRoot) {
-      const packageRelativeFile = path6.relative(packageInfo.root, path6.join(repoRoot, file)).replaceAll("\\", "/");
-      const testScript = readPackageJson(packageInfo.root)?.scripts?.test;
+      const packageRelativeFile = path7.relative(packageInfo.root, path7.join(repoRoot, file)).replaceAll("\\", "/");
+      const testScript = readPackageJson2(packageInfo.root)?.scripts?.test;
       if (typeof testScript === "string") {
         if (/\bvitest\b/.test(testScript)) {
           return `pnpm --filter ${packageInfo.name} exec vitest run ${packageRelativeFile}`;
@@ -11774,11 +12333,11 @@ function testCommandForFile(repoRoot, file, packageManager) {
   return `${packageManager} test -- ${file}`;
 }
 function nearestPackageInfo(repoRoot, file) {
-  let current = path6.dirname(path6.join(repoRoot, file));
+  let current = path7.dirname(path7.join(repoRoot, file));
   while (current.startsWith(repoRoot)) {
-    const packageJsonPath = path6.join(current, "package.json");
+    const packageJsonPath = path7.join(current, "package.json");
     if (existsSync3(packageJsonPath)) {
-      const pkg = readPackageJson(current);
+      const pkg = readPackageJson2(current);
       return {
         root: current,
         ...typeof pkg?.name === "string" ? { name: pkg.name } : {}
@@ -11786,18 +12345,18 @@ function nearestPackageInfo(repoRoot, file) {
     }
     if (current === repoRoot)
       break;
-    current = path6.dirname(current);
+    current = path7.dirname(current);
   }
   return null;
 }
 function coLocatedTestCandidates(repoRoot, file) {
-  const parsed = path6.parse(file);
+  const parsed = path7.parse(file);
   const extensions = parsed.ext === ".tsx" ? [".test.tsx", ".spec.tsx", ".test.ts", ".spec.ts"] : parsed.ext === ".jsx" ? [".test.jsx", ".spec.jsx", ".test.js", ".spec.js"] : [`.test${parsed.ext}`, `.spec${parsed.ext}`];
   const candidates = [
-    ...extensions.map((extension) => path6.join(parsed.dir, `${parsed.name}${extension}`)),
-    ...extensions.map((extension) => path6.join(parsed.dir, "__tests__", `${parsed.name}${extension}`))
+    ...extensions.map((extension) => path7.join(parsed.dir, `${parsed.name}${extension}`)),
+    ...extensions.map((extension) => path7.join(parsed.dir, "__tests__", `${parsed.name}${extension}`))
   ].map((candidate) => candidate.replaceAll("\\", "/"));
-  return candidates.filter((candidate) => existsSync3(path6.join(repoRoot, candidate)));
+  return candidates.filter((candidate) => existsSync3(path7.join(repoRoot, candidate)));
 }
 function importedByTests(scanMap, sourceFiles) {
   const fromSourceMetadata = scanMap.filter((node) => sourceFiles.includes(sourcePathForNode(node))).flatMap((node) => metadataStrings3(node, "importedBy")).filter(isTestPath);
@@ -11819,11 +12378,11 @@ function isDocsOnlyChange(files) {
 }
 function isDocsOrProductDocPath(file) {
   const normalized = file.replaceAll("\\", "/");
-  const basename = path6.basename(normalized).toLowerCase();
+  const basename = path7.basename(normalized).toLowerCase();
   return normalized.startsWith("docs/") || normalized.includes("/docs/") || normalized.startsWith(".github/") || basename === "readme.md" || basename === "agents.md" || basename === "claude.md" || basename.endsWith(".md") || basename.endsWith(".mdx") || basename.endsWith(".rst") || basename.endsWith(".adoc");
 }
 function docsOnlyRecommendations(repoRoot, packageManager, changedFiles) {
-  const pkg = readPackageJson(repoRoot);
+  const pkg = readPackageJson2(repoRoot);
   const scripts = pkg?.scripts ?? {};
   const recommendations = [
     {
@@ -11847,7 +12406,7 @@ function docsOnlyRecommendations(repoRoot, packageManager, changedFiles) {
     if (typeof scripts[script] === "string") {
       recommendations.push({
         command: `${packageManager} ${script}`,
-        reason: `Repo package.json defines ${script}; run it when docs or agent guidance can affect generated output or published docs.`,
+        reason: `Repo package.json defines ${script}; run it when docs or agent guidance can affect generated output or shared docs.`,
         files: [],
         source: "script",
         confidence: script === "check" ? "low" : "medium"
@@ -11857,7 +12416,7 @@ function docsOnlyRecommendations(repoRoot, packageManager, changedFiles) {
   return recommendations.slice(0, 4);
 }
 function packageScriptRecommendations(repoRoot, packageManager) {
-  const pkg = readPackageJson(repoRoot);
+  const pkg = readPackageJson2(repoRoot);
   const scripts = pkg?.scripts ?? {};
   const commands = [];
   for (const script of [
@@ -11890,7 +12449,7 @@ function taskRelevantPackageScriptRecommendations(repoRoot, packageManager, task
   const packageRoots = unique(sourceFiles.map((file) => nearestPackageInfo(repoRoot, file)?.root).filter((root) => Boolean(root)));
   const recommendations = [];
   for (const packageRoot of packageRoots) {
-    const pkg = readPackageJson(packageRoot);
+    const pkg = readPackageJson2(packageRoot);
     const scripts = pkg?.scripts ?? {};
     const packageName = typeof pkg?.name === "string" ? pkg.name : void 0;
     if (wantsPackageRelease) {
@@ -11923,8 +12482,8 @@ function packageScriptCommand(packageManager, packageRoot, repoRoot, packageName
   }
   return packageManager === "npm" ? `npm run ${script}` : `${packageManager} ${script}`;
 }
-function readPackageJson(packageRoot) {
-  const content = safeRead(path6.join(packageRoot, "package.json"), 2e5);
+function readPackageJson2(packageRoot) {
+  const content = safeRead(path7.join(packageRoot, "package.json"), 2e5);
   if (!content)
     return null;
   try {
@@ -11940,17 +12499,17 @@ function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 function detectPackageManager(repoRoot) {
-  const pkg = readPackageJson(repoRoot);
+  const pkg = readPackageJson2(repoRoot);
   if (typeof pkg?.packageManager === "string") {
     const name = pkg.packageManager.split("@")[0];
     if (name)
       return name;
   }
-  if (existsSync3(path6.join(repoRoot, "pnpm-lock.yaml")))
+  if (existsSync3(path7.join(repoRoot, "pnpm-lock.yaml")))
     return "pnpm";
-  if (existsSync3(path6.join(repoRoot, "yarn.lock")))
+  if (existsSync3(path7.join(repoRoot, "yarn.lock")))
     return "yarn";
-  if (existsSync3(path6.join(repoRoot, "bun.lockb")))
+  if (existsSync3(path7.join(repoRoot, "bun.lockb")))
     return "bun";
   return "npm";
 }
@@ -11967,6 +12526,10 @@ function contextForTask(scan, request) {
   const files = request.files ?? [];
   const maxTokens = request.maxTokens ?? 6e3;
   const scoped = files.length > 0;
+  const dependencyRemediation = isDependencyRemediationTask(task, files) ? buildDependencyRemediationPlan(request.repoRoot ?? scan.repoRoot, {
+    task,
+    changedFiles: files
+  }) : void 0;
   const rankedRules = rankRules(scan.rules, task, files);
   const initialRules = rankedRules.slice(0, scoped ? 8 : 12);
   const initialSkills = selectSkills(scan.skills, task, files, scoped).map(compactSkillForContext);
@@ -11974,13 +12537,18 @@ function contextForTask(scan, request) {
   const rankedMap = rankMap(mapCandidates, task, files);
   const selectedMap = takeGuidanceGroundedMapNodes(mapCandidates, scan.sources, rulesStronglyRelevantForGrounding(initialRules, task), initialSkills, rankedMap, files, scoped ? 14 : 18).map(compactMapNodeForContext);
   const suggestedTests = selectValidationForContext(scan.map, scan.sources, task, files, selectedMap, request.repoRoot);
+  const dependencyTests = dependencyValidationForContext(dependencyRemediation, task);
+  const focusedSuggestedTests = dependencyRemediation ? dependencyTests : suggestedTests;
   const initialSelection = {
     rules: initialRules,
     skills: initialSkills,
     map: selectedMap,
-    wikiPages: selectWikiPages(buildContextWiki(scan).pages, task, files, scoped, suggestedTests).map(compactWikiPageForContext),
+    wikiPages: selectWikiPages(buildContextWiki(scan).pages, task, files, scoped, focusedSuggestedTests).map(compactWikiPageForContext),
     memories: rankMemories(scan.memories, task, files).slice(0, scoped ? 4 : 8).map(compactMemoryForContext),
-    suggestedTests
+    suggestedTests: unique([...dependencyTests, ...focusedSuggestedTests]),
+    ...dependencyRemediation ? {
+      dependencyRemediation: compactDependencyRemediationForContext(dependencyRemediation)
+    } : {}
   };
   const { selection, tokenEstimate, omitted } = fitSelectionToBudget(initialSelection, {
     maxTokens,
@@ -11991,32 +12559,39 @@ function contextForTask(scan, request) {
   const { rules: selectedRules, skills: selectedSkills, map: budgetedMap, wikiPages: selectedWikiPages, memories: selectedMemories } = selection;
   const finalMap = takeGuidanceGroundedMapNodes(mapCandidates, scan.sources, rulesStronglyRelevantForGrounding(selectedRules, task), selectedSkills, budgetedMap, files, Math.max(budgetedMap.length, scoped ? 2 : 4)).map(compactMapNodeForContext);
   const finalSuggestedTests = selectValidationForContext(scan.map, scan.sources, task, files, finalMap, request.repoRoot);
+  const packetSuggestedTests = unique([
+    ...dependencyRemediation ? dependencyValidationForContext(dependencyRemediation, task) : finalSuggestedTests
+  ]);
   const owners = selectOwners(scan.map, files);
   const sources = unique([
     ...selectedRules.flatMap((rule) => rule.sourcePaths),
     ...selectedSkills.map((skill) => skill.sourcePath),
     ...finalMap.map(mapNodeSourcePath),
     ...selectedWikiPages.flatMap((page2) => page2.sourcePaths),
-    ...selectedMemories.flatMap((memory) => memory.sourcePaths)
+    ...selectedMemories.flatMap((memory) => memory.sourcePaths),
+    ...dependencySourcePaths(dependencyRemediation)
   ]);
   const teamGuidance = scan.teamGuidanceCatalog ? teamGuidanceDeliveryFor(scan, selectedRules, selectedSkills, selectedMemories) : void 0;
   const packet = {
     packetId: packetId(),
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     task,
-    summary: summarizeContext(task, selectedRules, finalSuggestedTests, finalMap),
+    summary: summarizeContext(task, selectedRules, packetSuggestedTests, finalMap),
     rules: selectedRules,
     skills: selectedSkills,
     map: finalMap,
     wikiPages: selectedWikiPages,
     memories: selectedMemories,
-    suggestedTests: finalSuggestedTests,
+    suggestedTests: packetSuggestedTests,
     owners,
     sources,
     tokenEstimate,
     omitted,
-    valueSignals: contextValueSignals(finalMap, finalSuggestedTests, sources.length, teamGuidance?.applied.length ?? 0),
-    ...teamGuidance ? { teamGuidance } : {}
+    valueSignals: contextValueSignals(finalMap, packetSuggestedTests, sources.length, teamGuidance?.applied.length ?? 0),
+    ...teamGuidance ? { teamGuidance } : {},
+    ...dependencyRemediation ? {
+      dependencyRemediation: compactDependencyRemediationForContext(dependencyRemediation)
+    } : {}
   };
   return enforceContextPacketBudget(packet, maxTokens, files);
 }
@@ -12050,6 +12625,47 @@ function contextValueSignals(map, suggestedTests, relevantSourceCount, appliedTe
     suggestedTestCount: suggestedTests.length
   };
 }
+function dependencyValidationForContext(plan, task) {
+  if (!plan)
+    return [];
+  const allowsRuntimeProof = /\b(runtime|smoke|e2e|browser|production|integration)\b/i.test(task);
+  return plan.validationCommands.filter((command2) => allowsRuntimeProof ? true : !/\b(e2e|smoke|ux)\b/i.test(command2)).slice(0, allowsRuntimeProof ? 5 : 4);
+}
+function dependencySourcePaths(plan) {
+  if (!plan)
+    return [];
+  return unique([
+    ...plan.manifestFiles,
+    ...plan.lockfiles,
+    ...plan.workspaceFiles,
+    ...plan.changedDependencyFiles,
+    ...plan.directDependencyFiles
+  ]);
+}
+function compactDependencyRemediationForContext(plan) {
+  if (!plan)
+    return void 0;
+  return {
+    ...plan,
+    manifestFiles: plan.manifestFiles.slice(0, 8),
+    lockfiles: plan.lockfiles.slice(0, 6),
+    workspaceFiles: plan.workspaceFiles.slice(0, 4),
+    changedDependencyFiles: plan.changedDependencyFiles.slice(0, 8),
+    directDependencyFiles: plan.directDependencyFiles.slice(0, 8),
+    packageSignals: plan.packageSignals.slice(0, 8).map((signal2) => ({
+      ...signal2,
+      manifestPaths: signal2.manifestPaths.slice(0, 4),
+      lockfilePaths: signal2.lockfilePaths.slice(0, 4),
+      evidence: signal2.evidence.slice(0, 3)
+    })),
+    graphCommands: plan.graphCommands.slice(0, 6),
+    remediationCommands: plan.remediationCommands.slice(0, 6),
+    validationCommands: plan.validationCommands.slice(0, 8),
+    residualRiskChecks: plan.residualRiskChecks.slice(0, 6),
+    handoffRequirements: plan.handoffRequirements.slice(0, 4),
+    summary: truncateText(plan.summary, 520)
+  };
+}
 function codebaseMapForTask(scan, request, limit = 80) {
   const files = request.files ?? [];
   const hasSpecificScope = files.length > 0 || wordsFor3(request.task).length > 1;
@@ -12858,8 +13474,8 @@ function sameStem(testPath, sourcePath) {
 function isTestScriptNode(node) {
   return node.type === "workflow" && node.tags.some((tag) => /test|check|type|e2e|smoke/i.test(tag));
 }
-function isTestPathCandidate(pathName) {
-  return /(^|\/|\.)(test|spec)\.[^.]+$/i.test(pathName);
+function isTestPathCandidate(pathName2) {
+  return /(^|\/|\.)(test|spec)\.[^.]+$/i.test(pathName2);
 }
 function summarizeContext(task, rules, tests, map = []) {
   const implementationPaths = contextSummaryPaths(map);
@@ -12927,7 +13543,8 @@ function cloneSelection(selection) {
     map: [...selection.map],
     wikiPages: [...selection.wikiPages],
     memories: [...selection.memories],
-    suggestedTests: [...selection.suggestedTests]
+    suggestedTests: [...selection.suggestedTests],
+    ...selection.dependencyRemediation ? { dependencyRemediation: selection.dependencyRemediation } : {}
   };
 }
 function estimateSelectionTokens(selection, task) {
@@ -12942,6 +13559,7 @@ function estimateSelectionTokens(selection, task) {
     wikiPages: selection.wikiPages,
     memories: selection.memories,
     suggestedTests: selection.suggestedTests,
+    ...selection.dependencyRemediation ? { dependencyRemediation: selection.dependencyRemediation } : {},
     owners: [],
     sources: selectionSources(selection),
     tokenEstimate: 0,
@@ -13038,10 +13656,6 @@ function trimContextPacket(packet, protectedMapPaths) {
     packet.suggestedTests.pop();
     return true;
   }
-  if (packet.rules.length > 0) {
-    packet.rules.pop();
-    return true;
-  }
   if (packet.map.length > protectedMapPaths.size) {
     packet.map.pop();
     return true;
@@ -13136,7 +13750,8 @@ function refreshContextPacketDerivedFields(packet) {
     map: packet.map,
     wikiPages: packet.wikiPages,
     memories: packet.memories,
-    suggestedTests: packet.suggestedTests
+    suggestedTests: packet.suggestedTests,
+    ...packet.dependencyRemediation ? { dependencyRemediation: packet.dependencyRemediation } : {}
   });
   refreshTeamGuidanceDelivery(packet);
   packet.valueSignals = contextValueSignals(packet.map, packet.suggestedTests, packet.sources.length, packet.teamGuidance?.applied.length ?? 0);
@@ -13188,7 +13803,8 @@ function selectionSources(selection) {
     ...selection.skills.map((skill) => skill.sourcePath),
     ...selection.map.map((node) => node.path),
     ...selection.wikiPages.flatMap((page2) => page2.sourcePaths),
-    ...selection.memories.flatMap((memory) => memory.sourcePaths)
+    ...selection.memories.flatMap((memory) => memory.sourcePaths),
+    ...dependencySourcePaths(selection.dependencyRemediation)
   ]);
 }
 function trimSelection(selection, minimums, protectedMapPaths) {
@@ -13333,6 +13949,7 @@ var init_context = __esm({
     init_scanner();
     init_contextWiki();
     init_pathIntent();
+    init_dependencyRemediation();
     init_testRecommendations();
     init_utils();
     contextStopWords = /* @__PURE__ */ new Set([
@@ -13405,440 +14022,328 @@ var init_context = __esm({
   }
 });
 
-// ../core/dist/dependencyRemediation.js
-import path7 from "node:path";
-function buildDependencyRemediationPlan(repoRoot, request) {
-  const files = walkFiles(repoRoot, request.maxFiles ?? 6e3);
-  const manifests = files.filter(isDependencyManifest);
-  const lockfiles = files.filter(isDependencyLockfile);
-  const workspaceFiles = files.filter(isDependencyWorkspaceFile);
-  const changedDependencyFiles = unique((request.changedFiles ?? []).filter(isDependencyFile));
-  const packageManager = inferPackageManager(repoRoot, manifests, lockfiles);
-  const packageSignalInput = {
-    task: request.task,
-    manifests,
-    changedDependencyFiles
-  };
-  if (request.diff)
-    packageSignalInput.diff = request.diff;
-  const packageSignals = packageSignalsFor(repoRoot, packageSignalInput);
-  const directDependencyFiles = unique(packageSignals.flatMap((signal2) => signal2.manifestPaths));
-  const packageNames = packageSignals.map((signal2) => signal2.name);
-  const validationCommands2 = validationCommandsFor2(repoRoot, packageManager);
-  const graphCommands = dependencyGraphCommandsFor(packageManager, packageNames);
-  const remediationCommands = remediationCommandsFor(packageManager, packageNames);
-  const residualRiskChecks = residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles);
-  const confidence = confidenceFor({
-    changedDependencyFiles,
-    packageSignals,
-    lockfiles,
-    validationCommands: validationCommands2
+// ../core/dist/productIntelligence.js
+import { isIP } from "node:net";
+function loadProductIntelligence(repoRoot) {
+  for (const filePath of briefCacheCandidatePaths(repoRoot, productIntelligenceFile)) {
+    const content = readBriefLedgerFile(filePath);
+    if (!content)
+      continue;
+    try {
+      const parsed = JSON.parse(content);
+      if (isProductIntelligenceStore(parsed)) {
+        return withLocalProductLearnings(repoRoot, parsed);
+      }
+    } catch {
+    }
+  }
+  return withLocalProductLearnings(repoRoot, emptyProductIntelligence(pathName(repoRoot)));
+}
+function saveProductIntelligence(repoRoot, input) {
+  return withBriefCacheLock(repoRoot, "product-intelligence", () => {
+    const current = loadProductIntelligence(repoRoot);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const facts = [...current.facts];
+    const savedFactIds = [];
+    for (const candidate of input.facts) {
+      const statement = normalizeText(candidate.statement, 1e3);
+      if (!statement)
+        continue;
+      const sources = (candidate.sources ?? []).map((source) => normalizeSource(source, now));
+      const existing = facts.find((fact2) => fact2.kind === candidate.kind && normalizeKey(fact2.statement) === normalizeKey(statement));
+      if (existing) {
+        existing.appliesTo = unique([
+          ...existing.appliesTo,
+          ...candidate.appliesTo ?? []
+        ]).slice(0, 24);
+        existing.sources = mergeSources(existing.sources, sources);
+        existing.confidence = Math.max(existing.confidence, clampConfidence(candidate.confidence ?? existing.confidence));
+        if (candidate.status)
+          existing.status = candidate.status;
+        existing.updatedAt = now;
+        savedFactIds.push(existing.id);
+        continue;
+      }
+      const fact = {
+        id: idFor("product-fact", `${candidate.kind}:${statement}`),
+        kind: candidate.kind,
+        statement,
+        appliesTo: unique(candidate.appliesTo ?? []).slice(0, 24),
+        status: candidate.status ?? "proposed",
+        confidence: clampConfidence(candidate.confidence ?? 0.65),
+        sources,
+        createdAt: now,
+        updatedAt: now
+      };
+      facts.unshift(fact);
+      savedFactIds.push(fact.id);
+    }
+    const store = {
+      version: 1,
+      repoName: input.repoName?.trim() || current.repoName,
+      updatedAt: now,
+      facts: facts.slice(0, 300),
+      openQuestions: unique([
+        ...current.openQuestions,
+        ...input.openQuestions ?? []
+      ]).map((item) => normalizeText(item, 300)).filter(Boolean).slice(0, 40),
+      decisions: unique([...current.decisions, ...input.decisions ?? []]).map((item) => normalizeText(item, 500)).filter(Boolean).slice(0, 80)
+    };
+    writeBriefCacheFile(repoRoot, productIntelligenceFile, `${JSON.stringify(store, null, 2)}
+`);
+    return { store, savedFactIds };
   });
+}
+function buildProductIntelligenceContext(store, task, maxLines = 14) {
+  const now = Date.now();
+  const ranked = store.facts.filter((fact) => fact.status !== "rejected").map((fact) => ({
+    fact,
+    stale: isStale(fact, now),
+    score: factRelevance(fact, task)
+  })).sort((a, b) => b.score - a.score || Number(b.fact.status === "approved") - Number(a.fact.status === "approved") || b.fact.updatedAt.localeCompare(a.fact.updatedAt));
+  const relevant = ranked.filter((item) => item.score > 0);
+  const selected = (relevant.length > 0 ? relevant : ranked).slice(0, 8);
+  const relevantFacts = selected.map((item) => item.fact);
+  const staleFactCount = ranked.filter((item) => item.stale).length;
+  const sourceCount = new Set(store.facts.flatMap((fact) => fact.sources.map((source) => source.id))).size;
+  const hasApproved = relevantFacts.some((fact) => fact.status === "approved");
+  const hasProposed = relevantFacts.some((fact) => fact.status === "proposed");
+  const status = relevantFacts.length === 0 ? "needs_research" : hasProposed ? "needs_review" : hasApproved && staleFactCount === 0 ? "ready" : "needs_research";
+  const summary = relevantFacts.length === 0 ? "No product intelligence matches this task yet." : `${relevantFacts.length} product fact${relevantFacts.length === 1 ? "" : "s"} matched; ${sourceCount} cited source${sourceCount === 1 ? "" : "s"}${staleFactCount > 0 ? `, ${staleFactCount} may be stale` : ""}.`;
+  const compactLines = [
+    `Product intelligence: ${summary}`,
+    ...relevantFacts.slice(0, 5).map((fact) => `- ${statusLabel(fact.status)} ${fact.kind}: ${fact.statement}`),
+    ...store.openQuestions.length > 0 ? [`Open question: ${store.openQuestions[0]}`] : [],
+    ...staleFactCount > 0 ? ["Refresh market, competitor, or integration evidence before treating it as current."] : []
+  ];
+  const compactText = compactLines.slice(0, Math.max(4, maxLines)).join("\n");
   return {
-    id: `dep_${contentHash([
-      request.task,
-      packageManager,
-      changedDependencyFiles.join(","),
-      packageNames.join(",")
-    ].join(":"))}`,
-    status: changedDependencyFiles.length > 0 || packageSignals.length > 0 ? "ready" : "needs_evidence",
-    packageManager,
-    manifestFiles: manifests.slice(0, 20),
-    lockfiles,
-    workspaceFiles,
-    changedDependencyFiles,
-    directDependencyFiles,
-    packageSignals,
-    graphCommands,
-    remediationCommands,
-    validationCommands: validationCommands2,
-    residualRiskChecks,
-    handoffRequirements: [
-      "List advisory ids or scanner finding ids that were fixed.",
-      "Name packages still present in the lockfile with vulnerable versions, or state that the scan/audit is clean.",
-      "Explain any major-version upgrades, overrides, peer dependency changes, skipped advisories, or remaining advisory ids.",
-      "Attach validation commands and CI follow-up results before marking the security mission done."
-    ],
-    summary: summaryFor3({
-      packageManager,
-      manifests,
-      lockfiles,
-      changedDependencyFiles,
-      packageSignals,
-      validationCommands: validationCommands2
-    }),
-    confidence
+    status,
+    summary,
+    relevantFacts,
+    staleFactCount,
+    sourceCount,
+    openQuestions: store.openQuestions.slice(0, 8),
+    compactText,
+    next: status === "needs_research" ? "Run brief.product_research_plan, use approved public sources where needed, then save cited observations as proposed context." : status === "needs_review" ? "Review proposed product facts with human judgment before treating them as team defaults." : "Use the cited product facts alongside repo rules; do not let market evidence override a direct user or team decision."
   };
 }
-function isDependencyFile(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return dependencyFilePatterns.some((pattern) => normalized === pattern || normalized.endsWith(`/${pattern}`) || pattern === "package.json" && normalized.endsWith("/package.json"));
-}
-function isDependencyLockfile(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return normalized === "pnpm-lock.yaml" || normalized.endsWith("/pnpm-lock.yaml") || normalized === "package-lock.json" || normalized.endsWith("/package-lock.json") || normalized === "yarn.lock" || normalized.endsWith("/yarn.lock") || normalized === "bun.lock" || normalized.endsWith("/bun.lock") || normalized === "npm-shrinkwrap.json" || normalized.endsWith("/npm-shrinkwrap.json") || normalized === "poetry.lock" || normalized.endsWith("/poetry.lock") || normalized === "Pipfile.lock" || normalized.endsWith("/Pipfile.lock") || normalized === "Gemfile.lock" || normalized.endsWith("/Gemfile.lock") || normalized === "go.sum" || normalized.endsWith("/go.sum") || normalized === "Cargo.lock" || normalized.endsWith("/Cargo.lock");
-}
-function isDependencyManifest(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return normalized === "package.json" || normalized.endsWith("/package.json") || normalized === "requirements.txt" || normalized.endsWith("/requirements.txt") || normalized === "pyproject.toml" || normalized.endsWith("/pyproject.toml") || normalized === "Gemfile" || normalized.endsWith("/Gemfile") || normalized === "go.mod" || normalized.endsWith("/go.mod") || normalized === "Cargo.toml" || normalized.endsWith("/Cargo.toml");
-}
-function isDependencyWorkspaceFile(filePath) {
-  const normalized = filePath.replaceAll("\\", "/");
-  return normalized === "pnpm-workspace.yaml" || normalized.endsWith("/pnpm-workspace.yaml") || normalized === "lerna.json" || normalized.endsWith("/lerna.json") || normalized === "turbo.json" || normalized.endsWith("/turbo.json") || normalized === "nx.json" || normalized.endsWith("/nx.json");
-}
-function inferPackageManager(repoRoot, manifests, lockfiles) {
-  const rootPackageJson = readPackageJson2(repoRoot, "package.json");
-  const packageManager = rootPackageJson?.packageManager;
-  if (typeof packageManager === "string") {
-    if (packageManager.startsWith("pnpm@"))
-      return "pnpm";
-    if (packageManager.startsWith("yarn@"))
-      return "yarn";
-    if (packageManager.startsWith("npm@"))
-      return "npm";
-    if (packageManager.startsWith("bun@"))
-      return "bun";
-  }
-  if (lockfiles.some((file) => file.endsWith("pnpm-lock.yaml")))
-    return "pnpm";
-  if (lockfiles.some((file) => file.endsWith("yarn.lock")))
-    return "yarn";
-  if (lockfiles.some((file) => file.endsWith("package-lock.json"))) {
-    return "npm";
-  }
-  if (lockfiles.some((file) => file.endsWith("bun.lock")))
-    return "bun";
-  if (manifests.some((file) => file.endsWith("requirements.txt") || file.endsWith("pyproject.toml") || file.endsWith("Pipfile"))) {
-    return "pip";
-  }
-  if (manifests.some((file) => file.endsWith("Gemfile")))
-    return "bundler";
-  if (manifests.some((file) => file.endsWith("go.mod")))
-    return "go";
-  if (manifests.some((file) => file.endsWith("Cargo.toml")))
-    return "cargo";
-  return "unknown";
+function buildProductResearchPlan(input) {
+  const task = normalizeText(input.task, 1e3);
+  const lower = task.toLowerCase();
+  const audience = input.audience?.trim() || "the target user";
+  const competitors = unique(input.competitors ?? []).slice(0, 8);
+  const integrations = unique(input.integrations ?? []).slice(0, 8);
+  const wantsTaste = /design|copy|content|microcopy|ux|ui|tone|visual|style/.test(lower);
+  const wantsMarket = competitors.length > 0 || /competitor|market|alternative|position|pricing|category|landscape/.test(lower);
+  const wantsIntegrations = integrations.length > 0 || /integration|connector|mcp|github|linear|jira|sentry|datadog|slack|figma/.test(lower);
+  const focus = unique([
+    "user job and desired outcome",
+    ...wantsTaste ? ["interaction and language taste"] : [],
+    ...wantsMarket ? ["category alternatives and differentiation"] : [],
+    ...wantsIntegrations ? ["integration expectations and trust boundaries"] : [],
+    "repo and team evidence that should constrain the decision"
+  ]);
+  const questions = [
+    `What is ${audience} trying to accomplish, and what makes the current path hard?`,
+    "Which existing behavior, workflow, or language should Brief preserve rather than reinvent?",
+    ...wantsTaste ? [
+      "What interaction, information hierarchy, and language patterns do users already recognize as high quality?",
+      "Which patterns are genuinely useful versus decorative or over-automated?"
+    ] : [],
+    ...wantsMarket ? [
+      "What do credible alternatives promise, and where do users still have to do the hard judgment themselves?",
+      "What narrow outcome can Brief own without copying a competitor's category language?"
+    ] : [],
+    ...wantsIntegrations ? [
+      "What setup, auth, permission, and failure behavior do users expect from this integration?",
+      "Which integration signals are official and current enough to become product guidance?"
+    ] : []
+  ];
+  const searchQueries = [
+    `${task} official documentation workflow users`,
+    ...competitors.length > 0 ? competitors.map((name) => `${name} official product docs ${task}`) : ["leading alternatives official docs product workflow"],
+    ...integrations.length > 0 ? integrations.map((name) => `${name} official integration docs auth permissions`) : []
+  ].slice(0, 10);
+  return {
+    status: "plan_ready",
+    task,
+    focus,
+    questions: questions.slice(0, 8),
+    searchQueries,
+    sourcePolicy: [
+      "Prefer official product documentation, changelogs, pricing, and security pages for current capabilities.",
+      "Use user feedback, interviews, support, analytics, and dogfood receipts for needs and outcomes; label them separately from market claims.",
+      "Attach the URL or repo path and access date to every saved observation; include a short excerpt only when it clarifies the claim.",
+      "Save findings as proposed until a product owner approves them. Conflicts stay visible as open questions.",
+      "Do not send private customer material or credentials to external research sources."
+    ],
+    deliverable: [
+      "3-7 cited observations, each with a claim and implication for Brief.",
+      "A short JTBD/persona or taste decision, if the evidence supports one.",
+      "Competitor or integration notes separated from direct user evidence.",
+      "Open questions and a decision owner rather than false certainty."
+    ],
+    next: "Research with the host's approved web/browser tools, then call brief.save_product_context with cited proposed facts."
+  };
 }
-function packageSignalsFor(repoRoot, input) {
-  const manifestDeps = dependencyNamesByManifest(repoRoot, input.manifests);
-  const explicitPackageNames = unique([
-    ...packagesMentionedInText(input.task),
-    ...packagesMentionedInDiff(input.diff ?? "")
-  ]).filter((name) => !looksLikeVersionOrAdvisory(name));
-  const fallbackPackageNames = input.changedDependencyFiles.flatMap((file) => packagesFromChangedDependencyFile(repoRoot, file));
-  const packageNames = unique(explicitPackageNames.length > 0 ? explicitPackageNames : fallbackPackageNames).filter((name) => !looksLikeVersionOrAdvisory(name));
-  return packageNames.slice(0, 16).map((name) => ({
-    name,
-    changeKind: changeKindFor(name, input.diff ?? ""),
-    manifestPaths: manifestsForPackage(name, manifestDeps),
-    lockfilePaths: input.changedDependencyFiles.filter(isDependencyLockfile),
-    evidence: evidenceForPackage(name, input.task, input.diff ?? "")
+function emptyProductIntelligence(repoName) {
+  return {
+    version: 1,
+    repoName,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+    facts: [],
+    openQuestions: [],
+    decisions: []
+  };
+}
+function withLocalProductLearnings(repoRoot, store) {
+  const learnedFacts = loadLocalLearnings(repoRoot).filter((learning) => /product|design|content|copy|ux|ui|user|journey|taste|terminology|workflow|integration|competitor|market/i.test(`${learning.title} ${learning.body} ${learning.files.join(" ")}`)).slice(0, 80).map((learning) => ({
+    id: idFor("product-learning", learning.id),
+    kind: /copy|content|terminology|tone/i.test(`${learning.title} ${learning.body}`) ? "terminology" : /user|journey|job/i.test(`${learning.title} ${learning.body}`) ? "jtbd" : "principle",
+    statement: normalizeText(learning.body, 1e3),
+    appliesTo: learning.files,
+    status: learning.status === "approved" ? "approved" : "proposed",
+    confidence: clampConfidence(learning.confidence),
+    sources: [
+      {
+        id: idFor("product-learning-source", learning.id),
+        kind: "feedback",
+        label: `Local learning: ${normalizeText(learning.title, 140)}`,
+        path: ".brief-cache/learnings.json",
+        accessedAt: learning.createdAt
+      }
+    ],
+    createdAt: learning.createdAt,
+    updatedAt: learning.createdAt
   }));
+  const existingIds = new Set(store.facts.map((fact) => fact.id));
+  const nextFacts = learnedFacts.filter((fact) => !existingIds.has(fact.id));
+  return nextFacts.length === 0 ? store : { ...store, facts: [...nextFacts, ...store.facts].slice(0, 300) };
+}
+function pathName(repoRoot) {
+  return repoRoot.split(/[\\/]/).filter(Boolean).pop() ?? "repo";
+}
+function factRelevance(fact, task) {
+  const text = `${task} ${fact.appliesTo.join(" ")}`.toLowerCase();
+  const statement = fact.statement.toLowerCase();
+  const words = unique(text.split(/[^a-z0-9]+/).filter((word) => word.length >= 4));
+  let score = fact.status === "approved" ? 3 : 1;
+  for (const word of words)
+    if (statement.includes(word))
+      score += 4;
+  const kindTerms = {
+    persona: ["user", "audience", "persona", "customer"],
+    jtbd: ["job", "outcome", "workflow", "task"],
+    principle: ["design", "ui", "ux", "copy", "taste", "quality"],
+    terminology: ["copy", "content", "word", "term", "language", "tone"],
+    competitor: ["competitor", "market", "alternative", "position"],
+    integration: ["integration", "connector", "auth", "permission", "mcp"],
+    metric: ["metric", "activation", "retention", "conversion", "usage"],
+    decision: ["decision", "scope", "choose", "prioritize"]
+  };
+  if (kindTerms[fact.kind].some((term) => text.includes(term)))
+    score += 8;
+  return score;
 }
-function dependencyNamesByManifest(repoRoot, manifests) {
-  const byPackage = /* @__PURE__ */ new Map();
-  for (const manifest of manifests) {
-    if (!manifest.endsWith("package.json"))
-      continue;
-    const parsed = readPackageJson2(repoRoot, manifest);
-    if (!parsed)
-      continue;
-    for (const name of packageJsonDependencyNames(parsed)) {
-      const current = byPackage.get(name) ?? [];
-      current.push(manifest);
-      byPackage.set(name, current);
-    }
-  }
-  return byPackage;
-}
-function packageJsonDependencyNames(parsed) {
-  return unique([
-    "dependencies",
-    "devDependencies",
-    "optionalDependencies",
-    "peerDependencies",
-    "overrides",
-    "resolutions",
-    "pnpm"
-  ].flatMap((field) => nestedDependencyNames(parsed[field])));
-}
-function nestedDependencyNames(value) {
-  if (!value || typeof value !== "object")
-    return [];
-  return Object.entries(value).flatMap(([key, nested]) => [
-    looksLikePackageName(key) ? key : "",
-    ...nestedDependencyNames(nested)
-  ]);
+function isStale(fact, now) {
+  const ageDays = (now - Date.parse(fact.updatedAt)) / 864e5;
+  const marketFact = ["competitor", "integration", "metric"].includes(fact.kind);
+  return !Number.isFinite(ageDays) || ageDays > (marketFact ? staleMarketDays : staleProductDays);
 }
-function packagesMentionedInText(text) {
-  const names = [];
-  const quoted = text.matchAll(/[`'"](@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)[`'"]/gi);
-  for (const match of quoted)
-    names.push(match[1] ?? "");
-  const advisoryContext = text.matchAll(/\b(?:package|dependency|upgrade|update|override|transitive|vulnerable|dependabot|cve|ghsa|audit)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
-  for (const match of advisoryContext)
-    names.push(match[1] ?? "");
-  const atVersion = text.matchAll(/\b(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/gi);
-  for (const match of atVersion)
-    names.push(match[1] ?? "");
-  if (/\b(dependabot|cve-|ghsa-|audit|vulnerab|advisory)\b/i.test(text)) {
-    const affectedPackageContext = text.matchAll(/\b(?:for|affects?|in)\s+(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)/gi);
-    for (const match of affectedPackageContext)
-      names.push(match[1] ?? "");
-  }
-  return unique(names.map(cleanPackageName).filter(looksLikePackageName));
+function statusLabel(status) {
+  return status === "approved" ? "[approved]" : "[proposed]";
 }
-function packagesMentionedInDiff(diff) {
-  const names = [];
-  for (const line of diff.split(/\r?\n/)) {
-    if (!/^[+-]/.test(line) || /^[+-]{3}/.test(line))
-      continue;
-    const packageJsonMatch = line.match(/"(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)"\s*:/i);
-    if (packageJsonMatch?.[1])
-      names.push(packageJsonMatch[1]);
-    const pnpmMatch = line.match(/^\s*[+-]\s{0,8}(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
-    if (pnpmMatch?.[1])
-      names.push(pnpmMatch[1]);
-    const lockPathMatch = line.match(/\/(@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?)@(?:\^|~)?\d/i);
-    if (lockPathMatch?.[1])
-      names.push(lockPathMatch[1]);
+function normalizeSource(input, fallbackAccessedAt) {
+  const url = input.url?.trim();
+  if (url)
+    assertPublicResearchUrl(url);
+  if (!input.path?.trim() && !url && input.kind !== "user" && input.kind !== "feedback" && input.kind !== "dogfood") {
+    throw new Error(`A ${input.kind} source needs a public URL or repo path.`);
   }
-  return unique(names.map(cleanPackageName).filter(looksLikePackageName));
-}
-function packagesFromChangedDependencyFile(repoRoot, filePath) {
-  if (!filePath.endsWith("package.json"))
-    return [];
-  const parsed = readPackageJson2(repoRoot, filePath);
-  return parsed ? packageJsonDependencyNames(parsed).slice(0, 20) : [];
+  const label = normalizeText(input.label, 180);
+  return {
+    id: idFor("product-source", `${input.kind}:${url ?? input.path ?? label}`),
+    kind: input.kind,
+    label,
+    ...url ? { url } : {},
+    ...input.path?.trim() ? { path: normalizeText(input.path, 300) } : {},
+    accessedAt: input.accessedAt ?? fallbackAccessedAt,
+    ...input.excerpt?.trim() ? { excerpt: normalizeText(input.excerpt, 420) } : {}
+  };
 }
-function readPackageJson2(repoRoot, filePath) {
-  const content = safeRead(path7.join(repoRoot, filePath), 4e5);
-  if (!content)
-    return null;
+function assertPublicResearchUrl(value) {
+  let parsed;
   try {
-    const parsed = JSON.parse(content);
-    return parsed && typeof parsed === "object" ? parsed : null;
+    parsed = new URL(value);
   } catch {
-    return null;
-  }
-}
-function changeKindFor(packageName, diff) {
-  const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const removedVersions = [
-    ...diff.matchAll(new RegExp(`^-.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
-  ].map((match) => match[1] ?? "");
-  const addedVersions = [
-    ...diff.matchAll(new RegExp(`^\\+.*${escaped}.*?(\\d+\\.\\d+\\.\\d+)`, "gim"))
-  ].map((match) => match[1] ?? "");
-  const removed = removedVersions[0];
-  const added = addedVersions[0];
-  if (removed && added) {
-    const [removedMajor] = removed.split(".");
-    const [addedMajor] = added.split(".");
-    return removedMajor && addedMajor && removedMajor !== addedMajor ? "major" : "patch_or_minor";
+    throw new Error("Product research URLs must be valid HTTPS URLs.");
   }
-  if (added && !removed)
-    return "added_or_overridden";
-  return "unknown";
-}
-function manifestsForPackage(packageName, manifestDeps) {
-  return unique([
-    ...manifestDeps.get(packageName) ?? [],
-    ...[...manifestDeps.entries()].filter(([name]) => name.endsWith(`/${packageName}`)).flatMap(([, manifests]) => manifests)
-  ]).slice(0, 8);
-}
-function evidenceForPackage(packageName, task, diff) {
-  const evidence = [];
-  if (task.toLowerCase().includes(packageName.toLowerCase())) {
-    evidence.push("mentioned_in_task");
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
+    throw new Error("Product research URLs must use HTTPS and cannot include credentials.");
   }
-  if (diff.toLowerCase().includes(packageName.toLowerCase())) {
-    evidence.push("mentioned_in_diff");
+  const host = parsed.hostname.toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || isPrivateIp(host)) {
+    throw new Error("Product research URLs must point to public sources.");
   }
-  if (evidence.length === 0)
-    evidence.push("manifest_candidate");
-  return evidence;
 }
-function validationCommandsFor2(repoRoot, packageManager) {
-  const scripts = packageScripts(repoRoot);
-  const run = packageRunCommand(packageManager);
-  return unique([
-    ...auditCommandsFor(packageManager),
-    ...scriptCommand(scripts, "check", run),
-    ...scriptCommand(scripts, "test", run),
-    ...scriptCommand(scripts, "test:client", run),
-    ...scriptCommand(scripts, "test:e2e:smoke", run),
-    ...scriptCommand(scripts, "build", run)
-  ]).slice(0, 10);
-}
-function packageScripts(repoRoot) {
-  const parsed = readPackageJson2(repoRoot, "package.json");
-  const scripts = parsed?.scripts;
-  return scripts && typeof scripts === "object" ? Object.fromEntries(Object.entries(scripts).filter((entry) => typeof entry[1] === "string")) : {};
-}
-function scriptCommand(scripts, scriptName, runCommand) {
-  return scripts[scriptName] ? [`${runCommand} ${scriptName}`] : [];
-}
-function packageRunCommand(packageManager) {
-  switch (packageManager) {
-    case "npm":
-      return "npm run";
-    case "yarn":
-      return "yarn";
-    case "bun":
-      return "bun run";
-    default:
-      return "pnpm";
-  }
-}
-function auditCommandsFor(packageManager) {
-  switch (packageManager) {
-    case "pnpm":
-      return ["pnpm audit --prod"];
-    case "npm":
-      return ["npm audit --omit=dev"];
-    case "yarn":
-      return ["yarn npm audit --environment production"];
-    case "bun":
-      return ["bun audit"];
-    case "pip":
-      return ["pip-audit"];
-    case "bundler":
-      return ["bundle audit check"];
-    case "go":
-      return ["govulncheck ./..."];
-    case "cargo":
-      return ["cargo audit"];
-    default:
-      return [];
-  }
-}
-function dependencyGraphCommandsFor(packageManager, packageNames) {
-  const selected = packageNames.slice(0, 5);
-  if (selected.length === 0)
-    return [];
-  switch (packageManager) {
-    case "pnpm":
-      return selected.map((name) => `pnpm why ${name}`);
-    case "npm":
-      return selected.map((name) => `npm explain ${name}`);
-    case "yarn":
-      return selected.map((name) => `yarn why ${name}`);
-    case "bun":
-      return selected.map((name) => `bun pm why ${name}`);
-    case "go":
-      return selected.map((name) => `go mod why -m ${name}`);
-    case "cargo":
-      return selected.map((name) => `cargo tree -i ${name}`);
-    default:
-      return [];
+function isPrivateIp(host) {
+  const family = isIP(host);
+  if (family === 4) {
+    const octets = host.split(".").map(Number);
+    return octets[0] === 10 || octets[0] === 127 || octets[0] === 169 && octets[1] === 254 || octets[0] === 172 && (octets[1] ?? -1) >= 16 && (octets[1] ?? -1) <= 31 || octets[0] === 192 && octets[1] === 168;
   }
+  return family === 6 && (host.startsWith("fc") || host.startsWith("fd") || host === "::1");
 }
-function remediationCommandsFor(packageManager, packageNames) {
-  const selected = packageNames.slice(0, 5);
-  if (selected.length === 0)
-    return [];
-  switch (packageManager) {
-    case "pnpm":
-      return selected.map((name) => `pnpm up ${name} --latest --interactive=false`);
-    case "npm":
-      return selected.map((name) => `npm update ${name}`);
-    case "yarn":
-      return selected.map((name) => `yarn up ${name}`);
-    case "bun":
-      return selected.map((name) => `bun update ${name}`);
-    case "go":
-      return selected.map((name) => `go get ${name}@latest`);
-    case "cargo":
-      return selected.map((name) => `cargo update -p ${name}`);
-    default:
-      return [];
+function mergeSources(current, incoming) {
+  const merged = [...current];
+  for (const source of incoming) {
+    const existing = merged.find((item) => item.id === source.id);
+    if (existing) {
+      Object.assign(existing, source);
+    } else {
+      merged.push(source);
+    }
   }
+  return merged.slice(0, 12);
 }
-function residualRiskChecksFor(packageManager, packageNames, changedDependencyFiles) {
-  return unique([
-    packageNames.length > 0 ? `Confirm vulnerable versions are gone for: ${packageNames.slice(0, 8).join(", ")}.` : "Name each advisory/package from the scanner before editing.",
-    changedDependencyFiles.some(isDependencyLockfile) ? "Inspect the lockfile diff for unexpected package churn outside the advisory path." : "Regenerate and inspect the lockfile if the fix changes dependency resolution.",
-    "Split major-version upgrades or broad framework upgrades into a separate mission unless the advisory requires them.",
-    "Record any remaining advisory ids, ignored dev-only findings, or transitive paths that still need owner judgment.",
-    ...auditCommandsFor(packageManager).map((command2) => `Rerun ${command2} after the lockfile update.`)
-  ]);
+function normalizeText(value, maxLength) {
+  return value.trim().replace(/\s+/g, " ").slice(0, maxLength);
 }
-function confidenceFor(input) {
-  let score = 35;
-  if (input.changedDependencyFiles.length > 0)
-    score += 20;
-  if (input.packageSignals.length > 0)
-    score += 20;
-  if (input.lockfiles.length > 0)
-    score += 10;
-  if (input.validationCommands.length > 0)
-    score += 10;
-  return Math.min(95, score);
+function normalizeKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
 }
-function summaryFor3(input) {
-  const packages = input.packageSignals.map((signal2) => signal2.name);
-  return [
-    `Detected ${input.packageManager} dependency remediation context.`,
-    `${input.manifests.length} manifest${input.manifests.length === 1 ? "" : "s"}, ${input.lockfiles.length} lockfile${input.lockfiles.length === 1 ? "" : "s"}.`,
-    input.changedDependencyFiles.length > 0 ? `Changed dependency files: ${input.changedDependencyFiles.slice(0, 6).join(", ")}.` : "No dependency files are changed yet.",
-    packages.length > 0 ? `Likely packages: ${packages.slice(0, 8).join(", ")}.` : "Package names still need advisory/scanner evidence.",
-    input.validationCommands.length > 0 ? `Validation starts with ${input.validationCommands[0]}.` : "Validation commands need repo-specific confirmation."
-  ].join(" ");
+function clampConfidence(value) {
+  return Math.max(0, Math.min(1, Number.isFinite(value) ? value : 0));
 }
-function cleanPackageName(input) {
-  return input.replace(/[),.;\]]+$/g, "").trim();
+function isProductIntelligenceStore(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const item = value;
+  return item.version === 1 && typeof item.repoName === "string" && typeof item.updatedAt === "string" && Array.isArray(item.facts) && item.facts.every(isFact) && Array.isArray(item.openQuestions) && item.openQuestions.every((question) => typeof question === "string") && Array.isArray(item.decisions) && item.decisions.every((decision) => typeof decision === "string");
 }
-function looksLikePackageName(input) {
-  return /^@?[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9._-]+)?$/i.test(input);
+function isFact(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const item = value;
+  return typeof item.id === "string" && typeof item.kind === "string" && typeof item.statement === "string" && Array.isArray(item.appliesTo) && typeof item.status === "string" && typeof item.confidence === "number" && Array.isArray(item.sources) && item.sources.every(isSource) && typeof item.createdAt === "string" && typeof item.updatedAt === "string";
 }
-function looksLikeVersionOrAdvisory(input) {
-  const normalized = input.toLowerCase();
-  return /^\d/.test(input) || /^cve-\d/i.test(input) || /^ghsa-/i.test(input) || [
-    "advisory",
-    "advisories",
-    "change",
-    "changes",
-    "dependency",
-    "dependencies",
-    "dependabot",
-    "finding",
-    "findings",
-    "package",
-    "packages",
-    "security",
-    "transitive",
-    "upgrade",
-    "upgrades",
-    "vulnerabilities",
-    "vulnerability",
-    "vulnerable"
-  ].includes(normalized);
+function isSource(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const item = value;
+  return typeof item.id === "string" && typeof item.kind === "string" && typeof item.label === "string" && typeof item.accessedAt === "string";
 }
-var dependencyFilePatterns;
-var init_dependencyRemediation = __esm({
-  "../core/dist/dependencyRemediation.js"() {
+var productIntelligenceFile, staleMarketDays, staleProductDays;
+var init_productIntelligence = __esm({
+  "../core/dist/productIntelligence.js"() {
     "use strict";
+    init_localCache();
+    init_localLearning();
     init_utils();
-    dependencyFilePatterns = [
-      "package.json",
-      "pnpm-lock.yaml",
-      "pnpm-workspace.yaml",
-      "package-lock.json",
-      "yarn.lock",
-      "bun.lock",
-      "npm-shrinkwrap.json",
-      "requirements.txt",
-      "poetry.lock",
-      "pyproject.toml",
-      "Pipfile.lock",
-      "Gemfile",
-      "Gemfile.lock",
-      "go.mod",
-      "go.sum",
-      "Cargo.toml",
-      "Cargo.lock"
-    ];
+    productIntelligenceFile = "product-intelligence.json";
+    staleMarketDays = 90;
+    staleProductDays = 180;
   }
 });
 
@@ -13863,6 +14368,16 @@ function buildProductOperatingContext(scan, request) {
   });
   const status = statusFor(taskClasses, reuseBeforeBuild, productRules);
   const score = scoreFor(status, reuseBeforeBuild, productRules, terminology);
+  const productIntelligence = request.repoRoot ? buildProductIntelligenceContext(loadProductIntelligence(request.repoRoot), request.task, Math.max(4, Math.min(12, (request.maxLines ?? 32) - 8))) : {
+    status: "not_available",
+    summary: "Product intelligence is not available without a repo root.",
+    relevantFacts: [],
+    staleFactCount: 0,
+    sourceCount: 0,
+    openQuestions: [],
+    compactText: "Product intelligence: not available without a repo root.",
+    next: "Resolve the repository before reading product context."
+  };
   const summary = status === "not_applicable" ? `${scan.repoName}: no product/design operating context was needed for this task.` : `${scan.repoName}: ${taskClasses.join(", ")} work should reuse ${reuseBeforeBuild.length} existing pattern${reuseBeforeBuild.length === 1 ? "" : "s"} and satisfy ${acceptanceCriteria.length} acceptance checks before handoff.`;
   const compactText = compactTextFor({
     summary,
@@ -13872,6 +14387,7 @@ function buildProductOperatingContext(scan, request) {
     acceptanceCriteria,
     terminology,
     stopSignals: stopSignals2,
+    productIntelligence,
     maxLines: request.maxLines ?? 32
   });
   return {
@@ -13891,9 +14407,10 @@ function buildProductOperatingContext(scan, request) {
     validation,
     productMemoryCandidates,
     stopSignals: stopSignals2,
+    productIntelligence,
     compactText,
     lineCount: compactText.split(/\r?\n/).length,
-    next: status === "not_applicable" ? "Continue with the normal before-you-code packet." : "Read compactText before editing; reuse or rule out the listed patterns, then validate the journey, terminology, state, and CTA checks before handoff."
+    next: status === "not_applicable" ? "Continue with the normal before-you-code packet." : `Read compactText before editing; reuse or rule out the listed patterns, then validate the journey, terminology, state, and CTA checks before handoff. ${productIntelligence.next}`
   };
 }
 function needsProductOperatingContext(request) {
@@ -14351,6 +14868,7 @@ function compactTextFor(input) {
     ...input.terminology.preferred.length > 0 ? [
       `Terminology: use ${input.terminology.preferred.slice(0, 8).join(", ")}.`
     ] : [],
+    ...input.productIntelligence.status !== "not_available" ? input.productIntelligence.compactText.split(/\r?\n/) : [],
     "Stop if:",
     ...itemLines(input.stopSignals, (item) => item, "No stop signals.", 4)
   ];
@@ -14379,6 +14897,7 @@ var init_productOperatingContext = __esm({
   "../core/dist/productOperatingContext.js"() {
     "use strict";
     init_utils();
+    init_productIntelligence();
     PRODUCT_KEYWORDS = [
       "app",
       "cta",
@@ -14387,6 +14906,16 @@ var init_productOperatingContext = __esm({
       "feature",
       "flow",
       "journey",
+      "jtbd",
+      "job-to-be-done",
+      "persona",
+      "competitor",
+      "market",
+      "research",
+      "taste",
+      "integration",
+      "customer",
+      "feedback",
       "page",
       "product",
       "screen",
@@ -16624,6 +17153,9 @@ function recipeFor(explicitRecipe, task, request) {
     return missionRecipes.find((recipe) => recipe.id === explicitRecipe) ?? missionRecipes[0];
   }
   const lower = task.toLowerCase();
+  if (/\b(dogfood|dogfooding|exploratory browser|web app smoke|browser smoke|product safari|try the app|use the app)\b/.test(lower) && /\b(app|site|web|browser|page|screen|flow|journey|ui|ux|localhost|staging|production)\b/.test(lower)) {
+    return recipeById("web_dogfood");
+  }
   if (isDesignLedChange(lower)) {
     return recipeById("design_change");
   }
@@ -16974,6 +17506,9 @@ function missionSummary(repoName, recipe, autonomy, request) {
   if (recipe.id === "qa_edge_cases") {
     return `${repoName} can run this as the QA edge-case loop: find missing coverage around risky behavior, add or improve tests, validate the signal, then review the diff.`;
   }
+  if (recipe.id === "web_dogfood") {
+    return `${repoName} can run this as a read-only browser dogfooding loop: name the critical journeys, exercise the app like a user, capture reproducible evidence, separate product friction from environment noise, then hand back the top fixes and reusable learning.`;
+  }
   if (recipe.id === "performance") {
     return `${repoName} can run this as the performance loop: capture a baseline, form a bounded optimization hypothesis, measure before and after, review the diff, then save handoff proof.`;
   }
@@ -17116,6 +17651,15 @@ function missionGates(autonomy, recipe, options2) {
       failureMode: "Do not add low-signal tests or hide flaky checks. Ask for the behavior risk and validation target."
     });
   }
+  if (recipe.id === "web_dogfood") {
+    gates.push({
+      id: "browser_journey",
+      label: "Browser journey gate",
+      requiredTool: "available browser",
+      passCriteria: "The agent names safe starting state, critical journeys, expected outcomes, stop conditions, and evidence fields before interacting with the app.",
+      failureMode: "Do not click through an unclear or destructive flow. Ask for a safe fixture, account, URL, or narrower journey list."
+    });
+  }
   if (recipe.id === "performance") {
     gates.push({
       id: "benchmark_baseline",
@@ -17164,7 +17708,7 @@ function missionGates(autonomy, recipe, options2) {
       label: "Library privacy gate",
       requiredTool: "brief.agent_session_insights",
       passCriteria: "Every candidate example is classified as derived-only, redacted transcript, or explicitly approved raw import before sharing.",
-      failureMode: "Do not publish raw prompts, secrets, customer data, private logs, or sensitive repo context without explicit approval."
+      failureMode: "Do not share raw prompts, secrets, customer data, private logs, or sensitive repo context without explicit approval."
     }, {
       id: "reuse_quality",
       label: "Reuse quality gate",
@@ -17230,6 +17774,17 @@ function missionSteps(task, autonomy, recipe, options2) {
       gateId: "plan"
     }
   ];
+  if (recipe.id === "web_dogfood") {
+    steps.push({
+      id: "browser_journeys",
+      title: "Exercise critical browser journeys",
+      objective: "Use the app like a real user and gather evidence before proposing a fix.",
+      agentAction: "Start from the named safe state, exercise 2-5 critical journeys, capture expected versus actual behavior, and stop before destructive or credential-requiring actions.",
+      briefTool: "available browser",
+      expectedOutput: "Journey evidence with routes, actions, screenshots or DOM notes, viewport/accessibility checks, and console/network observations.",
+      gateId: "browser_journey"
+    });
+  }
   if (recipe.id === "ticket_write") {
     steps.push({
       id: "capture_judgment",
@@ -17548,7 +18103,7 @@ function missionSteps(task, autonomy, recipe, options2) {
       id: "verify_receipts",
       title: "Verify ticket receipt ledger",
       objective: "Prove the ticket-writing receipt chain before another agent runs the ticket.",
-      agentAction: "Run Brief receipt verification and fix missing, mismatched, or broken-chain ticket proof before publishing the ticket.",
+      agentAction: "Run Brief receipt verification and fix missing, mismatched, or broken-chain ticket proof before sending the ticket.",
       briefTool: "brief.verify_receipts",
       expectedOutput: "Receipt ledger verification with digest and chain-link status.",
       gateId: "ticket"
@@ -17670,6 +18225,17 @@ function selectMissionValidation(suggestedTests, recipe, needsRuntimeEvidence, n
       "Run brief.review_diff before PR handoff."
     ]);
   }
+  if (recipe.id === "web_dogfood") {
+    return unique([
+      "Name 2-5 user journeys with a safe starting state, expected outcome, and stop condition.",
+      "Exercise rendered, user-visible behavior before inferring implementation causes.",
+      "For each finding capture route, reproducible steps, expected vs actual, severity, and screenshot or DOM evidence when useful.",
+      "Check desktop and narrow/mobile layout, keyboard/focus, accessible names, console errors, and failed requests when relevant.",
+      "Separate product friction from auth, fixture, network, or environment limitations.",
+      "End with the top three fixes, what worked, and one reusable learning; do not edit the repo in read-only mode.",
+      "Save the dogfooding report with brief.save_handoff and verify its receipts; use brief.save_learning only for repeatable lessons."
+    ]);
+  }
   if (recipe.id === "performance") {
     return unique([
       "Benchmark baseline names workload, command, metric, variance, and success threshold before edits.",
@@ -17759,25 +18325,31 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
   const isTicketWriter = mode === "ticket_writer";
   const isTicketFix = mode === "ticket_fix";
   const isRuntimeFix = mode === "runtime_fix";
+  const isWebDogfood = recipe.id === "web_dogfood";
   const isSecurityRecipe = recipe.id === "security_dependency" || recipe.id === "security_finding" || recipe.id === "security_testing";
   const handoffTarget = deliveryReviewTarget(deliveryMode);
   const phases = [
     {
-      id: isTicketWriter ? "ticket_intake" : "context_map",
-      title: isTicketWriter ? "Capture intent and judgment boundaries" : "Load team context and map the repo surface",
+      id: isTicketWriter ? "ticket_intake" : isWebDogfood ? "context_and_surface" : "context_map",
+      title: isTicketWriter ? "Capture intent and judgment boundaries" : isWebDogfood ? "Load app context and safe journey surface" : "Load team context and map the repo surface",
       required: true,
       tool: isTicketWriter ? "brief.write_ticket" : "brief.context_for_task + brief.codebase_map",
-      expectedArtifact: isTicketWriter ? "generatedArtifacts.automationTicket" : "context_receipt + map_proof",
+      expectedArtifact: isTicketWriter ? "generatedArtifacts.automationTicket" : isWebDogfood ? "context_receipt + map_proof + browser target" : "context_receipt + map_proof",
       proofRequired: isTicketWriter ? [
         "ticketReadiness.status",
         "automationTicket.machineReadableFields",
         "automationTicket.executionContract"
+      ] : isWebDogfood ? [
+        "contextReceipt.packetId",
+        "executionContract.evidenceContract.mapProof",
+        "context.likelyFiles",
+        "browser target and safe starting state"
       ] : [
         "contextReceipt.packetId",
         "executionContract.evidenceContract.mapProof",
         "context.likelyFiles"
       ],
-      stopIfMissing: isTicketWriter ? "Do not publish the ticket until product intent, owner judgment, acceptance criteria, and stop conditions are explicit." : "Do not edit until likely files, rules, tests, owners, and affected systems are grounded in Brief context."
+      stopIfMissing: isTicketWriter ? "Do not send the ticket until product intent, owner judgment, acceptance criteria, and stop conditions are explicit." : isWebDogfood ? "Do not interact until the app URL, safe starting state, critical journeys, and destructive-action stop conditions are explicit." : "Do not edit until likely files, rules, tests, owners, and affected systems are grounded in Brief context."
     },
     ...isRuntimeFix ? [
       {
@@ -17797,6 +18369,23 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
         stopIfMissing: "Do not code from a runtime symptom until the source, identifier, environment, time window, observed facts, and privacy boundary are present."
       }
     ] : [],
+    ...isWebDogfood ? [
+      {
+        id: "browser_journeys",
+        title: "Exercise critical user journeys",
+        required: true,
+        tool: "available browser",
+        expectedArtifact: "generatedArtifacts.browserJourneyEvidence",
+        proofRequired: [
+          "journey name and starting state",
+          "route and user-visible actions",
+          "expected versus actual outcome",
+          "screenshot or DOM evidence when useful",
+          "viewport, keyboard/focus, console, and failed-request notes"
+        ],
+        stopIfMissing: "Stop before destructive actions, credential entry, or ambiguous state changes; record the environment limitation instead."
+      }
+    ] : [],
     {
       id: "plan_loop",
       title: "Convert the work into a bounded loop",
@@ -17813,53 +18402,70 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
     },
     ...isTicketWriter ? [] : [
       {
-        id: "execute_change",
-        title: "Make the smallest bounded change",
-        required: autonomy !== "read_only",
-        tool: "coding agent",
-        expectedArtifact: "local diff or no-code-change explanation",
-        proofRequired: [
+        id: isWebDogfood ? "read_only_pass" : "execute_change",
+        title: isWebDogfood ? "Keep the pass read-only" : "Make the smallest bounded change",
+        required: isWebDogfood ? true : autonomy !== "read_only",
+        tool: isWebDogfood ? "available browser" : "coding agent",
+        expectedArtifact: isWebDogfood ? "journey evidence or explicit environment gap" : "local diff or no-code-change explanation",
+        proofRequired: isWebDogfood ? [
+          "no repo files changed",
+          "journey evidence is reproducible",
+          "product friction is separated from environment noise"
+        ] : [
           "changedFiles[]",
           "rootCause or explicit no-root-cause finding",
           "acceptanceCriteriaStatus[]"
         ],
-        stopIfMissing: "Stop when the likely fix exceeds the ticket, runtime evidence, or selected autonomy boundary."
+        stopIfMissing: isWebDogfood ? "Stop when a journey needs an external side effect, private credential, or unsupported browser capability." : "Stop when the likely fix exceeds the ticket, runtime evidence, or selected autonomy boundary."
       },
       {
-        id: "validate_change",
-        title: "Run the validation loop",
+        id: isWebDogfood ? "review_evidence" : "validate_change",
+        title: isWebDogfood ? "Review and classify the evidence" : "Run the validation loop",
         required: true,
-        tool: "brief.find_tests + project commands",
-        expectedArtifact: "validation evidence",
-        proofRequired: validation.length ? validation.slice(0, 5) : [
+        tool: isWebDogfood ? "browser evidence + agent judgment" : "brief.find_tests + project commands",
+        expectedArtifact: isWebDogfood ? "classified dogfooding findings" : "validation evidence",
+        proofRequired: isWebDogfood ? [
+          "finding severity and reproducible steps",
+          "bug versus UX friction versus environment classification",
+          "top fixes and what worked"
+        ] : validation.length ? validation.slice(0, 5) : [
           "selected validation command",
           "pass/fail/skipped result",
           "environment note"
         ],
-        stopIfMissing: `Do not ask for ${handoffTarget} until validation is run or the missing environment is named with an owner.`
+        stopIfMissing: isWebDogfood ? "Do not report a product issue without a route, action, expected result, actual result, and evidence or an explicit environment limitation." : `Do not ask for ${handoffTarget} until validation is run or the missing environment is named with an owner.`
       },
       {
-        id: "challenge_review",
-        title: "Challenge the diff and the root cause",
+        id: isWebDogfood ? "prioritize_findings" : "challenge_review",
+        title: isWebDogfood ? "Prioritize the user impact" : "Challenge the diff and the root cause",
         required: true,
-        tool: "brief.review_diff",
-        expectedArtifact: "review receipt",
-        proofRequired: [
+        tool: isWebDogfood ? "brief.save_learning (when repeatable)" : "brief.review_diff",
+        expectedArtifact: isWebDogfood ? "prioritized product feedback" : "review receipt",
+        proofRequired: isWebDogfood ? [
+          "top three fixes by user impact and reproducibility",
+          "one thing that worked",
+          "one reusable learning or explicit no-learning decision"
+        ] : [
           "review.verdict",
           "review.readiness.status",
           "review receipt id",
           "blocker/high findings resolved or explicitly accepted"
         ],
-        stopIfMissing: "Do not hand off when blocker or high review findings remain unresolved."
+        stopIfMissing: isWebDogfood ? "Do not hand off a long undifferentiated bug list; rank the few findings that most affect a real user." : "Do not hand off when blocker or high review findings remain unresolved."
       }
     ],
     {
       id: "handoff_receipts",
-      title: isTicketWriter ? "Save the ticket contract and receipt ledger" : "Save handoff proof and verify receipts",
+      title: isTicketWriter ? "Save the ticket contract and receipt ledger" : isWebDogfood ? "Save the dogfooding report and verify receipts" : "Save handoff proof and verify receipts",
       required: true,
       tool: "brief.save_handoff + brief.verify_receipts",
-      expectedArtifact: "proof bundle + receipt ledger verification",
-      proofRequired: [
+      expectedArtifact: isWebDogfood ? "dogfooding report + receipt ledger verification" : "proof bundle + receipt ledger verification",
+      proofRequired: isWebDogfood ? [
+        "proofBundle.status",
+        "proofBundle.receipts.handoffId",
+        "proofBundle.missingEvidence",
+        "receiptLedger.status"
+      ] : [
         "proofBundle.status",
         "proofBundle.receipts.handoffId",
         "proofBundle.receipts.reviewReceiptId",
@@ -17893,7 +18499,7 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
       "MCP-capable IDE",
       "console loop recipe"
     ],
-    evidenceSources: automationLoopEvidenceSources(mode, options2),
+    evidenceSources: automationLoopEvidenceSources(mode, options2, recipe.id),
     dataBoundaries: [
       "Use derived or redacted runtime facts in prompts; do not paste raw customer payloads, secrets, tokens, or private logs.",
       "Keep observed facts, hypotheses, and human decisions separate in the ticket or handoff.",
@@ -17910,7 +18516,10 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
         "Root cause is inferred from symptoms rather than proven by source, CI, logs, traces, or reproduction.",
         "Two plausible approaches compete or the change touches architecture, data, auth, migrations, billing, or customer-visible behavior.",
         "The agent changes files outside the mapped scope or selected autonomy.",
-        "brief.review_diff returns blocker or high findings.",
+        ...isWebDogfood ? [] : ["brief.review_diff returns blocker or high findings."],
+        ...isWebDogfood ? [
+          "A journey result is ambiguous, not reproducible, or could be explained by auth, fixture, network, or deployment state."
+        ] : [],
         ...isRuntimeFix ? [
           "Runtime evidence is stale, contradictory, privacy-sensitive, or cannot be tied to the changed code path."
         ] : [],
@@ -17940,7 +18549,7 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
       ] : []
     ]),
     finalUpdate: {
-      destination: deliveryFinalDestination(deliveryMode, isTicketWriter ? "Linear, Jira, or GitHub issue body" : isRuntimeFix ? "source ticket, incident, alert thread, or PR handoff" : isTicketFix ? "source Linear, Jira, GitHub, or pasted ticket" : isSecurityRecipe ? "security alert, Dependabot item, scanner finding, PR description, or handoff notes" : "PR description or handoff notes"),
+      destination: deliveryFinalDestination(deliveryMode, isTicketWriter ? "Linear, Jira, or GitHub issue body" : isWebDogfood ? "product feedback, bug triage, or follow-up mission" : isRuntimeFix ? "source ticket, incident, alert thread, or PR handoff" : isTicketFix ? "source Linear, Jira, GitHub, or pasted ticket" : isSecurityRecipe ? "security alert, Dependabot item, scanner finding, PR description, or handoff notes" : "PR description or handoff notes"),
       requiredSections: isTicketWriter ? [
         "Intent",
         "Automation Readiness",
@@ -17949,26 +18558,42 @@ function automationLoopContract(autonomy, recipe, validation, options2, delivery
         "Brief Evidence Contract",
         "Acceptance Criteria",
         "Stop Conditions"
+      ] : isWebDogfood ? [
+        "Journeys Tested",
+        "What Worked",
+        "Findings",
+        "Environment Limits",
+        "Top Fixes",
+        "Reusable Learning"
       ] : ticketIssueUpdateSections(),
       proofFields: [
         "proofBundle.status",
         "proofBundle.receipts.handoffId",
         "proofBundle.receipts.contextReceiptId",
-        "proofBundle.receipts.reviewReceiptId",
-        "proofBundle.receipts.reviewVerdict",
+        ...isWebDogfood ? [] : [
+          "proofBundle.receipts.reviewReceiptId",
+          "proofBundle.receipts.reviewVerdict"
+        ],
         "proofBundle.validation.passed",
         "proofBundle.missingEvidence"
       ],
       postOnlyWhen: [
-        "brief.review_diff has no unresolved blocker/high findings.",
+        ...isWebDogfood ? [
+          "Each reported finding has reproducible steps and evidence or an explicit environment limitation."
+        ] : ["brief.review_diff has no unresolved blocker/high findings."],
         "brief.verify_receipts is trusted or context_only with gaps explained.",
-        "Acceptance criteria have pass/fail/skipped evidence.",
-        "Remaining risk and owner are named."
+        ...isWebDogfood ? ["The top user-impact fixes and what worked are named."] : [
+          "Acceptance criteria have pass/fail/skipped evidence.",
+          "Remaining risk and owner are named."
+        ]
       ],
       doNotPostWhen: unique([
         "Required owner, product, security, data, or rollout judgment is missing.",
         "Validation is missing and no human owner accepted the gap.",
         "The change exceeded ticket scope, runtime evidence scope, or autonomy.",
+        ...isWebDogfood ? [
+          "A destructive action, private credential, or external side effect was required without approval."
+        ] : [],
         ...isRuntimeFix ? [
           "Runtime evidence packet is missing, stale, contradictory, or contains unresolved privacy gaps."
         ] : [],
@@ -17989,8 +18614,15 @@ function automationLoopMode(recipe, options2) {
     return "ticket_fix";
   return "mission";
 }
-function automationLoopEvidenceSources(mode, options2) {
+function automationLoopEvidenceSources(mode, options2, recipeId) {
   return unique([
+    ...recipeId === "web_dogfood" ? [
+      "available browser",
+      "journey steps and expected outcomes",
+      "screenshots or DOM snapshots",
+      "console and network observations",
+      "responsive and accessibility checks"
+    ] : [],
     ...mode === "ticket_writer" ? [
       "ticket intent",
       "acceptance criteria",
@@ -18026,6 +18658,7 @@ function loopProofContract(recipe, options2, deliveryMode) {
   const isTicketWriter = mode === "ticket_writer";
   const needsRuntimeEvidence = mode === "runtime_fix";
   const needsWorkItem = mode === "ticket_fix" || options2.needsWorkItem;
+  const isWebDogfood = recipe.id === "web_dogfood";
   const isSecurityDependency = recipe.id === "security_dependency";
   const isSecurityFinding = recipe.id === "security_finding";
   const isSecurityTesting = recipe.id === "security_testing";
@@ -18035,7 +18668,12 @@ function loopProofContract(recipe, options2, deliveryMode) {
       "map_proof",
       "team_rules_applied",
       "mission_receipt",
-      ...isTicketWriter ? ["ticket_readiness", "human_judgment_record", "automation_ticket"] : [
+      ...isTicketWriter ? ["ticket_readiness", "human_judgment_record", "automation_ticket"] : isWebDogfood ? [
+        "browser_journey_plan",
+        "browser_journey_evidence",
+        "dogfooding_report",
+        "handoff_receipt"
+      ] : [
         "acceptance_criteria_evidence",
         "validation_evidence",
         "review_readiness",
@@ -18064,7 +18702,8 @@ function loopProofContract(recipe, options2, deliveryMode) {
     ]),
     requiredReceipts: unique([
       "mission_plan",
-      ...isTicketWriter ? [] : ["review", "handoff"],
+      ...isTicketWriter || isWebDogfood ? [] : ["review", "handoff"],
+      ...isWebDogfood ? ["handoff"] : [],
       "receipt_ledger"
     ]),
     readyStatuses: {
@@ -18078,6 +18717,11 @@ function loopProofContract(recipe, options2, deliveryMode) {
       "Human judgment, acceptance criteria, non-goals, and owner boundaries are explicit.",
       "Machine-readable run fields and Brief evidence contract are present.",
       "Receipt ledger verifies the mission receipt digest."
+    ] : isWebDogfood ? [
+      "Browser journeys are named, exercised from a safe state, and reported with reproducible evidence.",
+      "Product issues are separated from auth, fixture, network, browser-capability, and deployment limitations.",
+      "The report is concise: top user-impact fixes, what worked, and reusable learning or an explicit no-learning decision.",
+      "A handoff receipt and receipt-ledger verification are present; review_diff is optional because no repo diff is expected."
     ] : [
       "Runtime evidence packet is ready when runtime evidence is part of the mission.",
       ...isSecurityDependency ? [
@@ -18164,6 +18808,11 @@ function missionRunContract(autonomy, recipe, validation, options2, deliveryMode
         "generatedArtifacts.contentProofPack.readiness",
         "generatedArtifacts.productOperatingContext"
       ] : [],
+      ...recipe.id === "web_dogfood" ? [
+        "generatedArtifacts.browserJourneyEvidence",
+        "generatedArtifacts.dogfoodingReport",
+        "generatedArtifacts.dogfoodingReport.topFindings[]"
+      ] : [],
       "runContract.exitCodes[]"
     ],
     artifacts,
@@ -18172,8 +18821,8 @@ function missionRunContract(autonomy, recipe, validation, options2, deliveryMode
     proofContract,
     successCriteria: [
       "The context receipt cites the rules, source paths, tests, owners, and memories used by the agent.",
-      recipe.id === "ticket_write" ? "The ticket separates human judgment from execution instructions and names unresolved decisions before automation starts." : recipe.id === "security_dependency" ? "The dependency vulnerability packet names advisory id, package, affected range, fixed range, manifest, lockfile, direct/transitive path, reachability, remediation choice, and rollback." : recipe.id === "security_finding" ? "The security finding packet names alert source, rule id, classification, source-to-sink or trust boundary, affected users/data, owner, exploitability, and validation path." : recipe.id === "security_testing" ? "The security test plan names the protected property, bad case, safe case, command, severity threshold, false-positive policy, owner, privacy boundary, and rollout mode." : recipe.id === "internal_app" ? "The app contract names the internal route, data source, auth context, allowed roles, row filters, audit events, and redaction rules before implementation." : recipe.id === "stale_pr" ? "The PR intent packet names original scope, unresolved review feedback, stale assumptions, validation, and handoff expectation." : recipe.id === "merge_conflict" ? "The conflict packet names conflicted files, both sides' intent, semantic conflicts, and validation before resolution." : recipe.id === "flaky_test" ? "The CI evidence packet names failing job or test, sample failure, platform, seed or timing signal, hypothesis, and validation path." : recipe.id === "small_refactor" ? "The mechanical scope packet names exact pattern, allowed files, exclusions, and expected behavior preservation." : recipe.id === "bug_investigation" ? "The hypothesis ledger names observed facts, prior attempts, plausible causes, disproven causes, next probes, and confidence." : recipe.id === "qa_edge_cases" ? "The edge-case inventory names current coverage, missing boundary cases, risky inputs, and validation commands." : recipe.id === "performance" ? "The benchmark packet names workload, command, metric, baseline, variance, success threshold, and rollback signal before edits." : recipe.id === "porting" ? "The source behavior packet names source paths, target paths, incompatible assumptions, owner decision, validation, and attribution notes." : recipe.id === "experiment" ? "The experiment contract names the hypothesis, success signal, throwaway boundary, rollback or discard path, and decision owner." : recipe.id === "session_review" ? "The session review uses receipt-derived activity and marks any need for raw prompts, logs, or transcripts explicitly." : recipe.id === "session_library" ? "The session library classifies every reusable example by proof quality, privacy posture, owner approval, and reuse trigger." : options2.needsRuntimeEvidence ? "The runtime evidence packet names the observed failure source, identifier, environment, time window, symptom, and open gaps." : options2.needsWorkItem ? "The work item packet names source, id, acceptance criteria, non-goals, and the update expected after execution." : recipe.id === "research" ? "The answer names sources, risks, and next steps without editing the repo." : "Required validation evidence is attached or the missing environment is explicitly explained.",
-      recipe.id === "ticket_write" ? "Acceptance criteria, constraints, validation plan, review bar, stop conditions, and update template are parseable from the ticket body." : recipe.id === "security_dependency" ? "Install integrity, build/typecheck, targeted tests, and scanner/audit evidence show the vulnerability is remediated without breaking the dependency path." : recipe.id === "security_finding" ? "The root cause is fixed with negative regression, safe abuse-case proof, or scanner rerun evidence; suppression-only fixes are explicitly rejected or owner-approved." : recipe.id === "security_testing" ? "The added test or scanner catches the intended bad case or has a clear preventive rationale, and rollout mode is calibrated for developer workflow." : recipe.id === "internal_app" ? "The built app follows repo-native UI/data patterns and validation proves the access-control contract." : recipe.id === "stale_pr" ? "The handoff names review feedback addressed, validation, remaining risk, and next reviewer action." : recipe.id === "merge_conflict" ? "The resolution preserves intended behavior from both sides or clearly escalates unresolved semantic conflicts." : recipe.id === "flaky_test" ? "The result stabilizes the test or explains the product root cause with evidence rather than hiding the signal." : recipe.id === "small_refactor" ? "The diff stays mechanical and validation proves no intended behavior changed." : recipe.id === "bug_investigation" ? "The root cause, fix, no-fix decision, or escalation is tied to evidence and includes a follow-up watch signal." : recipe.id === "qa_edge_cases" ? "The added or improved tests cover meaningful behavior risk and do not mute, skip, or obscure the signal." : recipe.id === "performance" ? "Before/after measurements, tradeoffs, and rollback signals are recorded before the optimization is accepted." : recipe.id === "porting" ? "The target behavior preserves source intent, attribution is handled, and intentional differences are explicit." : recipe.id === "experiment" ? "The keep, discard, or formalize decision is recorded with validation and remaining production-readiness gaps." : recipe.id === "session_review" ? "Run cards or skill drafts are tied to actual receipts, validation quality, review outcomes, and privacy posture." : recipe.id === "session_library" ? "The published examples are derived from approved receipts or explicitly approved imports and include first-run commands, stop conditions, and validation expectations." : options2.needsRuntimeEvidence ? "The root cause, fix, validation, and incident or ticket update are tied back to the runtime evidence." : "The mission output is tied back to the selected recipe and context receipt.",
+      recipe.id === "ticket_write" ? "The ticket separates human judgment from execution instructions and names unresolved decisions before automation starts." : recipe.id === "security_dependency" ? "The dependency vulnerability packet names advisory id, package, affected range, fixed range, manifest, lockfile, direct/transitive path, reachability, remediation choice, and rollback." : recipe.id === "security_finding" ? "The security finding packet names alert source, rule id, classification, source-to-sink or trust boundary, affected users/data, owner, exploitability, and validation path." : recipe.id === "security_testing" ? "The security test plan names the protected property, bad case, safe case, command, severity threshold, false-positive policy, owner, privacy boundary, and rollout mode." : recipe.id === "web_dogfood" ? "The dogfooding packet names critical journeys, safe starting state, expected outcomes, stop conditions, and evidence policy." : recipe.id === "internal_app" ? "The app contract names the internal route, data source, auth context, allowed roles, row filters, audit events, and redaction rules before implementation." : recipe.id === "stale_pr" ? "The PR intent packet names original scope, unresolved review feedback, stale assumptions, validation, and handoff expectation." : recipe.id === "merge_conflict" ? "The conflict packet names conflicted files, both sides' intent, semantic conflicts, and validation before resolution." : recipe.id === "flaky_test" ? "The CI evidence packet names failing job or test, sample failure, platform, seed or timing signal, hypothesis, and validation path." : recipe.id === "small_refactor" ? "The mechanical scope packet names exact pattern, allowed files, exclusions, and expected behavior preservation." : recipe.id === "bug_investigation" ? "The hypothesis ledger names observed facts, prior attempts, plausible causes, disproven causes, next probes, and confidence." : recipe.id === "qa_edge_cases" ? "The edge-case inventory names current coverage, missing boundary cases, risky inputs, and validation commands." : recipe.id === "performance" ? "The benchmark packet names workload, command, metric, baseline, variance, success threshold, and rollback signal before edits." : recipe.id === "porting" ? "The source behavior packet names source paths, target paths, incompatible assumptions, owner decision, validation, and attribution notes." : recipe.id === "experiment" ? "The experiment contract names the hypothesis, success signal, throwaway boundary, rollback or discard path, and decision owner." : recipe.id === "session_review" ? "The session review uses receipt-derived activity and marks any need for raw prompts, logs, or transcripts explicitly." : recipe.id === "session_library" ? "The session library classifies every reusable example by proof quality, privacy posture, owner approval, and reuse trigger." : options2.needsRuntimeEvidence ? "The runtime evidence packet names the observed failure source, identifier, environment, time window, symptom, and open gaps." : options2.needsWorkItem ? "The work item packet names source, id, acceptance criteria, non-goals, and the update expected after execution." : recipe.id === "research" ? "The answer names sources, risks, and next steps without editing the repo." : "Required validation evidence is attached or the missing environment is explicitly explained.",
+      recipe.id === "ticket_write" ? "Acceptance criteria, constraints, validation plan, review bar, stop conditions, and update template are parseable from the ticket body." : recipe.id === "security_dependency" ? "Install integrity, build/typecheck, targeted tests, and scanner/audit evidence show the vulnerability is remediated without breaking the dependency path." : recipe.id === "security_finding" ? "The root cause is fixed with negative regression, safe abuse-case proof, or scanner rerun evidence; suppression-only fixes are explicitly rejected or owner-approved." : recipe.id === "security_testing" ? "The added test or scanner catches the intended bad case or has a clear preventive rationale, and rollout mode is calibrated for developer workflow." : recipe.id === "web_dogfood" ? "The browser report contains reproducible journey evidence, separates product friction from environment noise, and ranks the top user-impact fixes." : recipe.id === "internal_app" ? "The built app follows repo-native UI/data patterns and validation proves the access-control contract." : recipe.id === "stale_pr" ? "The handoff names review feedback addressed, validation, remaining risk, and next reviewer action." : recipe.id === "merge_conflict" ? "The resolution preserves intended behavior from both sides or clearly escalates unresolved semantic conflicts." : recipe.id === "flaky_test" ? "The result stabilizes the test or explains the product root cause with evidence rather than hiding the signal." : recipe.id === "small_refactor" ? "The diff stays mechanical and validation proves no intended behavior changed." : recipe.id === "bug_investigation" ? "The root cause, fix, no-fix decision, or escalation is tied to evidence and includes a follow-up watch signal." : recipe.id === "qa_edge_cases" ? "The added or improved tests cover meaningful behavior risk and do not mute, skip, or obscure the signal." : recipe.id === "performance" ? "Before/after measurements, tradeoffs, and rollback signals are recorded before the optimization is accepted." : recipe.id === "porting" ? "The target behavior preserves source intent, attribution is handled, and intentional differences are explicit." : recipe.id === "experiment" ? "The keep, discard, or formalize decision is recorded with validation and remaining production-readiness gaps." : recipe.id === "session_review" ? "Run cards or skill drafts are tied to actual receipts, validation quality, review outcomes, and privacy posture." : recipe.id === "session_library" ? "The shared examples are derived from approved receipts or explicitly approved imports and include first-run commands, stop conditions, and validation expectations." : options2.needsRuntimeEvidence ? "The root cause, fix, validation, and incident or ticket update are tied back to the runtime evidence." : "The mission output is tied back to the selected recipe and context receipt.",
       autonomy === "read_only" ? "No repo files are changed." : "The local diff has no blocker or high Brief findings before human review.",
       "Useful repeated feedback is saved or intentionally skipped with a reason."
     ],
@@ -18221,6 +18870,12 @@ function missionRunContract(autonomy, recipe, validation, options2, deliveryMode
         "The proposed tests do not map to observable behavior risk or only assert implementation details.",
         "The change hides failures by muting, skipping, or weakening validation."
       ] : [],
+      ...recipe.id === "web_dogfood" ? [
+        "The app URL, safe starting state, critical journey, or expected outcome is missing.",
+        "A journey requires destructive action, private credentials, production data, or an external side effect without explicit approval.",
+        "A finding is reported without reproducible steps, route, expected versus actual behavior, and evidence or an explicit environment limitation.",
+        "Browser, auth, fixture, network, or deployment noise is presented as a product defect without confirmation."
+      ] : [],
       ...recipe.id === "performance" ? [
         "The benchmark, workload, baseline, variance, or success threshold is missing.",
         "The optimization makes readability, correctness, or operability worse without an explicit human tradeoff."
@@ -18373,6 +19028,30 @@ function missionArtifacts(recipe, autonomy, options2) {
       description: "Labels, helper text, descriptions, errors, announcements, and screen-reader context remain accurate after copy changes."
     });
   }
+  if (recipe.id === "web_dogfood") {
+    artifacts.push({
+      id: "browser_journey_plan",
+      label: "Browser journey plan",
+      kind: "plan",
+      producer: "brief.mission_plan",
+      required: true,
+      description: "Safe starting state, critical user journeys, expected outcomes, stop conditions, viewport plan, and evidence policy."
+    }, {
+      id: "browser_journey_evidence",
+      label: "Browser journey evidence",
+      kind: "validation",
+      producer: "available browser",
+      required: true,
+      description: "Journey-by-journey route, actions, expected versus actual behavior, screenshot or DOM evidence, viewport, accessibility notes, and console/network result."
+    }, {
+      id: "dogfooding_report",
+      label: "Dogfooding report",
+      kind: "handoff",
+      producer: "brief.save_handoff",
+      required: true,
+      description: "Concise findings ranked by user impact and reproducibility, environment limitations, top fixes, what worked, and reusable learning."
+    });
+  }
   if (recipe.id === "internal_app") {
     artifacts.push({
       id: "product_operating_context",
@@ -18841,6 +19520,30 @@ function missionHookEvents(recipe, autonomy, options2) {
       mode: "advisory"
     });
   }
+  if (recipe.id === "web_dogfood") {
+    events.push({
+      id: "before_browser_journey",
+      label: "Before browser journey",
+      timing: "before",
+      trigger: "An agent starts an exploratory pass through a local, staging, or deployed web app.",
+      action: "Require safe starting state, 2-5 critical journeys, expected outcomes, viewport plan, evidence fields, and destructive-action stop conditions.",
+      mode: "blocking"
+    }, {
+      id: "after_browser_journey",
+      label: "After browser journey",
+      timing: "after",
+      trigger: "A browser journey or exploratory scenario completes.",
+      action: "Classify findings as product bug, UX friction, accessibility issue, or environment limitation; attach reproducible evidence and rank the top user-impact fixes.",
+      mode: "blocking"
+    }, {
+      id: "before_dogfood_handoff",
+      label: "Before dogfooding handoff",
+      timing: "before",
+      trigger: "The agent prepares a browser dogfooding report.",
+      action: "Save the concise report and receipt ledger; skip review_diff when no repo files changed, and save only repeatable lessons to shared learning.",
+      mode: "blocking"
+    });
+  }
   if (recipe.id === "ticket_write") {
     events.push({
       id: "before_ticket_execution",
@@ -19012,10 +19715,10 @@ function missionHookEvents(recipe, autonomy, options2) {
   if (recipe.id === "session_library") {
     events.push({
       id: "before_session_library_publish",
-      label: "Before library publish",
+      label: "Before team sharing",
       timing: "before",
       trigger: "An agent turns previous sessions, transcripts, prompts, or run cards into shared examples.",
-      action: "Require receipt proof, privacy classification, owner approval, and explicit raw-import approval before publishing examples to the team.",
+      action: "Require receipt proof, privacy classification, owner approval, and explicit raw-import approval before sharing examples with the team.",
       mode: "blocking"
     });
   }
@@ -19472,6 +20175,31 @@ var init_missionPlan = __esm({
           "learn"
         ]
       },
+      {
+        id: "web_dogfood",
+        title: "Web app dogfooding loop",
+        whenToUse: "Exercise a local or deployed web app like a real user, find the highest-friction moments, and return evidence-backed product feedback before changing code.",
+        defaultAutonomy: "read_only",
+        primaryOutput: "Journey-based dogfooding report with reproducible findings, screenshots, DOM/console/network evidence, accessibility and responsive checks, and prioritized next actions.",
+        requiredGates: [
+          "brief.context_for_task",
+          "brief.codebase_map",
+          "brief.mission_plan",
+          "browser journey evidence",
+          "brief.save_handoff",
+          "brief.verify_receipts",
+          "brief.save_learning"
+        ],
+        loopIds: [
+          "research",
+          "journey",
+          "browser",
+          "validate",
+          "review",
+          "handoff",
+          "learn"
+        ]
+      },
       {
         id: "performance",
         title: "Performance loop",
@@ -20106,6 +20834,51 @@ var init_missionPlan = __esm({
           "Signal quality improved rather than only coverage count."
         ]
       }),
+      web_dogfood: workPattern({
+        title: "Web app dogfooding pattern",
+        teamValue: "Turns browser exploration into a compact, source-grounded product report: real user journeys, visual and interaction evidence, prioritized friction, and a decision about what to fix next.",
+        goodFirstRun: 'brief.mission_plan({ recipe: "web_dogfood", task: "Dogfood <app URL> through <critical journeys>", autonomy: "read_only" })',
+        recommendedSurfaces: [
+          "Codex in-app browser",
+          "Playwright",
+          "Claude browser tools",
+          "Browser MCP",
+          "Storybook or app preview"
+        ],
+        dataContext: [
+          "critical user journeys",
+          "app URL and environment",
+          "repo code map and route ownership",
+          "design system and product rules",
+          "browser screenshots and DOM snapshots",
+          "console errors and failed network requests",
+          "responsive and accessibility observations",
+          "prior dogfooding feedback and known issues"
+        ],
+        validationBurden: [
+          "Name the journeys, starting state, test account or safe fixture, and stop conditions before interacting.",
+          "Use visible user behavior and stable labels; do not infer success from a click alone.",
+          "Capture before/after or step evidence for each finding: route, action, expected result, actual result, severity, and reproduction.",
+          "Check the critical path at desktop and narrow/mobile widths, including loading, empty, error, success, keyboard/focus, and long-content states when relevant.",
+          "Inspect console errors and failed requests after a broken or suspicious interaction; distinguish product bugs from environment/auth failures.",
+          "Keep the session read-only unless the user explicitly asks for a fix; a follow-up fix loop must cite this report.",
+          "End with the top three fixes, what worked, and one proposed learning for the team."
+        ],
+        humanReviewFocus: [
+          "The journey represents a real user job rather than a tour of every page.",
+          "Findings are reproducible, prioritized by user impact, and backed by visible evidence.",
+          "A confusing flow is separated from a purely visual preference or test-environment limitation.",
+          "The report recommends the smallest next product change and names what should remain unchanged."
+        ],
+        parallelism: {
+          fit: "lead_agent",
+          guidance: [
+            "Keep one lead agent responsible for the journey map, evidence quality, and final prioritization.",
+            "Use a second browser session only for an independent mobile, accessibility, or fresh-user pass.",
+            "Do not split one journey across agents; a single owner should observe the full interaction chain."
+          ]
+        }
+      }),
       performance: workPattern({
         title: "Performance work pattern",
         teamValue: "Requires a baseline, workload, threshold, measured diff, and rollback signal before optimization work expands.",
@@ -20251,7 +21024,7 @@ var init_missionPlan = __esm({
           guidance: [
             "Keep one curator responsible for privacy classification and final library shape.",
             "Use parallel agents only to summarize candidate receipts or draft examples from approved sources.",
-            "Do not publish raw transcripts, secrets, logs, or customer data without explicit approval."
+            "Do not share raw transcripts, secrets, logs, or customer data without explicit approval."
           ]
         }
       }),
@@ -20416,7 +21189,7 @@ function categoryForRecipe(recipeId) {
   if (recipeId === "incident_fix" || recipeId === "bug_investigation" || recipeId === "flaky_test") {
     return "runtime";
   }
-  if (recipeId === "feature" || recipeId === "design_change" || recipeId === "content_change" || recipeId === "qa_edge_cases" || recipeId === "small_refactor" || recipeId === "bugfix") {
+  if (recipeId === "feature" || recipeId === "design_change" || recipeId === "content_change" || recipeId === "web_dogfood" || recipeId === "qa_edge_cases" || recipeId === "small_refactor" || recipeId === "bugfix") {
     return "quality";
   }
   if (recipeId === "internal_app")
@@ -20437,6 +21210,8 @@ function toolForRecipe(recipeId) {
     return "brief.write_ticket";
   if (recipeId === "ticket_fix")
     return "brief.fix_ticket";
+  if (recipeId === "web_dogfood")
+    return "browser + brief.save_handoff";
   if (recipeId === "incident_fix" || recipeId === "flaky_test") {
     return "brief.runtime_fix";
   }
@@ -20527,6 +21302,17 @@ function requiredInputsForRecipe(recipeId) {
       "privacy boundary for source, logs, secrets, and customer data"
     ];
   }
+  if (recipeId === "web_dogfood") {
+    return [
+      "app URL, environment, and safe account or fixture",
+      "two to five critical user journeys",
+      "expected outcome and stop condition for each journey",
+      "desktop and mobile or narrow viewport plan",
+      "accessibility checks for changed interactions",
+      "safe screenshot, DOM, console, and network evidence policy",
+      "known feedback or product principles to test"
+    ];
+  }
   if (recipeId === "incident_fix" || recipeId === "flaky_test" || recipeId === "bug_investigation") {
     return [
       "observed failure source",
@@ -20659,6 +21445,17 @@ function proofBarForRecipe(recipeId) {
       "the new signal is saved as team context for future missions"
     ];
   }
+  if (recipeId === "web_dogfood") {
+    return [
+      "journeys are named before exploration",
+      "each finding has route, steps, expected result, actual result, severity, and evidence",
+      "user-visible behavior is checked before implementation details",
+      "console and failed-request evidence is captured for suspicious states",
+      "desktop/narrow and keyboard/focus checks cover the critical path",
+      "environment/auth failures are separated from product defects",
+      "top fixes, what worked, and a team-learning candidate are prioritized"
+    ];
+  }
   if (recipeId === "incident_fix" || recipeId === "bug_investigation") {
     return [
       "observed facts",
@@ -20758,7 +21555,7 @@ function privacyBoundaryForRecipe(recipeId) {
   if (recipeId === "security_finding") {
     return [
       "redact raw secrets, tokens, cookies, customer payloads, and private logs before agent use",
-      "do not publish exploit strings or abuse-case details outside the approved repo/security channel",
+      "do not share exploit strings or abuse-case details outside the approved repo/security channel",
       "provider rotation or invalidation status is tracked without exposing the replacement credential",
       "false-positive and accepted-risk decisions need named owner approval and audit trail"
     ];
@@ -20771,6 +21568,14 @@ function privacyBoundaryForRecipe(recipeId) {
       "keep scanner findings and test fixtures free of real credentials and production payloads"
     ];
   }
+  if (recipeId === "web_dogfood") {
+    return [
+      "use safe fixtures and redact customer data, tokens, cookies, and private URLs",
+      "do not upload screenshots, DOM, console, or network payloads unless the workspace allows it",
+      "prefer derived evidence such as route, action, status, error class, and screenshot reference",
+      "never submit external side effects, purchases, destructive actions, or production writes without explicit approval"
+    ];
+  }
   if (recipeId === "incident_fix" || recipeId === "flaky_test" || recipeId === "bug_investigation") {
     return [
       "summarize raw logs into observed facts first",
@@ -20789,7 +21594,7 @@ function privacyBoundaryForRecipe(recipeId) {
     return [
       "derive examples from receipts before raw transcripts",
       "require approval for prompts, logs, secrets, or customer data",
-      "publish concise run cards, not private session dumps"
+      "share concise run cards, not private session dumps"
     ];
   }
   return [
@@ -20822,6 +21627,9 @@ function teamOutcomeForRecipe(recipeId) {
   if (recipeId === "security_testing") {
     return "Teams can add security tests and scanning gates that are useful enough to trust and calibrated enough not to slow every developer down.";
   }
+  if (recipeId === "web_dogfood") {
+    return "Teams get a repeatable user-centered browser pass that finds confusing flows, broken states, accessibility gaps, and product friction before customers do, with evidence a coding agent can act on.";
+  }
   if (recipeId === "flaky_test") {
     return "Teams reduce CI noise without normalizing muted, skipped, or blindly retried failures.";
   }
@@ -20862,6 +21670,9 @@ function firstRunPrompts(items) {
     if (item.recipeId === "security_testing") {
       return 'Call brief.mission_plan with recipe "security_testing" for the security test, scanner, dependency-review, or CI gate you want to add.';
     }
+    if (item.recipeId === "web_dogfood") {
+      return 'Call brief.mission_plan with recipe "web_dogfood" for: <app URL and critical user journeys>.';
+    }
     return `Call brief.mission_plan with recipe "${item.recipeId}" for: <describe the work>.`;
   });
 }
@@ -20919,7 +21730,7 @@ function querySynonyms(term) {
     return ["mcp", "client", "surface", "terminal", "ide"];
   }
   if (term === "dogfood" || term === "dogfooding") {
-    return ["first", "receipt", "review"];
+    return ["web", "browser", "journey", "receipt", "review"];
   }
   if (term === "codex")
     return ["codex", "terminal", "mcp"];
@@ -20963,6 +21774,9 @@ function queryScore(item, terms) {
   if (termSet.has("quality") && (item.category === "quality" || item.recipeId === "pr_review")) {
     score += 4;
   }
+  if ((termSet.has("quality") || termSet.has("review")) && item.recipeId === "pr_review") {
+    score += 8;
+  }
   if (termSet.has("product") && item.recipeId === "feature") {
     score += 4;
   }
@@ -20981,8 +21795,8 @@ function queryScore(item, terms) {
   if ((termSet.has("scanner") || termSet.has("scanning") || termSet.has("gate") || termSet.has("tests")) && item.recipeId === "security_testing") {
     score += 7;
   }
-  if (termSet.has("dogfood") && ["pr_review", "session_library", "small_refactor"].includes(item.recipeId)) {
-    score += 2;
+  if (termSet.has("dogfood") && item.recipeId === "web_dogfood") {
+    score += 12;
   }
   if (termSet.has("tdd") && ["feature", "bugfix", "flaky_test", "dependency"].includes(item.recipeId)) {
     score += 4;
@@ -21054,6 +21868,7 @@ var init_agentLoopCatalog = __esm({
       "security_testing",
       "flaky_test",
       "bug_investigation",
+      "web_dogfood",
       "stale_pr",
       "internal_app",
       "pr_review",
@@ -24223,6 +25038,8 @@ function runCardTitle(recipeId) {
       return "Repeat bug investigation loop";
     case "qa_edge_cases":
       return "Repeat QA edge-case loop";
+    case "web_dogfood":
+      return "Repeat web app dogfooding loop";
     case "performance":
       return "Repeat performance loop";
     case "porting":
@@ -24271,6 +25088,8 @@ function runCardUseWhen(recipeId) {
       return "Use when a hard, rare, intermittent, or previously failed bug needs hypotheses, evidence, validation, and a watch signal.";
     case "qa_edge_cases":
       return "Use when important code paths need missing edge cases, fuzz/stress coverage, or stronger behavior tests.";
+    case "web_dogfood":
+      return "Use when a real user journey through a local or deployed web app needs evidence-backed product feedback.";
     case "performance":
       return "Use when latency, throughput, memory, CPU, or benchmark work needs a baseline before code changes.";
     case "porting":
@@ -24386,6 +25205,16 @@ function runCardSteps(recipeId) {
       "decision"
     ];
   }
+  if (recipeId === "web_dogfood") {
+    return [
+      "journeys",
+      "starting state",
+      "browser pass",
+      "evidence",
+      "prioritized findings",
+      "decision"
+    ];
+  }
   if (recipeId === "session_review") {
     return [
       "receipts",
@@ -24504,6 +25333,9 @@ function runCardStopConditions(recipeId) {
   if (recipeId === "experiment") {
     stops.unshift("Success signal, throwaway boundary, discard path, or decision owner is missing.");
   }
+  if (recipeId === "web_dogfood") {
+    stops.unshift("The journey, starting state, expected outcome, or evidence policy is missing.", "The agent is treating a click, route change, or visual preference as proof of success without checking user-visible outcome.", "A screenshot, DOM snapshot, console error, network failure, or auth/environment limitation is being shared without redaction or classification.");
+  }
   if (recipeId === "session_review") {
     return [
       "Raw prompt transcripts, secrets, customer data, or private logs are required without explicit approval.",
@@ -24597,6 +25429,9 @@ function inferLoopId2(task) {
   if (/\b(edge cases?|missing tests?|test gaps?|coverage gaps?|property[- ]based|qa|quality pass|corner cases?)\b/.test(normalized)) {
     return "qa_edge_cases";
   }
+  if (/\b(dogfood|dogfooding|exploratory browser|web app smoke|browser smoke|product safari|try the app|use the app)\b/.test(normalized) && /\b(app|site|web|browser|page|screen|flow|journey|ui|ux|localhost|staging|production)\b/.test(normalized)) {
+    return "web_dogfood";
+  }
   if (/\b(performance|latency|throughput|benchmark|slow|speed|optimi[sz]e|profile|memory|cpu)\b/.test(normalized)) {
     return "performance";
   }
@@ -25264,6 +26099,7 @@ function autoEngageInstruction(scan, skillLearning) {
     "- Read `brief.next.beforeYouCode.compactText` or `brief.start.beforeYouCode.compactText` before the first edit. Cite its target repo, branch, inspect-first files, reuse decision, likely tests, and stop signals in your working notes.",
     "- For micro or small cockpit passes, keep Brief lightweight: inspect, reuse or rule out the top candidate, validate narrowly, and skip mission_plan/save_handoff/verify_receipts unless scope grows.",
     "- For product, design, content, workflow, compliance, internal-app, or wiki work, read `beforeYouCode.productOperatingContext.compactText` or call `brief.product_context` before editing. Reuse or rule out listed patterns, then preserve its journey, terminology, CTA, state-machine, and acceptance checks.",
+    "- When the task asks about users, JTBD, competitors, market alternatives, product taste, microcopy, integrations, or current external behavior, call `brief.product_research_plan` automatically. Use the host's approved web/browser tools for current public evidence, then call `brief.save_product_context` with cited proposed facts; never turn search snippets or competitor claims into defaults without review.",
     "- If the user gives a Linear, Jira, GitHub, Sentry, Datadog, CI, log, trace, or pasted issue reference, pass that exact reference into `brief.start` instead of inventing a separate plan.",
     "- Before creating a new helper, component, route, workflow, template, design pattern, command, or skill, call `brief.reference_implementations` and `brief.codebase_map` to look for reuse first.",
     "- When scope, files, risk, or validation changes mid-task, refresh with `brief.context_for_task`, `brief.rules_for_files`, `brief.codebase_map`, `brief.find_tests`, or `brief.review_memory` before continuing.",
@@ -25347,6 +26183,14 @@ function autoEngageTriggers() {
       agentBehavior: "Look for existing primitives and saved references before adding another implementation.",
       proof: "The final update names reused candidates or explains why new code was justified."
     },
+    {
+      id: "product_research",
+      label: "Product research",
+      when: "The task asks about users, JTBD, competitors, market alternatives, product taste, microcopy, integrations, or current external behavior.",
+      briefCalls: ["brief.product_research_plan", "brief.save_product_context"],
+      agentBehavior: "Create a focused research plan, use the host's approved public research tools, and save only cited proposed facts with an implication for the product. Keep direct user evidence, repo evidence, and market evidence distinct.",
+      proof: "The task includes a research question, source URLs or repo paths, access dates, confidence, proposed/approved status, and open questions when evidence conflicts."
+    },
     {
       id: "scope_change",
       label: "Scope changes",
@@ -26079,7 +26923,7 @@ function consoleLoopContract(scan) {
     `Use this when the current console cannot call MCP tools directly for ${scan.repoName}.`,
     "",
     "1. Ask the operator for a Brief context packet or to run `brief.context_for_task` for the task.",
-    "2. State the mission recipe you are following: feature, design_change, content_change, bugfix, ticket_write, ticket_fix, incident_fix, internal_app, stale_pr, merge_conflict, flaky_test, small_refactor, bug_investigation, qa_edge_cases, performance, porting, experiment, pr_review, session_review, session_library, research, docs_wiki, or dependency.",
+    "2. State the mission recipe you are following: feature, design_change, content_change, bugfix, ticket_write, ticket_fix, incident_fix, internal_app, stale_pr, merge_conflict, flaky_test, small_refactor, bug_investigation, qa_edge_cases, web_dogfood, performance, porting, experiment, pr_review, session_review, session_library, research, docs_wiki, or dependency.",
     "3. Keep scope bounded to the cited files, owners, rules, tests, and wiki pages.",
     "4. Before suggesting handoff, list the validation commands to run and what each proves.",
     "5. Ask for `brief.review_diff`, `brief.save_handoff`, and `brief.verify_receipts` from an MCP-capable surface before PR review.",
@@ -26121,11 +26965,12 @@ function firstRunPromptsFor(label, scan) {
     "Ask the agent: Save one proven implementation reference with brief.save_reference, then list it with brief.reference_implementations.",
     "Ask the agent: Call brief.agent_pack_inventory and summarize skills, commands, hooks, MCP configs, host configs, installers, and high-risk trust boundaries.",
     "Ask the agent: Call brief.agent_pack_adoption_plan before importing a skill, command, or prompt pack.",
+    'For web app dogfooding: Call brief.mission_plan with recipe "web_dogfood", name 2-5 critical journeys and a safe starting state, then use the available browser and hand back the top fixes with evidence.',
     "For UI work: Call brief.design_system_map and use the team's templates, tokens, components, setup rules, and design_adherence gate.",
     "For a ticket: Call brief.fix_ticket with the work item, optional runtime evidence, and autonomy validate.",
     "For a runtime signal: Call brief.runtime_fix with the Sentry issue, Datadog trace, CI failure, log query, or incident id.",
     'For an internal analytics app: Call brief.mission_plan with recipe "internal_app", then follow the returned auth/data/access-control gates.',
-    'For maintenance work: Call brief.mission_plan with recipe "stale_pr", "merge_conflict", "flaky_test", "small_refactor", "bug_investigation", "qa_edge_cases", "performance", "porting", or "experiment" before editing.',
+    'For maintenance work: Call brief.mission_plan with recipe "stale_pr", "merge_conflict", "flaky_test", "small_refactor", "bug_investigation", "qa_edge_cases", "web_dogfood", "performance", "porting", or "experiment" before editing.',
     "Before handoff: Call brief.review_diff, brief.save_handoff, and brief.verify_receipts so the final update includes review, proof bundle, and ledger status."
   ];
 }
@@ -26135,7 +26980,7 @@ function mcpJsonSnippet(installMode, briefSourceRoot, repoRoot) {
     args: ["-lc", localSourceMcpCommand(briefSourceRoot, repoRoot)]
   } : {
     command: "npx",
-    args: ["-y", briefPublishedPackageSpec]
+    args: ["-y", briefPublishedPackageInstallSpec]
   };
   const env = {
     BRIEF_REPO_ROOT: repoRoot ?? "${workspaceFolder}",
@@ -26202,7 +27047,7 @@ function rolloutStepsFor(readiness) {
     "Promote the repo once rules, tests, owners, and memories are discoverable."
   ];
 }
-var ALL_TARGETS, briefPublishedPackageSpec, TARGET_LABELS, INSTALL_COMMANDS, CONNECTOR_DESTINATIONS;
+var ALL_TARGETS, briefPublishedPackageVersion, briefPublishedPackageSpec, briefPublishedPackageInstallSpec, TARGET_LABELS, INSTALL_COMMANDS, CONNECTOR_DESTINATIONS;
 var init_agentSetup = __esm({
   "../core/dist/agentSetup.js"() {
     "use strict";
@@ -26220,7 +27065,9 @@ var init_agentSetup = __esm({
       "ide",
       "generic"
     ];
-    briefPublishedPackageSpec = "runbrief@0.1.2";
+    briefPublishedPackageVersion = "0.1.4";
+    briefPublishedPackageSpec = `runbrief@${briefPublishedPackageVersion}`;
+    briefPublishedPackageInstallSpec = `runbrief@^${briefPublishedPackageVersion}`;
     TARGET_LABELS = {
       terminal: "Terminal agent",
       vscode: "VS Code",
@@ -26233,15 +27080,15 @@ var init_agentSetup = __esm({
       generic: "Any MCP client"
     };
     INSTALL_COMMANDS = {
-      terminal: `npx -y ${briefPublishedPackageSpec}`,
-      vscode: `npx -y ${briefPublishedPackageSpec}`,
-      claude: `claude mcp add --transport stdio --scope user brief -- npx -y ${briefPublishedPackageSpec}`,
+      terminal: `npx -y ${briefPublishedPackageInstallSpec}`,
+      vscode: `npx -y ${briefPublishedPackageInstallSpec}`,
+      claude: `claude mcp add --transport stdio --scope user brief -- npx -y ${briefPublishedPackageInstallSpec}`,
       claude_console: "Paste the mission_plan loop recipe when direct MCP tools are unavailable.",
-      codex: `codex mcp add brief -- npx -y ${briefPublishedPackageSpec}`,
-      cursor: `npx -y ${briefPublishedPackageSpec}`,
+      codex: `codex mcp add brief -- npx -y ${briefPublishedPackageInstallSpec}`,
+      cursor: `npx -y ${briefPublishedPackageInstallSpec}`,
       cursor_console: "Paste the mission_plan loop recipe when direct MCP tools are unavailable.",
-      ide: `npx -y ${briefPublishedPackageSpec}`,
-      generic: `npx -y ${briefPublishedPackageSpec}`
+      ide: `npx -y ${briefPublishedPackageInstallSpec}`,
+      generic: `npx -y ${briefPublishedPackageInstallSpec}`
     };
     CONNECTOR_DESTINATIONS = {
       terminal: "Repo shell MCP server env",
@@ -26511,6 +27358,9 @@ function recipeForIntent(kind, request, explicitRecipe, runtimeEvidence) {
     return /\b(bug|broken|fix|incorrect|wrong)\b/i.test(request) ? "bugfix" : "feature";
   }
   const lower = request.toLowerCase();
+  if (/\b(dogfood|dogfooding|exploratory browser|web app smoke|browser smoke|product safari|try the app|use the app)\b/.test(lower) && /\b(app|site|web|browser|page|screen|flow|journey|ui|ux|localhost|staging|production)\b/.test(lower)) {
+    return "web_dogfood";
+  }
   if (isDesignLedChange(lower)) {
     return "design_change";
   }
@@ -26547,7 +27397,7 @@ function isProductJourneyAudit(request) {
   return /\b(audit|assess|evaluate|inspect|study)\b/.test(request) && /\b(app|experience|flow|journey|launch readiness|onboarding|product|self[- ]serve|workspace)\b/.test(request);
 }
 function autonomyForIntent(kind, recipe) {
-  if (kind === "context_for_task" || kind === "write_ticket" || recipe === "research") {
+  if (kind === "context_for_task" || kind === "write_ticket" || recipe === "research" || recipe === "web_dogfood") {
     return "read_only";
   }
   return "validate";
@@ -27208,6 +28058,9 @@ function summaryForIntent(kind, recipe, workItem, runtimeEvidence) {
     return "Brief inferred a compact pre-PR readiness pass.";
   if (kind === "context_for_task")
     return "Brief inferred a context-only preflight.";
+  if (recipe === "web_dogfood") {
+    return "Brief inferred a read-only browser dogfooding loop: exercise journeys, capture evidence, and rank the top user-impact fixes.";
+  }
   return `Brief inferred a ${recipe ?? "mission"} loop.`;
 }
 function reasonForIntent(kind, request, workItem, runtimeEvidence) {
@@ -27281,7 +28134,7 @@ function summarizeBeforeYouCodeSharedContext(delivery) {
       next: "Shared guidance is not available in this session; keep new learning personal until the workspace connection is ready."
     };
   }
-  const next = delivery.status === "applied" ? "Use the applied shared guidance, then save a focused learning or reference when the pass proves a reusable pattern." : delivery.status === "available_not_applied" ? "Shared guidance exists but did not match this task; inspect the relevant team item before creating a new pattern." : "No approved shared guidance exists yet; keep this pass personal and publish only after the pattern is proven.";
+  const next = delivery.status === "applied" ? "Use the applied shared guidance, then save a focused learning or reference when the pass proves a reusable pattern." : delivery.status === "available_not_applied" ? "Shared guidance exists but did not match this task; inspect the relevant team item before creating a new pattern." : "No approved shared guidance exists yet; keep this pass personal and make it available to the team only after the pattern is proven.";
   return {
     status: delivery.status,
     workspaceId: delivery.workspaceId,
@@ -27424,11 +28277,13 @@ function buildBeforeYouCodeMap(scan, input) {
     files,
     maxLines: 18
   });
+  const mapCoverage = mapCoverageFor2(scan);
   const stopSignals2 = unique([
     "Wrong repo, branch, or worktree.",
     ...target.branch?.startsWith("detached@") ? ["Detached HEAD; select the intended feature branch before editing."] : [],
     ...insights.agentPacket.stopSignals,
     ...productOperatingContext.stopSignals.slice(0, 3),
+    ...mapCoverage.status === "partial" ? [mapCoverage.summary] : [],
     ...target.dirty && files.length === 0 ? ["Dirty worktree is broad; classify baseline before editing."] : []
   ]).slice(0, 5);
   const status = inspectFirst.length === 0 && reuseCandidates.length === 0 ? "needs_narrower_scope" : "ready";
@@ -27448,6 +28303,7 @@ function buildBeforeYouCodeMap(scan, input) {
     reuseCandidates,
     likelyTests,
     productOperatingContext,
+    mapCoverage,
     ...context.teamGuidance ? { teamGuidance: context.teamGuidance } : {},
     referenceFirst,
     validationChecklist,
@@ -27460,6 +28316,7 @@ function buildBeforeYouCodeMap(scan, input) {
     reuseCandidates,
     likelyTests,
     productOperatingContext,
+    mapCoverage,
     validationChecklist,
     stopSignals: stopSignals2,
     ...context.teamGuidance ? { teamGuidance: context.teamGuidance } : {},
@@ -27479,7 +28336,9 @@ function buildBeforeYouCodeMap(scan, input) {
       candidates: reuseCandidates,
       decision: reuseCandidates.length > 0 ? "For each candidate, choose reuse, adapt, or rule out and record the decision before creating a new primitive." : "No reuse candidate is grounded yet; run one focused search before creating a new primitive."
     },
+    mapCoverage,
     ...context.teamGuidance ? { teamGuidance: context.teamGuidance } : {},
+    rules: context.rules.slice(0, 8),
     referenceFirst,
     likelyTests,
     exactTests,
@@ -27491,6 +28350,19 @@ function buildBeforeYouCodeMap(scan, input) {
     next: status === "ready" ? "Inspect these files and reuse candidates before editing; cite the reuse decision in the final handoff." : "Run brief.codebase_map or brief.context_for_task with a narrower task, folder, or file list before editing."
   };
 }
+function mapCoverageFor2(scan) {
+  const mappedNodes = scan.stats.mapNodeCount;
+  const omittedNodes = Math.max(0, scan.stats.mapOmittedCount ?? 0);
+  const candidateNodes = Math.max(mappedNodes, scan.stats.mapTotalCandidateCount ?? mappedNodes + omittedNodes);
+  const partial = Boolean(scan.stats.mapPartial) || omittedNodes > 0;
+  return {
+    status: partial ? "partial" : "complete",
+    mappedNodes,
+    candidateNodes,
+    omittedNodes,
+    summary: partial ? `Code map is partial: ${mappedNodes} of ${candidateNodes} candidate nodes are available; narrow by feature, folder, or symbol before treating a missing reuse candidate as proof none exists.` : `Code map covers all ${mappedNodes} indexed candidate nodes for this repo.`
+  };
+}
 function reuseStatusFor(candidates) {
   if (candidates.length === 0)
     return "missing";
@@ -27611,6 +28483,7 @@ function cockpitFor(input) {
     "Broad e2e or full-suite tests unless routing, auth, persistence, or cross-page state changed."
   ];
   const stopSignals2 = unique([
+    ...input.mapCoverage.status === "partial" ? [input.mapCoverage.summary] : [],
     ...input.stopSignals.slice(0, 3),
     ...mode === "lightweight" ? [
       "The tiny pass starts touching behavior, state, data, auth, or multiple surfaces."
@@ -27798,55 +28671,55 @@ function diversifyJourneyStages(ranked, task) {
   ];
 }
 function journeyStagePathPreference(stage, filePath) {
-  const path20 = filePath.toLowerCase();
+  const path21 = filePath.toLowerCase();
   if (stage === "acquisition") {
-    if (/landinginteractive\.[cm]?[tj]sx?$/.test(path20))
+    if (/landinginteractive\.[cm]?[tj]sx?$/.test(path21))
       return 40;
-    if (/apps\/web\/src\/app\/page\.[cm]?[tj]sx?$/.test(path20))
+    if (/apps\/web\/src\/app\/page\.[cm]?[tj]sx?$/.test(path21))
       return 35;
   }
   if (stage === "access") {
-    if (/apps\/web\/src\/app\/login\/page\.[cm]?[tj]sx?$/.test(path20))
+    if (/apps\/web\/src\/app\/login\/page\.[cm]?[tj]sx?$/.test(path21))
       return 40;
-    if (/api\/auth\/magic-link\/route\.[cm]?[tj]s$/.test(path20))
+    if (/api\/auth\/magic-link\/route\.[cm]?[tj]s$/.test(path21))
       return 35;
   }
   if (stage === "workspace") {
-    if (/api\/v1\/workspaces\/bootstrap\/route\.[cm]?[tj]s$/.test(path20)) {
+    if (/api\/v1\/workspaces\/bootstrap\/route\.[cm]?[tj]s$/.test(path21)) {
       return 40;
     }
   }
   if (stage === "activation") {
-    if (/api\/v1\/workspaces\/[^/]+\/api-keys\/route\.[cm]?[tj]s$/.test(path20)) {
+    if (/api\/v1\/workspaces\/[^/]+\/api-keys\/route\.[cm]?[tj]s$/.test(path21)) {
       return 40;
     }
-    if (/workspace-agent-actions\.[cm]?[tj]s$/.test(path20))
+    if (/workspace-agent-actions\.[cm]?[tj]s$/.test(path21))
       return 35;
-    if (/agent-handoff-composer\.[cm]?[tj]s$/.test(path20))
+    if (/agent-handoff-composer\.[cm]?[tj]s$/.test(path21))
       return 30;
   }
   if (stage === "collaboration") {
-    if (/api\/v1\/workspaces\/[^/]+\/invitations\/route\.[cm]?[tj]s$/.test(path20)) {
+    if (/api\/v1\/workspaces\/[^/]+\/invitations\/route\.[cm]?[tj]s$/.test(path21)) {
       return 40;
     }
-    if (/api\/v1\/workspaces\/[^/]+\/members\/[^/]+\/route/.test(path20)) {
+    if (/api\/v1\/workspaces\/[^/]+\/members\/[^/]+\/route/.test(path21)) {
       return 30;
     }
   }
   if (stage === "monetization") {
-    if (/billing\/checkout\/route\.[cm]?[tj]s$/.test(path20))
+    if (/billing\/checkout\/route\.[cm]?[tj]s$/.test(path21))
       return 40;
-    if (/pricing\/page\.[cm]?[tj]sx?$/.test(path20))
+    if (/pricing\/page\.[cm]?[tj]sx?$/.test(path21))
       return 35;
   }
   return 0;
 }
-function beforeYouCodePathIntentScore(path20, task) {
-  const lowerPath = (path20.split("#", 1)[0] ?? path20).toLowerCase();
+function beforeYouCodePathIntentScore(path21, task) {
+  const lowerPath = (path21.split("#", 1)[0] ?? path21).toLowerCase();
   const lowerTask = task.toLowerCase();
-  let score = namedCodePathIntentScore(path20, task);
+  let score = namedCodePathIntentScore(path21, task);
   const wantsInterface = /\b(app|design|header|interface|landing|layout|mobile|navigation|page|responsive|spacing|ui|ux|visual|workspace)\b/.test(lowerTask);
-  score += lexicalPathTaskScore(path20, task);
+  score += lexicalPathTaskScore(path21, task);
   const wantsLanding = /\b(hero|homepage|landing)\b/.test(lowerTask);
   const wantsAppShell = /\b(app|header|internal|mobile|navigation|responsive|sidebar|workspace)\b/.test(lowerTask);
   const wantsAuth = /\b(auth|authentication|callback|login|magic link|otp|session|sign[ -]?in|sign[ -]?out)\b/.test(lowerTask);
@@ -27996,8 +28869,8 @@ function beforeYouCodePathIntentScore(path20, task) {
   }
   return score;
 }
-function beforeYouCodeIntentSummary(path20, task) {
-  const normalizedPath = (path20.split("#", 1)[0] ?? path20).toLowerCase();
+function beforeYouCodeIntentSummary(path21, task) {
+  const normalizedPath = (path21.split("#", 1)[0] ?? path21).toLowerCase();
   if (!isInternalAppTask(task))
     return void 0;
   if (/apps\/web\/src\/app\/app\/page\.[cm]?[tj]sx?$/.test(normalizedPath)) {
@@ -28023,7 +28896,7 @@ function prefersPrimaryWorkspaceTask(task) {
     return true;
   return /\b(design|designer|figma|screenshot|visual|ui|ux|layout|spacing|typography|responsive|mobile)\b/i.test(task);
 }
-function lexicalPathTaskScore(path20, task) {
+function lexicalPathTaskScore(path21, task) {
   const ignored = /* @__PURE__ */ new Set([
     "agent",
     "brief",
@@ -28043,7 +28916,7 @@ function lexicalPathTaskScore(path20, task) {
     taskWords.add("workspace");
     taskWords.add("pane");
   }
-  const pathWords = path20.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 4 && !ignored.has(word));
+  const pathWords = path21.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 4 && !ignored.has(word));
   const matches = unique(pathWords.filter((word) => taskWords.has(word)));
   const structuralBonus = matches.reduce((score, word) => {
     if (!["header", "pane", "shell", "sidebar", "workspace"].includes(word)) {
@@ -28117,6 +28990,7 @@ function compactTextFor2(input) {
     `Before coding: ${input.headline}`,
     `Target: ${input.target.repoName} | ${input.target.branch ?? "branch unknown"} | ${input.target.repoRoot}`,
     `Worktree: ${input.target.dirty ? "dirty" : "clean"}${input.target.changedFiles.length ? `; changed ${input.target.changedFiles.slice(0, 4).join(", ")}` : ""}${input.target.untrackedFiles.length ? `; untracked ${input.target.untrackedFiles.slice(0, 3).join(", ")}` : ""}`,
+    `Map coverage: ${input.mapCoverage.summary}`,
     ...input.target.requestedFiles.length ? [`Scope files: ${input.target.requestedFiles.slice(0, 5).join(", ")}`] : [],
     ...input.teamGuidance ? [
       `Shared guidance: ${input.teamGuidance.applied.length > 0 ? input.teamGuidance.applied.slice(0, 2).map((item) => item.label).join(", ") : input.teamGuidance.status === "available_not_applied" ? "available, but none matched this task" : "none approved yet"}`
@@ -28167,16 +29041,20 @@ var init_agentBeforeYouCode = __esm({
 // ../core/dist/agentWorkPacket.js
 function buildAgentWorkPacket(input) {
   const before = input.beforeYouCode;
-  const rules = [
+  const rules = uniqueRules2([
     ...(before.teamGuidance?.applied ?? []).map((item) => ({
       rule: item.label,
       source: `team:${item.kind}`
     })),
+    ...(before.rules ?? []).map((item) => ({
+      rule: compact(item.body || item.title, 180),
+      source: item.sourcePaths[0] ?? "repo guidance"
+    })),
     ...before.productOperatingContext.productRules.map((item) => ({
       rule: item.rule,
       source: item.source
     }))
-  ].slice(0, 3);
+  ]).slice(0, 3);
   const tests = before.exactTests.length > 0 ? before.exactTests.slice(0, 3).map((test) => ({
     command: compact(test.command, 180),
     reason: compact(test.reason, 180),
@@ -28192,7 +29070,8 @@ function buildAgentWorkPacket(input) {
   ]).slice(0, 3);
   const stopConditions = unique2([
     ...before.stopSignals,
-    ...before.productOperatingContext.stopSignals
+    ...before.productOperatingContext.stopSignals,
+    ...before.mapCoverage.status === "partial" ? [before.mapCoverage.summary] : []
   ]).slice(0, 3);
   const nextAction = input.nextAction ?? before.next ?? "Inspect the listed files and make the reuse decision before editing.";
   const packet = {
@@ -28220,6 +29099,7 @@ function buildAgentWorkPacket(input) {
         why: compact(item.why, 140)
       }))
     },
+    mapCoverage: before.mapCoverage,
     rules,
     tests,
     acceptance,
@@ -28236,6 +29116,7 @@ function formatAgentWorkPacket(packet) {
     `Interpretation: ${packet.interpretation}`,
     `Inspect first: ${inlineList(packet.inspectFirst.map((item) => `${item.path} - ${item.why}`))}`,
     `Reuse (${packet.reuse.status}): ${packet.reuse.decision}; ${inlineList(packet.reuse.candidates.map((item) => `${item.path} - ${item.action}`))}`,
+    `Map: ${packet.mapCoverage.summary}`,
     `Rules: ${inlineList(packet.rules.map((item) => `${item.rule} [${item.source}]`))}`,
     `Focused tests: ${inlineList(packet.tests.map((item) => `${item.command} - ${item.reason}`))}`,
     `Acceptance: ${inlineList(packet.acceptance)}`,
@@ -28254,6 +29135,16 @@ function compact(value, maxLength) {
 function unique2(values) {
   return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
 }
+function uniqueRules2(rules) {
+  const seen = /* @__PURE__ */ new Set();
+  return rules.filter((item) => {
+    const key = item.rule.toLowerCase();
+    if (!item.rule || seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
 var init_agentWorkPacket = __esm({
   "../core/dist/agentWorkPacket.js"() {
     "use strict";
@@ -28469,7 +29360,7 @@ var init_governance = __esm({
 // ../core/dist/hookSetup.js
 function generateHookSetup(input = {}) {
   const mode = input.mode ?? "advisory";
-  const packageCommand = input.packageCommand ?? `npx -y ${briefPublishedPackageSpec}`;
+  const packageCommand = input.packageCommand ?? `npx -y ${briefPublishedPackageInstallSpec}`;
   const failOn = mode === "blocking" ? "high" : "blocker";
   return {
     mode,
@@ -31192,6 +32083,7 @@ var init_diffReview = __esm({
       "handler",
       "helpers",
       "delete",
+      "dynamic",
       "get",
       "head",
       "input",
@@ -33076,6 +33968,7 @@ var init_dist2 = __esm({
     init_agentBeforeYouCode();
     init_agentWorkPacket();
     init_productOperatingContext();
+    init_productIntelligence();
     init_ticketMissionRuntime();
     init_governance();
     init_hookSetup();
@@ -33102,7 +33995,7 @@ function cloudSyncStatus(env = process.env) {
     return {
       configured: false,
       privacyMode,
-      reason: privacyMode === "local-only" ? "Cloud sync is disabled by privacy mode." : "Set BRIEF_API_URL and BRIEF_API_KEY to enable MCP cloud sync."
+      reason: privacyMode === "local-only" ? "Cloud sync is disabled by privacy mode." : "Connect Brief from the app to authorize this device, or provide BRIEF_API_URL and BRIEF_API_KEY for an approved legacy setup."
     };
   }
   const status = {
@@ -33259,6 +34152,64 @@ async function fetchTeamContext(repoRoot, env = process.env, fetcher = fetch) {
   });
   return getTeamContextCloud(config, payload, fetcher);
 }
+async function claimRemoteLoopRun(runnerId, leaseSeconds = 180, env = process.env, fetcher = fetch) {
+  const config = cloudConfigFromEnv(env);
+  if (!config) throw new Error("Brief cloud connection is not configured for the runner.");
+  const payload = claimLoopRunRequestSchema.parse({ runnerId, leaseSeconds });
+  const body = await loopRunRequest(
+    config,
+    "/api/v1/mcp/loop-runs/claim",
+    "POST",
+    payload,
+    fetcher
+  );
+  if (!body.ok) throw new Error(body.message ?? "Brief could not claim a loop run.");
+  if (!body.run) return null;
+  const parsed = loopRunSummarySchema.safeParse(body.run);
+  if (!parsed.success) throw new Error("Brief returned an invalid loop run.");
+  return parsed.data;
+}
+async function updateRemoteLoopRun(runId, input, env = process.env, fetcher = fetch) {
+  const config = cloudConfigFromEnv(env);
+  if (!config) throw new Error("Brief cloud connection is not configured for the runner.");
+  const payload = updateLoopRunRequestSchema.parse(input);
+  const body = await loopRunRequest(
+    config,
+    `/api/v1/mcp/loop-runs/${encodeURIComponent(runId)}`,
+    "PATCH",
+    payload,
+    fetcher
+  );
+  if (!body.ok) throw new Error(body.message ?? "Brief could not update the loop run.");
+  const parsed = loopRunSummarySchema.safeParse(body.run);
+  if (!parsed.success) throw new Error("Brief returned an invalid updated loop run.");
+  return parsed.data;
+}
+async function loopRunRequest(config, route, method, payload, fetcher) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), syncTimeoutMs);
+  try {
+    const response = await fetcher(`${config.apiUrl}${route}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${config.apiKey}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal
+    });
+    const body = await safeJson(response);
+    const record = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+    const result = {
+      ok: response.ok && record.ok === true
+    };
+    if (typeof record.message === "string") result.message = record.message;
+    if (record.run !== void 0) result.run = record.run;
+    return result;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 function toRepoScanSummary(scan, privacyMode) {
   return {
     repoName: scan.repoName,
@@ -33304,7 +34255,7 @@ function skippedResult(env) {
   return {
     status: "skipped",
     privacyMode,
-    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because BRIEF_API_URL or BRIEF_API_KEY is missing."
+    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because this device is not connected. Create a browser-authorized connection from the Brief app, then restart the agent."
   };
 }
 function skippedTeamContextResult(env) {
@@ -33312,7 +34263,7 @@ function skippedTeamContextResult(env) {
   return {
     status: "skipped",
     privacyMode,
-    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because BRIEF_API_URL or BRIEF_API_KEY is missing."
+    reason: privacyMode === "local-only" ? "Cloud sync skipped because privacy mode is local-only." : "Cloud sync skipped because this device is not connected. Create a browser-authorized connection from the Brief app, then restart the agent."
   };
 }
 function normalizeApiUrl(apiUrl) {
@@ -33736,9 +34687,9 @@ function issuesValue(value) {
     if (typeof item === "string") return item;
     if (!item || typeof item !== "object") return "";
     const record = item;
-    const path20 = Array.isArray(record.path) ? record.path.join(".") : "";
+    const path21 = Array.isArray(record.path) ? record.path.join(".") : "";
     const message = stringValue(record.message);
-    return [path20, message].filter(Boolean).join(": ");
+    return [path21, message].filter(Boolean).join(": ");
   }).filter(Boolean).slice(0, 5).join("; ");
 }
 var syncTimeoutMs, canonicalBriefApiUrl, legacyBriefApiUrls;
@@ -34129,14 +35080,178 @@ var init_missionInputOptions = __esm({
   }
 });
 
-// ../mcp/src/workspace.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
+// ../mcp/src/cloudCredentials.ts
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import os from "node:os";
 import path14 from "node:path";
+async function bootstrapCloudCredentials(env = process.env) {
+  if (env.BRIEF_PRIVACY_MODE === "local-only") {
+    return { status: "skipped", reason: "local_only" };
+  }
+  if (env.BRIEF_API_URL && env.BRIEF_API_KEY) {
+    return { status: "configured", source: "env" };
+  }
+  const credentialPath = credentialsPath(env);
+  const requestedOrigin = originFrom(
+    env.BRIEF_API_URL ?? env.BRIEF_CONNECT_URL
+  );
+  const requestedWorkspace = env.BRIEF_WORKSPACE_ID?.trim();
+  const stored = readCredentialFile(credentialPath);
+  const existing = stored.credentials.find((credential2) => {
+    if (requestedOrigin && originFrom(credential2.apiUrl) !== requestedOrigin) {
+      return false;
+    }
+    return !requestedWorkspace || credential2.workspaceId === requestedWorkspace;
+  });
+  if (existing) {
+    applyCredential(env, existing);
+    return { status: "configured", source: "local_store" };
+  }
+  const connectUrl = env.BRIEF_CONNECT_URL?.trim();
+  const connectCode = env.BRIEF_CONNECT_CODE?.trim();
+  if (!connectUrl || !connectCode) {
+    return {
+      status: "skipped",
+      reason: "no_cloud_credential_or_pairing_setup"
+    };
+  }
+  let response;
+  try {
+    response = await fetch(connectUrl, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ code: connectCode }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    return {
+      status: "failed",
+      reason: "Could not reach the Brief connection service. Check your network and try a fresh setup from the Brief app."
+    };
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.ok || !body.apiUrl || !body.apiKey || !apiKeyPattern.test(body.apiKey) || !body.workspaceId || !body.privacyMode) {
+    return {
+      status: "failed",
+      reason: body?.message ?? "This Brief setup link is expired or already used. Create a fresh connection from the Brief app."
+    };
+  }
+  const credential = {
+    apiUrl: body.apiUrl,
+    apiKey: body.apiKey,
+    workspaceId: body.workspaceId,
+    privacyMode: body.privacyMode,
+    ...body.connectorId ? { connectorId: body.connectorId } : {},
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    writeCredentialFile(credentialPath, [
+      ...stored.credentials.filter(
+        (item) => item.workspaceId !== credential.workspaceId || originFrom(item.apiUrl) !== originFrom(credential.apiUrl)
+      ),
+      credential
+    ]);
+  } catch {
+    return {
+      status: "failed",
+      reason: "Brief connected, but could not save the local credential. Check permissions for the local Brief config directory and try again."
+    };
+  }
+  applyCredential(env, credential);
+  return { status: "configured", source: "pairing" };
+}
+function forgetCloudCredentials(env = process.env) {
+  const credentialPath = credentialsPath(env);
+  const stored = readCredentialFile(credentialPath);
+  const requestedOrigin = originFrom(
+    env.BRIEF_API_URL ?? env.BRIEF_CONNECT_URL
+  );
+  const requestedWorkspace = env.BRIEF_WORKSPACE_ID?.trim();
+  const remaining = stored.credentials.filter((credential) => {
+    if (requestedOrigin && originFrom(credential.apiUrl) !== requestedOrigin) {
+      return true;
+    }
+    return Boolean(
+      requestedWorkspace && credential.workspaceId !== requestedWorkspace
+    );
+  });
+  writeCredentialFile(credentialPath, remaining);
+}
+function defaultCredentialsPath(env = process.env) {
+  return credentialsPath(env);
+}
+function credentialsPath(env) {
+  return env.BRIEF_CREDENTIALS_FILE?.trim() || path14.join(
+    env.XDG_CONFIG_HOME?.trim() || path14.join(os.homedir(), ".config"),
+    "runbrief",
+    "credentials.json"
+  );
+}
+function readCredentialFile(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync3(filePath, "utf8"));
+    if (parsed.version !== 1 || !Array.isArray(parsed.credentials)) {
+      return { version: 1, credentials: [] };
+    }
+    return {
+      version: 1,
+      credentials: parsed.credentials.filter(isStoredCredential)
+    };
+  } catch {
+    return { version: 1, credentials: [] };
+  }
+}
+function writeCredentialFile(filePath, credentials) {
+  mkdirSync2(path14.dirname(filePath), { recursive: true, mode: 448 });
+  chmodSync(path14.dirname(filePath), 448);
+  writeFileSync5(
+    filePath,
+    `${JSON.stringify({ version: 1, credentials }, null, 2)}
+`,
+    { encoding: "utf8", mode: 384 }
+  );
+  chmodSync(filePath, 384);
+}
+function applyCredential(env, credential) {
+  env.BRIEF_API_URL = credential.apiUrl;
+  env.BRIEF_API_KEY = credential.apiKey;
+  env.BRIEF_WORKSPACE_ID = credential.workspaceId;
+  env.BRIEF_PRIVACY_MODE = credential.privacyMode;
+}
+function originFrom(value) {
+  if (!value) return void 0;
+  try {
+    return new URL(value).origin;
+  } catch {
+    return void 0;
+  }
+}
+function isStoredCredential(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return Boolean(
+    typeof candidate.apiUrl === "string" && typeof candidate.apiKey === "string" && apiKeyPattern.test(candidate.apiKey) && typeof candidate.workspaceId === "string" && typeof candidate.privacyMode === "string" && typeof candidate.updatedAt === "string"
+  );
+}
+var apiKeyPattern;
+var init_cloudCredentials = __esm({
+  "../mcp/src/cloudCredentials.ts"() {
+    "use strict";
+    apiKeyPattern = /^brf_(live|test)_[a-zA-Z0-9]{8,}_[a-zA-Z0-9]{24,}$/;
+  }
+});
+
+// ../mcp/src/workspace.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync4 } from "node:fs";
+import path15 from "node:path";
 function resolveRepoRoot(repoPath, options2 = {}) {
   return resolveRepoRootDetails(repoPath, options2).repoRoot;
 }
 function resolveRepoRootDetails(repoPath, options2 = {}) {
-  const cwd = path14.resolve(options2.cwd ?? process.cwd());
+  const cwd = path15.resolve(options2.cwd ?? process.cwd());
   const env = options2.env ?? process.env;
   const cwdResolution = resolveExistingRoot(cwd, "cwd");
   const cwdIsCustomerWorktree = isGitWorktree(cwdResolution.repoRoot) && !looksLikeBriefSourceCheckout(cwdResolution.repoRoot);
@@ -34150,7 +35265,7 @@ function resolveRepoRootDetails(repoPath, options2 = {}) {
   ]);
   const explicitRepoPath = repoPath?.trim();
   if (explicitRepoPath) {
-    const explicitPathKind = path14.isAbsolute(explicitRepoPath) ? "absolute" : "relative";
+    const explicitPathKind = path15.isAbsolute(explicitRepoPath) ? "absolute" : "relative";
     if (explicitPathKind === "relative" && envCandidates.length > 1) {
       return {
         ...cwdResolution,
@@ -34162,7 +35277,7 @@ function resolveRepoRootDetails(repoPath, options2 = {}) {
     const relativeBase = cwdIsCustomerWorktree ? cwdResolution.repoRoot : envCandidates[0]?.repoRoot ?? cwd;
     return {
       ...resolveExistingRoot(
-        path14.resolve(
+        path15.resolve(
           explicitPathKind === "absolute" ? cwd : relativeBase,
           explicitRepoPath
         ),
@@ -34200,7 +35315,7 @@ function resolveFromEnvVars(cwd, env, envVars, options2 = {}) {
   for (const envVar of envVars) {
     const value = cleanWorkspacePath(env[envVar]);
     if (!value) continue;
-    const start = path14.resolve(cwd, value);
+    const start = path15.resolve(cwd, value);
     if (existsSync5(start)) {
       const resolution = resolveExistingRoot(start, "environment", envVar);
       if (options2.skipBriefSource && looksLikeBriefSourceCheckout(resolution.repoRoot)) {
@@ -34213,7 +35328,7 @@ function resolveFromEnvVars(cwd, env, envVars, options2 = {}) {
 }
 function repoTargetHealth(resolution, options2 = {}) {
   const env = options2.env ?? process.env;
-  const cwd = path14.resolve(options2.cwd ?? process.cwd());
+  const cwd = path15.resolve(options2.cwd ?? process.cwd());
   const gitRoot = runGit(resolution.repoRoot, ["rev-parse", "--show-toplevel"]);
   const evidence = [
     ...rootEvidence(resolution, cwd, env),
@@ -34274,7 +35389,7 @@ function repoTargetHealth(resolution, options2 = {}) {
   };
 }
 function resolveExistingRoot(start, source, envVar) {
-  const gitStart = existsSync5(start) && !statSync4(start).isDirectory() ? path14.dirname(start) : start;
+  const gitStart = existsSync5(start) && !statSync4(start).isDirectory() ? path15.dirname(start) : start;
   const gitRoot = runGit(gitStart, ["rev-parse", "--show-toplevel"]);
   return {
     repoRoot: gitRoot && existsSync5(gitRoot) ? gitRoot : start,
@@ -34325,12 +35440,12 @@ function preferPinnedRepoRoot(env) {
   return env.BRIEF_REPO_ROOT_MODE === "pinned" || env.BRIEF_REPO_ROOT_PINNED === "true";
 }
 function looksLikeBriefSourceCheckout(repoRoot) {
-  if (!existsSync5(path14.join(repoRoot, "packages", "mcp", "src", "server.ts"))) {
+  if (!existsSync5(path15.join(repoRoot, "packages", "mcp", "src", "server.ts"))) {
     return false;
   }
   try {
     const pkg = JSON.parse(
-      readFileSync3(path14.join(repoRoot, "package.json"), "utf8")
+      readFileSync4(path15.join(repoRoot, "package.json"), "utf8")
     );
     return pkg.name === "brief";
   } catch {
@@ -34359,7 +35474,7 @@ var init_workspace = __esm({
 });
 
 // ../mcp/src/connectorReadiness.ts
-import path15 from "node:path";
+import path16 from "node:path";
 function connectorReadiness(input) {
   const runtimeLabel = input.mode === "cli" ? "Brief CLI process" : "Brief MCP connector";
   const installStatusTool = input.mode === "cli" ? "install-status or brief.install_status" : "brief.install_status";
@@ -34453,8 +35568,8 @@ function connectorReadiness(input) {
   };
 }
 function briefSourceCheckoutMismatch(input) {
-  const repoRoot = input.repoRoot ? path15.resolve(input.repoRoot) : void 0;
-  const sourceRoot = input.freshness.sourceRoot ? path15.resolve(input.freshness.sourceRoot) : void 0;
+  const repoRoot = input.repoRoot ? path16.resolve(input.repoRoot) : void 0;
+  const sourceRoot = input.freshness.sourceRoot ? path16.resolve(input.freshness.sourceRoot) : void 0;
   if (!repoRoot || !sourceRoot) return void 0;
   if (samePath(repoRoot, sourceRoot)) return void 0;
   if (!looksLikeBriefSourceCheckout(repoRoot)) return void 0;
@@ -34469,7 +35584,7 @@ function briefSourceCheckoutMismatch(input) {
   };
 }
 function samePath(left, right) {
-  return path15.normalize(left) === path15.normalize(right);
+  return path16.normalize(left) === path16.normalize(right);
 }
 var init_connectorReadiness = __esm({
   "../mcp/src/connectorReadiness.ts"() {
@@ -34489,9 +35604,9 @@ function buildConnectorRecoveryPlan(input) {
   });
   const restartNeeded = readiness.status === "restart_required" || readiness.status === "source_mismatch";
   const needsVerification = readiness.status === "needs_verification";
-  const canSelfRestart = input.mode === "server" && readiness.status !== "source_mismatch";
+  const canSelfRestart = input.mode === "server" && readiness.status !== "wrong_repo";
   const confirmed = input.confirm === briefRestartConfirmation;
-  const shouldSchedule = canSelfRestart && confirmed && (readiness.status === "restart_required" || input.force === true);
+  const shouldSchedule = canSelfRestart && confirmed && (readiness.status === "restart_required" || readiness.status === "source_mismatch" || input.force === true);
   const status = shouldSchedule ? "restart_scheduled" : restartNeeded ? readiness.status : needsVerification ? "needs_verification" : "ready";
   const verifyExpect = [
     "connectorReadiness.status is ready",
@@ -34515,7 +35630,7 @@ function buildConnectorRecoveryPlan(input) {
     mcpSelfRestart: {
       tool: "brief.restart_connector",
       available: canSelfRestart,
-      behavior: "When confirmed, Brief returns this recovery packet, waits briefly, then exits the local MCP process. MCP hosts that supervise subprocesses can relaunch it; hosts that do not should be restarted or reloaded by the user.",
+      behavior: "When confirmed, Brief returns this recovery packet, waits briefly, then exits the local MCP process. MCP hosts that supervise subprocesses can relaunch it; hosts that do not should be restarted or reloaded by the user. A restart refreshes the configured source; it does not change a host's source path.",
       call: {
         confirm: briefRestartConfirmation,
         surface: selectedSurface,
@@ -34538,7 +35653,8 @@ function buildConnectorRecoveryPlan(input) {
 }
 function summaryForStatus(status, readiness) {
   if (status === "restart_scheduled") {
-    return "Brief scheduled the local MCP process to exit so the host can relaunch a fresh connector.";
+    const restartSummary = "Brief scheduled the local MCP process to exit so the host can relaunch a fresh connector.";
+    return readiness.status === "source_mismatch" ? `${restartSummary} ${readiness.summary} Verify the host source path after reconnecting.` : restartSummary;
   }
   return readiness.summary;
 }
@@ -34603,8 +35719,8 @@ var init_connectorRecovery = __esm({
 });
 
 // ../mcp/src/serverFreshness.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
-import path16 from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync5 } from "node:fs";
+import path17 from "node:path";
 function mcpServerFreshness(options2) {
   const cwd = options2.cwd ?? process.cwd();
   const now = options2.now ?? /* @__PURE__ */ new Date();
@@ -34615,10 +35731,12 @@ function mcpServerFreshness(options2) {
     cwd,
     sourceRoot: options2.sourceRoot
   });
+  const sourceKind = options2.distribution ?? connectorDistributionFor(options2.entrypoint);
   const watchedGlobs = watchedSourceGlobs();
   const base = {
     serverStartedAt: options2.serverStartedAt.toISOString(),
     checkedAt: now.toISOString(),
+    sourceKind,
     process: {
       pid: process.pid,
       cwd,
@@ -34633,6 +35751,15 @@ function mcpServerFreshness(options2) {
     changedSinceStartCount: 0
   };
   if (!sourceRoot) {
+    if (sourceKind === "package") {
+      return {
+        status: "current",
+        ...base,
+        action: freshnessAction("current"),
+        summary: "The published Brief connector is running from an immutable package; source-checkout freshness checks are not applicable.",
+        next: "Continue using Brief normally. Fresh MCP starts resolve the latest compatible patch; reload the host to pick it up, and use a new generated setup for a future minor or major release."
+      };
+    }
     return {
       status: "unknown",
       ...base,
@@ -34673,6 +35800,21 @@ function mcpServerFreshness(options2) {
     next: status === "restart_recommended" ? "Call brief.restart_connector from the coding agent, then call brief.install_status again and confirm serverFreshness.status is current." : "Continue using Brief normally."
   };
 }
+function connectorDistributionFor(entrypoint) {
+  const configured = process.env.BRIEF_CONNECTOR_DISTRIBUTION;
+  if (configured === "package" || configured === "source_checkout") {
+    return configured;
+  }
+  const normalizedEntrypoint = path17.normalize(entrypoint);
+  if (normalizedEntrypoint.includes(
+    `${path17.sep}node_modules${path17.sep}runbrief${path17.sep}`
+  ) || normalizedEntrypoint.includes(
+    `${path17.sep}packages${path17.sep}runbrief${path17.sep}`
+  )) {
+    return "package";
+  }
+  return "unknown";
+}
 function freshnessAction(status) {
   if (status === "current") {
     return {
@@ -34707,30 +35849,30 @@ function findBriefSourceRoot(options2) {
   const candidates = [
     options2.sourceRoot,
     process.env.BRIEF_SOURCE_ROOT,
-    options2.entrypoint ? path16.dirname(options2.entrypoint) : void 0,
+    options2.entrypoint ? path17.dirname(options2.entrypoint) : void 0,
     options2.cwd
   ].filter((candidate) => Boolean(candidate));
   for (const candidate of candidates) {
-    const root = walkUpForBriefRoot(path16.resolve(candidate));
+    const root = walkUpForBriefRoot(path17.resolve(candidate));
     if (root) return root;
   }
   return void 0;
 }
 function walkUpForBriefRoot(start) {
-  let current = existsSync6(start) && statSafe(start)?.isFile() ? path16.dirname(start) : start;
+  let current = existsSync6(start) && statSafe(start)?.isFile() ? path17.dirname(start) : start;
   while (true) {
     if (isBriefSourceRoot(current)) return current;
-    const parent = path16.dirname(current);
+    const parent = path17.dirname(current);
     if (parent === current) return void 0;
     current = parent;
   }
 }
 function isBriefSourceRoot(candidate) {
-  const packageJsonPath = path16.join(candidate, "package.json");
+  const packageJsonPath = path17.join(candidate, "package.json");
   if (!existsSync6(packageJsonPath)) return false;
   const packageJson = readJson(packageJsonPath);
   if (packageJson?.name !== "brief") return false;
-  return existsSync6(path16.join(candidate, "packages", "mcp")) && existsSync6(path16.join(candidate, "packages", "core")) && existsSync6(path16.join(candidate, "packages", "contracts"));
+  return existsSync6(path17.join(candidate, "packages", "mcp")) && existsSync6(path17.join(candidate, "packages", "core")) && existsSync6(path17.join(candidate, "packages", "contracts"));
 }
 function watchedSourceGlobs() {
   return [
@@ -34768,7 +35910,7 @@ function collectWatchedFiles(sourceRoot, maxWatchedFiles) {
       truncated = true;
       break;
     }
-    const absolutePath = path16.join(sourceRoot, relativePath);
+    const absolutePath = path17.join(sourceRoot, relativePath);
     const stats = statSafe(absolutePath);
     if (!stats) continue;
     if (stats.isDirectory()) {
@@ -34785,7 +35927,7 @@ function collectWatchedFiles(sourceRoot, maxWatchedFiles) {
         break;
       }
       files.push({
-        path: normalizePath(path16.relative(sourceRoot, absolutePath)),
+        path: normalizePath(path17.relative(sourceRoot, absolutePath)),
         modifiedAtMs: stats.mtimeMs
       });
     }
@@ -34796,7 +35938,7 @@ function walkFiles2(sourceRoot, directory, files, maxWatchedFiles) {
   const entries = readdirSafe(directory);
   for (const entry of entries) {
     if (files.length >= maxWatchedFiles) return { truncated: true };
-    const absolutePath = path16.join(directory, entry.name);
+    const absolutePath = path17.join(directory, entry.name);
     if (entry.isDirectory()) {
       if (shouldSkipDirectory(entry.name)) continue;
       const result = walkFiles2(
@@ -34812,7 +35954,7 @@ function walkFiles2(sourceRoot, directory, files, maxWatchedFiles) {
     const stats = statSafe(absolutePath);
     if (!stats) continue;
     files.push({
-      path: normalizePath(path16.relative(sourceRoot, absolutePath)),
+      path: normalizePath(path17.relative(sourceRoot, absolutePath)),
       modifiedAtMs: stats.mtimeMs
     });
   }
@@ -34831,13 +35973,13 @@ function shouldSkipDirectory(name) {
   );
 }
 function shouldWatchFile(filePath) {
-  const base = path16.basename(filePath);
+  const base = path17.basename(filePath);
   if (base.endsWith(".tsbuildinfo")) return false;
   if (base === ".DS_Store") return false;
   return true;
 }
 function normalizePath(value) {
-  return value.split(path16.sep).join("/");
+  return value.split(path17.sep).join("/");
 }
 function statSafe(filePath) {
   try {
@@ -34855,7 +35997,7 @@ function readdirSafe(directory) {
 }
 function readJson(filePath) {
   try {
-    return JSON.parse(readFileSync4(filePath, "utf8"));
+    return JSON.parse(readFileSync5(filePath, "utf8"));
   } catch {
     return void 0;
   }
@@ -34918,13 +36060,16 @@ var init_serverInstructions = __esm({
   "../mcp/src/serverInstructions.ts"() {
     "use strict";
     briefMcpInstructions = [
-      "Brief is the default repo-context, reuse, review, and handoff companion for non-trivial coding work. This is the normal path, not an optional reminder. Do not wait for the user to repeat 'use Brief'.",
-      "At the first Brief-relevant task in a session, call brief.install_status once and confirm the repo target and connector freshness.",
-      "When the user asks for non-trivial work, call brief.next with the user's actual request before inspecting or editing files, then follow its compact workPacket and recommendation. Keep micro changes lightweight.",
-      "Before creating a helper, component, route, workflow, command, or skill, use the returned reuse candidates or call brief.reference_implementations and brief.codebase_map.",
-      "Refresh Brief context when the task, files, risk, or validation plan changes.",
+      "Brief is the default repo-context, reuse, review, and handoff companion for non-trivial coding work. Do not wait for the user to repeat 'use Brief'.",
+      "At the first task, call brief.install_status and confirm repo and connector freshness. Include task when known to get the first context packet.",
+      "Local mode is the default and needs no account. Team mode adds approved shared guidance. If team sync is unavailable, continue local repo work and mention it only when it affects the task.",
+      "Package-backed connectors pick up compatible patches on the next MCP start. Reload a long-lived host after an update; routine patches do not need a reinstall.",
+      "For non-trivial work, call brief.next with the request before inspecting or editing and follow its compact recommendation. Auto-engage. Keep micro changes lightweight.",
+      "Before creating a helper, component, route, workflow, command, or skill, use reuse candidates or call brief.reference_implementations and brief.codebase_map.",
+      "For user, JTBD, competitor, market, taste, copy, or integration questions, call brief.product_research_plan, research with the host, then save cited proposed facts with brief.save_product_context.",
+      "Refresh Brief when task, files, risk, or validation changes.",
       "Before a meaningful handoff, call brief.review_diff. Save and verify a handoff only for multi-step, high-risk, or durable work.",
-      "Keep Brief quiet in chat: report one concrete way it helped and the validation or remaining risk in one or two lines. Never invent Brief usage or paste full receipts unless asked."
+      "Keep Brief quiet: report one concrete benefit and validation or risk in one or two lines. Never invent usage or paste receipts unless asked."
     ].join("\n");
     briefMcpInstructionSignals = [
       "brief.install_status",
@@ -34968,6 +36113,18 @@ function compactInstallStatus(input) {
   const degraded = !blocked && (Boolean(cloudIssue) || input.readiness.verdict !== "agent_ready" || input.workflowWiring.status === "missing" || input.workflowWiring.status === "manual_workflow_only");
   const stats = input.scan.stats;
   const mcpContractActive = input.serverInstructionsActive && input.connectorReadiness.safeToUseBrief;
+  const teamSyncStatus = input.cloudSync.configured ? input.teamContext.status === "failed" ? "unavailable" : input.teamContext.status === "fetched" ? "connected" : "checking" : "not_connected";
+  const connectionMode = teamSyncStatus === "unavailable" ? "team_degraded" : teamSyncStatus === "connected" ? "team" : "local";
+  const connectorUpdate = input.serverFreshness.sourceKind === "package" ? {
+    policy: "automatic_compatible_patches",
+    installSpec: briefPublishedPackageInstallSpec,
+    applies: "next_mcp_start",
+    summary: "Package-backed connectors pick up the latest compatible patch when the MCP host starts them again."
+  } : {
+    policy: "manual_source_restart",
+    applies: "host_restart",
+    summary: "Source-checkout connectors use the files in their configured checkout; restart the host after local Brief changes."
+  };
   const totalMapCandidates = stats.mapTotalCandidateCount ?? stats.mapNodeCount + (stats.mapOmittedCount ?? 0);
   const mapCoveragePercent = totalMapCandidates ? Math.round(stats.mapNodeCount / totalMapCandidates * 100) : 100;
   const repoGuidanceSignals = unique4(
@@ -34996,9 +36153,17 @@ function compactInstallStatus(input) {
       status: input.connectorReadiness.status,
       safeToUse: input.connectorReadiness.safeToUseBrief,
       fresh: input.serverFreshness.status === "current",
+      distribution: input.serverFreshness.sourceKind,
       sourceRoot: input.serverFreshness.sourceRoot,
+      update: connectorUpdate,
       summary: input.connectorReadiness.summary
     },
+    connection: {
+      mode: connectionMode,
+      localAvailable: input.connectorReadiness.safeToUseBrief,
+      teamSync: teamSyncStatus,
+      summary: connectionMode === "team_degraded" ? "Local repo work is available. Team sync needs attention and will not block local analysis." : connectionMode === "team" ? "Local repo work and approved team context are available." : "Local repo work is available without an account. Team sync is optional."
+    },
     cloud: {
       configured: input.cloudSync.configured,
       privacyMode: input.cloudSync.privacyMode,
@@ -35054,8 +36219,9 @@ var briefConnectorVersion;
 var init_installStatus = __esm({
   "../mcp/src/installStatus.ts"() {
     "use strict";
+    init_dist2();
     init_serverInstructions();
-    briefConnectorVersion = "0.1.2";
+    briefConnectorVersion = "0.1.4";
   }
 });
 
@@ -35075,8 +36241,7 @@ function buildCompactStartEnvelope(input) {
     route: {
       tool: start.intent.tool,
       ...start.intent.recipe ? { recipe: start.intent.recipe } : {},
-      ...start.intent.autonomy ? { autonomy: start.intent.autonomy } : {},
-      ...start.intent.reviewBar ? { reviewBar: start.intent.reviewBar } : {}
+      ...start.intent.autonomy ? { autonomy: start.intent.autonomy } : {}
     },
     workPacket: (() => {
       const packet = buildAgentWorkPacket({
@@ -35086,7 +36251,6 @@ function buildCompactStartEnvelope(input) {
         nextAction: input.next
       });
       return {
-        schemaVersion: packet.schemaVersion,
         compactText: packet.compactText
       };
     })(),
@@ -35241,15 +36405,15 @@ var init_startSummary = __esm({
 });
 
 // ../mcp/src/wikiInit.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import path17 from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import path18 from "node:path";
 function writeWikiInitArtifacts(repoRoot, wiki, options2) {
-  const wikiDir = path17.join(repoRoot, ".brief", "wiki");
-  const pagesDir = path17.join(wikiDir, "pages");
-  mkdirSync2(pagesDir, { recursive: true });
+  const wikiDir = path18.join(repoRoot, ".brief", "wiki");
+  const pagesDir = path18.join(wikiDir, "pages");
+  mkdirSync3(pagesDir, { recursive: true });
   const pageArtifacts = wiki.pages.map((page2) => {
-    const pagePath = path17.join(pagesDir, `${wikiPageSlug(page2)}.md`);
-    writeFileSync5(pagePath, renderWikiPageMarkdown(wiki, page2));
+    const pagePath = path18.join(pagesDir, `${wikiPageSlug(page2)}.md`);
+    writeFileSync6(pagePath, renderWikiPageMarkdown(wiki, page2));
     return {
       id: page2.id,
       title: page2.title,
@@ -35258,32 +36422,32 @@ function writeWikiInitArtifacts(repoRoot, wiki, options2) {
       quality: page2.quality.status
     };
   });
-  const readmePath = path17.join(wikiDir, "README.md");
-  writeFileSync5(readmePath, renderWikiReadme(wiki, pageArtifacts));
-  const manifestPath = path17.join(wikiDir, "manifest.json");
-  writeFileSync5(
+  const readmePath = path18.join(wikiDir, "README.md");
+  writeFileSync6(readmePath, renderWikiReadme(wiki, pageArtifacts));
+  const manifestPath = path18.join(wikiDir, "manifest.json");
+  writeFileSync6(
     manifestPath,
     `${JSON.stringify(wikiInitManifest(wiki, pageArtifacts), null, 2)}
 `
   );
-  const workflowTemplatePath = path17.join(
+  const workflowTemplatePath = path18.join(
     wikiDir,
     "brief-wiki-refresh.github-actions.yml"
   );
-  writeFileSync5(workflowTemplatePath, renderWikiRefreshWorkflow());
+  writeFileSync6(workflowTemplatePath, renderWikiRefreshWorkflow());
   const agentFiles = options2.writeAgentFiles ? ["AGENTS.md", "CLAUDE.md"].map(
     (fileName) => upsertWikiAgentInstructions(repoRoot, fileName)
   ) : [];
   let githubWorkflow2;
   if (options2.writeGithubWorkflow) {
-    const workflowPath = path17.join(
+    const workflowPath = path18.join(
       repoRoot,
       ".github",
       "workflows",
       "brief-wiki-refresh.yml"
     );
-    mkdirSync2(path17.dirname(workflowPath), { recursive: true });
-    writeFileSync5(workflowPath, renderWikiRefreshWorkflow({ active: true }));
+    mkdirSync3(path18.dirname(workflowPath), { recursive: true });
+    writeFileSync6(workflowPath, renderWikiRefreshWorkflow({ active: true }));
     githubWorkflow2 = {
       path: repoRelativePath(repoRoot, workflowPath),
       status: "written",
@@ -35473,12 +36637,12 @@ function wikiInitManifest(wiki, pageArtifacts) {
   };
 }
 function upsertWikiAgentInstructions(repoRoot, fileName) {
-  const filePath = path17.join(repoRoot, fileName);
+  const filePath = path18.join(repoRoot, fileName);
   const status = existsSync7(filePath) ? "updated" : "created";
-  const existing = status === "updated" ? readFileSync5(filePath, "utf8") : "";
+  const existing = status === "updated" ? readFileSync6(filePath, "utf8") : "";
   const initial = existing || `# ${fileName}
 `;
-  writeFileSync5(filePath, upsertMarkedBlock(initial, wikiAgentBlock()));
+  writeFileSync6(filePath, upsertMarkedBlock(initial, wikiAgentBlock()));
   return {
     path: repoRelativePath(repoRoot, filePath),
     status,
@@ -35550,7 +36714,7 @@ function renderWikiRefreshWorkflow(options2 = {}) {
     "        with:",
     "          node-version: 22",
     "      - name: Refresh wiki",
-    '        run: npx -y runbrief@0.1.2 wiki init --repo "$GITHUB_WORKSPACE" --update --no-agent-files',
+    `        run: npx -y ${briefPublishedPackageInstallSpec} wiki init --repo "$GITHUB_WORKSPACE" --update --no-agent-files`,
     "      - name: Open refresh PR",
     "        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11",
     "        with:",
@@ -35571,7 +36735,7 @@ function markdownList(items) {
   return items.map((item) => `- ${item}`).join("\n");
 }
 function repoRelativePath(repoRoot, filePath) {
-  return path17.relative(repoRoot, filePath).split(path17.sep).join("/");
+  return path18.relative(repoRoot, filePath).split(path18.sep).join("/");
 }
 function wikiReadmeRelativePath(repoRelativeFilePath) {
   return repoRelativeFilePath.replace(/^\.brief\/wiki\//, "");
@@ -35666,8 +36830,8 @@ function bestMatchingReceipt(receipts, kind, input) {
 function missionIntentMatches(receipt, input) {
   if (input.recipeId && receipt.missionRecipeId === input.recipeId) return true;
   if (!input.task) return false;
-  const wantedTask = normalizeText(input.task);
-  const receiptTask = normalizeText(receipt.task);
+  const wantedTask = normalizeText2(input.task);
+  const receiptTask = normalizeText2(receipt.task);
   return receiptTask === wantedTask || wantedTask.length >= 20 && receiptTask.length >= 20 && (receiptTask.includes(wantedTask) || wantedTask.includes(receiptTask));
 }
 function matchScore(receipt, input) {
@@ -35677,8 +36841,8 @@ function matchScore(receipt, input) {
   }
   let score = input.branch && receiptBranch2 ? 15 : 0;
   if (input.task) {
-    const wantedTask = normalizeText(input.task);
-    const receiptTask = normalizeText(receipt.task);
+    const wantedTask = normalizeText2(input.task);
+    const receiptTask = normalizeText2(receipt.task);
     if (receiptTask === wantedTask) {
       score += 80;
     } else if (wantedTask.length >= 20 && receiptTask.length >= 20 && (receiptTask.includes(wantedTask) || wantedTask.includes(receiptTask))) {
@@ -35736,7 +36900,7 @@ function cleanValues(values, limit = 300) {
 function unique5(values) {
   return [...new Set(values)];
 }
-function normalizeText(value) {
+function normalizeText2(value) {
   return value.trim().toLowerCase().replace(/\s+/g, " ");
 }
 function normalizeBranch(value) {
@@ -35875,8 +37039,8 @@ var init_workflowWiringResponse = __esm({
 
 // ../mcp/src/server.ts
 var server_exports = {};
-import { chmodSync, mkdirSync as mkdirSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import path18 from "node:path";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import path19 from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   McpServer
@@ -36137,7 +37301,8 @@ function serverFreshness() {
   return mcpServerFreshness({
     serverStartedAt,
     entrypoint: serverModulePath,
-    mode: "server"
+    mode: "server",
+    distribution: connectorDistributionFor(serverModulePath)
   });
 }
 function summarizePacket(packet) {
@@ -36155,7 +37320,56 @@ function summarizePacket(packet) {
     sources: packet.sources,
     omitted: packet.omitted,
     ...packet.valueSignals ? { valueSignals: packet.valueSignals } : {},
-    ...packet.teamGuidance ? { teamGuidance: packet.teamGuidance } : {}
+    ...packet.teamGuidance ? { teamGuidance: packet.teamGuidance } : {},
+    ...packet.dependencyRemediation ? { dependencyRemediation: packet.dependencyRemediation } : {}
+  };
+}
+async function buildActivationContext(input) {
+  const request = {
+    task: input.task,
+    repoRoot: input.repoRoot,
+    agent: "mcp-activation",
+    maxTokens: Math.min(input.maxTokens ?? 6e3, 6e3)
+  };
+  if (input.files) request.files = input.files;
+  if (input.branch) request.branch = input.branch;
+  const packet = contextForTask(input.scan, request);
+  const localReceipt = saveLocalContextReceipt(input.repoRoot, packet, {
+    kind: "context",
+    agent: "mcp-activation",
+    ...input.files ? { files: input.files } : {},
+    ...input.branch ? { branch: input.branch } : {}
+  });
+  const cloudSync = await syncContextReceipt(packet, input.repoRoot, {
+    agent: "mcp-activation",
+    ...input.files ? { files: input.files } : {},
+    ...input.branch ? { branch: input.branch } : {}
+  });
+  return {
+    status: "context_ready",
+    task: input.task,
+    packetId: packet.packetId,
+    summary: packet.summary,
+    tokenEstimate: packet.tokenEstimate,
+    inspectFirst: packet.map.slice(0, 5).map((node) => ({
+      path: node.path,
+      kind: node.type,
+      name: node.name
+    })),
+    rules: packet.rules.slice(0, 4).map((rule) => ({
+      text: rule.body,
+      sources: rule.sourcePaths
+    })),
+    suggestedTests: packet.suggestedTests.slice(0, 4),
+    sources: packet.sources.slice(0, 6),
+    localReceipt: {
+      id: localReceipt.id
+    },
+    cloudSync: {
+      status: cloudSync.status,
+      ..."reason" in cloudSync && cloudSync.reason ? { reason: cloudSync.reason } : {}
+    },
+    next: "Use this packet before editing. If the task or files change, call brief.next again."
   };
 }
 function summarizeReview(review, detail = "auto") {
@@ -36593,6 +37807,7 @@ function summarizeBeforeYouCodeForStart(beforeYouCode) {
       decision: beforeYouCode.reuseFirst.decision,
       candidates: beforeYouCode.reuseFirst.candidates.slice(0, 2)
     },
+    mapCoverage: beforeYouCode.mapCoverage,
     sharedContext: summarizeBeforeYouCodeSharedContext(
       beforeYouCode.teamGuidance
     ),
@@ -36656,7 +37871,7 @@ function summarizeWorkflowWiringForStart(wiring) {
     defaultAsk: wiring.defaultAsk,
     gaps: wiring.gaps.slice(0, 3),
     chatFeedback: wiring.chatFeedback.slice(0, 2),
-    finalRecapPolicy: wiring.finalRecapPolicy,
+    finalRecapPolicy: compactFinalRecapPolicy(wiring.finalRecapPolicy),
     nextActions: wiring.nextActions.slice(0, 3)
   };
 }
@@ -36665,7 +37880,7 @@ function summarizeAutoEngageForStart(autoEngage) {
     status: autoEngage.status,
     summary: autoEngage.summary,
     chatFeedback: autoEngage.chatFeedback.slice(0, 1),
-    finalRecapPolicy: autoEngage.finalRecapPolicy,
+    finalRecapPolicy: compactFinalRecapPolicy(autoEngage.finalRecapPolicy),
     triggers: autoEngage.triggerMatrix.slice(0, 3).map((trigger) => ({
       id: trigger.id,
       label: trigger.label,
@@ -36674,6 +37889,13 @@ function summarizeAutoEngageForStart(autoEngage) {
     nextActions: autoEngage.nextActions.slice(0, 2)
   };
 }
+function compactFinalRecapPolicy(policy) {
+  return {
+    maxLines: policy.maxLines,
+    template: policy.defaultTemplate,
+    fallbackWhenNotHelpful: policy.fallbackWhenNotHelpful
+  };
+}
 function summarizeWiki(wiki) {
   return {
     wikiId: wiki.wikiId,
@@ -36726,21 +37948,22 @@ function summarizeLocalReceipt(receipt) {
 function writeHookFiles(repoRoot, files) {
   const written = [];
   for (const file of files) {
-    const targetPath = path18.join(repoRoot, file.path);
-    mkdirSync3(path18.dirname(targetPath), { recursive: true });
-    writeFileSync6(targetPath, file.body);
-    if (file.path.endsWith(".sh")) chmodSync(targetPath, 493);
+    const targetPath = path19.join(repoRoot, file.path);
+    mkdirSync4(path19.dirname(targetPath), { recursive: true });
+    writeFileSync7(targetPath, file.body);
+    if (file.path.endsWith(".sh")) chmodSync2(targetPath, 493);
     written.push(file.path);
   }
   return written;
 }
-var server, personalizationKindSchema, referenceImplementationKindSchema, referenceImplementationStatusSchema, savePersonalizationToolSchema, workItemSchema, runtimeEvidenceSchema, handoffValidationSchema, artifactEvidenceSchema, loopCatalogFocusSchema, missionRecipeIdSchema2, startIntentSchema, nextStageSchema, responseDetailSchema, serverStartedAt, serverModulePath, repoTargetGuardExemptTools;
+var cloudBootstrap, server, personalizationKindSchema, referenceImplementationKindSchema, referenceImplementationStatusSchema, savePersonalizationToolSchema, workItemSchema, runtimeEvidenceSchema, handoffValidationSchema, artifactEvidenceSchema, loopCatalogFocusSchema, missionRecipeIdSchema2, startIntentSchema, nextStageSchema, responseDetailSchema, serverStartedAt, serverModulePath, repoTargetGuardExemptTools;
 var init_server = __esm({
-  "../mcp/src/server.ts"() {
+  async "../mcp/src/server.ts"() {
     "use strict";
     init_dist();
     init_dist2();
     init_cloud();
+    init_cloudCredentials();
     init_teamContext();
     init_missionInputOptions();
     init_connectorReadiness();
@@ -36756,10 +37979,17 @@ var init_server = __esm({
     init_workspace();
     init_handoffAutofill();
     init_scanFreshness();
+    cloudBootstrap = process.env.BRIEF_CLOUD_BOOTSTRAP_DONE === "1" ? { status: "skipped", reason: "already_bootstrapped" } : await bootstrapCloudCredentials();
+    process.env.BRIEF_CLOUD_BOOTSTRAP_DONE = "1";
+    if (cloudBootstrap.status === "failed") {
+      console.error(
+        `Brief team sync is unavailable: ${cloudBootstrap.reason} Continuing in local mode.`
+      );
+    }
     server = new McpServer(
       {
         name: "brief",
-        version: "0.1.2"
+        version: "0.1.4"
       },
       {
         instructions: briefMcpInstructions
@@ -36859,6 +38089,7 @@ var init_server = __esm({
       "small_refactor",
       "bug_investigation",
       "qa_edge_cases",
+      "web_dogfood",
       "performance",
       "porting",
       "experiment",
@@ -36899,14 +38130,20 @@ var init_server = __esm({
     ]);
     registerTool(
       "install_status",
-      "First Brief call once per agent session. Confirms MCP is connected to the correct repo/worktree, then points the agent toward brief.next for the actual task.",
+      "First Brief call once per agent session. Confirms MCP is connected to the correct repo/worktree, scans it, and optionally returns the first compact context packet when task is provided. Never needs a reusable API key.",
       {
         repoPath: z2.string().optional().describe(
           "Path inside the repo. Defaults to BRIEF_REPO_ROOT captured from the agent workspace, then current working directory."
         ),
-        detail: responseDetailSchema
+        detail: responseDetailSchema,
+        task: z2.string().min(4).optional().describe(
+          "The user's current task, when already known. Brief returns a compact first context packet in this same call."
+        ),
+        files: z2.array(z2.string()).optional(),
+        branch: z2.string().optional(),
+        maxTokens: z2.number().int().min(500).max(12e3).optional()
       },
-      async ({ repoPath, detail }) => {
+      async ({ repoPath, detail, task, files, branch, maxTokens }) => {
         const rootResolution = resolveRepoRootDetails(repoPath);
         const repoRoot = rootResolution.repoRoot;
         const repoTarget = repoTargetHealth(rootResolution);
@@ -36930,8 +38167,16 @@ var init_server = __esm({
           );
         }
         const { scan, teamContext } = await scanRepoWithTeamContext(repoRoot, {
-          maxFiles: 400
+          maxFiles: 1200
         });
+        const activation = task?.trim() ? await buildActivationContext({
+          scan,
+          repoRoot,
+          task: task.trim(),
+          ...files ? { files } : {},
+          ...branch ? { branch } : {},
+          ...maxTokens !== void 0 ? { maxTokens } : {}
+        }) : void 0;
         const report = buildLocalValueReport(repoRoot, scan.repoName);
         const setups = generateAgentSetup(scan, { target: "all" });
         const skillLearning = buildRepoSkillLearningReport(repoRoot, {
@@ -36958,6 +38203,7 @@ var init_server = __esm({
           skillLearning: summarizeSkillLearningForStart(skillLearning, void 0),
           connectorHealth: summarizeAgentConnectorHealth(setups),
           proofLoop: report.proofLoop,
+          ...activation ? { activation } : {},
           value: {
             receiptCount: report.receiptCount,
             contextPacketCount: report.contextPacketCount,
@@ -36970,8 +38216,8 @@ var init_server = __esm({
           next: report.proofLoop.next
         };
         if (detail === "expanded") return jsonText(fullStatus);
-        return jsonText(
-          compactInstallStatus({
+        return jsonText({
+          ...compactInstallStatus({
             mode: fullStatus.mode,
             repoRoot,
             rootResolution,
@@ -36985,8 +38231,9 @@ var init_server = __esm({
             workflowWiring,
             valueReport: report,
             serverInstructionsActive: true
-          })
-        );
+          }),
+          ...activation ? { activation } : {}
+        });
       }
     );
     registerTool(
@@ -37214,9 +38461,12 @@ var init_server = __esm({
       {
         repoPath: z2.string().optional().describe(
           "Path inside the repo. Defaults to BRIEF_REPO_ROOT captured from the agent workspace, then current working directory."
+        ),
+        detail: z2.enum(["compact", "expanded"]).optional().describe(
+          "Use compact by default for the agent loop; request expanded only when diagnosing wiring or setup."
         )
       },
-      async ({ repoPath }) => {
+      async ({ repoPath, detail }) => {
         const repoTargetInfo = resolveRepoTarget(repoPath);
         if (repoTargetInfo.repoTarget.status === "needs_repo_target") {
           return repoTargetBlock(repoTargetInfo);
@@ -37226,14 +38476,19 @@ var init_server = __esm({
         const skillLearning = buildRepoSkillLearningReport(repoRoot, {
           maxFiles: 6e3
         });
+        const autoEngage = buildAgentAutoEngagementPlan(scan, skillLearning);
+        const workflowWiring = evaluateAgentWorkflowWiring(scan);
+        const responseDetail = detail ?? "compact";
         return jsonText({
           repoRoot,
           rootResolution,
           repoTarget,
-          autoEngage: buildAgentAutoEngagementPlan(scan, skillLearning),
-          workflowWiring: evaluateAgentWorkflowWiring(scan),
+          detail: responseDetail,
+          autoEngage: responseDetail === "expanded" ? autoEngage : summarizeAutoEngageForStart(autoEngage),
+          workflowWiring: responseDetail === "expanded" ? workflowWiring : summarizeWorkflowWiringForStart(workflowWiring),
           skillLearning: summarizeSkillLearningForStart(skillLearning, void 0),
-          next: "Install the default instruction into always-on agent guidance, then run the smoke test from the connected coding agent to prove Brief stays engaged from natural task asks."
+          next: responseDetail === "expanded" ? "Install the default instruction into always-on agent guidance, then run the smoke test from the connected coding agent to prove Brief stays engaged from natural task asks." : "Install the default instruction, then give the connected agent a normal task and confirm it calls brief.next before editing. Request detail: expanded only to diagnose wiring.",
+          detailHint: 'Call brief.auto_engage with detail: "expanded" only when diagnosing setup or workflow wiring.'
         });
       }
     );
@@ -37352,7 +38607,7 @@ var init_server = __esm({
               skills: scan.stats.skillCount
             }
           },
-          next: teamContext.status === "fetched" ? "Use brief.context_for_task to route this team context into the next task." : "Set BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID to fetch approved team context from the Brief app."
+          next: teamContext.status === "fetched" ? "Use brief.context_for_task to route this team context into the next task." : "Create a browser-authorized connection from the Brief app, then restart the agent. Approved legacy setups can provide BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID."
         });
       }
     );
@@ -38127,7 +39382,7 @@ var init_server = __esm({
         const sourceRepos = sourceRepoPaths && sourceRepoPaths.length > 0 ? sourceRepoPaths : [repoRoot];
         const inventories = sourceRepos.map(
           (sourceRepo) => buildAgentPackInventory(
-            path18.isAbsolute(sourceRepo) ? sourceRepo : path18.resolve(repoRoot, sourceRepo),
+            path19.isAbsolute(sourceRepo) ? sourceRepo : path19.resolve(repoRoot, sourceRepo),
             maxFiles === void 0 ? {} : { maxFiles }
           )
         );
@@ -38202,6 +39457,109 @@ var init_server = __esm({
         });
       }
     );
+    registerTool(
+      "product_research_plan",
+      "Create a focused, source-safe research plan for a product, UX, content, market, competitor, or integration decision. Use the host's approved web/browser tools to investigate it, then save only cited observations with brief.save_product_context.",
+      {
+        task: z2.string().min(4).describe("The product decision or user job to research."),
+        audience: z2.string().max(200).optional(),
+        competitors: z2.array(z2.string().trim().min(1).max(120)).max(8).optional(),
+        integrations: z2.array(z2.string().trim().min(1).max(120)).max(8).optional()
+      },
+      async ({ task, audience, competitors, integrations }) => jsonText({
+        ...buildProductResearchPlan({
+          task,
+          ...audience ? { audience } : {},
+          ...competitors ? { competitors } : {},
+          ...integrations ? { integrations } : {}
+        }),
+        next: "Use the host's approved public web/browser research. Do not treat search snippets as product truth; save the source URL, access date, claim, implication, and confidence with brief.save_product_context."
+      })
+    );
+    registerTool(
+      "save_product_context",
+      "Save cited product intelligence locally for this repo. Facts remain proposed by default; use approved only after a human product decision. Store JTBD, personas, product principles, terminology, competitor/integration observations, metrics, and decisions without credentials or private source content.",
+      {
+        repoPath: z2.string().optional().describe(
+          "Path inside the repo. Defaults to BRIEF_REPO_ROOT captured from the agent workspace, then current working directory."
+        ),
+        repoName: z2.string().trim().max(160).optional(),
+        facts: z2.array(
+          z2.object({
+            kind: z2.enum([
+              "persona",
+              "jtbd",
+              "principle",
+              "terminology",
+              "competitor",
+              "integration",
+              "metric",
+              "decision"
+            ]),
+            statement: z2.string().trim().min(8).max(1e3),
+            appliesTo: z2.array(z2.string().trim().min(1).max(240)).max(24).optional(),
+            status: z2.enum(["proposed", "approved", "stale", "rejected"]).optional(),
+            confidence: z2.number().min(0).max(1).optional(),
+            sources: z2.array(
+              z2.object({
+                kind: z2.enum(["repo", "user", "research", "feedback", "dogfood"]),
+                label: z2.string().trim().min(1).max(180),
+                url: z2.string().url().optional(),
+                path: z2.string().trim().max(300).optional(),
+                accessedAt: z2.string().datetime().optional(),
+                excerpt: z2.string().trim().max(420).optional()
+              })
+            ).max(12).optional()
+          })
+        ).min(1).max(40),
+        openQuestions: z2.array(z2.string().trim().min(4).max(300)).max(40).optional(),
+        decisions: z2.array(z2.string().trim().min(4).max(500)).max(80).optional()
+      },
+      async ({
+        repoPath,
+        repoName,
+        facts,
+        openQuestions,
+        decisions
+      }) => {
+        const repoTargetInfo = resolveRepoTarget(repoPath);
+        if (repoTargetInfo.repoTarget.status === "needs_repo_target") {
+          return repoTargetBlock(repoTargetInfo, { facts: facts.length });
+        }
+        const { repoRoot, rootResolution, repoTarget } = repoTargetInfo;
+        try {
+          const result = saveProductIntelligence(repoRoot, {
+            ...repoName ? { repoName } : {},
+            facts,
+            ...openQuestions ? { openQuestions } : {},
+            ...decisions ? { decisions } : {}
+          });
+          return jsonText({
+            status: "saved_product_context",
+            repoRoot,
+            rootResolution,
+            repoTarget,
+            savedFactIds: result.savedFactIds,
+            factCount: result.store.facts.length,
+            sourceCount: new Set(
+              result.store.facts.flatMap(
+                (fact) => fact.sources.map((source) => source.id)
+              )
+            ).size,
+            next: "Call brief.product_context for a task to see the relevant facts. Proposed facts need human review before becoming team defaults."
+          });
+        } catch (error) {
+          return jsonText({
+            status: "product_context_save_failed",
+            repoRoot,
+            rootResolution,
+            repoTarget,
+            error: error instanceof Error ? error.message : "Could not save product context.",
+            next: "Fix the source citation or repository target and retry; no context was saved from this request."
+          });
+        }
+      }
+    );
     registerTool(
       "context_for_task",
       "Return a compact, source-grounded context packet after brief.next or brief.start identifies that scoped context is needed. Use when scope changes, files are unclear, or an agent needs rules/tests/map evidence before continuing.",
@@ -39329,6 +40687,7 @@ var init_server = __esm({
           "small_refactor",
           "bug_investigation",
           "qa_edge_cases",
+          "web_dogfood",
           "performance",
           "porting",
           "experiment",
@@ -39502,6 +40861,7 @@ init_dist2();
 init_teamContext();
 init_missionInputOptions();
 init_cloud();
+init_cloudCredentials();
 init_workspace();
 init_connectorReadiness();
 init_connectorRecovery();
@@ -39513,15 +40873,140 @@ init_wikiInit();
 init_handoffAutofill();
 init_mapResponse();
 init_scanFreshness();
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import path19 from "node:path";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "node:fs";
+import path20 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// ../mcp/src/runner.ts
+init_cloud();
+import { hostname } from "node:os";
+import { spawn } from "node:child_process";
+async function runLoopRunner(options2, log = console.log) {
+  const runnerId = options2.runnerId ?? `${hostname()}-${process.pid}`;
+  const intervalMs = Math.max(options2.intervalMs ?? 4e3, 1e3);
+  const env = options2.env ?? process.env;
+  let didRun = false;
+  do {
+    const run = await claimRemoteLoopRun(runnerId, 180, env);
+    if (!run) {
+      if (options2.once) return;
+      await sleep(intervalMs);
+      continue;
+    }
+    didRun = true;
+    log({ status: "running", runId: run.id, loop: run.loopName });
+    try {
+      const result = await executeAgentCommand(
+        options2.agentCommand,
+        run,
+        options2.repoRoot,
+        options2.commandTimeoutMs ?? 30 * 60 * 1e3
+      );
+      const proof = {
+        runnerId,
+        exitCode: result.exitCode,
+        stdoutBytes: Buffer.byteLength(result.stdout, "utf8"),
+        stderrBytes: Buffer.byteLength(result.stderr, "utf8"),
+        completedLocallyAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const updated = await updateRemoteLoopRun(run.id, {
+        runnerId,
+        status: result.exitCode === 0 ? "succeeded" : "failed",
+        lastEvent: result.exitCode === 0 ? "The local agent completed the loop." : "The local agent exited with a failure.",
+        resultSummary: compactOutput(result.stdout || result.stderr),
+        proof,
+        ...result.exitCode === 0 ? {} : { errorMessage: compactOutput(result.stderr || result.stdout) }
+      }, env);
+      log({ status: updated.status, runId: updated.id, proof });
+    } catch (caught) {
+      const message = caught instanceof Error ? caught.message : "Local runner failed.";
+      try {
+        const updated = await updateRemoteLoopRun(run.id, {
+          runnerId,
+          status: "failed",
+          lastEvent: "The local runner could not execute the agent command.",
+          errorMessage: message,
+          proof: { runnerId, completedLocallyAt: (/* @__PURE__ */ new Date()).toISOString() }
+        }, env);
+        log({ status: updated.status, runId: updated.id, error: message });
+      } catch (updateError) {
+        log({ status: "failed", runId: run.id, error: message, updateError });
+        throw new Error(
+          `The runner could not persist the failed loop state: ${updateError instanceof Error ? updateError.message : "unknown update error"}`
+        );
+      }
+    }
+  } while (!options2.once || !didRun);
+}
+async function executeAgentCommand(command2, run, repoRoot, timeoutMs) {
+  const prompt = [
+    `You are running the approved Brief team loop: ${run.loopName}.`,
+    `Run id: ${run.id}`,
+    `Repository: ${run.repoFullName ?? repoRoot}`,
+    "",
+    "Approved loop guidance:",
+    run.loopBody,
+    "",
+    "Guardrails:",
+    ...run.guardrails.length > 0 ? run.guardrails.map((item) => `- ${item}`) : ["- Stop before external side effects without approval."],
+    "",
+    "Task:",
+    run.task,
+    "",
+    "Return a concise summary of what you changed, validation run, proof, and remaining risk."
+  ].join("\n");
+  return await new Promise((resolve, reject) => {
+    const child = spawn("/bin/sh", ["-lc", command2], {
+      cwd: repoRoot,
+      env: process.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error(`Agent command timed out after ${Math.round(timeoutMs / 6e4)} minutes.`));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout = `${stdout}${chunk.toString()}`.slice(-6e4);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = `${stderr}${chunk.toString()}`.slice(-2e4);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({ exitCode: code ?? 1, stdout, stderr });
+    });
+    child.stdin.end(prompt);
+  });
+}
+function compactOutput(value) {
+  return value.trim().slice(-12e3) || "The agent returned no summary.";
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// ../mcp/src/cli.ts
 var args = process.argv.slice(2);
 var command = args[0];
 var cliStartedAt = /* @__PURE__ */ new Date();
 var cliModulePath = fileURLToPath2(import.meta.url);
+if (!isCloudLogoutCommand(command)) {
+  const cloudBootstrap2 = await bootstrapCloudCredentials();
+  process.env.BRIEF_CLOUD_BOOTSTRAP_DONE = "1";
+  if (cloudBootstrap2.status === "failed") {
+    console.error(
+      `Brief team sync is unavailable: ${cloudBootstrap2.reason} Continuing in local mode.`
+    );
+  }
+}
 if (!command || command === "--stdio" || command === "stdio" || command === "mcp") {
-  await Promise.resolve().then(() => (init_server(), server_exports));
+  await init_server().then(() => server_exports);
 } else {
   await runCli(command, args.slice(1));
 }
@@ -39530,11 +41015,41 @@ async function runCli(commandName, commandArgs) {
     printJson(buildCliHelp(commandName));
     return;
   }
+  if (isCloudLogoutCommand(commandName)) {
+    forgetCloudCredentials();
+    printJson({
+      status: "cloud_credentials_removed",
+      path: defaultCredentialsPath(),
+      next: "Create a fresh browser-authorized connection from the Brief app before using team sync again."
+    });
+    return;
+  }
   const rootResolution = resolveRepoRootDetails(
     option2(commandArgs, "repo") ?? option2(commandArgs, "repoPath") ?? option2(commandArgs, "repo-path")
   );
   const repoRoot = rootResolution.repoRoot;
   const repoTarget = repoTargetHealth(rootResolution);
+  if (isCommand(commandName, "runner", "loop-runner", "run-loop")) {
+    const agentCommand = option2(commandArgs, "agent-command") ?? process.env.BRIEF_AGENT_COMMAND;
+    if (!agentCommand) {
+      fail(
+        "Missing --agent-command. Set BRIEF_AGENT_COMMAND to the local Claude, Codex, or compatible agent command."
+      );
+    }
+    const runnerOptions = {
+      repoRoot,
+      agentCommand,
+      once: hasFlag(commandArgs, "once")
+    };
+    const runnerId = option2(commandArgs, "runner-id");
+    const intervalMs = numberOption(commandArgs, "interval-ms");
+    const commandTimeoutMs = numberOption(commandArgs, "timeout-ms");
+    if (runnerId) runnerOptions.runnerId = runnerId;
+    if (intervalMs) runnerOptions.intervalMs = intervalMs;
+    if (commandTimeoutMs) runnerOptions.commandTimeoutMs = commandTimeoutMs;
+    await runLoopRunner(runnerOptions);
+    return;
+  }
   if (isCommand(commandName, "install-status", "install_status")) {
     const freshness = cliServerFreshness();
     const connector = connectorReadiness({
@@ -39667,6 +41182,66 @@ async function runCli(commandName, commandArgs) {
     process.exitCode = 1;
     return;
   }
+  if (isCommand(
+    commandName,
+    "product-research-plan",
+    "product_research_plan",
+    "research-product"
+  )) {
+    const task = option2(commandArgs, "task") ?? positionalText(commandArgs);
+    if (!task) {
+      fail(
+        'Missing task for product-research-plan. Example: brief product-research-plan --repo "$PWD" "Choose the right issue-triage integration"'
+      );
+    }
+    const audience = option2(commandArgs, "audience");
+    const competitors = textListOption(commandArgs, "competitor");
+    const integrations = textListOption(commandArgs, "integration");
+    printJson(
+      buildProductResearchPlan({
+        task,
+        ...audience ? { audience } : {},
+        ...competitors ? { competitors } : {},
+        ...integrations ? { integrations } : {}
+      })
+    );
+    return;
+  }
+  if (isCommand(
+    commandName,
+    "save-product-context",
+    "save_product_context",
+    "product-context-save"
+  )) {
+    const factsFile = option2(commandArgs, "facts-file");
+    if (!factsFile) {
+      fail(
+        'Missing --facts-file. Pass a JSON file with { "facts": [{ "kind", "statement", "sources" }] } so citations stay reviewable.'
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync7(path20.resolve(repoRoot, factsFile), "utf8"));
+    } catch (error) {
+      fail(
+        `Could not read --facts-file: ${error instanceof Error ? error.message : "invalid JSON"}`
+      );
+    }
+    if (!parsed?.facts || !Array.isArray(parsed.facts)) {
+      fail('The --facts-file must contain a top-level "facts" array.');
+    }
+    const result = saveProductIntelligence(repoRoot, parsed);
+    printJson({
+      status: "saved_product_context",
+      repoRoot,
+      rootResolution,
+      repoTarget,
+      savedFactIds: result.savedFactIds,
+      factCount: result.store.facts.length,
+      next: "Run brief product-context for a task to receive the relevant cited product facts."
+    });
+    return;
+  }
   if (isCommand(
     commandName,
     "pre-pr",
@@ -40200,7 +41775,7 @@ async function runCli(commandName, commandArgs) {
     const sourceRepos = filesOption2(commandArgs, "source-repos") ?? filesOption2(commandArgs, "sourceRepos") ?? filesOption2(commandArgs, "sources") ?? [repoRoot];
     const inventories = sourceRepos.map(
       (sourceRepo) => buildAgentPackInventory(
-        path19.isAbsolute(sourceRepo) ? sourceRepo : path19.resolve(repoRoot, sourceRepo),
+        path20.isAbsolute(sourceRepo) ? sourceRepo : path20.resolve(repoRoot, sourceRepo),
         maxFiles === void 0 ? {} : { maxFiles }
       )
     );
@@ -41072,7 +42647,7 @@ async function runCli(commandName, commandArgs) {
           skills: scan.stats.skillCount
         }
       },
-      next: teamContext.status === "fetched" ? "Use context_for_task to route this team context into the next task." : "Set BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID to fetch approved team context from the Brief app."
+      next: teamContext.status === "fetched" ? "Use context_for_task to route this team context into the next task." : "Create a browser-authorized connection from the Brief app, then restart the agent. Approved legacy setups can provide BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID."
     });
     return;
   }
@@ -41269,6 +42844,11 @@ async function runCli(commandName, commandArgs) {
 function isCommand(commandName, ...aliases) {
   return aliases.includes(commandName);
 }
+function isCloudLogoutCommand(commandName) {
+  return Boolean(
+    commandName && ["cloud-logout", "cloud_logout", "disconnect-cloud"].includes(commandName)
+  );
+}
 function wikiInitMode(argsList) {
   if (hasFlag(argsList, "init")) return "init";
   if (hasFlag(argsList, "update")) return "update";
@@ -41352,6 +42932,33 @@ function cliCommandHelp() {
         "After changing Brief source to confirm the running connector is fresh."
       ]
     },
+    {
+      command: "cloud-logout",
+      aliases: ["cloud_logout", "disconnect-cloud"],
+      purpose: "Remove the locally stored cloud credential so the next setup can pair a device again.",
+      repoBound: false,
+      usage: "brief cloud-logout",
+      examples: ["brief cloud-logout"],
+      whenToUse: [
+        "When a device needs to be disconnected from a Brief workspace.",
+        "When a one-time browser pairing has expired before the connector started."
+      ]
+    },
+    {
+      command: "runner",
+      aliases: ["loop-runner", "run-loop"],
+      purpose: "Poll for an approved team loop and execute it with the developer's local agent command.",
+      repoBound: true,
+      usage: 'runbrief runner --repo $PWD --agent-command "claude -p"',
+      examples: [
+        'runbrief runner --repo $PWD --agent-command "claude -p"',
+        'runbrief runner --repo $PWD --agent-command "codex exec" --once'
+      ],
+      whenToUse: [
+        "After pairing a connector from the Brief app.",
+        "When a team-approved loop is queued in the web app."
+      ]
+    },
     {
       command: "next",
       aliases: ["brief-next", "brief_next"],
@@ -41438,6 +43045,36 @@ function cliCommandHelp() {
         "When the agent needs acceptance criteria and state checks before editing."
       ]
     },
+    {
+      command: "product-research-plan",
+      aliases: ["product_research_plan", "research-product"],
+      purpose: "Turn a product, user, competitor, taste, or integration question into a focused research plan with source and approval rules.",
+      repoBound: true,
+      usage: 'brief product-research-plan --repo $PWD "Choose the right issue-triage integration"',
+      examples: [
+        'brief product-research-plan --repo $PWD "Improve onboarding copy for coding agents"',
+        'brief product-research-plan --repo $PWD --competitor Cursor --competitor Factory "Improve agent context"'
+      ],
+      whenToUse: [
+        "When a PM, designer, or agent needs current market, competitor, integration, or user evidence.",
+        "Before turning external research into a product rule, skill, style, or copy decision."
+      ]
+    },
+    {
+      command: "save-product-context",
+      aliases: ["save_product_context", "product-context-save"],
+      purpose: "Save cited product intelligence locally so future product, design, copy, and integration work receives relevant context.",
+      repoBound: true,
+      usage: "brief save-product-context --repo $PWD --facts-file /tmp/brief-product-facts.json",
+      examples: [
+        "brief save-product-context --repo $PWD --facts-file ./product-facts.json"
+      ],
+      whenToUse: [
+        "After researching with an approved browser or web source.",
+        "After a user, dogfood session, or product decision produces a reusable fact.",
+        "Facts remain proposed by default until a human approves them."
+      ]
+    },
     {
       command: "map",
       aliases: ["codebase-map", "codebase_map"],
@@ -41696,8 +43333,21 @@ function positionalText(argsList) {
     "doNotCopy",
     "owner",
     "receipts",
+    "audience",
+    "competitor",
+    "competitors",
+    "integration",
+    "integrations",
+    "facts-file",
+    "repo-name",
+    "open-questions",
+    "decisions",
     "added-by",
-    "addedBy"
+    "addedBy",
+    "agent-command",
+    "runner-id",
+    "interval-ms",
+    "timeout-ms"
   ]);
   const parts = [];
   for (let index = 0; index < argsList.length; index += 1) {
@@ -41814,6 +43464,7 @@ function recipeOption(argsList) {
     "small_refactor",
     "bug_investigation",
     "qa_edge_cases",
+    "web_dogfood",
     "performance",
     "porting",
     "experiment",
@@ -41953,7 +43604,7 @@ function artifactEvidenceFromOptions(argsList) {
   );
   const evidence = [];
   for (const raw of rawEvidenceValues) {
-    const json = raw.startsWith("@") ? readFileSync6(path19.resolve(raw.slice(1)), "utf8") : raw;
+    const json = raw.startsWith("@") ? readFileSync7(path20.resolve(raw.slice(1)), "utf8") : raw;
     try {
       const parsed = JSON.parse(json);
       const items = Array.isArray(parsed) ? parsed : [parsed];
@@ -42031,7 +43682,7 @@ function missionSummaryFromLocalReceipt2(repoRoot, missionReceiptId) {
 function runtimeEvidencePacketFromOptions(argsList) {
   const raw = option2(argsList, "runtime-packet") ?? option2(argsList, "runtime-evidence-packet") ?? option2(argsList, "runtimeEvidencePacket");
   if (!raw) return void 0;
-  const json = raw.startsWith("@") ? readFileSync6(path19.resolve(raw.slice(1)), "utf8") : raw;
+  const json = raw.startsWith("@") ? readFileSync7(path20.resolve(raw.slice(1)), "utf8") : raw;
   try {
     return cleanRuntimeEvidencePacket2(
       runtimeEvidencePacketSchema.parse(JSON.parse(json))
@@ -42200,6 +43851,15 @@ function printContextSummary(packet, localReceipt, teamContext) {
     teamContextLine(teamContext),
     teamGuidanceLine(packet),
     valueSignalLine(packet),
+    ...packet.dependencyRemediation ? [
+      "",
+      "Dependency plan:",
+      `- ${packet.dependencyRemediation.packageManager} \xB7 ${packet.dependencyRemediation.status}`,
+      `- manifests: ${packet.dependencyRemediation.manifestFiles.slice(0, 4).join(", ") || "none found"}`,
+      `- lockfiles: ${packet.dependencyRemediation.lockfiles.slice(0, 3).join(", ") || "none found"}`,
+      `- packages: ${packet.dependencyRemediation.packageSignals.map((item) => item.name).join(", ") || "need advisory/scanner evidence"}`,
+      `- graph proof: ${packet.dependencyRemediation.graphCommands.slice(0, 2).join(", ") || "name the direct/transitive path"}`
+    ] : [],
     "",
     "Rules:",
     ...packet.rules.length > 0 ? packet.rules.slice(0, 8).map((rule) => `- [${rule.enforcement}] ${rule.title}`) : ["- none"],
@@ -42252,10 +43912,10 @@ function valueSignalLine(packet) {
 function writeHookFiles2(repoRoot, files) {
   const written = [];
   for (const file of files) {
-    const targetPath = path19.join(repoRoot, file.path);
-    mkdirSync4(path19.dirname(targetPath), { recursive: true });
-    writeFileSync7(targetPath, file.body);
-    if (file.path.endsWith(".sh")) chmodSync2(targetPath, 493);
+    const targetPath = path20.join(repoRoot, file.path);
+    mkdirSync5(path20.dirname(targetPath), { recursive: true });
+    writeFileSync8(targetPath, file.body);
+    if (file.path.endsWith(".sh")) chmodSync3(targetPath, 493);
     written.push(file.path);
   }
   return written;
@@ -42383,7 +44043,8 @@ function cliServerFreshness() {
   return mcpServerFreshness({
     serverStartedAt: cliStartedAt,
     entrypoint: cliModulePath,
-    mode: "cli"
+    mode: "cli",
+    distribution: connectorDistributionFor(cliModulePath)
   });
 }
 function printJson(value) {
@@ -42407,7 +44068,7 @@ function nextScanStep(cloudSync) {
   if (cloudSync.status === "failed") {
     return `The local scan succeeded, but the web app did not update because cloud sync failed: ${cloudSync.reason}. Fix cloud sync before trusting hosted freshness; refresh local wiki separately with brief.initialize_repo_wiki update: true.`;
   }
-  return "The local scan succeeded, but the web app did not update. Set BRIEF_API_URL, BRIEF_API_KEY, BRIEF_WORKSPACE_ID, and BRIEF_PRIVACY_MODE=cloud-sync-derived to sync scans to Brief. To refresh repo-local wiki docs, ask the agent to call brief.initialize_repo_wiki with update: true.";
+  return "The local scan succeeded, but the web app did not update. Create a browser-authorized connection from the Brief app and restart the agent; approved legacy setups can provide BRIEF_API_URL, BRIEF_API_KEY, and BRIEF_WORKSPACE_ID. To refresh repo-local wiki docs, ask the agent to call brief.initialize_repo_wiki with update: true.";
 }
 function fail(message) {
   process.stderr.write(`${message}