runtrim 0.1.6 → 0.1.8

package/dist-cli/runtrim.js

@@ -25,8 +25,9 @@ import { Chalk } from "chalk";
 import ora from "ora";
 import prompts from "prompts";
 import clipboard from "clipboardy";
-import fs9 from "fs";
-import path9 from "path";
+import fs10 from "fs";
+import path10 from "path";
+import os3 from "os";
 import { execa as execa3 } from "execa";
 
 // src/lib/runtrim-config.ts
@@ -1731,6 +1732,16 @@ var SyncRunSchema = z2.object({
   localId: z2.string(),
   task: z2.string(),
   status: z2.string(),
+  // Bridge Mode optional fields
+  goal: z2.string().optional(),
+  allowedScope: z2.array(z2.string()).optional(),
+  forbiddenScope: z2.array(z2.string()).optional(),
+  stopConditions: z2.array(z2.string()).optional(),
+  memoryUsed: z2.boolean().optional(),
+  memorySummary: z2.string().optional(),
+  tokenBudget: z2.number().optional(),
+  scopeDriftStatus: z2.string().optional(),
+  reportSummary: z2.string().optional(),
   createdAt: z2.string(),
   evaluatedAt: z2.string().nullable(),
   riskBefore: z2.string().nullable(),
@@ -1847,7 +1858,7 @@ function buildSyncPayload(input) {
   );
   const memoryNextSafePrompt = readSection(memoryMarkdown, "Next safe prompt");
   const mappedRuns = runs.slice(0, 200).map((run) => {
-    var _a3, _b2, _c2, _d2, _e2, _f2, _g2, _h2, _i2, _j2, _k2, _l2, _m2, _n2, _o2, _p2, _q2, _r2, _s2, _t2, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I;
+    var _a3, _b2, _c2, _d2, _e2, _f2, _g2, _h2, _i2, _j2, _k2, _l2, _m2, _n2, _o2, _p2, _q2, _r2, _s2, _t2, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I, _J, _K, _L, _M, _N, _O, _P, _Q, _R, _S, _T, _U, _V, _W, _X, _Y, _Z, __;
     const tokens = Math.round(parseEstimatedNumber(String(run.contract.estimatedTokensTrimmed)));
     const dollars = estimateSavingsFromTokens(tokens);
     const status = (_b2 = (_a3 = run.evaluation) == null ? void 0 : _a3.status) != null ? _b2 : run.status;
@@ -1882,7 +1893,17 @@ function buildSyncPayload(input) {
       nextSafePrompt: (_I = (_H = (_G = (_D = (_B = (_z = run.evaluation) == null ? void 0 : _z.nextPrompt) != null ? _B : (_A = run.evaluation) == null ? void 0 : _A.nextSafePrompt) != null ? _D : (_C = run.evaluation) == null ? void 0 : _C.nextGuardedPrompt) != null ? _G : (_F = (_E = run.contract) == null ? void 0 : _E.splitReport) == null ? void 0 : _F.nextSafePrompt) != null ? _H : fallbackNextPrompt) != null ? _I : null,
       latestPrompt: latestPromptText,
       continuationPrompt: continuationPromptText,
-      fallbackNextPrompt
+      fallbackNextPrompt,
+      // Bridge Mode fields
+      goal: ((_K = (_J = run.contract) == null ? void 0 : _J.contract) == null ? void 0 : _K.cleanedObjective) || void 0,
+      allowedScope: ((_N = (_M = (_L = run.contract) == null ? void 0 : _L.contract) == null ? void 0 : _M.relevantScope) == null ? void 0 : _N.length) ? run.contract.contract.relevantScope : void 0,
+      forbiddenScope: ((_Q = (_P = (_O = run.contract) == null ? void 0 : _O.contract) == null ? void 0 : _P.forbiddenScope) == null ? void 0 : _Q.length) ? run.contract.contract.forbiddenScope : void 0,
+      stopConditions: ((_T = (_S = (_R = run.contract) == null ? void 0 : _R.contract) == null ? void 0 : _S.stopRules) == null ? void 0 : _T.length) ? run.contract.contract.stopRules : void 0,
+      memoryUsed: (_U = run.memoryUsed) != null ? _U : void 0,
+      memorySummary: (_X = (_W = run.memorySummary) != null ? _W : (_V = run.evaluation) == null ? void 0 : _V.memorySummary) != null ? _X : void 0,
+      tokenBudget: (_Y = run.tokenBudget) != null ? _Y : void 0,
+      scopeDriftStatus: (_Z = run.scopeDriftStatus) != null ? _Z : void 0,
+      reportSummary: (__ = run.reportSummary) != null ? __ : void 0
     };
   });
   const payload = {
@@ -1921,6 +1942,253 @@ function buildSyncPayload(input) {
   return SyncPayloadSchema.parse(payload);
 }
 
+// src/lib/bridge.ts
+import fs7 from "fs";
+import path7 from "path";
+var BRIDGE_START = "<!-- RUNTRIM_BRIDGE_START -->";
+var BRIDGE_END = "<!-- RUNTRIM_BRIDGE_END -->";
+var BRIDGE_BLOCK = `
+${BRIDGE_START}
+Before editing code, read RUNTRIM.md and .runtrim/contracts/latest.md.
+Stay inside the active scoped contract.
+Do not touch forbidden files or unrelated systems.
+If scope expands, stop and ask for a new RunTrim run.
+After editing, run: runtrim finish
+${BRIDGE_END}
+`;
+var TOKEN_BUDGET_MAP = {
+  low: 1e4,
+  medium: 25e3,
+  high: 4e4,
+  critical: 5e4
+};
+function deriveBridgeContext(task, contract, recentRuns, projectName) {
+  var _a2, _b, _c, _d, _e, _f, _g;
+  const c = contract.contract;
+  const riskLevel = (_a2 = contract.wasteRiskAfter) != null ? _a2 : "medium";
+  const tokenBudget = (_b = TOKEN_BUDGET_MAP[riskLevel]) != null ? _b : 25e3;
+  const stopConditions = [
+    ...(_c = c.stopRules) != null ? _c : [],
+    ...((_d = c.whenToAsk) != null ? _d : []).map((s) => `Stop if: ${s}`)
+  ];
+  const verificationSteps = (_e = c.successCriteria) != null ? _e : [];
+  const lines = recentRuns.slice(0, 3).map((r) => {
+    const day = new Date(r.createdAt).toLocaleDateString("en-US", {
+      month: "short",
+      day: "numeric"
+    });
+    return `- ${r.task} (${r.status}, ${day})`;
+  });
+  const memoryContext = lines.length > 0 ? `Recent runs:
+${lines.join("\n")}` : "No prior runs. This is the first run for this project.";
+  return {
+    task,
+    goal: c.cleanedObjective || task,
+    riskLevel,
+    tokenBudget,
+    allowedScope: (_f = c.relevantScope) != null ? _f : [],
+    forbiddenScope: (_g = c.forbiddenScope) != null ? _g : [],
+    stopConditions,
+    verificationSteps,
+    memoryContext,
+    projectName
+  };
+}
+function writeContractFile(ctx, cwd = process.cwd()) {
+  const dir = path7.join(getConfigDir(cwd), "contracts");
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const scopeLines = ctx.allowedScope.length > 0 ? ctx.allowedScope.map((s) => `- ${s}`) : ["- Scope not explicitly defined. Stay close to the task description."];
+  const forbidLines = ctx.forbiddenScope.length > 0 ? ctx.forbiddenScope.map((s) => `- ${s}`) : ["- .env* files", "- auth logic", "- database schema / migrations", "- billing and payment logic"];
+  const stopLines = ctx.stopConditions.length > 0 ? ctx.stopConditions.map((s) => `- ${s}`) : [
+    "- Stop if scope must expand beyond the task.",
+    "- Stop if a forbidden area needs to be touched.",
+    "- Stop if more than 5 files require changes."
+  ];
+  const verifyLines = ctx.verificationSteps.length > 0 ? ctx.verificationSteps.map((s) => `- ${s}`) : ["- Verify the behavior described in the task.", "- Check no unrelated files changed."];
+  const lines = [
+    "# RunTrim Active Contract",
+    "",
+    `Task: ${ctx.task}`,
+    `Goal: ${ctx.goal}`,
+    `Risk: ${ctx.riskLevel}`,
+    `Token budget: ~${ctx.tokenBudget.toLocaleString()}`,
+    `Created: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    "",
+    "## Allowed scope",
+    ...scopeLines,
+    "",
+    "## Forbidden scope",
+    ...forbidLines,
+    "",
+    "## Stop conditions",
+    ...stopLines,
+    "",
+    "## Verification steps",
+    ...verifyLines,
+    "",
+    "---",
+    "Generated by RunTrim Bridge. Do not edit manually."
+  ];
+  fs7.writeFileSync(path7.join(dir, "latest.md"), lines.join("\n"), "utf-8");
+}
+function writeMemoryFile(ctx, cwd = process.cwd()) {
+  const dir = path7.join(getConfigDir(cwd), "memory");
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const noTouchLines = ctx.forbiddenScope.length > 0 ? ctx.forbiddenScope.map((s) => `- ${s}`) : ["- .env files", "- auth logic", "- database schema", "- billing and payment logic"];
+  const scopeLines = ctx.allowedScope.length > 0 ? ctx.allowedScope.map((s) => `- ${s}`) : ["- Defined in .runtrim/contracts/latest.md"];
+  const lines = [
+    "# RunTrim Memory Pack",
+    "",
+    `Project: ${ctx.projectName}`,
+    `Current task: ${ctx.task}`,
+    `Updated: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    "",
+    "## Context",
+    ctx.memoryContext,
+    "",
+    "## Do not touch",
+    ...noTouchLines,
+    "",
+    "## Active task scope",
+    ...scopeLines,
+    "",
+    "---",
+    "Generated by RunTrim Bridge. Do not edit manually."
+  ];
+  fs7.writeFileSync(path7.join(dir, "current.md"), lines.join("\n"), "utf-8");
+}
+function writeBridgeInstructions(cwd = process.cwd()) {
+  const dir = path7.join(getConfigDir(cwd), "bridge");
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const lines = [
+    "# RunTrim Agent Instructions",
+    "",
+    "You are operating inside a RunTrim-guarded session.",
+    "",
+    "## Before editing",
+    "",
+    "Read these files first:",
+    "- RUNTRIM.md",
+    "- .runtrim/contracts/latest.md",
+    "- .runtrim/memory/current.md",
+    "",
+    "## During editing",
+    "",
+    "- Stay within the allowed scope defined in the contract.",
+    "- If a change requires touching a forbidden area, STOP and tell the user.",
+    "- Make minimal, targeted changes only.",
+    "- Do not refactor, rename, or reorganize outside the task scope.",
+    "- Do not add console.log statements or debug artifacts.",
+    "- Do not install new dependencies without explicit approval.",
+    "",
+    "## After editing",
+    "",
+    "- Tell the user which files you changed and why.",
+    "- The user will run: runtrim finish",
+    "- Do not run runtrim commands yourself unless explicitly asked.",
+    "",
+    "---",
+    "Generated by RunTrim Bridge. Do not edit manually."
+  ];
+  fs7.writeFileSync(path7.join(dir, "agent-instructions.md"), lines.join("\n"), "utf-8");
+}
+function writeRootProtocolFile(ctx, cwd = process.cwd()) {
+  const lines = [
+    "# RunTrim Protocol",
+    "",
+    "This project is guarded by RunTrim Bridge Mode.",
+    "",
+    "## Active session",
+    "",
+    `Task: ${ctx.task}`,
+    `Risk: ${ctx.riskLevel}`,
+    `Token budget: ~${ctx.tokenBudget.toLocaleString()}`,
+    "",
+    "## Before editing",
+    "",
+    "Read the active contract before making any changes:",
+    "",
+    "```",
+    ".runtrim/contracts/latest.md",
+    "```",
+    "",
+    "## Rules",
+    "",
+    "- Stay inside the active scoped contract.",
+    "- Do not touch forbidden files or unrelated systems.",
+    "- If scope must expand, stop and ask the user to start a new RunTrim session.",
+    "- Keep changes minimal and targeted.",
+    "- Do not refactor, reorganize, or rename outside the direct task.",
+    "",
+    "## After editing",
+    "",
+    "The user will run: runtrim finish",
+    "",
+    "Do not attempt to run runtrim commands yourself.",
+    "",
+    "---",
+    `Generated by RunTrim Bridge. Updated: ${(/* @__PURE__ */ new Date()).toISOString()}`
+  ];
+  fs7.writeFileSync(path7.join(cwd, "RUNTRIM.md"), lines.join("\n"), "utf-8");
+}
+function appendBridgeBlock(filePath) {
+  if (!fs7.existsSync(filePath)) return false;
+  const content = fs7.readFileSync(filePath, "utf-8");
+  if (content.includes(BRIDGE_START)) return false;
+  fs7.writeFileSync(filePath, content.trimEnd() + "\n" + BRIDGE_BLOCK, "utf-8");
+  return true;
+}
+function writeBridgeFiles(ctx, cwd) {
+  const written = [];
+  const managedPaths = [];
+  const track = (relativePath, label) => {
+    managedPaths.push(relativePath);
+    written.push(label != null ? label : relativePath);
+  };
+  writeRootProtocolFile(ctx, cwd);
+  track("RUNTRIM.md");
+  writeContractFile(ctx, cwd);
+  track(".runtrim/contracts/latest.md");
+  writeMemoryFile(ctx, cwd);
+  track(".runtrim/memory/current.md");
+  writeBridgeInstructions(cwd);
+  track(".runtrim/bridge/agent-instructions.md");
+  if (appendBridgeBlock(path7.join(cwd, "CLAUDE.md"))) track("CLAUDE.md", "CLAUDE.md (bridge block appended)");
+  if (appendBridgeBlock(path7.join(cwd, "AGENTS.md"))) track("AGENTS.md", "AGENTS.md (bridge block appended)");
+  return { written, managedPaths };
+}
+function buildBridgePrompt(contractText, ctx) {
+  const allowedList = ctx.allowedScope.length > 0 ? ctx.allowedScope.map((s) => `  - ${s}`).join("\n") : "  - Defined in .runtrim/contracts/latest.md";
+  const forbidList = ctx.forbiddenScope.length > 0 ? ctx.forbiddenScope.map((s) => `  - ${s}`).join("\n") : "  - .env files, auth, database schema, billing, payments";
+  const stopList = ctx.stopConditions.length > 0 ? ctx.stopConditions.slice(0, 4).map((s) => `  - ${s}`).join("\n") : "  - Stop if more than 5 files need changes.\n  - Stop if a forbidden area must be touched.";
+  const header = [
+    "RUNTRIM BRIDGE SESSION",
+    `Task: ${ctx.task}`,
+    `Risk: ${ctx.riskLevel}  |  Token budget: ~${ctx.tokenBudget.toLocaleString()}`,
+    "",
+    "ALLOWED SCOPE",
+    allowedList,
+    "",
+    "FORBIDDEN SCOPE",
+    forbidList,
+    "",
+    "STOP CONDITIONS",
+    stopList,
+    ""
+  ].join("\n");
+  const footer = [
+    "",
+    "RULES",
+    "  - Read RUNTRIM.md and .runtrim/contracts/latest.md before touching any file.",
+    "  - Inspect first. List relevant files before opening them.",
+    "  - Make the minimal change required. No unrelated refactors.",
+    "  - If scope must expand, stop immediately and tell the user.",
+    "  - After editing, tell the user which files changed. They will run: runtrim finish",
+    ""
+  ].join("\n");
+  return header + contractText + footer;
+}
+
 // src/lib/run-watch.ts
 function normalizeScopeKeywords2(scope) {
   var _a2;
@@ -2017,18 +2285,18 @@ function evaluateWatchState(input) {
 }
 
 // src/lib/local-panel-server.ts
-import fs8 from "fs";
+import fs9 from "fs";
 import http from "http";
 import net from "net";
 import os2 from "os";
-import path8 from "path";
+import path9 from "path";
 import { spawn } from "child_process";
 
 // src/lib/global-registry.ts
 import crypto from "crypto";
-import fs7 from "fs";
+import fs8 from "fs";
 import os from "os";
-import path7 from "path";
+import path8 from "path";
 import { execa as execa2 } from "execa";
 var DEFAULT_REGISTRY = {
   version: 1,
@@ -2040,23 +2308,23 @@ var DEFAULT_REGISTRY = {
   }
 };
 function normalizeRepoPath(input) {
-  const resolved = path7.resolve(input);
+  const resolved = path8.resolve(input);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function hashValue(value) {
   return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
 }
 function getGlobalRunTrimDir() {
-  return path7.join(os.homedir(), ".runtrim");
+  return path8.join(os.homedir(), ".runtrim");
 }
 function getGlobalRegistryPath() {
-  return path7.join(getGlobalRunTrimDir(), "global.json");
+  return path8.join(getGlobalRunTrimDir(), "global.json");
 }
 function loadGlobalRegistry() {
   const registryPath = getGlobalRegistryPath();
-  if (!fs7.existsSync(registryPath)) return __spreadValues({}, DEFAULT_REGISTRY);
+  if (!fs8.existsSync(registryPath)) return __spreadValues({}, DEFAULT_REGISTRY);
   try {
-    const raw = JSON.parse(fs7.readFileSync(registryPath, "utf-8"));
+    const raw = JSON.parse(fs8.readFileSync(registryPath, "utf-8"));
     return {
       version: 1,
       plan: raw.plan === "free" ? "free" : "free",
@@ -2079,8 +2347,8 @@ function loadGlobalRegistry() {
 }
 function saveGlobalRegistry(registry) {
   const dir = getGlobalRunTrimDir();
-  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
-  fs7.writeFileSync(getGlobalRegistryPath(), JSON.stringify(registry, null, 2), "utf-8");
+  if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
+  fs8.writeFileSync(getGlobalRegistryPath(), JSON.stringify(registry, null, 2), "utf-8");
 }
 async function getCurrentRepoIdentity(cwd = process.cwd()) {
   const normalizedPath = normalizeRepoPath(cwd);
@@ -2098,7 +2366,7 @@ async function getCurrentRepoIdentity(cwd = process.cwd()) {
   const idPrefix = gitRemote ? "remote" : "path";
   return {
     id: `${idPrefix}_${hashValue(idSeed)}`,
-    name: path7.basename(normalizedPath),
+    name: path8.basename(normalizedPath),
     path: normalizedPath,
     gitRemote
   };
@@ -2189,9 +2457,9 @@ function truncate2(text, max = 96) {
   return `${text.slice(0, max - 3)}...`;
 }
 function readMemory2(cwd) {
-  const p = path8.join(getConfigDir(cwd), "memory.md");
-  if (!fs8.existsSync(p)) return null;
-  return fs8.readFileSync(p, "utf-8");
+  const p = path9.join(getConfigDir(cwd), "memory.md");
+  if (!fs9.existsSync(p)) return null;
+  return fs9.readFileSync(p, "utf-8");
 }
 function parseMemorySection(memory, title) {
   if (!memory) return "";
@@ -2215,13 +2483,13 @@ function readProjectName(cwd) {
     audit = null;
   }
   if (audit == null ? void 0 : audit.projectName) return audit.projectName;
-  const pkgPath = path8.join(cwd, "package.json");
-  if (!fs8.existsSync(pkgPath)) return path8.basename(cwd);
+  const pkgPath = path9.join(cwd, "package.json");
+  if (!fs9.existsSync(pkgPath)) return path9.basename(cwd);
   try {
-    const pkg = JSON.parse(fs8.readFileSync(pkgPath, "utf-8"));
-    return ((_a2 = pkg.name) == null ? void 0 : _a2.trim()) || path8.basename(cwd);
+    const pkg = JSON.parse(fs9.readFileSync(pkgPath, "utf-8"));
+    return ((_a2 = pkg.name) == null ? void 0 : _a2.trim()) || path9.basename(cwd);
   } catch (e) {
-    return path8.basename(cwd);
+    return path9.basename(cwd);
   }
 }
 function isoOrEmpty(value) {
@@ -2912,7 +3180,7 @@ async function getPanelState(cwd, monitorMode) {
     warnings,
     initialized,
     projectName: readProjectName(cwd),
-    repoPath: path8.resolve(cwd),
+    repoPath: path9.resolve(cwd),
     mode: "local",
     monitor: monitorMode,
     stack: (_a2 = projectAudit == null ? void 0 : projectAudit.detectedStack) != null ? _a2 : [],
@@ -2930,7 +3198,7 @@ async function getPanelState(cwd, monitorMode) {
       changedFilesCount: (_k = (_j = (_h = (_g = latest.evaluation) == null ? void 0 : _g.changedFiles) == null ? void 0 : _h.length) != null ? _j : (_i = latest.watchChangedFiles) == null ? void 0 : _i.length) != null ? _k : 0,
       riskLabel: ((_o = (_n = (_l = latest.evaluation) == null ? void 0 : _l.scopeDriftRisk) != null ? _n : (_m = latest.audit) == null ? void 0 : _m.wasteRiskBefore) != null ? _o : "n/a").replace(/_/g, " "),
       nextSafeAction: (_q = (_p = latest.evaluation) == null ? void 0 : _p.nextSafeAction) != null ? _q : "Run runtrim check to evaluate latest run.",
-      promptState: ((_r = latest.contract) == null ? void 0 : _r.isBlocked) ? "split required prompt" : fs8.existsSync(path8.join(getConfigDir(cwd), "latest-prompt.md")) ? "guarded prompt available" : "no continuation prompt yet",
+      promptState: ((_r = latest.contract) == null ? void 0 : _r.isBlocked) ? "split required prompt" : fs9.existsSync(path9.join(getConfigDir(cwd), "latest-prompt.md")) ? "guarded prompt available" : "no continuation prompt yet",
       missingProofCount: (_u = (_t = (_s = latest.evaluation) == null ? void 0 : _s.missingProofItems) == null ? void 0 : _t.length) != null ? _u : 0,
       missingProofLabel: ((_w = (_v = latest.evaluation) == null ? void 0 : _v.missingProofItems) == null ? void 0 : _w.length) ? `${latest.evaluation.missingProofItems.length} verification item(s) still missing` : "No missing proof recorded",
       proofState: ((_y = (_x = latest.evaluation) == null ? void 0 : _x.missingProofItems) == null ? void 0 : _y.length) && latest.evaluation.missingProofItems.length > 0 ? "Proof pending" : latest.status === "guarded" ? "Needs check" : "Proof captured",
@@ -3038,8 +3306,8 @@ async function startLocalPanelServer(options = {}) {
             error: "partial_state",
             warnings: ["state_route_failed"],
             initialized: false,
-            projectName: path8.basename(cwd),
-            repoPath: path8.resolve(cwd),
+            projectName: path9.basename(cwd),
+            repoPath: path9.resolve(cwd),
             mode: "local",
             monitor,
             stack: [],
@@ -3221,29 +3489,29 @@ function resolveCliLauncherPath() {
   var _a2;
   const invokedPath = (_a2 = process.argv[1]) == null ? void 0 : _a2.trim();
   if (invokedPath) {
-    const absolute = path9.resolve(invokedPath);
-    if (fs9.existsSync(absolute)) return absolute;
+    const absolute = path10.resolve(invokedPath);
+    if (fs10.existsSync(absolute)) return absolute;
   }
-  const localFallback = path9.resolve(process.cwd(), "dist-cli", "runtrim.cjs");
-  if (fs9.existsSync(localFallback)) return localFallback;
+  const localFallback = path10.resolve(process.cwd(), "dist-cli", "runtrim.cjs");
+  if (fs10.existsSync(localFallback)) return localFallback;
   return null;
 }
 function resolveCliRuntimeDir() {
   const launcher = resolveCliLauncherPath();
-  if (launcher) return path9.dirname(launcher);
+  if (launcher) return path10.dirname(launcher);
   return process.cwd();
 }
 function resolveCliVersion() {
   var _a2, _b;
   const cliDir = resolveCliRuntimeDir();
   const candidates = [
-    path9.resolve(cliDir, "..", "package.json"),
-    path9.resolve(cliDir, "package.json"),
-    path9.resolve(process.cwd(), "package.json")
+    path10.resolve(cliDir, "..", "package.json"),
+    path10.resolve(cliDir, "package.json"),
+    path10.resolve(process.cwd(), "package.json")
   ];
   for (const packageJsonPath of candidates) {
     try {
-      const raw = fs9.readFileSync(packageJsonPath, "utf-8");
+      const raw = fs10.readFileSync(packageJsonPath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.version && parsed.version.trim()) return parsed.version.trim();
     } catch (e) {
@@ -3284,13 +3552,13 @@ function parseCommandString(input) {
 function resolvePromptPath(config, cwd) {
   var _a2;
   const configured = ((_a2 = config.lastPromptPath) == null ? void 0 : _a2.trim()) || ".runtrim/latest-prompt.md";
-  return path9.isAbsolute(configured) ? configured : path9.join(cwd, configured);
+  return path10.isAbsolute(configured) ? configured : path10.join(cwd, configured);
 }
 function writeLatestPromptFile(content, config, cwd) {
   const promptPath = resolvePromptPath(config, cwd);
-  const dir = path9.dirname(promptPath);
-  if (!fs9.existsSync(dir)) fs9.mkdirSync(dir, { recursive: true });
-  fs9.writeFileSync(promptPath, content, "utf-8");
+  const dir = path10.dirname(promptPath);
+  if (!fs10.existsSync(dir)) fs10.mkdirSync(dir, { recursive: true });
+  fs10.writeFileSync(promptPath, content, "utf-8");
   return promptPath;
 }
 async function openInEditor(editorValue, config, filePath, cwd) {
@@ -3342,14 +3610,6 @@ async function copyToClipboardSafe(value) {
     return false;
   }
 }
-function resolveSyncEndpoint(dashboardUrl) {
-  try {
-    const u = new URL(dashboardUrl);
-    return `${u.origin}/api/sync`;
-  } catch (e) {
-    return "http://localhost:3000/api/sync";
-  }
-}
 function parseMemorySection2(memory, title) {
   const lines = memory.split(/\r?\n/);
   const idx = lines.findIndex((line) => line.trim().toLowerCase() === `${title.toLowerCase()}:`);
@@ -3470,7 +3730,7 @@ function normalizeContinuationAgent(value, fallback) {
   return "custom";
 }
 function resolveContinuationPath(cwd) {
-  return path9.join(getConfigDir(cwd), "continuation-prompt.md");
+  return path10.join(getConfigDir(cwd), "continuation-prompt.md");
 }
 function extractMemoryValue(memory, label) {
   var _a2;
@@ -3636,8 +3896,8 @@ async function initializeRunTrim(cwd, options = {}) {
   spinner.stop();
   const configDir = getConfigDir(cwd);
   const runsDir = getRunsDir(cwd);
-  if (!fs9.existsSync(configDir)) fs9.mkdirSync(configDir, { recursive: true });
-  if (!fs9.existsSync(runsDir)) fs9.mkdirSync(runsDir, { recursive: true });
+  if (!fs10.existsSync(configDir)) fs10.mkdirSync(configDir, { recursive: true });
+  if (!fs10.existsSync(runsDir)) fs10.mkdirSync(runsDir, { recursive: true });
   const existingConfig = hadConfig ? loadConfig(cwd) : null;
   const baseConfig = __spreadValues(__spreadValues({}, DEFAULT_CONFIG), detectProjectInfo(cwd));
   const nextConfig = options.refresh && existingConfig ? __spreadValues({}, existingConfig) : baseConfig;
@@ -3648,20 +3908,20 @@ async function initializeRunTrim(cwd, options = {}) {
   saveConfig(nextConfig, cwd);
   writeProjectAudit(baseline, cwd);
   writeRules(baseline, cwd);
-  const memoryPath = path9.join(getConfigDir(cwd), "memory.md");
+  const memoryPath = path10.join(getConfigDir(cwd), "memory.md");
   const hasRuns = loadAllRuns(cwd).length > 0;
   if (hasRuns) {
     const latest = loadLatestRun(cwd);
     if (latest) writeMemoryFromRuns(latest, loadAllRuns(cwd), nextConfig, cwd);
   } else {
-    fs9.writeFileSync(memoryPath, buildBaselineMemoryMarkdown(baseline), "utf-8");
+    fs10.writeFileSync(memoryPath, buildBaselineMemoryMarkdown(baseline), "utf-8");
   }
   ensureStarterPromptIfMissing(cwd);
-  const gitignorePath = path9.join(cwd, ".gitignore");
-  if (fs9.existsSync(gitignorePath)) {
-    const content = fs9.readFileSync(gitignorePath, "utf-8");
+  const gitignorePath = path10.join(cwd, ".gitignore");
+  if (fs10.existsSync(gitignorePath)) {
+    const content = fs10.readFileSync(gitignorePath, "utf-8");
     if (!content.includes(".runtrim/runs")) {
-      fs9.appendFileSync(gitignorePath, "\n# RunTrim run history\n.runtrim/runs/\n");
+      fs10.appendFileSync(gitignorePath, "\n# RunTrim run history\n.runtrim/runs/\n");
     }
   }
   return { ok: true };
@@ -3758,8 +4018,8 @@ async function runPrepareTask(task, options) {
 }
 async function tryLaunchPanelMonitorDetached(cwd) {
   var _a2, _b;
-  const entry = (_a2 = resolveCliLauncherPath()) != null ? _a2 : path9.resolve(cwd, "dist-cli", "runtrim.cjs");
-  if (!fs9.existsSync(entry)) return false;
+  const entry = (_a2 = resolveCliLauncherPath()) != null ? _a2 : path10.resolve(cwd, "dist-cli", "runtrim.cjs");
+  if (!fs10.existsSync(entry)) return false;
   try {
     const child = execa3(process.execPath, [entry, "panel", "--monitor"], {
       cwd,
@@ -3920,7 +4180,7 @@ program.command("init").description("Initialize RunTrim in the current project")
   if (!initResult.ok) return;
   const baseline = (_a2 = loadProjectAudit(cwd)) != null ? _a2 : performBaselineProjectAudit(cwd, null);
   const scriptNames = Object.keys(baseline.scripts);
-  const starterCreated = fs9.existsSync(path9.join(getConfigDir(cwd), "latest-prompt.md"));
+  const starterCreated = fs10.existsSync(path10.join(getConfigDir(cwd), "latest-prompt.md"));
   console.log(ACCENT.bold("  RunTrim init"));
   console.log("");
   console.log(DIM("  Project detected"));
@@ -4538,8 +4798,8 @@ program.command("run <task>").description("Guard then run configured local agent
     console.log("");
     return;
   }
-  const outputPath = path9.join(getRunsDir(cwd), `${run.id}.output.txt`);
-  fs9.writeFileSync(outputPath, `# stdout
+  const outputPath = path10.join(getRunsDir(cwd), `${run.id}.output.txt`);
+  fs10.writeFileSync(outputPath, `# stdout
 ${stdout}
 
 # stderr
@@ -4616,7 +4876,8 @@ program.command("prepare <task>").description("Prepare a guarded prompt without
     });
   }
 );
-program.command("go <task>").description("Daily shortcut: initialize if needed, prepare a guarded prompt, and show next steps").option("--monitor", "Open local panel monitor in the background (best effort)").action(async (task, options) => {
+program.command("go <task>").description("Bridge Mode: generate a scoped contract, write protocol files, and prepare the guarded prompt").option("--no-clipboard", "Print prompt to terminal instead of copying to clipboard").option("--no-sync", "Skip cloud sync even if a CLI token is configured").option("--no-bridge", "Skip bridge file writing (RUNTRIM.md, contracts, memory)").option("--print", "Always print the prompt to terminal in addition to copying").option("--monitor", "Open local panel monitor in the background (best effort)").action(async (task, options) => {
+  var _a2, _b, _c, _d;
   const cwd = process.cwd();
   const allowed = await ensureRepoAllowedForFree(cwd);
   if (!allowed) return;
@@ -4624,45 +4885,148 @@ program.command("go <task>").description("Daily shortcut: initialize if needed,
     const initResult = await initializeRunTrim(cwd, { allowOverwritePrompt: false });
     if (!initResult.ok) return;
   }
-  const originalLog = console.log;
-  const originalError = console.error;
-  console.log = () => void 0;
-  console.error = () => void 0;
-  try {
-    await runPrepareTask(task, { showHeader: false, copy: true });
-  } finally {
-    console.log = originalLog;
-    console.error = originalError;
-  }
-  if (!configExists(cwd)) return;
   const config = loadConfig(cwd);
-  const promptPath = resolvePromptPath(config, cwd);
-  const promptValue = fs9.existsSync(promptPath) ? fs9.readFileSync(promptPath, "utf-8") : "";
-  const copied = promptValue ? await copyToClipboardSafe(promptValue) : false;
-  if (options.monitor) {
-    void tryLaunchPanelMonitorDetached(cwd);
+  const auditSpinner = oraFactory({ text: "  Auditing task...", color: "blue" }).start();
+  await new Promise((r) => setTimeout(r, 180));
+  const audit = auditTask(task, config, cwd);
+  auditSpinner.stop();
+  const contract = generateContract(task, audit, config);
+  if (contract.isBlocked && contract.splitReport) {
+    const sr = contract.splitReport;
+    updateRun(saveRun(task, audit, contract, cwd).id, { status: "blocked" }, cwd);
+    console.log("");
+    console.log(GO_ACCENT.bold("RunTrim go"));
+    console.log("");
+    console.log(chalk.red.bold("  SPLIT REQUIRED"));
+    console.log("");
+    console.log(DIM("  Task    ") + chalk.white(truncate(task, 60)));
+    console.log(DIM("  Risk    ") + chalk.red("CRITICAL"));
+    console.log("");
+    console.log(DIM("  This task crosses multiple high-risk systems."));
+    console.log(DIM("  Running it in one agent session would cause scope drift and token waste."));
+    console.log("");
+    console.log(DIM("  Detected: ") + chalk.white(sr.detectedSystems.join(", ")));
+    console.log("");
+    for (const step of sr.recommendedSplit) {
+      console.log(DIM("  ") + chalk.white(step));
+    }
+    console.log("");
+    console.log(DIM("  Estimated waste avoided: ") + ACCENT(sr.estimatedWasteAvoided));
+    console.log("");
+    return;
+  }
+  const runs = loadAllRuns(cwd);
+  const projectAudit = loadProjectAudit(cwd);
+  const projectName = (_a2 = projectAudit == null ? void 0 : projectAudit.projectName) != null ? _a2 : path10.basename(cwd);
+  const memoryMarkdown = (() => {
+    try {
+      return readMemory(cwd);
+    } catch (e) {
+      return null;
+    }
+  })();
+  const memoryUsed = Boolean(memoryMarkdown && memoryMarkdown.trim().length > 50);
+  const run = saveRun(task, audit, contract, cwd);
+  updateRun(run.id, {
+    status: "guarded",
+    bridgeMode: true,
+    tokenBudget: deriveBridgeContext(task, contract, runs, projectName).tokenBudget,
+    memoryUsed
+  }, cwd);
+  const bridgeCtx = deriveBridgeContext(task, contract, runs, projectName);
+  let bridgeWritten = [];
+  let bridgeManagedPaths = [];
+  if (options.bridge !== false) {
+    const result = writeBridgeFiles(bridgeCtx, cwd);
+    bridgeWritten = result.written;
+    bridgeManagedPaths = result.managedPaths;
+  }
+  const rawPrompt = contract.contractText;
+  const fullPrompt = options.bridge !== false ? buildBridgePrompt(rawPrompt, bridgeCtx) : rawPrompt;
+  const promptPath = writeLatestPromptFile(fullPrompt, config, cwd);
+  const promptRelative = ".runtrim/latest-prompt.md";
+  if (!bridgeManagedPaths.includes(promptRelative)) {
+    bridgeManagedPaths.push(promptRelative);
+  }
+  const doCopy = options.clipboard !== false;
+  const copied = doCopy ? await copyToClipboardSafe(fullPrompt) : false;
+  if (options.monitor) void tryLaunchPanelMonitorDetached(cwd);
+  updateRun(run.id, { bridgeManagedFiles: bridgeManagedPaths }, cwd);
+  let synced = false;
+  if (options.sync !== false) {
+    const globalAuth = loadGlobalAuth();
+    const rawToken = (_c = (_b = globalAuth == null ? void 0 : globalAuth.token) != null ? _b : config.syncToken) != null ? _c : null;
+    if (rawToken == null ? void 0 : rawToken.startsWith("rt_live_")) {
+      try {
+        const freshRuns = loadAllRuns(cwd);
+        const payload = buildSyncPayload({
+          cwd,
+          projectName,
+          config,
+          projectAudit: projectAudit != null ? projectAudit : null,
+          memoryMarkdown: memoryMarkdown != null ? memoryMarkdown : "",
+          runs: freshRuns
+        });
+        const apiBase = resolveApiBase(config);
+        const r = await fetch(`${apiBase}/api/sync`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${rawToken}` },
+          body: JSON.stringify(payload)
+        });
+        synced = r.ok;
+      } catch (e) {
+      }
+    }
   }
+  const riskColor = (_d = { low: chalk.green, medium: chalk.yellow, high: chalk.hex("#FF8C00"), critical: chalk.red }[bridgeCtx.riskLevel]) != null ? _d : chalk.white;
   console.log("");
   console.log(GO_ACCENT.bold("RunTrim go"));
   console.log("");
   console.log(GO_ACCENT.bold("Task"));
-  console.log(chalk.white(task));
+  console.log(chalk.white("  " + task));
   console.log("");
-  console.log(GO_ACCENT.bold("Guarded prompt"));
-  console.log(copied ? chalk.white("Copied to clipboard.") : DIM("Clipboard unavailable. Prompt saved to .runtrim/latest-prompt.md"));
+  console.log(GO_ACCENT.bold("Memory"));
+  console.log(DIM("  " + (memoryUsed ? `Loaded ${runs.length} prior run${runs.length === 1 ? "" : "s"} and project context.` : "No prior runs. Starting from project context.")));
   console.log("");
-  console.log(GO_ACCENT.bold("Next"));
-  console.log(chalk.white("1. Paste into your preferred coding agent, like Claude, Codex, Cursor, ChatGPT, Kimi, or another agent."));
-  console.log(chalk.white("2. Keep the local panel open:"));
-  console.log(chalk.white("   runtrim panel --monitor"));
-  console.log(chalk.white("3. After edits:"));
-  console.log(chalk.white("   runtrim check"));
+  console.log(GO_ACCENT.bold("Contract"));
+  console.log(DIM("  Risk          ") + riskColor(bridgeCtx.riskLevel));
+  console.log(DIM("  Token budget  ") + chalk.white("~" + bridgeCtx.tokenBudget.toLocaleString()));
+  if (bridgeCtx.allowedScope.length > 0) {
+    console.log(DIM("  Allowed       ") + chalk.white(truncate(bridgeCtx.allowedScope.slice(0, 2).join(", "), 60)));
+  }
+  if (bridgeCtx.forbiddenScope.length > 0) {
+    console.log(DIM("  Forbidden     ") + chalk.white(truncate(bridgeCtx.forbiddenScope.slice(0, 2).join(", "), 60)));
+  }
+  console.log(DIM("  Run saved     ") + chalk.white(`.runtrim/runs/${run.id}.json`));
   console.log("");
-  console.log(GO_ACCENT.bold("Why this helps"));
-  console.log(DIM("RunTrim keeps each run scoped, remembered, and easier to continue."));
+  if (bridgeWritten.length > 0) {
+    console.log(GO_ACCENT.bold("Bridge"));
+    for (const f of bridgeWritten) {
+      console.log(DIM("  ") + chalk.white(f));
+    }
+    console.log("");
+  }
+  if (options.sync !== false) {
+    console.log(GO_ACCENT.bold("Cloud sync"));
+    console.log(DIM("  ") + (synced ? chalk.white("Synced.") : DIM("Skipped. Run runtrim login to connect your dashboard.")));
+    console.log("");
+  }
+  console.log(GO_ACCENT.bold("Prompt"));
+  if (copied) {
+    console.log(chalk.white("  Copied to clipboard."));
+  } else if (!doCopy) {
+    console.log(chalk.white("  Saved to: " + promptPath));
+  } else {
+    console.log(DIM("  Clipboard unavailable. Saved to: " + promptPath));
+  }
+  if (options.print) {
+    console.log("");
+    console.log(fullPrompt);
+  }
   console.log("");
-  console.log(GO_ACCENT.bold("Need more control?"));
-  console.log(chalk.white("Run `runtrim --help` for panel, check, memory and continuation commands."));
+  console.log(GO_ACCENT.bold("Next"));
+  console.log(chalk.white("  Paste the guarded prompt into Claude Code, Codex, Cursor, or your agent."));
+  console.log(chalk.white("  After edits are done, run: runtrim finish"));
   console.log("");
 });
 program.command("check").description("Check the latest run and evaluate agent output").option("--json", "Print machine-readable check summary").action(async (options) => {
@@ -4828,80 +5192,6 @@ program.command("check").description("Check the latest run and evaluate agent ou
   console.log(chalk.white(checkSummary.nextSafeAction));
   console.log("");
 });
-program.command("sync").description("Sync local RunTrim metadata to dashboard").action(async () => {
-  var _a2, _b;
-  const cwd = process.cwd();
-  const allowed = await ensureRepoAllowedForFree(cwd);
-  if (!allowed) return;
-  const cfg = configExists(cwd) ? loadConfig(cwd) : DEFAULT_CONFIG;
-  if (!configExists(cwd)) {
-    console.log(chalk.yellow("  No config found. Run: runtrim init"));
-    console.log("");
-    return;
-  }
-  const config = loadConfig(cwd);
-  if (!config.syncToken) {
-    console.log(chalk.yellow("  Sync token missing. Run: runtrim auth set <token>"));
-    console.log("");
-    return;
-  }
-  const runs = loadAllRuns(cwd);
-  const latestRun = (_a2 = runs[0]) != null ? _a2 : null;
-  const audit = loadProjectAudit(cwd);
-  const inferredProjectName = (audit == null ? void 0 : audit.projectName) || path9.basename(cwd);
-  let memory = readMemory(cwd);
-  if (!memory) {
-    if (latestRun) {
-      memory = writeMemoryFromRuns(latestRun, runs, config, cwd);
-    } else if (audit) {
-      memory = buildBaselineMemoryMarkdown(audit);
-      fs9.writeFileSync(path9.join(getConfigDir(cwd), "memory.md"), memory, "utf-8");
-    } else {
-      memory = "RunTrim Project Memory\n\nCurrent state:\nNo local runs yet.\n";
-    }
-  }
-  const payload = buildSyncPayload({
-    cwd,
-    projectName: inferredProjectName,
-    config,
-    projectAudit: audit,
-    memoryMarkdown: memory,
-    runs
-  });
-  const endpoint = resolveSyncEndpoint(config.dashboardUrl);
-  try {
-    const response = await fetch(endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-runtrim-sync-token": config.syncToken
-      },
-      body: JSON.stringify(payload)
-    });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) {
-      console.log(chalk.red("  Sync failed: " + (body.error || `HTTP ${response.status}`)));
-      console.log(DIM("  Endpoint: ") + chalk.white(endpoint));
-      if (Array.isArray(body.missing) && body.missing.length > 0) {
-        console.log(DIM("  Missing:  ") + chalk.white(body.missing.join(", ")));
-      }
-      console.log("");
-      return;
-    }
-    const syncedRuns = (_b = body.syncedRuns) != null ? _b : payload.runs.length;
-    console.log(ACCENT.bold(`  Synced project memory and ${syncedRuns} runs.`));
-    console.log(DIM("  Open dashboard: ") + chalk.white(config.dashboardUrl));
-    console.log("");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Unknown network error";
-    console.log(chalk.red("  Sync failed: " + message));
-    console.log(DIM("  Endpoint: ") + chalk.white(endpoint));
-    console.log(
-      DIM("  If your dashboard backend is offline, start it first and ensure env vars are set.")
-    );
-    console.log("");
-  }
-});
 program.command("audit").description("Run baseline project audit and refresh local baseline files").action(() => {
   const cwd = process.cwd();
   if (!configExists(cwd)) {
@@ -4925,7 +5215,7 @@ program.command("audit").description("Run baseline project audit and refresh loc
     const latest = loadLatestRun(cwd);
     if (latest) writeMemoryFromRuns(latest, runs, nextConfig, cwd);
   } else {
-    fs9.writeFileSync(path9.join(getConfigDir(cwd), "memory.md"), buildBaselineMemoryMarkdown(baseline), "utf-8");
+    fs10.writeFileSync(path10.join(getConfigDir(cwd), "memory.md"), buildBaselineMemoryMarkdown(baseline), "utf-8");
   }
   console.log("");
   console.log(BOLD("RunTrim") + DIM("  audit"));
@@ -5057,15 +5347,15 @@ program.command("memory").description("Show project memory and latest next safe
   console.log("");
   const config = configExists(cwd) ? loadConfig(cwd) : DEFAULT_CONFIG;
   const audit = (_a2 = loadProjectAudit(cwd)) != null ? _a2 : performBaselineProjectAudit(cwd, null);
-  const memoryPath = path9.join(getConfigDir(cwd), "memory.md");
+  const memoryPath = path10.join(getConfigDir(cwd), "memory.md");
   const latestRun = loadLatestRun(cwd);
   if (!latestRun) {
     let memory2 = readMemory(cwd);
     if (!memory2) {
-      const memoryDir = path9.dirname(memoryPath);
-      if (!fs9.existsSync(memoryDir)) fs9.mkdirSync(memoryDir, { recursive: true });
+      const memoryDir = path10.dirname(memoryPath);
+      if (!fs10.existsSync(memoryDir)) fs10.mkdirSync(memoryDir, { recursive: true });
       memory2 = buildBaselineMemoryMarkdown(audit);
-      fs9.writeFileSync(memoryPath, memory2, "utf-8");
+      fs10.writeFileSync(memoryPath, memory2, "utf-8");
     }
     const baselinePrompt = 'runtrim go "your task"';
     if (options.prompt) {
@@ -5206,13 +5496,13 @@ program.command("continue").description("Create a safe continuation prompt from
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
   const continuationPath = resolveContinuationPath(cwd);
   const latestPromptPath = resolvePromptPath(config, cwd);
-  const latestPrompt = fs9.existsSync(latestPromptPath) ? fs9.readFileSync(latestPromptPath, "utf-8").trim() : "";
+  const latestPrompt = fs10.existsSync(latestPromptPath) ? fs10.readFileSync(latestPromptPath, "utf-8").trim() : "";
   let memory = readMemory(cwd);
   if (!memory) {
     if (latestRun) memory = writeMemoryFromRuns(latestRun, allRuns, config, cwd);
     else memory = buildBaselineMemoryMarkdown(audit);
   }
-  const projectName = audit.projectName || path9.basename(cwd);
+  const projectName = audit.projectName || path10.basename(cwd);
   const stackLine = audit.detectedStack.length > 0 ? audit.detectedStack.join(", ") : "unknown";
   const diffFiles = dedupeFiles(await getGitDiff(cwd));
   const changedFiles = ((_c = (_b = latestRun == null ? void 0 : latestRun.evaluation) == null ? void 0 : _b.changedFiles) == null ? void 0 : _c.length) ? dedupeFiles(latestRun.evaluation.changedFiles) : diffFiles;
@@ -5388,13 +5678,13 @@ program.command("continue").description("Create a safe continuation prompt from
     promptLines.push("");
   }
   const continuationPrompt = promptLines.join("\n");
-  const continuationDir = path9.dirname(continuationPath);
-  if (!fs9.existsSync(continuationDir)) fs9.mkdirSync(continuationDir, { recursive: true });
-  fs9.writeFileSync(continuationPath, continuationPrompt, "utf-8");
+  const continuationDir = path10.dirname(continuationPath);
+  if (!fs10.existsSync(continuationDir)) fs10.mkdirSync(continuationDir, { recursive: true });
+  fs10.writeFileSync(continuationPath, continuationPrompt, "utf-8");
   const copied = await copyToClipboardSafe(continuationPrompt);
   if (memory) {
     const memoryWithContinuation = updateMemoryWithContinuation(memory, reason, continuationPath, nowIso);
-    fs9.writeFileSync(path9.join(getConfigDir(cwd), "memory.md"), memoryWithContinuation, "utf-8");
+    fs10.writeFileSync(path10.join(getConfigDir(cwd), "memory.md"), memoryWithContinuation, "utf-8");
   }
   if (hasConfig) {
     const nextConfig = __spreadProps(__spreadValues({}, config), {
@@ -5505,7 +5795,7 @@ program.command("report").description("Show a summary of all local RunTrim runs"
   console.log(DIM("  " + SECTION));
   console.log("");
   const audit = loadProjectAudit(cwd);
-  console.log(DIM("  Project     ") + chalk.white((_b = audit == null ? void 0 : audit.projectName) != null ? _b : path9.basename(cwd)));
+  console.log(DIM("  Project     ") + chalk.white((_b = audit == null ? void 0 : audit.projectName) != null ? _b : path10.basename(cwd)));
   console.log(DIM("  Focus       ") + chalk.white(truncate((_d = (_c = latestRun.contract.contract) == null ? void 0 : _c.cleanedObjective) != null ? _d : latestRun.task, 58)));
   console.log(DIM("  Status      ") + chalk.white(formatStatus((_e = latestEval == null ? void 0 : latestEval.status) != null ? _e : latestRun.status)));
   console.log(DIM("  Changed     ") + chalk.white(`${(_g = (_f = latestEval == null ? void 0 : latestEval.changedFiles) == null ? void 0 : _f.length) != null ? _g : 0} file${((_i = (_h = latestEval == null ? void 0 : latestEval.changedFiles) == null ? void 0 : _h.length) != null ? _i : 0) === 1 ? "" : "s"}`));
@@ -5568,4 +5858,389 @@ var statusColors = {
   drift_detected: chalk.red,
   blocked: chalk.red
 };
+var GLOBAL_AUTH_DIR = path10.join(os3.homedir(), ".runtrim");
+var GLOBAL_AUTH_FILE = path10.join(GLOBAL_AUTH_DIR, "auth.json");
+function loadGlobalAuth() {
+  if (!fs10.existsSync(GLOBAL_AUTH_FILE)) return null;
+  try {
+    return JSON.parse(fs10.readFileSync(GLOBAL_AUTH_FILE, "utf-8"));
+  } catch (e) {
+    return null;
+  }
+}
+function saveGlobalAuth(auth) {
+  if (!fs10.existsSync(GLOBAL_AUTH_DIR)) {
+    fs10.mkdirSync(GLOBAL_AUTH_DIR, { recursive: true });
+  }
+  fs10.writeFileSync(GLOBAL_AUTH_FILE, JSON.stringify(auth, null, 2));
+}
+function resolveApiBase(config) {
+  var _a2;
+  const url = (_a2 = config.dashboardUrl) == null ? void 0 : _a2.trim();
+  if (!url || url.startsWith("http://localhost")) {
+    return "https://www.runtrim.com";
+  }
+  try {
+    return new URL(url).origin;
+  } catch (e) {
+    return "https://www.runtrim.com";
+  }
+}
+program.command("login").description("Connect this machine to your RunTrim cloud account").option("--token <token>", "CLI token (skip interactive prompt)").action(async (opts) => {
+  var _a2, _b, _c, _d, _e;
+  console.log("");
+  console.log(BOLD("RunTrim") + DIM("  connect to cloud"));
+  console.log("");
+  const cwd = process.cwd();
+  const existing = loadGlobalAuth();
+  if (existing && !opts.token) {
+    console.log(DIM("  Already connected."));
+    if (existing.email) {
+      console.log(DIM("  Account   ") + chalk.white(existing.email));
+    }
+    console.log(DIM("  Token     ") + chalk.white("rt_live_..."));
+    console.log("");
+    console.log(DIM("  To reconnect, run: ") + GO_ACCENT("runtrim login --token <new-token>"));
+    console.log("");
+    return;
+  }
+  console.log(DIM("  Get your CLI token from:"));
+  console.log("  " + GO_ACCENT("https://www.runtrim.com/app/connect"));
+  console.log("");
+  let rawToken = (_b = (_a2 = opts.token) == null ? void 0 : _a2.trim()) != null ? _b : "";
+  if (!rawToken) {
+    const answer = await prompts({
+      type: "text",
+      name: "token",
+      message: "Paste your CLI token"
+    });
+    rawToken = (_d = (_c = answer.token) == null ? void 0 : _c.trim()) != null ? _d : "";
+  }
+  if (!rawToken || !rawToken.startsWith("rt_live_")) {
+    console.log(chalk.yellow("  Invalid token. Tokens start with rt_live_"));
+    console.log("");
+    return;
+  }
+  const config = configExists(cwd) ? loadConfig(cwd) : DEFAULT_CONFIG;
+  const apiBase = resolveApiBase(config);
+  const verifyUrl = `${apiBase}/api/cli-token/verify`;
+  const spinner = oraFactory({ text: "  Verifying token...", color: "blue" }).start();
+  let email;
+  try {
+    const res = await fetch(verifyUrl, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${rawToken}` }
+    });
+    const body = await res.json();
+    if (!res.ok || !body.ok) {
+      spinner.fail("  Invalid token. " + ((_e = body.error) != null ? _e : ""));
+      console.log("");
+      return;
+    }
+    email = body.email;
+    spinner.succeed("  Token verified.");
+  } catch (e) {
+    spinner.fail("  Could not reach RunTrim server. Check your connection.");
+    console.log("");
+    return;
+  }
+  saveGlobalAuth({ token: rawToken, storedAt: (/* @__PURE__ */ new Date()).toISOString(), email });
+  console.log("");
+  if (email) {
+    console.log(ACCENT.bold("  Connected as ") + chalk.white(email));
+  } else {
+    console.log(ACCENT.bold("  Connected to RunTrim cloud."));
+  }
+  console.log(DIM("  Token stored in ") + chalk.white("~/.runtrim/auth.json"));
+  console.log("");
+  console.log(DIM("  Next: navigate to a project and run ") + GO_ACCENT("runtrim sync"));
+  console.log("");
+});
+program.command("finish").description("Bridge Mode: evaluate agent output, check scope, mark run completed, and sync").option("--no-sync", "Skip cloud sync even if a CLI token is configured").action(async (options) => {
+  var _a2, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o;
+  const cwd = process.cwd();
+  console.log("");
+  console.log(GO_ACCENT.bold("RunTrim finish"));
+  console.log("");
+  const allRuns = loadAllRuns(cwd);
+  const activeRun = allRuns.find((r) => r.status === "guarded" || r.status === "checked");
+  if (!activeRun) {
+    console.log(chalk.yellow("  No active RunTrim session found."));
+    console.log(DIM('  Start a new session with: runtrim go "<task>"'));
+    console.log("");
+    return;
+  }
+  const config = configExists(cwd) ? loadConfig(cwd) : DEFAULT_CONFIG;
+  const projectAudit = loadProjectAudit(cwd);
+  const projectName = (_a2 = projectAudit == null ? void 0 : projectAudit.projectName) != null ? _a2 : path10.basename(cwd);
+  console.log(DIM("  Run     ") + chalk.white(truncate(activeRun.task, 60)));
+  console.log(DIM("  Run ID  ") + chalk.white(activeRun.id));
+  console.log("");
+  const allChangedFiles = dedupeFiles(await getGitDiff(cwd));
+  const sessionManagedFiles = (_b = activeRun.bridgeManagedFiles) != null ? _b : [];
+  function isRuntrimOwned(f) {
+    const norm = f.replace(/\\/g, "/").toLowerCase();
+    if (norm.startsWith(".runtrim/")) return true;
+    if (norm === "runtrim.md") return true;
+    if (sessionManagedFiles.some(
+      (m) => m.replace(/\\/g, "/").toLowerCase() === norm
+    )) return true;
+    return false;
+  }
+  const runtrimFiles = [];
+  const agentFiles = [];
+  for (const f of allChangedFiles) {
+    if (isRuntrimOwned(f)) {
+      runtrimFiles.push(f);
+    } else {
+      agentFiles.push(f);
+    }
+  }
+  const changedFiles = agentFiles;
+  const maxFiles = inferMaxFilesFromScope(
+    (_d = (_c = activeRun.contract.contract) == null ? void 0 : _c.relevantScope) != null ? _d : [],
+    config.maxFilesPerRun
+  );
+  const scope = evaluateWatchState({
+    changedFiles,
+    run: activeRun,
+    maxFilesPerRun: maxFiles,
+    strict: false
+  });
+  const evaluation = evaluateAgentOutput(null, changedFiles, {
+    task: activeRun.task,
+    relevantScope: (_f = (_e = activeRun.contract.contract) == null ? void 0 : _e.relevantScope) != null ? _f : [],
+    sensitiveScope: (_h = (_g = activeRun.contract.contract) == null ? void 0 : _g.sensitiveScope) != null ? _h : [],
+    forbiddenScope: (_j = (_i = activeRun.contract.contract) == null ? void 0 : _i.forbiddenScope) != null ? _j : [],
+    runStatus: activeRun.status
+  });
+  let scopeDriftStatus = "passed";
+  if (scope.forbiddenFiles.length > 0) scopeDriftStatus = "forbidden_touched";
+  else if (scope.outOfScopeFiles.length > 0) scopeDriftStatus = "out_of_scope";
+  else if (evaluation.scopeDriftRisk === "high" || evaluation.scopeDriftRisk === "medium")
+    scopeDriftStatus = "drift_detected";
+  const forbiddenCount = scope.forbiddenFiles.length;
+  const reportParts = [];
+  if (changedFiles.length === 0) {
+    reportParts.push("No agent changes detected.");
+  } else {
+    reportParts.push(`${changedFiles.length} file${changedFiles.length === 1 ? "" : "s"} changed.`);
+  }
+  if (forbiddenCount > 0) {
+    reportParts.push(`${forbiddenCount} forbidden file${forbiddenCount === 1 ? "" : "s"} touched.`);
+  } else if (changedFiles.length > 0) {
+    reportParts.push("No forbidden systems touched.");
+  }
+  if (scopeDriftStatus === "passed" && changedFiles.length > 0) {
+    reportParts.push("Changes within contract.");
+  }
+  if (evaluation.memorySummary) reportParts.push(evaluation.memorySummary);
+  const reportSummary = reportParts.join(" ");
+  const continuationPack = evaluation.nextGuardedPrompt || null;
+  if (continuationPack) {
+    const contDir = getConfigDir(cwd);
+    if (!fs10.existsSync(contDir)) fs10.mkdirSync(contDir, { recursive: true });
+    fs10.writeFileSync(path10.join(contDir, "continuation-prompt.md"), continuationPack, "utf-8");
+  }
+  const evalRecord = __spreadProps(__spreadValues({}, evaluation), {
+    nextPrompt: evaluation.nextGuardedPrompt,
+    nextSafePrompt: evaluation.nextGuardedPrompt,
+    nextSafeAction: evaluation.nextSafeAction,
+    memorySummary: evaluation.memorySummary,
+    evaluatedAt: evaluation.evaluatedAt
+  });
+  updateRun(activeRun.id, {
+    status: "completed",
+    evaluation: evalRecord,
+    scopeDriftStatus,
+    reportSummary,
+    watchStatus: scope.status,
+    watchWarnings: scope.warnings,
+    watchChangedFiles: agentFiles
+    // only agent changes, not RunTrim protocol files
+  }, cwd);
+  const freshRuns = loadAllRuns(cwd);
+  const updatedRun = (_k = freshRuns.find((r) => r.id === activeRun.id)) != null ? _k : activeRun;
+  writeMemoryFromRuns(updatedRun, freshRuns, config, cwd);
+  let synced = false;
+  if (options.sync !== false) {
+    const globalAuth = loadGlobalAuth();
+    const rawToken = (_m = (_l = globalAuth == null ? void 0 : globalAuth.token) != null ? _l : config.syncToken) != null ? _m : null;
+    if (rawToken == null ? void 0 : rawToken.startsWith("rt_live_")) {
+      try {
+        const memoryMarkdown = (() => {
+          try {
+            return readMemory(cwd);
+          } catch (e) {
+            return null;
+          }
+        })();
+        const payload = buildSyncPayload({
+          cwd,
+          projectName,
+          config,
+          projectAudit: projectAudit != null ? projectAudit : null,
+          memoryMarkdown: memoryMarkdown != null ? memoryMarkdown : "",
+          runs: freshRuns
+        });
+        const apiBase = resolveApiBase(config);
+        const r = await fetch(`${apiBase}/api/sync`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${rawToken}` },
+          body: JSON.stringify(payload)
+        });
+        synced = r.ok;
+      } catch (e) {
+      }
+    }
+  }
+  const scopeColor = scopeDriftStatus === "passed" ? chalk.green : scopeDriftStatus === "forbidden_touched" ? chalk.red : chalk.yellow;
+  const riskAfter = (_n = activeRun.contract.wasteRiskAfter) != null ? _n : "medium";
+  const riskColor = (_o = { low: chalk.green, medium: chalk.yellow, high: chalk.hex("#FF8C00"), critical: chalk.red }[riskAfter]) != null ? _o : chalk.white;
+  console.log(GO_ACCENT.bold("Run"));
+  console.log(chalk.white("  " + truncate(activeRun.task, 70)));
+  console.log("");
+  if (changedFiles.length > 0) {
+    console.log(GO_ACCENT.bold("Changed files"));
+    for (const f of changedFiles.slice(0, 8)) {
+      const isForbidden = scope.forbiddenFiles.includes(f);
+      const isSensitive = scope.sensitiveFiles.includes(f);
+      const marker = isForbidden ? chalk.red(" [forbidden]") : isSensitive ? chalk.yellow(" [sensitive]") : "";
+      console.log(chalk.white("  - " + f) + marker);
+    }
+    if (changedFiles.length > 8) {
+      console.log(DIM(`  ... and ${changedFiles.length - 8} more`));
+    }
+    console.log("");
+  } else {
+    console.log(GO_ACCENT.bold("Changed files"));
+    console.log(DIM("  No agent changes detected."));
+    console.log("");
+  }
+  if (runtrimFiles.length > 0) {
+    console.log(GO_ACCENT.bold("RunTrim files"));
+    for (const f of runtrimFiles) {
+      console.log(DIM("  - " + f));
+    }
+    console.log("");
+  }
+  console.log(GO_ACCENT.bold("Scope"));
+  if (changedFiles.length === 0) {
+    console.log(chalk.green("  No agent changes to evaluate."));
+  } else {
+    console.log(scopeColor("  " + (scopeDriftStatus === "passed" ? "Passed" : scopeDriftStatus === "forbidden_touched" ? "Failed \u2014 forbidden files touched" : "Drift detected")));
+  }
+  console.log("");
+  console.log(GO_ACCENT.bold("Risk"));
+  console.log(riskColor("  " + riskAfter));
+  console.log("");
+  console.log(GO_ACCENT.bold("Report"));
+  console.log(chalk.white("  " + reportSummary));
+  console.log("");
+  if (continuationPack) {
+    console.log(GO_ACCENT.bold("Continuation"));
+    console.log(chalk.white("  Saved to .runtrim/continuation-prompt.md"));
+    console.log("");
+  }
+  if (evaluation.nextSafeAction && evaluation.nextSafeAction !== "Run is ready to continue.") {
+    console.log(GO_ACCENT.bold("Next safest step"));
+    console.log(chalk.white("  " + evaluation.nextSafeAction));
+    console.log("");
+  }
+  if (options.sync !== false) {
+    console.log(GO_ACCENT.bold("Cloud sync"));
+    console.log(DIM("  ") + (synced ? chalk.white("Completed.") : DIM("Skipped. Run runtrim login to connect your dashboard.")));
+    console.log("");
+  }
+});
+program.command("sync").description("Sync local run history and project memory to your RunTrim dashboard").option("--dry-run", "Show what would be synced without uploading").action(async (opts) => {
+  var _a2, _b, _c, _d, _e, _f;
+  const cwd = process.cwd();
+  console.log("");
+  console.log(BOLD("RunTrim") + DIM("  cloud sync"));
+  console.log("");
+  const globalAuth = loadGlobalAuth();
+  const config = configExists(cwd) ? loadConfig(cwd) : DEFAULT_CONFIG;
+  const rawToken = (_b = (_a2 = globalAuth == null ? void 0 : globalAuth.token) != null ? _a2 : config.syncToken) != null ? _b : null;
+  if (!rawToken) {
+    console.log(chalk.yellow("  No CLI token found."));
+    console.log(DIM("  Run ") + GO_ACCENT("runtrim login") + DIM(" to connect cloud sync."));
+    console.log(DIM("  Local CLI still works without a token."));
+    console.log("");
+    return;
+  }
+  if (!rawToken.startsWith("rt_live_")) {
+    console.log(chalk.yellow("  Stored token format is invalid. Re-run: runtrim login"));
+    console.log("");
+    return;
+  }
+  const apiBase = resolveApiBase(config);
+  const syncUrl = `${apiBase}/api/sync`;
+  const runs = loadAllRuns(cwd);
+  if (runs.length === 0) {
+    console.log(DIM("  No local runs found in this directory."));
+    console.log(DIM("  Run ") + GO_ACCENT('runtrim go "your task"') + DIM(" first to create runs."));
+    console.log("");
+    return;
+  }
+  const projectAudit = loadProjectAudit(cwd);
+  const memoryMarkdown = (() => {
+    try {
+      return readMemory(cwd);
+    } catch (e) {
+      return "";
+    }
+  })();
+  const payload = buildSyncPayload({
+    cwd,
+    projectName: (_c = projectAudit == null ? void 0 : projectAudit.projectName) != null ? _c : path10.basename(cwd),
+    config,
+    projectAudit: projectAudit != null ? projectAudit : null,
+    memoryMarkdown: memoryMarkdown != null ? memoryMarkdown : "",
+    runs
+  });
+  console.log(DIM("  Project    ") + chalk.white(payload.project.name));
+  console.log(DIM("  Runs       ") + chalk.white(String(payload.runs.length)));
+  console.log(DIM("  API        ") + chalk.white(syncUrl));
+  console.log("");
+  if (opts.dryRun) {
+    console.log(ACCENT.bold("  Dry run \u2014 nothing uploaded."));
+    console.log("");
+    return;
+  }
+  const spinner = oraFactory({ text: "  Syncing...", color: "blue" }).start();
+  try {
+    const res = await fetch(syncUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${rawToken}`
+      },
+      body: JSON.stringify(payload)
+    });
+    const body = await res.json();
+    if (!res.ok || !body.ok) {
+      spinner.fail("  Sync failed.");
+      console.log("");
+      if (body.error) {
+        console.log(chalk.red("  Error: ") + chalk.white(body.error));
+        if (res.status === 401) {
+          console.log(DIM("  Token may be invalid or expired. Run: runtrim login"));
+        }
+      }
+      console.log("");
+      return;
+    }
+    spinner.succeed("  Sync complete.");
+    console.log("");
+    console.log(ACCENT.bold("  Synced") + chalk.white(`  ${(_d = body.syncedRuns) != null ? _d : payload.runs.length} run${((_e = body.syncedRuns) != null ? _e : payload.runs.length) === 1 ? "" : "s"}`));
+    console.log(DIM("  Project ID ") + chalk.white((_f = body.projectId) != null ? _f : "\u2014"));
+    console.log("");
+    console.log(DIM("  View at  ") + GO_ACCENT(`${apiBase}/app`));
+    console.log("");
+  } catch (err) {
+    spinner.fail("  Network error. Check your connection.");
+    console.log("");
+  }
+});
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runtrim",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "CLI guard layer that scopes AI coding runs before they waste tokens.",
   "license": "MIT",
   "author": "RunTrim",
@@ -38,6 +38,7 @@
     "build:all": "npm run build:cli && npm run build:web",
     "start": "next start",
     "lint": "eslint",
+    "prepublishOnly": "npm run build:cli",
     "runtrim": "tsx cli/runtrim.ts",
     "runtrim:build": "npm run build:cli"
   },
@@ -54,6 +55,7 @@
     "@radix-ui/react-switch": "^1.2.6",
     "@radix-ui/react-tabs": "^1.1.13",
     "@radix-ui/react-tooltip": "^1.2.8",
+    "@supabase/ssr": "^0.10.2",
     "@supabase/supabase-js": "^2.57.4",
     "chalk": "^5.6.2",
     "class-variance-authority": "^0.7.1",