@cleocode/adapters 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/index.js

@@ -1617,154 +1617,11 @@ var init_identity = __esm({
   }
 });
 
-// packages/contracts/src/docs-taxonomy.ts
-var BUILTIN_DOC_KINDS, BUILTIN_DOC_KIND_VALUES;
-var init_docs_taxonomy = __esm({
-  "packages/contracts/src/docs-taxonomy.ts"() {
+// packages/contracts/src/operations/docs-lifecycle.ts
+var DOCS_LIFECYCLE_STATUSES;
+var init_docs_lifecycle = __esm({
+  "packages/contracts/src/operations/docs-lifecycle.ts"() {
     "use strict";
-    BUILTIN_DOC_KINDS = [
-      {
-        kind: "adr",
-        label: "ADR",
-        description: "Architectural decision record",
-        defaultOwnerKind: "task",
-        publishDir: "docs/adr",
-        requiresEntityId: true,
-        entityIdPattern: /^adr-\d{3,4}-[a-z0-9-]+$/,
-        requiredSections: ["Status", "Date", "Context", "Decision", "Consequences"]
-      },
-      {
-        kind: "spec",
-        label: "Spec",
-        description: "Technical specification",
-        defaultOwnerKind: "task",
-        publishDir: "docs/spec",
-        requiresEntityId: false,
-        requiredSections: ["Goal", "Non-Goals", "Requirements", "Out-of-Scope"]
-      },
-      {
-        kind: "research",
-        label: "Research",
-        description: "Investigation / research note",
-        defaultOwnerKind: "task",
-        publishDir: "docs/research",
-        requiresEntityId: false,
-        requiredSections: ["Question", "Findings", "Sources"]
-      },
-      {
-        kind: "handoff",
-        label: "Handoff",
-        description: "Session / agent handoff",
-        defaultOwnerKind: "session",
-        publishDir: "docs/handoff",
-        requiresEntityId: false,
-        requiredSections: ["Context", "State", "Next-Steps"]
-      },
-      {
-        kind: "note",
-        label: "Note",
-        description: "Agent observation / informal note",
-        defaultOwnerKind: "observation",
-        publishDir: "docs/note",
-        requiresEntityId: false,
-        requiredSections: []
-      },
-      {
-        kind: "llm-readme",
-        label: "LLM README",
-        description: "Machine-readable README (llms.txt)",
-        defaultOwnerKind: "project",
-        publishDir: ".",
-        requiresEntityId: false,
-        requiredSections: []
-      },
-      {
-        kind: "changeset",
-        label: "Changeset",
-        description: "Atomic change entry (release-note input)",
-        defaultOwnerKind: "task",
-        publishDir: ".changeset",
-        requiresEntityId: true,
-        entityIdPattern: /^t\d+-[a-z0-9-]+$/,
-        requiredSections: []
-      },
-      {
-        kind: "release-note",
-        label: "Release Note",
-        description: "Composed release notes",
-        defaultOwnerKind: "project",
-        publishDir: "docs/release",
-        requiresEntityId: true,
-        entityIdPattern: /^v\d{4}\.\d+\.\d+(-[a-z0-9-]+)?$/,
-        requiredSections: ["Changes", "Migration"]
-      },
-      {
-        kind: "plan",
-        label: "Plan",
-        description: "Epic / saga decomposition plan",
-        defaultOwnerKind: "task",
-        publishDir: "docs/plan",
-        requiresEntityId: false,
-        requiredSections: ["Goal", "Steps", "Owners"]
-      },
-      {
-        kind: "rcasd",
-        label: "RCASD",
-        description: "Root-cause analysis + scoped delivery",
-        defaultOwnerKind: "task",
-        publishDir: ".cleo/rcasd",
-        requiresEntityId: true,
-        entityIdPattern: /^t\d+(-.+)?$/,
-        requiredSections: ["Root-Cause", "Action", "Schedule", "Detection"]
-      }
-    ];
-    BUILTIN_DOC_KIND_VALUES = Object.freeze(
-      BUILTIN_DOC_KINDS.map((d) => d.kind)
-    );
-  }
-});
-
-// packages/contracts/src/operations/docs.ts
-import { z as z7 } from "zod";
-var DOCS_PROJECTION_PROPOSAL_SCHEMA, DOCS_PROJECTION_RECEIPT_SCHEMA, DOCS_LIFECYCLE_STATUSES;
-var init_docs = __esm({
-  "packages/contracts/src/operations/docs.ts"() {
-    "use strict";
-    init_docs_taxonomy();
-    DOCS_PROJECTION_PROPOSAL_SCHEMA = z7.object({
-      version: z7.literal(1),
-      operation: z7.literal("docs.projection"),
-      identity: z7.object({
-        projectId: z7.string().min(1),
-        projectRoot: z7.string().min(1),
-        actor: z7.string().min(1),
-        operation: z7.literal("docs.projection"),
-        idempotencyKey: z7.string().min(1)
-      }).strict(),
-      source: z7.object({
-        attachmentId: z7.string().min(1),
-        sha256: z7.string().regex(/^[a-f0-9]{64}$/),
-        ownerId: z7.string().min(1),
-        ownerType: z7.enum(["task", "session", "observation", "decision", "learning", "pattern"]),
-        label: z7.string().min(1)
-      }).strict(),
-      observation: z7.object({
-        kind: z7.literal("doc-attachment"),
-        attachmentId: z7.string().min(1),
-        ownerId: z7.string().min(1),
-        addedAt: z7.string().min(1),
-        slug: z7.string().optional(),
-        type: z7.string().optional()
-      }).strict()
-    }).strict();
-    DOCS_PROJECTION_RECEIPT_SCHEMA = z7.object({
-      version: z7.literal(1),
-      sourceHash: z7.string().regex(/^[a-f0-9]{64}$/),
-      graph: z7.enum(["completed", "disabled"]),
-      observationId: z7.string().min(1),
-      verifiedAt: z7.string().min(1),
-      actor: z7.string().min(1)
-    }).strict();
     DOCS_LIFECYCLE_STATUSES = [
       "draft",
       "proposed",
@@ -2914,7 +2771,7 @@ var requirementTaskParam, OPERATIONS;
 var init_operations_registry = __esm({
   "packages/contracts/src/dispatch/operations-registry.ts"() {
     "use strict";
-    init_docs();
+    init_docs_lifecycle();
     init_output_contracts_data();
     init_tasks();
     requirementTaskParam = {
@@ -13382,7 +13239,7 @@ var init_operations_registry = __esm({
 });
 
 // packages/contracts/src/docs/provenance.ts
-import { z as z8 } from "zod";
+import { z as z7 } from "zod";
 var PROVENANCE_NODE_KINDS, PROVENANCE_EDGE_RELATIONS, DOC_LIFECYCLE_STATUSES, provenanceNodeKindSchema, provenanceEdgeRelationSchema, docLifecycleStatusSchema, provenanceNodeBaseFields, provenanceDocNodeSchema, provenanceTaskNodeSchema, provenanceDecisionNodeSchema, provenanceSessionNodeSchema, provenanceMemoryNodeSchema, provenanceNodeSchema, provenanceEdgeSchema, docProvenanceResponseSchema;
 var init_provenance = __esm({
   "packages/contracts/src/docs/provenance.ts"() {
@@ -13409,108 +13266,215 @@ var init_provenance = __esm({
       "archived",
       "draft"
     ];
-    provenanceNodeKindSchema = z8.enum(PROVENANCE_NODE_KINDS);
-    provenanceEdgeRelationSchema = z8.enum(PROVENANCE_EDGE_RELATIONS);
-    docLifecycleStatusSchema = z8.enum(DOC_LIFECYCLE_STATUSES);
+    provenanceNodeKindSchema = z7.enum(PROVENANCE_NODE_KINDS);
+    provenanceEdgeRelationSchema = z7.enum(PROVENANCE_EDGE_RELATIONS);
+    docLifecycleStatusSchema = z7.enum(DOC_LIFECYCLE_STATUSES);
     provenanceNodeBaseFields = {
-      id: z8.string().min(1),
-      title: z8.string().min(1),
-      metadata: z8.record(z8.string(), z8.unknown()).optional()
+      id: z7.string().min(1),
+      title: z7.string().min(1),
+      metadata: z7.record(z7.string(), z7.unknown()).optional()
     };
-    provenanceDocNodeSchema = z8.object({
+    provenanceDocNodeSchema = z7.object({
       ...provenanceNodeBaseFields,
-      kind: z8.literal("doc"),
-      slug: z8.string().min(1),
-      docKind: z8.string().min(1),
+      kind: z7.literal("doc"),
+      slug: z7.string().min(1),
+      docKind: z7.string().min(1),
       lifecycleStatus: docLifecycleStatusSchema,
-      publishedAt: z8.string().min(1),
-      supersededAt: z8.string().min(1).optional(),
-      summary: z8.string().optional()
+      publishedAt: z7.string().min(1),
+      supersededAt: z7.string().min(1).optional(),
+      summary: z7.string().optional()
     });
-    provenanceTaskNodeSchema = z8.object({
+    provenanceTaskNodeSchema = z7.object({
       ...provenanceNodeBaseFields,
-      kind: z8.literal("task"),
-      taskType: z8.enum(["saga", "epic", "task", "subtask"]),
-      status: z8.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
+      kind: z7.literal("task"),
+      taskType: z7.enum(["saga", "epic", "task", "subtask"]),
+      status: z7.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
     });
-    provenanceDecisionNodeSchema = z8.object({
+    provenanceDecisionNodeSchema = z7.object({
       ...provenanceNodeBaseFields,
-      kind: z8.literal("decision"),
-      outcome: z8.enum(["proposed", "accepted", "rejected", "superseded"]),
-      decidedAt: z8.string().min(1)
+      kind: z7.literal("decision"),
+      outcome: z7.enum(["proposed", "accepted", "rejected", "superseded"]),
+      decidedAt: z7.string().min(1)
     });
-    provenanceSessionNodeSchema = z8.object({
+    provenanceSessionNodeSchema = z7.object({
       ...provenanceNodeBaseFields,
-      kind: z8.literal("session"),
-      startedAt: z8.string().min(1),
-      endedAt: z8.string().min(1).optional()
+      kind: z7.literal("session"),
+      startedAt: z7.string().min(1),
+      endedAt: z7.string().min(1).optional()
     });
-    provenanceMemoryNodeSchema = z8.object({
+    provenanceMemoryNodeSchema = z7.object({
       ...provenanceNodeBaseFields,
-      kind: z8.literal("memory"),
-      memoryType: z8.enum(["observation", "pattern", "decision", "diary"]),
-      recordedAt: z8.string().min(1)
+      kind: z7.literal("memory"),
+      memoryType: z7.enum(["observation", "pattern", "decision", "diary"]),
+      recordedAt: z7.string().min(1)
     });
-    provenanceNodeSchema = z8.discriminatedUnion("kind", [
+    provenanceNodeSchema = z7.discriminatedUnion("kind", [
       provenanceDocNodeSchema,
       provenanceTaskNodeSchema,
       provenanceDecisionNodeSchema,
       provenanceSessionNodeSchema,
       provenanceMemoryNodeSchema
     ]);
-    provenanceEdgeSchema = z8.object({
+    provenanceEdgeSchema = z7.object({
       relation: provenanceEdgeRelationSchema,
-      from: z8.string().min(1),
+      from: z7.string().min(1),
       fromKind: provenanceNodeKindSchema,
-      to: z8.string().min(1),
+      to: z7.string().min(1),
       toKind: provenanceNodeKindSchema,
-      addedAt: z8.string().min(1),
-      summary: z8.string().optional()
+      addedAt: z7.string().min(1),
+      summary: z7.string().optional()
     });
-    docProvenanceResponseSchema = z8.object({
-      nodes: z8.array(provenanceNodeSchema).readonly(),
-      edges: z8.array(provenanceEdgeSchema).readonly(),
-      totalNodes: z8.number().int().nonnegative(),
-      totalEdges: z8.number().int().nonnegative()
+    docProvenanceResponseSchema = z7.object({
+      nodes: z7.array(provenanceNodeSchema).readonly(),
+      edges: z7.array(provenanceEdgeSchema).readonly(),
+      totalNodes: z7.number().int().nonnegative(),
+      totalEdges: z7.number().int().nonnegative()
     });
   }
 });
 
 // packages/contracts/src/docs/read.ts
-import { z as z9 } from "zod";
+import { z as z8 } from "zod";
 var docFrontmatterSchema, docBodySchema, docReadResponseSchema;
 var init_read = __esm({
   "packages/contracts/src/docs/read.ts"() {
     "use strict";
-    docFrontmatterSchema = z9.object({
-      slug: z9.string(),
-      kind: z9.string().nullable(),
-      title: z9.string().nullable(),
-      summary: z9.string().nullable(),
-      lifecycleStatus: z9.string(),
-      docVersion: z9.number().int(),
-      ownerVersion: z9.string().nullable(),
-      supersedes: z9.string().nullable(),
-      supersededBy: z9.string().nullable(),
-      topics: z9.array(z9.string()).readonly(),
-      relatedTasks: z9.array(z9.string()).readonly(),
-      sha256: z9.string(),
-      createdAt: z9.string()
-    });
-    docBodySchema = z9.object({
-      encoding: z9.enum(["utf-8", "base64"]),
-      text: z9.string().optional(),
-      base64: z9.string().optional(),
-      sizeBytes: z9.number().int().nonnegative(),
-      mimeType: z9.string().nullable()
-    });
-    docReadResponseSchema = z9.object({
+    docFrontmatterSchema = z8.object({
+      slug: z8.string(),
+      kind: z8.string().nullable(),
+      title: z8.string().nullable(),
+      summary: z8.string().nullable(),
+      lifecycleStatus: z8.string(),
+      docVersion: z8.number().int(),
+      ownerVersion: z8.string().nullable(),
+      supersedes: z8.string().nullable(),
+      supersededBy: z8.string().nullable(),
+      topics: z8.array(z8.string()).readonly(),
+      relatedTasks: z8.array(z8.string()).readonly(),
+      sha256: z8.string(),
+      createdAt: z8.string()
+    });
+    docBodySchema = z8.object({
+      encoding: z8.enum(["utf-8", "base64"]),
+      text: z8.string().optional(),
+      base64: z8.string().optional(),
+      sizeBytes: z8.number().int().nonnegative(),
+      mimeType: z8.string().nullable()
+    });
+    docReadResponseSchema = z8.object({
       frontmatter: docFrontmatterSchema,
       body: docBodySchema
     });
   }
 });
 
+// packages/contracts/src/docs-taxonomy.ts
+var BUILTIN_DOC_KINDS, BUILTIN_DOC_KIND_VALUES;
+var init_docs_taxonomy = __esm({
+  "packages/contracts/src/docs-taxonomy.ts"() {
+    "use strict";
+    BUILTIN_DOC_KINDS = [
+      {
+        kind: "adr",
+        label: "ADR",
+        description: "Architectural decision record",
+        defaultOwnerKind: "task",
+        publishDir: "docs/adr",
+        requiresEntityId: true,
+        entityIdPattern: /^adr-\d{3,4}-[a-z0-9-]+$/,
+        requiredSections: ["Status", "Date", "Context", "Decision", "Consequences"]
+      },
+      {
+        kind: "spec",
+        label: "Spec",
+        description: "Technical specification",
+        defaultOwnerKind: "task",
+        publishDir: "docs/spec",
+        requiresEntityId: false,
+        requiredSections: ["Goal", "Non-Goals", "Requirements", "Out-of-Scope"]
+      },
+      {
+        kind: "research",
+        label: "Research",
+        description: "Investigation / research note",
+        defaultOwnerKind: "task",
+        publishDir: "docs/research",
+        requiresEntityId: false,
+        requiredSections: ["Question", "Findings", "Sources"]
+      },
+      {
+        kind: "handoff",
+        label: "Handoff",
+        description: "Session / agent handoff",
+        defaultOwnerKind: "session",
+        publishDir: "docs/handoff",
+        requiresEntityId: false,
+        requiredSections: ["Context", "State", "Next-Steps"]
+      },
+      {
+        kind: "note",
+        label: "Note",
+        description: "Agent observation / informal note",
+        defaultOwnerKind: "observation",
+        publishDir: "docs/note",
+        requiresEntityId: false,
+        requiredSections: []
+      },
+      {
+        kind: "llm-readme",
+        label: "LLM README",
+        description: "Machine-readable README (llms.txt)",
+        defaultOwnerKind: "project",
+        publishDir: ".",
+        requiresEntityId: false,
+        requiredSections: []
+      },
+      {
+        kind: "changeset",
+        label: "Changeset",
+        description: "Atomic change entry (release-note input)",
+        defaultOwnerKind: "task",
+        publishDir: ".changeset",
+        requiresEntityId: true,
+        entityIdPattern: /^t\d+-[a-z0-9-]+$/,
+        requiredSections: []
+      },
+      {
+        kind: "release-note",
+        label: "Release Note",
+        description: "Composed release notes",
+        defaultOwnerKind: "project",
+        publishDir: "docs/release",
+        requiresEntityId: true,
+        entityIdPattern: /^v\d{4}\.\d+\.\d+(-[a-z0-9-]+)?$/,
+        requiredSections: ["Changes", "Migration"]
+      },
+      {
+        kind: "plan",
+        label: "Plan",
+        description: "Epic / saga decomposition plan",
+        defaultOwnerKind: "task",
+        publishDir: "docs/plan",
+        requiresEntityId: false,
+        requiredSections: ["Goal", "Steps", "Owners"]
+      },
+      {
+        kind: "rcasd",
+        label: "RCASD",
+        description: "Root-cause analysis + scoped delivery",
+        defaultOwnerKind: "task",
+        publishDir: ".cleo/rcasd",
+        requiresEntityId: true,
+        entityIdPattern: /^t\d+(-.+)?$/,
+        requiredSections: ["Root-Cause", "Action", "Schedule", "Detection"]
+      }
+    ];
+    BUILTIN_DOC_KIND_VALUES = Object.freeze(
+      BUILTIN_DOC_KINDS.map((d) => d.kind)
+    );
+  }
+});
+
 // packages/contracts/src/engine-result.ts
 var init_engine_result = __esm({
   "packages/contracts/src/engine-result.ts"() {
@@ -13564,7 +13528,7 @@ var init_errors = __esm({
 });
 
 // packages/contracts/src/evidence-atom-schema.ts
-import { z as z10 } from "zod";
+import { z as z9 } from "zod";
 var EVIDENCE_ATOM_KINDS, PARSER_PREFIXES, KIND_BOUNDARY_REGEX, commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, ciAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
@@ -13585,73 +13549,73 @@ var init_evidence_atom_schema = __esm({
     ];
     PARSER_PREFIXES = [...EVIDENCE_ATOM_KINDS, "state"];
     KIND_BOUNDARY_REGEX = new RegExp(`;(?=\\s*(?:${PARSER_PREFIXES.join("|")})\\s*:)`, "g");
-    commitAtomSchema = z10.object({
-      kind: z10.literal("commit"),
-      sha: z10.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
-    });
-    filesAtomSchema = z10.object({
-      kind: z10.literal("files"),
-      paths: z10.array(z10.string().min(1)).min(1, "files atom requires at least one path")
-    });
-    testRunAtomSchema = z10.object({
-      kind: z10.literal("test-run"),
-      path: z10.string().min(1, "test-run atom requires a non-empty path")
-    });
-    toolAtomSchema = z10.object({
-      kind: z10.literal("tool"),
-      tool: z10.string().min(1, "tool atom requires a non-empty tool name")
-    });
-    urlAtomSchema = z10.object({
-      kind: z10.literal("url"),
-      url: z10.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
-    });
-    noteAtomSchema = z10.object({
-      kind: z10.literal("note"),
-      note: z10.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
-    });
-    decisionAtomSchema = z10.object({
-      kind: z10.literal("decision"),
-      decisionId: z10.string().min(1, "decision atom requires a non-empty decision ID")
-    });
-    prAtomSchema = z10.object({
-      kind: z10.literal("pr"),
-      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number"),
-      componentPrNumber: z10.number().int().positive().optional()
-    });
-    ciAtomSchema = z10.object({
-      kind: z10.literal("ci"),
-      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number"),
-      componentPrNumber: z10.number().int().positive().optional()
-    });
-    locDropAtomSchema = z10.object({
-      kind: z10.literal("loc-drop"),
-      fromLines: z10.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
-      toLines: z10.number().int().nonnegative("loc-drop toLines must be \u2265 0")
-    });
-    callsiteCoverageAtomSchema = z10.object({
-      kind: z10.literal("callsite-coverage"),
-      symbolName: z10.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
-      relativeSourcePath: z10.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
+    commitAtomSchema = z9.object({
+      kind: z9.literal("commit"),
+      sha: z9.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
+    });
+    filesAtomSchema = z9.object({
+      kind: z9.literal("files"),
+      paths: z9.array(z9.string().min(1)).min(1, "files atom requires at least one path")
+    });
+    testRunAtomSchema = z9.object({
+      kind: z9.literal("test-run"),
+      path: z9.string().min(1, "test-run atom requires a non-empty path")
+    });
+    toolAtomSchema = z9.object({
+      kind: z9.literal("tool"),
+      tool: z9.string().min(1, "tool atom requires a non-empty tool name")
+    });
+    urlAtomSchema = z9.object({
+      kind: z9.literal("url"),
+      url: z9.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
+    });
+    noteAtomSchema = z9.object({
+      kind: z9.literal("note"),
+      note: z9.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
+    });
+    decisionAtomSchema = z9.object({
+      kind: z9.literal("decision"),
+      decisionId: z9.string().min(1, "decision atom requires a non-empty decision ID")
+    });
+    prAtomSchema = z9.object({
+      kind: z9.literal("pr"),
+      prNumber: z9.number().int().positive("pr atom requires a positive integer PR number"),
+      componentPrNumber: z9.number().int().positive().optional()
+    });
+    ciAtomSchema = z9.object({
+      kind: z9.literal("ci"),
+      prNumber: z9.number().int().positive("ci atom requires a positive integer PR number"),
+      componentPrNumber: z9.number().int().positive().optional()
+    });
+    locDropAtomSchema = z9.object({
+      kind: z9.literal("loc-drop"),
+      fromLines: z9.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
+      toLines: z9.number().int().nonnegative("loc-drop toLines must be \u2265 0")
+    });
+    callsiteCoverageAtomSchema = z9.object({
+      kind: z9.literal("callsite-coverage"),
+      symbolName: z9.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
+      relativeSourcePath: z9.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
     });
     AC_UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[45][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
     AC_ALIAS_REGEX = /^AC[0-9]{1,4}$/;
     SATISFIES_TASK_ID_REGEX = /^T[0-9]{1,7}$/;
     SATISFIES_VERSION_PIN_REGEX = /^[0-9]{14}$/;
-    satisfiesAtomSchema = z10.object({
-      kind: z10.literal("satisfies"),
+    satisfiesAtomSchema = z9.object({
+      kind: z9.literal("satisfies"),
       /** Target task ID — `T<1-7 digits>` per ADR-079-r2 §2.1. */
-      targetTaskId: z10.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
+      targetTaskId: z9.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
       /** Lowercase UUIDv4/v5 — populated for the canonical form; undefined for alias form. */
-      targetAcId: z10.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4/v5").optional(),
+      targetAcId: z9.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4/v5").optional(),
       /** Positional alias `AC<1-4 digits>` — populated for alias form; undefined for UUID form. */
-      targetAcAlias: z10.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
+      targetAcAlias: z9.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
       /** Optional `@<14-digit YYYYMMDDhhmmss>` pin captured at mint time. */
-      versionPin: z10.string().regex(
+      versionPin: z9.string().regex(
         SATISFIES_VERSION_PIN_REGEX,
         "satisfies atom versionPin must be 14 digits (YYYYMMDDhhmmss)"
       ).optional()
     });
-    EvidenceAtomSchema = z10.discriminatedUnion("kind", [
+    EvidenceAtomSchema = z9.discriminatedUnion("kind", [
       commitAtomSchema,
       filesAtomSchema,
       testRunAtomSchema,
@@ -13703,58 +13667,58 @@ var init_evidence_atom_schema = __esm({
 });
 
 // packages/contracts/src/evidence-record-schema.ts
-import { z as z11 } from "zod";
+import { z as z10 } from "zod";
 var evidenceBaseSchema, implDiffRecordSchema, validateSpecCheckRecordSchema, testOutputRecordSchema, lintReportRecordSchema, commandOutputRecordSchema, evidenceRecordSchema;
 var init_evidence_record_schema = __esm({
   "packages/contracts/src/evidence-record-schema.ts"() {
     "use strict";
-    evidenceBaseSchema = z11.object({
+    evidenceBaseSchema = z10.object({
       /** Identity string of the agent that produced this record. */
-      agentIdentity: z11.string().min(1),
+      agentIdentity: z10.string().min(1),
       /** SHA-256 hex digest (64 chars) of the attached artifact. */
-      attachmentSha256: z11.string().length(64),
+      attachmentSha256: z10.string().length(64),
       /** ISO 8601 timestamp at which the action ran. */
-      ranAt: z11.string().datetime(),
+      ranAt: z10.string().datetime(),
       /** Wall-clock duration of the action in milliseconds. */
-      durationMs: z11.number().nonnegative()
+      durationMs: z10.number().nonnegative()
     });
     implDiffRecordSchema = evidenceBaseSchema.extend({
-      kind: z11.literal("impl-diff"),
-      phase: z11.literal("implement"),
-      filesChanged: z11.array(z11.string().min(1)).min(1),
-      linesAdded: z11.number().int().nonnegative(),
-      linesRemoved: z11.number().int().nonnegative()
+      kind: z10.literal("impl-diff"),
+      phase: z10.literal("implement"),
+      filesChanged: z10.array(z10.string().min(1)).min(1),
+      linesAdded: z10.number().int().nonnegative(),
+      linesRemoved: z10.number().int().nonnegative()
     });
     validateSpecCheckRecordSchema = evidenceBaseSchema.extend({
-      kind: z11.literal("validate-spec-check"),
-      phase: z11.literal("validate"),
-      reqIdsChecked: z11.array(z11.string().min(1)).min(1),
-      passed: z11.boolean(),
-      details: z11.string().min(1)
+      kind: z10.literal("validate-spec-check"),
+      phase: z10.literal("validate"),
+      reqIdsChecked: z10.array(z10.string().min(1)).min(1),
+      passed: z10.boolean(),
+      details: z10.string().min(1)
     });
     testOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z11.literal("test-output"),
-      phase: z11.literal("test"),
-      command: z11.string().min(1),
-      exitCode: z11.number().int(),
-      testsPassed: z11.number().int().nonnegative(),
-      testsFailed: z11.number().int().nonnegative()
+      kind: z10.literal("test-output"),
+      phase: z10.literal("test"),
+      command: z10.string().min(1),
+      exitCode: z10.number().int(),
+      testsPassed: z10.number().int().nonnegative(),
+      testsFailed: z10.number().int().nonnegative()
     });
     lintReportRecordSchema = evidenceBaseSchema.extend({
-      kind: z11.literal("lint-report"),
-      phase: z11.enum(["implement", "test"]),
-      tool: z11.string().min(1),
-      passed: z11.boolean(),
-      warnings: z11.number().int().nonnegative(),
-      errors: z11.number().int().nonnegative()
+      kind: z10.literal("lint-report"),
+      phase: z10.enum(["implement", "test"]),
+      tool: z10.string().min(1),
+      passed: z10.boolean(),
+      warnings: z10.number().int().nonnegative(),
+      errors: z10.number().int().nonnegative()
     });
     commandOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z11.literal("command-output"),
-      phase: z11.enum(["implement", "validate", "test"]),
-      cmd: z11.string().min(1),
-      exitCode: z11.number().int()
+      kind: z10.literal("command-output"),
+      phase: z10.enum(["implement", "validate", "test"]),
+      cmd: z10.string().min(1),
+      exitCode: z10.number().int()
     });
-    evidenceRecordSchema = z11.discriminatedUnion("kind", [
+    evidenceRecordSchema = z10.discriminatedUnion("kind", [
       implDiffRecordSchema,
       validateSpecCheckRecordSchema,
       testOutputRecordSchema,
@@ -14223,6 +14187,21 @@ function checkPending(task) {
 function rulePending(task) {
   return { task, reason: "the typed merge-rule registry does not define it yet (T12344 item)" };
 }
+function implemented(entry) {
+  const { pending: _pending, ...rest } = entry;
+  return { ...rest, runtimeGate: MERGE_ENGINE_GATE };
+}
+function implementedCheck(entry, functionName) {
+  const { pending: _pending, ...rest } = entry;
+  return {
+    ...rest,
+    check: {
+      module: "packages/core/src/store/sync/apply/post-apply.ts",
+      functionName,
+      footprint: entry.check?.footprint ?? []
+    }
+  };
+}
 function trigger(id, tables, triggers, inventory, reason) {
   return { id, class: "trigger-covered", tables, sites: [], triggers, inventory, reason };
 }
@@ -14250,10 +14229,14 @@ function rule(id, task, table, columns, inventory, reason, tables = [table]) {
     reason
   };
 }
-var SYNC_WRITE_INVARIANTS;
+var MERGE_ENGINE_GATE, SYNC_WRITE_INVARIANTS;
 var init_sync_write_invariants = __esm({
   "packages/contracts/src/invariants/sync-write-invariants.ts"() {
     "use strict";
+    MERGE_ENGINE_GATE = {
+      module: "packages/core/src/store/sync/merge/engine.ts",
+      functionName: "applyOp"
+    };
     SYNC_WRITE_INVARIANTS = Object.freeze([
       // §3.6.2: RAISE guards and UNIQUE indexes a migration creates on synced tables.
       trigger(
@@ -14334,13 +14317,16 @@ var init_sync_write_invariants = __esm({
         "at most one active account per provider (partial UNIQUE)"
       ),
       // §3.6.5: post-apply check families (T12344 items).
-      pac(
-        "task.tree.shape",
-        "PAC-01",
-        "T12922",
-        ["tasks_tasks"],
-        ["rows with a changed parent_id or type", "their direct children and ancestor chain"],
-        "saga\u2192epic\u2192task\u2192subtask matrix, non-saga has a parent, depth \u2264 3, no self-parent"
+      implementedCheck(
+        pac(
+          "task.tree.shape",
+          "PAC-01",
+          "T12922",
+          ["tasks_tasks"],
+          ["rows with a changed parent_id or type", "their direct children and ancestor chain"],
+          "saga\u2192epic\u2192task\u2192subtask matrix, non-saga has a parent, depth \u2264 3, no self-parent"
+        ),
+        "checkTaskTreeShape"
       ),
       pac(
         "task.terminal-parent.live-children",
@@ -14350,13 +14336,12 @@ var init_sync_write_invariants = __esm({
         ["rows whose status, stage or parent changed", "their parent and siblings"],
         "no terminal parent with a live child; epic stage \u2265 children; rollup re-evaluated"
       ),
-      pac(
+      trigger(
         "task.dependency.graph",
-        "PAC-03",
-        "T12924",
         ["tasks_task_dependencies", "tasks_tasks"],
-        ["dependency edges inserted in the page", "reachability from each depends_on"],
-        "dependencies are acyclic, with no self-edge"
+        ["tasks_task_dependencies_cycle_guard_insert", "tasks_task_dependencies_cycle_guard_update"],
+        ["PAC-03"],
+        "dependencies are acyclic, with no self-edge: enforced by the T12886 cycle guards on apply (a guard conflict)"
       ),
       pac(
         "task.done.evidence",
@@ -14446,38 +14431,47 @@ var init_sync_write_invariants = __esm({
         ["the owning rows"],
         "derived counters and cross-column facts agree with their rows"
       ),
-      pac(
-        "apply.preconditions",
-        "PAC-15",
-        "T12936",
-        ["tasks_tasks"],
-        ["the whole page"],
-        "no apply while the local twin collapse has failed; restore is a re-baseline"
+      implementedCheck(
+        pac(
+          "apply.preconditions",
+          "PAC-15",
+          "T12936",
+          ["tasks_tasks"],
+          ["the whole page"],
+          "no apply while the local twin collapse has failed; restore is a re-baseline"
+        ),
+        "checkApplyPreconditions"
       ),
       // §3.6.6: typed merge rules (T12344).
-      rule(
-        "task.status.absorbing",
-        "T12937",
-        "tasks_tasks",
-        ["status", "completed_at", "cancelled_at", "cancellation_reason", "pipeline_stage"],
-        ["V18", "V20", "C22", "P40", "P46", "P47"],
-        "done, cancelled and archived are absorbing; leaving them needs an explicit op"
+      implemented(
+        rule(
+          "task.status.absorbing",
+          "T12937",
+          "tasks_tasks",
+          ["status", "completed_at", "cancelled_at", "cancellation_reason", "pipeline_stage"],
+          ["V18", "V20", "C22", "P40", "P46", "P47"],
+          "done, cancelled and archived are absorbing; leaving them needs an explicit op"
+        )
       ),
-      rule(
-        "task.pipeline-stage.max",
-        "T12938",
-        "tasks_tasks",
-        ["pipeline_stage"],
-        ["V21", "C20", "P01", "F3"],
-        "pipeline_stage is the maximum by STAGE_ORDER, except an explicit restore"
+      implemented(
+        rule(
+          "task.pipeline-stage.max",
+          "T12938",
+          "tasks_tasks",
+          ["pipeline_stage"],
+          ["V21", "C20", "P01", "F3"],
+          "pipeline_stage is the maximum by STAGE_ORDER, except an explicit restore"
+        )
       ),
-      rule(
-        "task.verification.frozen-on-done",
-        "T12939",
-        "tasks_tasks",
-        ["verification_json"],
-        ["C01", "C02", "C03", "C17"],
-        "verification is frozen once done; otherwise merged per gate"
+      implemented(
+        rule(
+          "task.verification.frozen-on-done",
+          "T12939",
+          "tasks_tasks",
+          ["verification_json"],
+          ["C01", "C02", "C03", "C17"],
+          "verification is frozen once done; otherwise merged per gate"
+        )
       ),
       rule(
         "session.status.terminal",
@@ -14613,111 +14607,111 @@ var init_lafs = __esm({
 });
 
 // packages/contracts/src/lease-ipc/messages.ts
-import { z as z12 } from "zod";
+import { z as z11 } from "zod";
 var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, ResourceAdmitRequestSchema, ResourceReleaseRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, ResourceAdmitDispositionSchema, ResourceAdmitResultResponseSchema, ResourceReleaseResultResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
 var init_messages2 = __esm({
   "packages/contracts/src/lease-ipc/messages.ts"() {
     "use strict";
-    LeaseScopeSchema = z12.enum(["project", "global"]);
-    LeaseLaneSchema = z12.enum(["tasks", "brain", "bulk"]);
-    LeaseAcquireRequestSchema = z12.object({
+    LeaseScopeSchema = z11.enum(["project", "global"]);
+    LeaseLaneSchema = z11.enum(["tasks", "brain", "bulk"]);
+    LeaseAcquireRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("lease_acquire"),
+      kind: z11.literal("lease_acquire"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** Advisory priority — lower acquires sooner. `0` = highest. */
-      priority: z12.number().int().min(0).max(255),
+      priority: z11.number().int().min(0).max(255),
       /** Lease time-to-live in milliseconds. */
-      ttl_ms: z12.number().int().nonnegative(),
+      ttl_ms: z11.number().int().nonnegative(),
       /** When true, a same-holder acquire re-enters (refcount++) rather than queuing. */
-      reentrant: z12.boolean()
+      reentrant: z11.boolean()
     }).strict();
-    LeaseReleaseRequestSchema = z12.object({
+    LeaseReleaseRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("lease_release"),
+      kind: z11.literal("lease_release"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** The epoch fence the holder acquired — a stale epoch no-ops. */
-      epoch: z12.number().int().nonnegative()
+      epoch: z11.number().int().nonnegative()
     }).strict();
-    LeaseRenewRequestSchema = z12.object({
+    LeaseRenewRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("lease_renew"),
+      kind: z11.literal("lease_renew"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** The epoch fence the holder acquired (epoch-guarded renew). */
-      epoch: z12.number().int().nonnegative()
+      epoch: z11.number().int().nonnegative()
     }).strict();
-    RateCheckRequestSchema = z12.object({
+    RateCheckRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("rate_check"),
+      kind: z11.literal("rate_check"),
       /** The cleo.db scope being checked. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Estimated bytes the caller intends to write. */
-      est_bytes: z12.number().int().nonnegative()
+      est_bytes: z11.number().int().nonnegative()
     }).strict();
-    ToolGrantRequestSchema = z12.object({
+    ToolGrantRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("tool_grant"),
+      kind: z11.literal("tool_grant"),
       /** The tool name being requested. */
-      tool: z12.string().min(1),
+      tool: z11.string().min(1),
       /** The requesting holder identity. */
-      holder_id: z12.string().min(1)
+      holder_id: z11.string().min(1)
     }).strict();
-    QueuePriorityClassSchema = z12.enum(["lead", "worker", "background"]);
-    QueueAdmitRequestSchema = z12.object({
+    QueuePriorityClassSchema = z11.enum(["lead", "worker", "background"]);
+    QueueAdmitRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("queue_admit"),
+      kind: z11.literal("queue_admit"),
       /** The LLM provider id the call targets (rate budget is per-provider). */
-      provider: z12.string().min(1),
+      provider: z11.string().min(1),
       /** The caller's priority class (lead > worker > background). */
       priority_class: QueuePriorityClassSchema,
       /** The caller's estimate of the request's token cost (debited on admit). */
-      est_tokens: z12.number().int().nonnegative(),
+      est_tokens: z11.number().int().nonnegative(),
       /** The child the call belongs to (in-flight tracking — the watchdog seam). */
-      child_id: z12.string().min(1)
+      child_id: z11.string().min(1)
     }).strict();
-    WorkerHeartbeatRequestSchema = z12.object({
+    WorkerHeartbeatRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("worker_heartbeat"),
+      kind: z11.literal("worker_heartbeat"),
       /** The logical id of the heartbeating child (matches the registry key). */
-      child_id: z12.string().min(1),
+      child_id: z11.string().min(1),
       /** The worker's own view of whether it is currently inside an LLM call. */
-      in_flight_llm: z12.boolean()
+      in_flight_llm: z11.boolean()
     }).strict();
-    ResourceAdmitRequestSchema = z12.object({
+    ResourceAdmitRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("resource_admit"),
+      kind: z11.literal("resource_admit"),
       /** The resource class (e.g. `"db-heavy"`, `"full-build"`, `"test-run"`). */
-      class: z12.string().min(1),
+      class: z11.string().min(1),
       /** The caller holding the slot — process/worktree-unique; the release key. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** The client-computed budget: the max concurrent holders for this class. */
-      budget: z12.number().int().nonnegative()
+      budget: z11.number().int().nonnegative()
     }).strict();
-    ResourceReleaseRequestSchema = z12.object({
+    ResourceReleaseRequestSchema = z11.object({
       /** Tag discriminating this request variant. */
-      kind: z12.literal("resource_release"),
+      kind: z11.literal("resource_release"),
       /** The resource class the slot belongs to. */
-      class: z12.string().min(1),
+      class: z11.string().min(1),
       /** The holder that was admitted (matches the admit `holder_id`). */
-      holder_id: z12.string().min(1)
+      holder_id: z11.string().min(1)
     }).strict();
-    LeaseIpcRequestSchema = z12.discriminatedUnion("kind", [
+    LeaseIpcRequestSchema = z11.discriminatedUnion("kind", [
       LeaseAcquireRequestSchema,
       LeaseReleaseRequestSchema,
       LeaseRenewRequestSchema,
@@ -14728,133 +14722,133 @@ var init_messages2 = __esm({
       ResourceAdmitRequestSchema,
       ResourceReleaseRequestSchema
     ]);
-    LeaseGrantedResponseSchema = z12.object({
+    LeaseGrantedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("lease_granted"),
+      kind: z11.literal("lease_granted"),
       /** The granted cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The granted write lane. */
       lane: LeaseLaneSchema,
       /** The holder the lease was granted to. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** The monotonic epoch fence assigned to this grant. */
-      epoch: z12.number().int().nonnegative(),
+      epoch: z11.number().int().nonnegative(),
       /** The lease TTL in milliseconds. */
-      ttl_ms: z12.number().int().nonnegative(),
+      ttl_ms: z11.number().int().nonnegative(),
       /** Absolute expiry timestamp (epoch ms) for this grant. */
-      expires_at_ms: z12.number().int().nonnegative()
+      expires_at_ms: z11.number().int().nonnegative()
     }).strict();
-    LeaseQueuedResponseSchema = z12.object({
+    LeaseQueuedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("lease_queued"),
+      kind: z11.literal("lease_queued"),
       /** The queued cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The queued write lane. */
       lane: LeaseLaneSchema,
       /** The monotonic ticket assigned for FIFO tiebreak. */
-      ticket: z12.number().int().nonnegative(),
+      ticket: z11.number().int().nonnegative(),
       /** Number of waiters ahead of this one. */
-      ahead: z12.number().int().nonnegative()
+      ahead: z11.number().int().nonnegative()
     }).strict();
-    LeaseDeniedResponseSchema = z12.object({
+    LeaseDeniedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("lease_denied"),
+      kind: z11.literal("lease_denied"),
       /** The denied cleo.db scope. */
       scope: LeaseScopeSchema,
       /** Machine-readable denial code (e.g. `E_LEASE_UNAVAILABLE`). */
-      code: z12.string().min(1),
+      code: z11.string().min(1),
       /** Human-readable denial message. */
-      message: z12.string()
+      message: z11.string()
     }).strict();
-    RateResultResponseSchema = z12.object({
+    RateResultResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("rate_result"),
+      kind: z11.literal("rate_result"),
       /** The checked cleo.db scope. */
       scope: LeaseScopeSchema,
       /** Whether the write is within budget. */
-      ok: z12.boolean(),
+      ok: z11.boolean(),
       /** Suggested back-off in milliseconds when `ok` is false. */
-      retry_after_ms: z12.number().int().nonnegative(),
+      retry_after_ms: z11.number().int().nonnegative(),
       /** Remaining token budget for the scope. */
-      tokens_remaining: z12.number().int().nonnegative()
+      tokens_remaining: z11.number().int().nonnegative()
     }).strict();
-    ToolGrantedResponseSchema = z12.object({
+    ToolGrantedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("tool_granted"),
+      kind: z11.literal("tool_granted"),
       /** The granted tool name. */
-      tool: z12.string().min(1),
+      tool: z11.string().min(1),
       /** The holder the tool grant was issued to. */
-      holder_id: z12.string().min(1)
+      holder_id: z11.string().min(1)
     }).strict();
-    LeaseRevokedResponseSchema = z12.object({
+    LeaseRevokedResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("lease_revoked"),
+      kind: z11.literal("lease_revoked"),
       /** The revoked cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The revoked write lane. */
       lane: LeaseLaneSchema,
       /** The holder whose lease was revoked. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** Human-readable reason for the revocation. */
-      reason: z12.string()
+      reason: z11.string()
     }).strict();
-    ChildKilledUnresponsiveResponseSchema = z12.object({
+    ChildKilledUnresponsiveResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("child_killed_unresponsive"),
+      kind: z11.literal("child_killed_unresponsive"),
       /** Logical id of the killed child. */
-      child_id: z12.string().min(1),
+      child_id: z11.string().min(1),
       /** The holder identity the killed child held the lease as. */
-      holder_id: z12.string().min(1),
+      holder_id: z11.string().min(1),
       /** The cleo.db scope the killed child held the lease in. */
       scope: LeaseScopeSchema,
       /** Human-readable reason for the kill. */
-      reason: z12.string()
+      reason: z11.string()
     }).strict();
-    QueueAdmitDispositionSchema = z12.enum(["admitted", "deferred"]);
-    QueueAdmitResultResponseSchema = z12.object({
+    QueueAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
+    QueueAdmitResultResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("queue_admit_result"),
+      kind: z11.literal("queue_admit_result"),
       /** Whether the LLM call was admitted or deferred. */
       disposition: QueueAdmitDispositionSchema,
       /** Back-off in ms before re-requesting (0 when admitted). */
-      retry_after_ms: z12.number().int().nonnegative(),
+      retry_after_ms: z11.number().int().nonnegative(),
       /** Remaining provider token budget after this decision. */
-      tokens_remaining: z12.number().int().nonnegative(),
+      tokens_remaining: z11.number().int().nonnegative(),
       /** Number of higher/equal-priority waiters ahead (0 when admitted). */
-      queue_position: z12.number().int().nonnegative()
+      queue_position: z11.number().int().nonnegative()
     }).strict();
-    HeartbeatAckResponseSchema = z12.object({
+    HeartbeatAckResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("heartbeat_ack")
+      kind: z11.literal("heartbeat_ack")
     }).strict();
-    ResourceAdmitDispositionSchema = z12.enum(["admitted", "deferred"]);
-    ResourceAdmitResultResponseSchema = z12.object({
+    ResourceAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
+    ResourceAdmitResultResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("resource_admit_result"),
+      kind: z11.literal("resource_admit_result"),
       /** Whether the heavy op was admitted or deferred. */
       disposition: ResourceAdmitDispositionSchema,
       /** Back-off in ms before re-requesting (0 when admitted). */
-      retry_after_ms: z12.number().int().nonnegative(),
+      retry_after_ms: z11.number().int().nonnegative(),
       /** Remaining slots for the class after this decision. */
-      slots_remaining: z12.number().int().nonnegative()
+      slots_remaining: z11.number().int().nonnegative()
     }).strict();
-    ResourceReleaseResultResponseSchema = z12.object({
+    ResourceReleaseResultResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("resource_release_result"),
+      kind: z11.literal("resource_release_result"),
       /** Whether a held slot was actually released (false = no such holder). */
-      released: z12.boolean(),
+      released: z11.boolean(),
       /** Remaining in-flight holders for the class after the release. */
-      slots_remaining: z12.number().int().nonnegative()
+      slots_remaining: z11.number().int().nonnegative()
     }).strict();
-    LeaseErrorResponseSchema = z12.object({
+    LeaseErrorResponseSchema = z11.object({
       /** Tag discriminating this response variant. */
-      kind: z12.literal("error"),
+      kind: z11.literal("error"),
       /** Machine-readable error code (e.g. `E_LEASE_BAD_VERSION`, `E_LEASE_UNIMPLEMENTED`). */
-      code: z12.string().min(1),
+      code: z11.string().min(1),
       /** Human-readable error message. */
-      message: z12.string()
+      message: z11.string()
     }).strict();
-    LeaseIpcResponseSchema = z12.discriminatedUnion("kind", [
+    LeaseIpcResponseSchema = z11.discriminatedUnion("kind", [
       LeaseGrantedResponseSchema,
       LeaseQueuedResponseSchema,
       LeaseDeniedResponseSchema,
@@ -14868,27 +14862,27 @@ var init_messages2 = __esm({
       ResourceReleaseResultResponseSchema,
       LeaseErrorResponseSchema
     ]);
-    LeaseIpcRequestEnvelopeSchema = z12.object({
+    LeaseIpcRequestEnvelopeSchema = z11.object({
       /** Parallel protocol version. */
-      protocol_version: z12.string(),
+      protocol_version: z11.string(),
       /** Correlation id echoed back on the matching response. */
-      id: z12.string().min(1),
+      id: z11.string().min(1),
       /** Direction discriminator. */
-      direction: z12.literal("request"),
+      direction: z11.literal("request"),
       /** The request body. */
       request: LeaseIpcRequestSchema
     }).strict();
-    LeaseIpcResponseEnvelopeSchema = z12.object({
+    LeaseIpcResponseEnvelopeSchema = z11.object({
       /** Parallel protocol version. */
-      protocol_version: z12.string(),
+      protocol_version: z11.string(),
       /** Correlation id echoed from the originating request (or a fresh id for events). */
-      id: z12.string().min(1),
+      id: z11.string().min(1),
       /** Direction discriminator. */
-      direction: z12.literal("response"),
+      direction: z11.literal("response"),
       /** The response body. */
       response: LeaseIpcResponseSchema
     }).strict();
-    LeaseIpcEnvelopeSchema = z12.discriminatedUnion("direction", [
+    LeaseIpcEnvelopeSchema = z11.discriminatedUnion("direction", [
       LeaseIpcRequestEnvelopeSchema,
       LeaseIpcResponseEnvelopeSchema
     ]);
@@ -14941,7 +14935,7 @@ var init_lease_ipc = __esm({
 });
 
 // packages/contracts/src/llm/catalog-schema.ts
-import { z as z13 } from "zod";
+import { z as z12 } from "zod";
 var CATALOG_MODEL_STATUSES, CATALOG_AUTH_TYPES, isoDate, semver, catalogModalitiesSchema, catalogCostSchema, catalogLimitSchema, catalogModelProviderSchema, catalogModelEntrySchema, catalogProviderSchema, curatedCatalogSchema, modelsCatalogRowInsertSchema, modelsCatalogRowSelectSchema;
 var init_catalog_schema = __esm({
   "packages/contracts/src/llm/catalog-schema.ts"() {
@@ -14954,78 +14948,78 @@ var init_catalog_schema = __esm({
       "retired"
     ];
     CATALOG_AUTH_TYPES = ["api_key", "oauth", "bedrock", "vertex"];
-    isoDate = z13.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)");
-    semver = z13.string().regex(/^\d+\.\d+\.\d+$/, "must be semver (MAJOR.MINOR.PATCH)");
-    catalogModalitiesSchema = z13.object({
-      input: z13.array(z13.string()),
-      output: z13.array(z13.string())
+    isoDate = z12.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)");
+    semver = z12.string().regex(/^\d+\.\d+\.\d+$/, "must be semver (MAJOR.MINOR.PATCH)");
+    catalogModalitiesSchema = z12.object({
+      input: z12.array(z12.string()),
+      output: z12.array(z12.string())
     }).strict();
-    catalogCostSchema = z13.object({
-      input: z13.number().optional(),
-      output: z13.number().optional(),
-      cache_read: z13.number().optional(),
-      cache_write: z13.number().optional(),
-      context_over_200k: z13.number().optional()
+    catalogCostSchema = z12.object({
+      input: z12.number().optional(),
+      output: z12.number().optional(),
+      cache_read: z12.number().optional(),
+      cache_write: z12.number().optional(),
+      context_over_200k: z12.number().optional()
     }).strict();
-    catalogLimitSchema = z13.object({
-      context: z13.number(),
-      output: z13.number()
+    catalogLimitSchema = z12.object({
+      context: z12.number(),
+      output: z12.number()
     }).strict();
-    catalogModelProviderSchema = z13.object({
-      npm: z13.string(),
-      api: z13.string()
+    catalogModelProviderSchema = z12.object({
+      npm: z12.string(),
+      api: z12.string()
     }).strict();
-    catalogModelEntrySchema = z13.object({
-      id: z13.string(),
-      name: z13.string(),
-      family: z13.string(),
-      attachment: z13.boolean(),
-      reasoning: z13.boolean(),
-      temperature: z13.boolean(),
-      interleaved: z13.boolean(),
-      tool_call: z13.boolean(),
+    catalogModelEntrySchema = z12.object({
+      id: z12.string(),
+      name: z12.string(),
+      family: z12.string(),
+      attachment: z12.boolean(),
+      reasoning: z12.boolean(),
+      temperature: z12.boolean(),
+      interleaved: z12.boolean(),
+      tool_call: z12.boolean(),
       modalities: catalogModalitiesSchema,
       cost: catalogCostSchema,
       limit: catalogLimitSchema,
-      status: z13.enum(CATALOG_MODEL_STATUSES),
+      status: z12.enum(CATALOG_MODEL_STATUSES),
       release_date: isoDate,
       provider: catalogModelProviderSchema
     }).strict();
-    catalogProviderSchema = z13.object({
-      id: z13.string(),
-      endpoint: z13.string(),
-      authTypes: z13.array(z13.enum(CATALOG_AUTH_TYPES)).min(1),
-      npm: z13.string().optional()
+    catalogProviderSchema = z12.object({
+      id: z12.string(),
+      endpoint: z12.string(),
+      authTypes: z12.array(z12.enum(CATALOG_AUTH_TYPES)).min(1),
+      npm: z12.string().optional()
     }).strict();
-    curatedCatalogSchema = z13.object({
-      $schema: z13.string().optional(),
+    curatedCatalogSchema = z12.object({
+      $schema: z12.string().optional(),
       version: semver,
       lastUpdated: isoDate,
-      providers: z13.record(z13.string(), catalogProviderSchema),
-      models: z13.record(z13.string(), z13.record(z13.string(), catalogModelEntrySchema))
+      providers: z12.record(z12.string(), catalogProviderSchema),
+      models: z12.record(z12.string(), z12.record(z12.string(), catalogModelEntrySchema))
     }).strict();
-    modelsCatalogRowInsertSchema = z13.object({
-      id: z13.string(),
-      providerId: z13.string(),
-      name: z13.string(),
-      family: z13.string(),
-      attachment: z13.boolean(),
-      reasoning: z13.boolean(),
-      temperature: z13.boolean(),
-      interleaved: z13.boolean(),
-      toolCall: z13.boolean(),
-      modalities: z13.string(),
-      cost: z13.string(),
-      contextLimit: z13.number().nullable().optional(),
-      outputLimit: z13.number().nullable().optional(),
-      status: z13.enum(CATALOG_MODEL_STATUSES),
+    modelsCatalogRowInsertSchema = z12.object({
+      id: z12.string(),
+      providerId: z12.string(),
+      name: z12.string(),
+      family: z12.string(),
+      attachment: z12.boolean(),
+      reasoning: z12.boolean(),
+      temperature: z12.boolean(),
+      interleaved: z12.boolean(),
+      toolCall: z12.boolean(),
+      modalities: z12.string(),
+      cost: z12.string(),
+      contextLimit: z12.number().nullable().optional(),
+      outputLimit: z12.number().nullable().optional(),
+      status: z12.enum(CATALOG_MODEL_STATUSES),
       releaseDate: isoDate,
-      modelsDevId: z13.string(),
-      source: z13.string(),
-      seededAt: z13.string().optional()
+      modelsDevId: z12.string(),
+      source: z12.string(),
+      seededAt: z12.string().optional()
     }).strict();
     modelsCatalogRowSelectSchema = modelsCatalogRowInsertSchema.extend({
-      seededAt: z13.string()
+      seededAt: z12.string()
     });
   }
 });
@@ -15140,7 +15134,7 @@ var init_status_registry = __esm({
 });
 
 // packages/contracts/src/workgraph.ts
-import { z as z14 } from "zod";
+import { z as z13 } from "zod";
 var E_WORKGRAPH_PARENT_TYPE_MATRIX, taskTypeSchema, taskPrioritySchema, taskStatusSchema, verificationGateSchema, workGraphRelationKindSchema, workGraphTraversalDirectionSchema, workGraphEdgeDirectionSchema, paginationParamsSchema, workGraphNodeSchema, workGraphEdgeSchema, workGraphHierarchyEdgeSchema, workGraphPageInfoSchema, workGraphRollupCountsSchema, workGraphSubtreePercentagesSchema, workGraphProjectionMismatchSchema, workGraphReadyFrontierTaskSchema, workGraphRelationEdgeSchema, workGraphDependencyEdgeSchema, workGraphOmissionReasonSchema, workGraphContextBudgetSchema, workGraphOmissionSchema, workGraphDirectEdgeSchema, workGraphContextPackParamsSchema, workGraphSliceParamsSchema, workGraphSliceSchema, workGraphReadinessParamsSchema, workGraphReadinessResultSchema, workGraphContextPackSchema, workGraphScaffoldValidateParamsSchema, workGraphScaffoldValidationIssueSchema, workGraphScaffoldValidateResultSchema, workGraphScaffoldApplyParamsSchema, workGraphScaffoldApplyResultSchema, workGraphPlanningDocParamsSchema, workGraphPlanningDocSchema, tasksTraverseParamsSchema, tasksTraverseResultSchema, tasksTreeParamsSchema, tasksTreeResultSchema, tasksRollupParamsSchema, tasksRollupResultSchema, tasksFrontierParamsSchema, tasksFrontierResultSchema, tasksWorkGraphAuditParamsSchema, tasksWorkGraphAuditResultSchema;
 var init_workgraph = __esm({
   "packages/contracts/src/workgraph.ts"() {
@@ -15148,10 +15142,10 @@ var init_workgraph = __esm({
     init_enums();
     init_status_registry();
     E_WORKGRAPH_PARENT_TYPE_MATRIX = "E_WORKGRAPH_PARENT_TYPE_MATRIX";
-    taskTypeSchema = z14.enum(["saga", "epic", "task", "subtask"]);
-    taskPrioritySchema = z14.enum(["critical", "high", "medium", "low"]);
-    taskStatusSchema = z14.enum(TASK_STATUSES);
-    verificationGateSchema = z14.enum([
+    taskTypeSchema = z13.enum(["saga", "epic", "task", "subtask"]);
+    taskPrioritySchema = z13.enum(["critical", "high", "medium", "low"]);
+    taskStatusSchema = z13.enum(TASK_STATUSES);
+    verificationGateSchema = z13.enum([
       "implemented",
       "testsPassed",
       "qaPassed",
@@ -15160,7 +15154,7 @@ var init_workgraph = __esm({
       "documented",
       "nexusImpact"
     ]);
-    workGraphRelationKindSchema = z14.enum([
+    workGraphRelationKindSchema = z13.enum([
       "contains",
       "depends_on",
       "blocks",
@@ -15168,317 +15162,317 @@ var init_workgraph = __esm({
       "groups",
       "satisfies"
     ]);
-    workGraphTraversalDirectionSchema = z14.enum([
+    workGraphTraversalDirectionSchema = z13.enum([
       "ancestors",
       "descendants",
       "upstream",
       "downstream"
     ]);
-    workGraphEdgeDirectionSchema = z14.enum(["out", "in", "both"]);
-    paginationParamsSchema = z14.object({
-      cursor: z14.string().min(1).optional(),
-      limit: z14.number().int().positive().max(500).optional()
+    workGraphEdgeDirectionSchema = z13.enum(["out", "in", "both"]);
+    paginationParamsSchema = z13.object({
+      cursor: z13.string().min(1).optional(),
+      limit: z13.number().int().positive().max(500).optional()
     });
-    workGraphNodeSchema = z14.object({
-      id: z14.string().min(1),
+    workGraphNodeSchema = z13.object({
+      id: z13.string().min(1),
       type: taskTypeSchema,
-      title: z14.string(),
+      title: z13.string(),
       status: taskStatusSchema,
       priority: taskPrioritySchema,
-      parentId: z14.string().min(1).optional()
+      parentId: z13.string().min(1).optional()
     });
-    workGraphEdgeSchema = z14.object({
-      fromId: z14.string().min(1),
-      toId: z14.string().min(1),
+    workGraphEdgeSchema = z13.object({
+      fromId: z13.string().min(1),
+      toId: z13.string().min(1),
       kind: workGraphRelationKindSchema
     });
-    workGraphHierarchyEdgeSchema = z14.object({
-      fromId: z14.string().min(1),
-      toId: z14.string().min(1),
-      kind: z14.literal("contains")
+    workGraphHierarchyEdgeSchema = z13.object({
+      fromId: z13.string().min(1),
+      toId: z13.string().min(1),
+      kind: z13.literal("contains")
     }).strict();
-    workGraphPageInfoSchema = z14.object({
-      nextCursor: z14.string().min(1).optional(),
-      hasMore: z14.boolean()
-    });
-    workGraphRollupCountsSchema = z14.object({
-      total: z14.number().int().nonnegative(),
-      byStatus: z14.partialRecord(taskStatusSchema, z14.number().int().nonnegative()),
-      byType: z14.partialRecord(taskTypeSchema, z14.number().int().nonnegative())
-    });
-    workGraphSubtreePercentagesSchema = z14.object({
-      done: z14.number().nonnegative(),
-      active: z14.number().nonnegative(),
-      blocked: z14.number().nonnegative(),
-      pending: z14.number().nonnegative(),
-      cancelled: z14.number().nonnegative()
-    });
-    workGraphProjectionMismatchSchema = z14.object({
-      field: z14.string().min(1),
-      expected: z14.number().int().nonnegative(),
-      actual: z14.number().int().nonnegative()
+    workGraphPageInfoSchema = z13.object({
+      nextCursor: z13.string().min(1).optional(),
+      hasMore: z13.boolean()
+    });
+    workGraphRollupCountsSchema = z13.object({
+      total: z13.number().int().nonnegative(),
+      byStatus: z13.partialRecord(taskStatusSchema, z13.number().int().nonnegative()),
+      byType: z13.partialRecord(taskTypeSchema, z13.number().int().nonnegative())
+    });
+    workGraphSubtreePercentagesSchema = z13.object({
+      done: z13.number().nonnegative(),
+      active: z13.number().nonnegative(),
+      blocked: z13.number().nonnegative(),
+      pending: z13.number().nonnegative(),
+      cancelled: z13.number().nonnegative()
+    });
+    workGraphProjectionMismatchSchema = z13.object({
+      field: z13.string().min(1),
+      expected: z13.number().int().nonnegative(),
+      actual: z13.number().int().nonnegative()
     });
     workGraphReadyFrontierTaskSchema = workGraphNodeSchema.extend({
-      role: z14.string().min(1).optional(),
-      dependencyBlockers: z14.array(z14.object({ taskId: z14.string().min(1), status: taskStatusSchema })),
-      gateBlockers: z14.array(z14.object({ gate: verificationGateSchema }))
+      role: z13.string().min(1).optional(),
+      dependencyBlockers: z13.array(z13.object({ taskId: z13.string().min(1), status: taskStatusSchema })),
+      gateBlockers: z13.array(z13.object({ gate: verificationGateSchema }))
     });
     workGraphRelationEdgeSchema = workGraphEdgeSchema.extend({
-      source: z14.literal("relation"),
-      relationType: z14.enum(TASK_RELATION_TYPES),
-      reason: z14.string().min(1).optional()
+      source: z13.literal("relation"),
+      relationType: z13.enum(TASK_RELATION_TYPES),
+      reason: z13.string().min(1).optional()
     });
     workGraphDependencyEdgeSchema = workGraphEdgeSchema.extend({
-      source: z14.literal("dependency"),
-      kind: z14.literal("depends_on")
+      source: z13.literal("dependency"),
+      kind: z13.literal("depends_on")
     });
-    workGraphOmissionReasonSchema = z14.enum([
+    workGraphOmissionReasonSchema = z13.enum([
       "budget_exceeded",
       "not_requested",
       "not_available",
       "redacted",
       "truncated"
     ]);
-    workGraphContextBudgetSchema = z14.object({
-      tokenBudget: z14.number().int().nonnegative(),
-      estimatedTokens: z14.number().int().nonnegative(),
-      remainingTokens: z14.number().int().nonnegative(),
-      truncated: z14.boolean()
-    });
-    workGraphOmissionSchema = z14.object({
-      path: z14.string().min(1),
+    workGraphContextBudgetSchema = z13.object({
+      tokenBudget: z13.number().int().nonnegative(),
+      estimatedTokens: z13.number().int().nonnegative(),
+      remainingTokens: z13.number().int().nonnegative(),
+      truncated: z13.boolean()
+    });
+    workGraphOmissionSchema = z13.object({
+      path: z13.string().min(1),
       reason: workGraphOmissionReasonSchema,
-      message: z14.string().min(1),
-      estimatedTokens: z14.number().int().nonnegative().optional()
+      message: z13.string().min(1),
+      estimatedTokens: z13.number().int().nonnegative().optional()
     });
-    workGraphDirectEdgeSchema = z14.discriminatedUnion("source", [
+    workGraphDirectEdgeSchema = z13.discriminatedUnion("source", [
       workGraphRelationEdgeSchema,
       workGraphDependencyEdgeSchema
     ]);
     workGraphContextPackParamsSchema = paginationParamsSchema.extend({
-      rootId: z14.string().min(1),
-      tokenBudget: z14.number().int().positive().optional(),
-      includeRelations: z14.boolean().optional(),
-      includeReadiness: z14.boolean().optional(),
-      includeRollup: z14.boolean().optional()
+      rootId: z13.string().min(1),
+      tokenBudget: z13.number().int().positive().optional(),
+      includeRelations: z13.boolean().optional(),
+      includeReadiness: z13.boolean().optional(),
+      includeRollup: z13.boolean().optional()
     });
     workGraphSliceParamsSchema = paginationParamsSchema.extend({
-      rootId: z14.string().min(1),
+      rootId: z13.string().min(1),
       direction: workGraphTraversalDirectionSchema.optional(),
-      maxDepth: z14.number().int().nonnegative().optional(),
-      includeRelations: z14.boolean().optional()
+      maxDepth: z13.number().int().nonnegative().optional(),
+      includeRelations: z13.boolean().optional()
     });
-    workGraphSliceSchema = z14.object({
-      rootId: z14.string().min(1),
+    workGraphSliceSchema = z13.object({
+      rootId: z13.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      nodes: z14.array(workGraphNodeSchema),
-      edges: z14.array(workGraphEdgeSchema),
+      nodes: z13.array(workGraphNodeSchema),
+      edges: z13.array(workGraphEdgeSchema),
       pageInfo: workGraphPageInfoSchema,
-      omissions: z14.array(workGraphOmissionSchema).optional()
-    });
-    workGraphReadinessParamsSchema = z14.object({
-      rootId: z14.string().min(1),
-      role: z14.string().min(1).optional(),
-      includeGateBlockers: z14.boolean().optional()
-    });
-    workGraphReadinessResultSchema = z14.object({
-      rootId: z14.string().min(1),
-      role: z14.string().min(1).optional(),
-      ready: z14.boolean(),
-      warnings: z14.array(z14.string()),
-      groups: z14.object({
-        ready: z14.array(workGraphReadyFrontierTaskSchema),
-        blocked: z14.array(workGraphReadyFrontierTaskSchema),
-        blockedBy: z14.array(
-          z14.discriminatedUnion("kind", [
-            z14.object({
-              kind: z14.literal("dependency"),
-              blockerId: z14.string().min(1),
-              blocks: z14.array(z14.string().min(1))
+      omissions: z13.array(workGraphOmissionSchema).optional()
+    });
+    workGraphReadinessParamsSchema = z13.object({
+      rootId: z13.string().min(1),
+      role: z13.string().min(1).optional(),
+      includeGateBlockers: z13.boolean().optional()
+    });
+    workGraphReadinessResultSchema = z13.object({
+      rootId: z13.string().min(1),
+      role: z13.string().min(1).optional(),
+      ready: z13.boolean(),
+      warnings: z13.array(z13.string()),
+      groups: z13.object({
+        ready: z13.array(workGraphReadyFrontierTaskSchema),
+        blocked: z13.array(workGraphReadyFrontierTaskSchema),
+        blockedBy: z13.array(
+          z13.discriminatedUnion("kind", [
+            z13.object({
+              kind: z13.literal("dependency"),
+              blockerId: z13.string().min(1),
+              blocks: z13.array(z13.string().min(1))
             }),
-            z14.object({
-              kind: z14.literal("gate"),
+            z13.object({
+              kind: z13.literal("gate"),
               gate: verificationGateSchema,
-              blocks: z14.array(z14.string().min(1))
+              blocks: z13.array(z13.string().min(1))
             })
           ])
         )
       })
     });
-    workGraphContextPackSchema = z14.object({
-      rootId: z14.string().min(1),
-      generatedAt: z14.string().min(1),
+    workGraphContextPackSchema = z13.object({
+      rootId: z13.string().min(1),
+      generatedAt: z13.string().min(1),
       budget: workGraphContextBudgetSchema,
       slice: workGraphSliceSchema,
-      relationEdges: z14.object({
-        rootId: z14.string().min(1),
+      relationEdges: z13.object({
+        rootId: z13.string().min(1),
         direction: workGraphEdgeDirectionSchema,
-        edges: z14.array(workGraphDirectEdgeSchema)
+        edges: z13.array(workGraphDirectEdgeSchema)
       }).optional(),
       readiness: workGraphReadinessResultSchema.optional(),
-      rollup: z14.lazy(() => tasksRollupResultSchema).optional(),
-      omissions: z14.array(workGraphOmissionSchema)
-    });
-    workGraphScaffoldValidateParamsSchema = z14.object({
-      rootId: z14.string().min(1),
-      nodes: z14.array(
-        z14.object({
-          id: z14.string().min(1),
+      rollup: z13.lazy(() => tasksRollupResultSchema).optional(),
+      omissions: z13.array(workGraphOmissionSchema)
+    });
+    workGraphScaffoldValidateParamsSchema = z13.object({
+      rootId: z13.string().min(1),
+      nodes: z13.array(
+        z13.object({
+          id: z13.string().min(1),
           type: taskTypeSchema,
-          parentId: z14.string().min(1).nullable().optional()
+          parentId: z13.string().min(1).nullable().optional()
         })
       ),
-      edges: z14.array(workGraphDirectEdgeSchema).optional(),
-      dryRun: z14.boolean().optional()
-    });
-    workGraphScaffoldValidationIssueSchema = z14.object({
-      code: z14.string().min(1),
-      message: z14.string().min(1),
-      taskId: z14.string().min(1).optional(),
-      severity: z14.enum(["error", "warning"])
-    });
-    workGraphScaffoldValidateResultSchema = z14.object({
-      rootId: z14.string().min(1),
-      valid: z14.boolean(),
-      dryRun: z14.boolean(),
-      issues: z14.array(workGraphScaffoldValidationIssueSchema),
-      hierarchy: z14.object({
-        valid: z14.boolean(),
-        violations: z14.array(
-          z14.object({
-            code: z14.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
-            taskId: z14.string().min(1),
+      edges: z13.array(workGraphDirectEdgeSchema).optional(),
+      dryRun: z13.boolean().optional()
+    });
+    workGraphScaffoldValidationIssueSchema = z13.object({
+      code: z13.string().min(1),
+      message: z13.string().min(1),
+      taskId: z13.string().min(1).optional(),
+      severity: z13.enum(["error", "warning"])
+    });
+    workGraphScaffoldValidateResultSchema = z13.object({
+      rootId: z13.string().min(1),
+      valid: z13.boolean(),
+      dryRun: z13.boolean(),
+      issues: z13.array(workGraphScaffoldValidationIssueSchema),
+      hierarchy: z13.object({
+        valid: z13.boolean(),
+        violations: z13.array(
+          z13.object({
+            code: z13.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
+            taskId: z13.string().min(1),
             taskType: taskTypeSchema,
-            parentId: z14.string().min(1).nullable(),
+            parentId: z13.string().min(1).nullable(),
             parentType: taskTypeSchema.optional(),
-            message: z14.string().min(1)
+            message: z13.string().min(1)
           })
         )
       })
     });
     workGraphScaffoldApplyParamsSchema = workGraphScaffoldValidateParamsSchema.extend({
-      apply: z14.boolean().optional()
+      apply: z13.boolean().optional()
     });
     workGraphScaffoldApplyResultSchema = workGraphScaffoldValidateResultSchema.extend({
-      applied: z14.boolean(),
-      nodesChanged: z14.number().int().nonnegative(),
-      edgesChanged: z14.number().int().nonnegative()
-    });
-    workGraphPlanningDocParamsSchema = z14.object({
-      rootId: z14.string().min(1),
-      audience: z14.enum(["agent", "maintainer"]),
-      tokenBudget: z14.number().int().positive().optional(),
-      includeRelations: z14.boolean().optional(),
-      includeReadiness: z14.boolean().optional(),
-      includeRollup: z14.boolean().optional()
-    });
-    workGraphPlanningDocSchema = z14.object({
-      rootId: z14.string().min(1),
-      generatedAt: z14.string().min(1),
-      audience: z14.enum(["agent", "maintainer"]),
-      title: z14.string().min(1),
-      content: z14.string(),
-      sections: z14.array(z14.string().min(1)),
-      estimatedTokens: z14.number().int().nonnegative(),
-      budget: z14.object({
-        tokenBudget: z14.number().int().positive(),
-        truncated: z14.boolean()
+      applied: z13.boolean(),
+      nodesChanged: z13.number().int().nonnegative(),
+      edgesChanged: z13.number().int().nonnegative()
+    });
+    workGraphPlanningDocParamsSchema = z13.object({
+      rootId: z13.string().min(1),
+      audience: z13.enum(["agent", "maintainer"]),
+      tokenBudget: z13.number().int().positive().optional(),
+      includeRelations: z13.boolean().optional(),
+      includeReadiness: z13.boolean().optional(),
+      includeRollup: z13.boolean().optional()
+    });
+    workGraphPlanningDocSchema = z13.object({
+      rootId: z13.string().min(1),
+      generatedAt: z13.string().min(1),
+      audience: z13.enum(["agent", "maintainer"]),
+      title: z13.string().min(1),
+      content: z13.string(),
+      sections: z13.array(z13.string().min(1)),
+      estimatedTokens: z13.number().int().nonnegative(),
+      budget: z13.object({
+        tokenBudget: z13.number().int().positive(),
+        truncated: z13.boolean()
       }).optional()
     });
     tasksTraverseParamsSchema = paginationParamsSchema.extend({
-      rootId: z14.string().min(1),
+      rootId: z13.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      maxDepth: z14.number().int().nonnegative().optional(),
-      includeRelations: z14.boolean().optional()
+      maxDepth: z13.number().int().nonnegative().optional(),
+      includeRelations: z13.boolean().optional()
     });
-    tasksTraverseResultSchema = z14.object({
-      rootId: z14.string().min(1),
+    tasksTraverseResultSchema = z13.object({
+      rootId: z13.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      nodes: z14.array(workGraphNodeSchema),
-      edges: z14.array(workGraphEdgeSchema),
+      nodes: z13.array(workGraphNodeSchema),
+      edges: z13.array(workGraphEdgeSchema),
       pageInfo: workGraphPageInfoSchema
     });
     tasksTreeParamsSchema = paginationParamsSchema.extend({
-      rootId: z14.string().min(1),
-      maxDepth: z14.number().int().nonnegative().optional()
+      rootId: z13.string().min(1),
+      maxDepth: z13.number().int().nonnegative().optional()
     });
-    tasksTreeResultSchema = z14.object({
-      rootId: z14.string().min(1),
-      nodes: z14.array(workGraphNodeSchema.extend({ depth: z14.number().int().positive() })),
-      edges: z14.array(workGraphHierarchyEdgeSchema),
+    tasksTreeResultSchema = z13.object({
+      rootId: z13.string().min(1),
+      nodes: z13.array(workGraphNodeSchema.extend({ depth: z13.number().int().positive() })),
+      edges: z13.array(workGraphHierarchyEdgeSchema),
       pageInfo: workGraphPageInfoSchema
     });
-    tasksRollupParamsSchema = z14.object({
-      rootId: z14.string().min(1),
+    tasksRollupParamsSchema = z13.object({
+      rootId: z13.string().min(1),
       expectedDirectRollup: workGraphRollupCountsSchema.optional()
     });
-    tasksRollupResultSchema = z14.object({
-      rootId: z14.string().min(1),
+    tasksRollupResultSchema = z13.object({
+      rootId: z13.string().min(1),
       direct: workGraphRollupCountsSchema,
       subtree: workGraphRollupCountsSchema,
-      percentDenominator: z14.object({
-        basis: z14.literal("subtree-total"),
-        total: z14.number().int().nonnegative(),
-        description: z14.string().min(1)
+      percentDenominator: z13.object({
+        basis: z13.literal("subtree-total"),
+        total: z13.number().int().nonnegative(),
+        description: z13.string().min(1)
       }),
       percentages: workGraphSubtreePercentagesSchema,
-      staleProjection: z14.boolean(),
-      projectionMismatches: z14.array(workGraphProjectionMismatchSchema)
-    });
-    tasksFrontierParamsSchema = z14.object({
-      rootId: z14.string().min(1),
-      role: z14.string().min(1).optional()
-    });
-    tasksFrontierResultSchema = z14.object({
-      rootId: z14.string().min(1),
-      role: z14.string().min(1).optional(),
-      groups: z14.object({
-        ready: z14.array(workGraphReadyFrontierTaskSchema),
-        blocked: z14.array(workGraphReadyFrontierTaskSchema),
-        blockedBy: z14.array(
-          z14.discriminatedUnion("kind", [
-            z14.object({
-              kind: z14.literal("dependency"),
-              blockerId: z14.string().min(1),
-              blocks: z14.array(z14.string().min(1))
+      staleProjection: z13.boolean(),
+      projectionMismatches: z13.array(workGraphProjectionMismatchSchema)
+    });
+    tasksFrontierParamsSchema = z13.object({
+      rootId: z13.string().min(1),
+      role: z13.string().min(1).optional()
+    });
+    tasksFrontierResultSchema = z13.object({
+      rootId: z13.string().min(1),
+      role: z13.string().min(1).optional(),
+      groups: z13.object({
+        ready: z13.array(workGraphReadyFrontierTaskSchema),
+        blocked: z13.array(workGraphReadyFrontierTaskSchema),
+        blockedBy: z13.array(
+          z13.discriminatedUnion("kind", [
+            z13.object({
+              kind: z13.literal("dependency"),
+              blockerId: z13.string().min(1),
+              blocks: z13.array(z13.string().min(1))
             }),
-            z14.object({
-              kind: z14.literal("gate"),
+            z13.object({
+              kind: z13.literal("gate"),
               gate: verificationGateSchema,
-              blocks: z14.array(z14.string().min(1))
+              blocks: z13.array(z13.string().min(1))
             })
           ])
         )
       })
     });
     tasksWorkGraphAuditParamsSchema = paginationParamsSchema.extend({
-      rootId: z14.string().min(1),
-      maxDepth: z14.number().int().nonnegative().optional(),
-      includeRelations: z14.boolean().optional()
-    });
-    tasksWorkGraphAuditResultSchema = z14.object({
-      rootId: z14.string().min(1),
-      hierarchy: z14.object({
-        valid: z14.boolean(),
-        violations: z14.array(
-          z14.object({
-            code: z14.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
-            taskId: z14.string().min(1),
+      rootId: z13.string().min(1),
+      maxDepth: z13.number().int().nonnegative().optional(),
+      includeRelations: z13.boolean().optional()
+    });
+    tasksWorkGraphAuditResultSchema = z13.object({
+      rootId: z13.string().min(1),
+      hierarchy: z13.object({
+        valid: z13.boolean(),
+        violations: z13.array(
+          z13.object({
+            code: z13.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
+            taskId: z13.string().min(1),
             taskType: taskTypeSchema,
-            parentId: z14.string().min(1).nullable(),
+            parentId: z13.string().min(1).nullable(),
             parentType: taskTypeSchema.optional(),
-            message: z14.string().min(1)
+            message: z13.string().min(1)
           })
         )
       }),
       traversal: tasksTraverseResultSchema,
       frontier: tasksFrontierResultSchema,
       rollup: tasksRollupResultSchema,
-      relationEdges: z14.object({
-        rootId: z14.string().min(1),
+      relationEdges: z13.object({
+        rootId: z13.string().min(1),
         direction: workGraphEdgeDirectionSchema,
-        edges: z14.array(
-          z14.discriminatedUnion("source", [
+        edges: z13.array(
+          z13.discriminatedUnion("source", [
             workGraphRelationEdgeSchema,
             workGraphDependencyEdgeSchema
           ])
@@ -15497,6 +15491,51 @@ var init_operation_envelope_validation = __esm({
   }
 });
 
+// packages/contracts/src/operations/docs.ts
+import { z as z14 } from "zod";
+var DOCS_PROJECTION_PROPOSAL_SCHEMA, DOCS_PROJECTION_RECEIPT_SCHEMA;
+var init_docs = __esm({
+  "packages/contracts/src/operations/docs.ts"() {
+    "use strict";
+    init_docs_taxonomy();
+    init_docs_lifecycle();
+    DOCS_PROJECTION_PROPOSAL_SCHEMA = z14.object({
+      version: z14.literal(1),
+      operation: z14.literal("docs.projection"),
+      identity: z14.object({
+        projectId: z14.string().min(1),
+        projectRoot: z14.string().min(1),
+        actor: z14.string().min(1),
+        operation: z14.literal("docs.projection"),
+        idempotencyKey: z14.string().min(1)
+      }).strict(),
+      source: z14.object({
+        attachmentId: z14.string().min(1),
+        sha256: z14.string().regex(/^[a-f0-9]{64}$/),
+        ownerId: z14.string().min(1),
+        ownerType: z14.enum(["task", "session", "observation", "decision", "learning", "pattern"]),
+        label: z14.string().min(1)
+      }).strict(),
+      observation: z14.object({
+        kind: z14.literal("doc-attachment"),
+        attachmentId: z14.string().min(1),
+        ownerId: z14.string().min(1),
+        addedAt: z14.string().min(1),
+        slug: z14.string().optional(),
+        type: z14.string().optional()
+      }).strict()
+    }).strict();
+    DOCS_PROJECTION_RECEIPT_SCHEMA = z14.object({
+      version: z14.literal(1),
+      sourceHash: z14.string().regex(/^[a-f0-9]{64}$/),
+      graph: z14.enum(["completed", "disabled"]),
+      observationId: z14.string().min(1),
+      verifiedAt: z14.string().min(1),
+      actor: z14.string().min(1)
+    }).strict();
+  }
+});
+
 // packages/contracts/src/operations/ensures-schema-registry.ts
 import { z as z15 } from "zod";
 var taskTreeEntrySchema, taskTreeSchema, evidenceSchema, passthroughSchema, LEGACY_PASSTHROUGH_SCHEMA_NAMES, ENSURES_SCHEMA_REGISTRY;
@@ -15866,11 +15905,7 @@ var init_evidence_atoms = __esm({
         }).passthrough()
       ).optional().default([])
     }).passthrough();
-    PR_REQUIRED_WORKFLOWS = Object.freeze([
-      "CI",
-      "Lockfile Check",
-      "Contracts Dep Lint"
-    ]);
+    PR_REQUIRED_WORKFLOWS = Object.freeze(["CI", "Contracts Dep Lint"]);
   }
 });
 
@@ -18088,8 +18123,15 @@ var init_nexus_cloud = __esm({
     nexusCloudProjectListItemSchema = z26.object({
       ...projectFields,
       role: z26.string(),
+      /**
+       * The project name sealed with the project data key (`Project.encryptedName`), base64;
+       * only a holder of the account key can open it (T13102).
+       */
+      encryptedName: z26.string().nullable().optional(),
       streamId: z26.string().optional(),
       headSeq: z26.number().int().nonnegative().nullable().optional(),
+      /** The stream's head snapshot; null when nothing was ever pushed (T13102: restorable or not). */
+      headCheckpointId: z26.string().nullable().optional(),
       openConflicts: z26.number().int().nonnegative().optional(),
       replicas: z26.array(nexusCloudReplicaSchema).default([]),
       devices: nexusCloudDeviceCountsSchema.optional(),
@@ -18155,6 +18197,11 @@ var init_nexus_cloud = __esm({
     nexusCloudStatusSchema = z26.object({
       serverTime: isoTime.optional(),
       apiVersion: z26.string().optional(),
+      /**
+       * Optional server features (e.g. {@link NEXUS_FEATURE_PROJECT_INITIAL_KEY}). Absent from servers older
+       * than the list, which therefore support none of them.
+       */
+      features: z26.array(z26.string()).optional(),
       user: nexusCloudUserSchema,
       credential: nexusCloudCredentialSchema,
       device: nexusCloudDeviceSchema.nullable(),
@@ -18235,6 +18282,13 @@ var init_nexus_cloud = __esm({
   }
 });
 
+// packages/contracts/src/nexus-first-run.ts
+var init_nexus_first_run = __esm({
+  "packages/contracts/src/nexus-first-run.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/nexus-vault.ts
 import { z as z27 } from "zod";
 var isoTime2, uuid, nexusUserKeysSchema, nexusProjectKeysSchema, nexusLeaseSchema, nexusLeaseAcquireSchema, nexusStreamHeadSchema, nexusActivityEventSchema, nexusActivityPageSchema;
@@ -18380,6 +18434,7 @@ var init_src = __esm({
     init_decide_sites();
     init_nexus_account();
     init_nexus_cloud();
+    init_nexus_first_run();
     init_nexus_vault();
     init_sync_schema();
     init_task_id();
@@ -44442,18 +44497,6 @@ function appendHookEntry(hooks, event, entry) {
   }
   hooks[event] = [...existing ?? [], entry];
 }
-function removeCleoHookEntries(hooks) {
-  let changed = false;
-  for (const [event, entries] of Object.entries(hooks)) {
-    if (!Array.isArray(entries)) continue;
-    const kept = entries.filter((e) => !isCleoHookEntry(e));
-    if (kept.length !== entries.length) {
-      hooks[event] = kept;
-      changed = true;
-    }
-  }
-  return changed;
-}
 var CLEO_HOOK_MARKER;
 var init_hook_config = __esm({
   "packages/adapters/src/providers/shared/hook-config.ts"() {
@@ -44462,43 +44505,623 @@ var init_hook_config = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/heavy-command-hook-install.ts
+import { execFileSync } from "node:child_process";
+import {
+  existsSync as existsSync3,
+  mkdirSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3,
+  realpathSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { homedir as homedir2, tmpdir } from "node:os";
+import { dirname, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+import { updateJsonConfigFile } from "@cleocode/caamp";
+function canonical(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return resolve2(path);
+  }
+}
+function nonDirectoryAncestor(dir) {
+  let cur = resolve2(dir);
+  for (; ; ) {
+    try {
+      return statSync(cur).isDirectory() ? null : cur;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+    }
+    const parent = dirname(cur);
+    if (parent === cur) return null;
+    cur = parent;
+  }
+}
+function ensureParentDir(target) {
+  const blocked = nonDirectoryAncestor(dirname(target));
+  if (blocked !== null) throw new HeavyHookPathBlockedError(blocked, target);
+  mkdirSync(dirname(target), { recursive: true });
+}
+function isUserHomeDir(projectDir, home = homedir2()) {
+  return canonical(projectDir) === canonical(home);
+}
+function clearOlderCleoMarkers(dir = process.env.XDG_RUNTIME_DIR || tmpdir()) {
+  let removed = 0;
+  let names;
+  try {
+    names = readdirSync2(dir);
+  } catch {
+    return 0;
+  }
+  for (const name15 of names) {
+    if (!name15.startsWith(OLDER_CLEO_MARKER_PREFIX)) continue;
+    try {
+      rmSync(join3(dir, name15), { force: true });
+      removed++;
+    } catch {
+    }
+  }
+  return removed;
+}
+function shellWord(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function heavyCommandGuardScript(provider) {
+  const words = HEAVY_TOOL_WORDS.join("|");
+  const old = `printf '%s\\n' '${OLDER_CLEO_HOOK_ANSWER}'`;
+  return [
+    "command -v cleo >/dev/null 2>&1 || exit 0",
+    'in="$(cat)"',
+    "set -f",
+    "hit=",
+    // `[\]` (not `\\`) matches a backslash: it survives fish's quoting under Codex.
+    `for w in $(printf '%s' "$in" | sed 's/[\\][nrt]/ /g; s/[^A-Za-z0-9_./@+-]/ /g'); do case "\${w##*/}" in ${words}) hit=1; break;; esac; done`,
+    '[ -n "$hit" ] || exit 0',
+    'p="$(command -v cleo)"',
+    `d="\${XDG_RUNTIME_DIR:-\${TMPDIR:-/tmp}}"`,
+    `k="$d/${OLDER_CLEO_MARKER_PREFIX}$(printf '%s|%s' "$p" "$PWD" | cksum | tr -c '0-9' '-')"`,
+    `if [ -f "$k" ] && [ ! -L "$k" ] && [ -O "$k" ] && ! [ "$p" -nt "$k" ] && [ -n "$(find "$k" -mmin -60 2>/dev/null)" ]; then ${old}; exit 0; fi`,
+    'e="$(mktemp 2>/dev/null)" || e=',
+    // Only the older-CLEO signature (exit 127, "Unknown command hook") writes the
+    // marker; a crash or kill of a current CLEO fails open and asks again next time.
+    `if out="$(printf '%s' "$in" | ${HEAVY_COMMAND_HOOK_ID} --provider ${provider} 2>"\${e:-/dev/null}")"; then case "$out" in "{"*) printf '%s\\n' "$out";; esac; else rc=$?; if [ "$rc" = 127 ] && [ -n "$e" ] && grep -q 'Unknown command' "$e" 2>/dev/null; then t="$(mktemp "$k.XXXXXX" 2>/dev/null)" && mv -f "$t" "$k"; ${old}; fi; fi`,
+    '[ -z "$e" ] || rm -f "$e"',
+    "exit 0"
+  ].join("; ");
+}
+function heavyCommandHookCommand(provider) {
+  const script = heavyCommandGuardScript(provider);
+  const line = provider === "codex" ? `/bin/sh -c ${shellWord(script)}` : script;
+  return `${line} ${CLEO_HOOK_MARKER}`;
+}
+function heavyCommandHookObject(provider) {
+  return {
+    type: "command",
+    command: heavyCommandHookCommand(provider),
+    timeout: HEAVY_COMMAND_HOOK_TIMEOUT_SEC
+  };
+}
+function heavyCommandHookEntry(provider) {
+  return { matcher: "Bash", hooks: [heavyCommandHookObject(provider)] };
+}
+function isHeavyHookObject(hook) {
+  return isPlainObject2(hook) && typeof hook.command === "string" && hook.command.includes(CLEO_HOOK_MARKER) && hook.command.includes(HEAVY_COMMAND_HOOK_ID);
+}
+function placeHeavyHook(hooks, desired) {
+  const groups = hooks.PreToolUse;
+  if (groups === void 0) return { changed: false, found: false };
+  if (!Array.isArray(groups)) {
+    throw new Error('hooks "PreToolUse" is not an array; not modifying it');
+  }
+  let changed = false;
+  let found = false;
+  const next = [];
+  for (const group of groups) {
+    if (!isPlainObject2(group) || !Array.isArray(group.hooks)) {
+      next.push(group);
+      continue;
+    }
+    const kept = [];
+    let groupChanged = false;
+    for (const hook of group.hooks) {
+      if (!isHeavyHookObject(hook)) {
+        kept.push(hook);
+      } else if (desired !== null && !found) {
+        found = true;
+        if (JSON.stringify(hook) !== JSON.stringify(desired)) groupChanged = true;
+        kept.push(desired);
+      } else {
+        groupChanged = true;
+      }
+    }
+    if (!groupChanged) {
+      next.push(group);
+      continue;
+    }
+    changed = true;
+    if (kept.length > 0) next.push({ ...group, hooks: kept });
+  }
+  if (changed) hooks.PreToolUse = next;
+  return { changed, found };
+}
+async function syncJsonHeavyCommandHook(configPath, provider, mode) {
+  if (mode === "off") {
+    if (!existsSync3(configPath)) return "unchanged";
+    const removed = await updateJsonConfigFile(configPath, (config2) => {
+      if (config2.hooks === void 0) return false;
+      return placeHeavyHook(hookMap(config2), null).changed;
+    });
+    return removed ? "removed" : "unchanged";
+  }
+  ensureParentDir(configPath);
+  clearOlderCleoMarkers();
+  let result = "unchanged";
+  await updateJsonConfigFile(configPath, (config2) => {
+    const hooks = hookMap(config2);
+    const placed = placeHeavyHook(hooks, heavyCommandHookObject(provider));
+    if (placed.found) {
+      if (placed.changed) result = "updated";
+      return placed.changed;
+    }
+    const existing = hooks.PreToolUse;
+    hooks.PreToolUse = [
+      ...Array.isArray(existing) ? existing : [],
+      heavyCommandHookEntry(provider)
+    ];
+    result = "installed";
+    return true;
+  });
+  return result;
+}
+function gitOutput(projectDir, args) {
+  try {
+    return execFileSync("git", ["-C", projectDir, ...args], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function excludeFile(projectDir) {
+  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return null;
+  const path = gitOutput(projectDir, ["rev-parse", "--git-path", "info/exclude"]);
+  if (path === null || path === "") return null;
+  return isAbsolute(path) ? path : join3(projectDir, path);
+}
+function excludeLine(projectDir, relPath) {
+  const prefix = gitOutput(projectDir, ["rev-parse", "--show-prefix"]) ?? "";
+  return `/${prefix}${relPath}`;
+}
+function excludeHookFileFromGit(projectDir, relPath, marker16 = HOOK_FILE_EXCLUDE_MARKER) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null) return false;
+  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) !== null) return false;
+  const line = excludeLine(projectDir, relPath);
+  const text = existsSync3(exclude) ? readFileSync3(exclude, "utf-8") : "";
+  if (text.split("\n").includes(line)) return false;
+  const block = `${marker16}
+${line}
+`;
+  mkdirSync(dirname(exclude), { recursive: true });
+  writeFileSync(exclude, text === "" || text.endsWith("\n") ? text + block : `${text}
+${block}`);
+  return true;
+}
+function unexcludeHookFileFromGit(projectDir, relPath) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null || !existsSync3(exclude)) return false;
+  const lines = readFileSync3(exclude, "utf-8").split("\n");
+  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const above = lines[at - 1];
+  if (at < 1 || above !== LOCAL_SETTINGS_EXCLUDE_MARKER && above !== HOOK_FILE_EXCLUDE_MARKER) {
+    return false;
+  }
+  lines.splice(at - 1, 2);
+  writeFileSync(exclude, lines.join("\n"));
+  return true;
+}
+function hookFileVisibleToGit(projectDir, relPath) {
+  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return false;
+  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
+  return gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null;
+}
+function excludeLocalSettingsFromGit(projectDir) {
+  return excludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER);
+}
+function unexcludeLocalSettingsFromGit(projectDir) {
+  return unexcludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS);
+}
+function cleoCreatedConfig(config2) {
+  if (!isPlainObject2(config2) || Object.keys(config2).some((k) => k !== "hooks")) return false;
+  if (!isPlainObject2(config2.hooks)) return false;
+  let mine = 0;
+  for (const groups of Object.values(config2.hooks)) {
+    if (!Array.isArray(groups)) return false;
+    for (const group of groups) {
+      if (!isPlainObject2(group) || !Array.isArray(group.hooks)) return false;
+      for (const hook of group.hooks) {
+        if (!isPlainObject2(hook) || typeof hook.command !== "string" || !hook.command.includes(CLEO_HOOK_MARKER)) {
+          return false;
+        }
+        mine++;
+      }
+    }
+  }
+  return mine > 0;
+}
+function codexHooksSharedReason(projectDir, checkGit = true) {
+  const file2 = join3(projectDir, CODEX_HOOKS_FILE);
+  if (checkGit && gitOutput(projectDir, ["ls-files", "--error-unmatch", CODEX_HOOKS_FILE]) !== null) {
+    return "is tracked by git (a shared team config)";
+  }
+  if (!existsSync3(file2)) return null;
+  let config2;
+  try {
+    config2 = JSON.parse(readFileSync3(file2, "utf-8"));
+  } catch {
+    return "is the project's own Codex hook config (empty or not valid JSON)";
+  }
+  return cleoCreatedConfig(config2) ? null : "is the project's own Codex hook config";
+}
+function committedCodexHookHoldsCleo(projectDir) {
+  const committed = gitOutput(projectDir, ["show", `HEAD:./${CODEX_HOOKS_FILE}`]);
+  if (committed === null || committed === "") return false;
+  try {
+    const config2 = JSON.parse(committed);
+    if (!isPlainObject2(config2)) return false;
+    const groups = isPlainObject2(config2.hooks) ? config2.hooks.PreToolUse : void 0;
+    return Array.isArray(groups) && groups.some(
+      (g) => isPlainObject2(g) && Array.isArray(g.hooks) && g.hooks.some(isHeavyHookObject)
+    );
+  } catch {
+    return false;
+  }
+}
+function jsonEqual(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => jsonEqual(v, b[i]));
+  }
+  if (isPlainObject2(a) && isPlainObject2(b)) {
+    const keys = Object.keys(a);
+    return keys.length === Object.keys(b).length && keys.every((k) => Object.hasOwn(b, k) && jsonEqual(a[k], b[k]));
+  }
+  return a === b;
+}
+function restoreCommittedCodexHooks(projectDir) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", CODEX_HOOKS_FILE]) === null)
+    return false;
+  const file2 = join3(projectDir, CODEX_HOOKS_FILE);
+  let committed;
+  let working;
+  try {
+    committed = execFileSync("git", ["-C", projectDir, "show", `HEAD:./${CODEX_HOOKS_FILE}`], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    working = JSON.parse(readFileSync3(file2, "utf-8"));
+  } catch {
+    return false;
+  }
+  if (!isPlainObject2(working)) return false;
+  const hooks = hookMap(working);
+  if (!placeHeavyHook(hooks, null).changed) return false;
+  try {
+    if (!jsonEqual(working, JSON.parse(committed))) return false;
+  } catch {
+    return false;
+  }
+  writeFileSync(file2, committed);
+  return true;
+}
+function excludedByCleo(projectDir, relPath) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null || !existsSync3(exclude)) return false;
+  const lines = readFileSync3(exclude, "utf-8").split("\n");
+  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const above = lines[at - 1];
+  return at >= 1 && (above === LOCAL_SETTINGS_EXCLUDE_MARKER || above === HOOK_FILE_EXCLUDE_MARKER);
+}
+function codexHookSnippet() {
+  return JSON.stringify(heavyCommandHookEntry("codex"));
+}
+function trackedFileModified(projectDir, relPath) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null) return false;
+  return (gitOutput(projectDir, ["diff", "--name-only", "HEAD", "--", relPath]) ?? "") !== "";
+}
+async function syncCodexHeavyCommandHook(projectDir, mode) {
+  const file2 = join3(projectDir, CODEX_HOOKS_FILE);
+  if (mode !== "off") {
+    const shared = codexHooksSharedReason(projectDir);
+    if (shared !== null) {
+      unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+      throw new HeavyHookSharedConfigError(file2, shared);
+    }
+  } else if (committedCodexHookHoldsCleo(projectDir)) {
+    throw new HeavyHookSharedConfigError(
+      file2,
+      "holds CLEO's hook as the team committed it (removing it is a team change)"
+    );
+  } else if (restoreCommittedCodexHooks(projectDir)) {
+    unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+    return "removed";
+  }
+  const result = await syncJsonHeavyCommandHook(file2, "codex", mode);
+  if (mode === "off") unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+  else excludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+  return result;
+}
+async function syncClaudeCodeHeavyCommandHook(projectDir, mode) {
+  const result = await syncJsonHeavyCommandHook(
+    join3(projectDir, CLAUDE_LOCAL_SETTINGS),
+    "claude-code",
+    mode
+  );
+  if (mode === "off") unexcludeLocalSettingsFromGit(projectDir);
+  else excludeLocalSettingsFromGit(projectDir);
+  try {
+    await syncJsonHeavyCommandHook(
+      join3(projectDir, ".claude", "settings.json"),
+      "claude-code",
+      "off"
+    );
+  } catch {
+  }
+  return result;
+}
+function opencodeHeavyCommandPluginSource() {
+  return [
+    "// CLEO heavy-command plugin for OpenCode (generated by @cleocode/adapters, T12983).",
+    "// Routes heavy shell commands (tests, builds, typechecks, installs) through",
+    "// `cleo run`, the machine-wide resource budget. Opt out with",
+    '// CLEO_HEAVY_COMMAND_HOOK=off, or set resources.heavyCommandHook to "off" and',
+    "// run `cleo upgrade` (which deletes this file). Fails open: on any error the",
+    "// command runs unchanged.",
+    "",
+    "import { execFile } from 'node:child_process';",
+    "",
+    `const HEAVY = /(?:^|[^A-Za-z0-9_.@+-])(?:${HEAVY_TOOL_WORDS.join("|")})(?=$|[^A-Za-z0-9_.@+-])/;`,
+    "const contexts = new Map();",
+    "",
+    "function ask(payload) {",
+    "  return new Promise((done) => {",
+    "    const child = execFile(",
+    "      'cleo',",
+    "      ['hook', 'heavy-command', '--provider', 'opencode'],",
+    `      { timeout: ${HEAVY_COMMAND_HOOK_TIMEOUT_SEC * 1e3} },`,
+    "      (err, stdout) => done(err ? '' : stdout),",
+    "    );",
+    "    child.on('error', () => done(''));",
+    "    child.stdin?.end(JSON.stringify(payload));",
+    "  });",
+    "}",
+    "",
+    "export const CleoHeavyCommand = async ({ directory }) => ({",
+    "  'tool.execute.before': async (input, output) => {",
+    "    if (input?.tool !== 'bash' || typeof output?.args?.command !== 'string') return;",
+    "    if (process.env.CLEO_HEAVY_COMMAND_HOOK === 'off') return;",
+    "    if (!HEAVY.test(output.args.command)) return;",
+    "    try {",
+    "      const text = await ask({ tool_name: 'bash', tool_input: output.args, cwd: directory });",
+    "      const answer = JSON.parse(text || '{}');",
+    "      if (typeof answer.command === 'string') output.args.command = answer.command;",
+    "      if (typeof answer.timeout === 'number') output.args.timeout = answer.timeout;",
+    "      if (typeof answer.context === 'string' && input.callID) contexts.set(input.callID, answer.context);",
+    "    } catch {",
+    "      // Fail open.",
+    "    }",
+    "  },",
+    "  'tool.execute.after': async (input, output) => {",
+    "    const context = input?.callID ? contexts.get(input.callID) : undefined;",
+    "    if (context === undefined) return;",
+    "    contexts.delete(input.callID);",
+    "    if (typeof output?.output === 'string') output.output += '\\n\\n' + context;",
+    "  },",
+    "});",
+    ""
+  ].join("\n");
+}
+function syncOpencodeHeavyCommandPlugin(projectDir, mode) {
+  const pluginPath = join3(projectDir, OPENCODE_PLUGIN_FILE);
+  const exists = existsSync3(pluginPath);
+  if (mode === "off") {
+    unexcludeHookFileFromGit(projectDir, OPENCODE_PLUGIN_FILE);
+    if (!exists) return "unchanged";
+    rmSync(pluginPath, { force: true });
+    return "removed";
+  }
+  const source = opencodeHeavyCommandPluginSource();
+  const current = exists && readFileSync3(pluginPath, "utf-8") === source;
+  if (!current) {
+    ensureParentDir(pluginPath);
+    writeFileSync(pluginPath, source, "utf-8");
+  }
+  excludeHookFileFromGit(projectDir, OPENCODE_PLUGIN_FILE);
+  return current ? "unchanged" : exists ? "updated" : "installed";
+}
+var HEAVY_COMMAND_HOOK_ID, HEAVY_COMMAND_HOOK_TIMEOUT_SEC, OPENCODE_HEAVY_COMMAND_PLUGIN, HEAVY_TOOL_WORDS, HeavyHookPathBlockedError, OLDER_CLEO_HOOK_ANSWER, OLDER_CLEO_MARKER_PREFIX, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER, HOOK_FILE_EXCLUDE_MARKER, CODEX_HOOKS_FILE, OPENCODE_PLUGIN_FILE, HeavyHookSharedConfigError;
+var init_heavy_command_hook_install = __esm({
+  "packages/adapters/src/providers/shared/heavy-command-hook-install.ts"() {
+    "use strict";
+    init_hook_config();
+    HEAVY_COMMAND_HOOK_ID = "cleo hook heavy-command";
+    HEAVY_COMMAND_HOOK_TIMEOUT_SEC = 20;
+    OPENCODE_HEAVY_COMMAND_PLUGIN = "cleo-heavy-command.js";
+    HEAVY_TOOL_WORDS = Object.freeze([
+      "vitest",
+      "jest",
+      "mocha",
+      "ava",
+      "tap",
+      "playwright",
+      "pytest",
+      "rspec",
+      "phpunit",
+      "tsc",
+      "tsup",
+      "turbo",
+      "vite",
+      "esbuild",
+      "webpack",
+      "rollup",
+      "next",
+      "nx",
+      "biome",
+      "eslint",
+      "svelte-check",
+      "npm",
+      "pnpm",
+      "yarn",
+      "bun",
+      "npx",
+      "pnpx",
+      "bunx",
+      "cargo",
+      "go"
+    ]);
+    HeavyHookPathBlockedError = class extends Error {
+      /** The existing path that is not a directory. */
+      path;
+      /**
+       * @param path - the existing non-directory path.
+       * @param target - the config file that would have lived under it.
+       */
+      constructor(path, target) {
+        super(`${path} exists but is not a directory, so ${target} cannot be created under it`);
+        this.name = "HeavyHookPathBlockedError";
+        this.path = path;
+      }
+    };
+    OLDER_CLEO_HOOK_ANSWER = JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: "[cleo] This may be a heavy command, but the cleo on PATH predates cleo hook and cleo run, so it runs outside the machine-wide resource budget. Upgrade CLEO to govern it."
+      }
+    });
+    OLDER_CLEO_MARKER_PREFIX = "cleo-hook-unsupported-";
+    CLAUDE_LOCAL_SETTINGS = ".claude/settings.local.json";
+    LOCAL_SETTINGS_EXCLUDE_MARKER = "# cleo-hook: keep the per-machine heavy-command hook settings out of git (T12983)";
+    HOOK_FILE_EXCLUDE_MARKER = "# cleo-hook: keep a per-machine heavy-command hook file out of git (T13124)";
+    CODEX_HOOKS_FILE = ".codex/hooks.json";
+    OPENCODE_PLUGIN_FILE = `.opencode/plugins/${OPENCODE_HEAVY_COMMAND_PLUGIN}`;
+    HeavyHookSharedConfigError = class extends Error {
+      /** The project's own config file. */
+      path;
+      /**
+       * @param path - the config file.
+       * @param why - what makes it the project's own.
+       */
+      constructor(path, why) {
+        super(`${path} ${why}, so CLEO does not write or hide it`);
+        this.name = "HeavyHookSharedConfigError";
+        this.path = path;
+      }
+    };
+  }
+});
+
 // packages/adapters/src/providers/claude-code/paths.ts
-import { homedir as homedir2 } from "node:os";
-import { join as join3 } from "node:path";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join4, relative, resolve as resolve3, sep } from "node:path";
 function claudeSettingsPath() {
-  return new ClaudeCodePathProvider().getSettingsPath() ?? join3(homedir2(), ".claude", "settings.json");
+  return new ClaudeCodePathProvider().getSettingsPath() ?? join4(homedir3(), ".claude", "settings.json");
 }
-var ClaudeCodePathProvider;
+function canonicalPath(path) {
+  const abs = resolve3(path);
+  try {
+    return realpathSync2.native(abs);
+  } catch {
+    const parent = dirname2(abs);
+    return parent === abs ? abs : join4(canonicalPath(parent), basename2(abs));
+  }
+}
+function comparable(path) {
+  return CASE_INSENSITIVE_DEFAULT ? path.toLowerCase() : path;
+}
+function isAtOrInside(path, dir) {
+  const rel = relative(comparable(dir), comparable(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute2(rel);
+}
+function assertProjectScoped(projectDir, target) {
+  const abs = resolve3(target);
+  if (isUserHomeDir(projectDir)) {
+    throw new UserGlobalClaudeConfigError(abs, "the project is the home directory");
+  }
+  const canonical2 = canonicalPath(abs);
+  if (comparable(canonical2) === comparable(canonicalPath(claudeSettingsPath()))) {
+    throw new UserGlobalClaudeConfigError(abs, "it is the user-global Claude settings file");
+  }
+  if (isAtOrInside(canonical2, canonicalPath(new ClaudeCodePathProvider().getProviderDir()))) {
+    throw new UserGlobalClaudeConfigError(abs, "it is inside the user-global Claude config dir");
+  }
+  return abs;
+}
+function projectClaudeSettingsPath(projectDir) {
+  return assertProjectScoped(projectDir, join4(projectDir, CLAUDE_LOCAL_SETTINGS));
+}
+function projectClaudeHooksDir(projectDir) {
+  return assertProjectScoped(projectDir, join4(projectDir, ".claude", "hooks"));
+}
+function assertProjectInstructionScope(projectDir) {
+  assertProjectScoped(projectDir, join4(projectDir, "CLAUDE.md"));
+}
+function projectClaudeCommandsDir(projectDir) {
+  return assertProjectScoped(projectDir, join4(projectDir, ".claude", "commands"));
+}
+var ClaudeCodePathProvider, CASE_INSENSITIVE_DEFAULT, UserGlobalClaudeConfigError;
 var init_paths = __esm({
   "packages/adapters/src/providers/claude-code/paths.ts"() {
     "use strict";
+    init_heavy_command_hook_install();
     init_hook_config();
     ClaudeCodePathProvider = class {
       /** Get the provider's root configuration directory. */
       getProviderDir() {
-        return process.env["CLAUDE_HOME"] ?? join3(homedir2(), ".claude");
+        return process.env["CLAUDE_HOME"] ?? join4(homedir3(), ".claude");
       }
       /** Get the path to the provider's settings file, or null if unavailable. */
       getSettingsPath() {
-        return process.env["CLAUDE_SETTINGS"] ?? join3(this.getProviderDir(), "settings.json");
+        return process.env["CLAUDE_SETTINGS"] ?? join4(this.getProviderDir(), "settings.json");
       }
       /** Get the directory where agents are installed, or null if unsupported. */
       getAgentInstallDir() {
-        return join3(this.getProviderDir(), "agents");
+        return join4(this.getProviderDir(), "agents");
       }
       /** Get the path to the provider's memory database, or null if unsupported. */
       getMemoryDbPath() {
-        return process.env["CLAUDE_MEM_DB"] ?? join3(homedir2(), ".claude-mem", "claude-mem.db");
+        return process.env["CLAUDE_MEM_DB"] ?? join4(homedir3(), ".claude-mem", "claude-mem.db");
+      }
+    };
+    CASE_INSENSITIVE_DEFAULT = process.platform === "darwin" || process.platform === "win32";
+    UserGlobalClaudeConfigError = class extends Error {
+      /** The path that was refused. */
+      path;
+      /**
+       * @param path - the refused target.
+       * @param why - which user-global location it hits.
+       */
+      constructor(path, why) {
+        super(`refusing to write ${path}: ${why}; CLEO only writes project-level Claude Code config`);
+        this.name = "UserGlobalClaudeConfigError";
+        this.path = path;
       }
     };
   }
 });
 
 // packages/adapters/src/providers/claude-code/context-monitor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { mkdir } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname, join as join4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname3, join as join5 } from "node:path";
 import { resolveLegacyCleoDir } from "@cleocode/paths";
 function getContextStatusFromPercentage(percentage) {
   if (percentage >= THRESHOLDS.EMERGENCY) return "emergency";
@@ -44533,10 +45156,10 @@ var init_context_monitor = __esm({
         const totalTokens = inputTokens + outputTokens + cacheCreate;
         const percentage = Math.floor(totalTokens * 100 / contextSize);
         const status = getContextStatusFromPercentage(percentage);
-        const cleoDir = cwd ? join4(cwd, ".cleo") : ".cleo";
-        if (existsSync3(cleoDir)) {
-          const stateDir = join4(cleoDir, "context-states");
-          const statePath = join4(stateDir, ".context-state.json");
+        const cleoDir = cwd ? join5(cwd, ".cleo") : ".cleo";
+        if (existsSync4(cleoDir)) {
+          const stateDir = join5(cleoDir, "context-states");
+          const statePath = join5(stateDir, ".context-state.json");
           const state = {
             $schema: "https://cleo-dev.com/schemas/v1/context-state.schema.json",
             version: "1.0.0",
@@ -44563,8 +45186,8 @@ var init_context_monitor = __esm({
             cleoSessionId: ""
           };
           try {
-            await mkdir(dirname(statePath), { recursive: true });
-            writeFileSync(statePath, JSON.stringify(state, null, 2));
+            await mkdir(dirname3(statePath), { recursive: true });
+            writeFileSync2(statePath, JSON.stringify(state, null, 2));
           } catch {
           }
         }
@@ -44573,9 +45196,9 @@ var init_context_monitor = __esm({
       /** Check the current statusline integration status in Claude Code settings. */
       checkStatuslineIntegration() {
         const settingsPath = this.pathProvider.getSettingsPath();
-        if (!settingsPath || !existsSync3(settingsPath)) return "no_settings";
+        if (!settingsPath || !existsSync4(settingsPath)) return "no_settings";
         try {
-          const settings = JSON.parse(readFileSync3(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
           const statusLine = settings.statusLine;
           if (!statusLine?.type) return "not_configured";
           if (statusLine.type !== "command") return "custom_no_cleo";
@@ -44583,10 +45206,10 @@ var init_context_monitor = __esm({
           if (cmd.includes("context-monitor.sh") || cmd.includes("cleo-statusline") || cmd.includes(".context-state.json") || cmd.includes("context-states")) {
             return "configured";
           }
-          const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir3()) : cmd;
-          if (existsSync3(scriptPath)) {
+          const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir4()) : cmd;
+          if (existsSync4(scriptPath)) {
             try {
-              const content = readFileSync3(scriptPath, "utf-8");
+              const content = readFileSync4(scriptPath, "utf-8");
               if (content.includes("context-state.json")) return "configured";
             } catch {
             }
@@ -44601,7 +45224,7 @@ var init_context_monitor = __esm({
         return {
           statusLine: {
             type: "command",
-            command: join4(resolveLegacyCleoDir(), "lib", "session", "context-monitor.sh")
+            command: join5(resolveLegacyCleoDir(), "lib", "session", "context-monitor.sh")
           }
         };
       }
@@ -44622,15 +45245,56 @@ var init_context_monitor = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/hooks.ts
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
-import { join as join5 } from "node:path";
-import { updateJsonConfigFile } from "@cleocode/caamp";
-var PROVIDER_ID, CLAUDE_CODE_EVENT_MAP, ClaudeCodeHookProvider;
+import { join as join6 } from "node:path";
+import { updateJsonConfigFile as updateJsonConfigFile2 } from "@cleocode/caamp";
+function isNativeHookObject(hook) {
+  return isPlainObject2(hook) && typeof hook.command === "string" && NATIVE_HOOK_COMMANDS.has(hook.command);
+}
+function hasNativeHooks(hooks) {
+  return Object.values(hooks).some(
+    (entries) => Array.isArray(entries) && entries.some(
+      (entry) => isPlainObject2(entry) && Array.isArray(entry.hooks) && entry.hooks.some(isNativeHookObject)
+    )
+  );
+}
+function removeNativeHooks(hooks) {
+  let changed = false;
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const kept = [];
+    let eventChanged = false;
+    for (const entry of entries) {
+      if (!isPlainObject2(entry) || !Array.isArray(entry.hooks) || !entry.hooks.some(isNativeHookObject)) {
+        kept.push(entry);
+        continue;
+      }
+      eventChanged = true;
+      const rest = entry.hooks.filter((hook) => !isNativeHookObject(hook));
+      if (rest.length > 0) kept.push({ ...entry, hooks: rest });
+    }
+    if (!eventChanged) continue;
+    changed = true;
+    if (kept.length === 0) delete hooks[event];
+    else hooks[event] = kept;
+  }
+  return changed;
+}
+var NATIVE_STOP_HOOK_COMMAND, NATIVE_OBSERVE_HOOK_COMMAND, NATIVE_NEXUS_HOOK_COMMAND, NATIVE_HOOK_COMMANDS, PROVIDER_ID, CLAUDE_CODE_EVENT_MAP, ClaudeCodeHookProvider;
 var init_hooks = __esm({
   "packages/adapters/src/providers/claude-code/hooks.ts"() {
     "use strict";
+    init_heavy_command_hook_install();
     init_paths();
+    NATIVE_STOP_HOOK_COMMAND = "cleo session end --quiet # cleo-hook";
+    NATIVE_OBSERVE_HOOK_COMMAND = 'cleo observe "File modified via $TOOL_NAME" --title "tool-use" --quiet # cleo-hook';
+    NATIVE_NEXUS_HOOK_COMMAND = 'cleo nexus analyze --incremental --json > /dev/null 2>&1 && cleo observe "NEXUS re-indexed after $TOOL_NAME on $TOOL_INPUT_file_path" --title "nexus-post-check" --quiet # cleo-hook';
+    NATIVE_HOOK_COMMANDS = /* @__PURE__ */ new Set([
+      NATIVE_STOP_HOOK_COMMAND,
+      NATIVE_OBSERVE_HOOK_COMMAND,
+      NATIVE_NEXUS_HOOK_COMMAND
+    ]);
     PROVIDER_ID = "claude-code";
     CLAUDE_CODE_EVENT_MAP = {
       // CAAMP: toNative('SessionStart',      'claude-code') = 'SessionStart'
@@ -44685,95 +45349,111 @@ var init_hooks = __esm({
       /**
        * Register native hooks for a project.
        *
-       * Writes CLEO hook entries to `~/.claude/settings.json` so that Claude Code's
-       * native event system calls cleo CLI commands when events fire. This bridges
-       * Claude Code's event loop to CLEO's internal hook dispatch.
+       * Writes CLEO hook entries to the project's per-machine
+       * `<project>/.claude/settings.local.json` so that Claude Code's native event
+       * system calls cleo CLI commands when events fire in this project. This
+       * bridges Claude Code's event loop to CLEO's internal hook dispatch.
+       * CLEO never writes the user-global `~/.claude/settings.json` (T13227): a
+       * project that is the home directory, or whose settings file resolves into
+       * the user-global Claude config, is refused and nothing is written. When
+       * git does not ignore `settings.local.json` yet, a marked `info/exclude`
+       * block keeps it out of git (the T12983 heavy-command rule).
        *
-       * Idempotent: skips writing if CLEO hooks already exist in settings.json.
+       * Idempotent: skips writing if the native hooks are already present.
        *
        * Hook entries registered:
        * - `Stop` → `cleo session end --quiet` (triggers LLM extraction, reflector, consolidation)
        * - `PostToolUse` (Write|Edit) → brain observation for file modifications
-       * - `SubagentStop` → brain observation for agent completion
+       *   and the NEXUS post-check
        *
-       * @param projectDir - Project directory for context-scoped hook commands
-       * @task T164 @task T555
+       * @param projectDir - Project whose Claude Code settings receive the hooks
+       * @task T164 @task T555 @task T13227
        */
       async registerNativeHooks(projectDir) {
         this.projectDir = projectDir;
         this.registered = true;
-        await this.updateSettings((settings) => {
+        const wrote = await this.updateSettings(projectDir, (settings) => {
           const hooks = hookMap(settings);
-          if (Object.values(hooks).some((entries) => hasCleoHook(entries))) {
-            return false;
-          }
+          if (hasNativeHooks(hooks)) return false;
           appendHookEntry(hooks, "Stop", {
             matcher: "",
-            hooks: [{ type: "command", command: `cleo session end --quiet # cleo-hook` }]
+            hooks: [{ type: "command", command: NATIVE_STOP_HOOK_COMMAND }]
           });
           appendHookEntry(hooks, "PostToolUse", {
             matcher: "Write|Edit",
             hooks: [
-              {
-                type: "command",
-                command: `cleo observe "File modified via $TOOL_NAME" --title "tool-use" --quiet # cleo-hook`
-              },
-              {
-                // NEXUS post-modification check: re-index changed files and flag regressions.
-                // $TOOL_INPUT_file_path is populated by Claude Code for Write/Edit events.
-                type: "command",
-                command: `cleo nexus analyze --incremental --json > /dev/null 2>&1 && cleo observe "NEXUS re-indexed after $TOOL_NAME on $TOOL_INPUT_file_path" --title "nexus-post-check" --quiet # cleo-hook`
-              }
+              { type: "command", command: NATIVE_OBSERVE_HOOK_COMMAND },
+              { type: "command", command: NATIVE_NEXUS_HOOK_COMMAND }
             ]
           });
           return true;
         });
+        if (wrote) excludeLocalSettingsFromGit(projectDir);
       }
       /**
        * Unregister native hooks.
        *
-       * Removes CLEO hook entries from Claude Code's `settings.json` by filtering
-       * out entries containing the `# cleo-hook` marker. Same locking, atomicity
-       * and parse-error rules as {@link registerNativeHooks}.
+       * Removes the hook objects {@link registerNativeHooks} wrote from the
+       * project's `settings.local.json`, and nothing else: the heavy-command hook
+       * and the user's own hooks stay, and an entry or event is dropped only when
+       * left empty. Same locking, atomicity, parse-error and project-scope rules
+       * as {@link registerNativeHooks}.
        *
-       * @task T164 @task T555
+       * @task T164 @task T555 @task T13227
        */
       async unregisterNativeHooks() {
+        const projectDir = this.projectDir;
         this.registered = false;
         this.projectDir = null;
-        if (!existsSync4(claudeSettingsPath())) return;
-        await this.updateSettings((settings) => {
+        if (projectDir === null) return;
+        let settingsPath;
+        try {
+          settingsPath = projectClaudeSettingsPath(projectDir);
+        } catch {
+          return;
+        }
+        if (!existsSync5(settingsPath)) return;
+        await this.updateSettings(projectDir, (settings) => {
           if (settings.hooks === void 0) return false;
-          return removeCleoHookEntries(hookMap(settings));
+          return removeNativeHooks(hookMap(settings));
         });
       }
       /** The last settings.json failure, or `null` when the last update succeeded. */
       settingsError = null;
       /**
-       * Why the last settings.json update did not happen, or `null`.
+       * Why the last settings update did not happen, or `null`.
        *
        * @remarks
        * Hook registration stays non-fatal for adapter initialisation, so a
-       * refused write (malformed settings.json, lock timeout) is surfaced here and
-       * on stderr instead of being swallowed (T12385).
+       * refused write (malformed settings file, lock timeout, a user-global
+       * target) is surfaced here and on stderr instead of being swallowed
+       * (T12385, T13227).
        *
        * @returns The failure message, or `null`
        */
       getSettingsError() {
         return this.settingsError;
       }
-      /** Apply `mutate` to settings.json via CAAMP's locked, atomic JSON writer. */
-      async updateSettings(mutate) {
-        const settingsPath = claudeSettingsPath();
+      /**
+       * Apply `mutate` to the project's `settings.local.json` via CAAMP's locked,
+       * atomic JSON writer.
+       *
+       * @returns whether the file was written.
+       */
+      async updateSettings(projectDir, mutate) {
+        let settingsPath = `${projectDir}/.claude/settings.local.json`;
         try {
-          await updateJsonConfigFile(settingsPath, mutate);
+          settingsPath = projectClaudeSettingsPath(projectDir);
+          const wrote = await updateJsonConfigFile2(settingsPath, mutate);
           this.settingsError = null;
+          return wrote;
         } catch (err) {
           this.settingsError = err instanceof Error ? err.message : String(err);
           process.stderr.write(
             `[cleo:claude-code] hooks not written to ${settingsPath}: ${this.settingsError}
 `
           );
+          return false;
         }
       }
       /**
@@ -44880,28 +45560,28 @@ var init_hooks = __esm({
       async getTranscript(sessionId, _projectDir) {
         try {
           const homeDir = process.env.HOME ?? process.env.USERPROFILE ?? "/root";
-          const projectsDir = join5(homeDir, ".claude", "projects");
+          const projectsDir = join6(homeDir, ".claude", "projects");
           let rootFiles = [];
           const subagentFiles = [];
           try {
             const projectDirs = await readdir(projectsDir, { withFileTypes: true });
             for (const projectEntry of projectDirs) {
               if (!projectEntry.isDirectory()) continue;
-              const projectDir = join5(projectsDir, projectEntry.name);
+              const projectDir = join6(projectsDir, projectEntry.name);
               try {
                 const projectContents = await readdir(projectDir, { withFileTypes: true });
                 for (const entry of projectContents) {
                   if (entry.isFile() && entry.name.endsWith(".jsonl")) {
-                    rootFiles.push({ path: join5(projectDir, entry.name) });
+                    rootFiles.push({ path: join6(projectDir, entry.name) });
                     continue;
                   }
                   if (entry.isDirectory()) {
-                    const subagentsDir = join5(projectDir, entry.name, "subagents");
+                    const subagentsDir = join6(projectDir, entry.name, "subagents");
                     try {
                       const subagentEntries = await readdir(subagentsDir);
                       for (const sa of subagentEntries) {
                         if (sa.startsWith("agent-") && sa.endsWith(".jsonl")) {
-                          subagentFiles.push({ path: join5(subagentsDir, sa) });
+                          subagentFiles.push({ path: join6(subagentsDir, sa) });
                         }
                       }
                     } catch {
@@ -44951,344 +45631,13 @@ var init_hooks = __esm({
   }
 });
 
-// packages/adapters/src/providers/shared/heavy-command-hook-install.ts
-import { execFileSync } from "node:child_process";
-import {
-  existsSync as existsSync5,
-  mkdirSync,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
-  realpathSync,
-  rmSync,
-  writeFileSync as writeFileSync2
-} from "node:fs";
-import { homedir as homedir4, tmpdir } from "node:os";
-import { dirname as dirname2, isAbsolute, join as join6, resolve as resolve2 } from "node:path";
-import { updateJsonConfigFile as updateJsonConfigFile2 } from "@cleocode/caamp";
-function canonical(path) {
-  try {
-    return realpathSync(path);
-  } catch {
-    return resolve2(path);
-  }
-}
-function isUserHomeDir(projectDir, home = homedir4()) {
-  return canonical(projectDir) === canonical(home);
-}
-function clearOlderCleoMarkers(dir = process.env.XDG_RUNTIME_DIR || tmpdir()) {
-  let removed = 0;
-  let names;
-  try {
-    names = readdirSync2(dir);
-  } catch {
-    return 0;
-  }
-  for (const name15 of names) {
-    if (!name15.startsWith(OLDER_CLEO_MARKER_PREFIX)) continue;
-    try {
-      rmSync(join6(dir, name15), { force: true });
-      removed++;
-    } catch {
-    }
-  }
-  return removed;
-}
-function shellWord(text) {
-  return `'${text.replace(/'/g, `'\\''`)}'`;
-}
-function heavyCommandGuardScript(provider) {
-  const words = HEAVY_TOOL_WORDS.join("|");
-  const old = `printf '%s\\n' '${OLDER_CLEO_HOOK_ANSWER}'`;
-  return [
-    "command -v cleo >/dev/null 2>&1 || exit 0",
-    'in="$(cat)"',
-    "set -f",
-    "hit=",
-    // `[\]` (not `\\`) matches a backslash: it survives fish's quoting under Codex.
-    `for w in $(printf '%s' "$in" | sed 's/[\\][nrt]/ /g; s/[^A-Za-z0-9_./@+-]/ /g'); do case "\${w##*/}" in ${words}) hit=1; break;; esac; done`,
-    '[ -n "$hit" ] || exit 0',
-    'p="$(command -v cleo)"',
-    `d="\${XDG_RUNTIME_DIR:-\${TMPDIR:-/tmp}}"`,
-    `k="$d/${OLDER_CLEO_MARKER_PREFIX}$(printf '%s|%s' "$p" "$PWD" | cksum | tr -c '0-9' '-')"`,
-    `if [ -f "$k" ] && [ ! -L "$k" ] && [ -O "$k" ] && ! [ "$p" -nt "$k" ] && [ -n "$(find "$k" -mmin -60 2>/dev/null)" ]; then ${old}; exit 0; fi`,
-    'e="$(mktemp 2>/dev/null)" || e=',
-    // Only the older-CLEO signature (exit 127, "Unknown command hook") writes the
-    // marker; a crash or kill of a current CLEO fails open and asks again next time.
-    `if out="$(printf '%s' "$in" | ${HEAVY_COMMAND_HOOK_ID} --provider ${provider} 2>"\${e:-/dev/null}")"; then case "$out" in "{"*) printf '%s\\n' "$out";; esac; else rc=$?; if [ "$rc" = 127 ] && [ -n "$e" ] && grep -q 'Unknown command' "$e" 2>/dev/null; then t="$(mktemp "$k.XXXXXX" 2>/dev/null)" && mv -f "$t" "$k"; ${old}; fi; fi`,
-    '[ -z "$e" ] || rm -f "$e"',
-    "exit 0"
-  ].join("; ");
-}
-function heavyCommandHookCommand(provider) {
-  const script = heavyCommandGuardScript(provider);
-  const line = provider === "codex" ? `/bin/sh -c ${shellWord(script)}` : script;
-  return `${line} ${CLEO_HOOK_MARKER}`;
-}
-function heavyCommandHookObject(provider) {
-  return {
-    type: "command",
-    command: heavyCommandHookCommand(provider),
-    timeout: HEAVY_COMMAND_HOOK_TIMEOUT_SEC
-  };
-}
-function heavyCommandHookEntry(provider) {
-  return { matcher: "Bash", hooks: [heavyCommandHookObject(provider)] };
-}
-function isHeavyHookObject(hook) {
-  return isPlainObject2(hook) && typeof hook.command === "string" && hook.command.includes(CLEO_HOOK_MARKER) && hook.command.includes(HEAVY_COMMAND_HOOK_ID);
-}
-function placeHeavyHook(hooks, desired) {
-  const groups = hooks.PreToolUse;
-  if (groups === void 0) return { changed: false, found: false };
-  if (!Array.isArray(groups)) {
-    throw new Error('hooks "PreToolUse" is not an array; not modifying it');
-  }
-  let changed = false;
-  let found = false;
-  const next = [];
-  for (const group of groups) {
-    if (!isPlainObject2(group) || !Array.isArray(group.hooks)) {
-      next.push(group);
-      continue;
-    }
-    const kept = [];
-    let groupChanged = false;
-    for (const hook of group.hooks) {
-      if (!isHeavyHookObject(hook)) {
-        kept.push(hook);
-      } else if (desired !== null && !found) {
-        found = true;
-        if (JSON.stringify(hook) !== JSON.stringify(desired)) groupChanged = true;
-        kept.push(desired);
-      } else {
-        groupChanged = true;
-      }
-    }
-    if (!groupChanged) {
-      next.push(group);
-      continue;
-    }
-    changed = true;
-    if (kept.length > 0) next.push({ ...group, hooks: kept });
-  }
-  if (changed) hooks.PreToolUse = next;
-  return { changed, found };
-}
-async function syncJsonHeavyCommandHook(configPath, provider, mode) {
-  if (mode === "off") {
-    if (!existsSync5(configPath)) return "unchanged";
-    const removed = await updateJsonConfigFile2(configPath, (config2) => {
-      if (config2.hooks === void 0) return false;
-      return placeHeavyHook(hookMap(config2), null).changed;
-    });
-    return removed ? "removed" : "unchanged";
-  }
-  mkdirSync(dirname2(configPath), { recursive: true });
-  clearOlderCleoMarkers();
-  let result = "unchanged";
-  await updateJsonConfigFile2(configPath, (config2) => {
-    const hooks = hookMap(config2);
-    const placed = placeHeavyHook(hooks, heavyCommandHookObject(provider));
-    if (placed.found) {
-      if (placed.changed) result = "updated";
-      return placed.changed;
-    }
-    const existing = hooks.PreToolUse;
-    hooks.PreToolUse = [
-      ...Array.isArray(existing) ? existing : [],
-      heavyCommandHookEntry(provider)
-    ];
-    result = "installed";
-    return true;
-  });
-  return result;
-}
-function gitOutput(projectDir, args) {
-  try {
-    return execFileSync("git", ["-C", projectDir, ...args], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 5e3
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function excludeFile(projectDir) {
-  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return null;
-  const path = gitOutput(projectDir, ["rev-parse", "--git-path", "info/exclude"]);
-  if (path === null || path === "") return null;
-  return isAbsolute(path) ? path : join6(projectDir, path);
-}
-function excludeLine(projectDir) {
-  const prefix = gitOutput(projectDir, ["rev-parse", "--show-prefix"]) ?? "";
-  return `/${prefix}${CLAUDE_LOCAL_SETTINGS}`;
-}
-function excludeLocalSettingsFromGit(projectDir) {
-  const exclude = excludeFile(projectDir);
-  if (exclude === null) return false;
-  if (gitOutput(projectDir, ["check-ignore", CLAUDE_LOCAL_SETTINGS]) !== null) return false;
-  const line = excludeLine(projectDir);
-  const text = existsSync5(exclude) ? readFileSync4(exclude, "utf-8") : "";
-  if (text.split("\n").includes(line)) return false;
-  const block = `${LOCAL_SETTINGS_EXCLUDE_MARKER}
-${line}
-`;
-  mkdirSync(dirname2(exclude), { recursive: true });
-  writeFileSync2(exclude, text === "" || text.endsWith("\n") ? text + block : `${text}
-${block}`);
-  return true;
-}
-function unexcludeLocalSettingsFromGit(projectDir) {
-  const exclude = excludeFile(projectDir);
-  if (exclude === null || !existsSync5(exclude)) return false;
-  const lines = readFileSync4(exclude, "utf-8").split("\n");
-  const at = lines.indexOf(excludeLine(projectDir));
-  if (at < 1 || lines[at - 1] !== LOCAL_SETTINGS_EXCLUDE_MARKER) return false;
-  lines.splice(at - 1, 2);
-  writeFileSync2(exclude, lines.join("\n"));
-  return true;
-}
-async function syncClaudeCodeHeavyCommandHook(projectDir, mode) {
-  const result = await syncJsonHeavyCommandHook(
-    join6(projectDir, CLAUDE_LOCAL_SETTINGS),
-    "claude-code",
-    mode
-  );
-  if (mode === "off") unexcludeLocalSettingsFromGit(projectDir);
-  else excludeLocalSettingsFromGit(projectDir);
-  await syncJsonHeavyCommandHook(
-    join6(projectDir, ".claude", "settings.json"),
-    "claude-code",
-    "off"
-  );
-  return result;
-}
-function opencodeHeavyCommandPluginSource() {
-  return [
-    "// CLEO heavy-command plugin for OpenCode (generated by @cleocode/adapters, T12983).",
-    "// Routes heavy shell commands (tests, builds, typechecks, installs) through",
-    "// `cleo run`, the machine-wide resource budget. Opt out with",
-    '// CLEO_HEAVY_COMMAND_HOOK=off, or set resources.heavyCommandHook to "off" and',
-    "// run `cleo upgrade` (which deletes this file). Fails open: on any error the",
-    "// command runs unchanged.",
-    "",
-    "import { execFile } from 'node:child_process';",
-    "",
-    `const HEAVY = /(?:^|[^A-Za-z0-9_.@+-])(?:${HEAVY_TOOL_WORDS.join("|")})(?=$|[^A-Za-z0-9_.@+-])/;`,
-    "const contexts = new Map();",
-    "",
-    "function ask(payload) {",
-    "  return new Promise((done) => {",
-    "    const child = execFile(",
-    "      'cleo',",
-    "      ['hook', 'heavy-command', '--provider', 'opencode'],",
-    `      { timeout: ${HEAVY_COMMAND_HOOK_TIMEOUT_SEC * 1e3} },`,
-    "      (err, stdout) => done(err ? '' : stdout),",
-    "    );",
-    "    child.on('error', () => done(''));",
-    "    child.stdin?.end(JSON.stringify(payload));",
-    "  });",
-    "}",
-    "",
-    "export const CleoHeavyCommand = async ({ directory }) => ({",
-    "  'tool.execute.before': async (input, output) => {",
-    "    if (input?.tool !== 'bash' || typeof output?.args?.command !== 'string') return;",
-    "    if (process.env.CLEO_HEAVY_COMMAND_HOOK === 'off') return;",
-    "    if (!HEAVY.test(output.args.command)) return;",
-    "    try {",
-    "      const text = await ask({ tool_name: 'bash', tool_input: output.args, cwd: directory });",
-    "      const answer = JSON.parse(text || '{}');",
-    "      if (typeof answer.command === 'string') output.args.command = answer.command;",
-    "      if (typeof answer.timeout === 'number') output.args.timeout = answer.timeout;",
-    "      if (typeof answer.context === 'string' && input.callID) contexts.set(input.callID, answer.context);",
-    "    } catch {",
-    "      // Fail open.",
-    "    }",
-    "  },",
-    "  'tool.execute.after': async (input, output) => {",
-    "    const context = input?.callID ? contexts.get(input.callID) : undefined;",
-    "    if (context === undefined) return;",
-    "    contexts.delete(input.callID);",
-    "    if (typeof output?.output === 'string') output.output += '\\n\\n' + context;",
-    "  },",
-    "});",
-    ""
-  ].join("\n");
-}
-function syncOpencodeHeavyCommandPlugin(projectDir, mode) {
-  const pluginPath = join6(projectDir, ".opencode", "plugins", OPENCODE_HEAVY_COMMAND_PLUGIN);
-  const exists = existsSync5(pluginPath);
-  if (mode === "off") {
-    if (!exists) return "unchanged";
-    rmSync(pluginPath, { force: true });
-    return "removed";
-  }
-  const source = opencodeHeavyCommandPluginSource();
-  if (exists && readFileSync4(pluginPath, "utf-8") === source) return "unchanged";
-  mkdirSync(dirname2(pluginPath), { recursive: true });
-  writeFileSync2(pluginPath, source, "utf-8");
-  return exists ? "updated" : "installed";
-}
-var HEAVY_COMMAND_HOOK_ID, HEAVY_COMMAND_HOOK_TIMEOUT_SEC, OPENCODE_HEAVY_COMMAND_PLUGIN, HEAVY_TOOL_WORDS, OLDER_CLEO_HOOK_ANSWER, OLDER_CLEO_MARKER_PREFIX, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER;
-var init_heavy_command_hook_install = __esm({
-  "packages/adapters/src/providers/shared/heavy-command-hook-install.ts"() {
-    "use strict";
-    init_hook_config();
-    HEAVY_COMMAND_HOOK_ID = "cleo hook heavy-command";
-    HEAVY_COMMAND_HOOK_TIMEOUT_SEC = 20;
-    OPENCODE_HEAVY_COMMAND_PLUGIN = "cleo-heavy-command.js";
-    HEAVY_TOOL_WORDS = Object.freeze([
-      "vitest",
-      "jest",
-      "mocha",
-      "ava",
-      "tap",
-      "playwright",
-      "pytest",
-      "rspec",
-      "phpunit",
-      "tsc",
-      "tsup",
-      "turbo",
-      "vite",
-      "esbuild",
-      "webpack",
-      "rollup",
-      "next",
-      "nx",
-      "biome",
-      "eslint",
-      "svelte-check",
-      "npm",
-      "pnpm",
-      "yarn",
-      "bun",
-      "npx",
-      "pnpx",
-      "bunx",
-      "cargo",
-      "go"
-    ]);
-    OLDER_CLEO_HOOK_ANSWER = JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        additionalContext: "[cleo] This may be a heavy command, but the cleo on PATH predates cleo hook and cleo run, so it runs outside the machine-wide resource budget. Upgrade CLEO to govern it."
-      }
-    });
-    OLDER_CLEO_MARKER_PREFIX = "cleo-hook-unsupported-";
-    CLAUDE_LOCAL_SETTINGS = ".claude/settings.local.json";
-    LOCAL_SETTINGS_EXCLUDE_MARKER = "# cleo-hook: keep the per-machine heavy-command hook settings out of git (T12983)";
-  }
-});
-
 // packages/adapters/src/providers/shared/hook-template-installer.ts
-import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, statSync } from "node:fs";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, statSync as statSync2 } from "node:fs";
+import { dirname as dirname4, join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveProviderCandidates() {
-  const thisDir = dirname3(fileURLToPath(import.meta.url));
-  const here = dirname3(thisDir);
+  const thisDir = dirname4(fileURLToPath(import.meta.url));
+  const here = dirname4(thisDir);
   const fromDist = join7(here, "..", "..", "src", "providers");
   return [here, fromDist];
 }
@@ -45311,13 +45660,13 @@ function copyTemplate(src, dest, force) {
     throw new Error(`CLEO hook template missing at source: ${src}`);
   }
   if (!force && existsSync6(dest)) {
-    const srcStat = statSync(src);
-    const destStat = statSync(dest);
+    const srcStat = statSync2(src);
+    const destStat = statSync2(dest);
     if (srcStat.size === destStat.size && srcStat.mtimeMs <= destStat.mtimeMs) {
       return { wrote: false };
     }
   }
-  mkdirSync2(dirname3(dest), { recursive: true });
+  mkdirSync2(dirname4(dest), { recursive: true });
   copyFileSync(src, dest);
   return { wrote: true };
 }
@@ -45363,25 +45712,28 @@ var init_hook_template_installer = __esm({
 
 // packages/adapters/src/providers/claude-code/install.ts
 import { copyFileSync as copyFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join8, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join8, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { ensureProviderInstructionFile, updateJsonConfigFile as updateJsonConfigFile3 } from "@cleocode/caamp";
-function getClaudeConfigDir() {
-  return process.env["CLAUDE_HOME"] ?? join8(homedir5(), ".claude");
-}
 function getAdapterCommandsDir() {
-  const thisDir = dirname4(fileURLToPath2(import.meta.url));
+  const thisDir = dirname5(fileURLToPath2(import.meta.url));
   return join8(thisDir, "commands");
 }
-var ClaudeCodeInstallProvider;
+var CLEO_PLUGIN_KEY, PROJECT_HOOK_FILES, ClaudeCodeInstallProvider;
 var init_install = __esm({
   "packages/adapters/src/providers/claude-code/install.ts"() {
     "use strict";
     init_heavy_command_hook_install();
     init_hook_template_installer();
     init_paths();
+    CLEO_PLUGIN_KEY = "cleo@cleocode";
+    PROJECT_HOOK_FILES = [
+      ".claude/hooks/precompact-safestop.sh",
+      ".claude/hooks/cleo-precompact-core.sh"
+    ];
     ClaudeCodeInstallProvider = class {
+      /** The project the last {@link install} ran for; {@link isInstalled} reads its settings. */
+      projectDir = null;
       /**
        * Install CLEO into a Claude Code project.
        *
@@ -45390,38 +45742,52 @@ var init_install = __esm({
        */
       async install(options) {
         const { projectDir } = options;
+        this.projectDir = projectDir;
         const installedAt = (/* @__PURE__ */ new Date()).toISOString();
         let instructionFileUpdated = false;
         const details = {};
-        const instructionResult = await ensureProviderInstructionFile("claude-code", projectDir, {});
-        instructionFileUpdated = instructionResult.action !== "intact";
-        if (instructionFileUpdated) {
-          details.instructionFile = instructionResult.filePath;
+        try {
+          assertProjectInstructionScope(projectDir);
+          const instructionResult = await ensureProviderInstructionFile("claude-code", projectDir, {});
+          instructionFileUpdated = instructionResult.action !== "intact";
+          if (instructionFileUpdated) {
+            details.instructionFile = instructionResult.filePath;
+          }
+        } catch (err) {
+          if (!(err instanceof UserGlobalClaudeConfigError)) throw err;
+          details.instructionFile = "skipped";
         }
-        const commandsInstalled = this.installCommands(projectDir);
-        if (commandsInstalled.length > 0) {
-          details.commands = commandsInstalled;
+        try {
+          const commandsInstalled = this.installCommands(projectDir);
+          if (commandsInstalled.length > 0) {
+            details.commands = commandsInstalled;
+          }
+        } catch (err) {
+          if (!(err instanceof UserGlobalClaudeConfigError)) throw err;
+          details.commands = "skipped";
         }
         const settingsErrors = [];
         try {
-          const pluginResult = await this.registerPlugin();
+          const pluginResult = await this.registerPlugin(projectDir);
           if (pluginResult) {
             details.plugin = pluginResult;
           }
         } catch (err) {
-          settingsErrors.push(err instanceof Error ? err.message : String(err));
+          if (err instanceof UserGlobalClaudeConfigError) details.plugin = "skipped";
+          else settingsErrors.push(err instanceof Error ? err.message : String(err));
         }
         try {
-          const hookResult = await this.installHookTemplates();
+          const hookResult = await this.installHookTemplates(projectDir);
           if (hookResult) {
             details.hookTemplates = hookResult;
           }
         } catch (err) {
-          settingsErrors.push(err instanceof Error ? err.message : String(err));
+          if (err instanceof UserGlobalClaudeConfigError) details.hookTemplates = "skipped";
+          else settingsErrors.push(err instanceof Error ? err.message : String(err));
         }
         if (options.heavyCommandHook !== void 0) {
           const projectSettings = join8(projectDir, ".claude", "settings.json");
-          if (isUserHomeDir(projectDir) || resolve3(projectSettings) === resolve3(claudeSettingsPath())) {
+          if (isUserHomeDir(projectDir) || resolve4(projectSettings) === resolve4(claudeSettingsPath())) {
             details.heavyCommandHook = "skipped";
           } else {
             try {
@@ -45454,16 +45820,25 @@ var init_install = __esm({
       /**
        * Check whether CLEO is installed in the current environment.
        *
-       * Checks for plugin enabled in ~/.claude/settings.json.
+       * Checks for the plugin enabled in the project's
+       * `.claude/settings.local.json` — the project of the last {@link install},
+       * else the working directory (T13227).
        */
       async isInstalled() {
-        const settingsPath = claudeSettingsPath();
+        let settingsPath;
+        try {
+          settingsPath = projectClaudeSettingsPath(this.projectDir ?? process.cwd());
+        } catch {
+          return false;
+        }
         if (existsSync7(settingsPath)) {
           try {
             const settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
-            const plugins = settings.enabledPlugins;
-            if (plugins && plugins["cleo@cleocode"] === true) {
-              return true;
+            if (isPlainObject2(settings)) {
+              const plugins = settings.enabledPlugins;
+              if (isPlainObject2(plugins) && plugins[CLEO_PLUGIN_KEY] === true) {
+                return true;
+              }
             }
           } catch {
           }
@@ -45477,8 +45852,11 @@ var init_install = __esm({
        * and default references from the provider registry (T1919).
        *
        * @param projectDir - Project root directory
+       * @throws {@link UserGlobalClaudeConfigError} when the project root is inside
+       *   the user-global Claude config dir (T13227); nothing is written.
        */
       async ensureInstructionReferences(projectDir) {
+        assertProjectInstructionScope(projectDir);
         await ensureProviderInstructionFile("claude-code", projectDir, {});
       }
       /**
@@ -45489,13 +45867,14 @@ var init_install = __esm({
        *
        * @param projectDir - Project root directory
        * @returns Array of installed command filenames
+       * @throws {@link UserGlobalClaudeConfigError} when the target is user-global
        */
       installCommands(projectDir) {
         const adapterCommandsDir = getAdapterCommandsDir();
         if (!existsSync7(adapterCommandsDir)) {
           return [];
         }
-        const targetDir = join8(projectDir, ".claude", "commands");
+        const targetDir = projectClaudeCommandsDir(projectDir);
         mkdirSync3(targetDir, { recursive: true });
         const installed = [];
         const files = readdirSync3(adapterCommandsDir).filter((f) => f.endsWith(".md"));
@@ -45508,13 +45887,17 @@ var init_install = __esm({
         return installed;
       }
       /**
-       * Register the CLEO brain plugin in ~/.claude/settings.json.
+       * Register the CLEO brain plugin in the project's
+       * `.claude/settings.local.json` (T13227: never the user-global settings).
        *
+       * @param projectDir - Project root directory
        * @returns Description of what was registered, or null if no change needed
+       * @throws {@link UserGlobalClaudeConfigError} when the target is user-global
        */
-      async registerPlugin() {
-        const pluginKey = "cleo@cleocode";
-        const wrote = await updateJsonConfigFile3(claudeSettingsPath(), (settings) => {
+      async registerPlugin(projectDir) {
+        const pluginKey = CLEO_PLUGIN_KEY;
+        const settingsPath = projectClaudeSettingsPath(projectDir);
+        const wrote = await updateJsonConfigFile3(settingsPath, (settings) => {
           const enabledPlugins = settings.enabledPlugins ?? {};
           if (!isPlainObject2(enabledPlugins)) {
             throw new Error('settings.json "enabledPlugins" is not an object; not modifying it');
@@ -45529,31 +45912,38 @@ var init_install = __esm({
           settings.enabledPlugins = enabledPlugins;
           return true;
         });
-        return wrote ? `Enabled ${pluginKey} in ~/.claude/settings.json` : null;
+        if (!wrote) return null;
+        excludeLocalSettingsFromGit(projectDir);
+        return `Enabled ${pluginKey} in ${settingsPath}`;
       }
       /**
        * Install the CLEO PreCompact hook templates for Claude Code (T1013).
        *
-       * Writes two files to `~/.claude/hooks/`:
+       * Writes two files to the project's `.claude/hooks/`:
        * 1. `cleo-precompact-core.sh` — universal CLEO safestop helper (shared
        *    across all providers; sourced by the provider-specific shim).
        * 2. `precompact-safestop.sh` — Claude-Code-flavoured wrapper that invokes
        *    `cleo memory precompact-flush` and `cleo safestop`.
        *
-       * Also registers a `PreCompact` entry in `~/.claude/settings.json` so Claude
-       * Code runs the hook when auto-compact fires (at 95% context).
+       * Also registers a `PreCompact` entry in the project's
+       * `.claude/settings.local.json` so Claude Code runs the hook when
+       * auto-compact fires (at 95% context). Files git does not ignore yet are
+       * kept out of it with a marked `info/exclude` block. Nothing is written to
+       * the user-global Claude config (T13227).
        *
        * Idempotent: subsequent installs skip unchanged files and do not duplicate
-       * the settings.json hook entry.
+       * the settings hook entry.
        *
+       * @param projectDir - Project root directory
        * @returns Install summary (paths written + config change description), or
        *   `null` when no change was required.
+       * @throws {@link UserGlobalClaudeConfigError} when the target is user-global
        *
-       * @task T1013
+       * @task T1013 @task T13227
        */
-      async installHookTemplates() {
-        const claudeDir = getClaudeConfigDir();
-        const hooksDir = join8(claudeDir, "hooks");
+      async installHookTemplates(projectDir) {
+        const hooksDir = projectClaudeHooksDir(projectDir);
+        const settingsPath = projectClaudeSettingsPath(projectDir);
         let templates;
         try {
           templates = installProviderHookTemplates({
@@ -45563,30 +45953,35 @@ var init_install = __esm({
         } catch {
           return null;
         }
+        for (const file2 of PROJECT_HOOK_FILES) excludeHookFileFromGit(projectDir, file2);
         const settingsEntryAdded = await this.registerPreCompactHook(
+          settingsPath,
           join8(hooksDir, "precompact-safestop.sh")
         );
+        if (settingsEntryAdded) excludeLocalSettingsFromGit(projectDir);
         if (templates.installedFiles.length === 0 && !settingsEntryAdded) {
           return null;
         }
         return { templates, settingsEntryAdded };
       }
       /**
-       * Register the PreCompact hook command in `~/.claude/settings.json`.
+       * Register the PreCompact hook command in the project's
+       * `.claude/settings.local.json`.
        *
        * The Claude Code native event name for the canonical `PreCompact` event is
        * `PreCompact` (identity mapping — see `hook-mappings.json`). The entry is
        * tagged with `# cleo-hook` so the uninstall flow can identify and remove
        * our additions without touching user-authored hooks.
        *
+       * @param settingsPath - The project settings file (already scope-checked).
        * @param shimPath - Absolute path to the installed `precompact-safestop.sh`.
        * @returns `true` when a new hook entry was written, `false` when an
        *   equivalent entry was already present.
        *
        * @task T1013
        */
-      async registerPreCompactHook(shimPath) {
-        return updateJsonConfigFile3(claudeSettingsPath(), (settings) => {
+      async registerPreCompactHook(settingsPath, shimPath) {
+        return updateJsonConfigFile3(settingsPath, (settings) => {
           const hooks = hookMap(settings);
           if (hasCleoHook(hooks.PreCompact, "precompact-safestop.sh")) {
             return false;
@@ -45709,7 +46104,7 @@ var init_agent_spawn_wrapper = __esm({
 // packages/adapters/src/providers/shared/prompt-file.ts
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { dirname as dirname6, join as join9 } from "node:path";
 async function writeSpawnPromptFile(prefix, prompt) {
   const dir = await mkdtemp(join9(tmpdir2(), `cleo-${prefix}-`));
   const file2 = join9(dir, "prompt.txt");
@@ -45717,7 +46112,7 @@ async function writeSpawnPromptFile(prefix, prompt) {
   return file2;
 }
 async function removeSpawnPromptFile(file2) {
-  await rm(dirname5(file2), { recursive: true, force: true }).catch(() => void 0);
+  await rm(dirname6(file2), { recursive: true, force: true }).catch(() => void 0);
 }
 var init_prompt_file = __esm({
   "packages/adapters/src/providers/shared/prompt-file.ts"() {
@@ -45809,7 +46204,7 @@ function isEsrch(err) {
   return false;
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 var SIGTERM_GRACE_MS;
 var init_suite_reaper = __esm({
@@ -46103,7 +46498,7 @@ var init_transport = __esm({
 
 // packages/adapters/src/providers/claude-code/adapter.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join11 } from "node:path";
 import { findOnPath as findOnPath2 } from "@cleocode/paths";
 var ClaudeCodeAdapter;
@@ -46257,7 +46652,7 @@ var init_adapter = __esm({
         cliAvailable = resolvedCli !== null;
         if (resolvedCli) details.cliPath = resolvedCli;
         else details.cliAvailable = false;
-        const claudeConfigDir = join11(homedir6(), ".claude");
+        const claudeConfigDir = join11(homedir5(), ".claude");
         const configExists = existsSync8(claudeConfigDir);
         details.configDirExists = configExists;
         const entrypointSet = process.env.CLAUDE_CODE_ENTRYPOINT !== void 0;
@@ -46288,10 +46683,10 @@ var init_adapter = __esm({
 
 // packages/adapters/src/providers/claude-code/statusline.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { join as join12 } from "node:path";
 function getClaudeSettingsPath() {
-  return process.env["CLAUDE_SETTINGS"] ?? join12(process.env["CLAUDE_HOME"] ?? join12(homedir7(), ".claude"), "settings.json");
+  return process.env["CLAUDE_SETTINGS"] ?? join12(process.env["CLAUDE_HOME"] ?? join12(homedir6(), ".claude"), "settings.json");
 }
 function checkStatuslineIntegration() {
   const settingsPath = getClaudeSettingsPath();
@@ -46305,7 +46700,7 @@ function checkStatuslineIntegration() {
     if (cmd.includes("context-monitor.sh") || cmd.includes("cleo-statusline") || cmd.includes(".context-state.json") || cmd.includes("context-states")) {
       return "configured";
     }
-    const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir7()) : cmd;
+    const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir6()) : cmd;
     if (existsSync9(scriptPath)) {
       try {
         const content = readFileSync7(scriptPath, "utf-8");
@@ -46387,6 +46782,25 @@ var init_paths2 = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/project-instruction-file.ts
+import {
+  ensureProviderInstructionFile as ensureProviderInstructionFile2,
+  HomeInstructionFileError
+} from "@cleocode/caamp";
+async function ensureProjectInstructionFile(providerId, projectDir, options) {
+  try {
+    return await ensureProviderInstructionFile2(providerId, projectDir, options);
+  } catch (err) {
+    if (err instanceof HomeInstructionFileError) return null;
+    throw err;
+  }
+}
+var init_project_instruction_file = __esm({
+  "packages/adapters/src/providers/shared/project-instruction-file.ts"() {
+    "use strict";
+  }
+});
+
 // packages/adapters/src/providers/shared/cli-spawn.ts
 import { spawn } from "node:child_process";
 import { resolveSpawnInvocation as resolveSpawnInvocation2 } from "@cleocode/paths";
@@ -46561,7 +46975,7 @@ var init_hooks2 = __esm({
 import { existsSync as existsSync12, readFileSync as readFileSync8 } from "node:fs";
 import { join as join18 } from "node:path";
 import {
-  ensureProviderInstructionFile as ensureProviderInstructionFile3,
+  ensureProviderInstructionFile as ensureProviderInstructionFile4,
   ensureProviderRuleFile,
   updateJsonConfigFile as updateJsonConfigFile4
 } from "@cleocode/caamp";
@@ -46572,8 +46986,10 @@ var CLEO_MDC_FRONTMATTER, CursorInstallProvider;
 var init_install2 = __esm({
   "packages/adapters/src/providers/cursor/install.ts"() {
     "use strict";
+    init_heavy_command_hook_install();
     init_hook_template_installer();
     init_paths2();
+    init_project_instruction_file();
     CLEO_MDC_FRONTMATTER = [
       "---",
       "description: CLEO task management protocol references",
@@ -46594,21 +47010,29 @@ var init_install2 = __esm({
         const installedAt = (/* @__PURE__ */ new Date()).toISOString();
         let instructionFileUpdated = false;
         const details = {};
-        const instructionResult = await ensureProviderInstructionFile3("cursor", projectDir, {});
-        const cursorFilesUpdated = await this.updateInstructionFiles(projectDir);
-        instructionFileUpdated = instructionResult.action !== "intact" || cursorFilesUpdated;
-        if (instructionFileUpdated) {
-          details.instructionFiles = this.getUpdatedFileList(projectDir);
+        const instructionResult = await ensureProjectInstructionFile("cursor", projectDir, {});
+        if (instructionResult === null) {
+          details.instructionFiles = "skipped";
+        } else {
+          const cursorFilesUpdated = await this.updateInstructionFiles(projectDir);
+          instructionFileUpdated = instructionResult.action !== "intact" || cursorFilesUpdated;
+          if (instructionFileUpdated) {
+            details.instructionFiles = this.getUpdatedFileList(projectDir);
+          }
         }
         let hooksError = null;
-        try {
-          const hookResult = await this.installHookTemplates(projectDir);
-          if (hookResult) {
-            details.hookTemplates = hookResult;
+        if (isUserHomeDir(projectDir)) {
+          details.hookTemplates = "skipped";
+        } else {
+          try {
+            const hookResult = await this.installHookTemplates(projectDir);
+            if (hookResult) {
+              details.hookTemplates = hookResult;
+            }
+          } catch (err) {
+            hooksError = err instanceof Error ? err.message : String(err);
+            details.hooksError = hooksError;
           }
-        } catch (err) {
-          hooksError = err instanceof Error ? err.message : String(err);
-          details.hooksError = hooksError;
         }
         return {
           success: hooksError === null,
@@ -46656,7 +47080,7 @@ var init_install2 = __esm({
        * @param projectDir - Project root directory
        */
       async ensureInstructionReferences(projectDir) {
-        await ensureProviderInstructionFile3("cursor", projectDir, {});
+        await ensureProviderInstructionFile4("cursor", projectDir, {});
         await this.updateInstructionFiles(projectDir);
       }
       /**
@@ -47088,7 +47512,7 @@ var init_hooks3 = __esm({
 // packages/adapters/src/providers/opencode/install.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join25 } from "node:path";
-import { ensureProviderInstructionFile as ensureProviderInstructionFile6 } from "@cleocode/caamp";
+import { ensureProviderInstructionFile as ensureProviderInstructionFile7 } from "@cleocode/caamp";
 var OpenCodeInstallProvider;
 var init_install3 = __esm({
   "packages/adapters/src/providers/opencode/install.ts"() {
@@ -47096,6 +47520,7 @@ var init_install3 = __esm({
     init_heavy_command_hook_install();
     init_hook_template_installer();
     init_paths2();
+    init_project_instruction_file();
     OpenCodeInstallProvider = class {
       /**
        * Install CLEO into an OpenCode project.
@@ -47107,14 +47532,15 @@ var init_install3 = __esm({
         const { projectDir } = options;
         const installedAt = (/* @__PURE__ */ new Date()).toISOString();
         const details = {};
-        const instructResult = await ensureProviderInstructionFile6("opencode", projectDir, {
+        const instructResult = await ensureProjectInstructionFile("opencode", projectDir, {
           scope: "project",
           references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"]
         });
-        const instructionFileUpdated = instructResult.action !== "intact";
+        const instructionFileUpdated = instructResult !== null && instructResult.action !== "intact";
         if (instructionFileUpdated) {
           details.instructionFile = join25(projectDir, instructResult.instructFile);
         }
+        if (instructResult === null) details.instructionFile = "skipped";
         const hookResult = this.installHookTemplates(projectDir);
         if (hookResult) {
           details.hookTemplates = hookResult;
@@ -47154,7 +47580,7 @@ var init_install3 = __esm({
        */
       async isInstalled() {
         try {
-          const result = await ensureProviderInstructionFile6("opencode", process.cwd(), {
+          const result = await ensureProviderInstructionFile7("opencode", process.cwd(), {
             scope: "project",
             references: [
               `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`,
@@ -47174,7 +47600,7 @@ var init_install3 = __esm({
        * @param projectDir - Project root directory
        */
       async ensureInstructionReferences(projectDir) {
-        await ensureProviderInstructionFile6("opencode", projectDir, {
+        await ensureProviderInstructionFile7("opencode", projectDir, {
           scope: "project",
           references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"]
         });
@@ -47781,8 +48207,8 @@ var init_hooks4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/install.ts
-import { join as join28 } from "node:path";
-import { ensureProviderInstructionFile as ensureProviderInstructionFile7 } from "@cleocode/caamp";
+import { join as join29 } from "node:path";
+import { ensureProviderInstructionFile as ensureProviderInstructionFile8 } from "@cleocode/caamp";
 function getCleoReferences() {
   return [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"];
 }
@@ -47791,6 +48217,7 @@ var init_install4 = __esm({
   "packages/adapters/src/providers/pi/install.ts"() {
     "use strict";
     init_paths2();
+    init_project_instruction_file();
     PiInstallProvider = class {
       /**
        * Install CLEO into a Pi coding agent project.
@@ -47802,17 +48229,18 @@ var init_install4 = __esm({
         const { projectDir } = options;
         const installedAt = (/* @__PURE__ */ new Date()).toISOString();
         const details = {};
-        const projectResult = await ensureProviderInstructionFile7("pi", projectDir, {
+        const projectResult = await ensureProjectInstructionFile("pi", projectDir, {
           scope: "project",
           references: getCleoReferences()
         });
-        const projectUpdated = projectResult.action !== "intact";
+        const projectUpdated = projectResult !== null && projectResult.action !== "intact";
         if (projectUpdated) {
-          details.instructionFile = join28(projectDir, projectResult.instructFile);
+          details.instructionFile = join29(projectDir, projectResult.instructFile);
         }
+        if (projectResult === null) details.instructionFile = "skipped";
         let globalUpdated = false;
         try {
-          const globalResult = await ensureProviderInstructionFile7("pi", projectDir, {
+          const globalResult = await ensureProviderInstructionFile8("pi", projectDir, {
             scope: "global",
             references: getCleoReferences()
           });
@@ -47844,7 +48272,7 @@ var init_install4 = __esm({
        */
       async isInstalled() {
         try {
-          const result = await ensureProviderInstructionFile7("pi", process.cwd(), {
+          const result = await ensureProviderInstructionFile8("pi", process.cwd(), {
             scope: "project",
             references: getCleoReferences()
           });
@@ -47852,7 +48280,7 @@ var init_install4 = __esm({
         } catch {
         }
         try {
-          const result = await ensureProviderInstructionFile7("pi", process.cwd(), {
+          const result = await ensureProviderInstructionFile8("pi", process.cwd(), {
             scope: "global",
             references: getCleoReferences()
           });
@@ -47869,7 +48297,7 @@ var init_install4 = __esm({
        * @param projectDir - Project root directory
        */
       async ensureInstructionReferences(projectDir) {
-        await ensureProviderInstructionFile7("pi", projectDir, {
+        await ensureProviderInstructionFile8("pi", projectDir, {
           scope: "project",
           references: getCleoReferences()
         });
@@ -47879,7 +48307,7 @@ var init_install4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/spawn.ts
-import { findOnPath as findOnPath11 } from "@cleocode/paths";
+import { findOnPath as findOnPath12 } from "@cleocode/paths";
 function getPiCliPath() {
   return process.env["PI_CLI_PATH"] ?? "pi";
 }
@@ -47902,7 +48330,7 @@ var init_spawn4 = __esm({
        */
       async canSpawn() {
         const cliPath = getPiCliPath();
-        return findOnPath11(cliPath) !== null;
+        return findOnPath12(cliPath) !== null;
       }
       /**
        * Spawn a subagent via Pi CLI.
@@ -48013,22 +48441,22 @@ var init_spawn4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/adapter.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { join as join29 } from "node:path";
-import { findOnPath as findOnPath12 } from "@cleocode/paths";
+import { join as join30 } from "node:path";
+import { findOnPath as findOnPath13 } from "@cleocode/paths";
 function getPiAgentDir() {
   const env = process.env["PI_CODING_AGENT_DIR"];
   if (env !== void 0 && env.length > 0) {
     if (env === "~") return homedir13();
-    if (env.startsWith("~/")) return join29(homedir13(), env.slice(2));
+    if (env.startsWith("~/")) return join30(homedir13(), env.slice(2));
     return env;
   }
   const piHome = process.env["PI_HOME"];
   if (piHome !== void 0 && piHome.length > 0) {
-    return join29(piHome, "agent");
+    return join30(piHome, "agent");
   }
-  return join29(homedir13(), ".pi", "agent");
+  return join30(homedir13(), ".pi", "agent");
 }
 var PiAdapter;
 var init_adapter4 = __esm({
@@ -48131,17 +48559,17 @@ var init_adapter4 = __esm({
         }
         let cliAvailable = false;
         const cliPath = process.env["PI_CLI_PATH"] ?? "pi";
-        const resolvedCli = findOnPath12(cliPath);
+        const resolvedCli = findOnPath13(cliPath);
         cliAvailable = resolvedCli !== null;
         if (resolvedCli) details.cliPath = cliPath === "pi" ? resolvedCli : cliPath;
         else details.cliAvailable = false;
         const agentDir = getPiAgentDir();
-        const agentDirExists = existsSync20(agentDir);
+        const agentDirExists = existsSync21(agentDir);
         details.agentDirExists = agentDirExists;
         details.agentDir = agentDir;
         if (this.projectDir) {
-          const projectPiDir = join29(this.projectDir, ".pi");
-          details.projectPiDirExists = existsSync20(projectPiDir);
+          const projectPiDir = join30(this.projectDir, ".pi");
+          details.projectPiDirExists = existsSync21(projectPiDir);
         }
         details.piCodingAgentDirSet = process.env["PI_CODING_AGENT_DIR"] !== void 0;
         details.piHomeSet = process.env["PI_HOME"] !== void 0;
@@ -48353,12 +48781,12 @@ function createAdapter2() {
 
 // packages/adapters/src/providers/codex/adapter.ts
 import { existsSync as existsSync11 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { join as join17 } from "node:path";
 import { findOnPath as findOnPath3 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/codex/hooks.ts
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { join as join15 } from "node:path";
 
 // packages/adapters/src/providers/shared/transcript-reader.ts
@@ -48478,15 +48906,16 @@ var CodexHookProvider = class {
    * @task T162 @epic T134
    */
   async getTranscript(_sessionId, _projectDir) {
-    return readLatestTranscript(join15(homedir8(), ".codex"));
+    return readLatestTranscript(join15(homedir7(), ".codex"));
   }
 };
 
 // packages/adapters/src/providers/codex/install.ts
 init_heavy_command_hook_install();
 init_paths2();
+init_project_instruction_file();
 import { join as join16 } from "node:path";
-import { ensureProviderInstructionFile as ensureProviderInstructionFile2 } from "@cleocode/caamp";
+import { ensureProviderInstructionFile as ensureProviderInstructionFile3 } from "@cleocode/caamp";
 var CodexInstallProvider = class {
   /**
    * Install CLEO into a Codex CLI environment.
@@ -48499,22 +48928,22 @@ var CodexInstallProvider = class {
     const { projectDir } = options;
     const installedAt = (/* @__PURE__ */ new Date()).toISOString();
     const details = {};
-    const result = await ensureProviderInstructionFile2("codex", projectDir, {
+    const result = await ensureProjectInstructionFile("codex", projectDir, {
       scope: "project",
       references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"]
     });
-    const instructionFileUpdated = result.action !== "intact";
+    const instructionFileUpdated = result !== null && result.action !== "intact";
     if (instructionFileUpdated) {
       details.instructionFile = join16(projectDir, result.instructFile);
     }
+    if (result === null) details.instructionFile = "skipped";
     let success2 = true;
     if (options.heavyCommandHook !== void 0 && isUserHomeDir(projectDir)) {
       details.heavyCommandHook = "skipped";
     } else if (options.heavyCommandHook !== void 0) {
       try {
-        details.heavyCommandHook = await syncJsonHeavyCommandHook(
-          join16(projectDir, ".codex", "hooks.json"),
-          "codex",
+        details.heavyCommandHook = await syncCodexHeavyCommandHook(
+          projectDir,
           options.heavyCommandHook
         );
       } catch (err) {
@@ -48545,7 +48974,7 @@ var CodexInstallProvider = class {
    */
   async isInstalled() {
     try {
-      const result = await ensureProviderInstructionFile2("codex", process.cwd(), {
+      const result = await ensureProviderInstructionFile3("codex", process.cwd(), {
         scope: "project",
         references: [
           `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`,
@@ -48566,7 +48995,7 @@ var CodexInstallProvider = class {
    * @task T162
    */
   async ensureInstructionReferences(projectDir) {
-    await ensureProviderInstructionFile2("codex", projectDir, {
+    await ensureProviderInstructionFile3("codex", projectDir, {
       scope: "project",
       references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"]
     });
@@ -48654,7 +49083,7 @@ var CodexAdapter = class {
     cliAvailable = resolvedCli !== null;
     if (resolvedCli) details.cliPath = resolvedCli;
     else details.cliAvailable = false;
-    const codexConfigDir = join17(homedir9(), ".codex");
+    const codexConfigDir = join17(homedir8(), ".codex");
     const configExists = existsSync11(codexConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
@@ -48697,12 +49126,12 @@ init_cursor();
 
 // packages/adapters/src/providers/gemini-cli/adapter.ts
 import { existsSync as existsSync15 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 import { join as join22 } from "node:path";
 import { findOnPath as findOnPath5 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/gemini-cli/hooks.ts
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { join as join20 } from "node:path";
 var GEMINI_CLI_EVENT_MAP = {
   SessionStart: "SessionStart",
@@ -48781,15 +49210,16 @@ var GeminiCliHookProvider = class {
    * @task T161 @epic T134
    */
   async getTranscript(_sessionId, _projectDir) {
-    return readLatestTranscript(join20(homedir10(), ".gemini"));
+    return readLatestTranscript(join20(homedir9(), ".gemini"));
   }
 };
 
 // packages/adapters/src/providers/gemini-cli/install.ts
 init_paths2();
+init_project_instruction_file();
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
 import { join as join21 } from "node:path";
-import { ensureProviderInstructionFile as ensureProviderInstructionFile4 } from "@cleocode/caamp";
+import { ensureProviderInstructionFile as ensureProviderInstructionFile5 } from "@cleocode/caamp";
 var GeminiCliInstallProvider = class {
   /**
    * Install CLEO into a Gemini CLI environment.
@@ -48802,14 +49232,15 @@ var GeminiCliInstallProvider = class {
     const { projectDir } = options;
     const installedAt = (/* @__PURE__ */ new Date()).toISOString();
     const details = {};
-    const result = await ensureProviderInstructionFile4("gemini-cli", projectDir, {
+    const result = await ensureProjectInstructionFile("gemini-cli", projectDir, {
       references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"],
       scope: "project"
     });
-    const instructionFileUpdated = result.action !== "intact";
+    const instructionFileUpdated = result !== null && result.action !== "intact";
     if (instructionFileUpdated) {
       details.instructionFile = result.filePath;
     }
+    if (result === null) details.instructionFile = "skipped";
     return {
       success: true,
       installedAt,
@@ -48854,7 +49285,7 @@ var GeminiCliInstallProvider = class {
    * @task T161
    */
   async ensureInstructionReferences(projectDir) {
-    await ensureProviderInstructionFile4("gemini-cli", projectDir, {
+    await ensureProviderInstructionFile5("gemini-cli", projectDir, {
       references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"],
       scope: "project"
     });
@@ -48953,7 +49384,7 @@ var GeminiCliAdapter = class {
     cliAvailable = resolvedCli !== null;
     if (resolvedCli) details.cliPath = resolvedCli;
     else details.cliAvailable = false;
-    const geminiConfigDir = join22(homedir11(), ".gemini");
+    const geminiConfigDir = join22(homedir10(), ".gemini");
     const configExists = existsSync15(geminiConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
@@ -48992,7 +49423,7 @@ function createAdapter5() {
 
 // packages/adapters/src/providers/kimi/adapter.ts
 import { existsSync as existsSync17 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { join as join24 } from "node:path";
 import { findOnPath as findOnPath7 } from "@cleocode/paths";
 
@@ -49053,9 +49484,10 @@ var KimiHookProvider = class {
 
 // packages/adapters/src/providers/kimi/install.ts
 init_paths2();
+init_project_instruction_file();
 import { existsSync as existsSync16, readFileSync as readFileSync10 } from "node:fs";
 import { join as join23 } from "node:path";
-import { ensureProviderInstructionFile as ensureProviderInstructionFile5 } from "@cleocode/caamp";
+import { ensureProviderInstructionFile as ensureProviderInstructionFile6 } from "@cleocode/caamp";
 var KimiInstallProvider = class {
   /**
    * Install CLEO into a Kimi environment.
@@ -49068,14 +49500,15 @@ var KimiInstallProvider = class {
     const { projectDir } = options;
     const installedAt = (/* @__PURE__ */ new Date()).toISOString();
     const details = {};
-    const result = await ensureProviderInstructionFile5("kimi", projectDir, {
+    const result = await ensureProjectInstructionFile("kimi", projectDir, {
       references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"],
       scope: "project"
     });
-    const instructionFileUpdated = result.action !== "intact";
+    const instructionFileUpdated = result !== null && result.action !== "intact";
     if (instructionFileUpdated) {
       details.instructionFile = result.filePath;
     }
+    if (result === null) details.instructionFile = "skipped";
     return {
       success: true,
       installedAt,
@@ -49120,7 +49553,7 @@ var KimiInstallProvider = class {
    * @task T163
    */
   async ensureInstructionReferences(projectDir) {
-    await ensureProviderInstructionFile5("kimi", projectDir, {
+    await ensureProviderInstructionFile6("kimi", projectDir, {
       references: [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"],
       scope: "project"
     });
@@ -49206,7 +49639,7 @@ var KimiAdapter = class {
     cliAvailable = resolvedCli !== null;
     if (resolvedCli) details.cliPath = resolvedCli;
     else details.cliAvailable = false;
-    const kimiConfigDir = join24(homedir12(), ".kimi");
+    const kimiConfigDir = join24(homedir11(), ".kimi");
     const configExists = existsSync17(kimiConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
@@ -49244,20 +49677,405 @@ function createAdapter6() {
 
 // packages/adapters/src/index.ts
 init_opencode();
+
+// packages/adapters/src/providers/shared/heavy-command-hook-delivery.ts
+init_heavy_command_hook_install();
+init_hook_config();
+import { execFileSync as execFileSync2, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync20, lstatSync, readFileSync as readFileSync12, statSync as statSync3 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { dirname as dirname7, join as join28 } from "node:path";
+import { JsonConfigParseError } from "@cleocode/caamp";
+import { findOnPath as findOnPath11 } from "@cleocode/paths";
+var HEAVY_HOOK_DELIVERY_PROVIDERS = Object.freeze([
+  "claude-code",
+  "codex",
+  "opencode",
+  "kimi"
+]);
+var HEAVY_HOOK_FIX_COMMAND = "cleo doctor heavy-command-hook --fix";
+var CODEX_SHARED_REMEDY = "if the team wants Codex governed here, add CLEO's PreToolUse entry (the snippet) to .codex/hooks.json yourself and commit it deliberately; CLEO never writes or hides a project's own hook config";
+var KIMI_REASON = "Kimi reads hooks only from its global ~/.kimi/config.toml, and CLEO never writes user-global configs";
+var KIMI_REMEDY = "add a [[hooks]] entry for PreToolUse that runs `cleo hook heavy-command --provider kimi` to ~/.kimi/config.toml yourself";
+function homeOf(env) {
+  return env.HOME || homedir12();
+}
+function heavyHookTarget(provider, projectDir, env = process.env) {
+  switch (provider) {
+    case "claude-code":
+      return join28(projectDir, CLAUDE_LOCAL_SETTINGS);
+    case "codex":
+      return join28(projectDir, CODEX_HOOKS_FILE);
+    case "opencode":
+      return join28(projectDir, OPENCODE_PLUGIN_FILE);
+    case "kimi":
+      return join28(homeOf(env), ".kimi", "config.toml");
+  }
+}
+function detectHeavyHookProvider(provider, projectDir, env = process.env) {
+  const home = homeOf(env);
+  const signals = provider === "claude-code" ? [
+    [
+      env.CLAUDECODE === "1" || Boolean(env.CLAUDE_CODE_ENTRYPOINT),
+      "running inside Claude Code"
+    ],
+    [() => existsSync20(join28(projectDir, ".claude")), "the project has .claude/"],
+    [() => findOnPath11("claude", { env }) !== null, "`claude` is on PATH"],
+    [() => existsSync20(env.CLAUDE_CONFIG_DIR || join28(home, ".claude")), "~/.claude exists"]
+  ] : provider === "codex" ? [
+    [() => existsSync20(join28(projectDir, ".codex")), "the project has .codex"],
+    [() => findOnPath11("codex", { env }) !== null, "`codex` is on PATH"],
+    [() => existsSync20(env.CODEX_HOME || join28(home, ".codex")), "~/.codex exists"]
+  ] : provider === "opencode" ? [
+    [() => existsSync20(join28(projectDir, ".opencode")), "the project has .opencode/"],
+    [
+      () => existsSync20(join28(projectDir, "opencode.json")) || existsSync20(join28(projectDir, "opencode.jsonc")),
+      "the project has opencode.json"
+    ],
+    [() => findOnPath11("opencode", { env }) !== null, "`opencode` is on PATH"],
+    [
+      () => existsSync20(join28(env.XDG_CONFIG_HOME || join28(home, ".config"), "opencode")),
+      "~/.config/opencode exists"
+    ]
+  ] : [
+    [() => findOnPath11("kimi", { env }) !== null, "`kimi` is on PATH"],
+    [() => existsSync20(join28(home, ".kimi")), "~/.kimi exists"]
+  ];
+  for (const [test, why] of signals) {
+    if (typeof test === "boolean" ? test : test()) return { detected: true, why };
+  }
+  if (provider !== "kimi" && existsSync20(heavyHookTarget(provider, projectDir, env))) {
+    return { detected: true, why: "its hook config exists" };
+  }
+  return {
+    detected: false,
+    why: `${provider} is not in use here (no config directory or CLI found)`
+  };
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function syncProvider(provider, projectDir, mode, env) {
+  const target = heavyHookTarget(provider, projectDir, env);
+  if (provider === "kimi") {
+    return mode === "off" ? { provider, status: "unchanged", target } : { provider, status: "unsupported", target, reason: KIMI_REASON, remedy: KIMI_REMEDY };
+  }
+  try {
+    const result = provider === "claude-code" ? await syncClaudeCodeHeavyCommandHook(projectDir, mode) : provider === "codex" ? await syncCodexHeavyCommandHook(projectDir, mode) : syncOpencodeHeavyCommandPlugin(projectDir, mode);
+    return { provider, status: result, target };
+  } catch (err) {
+    if (err instanceof HeavyHookSharedConfigError) {
+      return {
+        provider,
+        status: "needs-consent",
+        target,
+        reason: err.message,
+        ...mode === "off" ? {
+          remedy: "the team committed CLEO's hook in .codex/hooks.json; remove it there in a team change if the team agrees"
+        } : { remedy: CODEX_SHARED_REMEDY, snippet: codexHookSnippet() }
+      };
+    }
+    if (err instanceof HeavyHookPathBlockedError) {
+      return {
+        provider,
+        status: "blocked",
+        target,
+        reason: err.message,
+        remedy: `remove or rename ${err.path} (it is not a directory), then run: ${HEAVY_HOOK_FIX_COMMAND}`
+      };
+    }
+    return {
+      provider,
+      status: "failed",
+      target,
+      reason: errorText(err),
+      remedy: err instanceof JsonConfigParseError ? `fix the JSON in ${err.filePath} (it was left untouched), then run: ${HEAVY_HOOK_FIX_COMMAND}` : `run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+}
+async function syncProjectHeavyCommandHooks(projectDir, mode, options = {}) {
+  const env = options.env ?? process.env;
+  const providers = options.providers ?? HEAVY_HOOK_DELIVERY_PROVIDERS;
+  const home = isUserHomeDir(projectDir, homeOf(env));
+  const outcomes = [];
+  for (const provider of providers) {
+    const target = heavyHookTarget(provider, projectDir, env);
+    if (home) {
+      outcomes.push({
+        provider,
+        status: "skipped",
+        target,
+        reason: "the project is your home directory, whose provider configs are user-global"
+      });
+      continue;
+    }
+    const detection = detectHeavyHookProvider(provider, projectDir, env);
+    if (mode !== "off" && !detection.detected) {
+      outcomes.push({ provider, status: "skipped", target, reason: detection.why });
+      continue;
+    }
+    outcomes.push(await syncProvider(provider, projectDir, mode, env));
+  }
+  return outcomes;
+}
+function jsonHookPresence(file2, provider) {
+  let raw;
+  try {
+    raw = readFileSync12(file2, "utf-8");
+  } catch (err) {
+    const code = err.code;
+    return code === "ENOENT" || code === "ENOTDIR" ? { kind: "absent" } : { kind: "unreadable", error: errorText(err) };
+  }
+  if (raw.trim() === "") return { kind: "absent" };
+  let config2;
+  try {
+    config2 = JSON.parse(raw);
+  } catch (err) {
+    return { kind: "unreadable", error: errorText(err) };
+  }
+  if (!isPlainObject2(config2))
+    return { kind: "unreadable", error: "top-level value is not an object" };
+  const hooks = config2.hooks;
+  const groups = isPlainObject2(hooks) ? hooks.PreToolUse : void 0;
+  if (!Array.isArray(groups)) return { kind: "absent" };
+  const expected = JSON.stringify(heavyCommandHookObject(provider));
+  let found = { kind: "absent" };
+  for (const group of groups) {
+    if (!isPlainObject2(group) || !Array.isArray(group.hooks)) continue;
+    for (const hook of group.hooks) {
+      if (!isHeavyHookObject(hook)) continue;
+      if (JSON.stringify(hook) === expected) return { kind: "present", current: true };
+      found = { kind: "present", current: false };
+    }
+  }
+  return found;
+}
+function presenceOf(provider, projectDir, target) {
+  if (provider !== "opencode") {
+    const local = jsonHookPresence(target, provider);
+    if (provider !== "claude-code" || local.kind !== "absent") return local;
+    const legacy = jsonHookPresence(join28(projectDir, ".claude", "settings.json"), provider);
+    return legacy.kind === "present" ? { kind: "present", current: false } : { kind: "absent" };
+  }
+  if (!existsSync20(target)) return { kind: "absent" };
+  try {
+    return {
+      kind: "present",
+      current: readFileSync12(target, "utf-8") === opencodeHeavyCommandPluginSource()
+    };
+  } catch (err) {
+    return { kind: "unreadable", error: errorText(err) };
+  }
+}
+var HOOK_FILES = {
+  "claude-code": CLAUDE_LOCAL_SETTINGS,
+  codex: CODEX_HOOKS_FILE,
+  opencode: OPENCODE_PLUGIN_FILE
+};
+function inspectProvider(provider, projectDir, mode, env, gitChecks) {
+  const target = heavyHookTarget(provider, projectDir, env);
+  const { detected, why } = detectHeavyHookProvider(provider, projectDir, env);
+  const base = { provider, detected, target };
+  if (provider === "kimi") {
+    if (!detected || mode === "off") return { ...base, state: "not-detected", detail: why };
+    let manual = false;
+    try {
+      manual = readFileSync12(target, "utf-8").includes(HEAVY_COMMAND_HOOK_ID);
+    } catch {
+    }
+    return manual ? { ...base, state: "installed", detail: `a manual entry in ${target} runs the hook` } : { ...base, state: "unsupported", detail: `${why}; ${KIMI_REASON}`, remedy: KIMI_REMEDY };
+  }
+  const presence = presenceOf(provider, projectDir, target);
+  if (presence.kind === "unreadable") {
+    return {
+      ...base,
+      state: "unreadable",
+      detail: `${target} cannot be read or parsed (${presence.error})`,
+      remedy: `fix ${target}, then run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+  if (mode === "off") {
+    return presence.kind === "present" ? {
+      ...base,
+      state: "outdated",
+      detail: "resources.heavyCommandHook is off, but the hook is still installed",
+      remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes it)`
+    } : { ...base, state: "disabled", detail: "resources.heavyCommandHook is off" };
+  }
+  if (presence.kind === "present") {
+    if (!presence.current) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `the hook in ${target} (or a legacy location) was written by another CLEO build`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND}`
+      };
+    }
+    if (!gitChecks) return { ...base, state: "installed", detail: `installed in ${target}` };
+    const shared2 = provider === "codex" ? codexHooksSharedReason(projectDir, true) : null;
+    if (shared2 !== null && excludedByCleo(projectDir, CODEX_HOOKS_FILE)) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `CLEO's info/exclude line hides ${target}, which ${shared2}`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes CLEO's exclude line)`
+      };
+    }
+    if (shared2 !== null) {
+      const modified = trackedFileModified(projectDir, CODEX_HOOKS_FILE);
+      if (modified || hookFileVisibleToGit(projectDir, CODEX_HOOKS_FILE)) {
+        return {
+          ...base,
+          state: "outdated",
+          detail: `CLEO's per-machine hook sits in ${target}, which ${shared2}, as ${modified ? "an uncommitted change" : "an untracked file"}: one \`git commit -a\` ships it to the team, and it widens evidence scope`,
+          remedy: "remove CLEO's entry from .codex/hooks.json, or commit it deliberately if the team wants Codex governed"
+        };
+      }
+      return { ...base, state: "installed", detail: `installed in ${target}, which ${shared2}` };
+    }
+    if (hookFileVisibleToGit(projectDir, HOOK_FILES[provider])) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `${target} is installed but git sees it as an untracked file (it widens evidence scope)`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (adds it to the repository's info/exclude)`
+      };
+    }
+    return { ...base, state: "installed", detail: `installed in ${target}` };
+  }
+  if (!detected) return { ...base, state: "not-detected", detail: why };
+  const shared = provider === "codex" ? codexHooksSharedReason(projectDir, gitChecks) : null;
+  if (shared !== null && gitChecks && excludedByCleo(projectDir, CODEX_HOOKS_FILE)) {
+    return {
+      ...base,
+      state: "outdated",
+      detail: `CLEO's info/exclude line hides ${target}, which ${shared}`,
+      remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes CLEO's exclude line)`
+    };
+  }
+  if (shared !== null) {
+    return {
+      ...base,
+      state: "needs-consent",
+      detail: `${target} ${shared}, so CLEO does not write or hide it; Codex runs ungoverned here until the team adds the entry (${why})`,
+      remedy: CODEX_SHARED_REMEDY,
+      snippet: codexHookSnippet()
+    };
+  }
+  const blocked = nonDirectoryAncestor(dirname7(target));
+  if (blocked !== null) {
+    return {
+      ...base,
+      state: "blocked",
+      detail: `${blocked} exists but is not a directory, so the hook cannot be installed (${why})`,
+      remedy: `remove or rename ${blocked}, then run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+  return {
+    ...base,
+    state: "missing",
+    detail: `${why}, but ${target} has no heavy-command hook: agent-run tests and builds bypass the machine-wide budget`,
+    remedy: `run: ${HEAVY_HOOK_FIX_COMMAND}`
+  };
+}
+function inspectProjectHeavyCommandHooks(projectDir, mode, options = {}) {
+  const env = options.env ?? process.env;
+  const providers = options.providers ?? HEAVY_HOOK_DELIVERY_PROVIDERS;
+  if (isUserHomeDir(projectDir, homeOf(env))) {
+    return providers.map((provider) => ({
+      provider,
+      detected: false,
+      state: "not-detected",
+      target: heavyHookTarget(provider, projectDir, env),
+      detail: "the project is your home directory; CLEO installs this hook per project only"
+    }));
+  }
+  const gitChecks = options.gitChecks ?? true;
+  return providers.map((provider) => inspectProvider(provider, projectDir, mode, env, gitChecks));
+}
+var OLDER_CLEO_MARKER_TTL_MS = 60 * 60 * 1e3;
+function olderCleoMarkerPath(cleoPath, dir, env) {
+  try {
+    const key = execFileSync2(
+      "/bin/sh",
+      ["-c", `printf '%s|%s' "$1" "$2" | cksum | tr -c '0-9' '-'`, "sh", cleoPath, dir],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 }
+    );
+    const base = env.XDG_RUNTIME_DIR || env.TMPDIR || "/tmp";
+    return join28(base, `${OLDER_CLEO_MARKER_PREFIX}${key}`);
+  } catch {
+    return null;
+  }
+}
+function hasOlderCleoMarker(cleoPath, dir, env) {
+  const marker16 = olderCleoMarkerPath(cleoPath, dir, env);
+  if (marker16 === null) return false;
+  try {
+    const st = lstatSync(marker16);
+    if (!st.isFile()) return false;
+    if (Date.now() - st.mtimeMs > OLDER_CLEO_MARKER_TTL_MS) return false;
+    return statSync3(cleoPath).mtimeMs <= st.mtimeMs;
+  } catch {
+    return false;
+  }
+}
+function probeHeavyHookCli(projectDir, options = {}) {
+  const env = options.env ?? process.env;
+  const path = findOnPath11("cleo", { env });
+  if (path === null) {
+    return {
+      state: "missing",
+      path: null,
+      detail: "no `cleo` on PATH, so the hook lets every heavy command run ungoverned",
+      remedy: "install CLEO so `cleo` is on PATH: npm i -g @cleocode/cleo"
+    };
+  }
+  const older = {
+    state: "older",
+    path,
+    detail: `${path} predates \`cleo hook\` and \`cleo run\`, so the hook lets every heavy command run ungoverned`,
+    remedy: `upgrade the cleo at ${path} (npm i -g @cleocode/cleo, or your version manager), then run: ${HEAVY_HOOK_FIX_COMMAND}`
+  };
+  if (hasOlderCleoMarker(path, projectDir, env)) return older;
+  const probe = spawnSync3(path, ["hook", "heavy-command", "--provider", "claude-code"], {
+    cwd: projectDir,
+    env: { ...env },
+    input: "{}",
+    encoding: "utf-8",
+    timeout: 2e4
+  });
+  if (probe.status === 0) {
+    return { state: "current", path, detail: `${path} answers \`cleo hook heavy-command\`` };
+  }
+  if (probe.status === 127 && /Unknown command/.test(probe.stderr ?? "")) return older;
+  return {
+    state: "unknown",
+    path,
+    detail: `${path} did not answer \`cleo hook heavy-command\` (${probe.error?.message ?? `exit ${probe.status ?? "none"}`}); the hook fails open, so heavy commands run ungoverned while it does not`,
+    remedy: `run \`${path} hook heavy-command < /dev/null\` in ${projectDir} to see why it fails (a broken version-manager shim, say)`
+  };
+}
+var heavyHookDeliveryApi = Object.freeze({
+  syncProjectHeavyCommandHooks,
+  inspectProjectHeavyCommandHooks,
+  probeHeavyHookCli
+});
+
+// packages/adapters/src/index.ts
 init_hook_template_installer();
 
 // packages/adapters/src/registry.ts
-import { readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname6, join as join30, resolve as resolve4 } from "node:path";
+import { readFileSync as readFileSync13 } from "node:fs";
+import { dirname as dirname8, join as join31, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PROVIDER_IDS = ["claude-code", "opencode", "cursor", "pi"];
 function getProviderManifests() {
   const manifests = [];
-  const baseDir = resolve4(dirname6(fileURLToPath3(import.meta.url)), "providers");
+  const baseDir = resolve5(dirname8(fileURLToPath3(import.meta.url)), "providers");
   for (const providerId of PROVIDER_IDS) {
     try {
-      const manifestPath = join30(baseDir, providerId, "manifest.json");
-      const raw = readFileSync12(manifestPath, "utf-8");
+      const manifestPath = join31(baseDir, providerId, "manifest.json");
+      const raw = readFileSync13(manifestPath, "utf-8");
       manifests.push(JSON.parse(raw));
     } catch {
     }
@@ -49305,6 +50123,8 @@ export {
   GeminiCliAdapter,
   GeminiCliHookProvider,
   GeminiCliInstallProvider,
+  HEAVY_HOOK_DELIVERY_PROVIDERS,
+  HEAVY_HOOK_FIX_COMMAND,
   KimiAdapter,
   KimiHookProvider,
   KimiInstallProvider,
@@ -49325,6 +50145,7 @@ export {
   createAdapter5 as createGeminiCliAdapter,
   createAdapter6 as createKimiAdapter,
   createAdapter7 as createOpenCodeAdapter,
+  detectHeavyHookProvider,
   discoverProviders,
   extractSymbolsFromText,
   getProviderHookTemplatePath,
@@ -49333,8 +50154,13 @@ export {
   getSetupInstructions,
   getSharedHookCorePath,
   getStatuslineConfig,
+  heavyHookDeliveryApi,
+  heavyHookTarget,
+  inspectProjectHeavyCommandHooks,
   installProviderHookTemplates,
+  probeHeavyHookCli,
   resolveTools,
-  runNexusPostModificationCheck
+  runNexusPostModificationCheck,
+  syncProjectHeavyCommandHooks
 };
 //# sourceMappingURL=index.js.map