@cleocode/adapters 2026.9.19 → 2026.9.21

package/dist/index.js

@@ -28,9 +28,9 @@ __export(cant_context_exports, {
 });
 import { execFile } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
+import { getCleoHome, getCleoPlatformPaths } from "@cleocode/paths";
 function discoverCantFiles(dir) {
   try {
     const entries = readdirSync(dir, { recursive: true, withFileTypes: true });
@@ -47,12 +47,9 @@ function discoverCantFiles(dir) {
   }
 }
 function resolveThreeTierPaths(projectDir) {
-  const home = homedir();
-  const xdgData = process.env["XDG_DATA_HOME"] ?? join(home, ".local", "share");
-  const xdgConfig = process.env["XDG_CONFIG_HOME"] ?? join(home, ".config");
   return {
-    global: join(xdgData, "cleo", "cant"),
-    user: join(xdgConfig, "cleo", "cant"),
+    global: join(getCleoHome(), "cant"),
+    user: join(getCleoPlatformPaths().config, "cant"),
     project: join(projectDir, ".cleo", "cant")
   };
 }
@@ -139,9 +136,7 @@ function readIdentityFile(projectDir) {
     } catch {
     }
   }
-  const home = homedir();
-  const xdgData = process.env["XDG_DATA_HOME"] ?? join(home, ".local", "share");
-  const globalPath = join(xdgData, "cleo", "CLEOOS-IDENTITY.md");
+  const globalPath = join(getCleoHome(), "CLEOOS-IDENTITY.md");
   if (existsSync(globalPath)) {
     try {
       const content = readFileSync(globalPath, "utf-8");
@@ -747,7 +742,17 @@ var init_acceptance_gate_schema = __esm({
               message: "Absent input requires both null digest and size"
             });
         })
-      )
+      ),
+      tree: z.object({
+        headSha: z.string().regex(/^[0-9a-f]{40}$/),
+        clean: z.boolean(),
+        cwd: z.string().min(1).refine(
+          (v) => !/^(?:\/|[A-Za-z]:[\\/]|\\\\)/.test(v) && !v.split(/[\\/]/).includes(".."),
+          "Tree-relative cwd must be relative and stay inside the tree"
+        ),
+        inputsHash: z.string().regex(/^[a-f0-9]{64}$/),
+        baseSha: z.string().regex(/^[0-9a-f]{40}$/).optional()
+      }).strict().optional()
     }).strict().superRefine((binding, context) => {
       if (new Set(binding.artifacts.map(({ path }) => path)).size !== binding.artifacts.length)
         context.addIssue({
@@ -777,8 +782,18 @@ var init_acceptance_gate_schema = __esm({
       errorMessage: z.string().optional(),
       /** ISO 8601 timestamp. */
       checkedAt: z.string().datetime(),
-      checkedBy: z.string().min(1)
+      checkedBy: z.string().min(1),
+      /** T12621: `executed` in this run, or an authenticated pass reused from the cache. */
+      source: z.enum(["executed", "cache"]).optional(),
+      /** T12621: creation time of the reused cache entry. */
+      cachedAt: z.string().datetime().optional()
     }).superRefine((result, context) => {
+      if (result.source === "cache" !== (result.cachedAt !== void 0))
+        context.addIssue({
+          code: "custom",
+          path: ["cachedAt"],
+          message: "A cached result carries its cache time, and only a cached result does"
+        });
       const binding = result.binding;
       if (binding) {
         if (binding.identity.actor !== result.checkedBy)
@@ -2778,7 +2793,8 @@ var init_tasks = __esm({
             }
           }
         },
-        removeRelates: { type: "array", items: { type: "string" } }
+        removeRelates: { type: "array", items: { type: "string" } },
+        expectedUpdatedAt: { type: "string", minLength: 1 }
       }
     };
     tasksUpdateInputContract = {
@@ -5735,6 +5751,13 @@ var init_operations_registry = __esm({
             required: false,
             description: "Disable automatic parent completion",
             cli: { flag: "no-auto-complete" }
+          },
+          {
+            name: "expectedUpdatedAt",
+            type: "string",
+            required: false,
+            description: "Optimistic-concurrency guard: fail with E_CONFLICT unless the task updatedAt still equals this value",
+            cli: { flag: "expected-updated-at" }
           }
         ],
         inputSchema: tasksUpdateInputContract,
@@ -9513,6 +9536,42 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      {
+        gateway: "mutate",
+        domain: "nexus",
+        operation: "projects.status",
+        description: "nexus.projects.status (mutate) \u2014 probe and record git state of every project location on this device (bounded, parallel; no network unless fetch)",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "fetch",
+            type: "boolean",
+            required: false,
+            description: "Run git fetch per location first (network; off by default)"
+          },
+          {
+            name: "concurrency",
+            type: "number",
+            required: false,
+            description: "Locations probed at once (default 8, max 64)"
+          },
+          {
+            name: "timeoutMs",
+            type: "number",
+            required: false,
+            description: "Per-location git budget in ms (default 10000; 30000 with fetch)"
+          },
+          {
+            name: "staleAfterMs",
+            type: "number",
+            required: false,
+            description: "A fetch older than this marks remote state stale (default 24h)"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "nexus",
@@ -10688,7 +10747,13 @@ var init_operations_registry = __esm({
           },
           { name: "title", type: "string", required: false, description: "Override PR title" },
           { name: "body", type: "string", required: false, description: "Override PR body" },
-          { name: "base", type: "string", required: false, description: "PR base branch" }
+          { name: "base", type: "string", required: false, description: "PR base branch" },
+          {
+            name: "taskId",
+            type: "string",
+            required: false,
+            description: "Owning task id (T####) for the PR commit subject"
+          }
         ]
       },
       {
@@ -10721,7 +10786,13 @@ var init_operations_registry = __esm({
           },
           { name: "title", type: "string", required: false, description: "Override PR title" },
           { name: "body", type: "string", required: false, description: "Override PR body" },
-          { name: "base", type: "string", required: false, description: "PR base branch" }
+          { name: "base", type: "string", required: false, description: "PR base branch" },
+          {
+            name: "taskId",
+            type: "string",
+            required: false,
+            description: "Owning task id (T####) for the PR commit subject"
+          }
         ]
       },
       {
@@ -13237,7 +13308,7 @@ var init_errors = __esm({
 
 // packages/contracts/src/evidence-atom-schema.ts
 import { z as z10 } from "zod";
-var EVIDENCE_ATOM_KINDS, PARSER_PREFIXES, KIND_BOUNDARY_REGEX, commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
+var EVIDENCE_ATOM_KINDS, PARSER_PREFIXES, KIND_BOUNDARY_REGEX, commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, ciAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
@@ -13250,6 +13321,7 @@ var init_evidence_atom_schema = __esm({
       "note",
       "decision",
       "pr",
+      "ci",
       "loc-drop",
       "callsite-coverage",
       "satisfies"
@@ -13288,6 +13360,10 @@ var init_evidence_atom_schema = __esm({
       kind: z10.literal("pr"),
       prNumber: z10.number().int().positive("pr atom requires a positive integer PR number")
     });
+    ciAtomSchema = z10.object({
+      kind: z10.literal("ci"),
+      prNumber: z10.number().int().positive("ci atom requires a positive integer PR number")
+    });
     locDropAtomSchema = z10.object({
       kind: z10.literal("loc-drop"),
       fromLines: z10.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
@@ -13325,6 +13401,7 @@ var init_evidence_atom_schema = __esm({
       noteAtomSchema,
       decisionAtomSchema,
       prAtomSchema,
+      ciAtomSchema,
       locDropAtomSchema,
       callsiteCoverageAtomSchema,
       satisfiesAtomSchema
@@ -13339,8 +13416,8 @@ var init_evidence_atom_schema = __esm({
           ["pr", "files"]
         ]
       },
-      testsPassed: { oneOf: [["test-run"], ["tool"]] },
-      qaPassed: { oneOf: [["tool"]] },
+      testsPassed: { oneOf: [["test-run"], ["tool"], ["ci"]] },
+      qaPassed: { oneOf: [["tool"], ["ci"]] },
       documented: { oneOf: [["files"], ["url"]] },
       securityPassed: { oneOf: [["tool"], ["note"]] },
       cleanupDone: { oneOf: [["note"]] },
@@ -13355,6 +13432,7 @@ var init_evidence_atom_schema = __esm({
       note: "note:<short description>",
       decision: "decision:D-arch-001",
       pr: "pr:357",
+      ci: "ci:357",
       "loc-drop": "loc-drop:<fromLines>:<toLines>",
       "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>",
       satisfies: "satisfies:T1234#AC2"
@@ -15163,6 +15241,13 @@ var init_peer = __esm({
   }
 });
 
+// packages/contracts/src/process-probe.ts
+var init_process_probe = __esm({
+  "packages/contracts/src/process-probe.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/release/evidence-atoms.ts
 import { z as z16 } from "zod";
 var parsedPrEvidenceAtomSchema, prEvidenceStateModifierSchema, ghPrViewSchema, PR_REQUIRED_WORKFLOWS;
@@ -15249,7 +15334,12 @@ var init_plan = __esm({
       "hotfix"
     ];
     IMPACT = ["major", "minor", "patch"];
-    RESOLVED_SOURCE = ["project-context", "language-default", "legacy-alias"];
+    RESOLVED_SOURCE = [
+      "project-context",
+      "package-script",
+      "language-default",
+      "legacy-alias"
+    ];
     ReleaseChannelSchema = z17.enum(RELEASE_CHANNEL);
     ReleaseSchemeSchema = z17.enum(RELEASE_SCHEME);
     ReleaseKindSchema = z17.enum(RELEASE_KIND);
@@ -17165,6 +17255,117 @@ var init_collection_keys = __esm({
   }
 });
 
+// packages/contracts/src/decide.ts
+import { z as z24 } from "zod";
+var DECISION_QUESTION_TYPES, DECISION_OUTCOME_SOURCES, DECISION_REQUEST_LIMITS, decisionQuestionTypeSchema, decisionOutcomeSourceSchema, decisionInstructionsSchema, unitIntervalSchema, decisionStateSchema, noulDecisionQuestionSchema, choiceDecisionQuestionSchema, scoreDecisionQuestionSchema, decisionQuestionSchema, decisionRequestSchema, noulDecisionAnswerSchema, choiceDecisionAnswerSchema, scoreDecisionAnswerSchema, decisionAnswerSchema, decisionOutcomeSchema, decisionProviderConfigSchema;
+var init_decide = __esm({
+  "packages/contracts/src/decide.ts"() {
+    "use strict";
+    DECISION_QUESTION_TYPES = ["noul", "choice", "score"];
+    DECISION_OUTCOME_SOURCES = ["provider", "cache", "fallback"];
+    DECISION_REQUEST_LIMITS = {
+      /**
+       * Maximum size of `state`, in UTF-16 characters. A string state is measured
+       * directly; a structured (object/array) state is measured on its
+       * `JSON.stringify` serialization, which is what goes over the wire.
+       */
+      maxStateChars: 32e3,
+      /** Minimum number of questions in one request. */
+      minQuestions: 1,
+      /** Maximum number of questions in one request. */
+      maxQuestions: 32,
+      /** Minimum number of options a `choice` question must offer. */
+      minChoiceOptions: 2,
+      /** Minimum number of levels on a `score` question's scale. */
+      minScoreLevels: 2,
+      /** Maximum number of levels on a `score` question's scale. */
+      maxScoreLevels: 10
+    };
+    decisionQuestionTypeSchema = z24.enum(DECISION_QUESTION_TYPES);
+    decisionOutcomeSourceSchema = z24.enum(DECISION_OUTCOME_SOURCES);
+    decisionInstructionsSchema = z24.union([z24.string(), z24.record(z24.string(), z24.json())]);
+    unitIntervalSchema = z24.number().min(0).max(1);
+    decisionStateSchema = z24.union([z24.string(), z24.array(z24.json()), z24.record(z24.string(), z24.json())]).superRefine((state, context) => {
+      const size = typeof state === "string" ? state.length : JSON.stringify(state).length;
+      if (size > DECISION_REQUEST_LIMITS.maxStateChars) {
+        context.addIssue({
+          code: "custom",
+          message: `state is ${size} characters; the limit is ${DECISION_REQUEST_LIMITS.maxStateChars}`
+        });
+      }
+    });
+    noulDecisionQuestionSchema = z24.object({
+      type: z24.literal("noul"),
+      instructions: decisionInstructionsSchema.optional(),
+      criteria: z24.string().min(1)
+    });
+    choiceDecisionQuestionSchema = z24.object({
+      type: z24.literal("choice"),
+      instructions: decisionInstructionsSchema.optional(),
+      criteria: z24.record(z24.string().min(1), z24.string()).refine((options) => Object.keys(options).length >= DECISION_REQUEST_LIMITS.minChoiceOptions, {
+        message: `a choice question needs at least ${DECISION_REQUEST_LIMITS.minChoiceOptions} options`
+      })
+    });
+    scoreDecisionQuestionSchema = z24.object({
+      type: z24.literal("score"),
+      instructions: decisionInstructionsSchema.optional(),
+      criteria: z24.array(z24.string()).min(DECISION_REQUEST_LIMITS.minScoreLevels).max(DECISION_REQUEST_LIMITS.maxScoreLevels)
+    });
+    decisionQuestionSchema = z24.discriminatedUnion("type", [
+      noulDecisionQuestionSchema,
+      choiceDecisionQuestionSchema,
+      scoreDecisionQuestionSchema
+    ]);
+    decisionRequestSchema = z24.object({
+      model: z24.string().min(1).optional(),
+      state: decisionStateSchema,
+      questions: z24.record(z24.string().min(1), decisionQuestionSchema).refine(
+        (questions) => {
+          const count = Object.keys(questions).length;
+          return count >= DECISION_REQUEST_LIMITS.minQuestions && count <= DECISION_REQUEST_LIMITS.maxQuestions;
+        },
+        {
+          message: `a request needs ${DECISION_REQUEST_LIMITS.minQuestions}\u2013${DECISION_REQUEST_LIMITS.maxQuestions} questions`
+        }
+      )
+    });
+    noulDecisionAnswerSchema = z24.object({
+      type: z24.literal("noul"),
+      value: z24.boolean(),
+      probability: unitIntervalSchema,
+      confidence: unitIntervalSchema
+    });
+    choiceDecisionAnswerSchema = z24.object({
+      type: z24.literal("choice"),
+      value: z24.string().min(1),
+      probabilities: z24.record(z24.string().min(1), unitIntervalSchema),
+      confidence: unitIntervalSchema
+    });
+    scoreDecisionAnswerSchema = z24.object({
+      type: z24.literal("score"),
+      value: z24.number().int().nonnegative(),
+      probabilities: z24.array(unitIntervalSchema).min(DECISION_REQUEST_LIMITS.minScoreLevels).max(DECISION_REQUEST_LIMITS.maxScoreLevels),
+      confidence: unitIntervalSchema
+    });
+    decisionAnswerSchema = z24.discriminatedUnion("type", [
+      noulDecisionAnswerSchema,
+      choiceDecisionAnswerSchema,
+      scoreDecisionAnswerSchema
+    ]);
+    decisionOutcomeSchema = z24.object({
+      answers: z24.record(z24.string().min(1), decisionAnswerSchema),
+      source: decisionOutcomeSourceSchema,
+      requestId: z24.string().min(1).optional(),
+      latencyMs: z24.number().nonnegative(),
+      costUsd: z24.number().nonnegative().optional(),
+      inputTokens: z24.number().int().nonnegative().optional()
+    });
+    decisionProviderConfigSchema = z24.object({
+      baseUrl: z24.url()
+    });
+  }
+});
+
 // packages/contracts/src/task-id.ts
 var init_task_id = __esm({
   "packages/contracts/src/task-id.ts"() {
@@ -17219,11 +17420,13 @@ var init_src = __esm({
     init_entities();
     init_operations();
     init_nexus_scope_map();
+    init_nexus_user_profile();
     init_output_contracts_data();
     init_params();
     init_service();
     init_tasks();
     init_peer();
+    init_process_probe();
     init_evidence_atoms();
     init_plan();
     init_render();
@@ -17243,20 +17446,21 @@ var init_src = __esm({
     init_workgraph();
     init_caamp_markers();
     init_collection_keys();
+    init_decide();
     init_task_id();
   }
 });
 
 // packages/adapters/src/providers/shared/credentials.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir } from "node:os";
 import { join as join2 } from "node:path";
+import { getCleoHome as getCleoHome2 } from "@cleocode/paths";
 function resolveCredentials(_provider) {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (envKey?.trim()) return { apiKey: envKey.trim() };
   try {
-    const xdg = process.env["XDG_DATA_HOME"] ?? join2(homedir2(), ".local", "share");
-    const keyFile = join2(xdg, "cleo", "anthropic-key");
+    const keyFile = join2(getCleoHome2(), "anthropic-key");
     if (existsSync2(keyFile)) {
       const stored = readFileSync2(keyFile, "utf-8").trim();
       if (stored) return { apiKey: stored };
@@ -17264,7 +17468,7 @@ function resolveCredentials(_provider) {
   } catch {
   }
   try {
-    const credPath = join2(homedir2(), ".claude", ".credentials.json");
+    const credPath = join2(homedir(), ".claude", ".credentials.json");
     if (!existsSync2(credPath)) return { apiKey: null };
     const raw = readFileSync2(credPath, "utf-8");
     const cred = parseClaudeCodeCredentials(raw);
@@ -31263,7 +31467,7 @@ function resolveRef(ref, ctx) {
 function convertBaseSchema(schema, ctx) {
   if (schema.not !== void 0) {
     if (typeof schema.not === "object" && Object.keys(schema.not).length === 0) {
-      return z24.never();
+      return z25.never();
     }
     throw new Error("not is not supported in Zod (except { not: {} } for never)");
   }
@@ -31285,7 +31489,7 @@ function convertBaseSchema(schema, ctx) {
       return ctx.refs.get(refPath);
     }
     if (ctx.processing.has(refPath)) {
-      return z24.lazy(() => {
+      return z25.lazy(() => {
         if (!ctx.refs.has(refPath)) {
           throw new Error(`Circular reference not resolved: ${refPath}`);
         }
@@ -31302,25 +31506,25 @@ function convertBaseSchema(schema, ctx) {
   if (schema.enum !== void 0) {
     const enumValues = schema.enum;
     if (ctx.version === "openapi-3.0" && schema.nullable === true && enumValues.length === 1 && enumValues[0] === null) {
-      return z24.null();
+      return z25.null();
     }
     if (enumValues.length === 0) {
-      return z24.never();
+      return z25.never();
     }
     if (enumValues.length === 1) {
-      return z24.literal(enumValues[0]);
+      return z25.literal(enumValues[0]);
     }
     if (enumValues.every((v) => typeof v === "string")) {
-      return z24.enum(enumValues);
+      return z25.enum(enumValues);
     }
-    const literalSchemas = enumValues.map((v) => z24.literal(v));
+    const literalSchemas = enumValues.map((v) => z25.literal(v));
     if (literalSchemas.length < 2) {
       return literalSchemas[0];
     }
-    return z24.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
+    return z25.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
   }
   if (schema.const !== void 0) {
-    return z24.literal(schema.const);
+    return z25.literal(schema.const);
   }
   const type = schema.type;
   if (Array.isArray(type)) {
@@ -31329,68 +31533,68 @@ function convertBaseSchema(schema, ctx) {
       return convertBaseSchema(typeSchema, ctx);
     });
     if (typeSchemas.length === 0) {
-      return z24.never();
+      return z25.never();
     }
     if (typeSchemas.length === 1) {
       return typeSchemas[0];
     }
-    return z24.union(typeSchemas);
+    return z25.union(typeSchemas);
   }
   if (!type) {
-    return z24.any();
+    return z25.any();
   }
   let zodSchema2;
   switch (type) {
     case "string": {
-      let stringSchema = z24.string();
+      let stringSchema = z25.string();
       if (schema.format) {
         const format = schema.format;
         if (format === "email") {
-          stringSchema = stringSchema.check(z24.email());
+          stringSchema = stringSchema.check(z25.email());
         } else if (format === "uri" || format === "uri-reference") {
-          stringSchema = stringSchema.check(z24.url());
+          stringSchema = stringSchema.check(z25.url());
         } else if (format === "uuid" || format === "guid") {
-          stringSchema = stringSchema.check(z24.uuid());
+          stringSchema = stringSchema.check(z25.uuid());
         } else if (format === "date-time") {
-          stringSchema = stringSchema.check(z24.iso.datetime());
+          stringSchema = stringSchema.check(z25.iso.datetime());
         } else if (format === "date") {
-          stringSchema = stringSchema.check(z24.iso.date());
+          stringSchema = stringSchema.check(z25.iso.date());
         } else if (format === "time") {
-          stringSchema = stringSchema.check(z24.iso.time());
+          stringSchema = stringSchema.check(z25.iso.time());
         } else if (format === "duration") {
-          stringSchema = stringSchema.check(z24.iso.duration());
+          stringSchema = stringSchema.check(z25.iso.duration());
         } else if (format === "ipv4") {
-          stringSchema = stringSchema.check(z24.ipv4());
+          stringSchema = stringSchema.check(z25.ipv4());
         } else if (format === "ipv6") {
-          stringSchema = stringSchema.check(z24.ipv6());
+          stringSchema = stringSchema.check(z25.ipv6());
         } else if (format === "mac") {
-          stringSchema = stringSchema.check(z24.mac());
+          stringSchema = stringSchema.check(z25.mac());
         } else if (format === "cidr") {
-          stringSchema = stringSchema.check(z24.cidrv4());
+          stringSchema = stringSchema.check(z25.cidrv4());
         } else if (format === "cidr-v6") {
-          stringSchema = stringSchema.check(z24.cidrv6());
+          stringSchema = stringSchema.check(z25.cidrv6());
         } else if (format === "base64") {
-          stringSchema = stringSchema.check(z24.base64());
+          stringSchema = stringSchema.check(z25.base64());
         } else if (format === "base64url") {
-          stringSchema = stringSchema.check(z24.base64url());
+          stringSchema = stringSchema.check(z25.base64url());
         } else if (format === "e164") {
-          stringSchema = stringSchema.check(z24.e164());
+          stringSchema = stringSchema.check(z25.e164());
         } else if (format === "jwt") {
-          stringSchema = stringSchema.check(z24.jwt());
+          stringSchema = stringSchema.check(z25.jwt());
         } else if (format === "emoji") {
-          stringSchema = stringSchema.check(z24.emoji());
+          stringSchema = stringSchema.check(z25.emoji());
         } else if (format === "nanoid") {
-          stringSchema = stringSchema.check(z24.nanoid());
+          stringSchema = stringSchema.check(z25.nanoid());
         } else if (format === "cuid") {
-          stringSchema = stringSchema.check(z24.cuid());
+          stringSchema = stringSchema.check(z25.cuid());
         } else if (format === "cuid2") {
-          stringSchema = stringSchema.check(z24.cuid2());
+          stringSchema = stringSchema.check(z25.cuid2());
         } else if (format === "ulid") {
-          stringSchema = stringSchema.check(z24.ulid());
+          stringSchema = stringSchema.check(z25.ulid());
         } else if (format === "xid") {
-          stringSchema = stringSchema.check(z24.xid());
+          stringSchema = stringSchema.check(z25.xid());
         } else if (format === "ksuid") {
-          stringSchema = stringSchema.check(z24.ksuid());
+          stringSchema = stringSchema.check(z25.ksuid());
         }
       }
       if (typeof schema.minLength === "number") {
@@ -31407,7 +31611,7 @@ function convertBaseSchema(schema, ctx) {
     }
     case "number":
     case "integer": {
-      let numberSchema = type === "integer" ? z24.number().int() : z24.number();
+      let numberSchema = type === "integer" ? z25.number().int() : z25.number();
       if (typeof schema.minimum === "number") {
         numberSchema = numberSchema.min(schema.minimum);
       }
@@ -31431,11 +31635,11 @@ function convertBaseSchema(schema, ctx) {
       break;
     }
     case "boolean": {
-      zodSchema2 = z24.boolean();
+      zodSchema2 = z25.boolean();
       break;
     }
     case "null": {
-      zodSchema2 = z24.null();
+      zodSchema2 = z25.null();
       break;
     }
     case "object": {
@@ -31448,14 +31652,14 @@ function convertBaseSchema(schema, ctx) {
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
-        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z24.any();
+        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z25.any();
         if (Object.keys(shape).length === 0) {
-          zodSchema2 = z24.record(keySchema, valueSchema);
+          zodSchema2 = z25.record(keySchema, valueSchema);
           break;
         }
-        const objectSchema2 = z24.object(shape).passthrough();
-        const recordSchema = z24.looseRecord(keySchema, valueSchema);
-        zodSchema2 = z24.intersection(objectSchema2, recordSchema);
+        const objectSchema2 = z25.object(shape).passthrough();
+        const recordSchema = z25.looseRecord(keySchema, valueSchema);
+        zodSchema2 = z25.intersection(objectSchema2, recordSchema);
         break;
       }
       if (schema.patternProperties) {
@@ -31464,28 +31668,28 @@ function convertBaseSchema(schema, ctx) {
         const looseRecords = [];
         for (const pattern of patternKeys) {
           const patternValue = convertSchema(patternProps[pattern], ctx);
-          const keySchema = z24.string().regex(new RegExp(pattern));
-          looseRecords.push(z24.looseRecord(keySchema, patternValue));
+          const keySchema = z25.string().regex(new RegExp(pattern));
+          looseRecords.push(z25.looseRecord(keySchema, patternValue));
         }
         const schemasToIntersect = [];
         if (Object.keys(shape).length > 0) {
-          schemasToIntersect.push(z24.object(shape).passthrough());
+          schemasToIntersect.push(z25.object(shape).passthrough());
         }
         schemasToIntersect.push(...looseRecords);
         if (schemasToIntersect.length === 0) {
-          zodSchema2 = z24.object({}).passthrough();
+          zodSchema2 = z25.object({}).passthrough();
         } else if (schemasToIntersect.length === 1) {
           zodSchema2 = schemasToIntersect[0];
         } else {
-          let result = z24.intersection(schemasToIntersect[0], schemasToIntersect[1]);
+          let result = z25.intersection(schemasToIntersect[0], schemasToIntersect[1]);
           for (let i = 2; i < schemasToIntersect.length; i++) {
-            result = z24.intersection(result, schemasToIntersect[i]);
+            result = z25.intersection(result, schemasToIntersect[i]);
           }
           zodSchema2 = result;
         }
         break;
       }
-      const objectSchema = z24.object(shape);
+      const objectSchema = z25.object(shape);
       if (schema.additionalProperties === false) {
         zodSchema2 = objectSchema.strict();
       } else if (typeof schema.additionalProperties === "object") {
@@ -31502,33 +31706,33 @@ function convertBaseSchema(schema, ctx) {
         const tupleItems = prefixItems.map((item) => convertSchema(item, ctx));
         const rest = items && typeof items === "object" && !Array.isArray(items) ? convertSchema(items, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z24.tuple(tupleItems).rest(rest);
+          zodSchema2 = z25.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z24.tuple(tupleItems);
+          zodSchema2 = z25.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z24.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z25.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z24.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z25.maxLength(schema.maxItems));
         }
       } else if (Array.isArray(items)) {
         const tupleItems = items.map((item) => convertSchema(item, ctx));
         const rest = schema.additionalItems && typeof schema.additionalItems === "object" ? convertSchema(schema.additionalItems, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z24.tuple(tupleItems).rest(rest);
+          zodSchema2 = z25.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z24.tuple(tupleItems);
+          zodSchema2 = z25.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z24.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z25.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z24.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z25.maxLength(schema.maxItems));
         }
       } else if (items !== void 0) {
         const element = convertSchema(items, ctx);
-        let arraySchema = z24.array(element);
+        let arraySchema = z25.array(element);
         if (typeof schema.minItems === "number") {
           arraySchema = arraySchema.min(schema.minItems);
         }
@@ -31537,7 +31741,7 @@ function convertBaseSchema(schema, ctx) {
         }
         zodSchema2 = arraySchema;
       } else {
-        zodSchema2 = z24.array(z24.any());
+        zodSchema2 = z25.array(z25.any());
       }
       break;
     }
@@ -31554,37 +31758,37 @@ function convertBaseSchema(schema, ctx) {
 }
 function convertSchema(schema, ctx) {
   if (typeof schema === "boolean") {
-    return schema ? z24.any() : z24.never();
+    return schema ? z25.any() : z25.never();
   }
   let baseSchema = convertBaseSchema(schema, ctx);
   const hasExplicitType = schema.type || schema.enum !== void 0 || schema.const !== void 0;
   if (schema.anyOf && Array.isArray(schema.anyOf)) {
     const options = schema.anyOf.map((s) => convertSchema(s, ctx));
-    const anyOfUnion = z24.union(options);
-    baseSchema = hasExplicitType ? z24.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+    const anyOfUnion = z25.union(options);
+    baseSchema = hasExplicitType ? z25.intersection(baseSchema, anyOfUnion) : anyOfUnion;
   }
   if (schema.oneOf && Array.isArray(schema.oneOf)) {
     const options = schema.oneOf.map((s) => convertSchema(s, ctx));
-    const oneOfUnion = z24.xor(options);
-    baseSchema = hasExplicitType ? z24.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+    const oneOfUnion = z25.xor(options);
+    baseSchema = hasExplicitType ? z25.intersection(baseSchema, oneOfUnion) : oneOfUnion;
   }
   if (schema.allOf && Array.isArray(schema.allOf)) {
     if (schema.allOf.length === 0) {
-      baseSchema = hasExplicitType ? baseSchema : z24.any();
+      baseSchema = hasExplicitType ? baseSchema : z25.any();
     } else {
       let result = hasExplicitType ? baseSchema : convertSchema(schema.allOf[0], ctx);
       const startIdx = hasExplicitType ? 0 : 1;
       for (let i = startIdx; i < schema.allOf.length; i++) {
-        result = z24.intersection(result, convertSchema(schema.allOf[i], ctx));
+        result = z25.intersection(result, convertSchema(schema.allOf[i], ctx));
       }
       baseSchema = result;
     }
   }
   if (schema.nullable === true && ctx.version === "openapi-3.0") {
-    baseSchema = z24.nullable(baseSchema);
+    baseSchema = z25.nullable(baseSchema);
   }
   if (schema.readOnly === true) {
-    baseSchema = z24.readonly(baseSchema);
+    baseSchema = z25.readonly(baseSchema);
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
@@ -31611,7 +31815,7 @@ function convertSchema(schema, ctx) {
 }
 function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
-    return schema ? z24.any() : z24.never();
+    return schema ? z25.any() : z25.never();
   }
   const version2 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
@@ -31625,14 +31829,14 @@ function fromJSONSchema(schema, params) {
   };
   return convertSchema(schema, ctx);
 }
-var z24, RECOGNIZED_KEYS;
+var z25, RECOGNIZED_KEYS;
 var init_from_json_schema = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/from-json-schema.js"() {
     init_registries();
     init_checks2();
     init_iso();
     init_schemas2();
-    z24 = {
+    z25 = {
       ...schemas_exports2,
       ...checks_exports2,
       iso: iso_exports
@@ -43141,7 +43345,7 @@ var init_spawn = __esm({
        *
        * Uses 3-tier key resolution so the provider works with:
        * - `ANTHROPIC_API_KEY` environment variable (explicit)
-       * - `~/.local/share/cleo/anthropic-key` (user-stored via cleo config)
+       * - `<getCleoHome()>/anthropic-key` (user-stored via cleo config)
        * - Claude Code OAuth token (zero-config for Claude Code users)
        *
        * @returns `true` when any Anthropic credential is available
@@ -43272,16 +43476,62 @@ var init_spawn = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/paths.ts
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir2 } from "node:os";
 import { join as join3 } from "node:path";
-var ClaudeCodePathProvider;
+function claudeSettingsPath() {
+  return new ClaudeCodePathProvider().getSettingsPath() ?? join3(homedir2(), ".claude", "settings.json");
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isCleoHookEntry(entry, commandIncludes) {
+  if (!isPlainObject2(entry) || !Array.isArray(entry.hooks)) return false;
+  return entry.hooks.some(
+    (hook) => isPlainObject2(hook) && typeof hook.command === "string" && hook.command.includes(CLEO_HOOK_MARKER) && (commandIncludes === void 0 || hook.command.includes(commandIncludes))
+  );
+}
+function hasCleoHook(entries, commandIncludes) {
+  return Array.isArray(entries) && entries.some((e) => isCleoHookEntry(e, commandIncludes));
+}
+function hookMap(settings) {
+  const existing = settings.hooks;
+  if (existing === void 0) {
+    const created = {};
+    settings.hooks = created;
+    return created;
+  }
+  if (!isPlainObject2(existing)) {
+    throw new Error('settings.json "hooks" is not an object; not modifying it');
+  }
+  return existing;
+}
+function appendHookEntry(hooks, event, entry) {
+  const existing = hooks[event];
+  if (existing !== void 0 && !Array.isArray(existing)) {
+    throw new Error(`settings.json "hooks.${event}" is not an array; not modifying it`);
+  }
+  hooks[event] = [...existing ?? [], entry];
+}
+function removeCleoHookEntries(hooks) {
+  let changed = false;
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const kept = entries.filter((e) => !isCleoHookEntry(e));
+    if (kept.length !== entries.length) {
+      hooks[event] = kept;
+      changed = true;
+    }
+  }
+  return changed;
+}
+var ClaudeCodePathProvider, CLEO_HOOK_MARKER;
 var init_paths = __esm({
   "packages/adapters/src/providers/claude-code/paths.ts"() {
     "use strict";
     ClaudeCodePathProvider = class {
       /** Get the provider's root configuration directory. */
       getProviderDir() {
-        return process.env["CLAUDE_HOME"] ?? join3(homedir3(), ".claude");
+        return process.env["CLAUDE_HOME"] ?? join3(homedir2(), ".claude");
       }
       /** Get the path to the provider's settings file, or null if unavailable. */
       getSettingsPath() {
@@ -43293,16 +43543,17 @@ var init_paths = __esm({
       }
       /** Get the path to the provider's memory database, or null if unsupported. */
       getMemoryDbPath() {
-        return process.env["CLAUDE_MEM_DB"] ?? join3(homedir3(), ".claude-mem", "claude-mem.db");
+        return process.env["CLAUDE_MEM_DB"] ?? join3(homedir2(), ".claude-mem", "claude-mem.db");
       }
     };
+    CLEO_HOOK_MARKER = "# cleo-hook";
   }
 });
 
 // packages/adapters/src/providers/claude-code/context-monitor.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { dirname, join as join4 } from "node:path";
 import { resolveLegacyCleoDir } from "@cleocode/paths";
 function getContextStatusFromPercentage(percentage) {
@@ -43388,7 +43639,7 @@ var init_context_monitor = __esm({
           if (cmd.includes("context-monitor.sh") || cmd.includes("cleo-statusline") || cmd.includes(".context-state.json") || cmd.includes("context-states")) {
             return "configured";
           }
-          const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir4()) : cmd;
+          const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir3()) : cmd;
           if (existsSync3(scriptPath)) {
             try {
               const content = readFileSync3(scriptPath, "utf-8");
@@ -43427,14 +43678,15 @@ var init_context_monitor = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/hooks.ts
-import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
 import { join as join5 } from "node:path";
+import { updateJsonConfigFile } from "@cleocode/caamp";
 var PROVIDER_ID, CLAUDE_CODE_EVENT_MAP, ClaudeCodeHookProvider;
 var init_hooks = __esm({
   "packages/adapters/src/providers/claude-code/hooks.ts"() {
     "use strict";
+    init_paths();
     PROVIDER_ID = "claude-code";
     CLAUDE_CODE_EVENT_MAP = {
       // CAAMP: toNative('SessionStart',      'claude-code') = 'SessionStart'
@@ -43506,39 +43758,16 @@ var init_hooks = __esm({
       async registerNativeHooks(projectDir) {
         this.projectDir = projectDir;
         this.registered = true;
-        try {
-          const home = homedir5();
-          const settingsPath = join5(home, ".claude", "settings.json");
-          let settings = {};
-          if (existsSync4(settingsPath)) {
-            try {
-              settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
-            } catch {
-            }
-          }
-          const hooks = settings.hooks ?? {};
-          const alreadyRegistered = Object.values(hooks).some(
-            (entries) => Array.isArray(entries) && entries.some(
-              (e) => typeof e === "object" && e !== null && Array.isArray(e.hooks) && e.hooks.some(
-                (h) => typeof h.command === "string" && h.command.includes("# cleo-hook")
-              )
-            )
-          );
-          if (alreadyRegistered) {
-            return;
+        await this.updateSettings((settings) => {
+          const hooks = hookMap(settings);
+          if (Object.values(hooks).some((entries) => hasCleoHook(entries))) {
+            return false;
           }
-          if (!hooks.Stop) hooks.Stop = [];
-          hooks.Stop.push({
+          appendHookEntry(hooks, "Stop", {
             matcher: "",
-            hooks: [
-              {
-                type: "command",
-                command: `cleo session end --quiet # cleo-hook`
-              }
-            ]
+            hooks: [{ type: "command", command: `cleo session end --quiet # cleo-hook` }]
           });
-          if (!hooks.PostToolUse) hooks.PostToolUse = [];
-          hooks.PostToolUse.push({
+          appendHookEntry(hooks, "PostToolUse", {
             matcher: "Write|Edit",
             hooks: [
               {
@@ -43553,48 +43782,54 @@ var init_hooks = __esm({
               }
             ]
           });
-          settings.hooks = hooks;
-          mkdirSync(join5(home, ".claude"), { recursive: true });
-          writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-        } catch {
-        }
+          return true;
+        });
       }
       /**
        * Unregister native hooks.
        *
-       * Removes CLEO hook entries from `~/.claude/settings.json` by filtering out
-       * entries containing the `# cleo-hook` marker.
+       * Removes CLEO hook entries from Claude Code's `settings.json` by filtering
+       * out entries containing the `# cleo-hook` marker. Same locking, atomicity
+       * and parse-error rules as {@link registerNativeHooks}.
        *
        * @task T164 @task T555
        */
       async unregisterNativeHooks() {
         this.registered = false;
         this.projectDir = null;
+        if (!existsSync4(claudeSettingsPath())) return;
+        await this.updateSettings((settings) => {
+          if (settings.hooks === void 0) return false;
+          return removeCleoHookEntries(hookMap(settings));
+        });
+      }
+      /** The last settings.json failure, or `null` when the last update succeeded. */
+      settingsError = null;
+      /**
+       * Why the last settings.json update did not happen, or `null`.
+       *
+       * @remarks
+       * Hook registration stays non-fatal for adapter initialisation, so a
+       * refused write (malformed settings.json, lock timeout) is surfaced here and
+       * on stderr instead of being swallowed (T12385).
+       *
+       * @returns The failure message, or `null`
+       */
+      getSettingsError() {
+        return this.settingsError;
+      }
+      /** Apply `mutate` to settings.json via CAAMP's locked, atomic JSON writer. */
+      async updateSettings(mutate) {
+        const settingsPath = claudeSettingsPath();
         try {
-          const home = homedir5();
-          const settingsPath = join5(home, ".claude", "settings.json");
-          if (!existsSync4(settingsPath)) return;
-          const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
-          const hooks = settings.hooks;
-          if (!hooks) return;
-          let changed = false;
-          for (const [event, entries] of Object.entries(hooks)) {
-            if (!Array.isArray(entries)) continue;
-            const filtered = entries.filter(
-              (e) => !(typeof e === "object" && e !== null && Array.isArray(e.hooks) && e.hooks.some(
-                (h) => typeof h.command === "string" && h.command.includes("# cleo-hook")
-              ))
-            );
-            if (filtered.length !== entries.length) {
-              hooks[event] = filtered;
-              changed = true;
-            }
-          }
-          if (changed) {
-            settings.hooks = hooks;
-            writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-          }
-        } catch {
+          await updateJsonConfigFile(settingsPath, mutate);
+          this.settingsError = null;
+        } catch (err) {
+          this.settingsError = err instanceof Error ? err.message : String(err);
+          process.stderr.write(
+            `[cleo:claude-code] hooks not written to ${settingsPath}: ${this.settingsError}
+`
+          );
         }
       }
       /**
@@ -43773,7 +44008,7 @@ var init_hooks = __esm({
 });
 
 // packages/adapters/src/providers/shared/hook-template-installer.ts
-import { copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, statSync } from "node:fs";
+import { copyFileSync, existsSync as existsSync5, mkdirSync, statSync } from "node:fs";
 import { dirname as dirname2, join as join6 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveProviderCandidates() {
@@ -43807,7 +44042,7 @@ function copyTemplate(src, dest, force) {
       return { wrote: false };
     }
   }
-  mkdirSync2(dirname2(dest), { recursive: true });
+  mkdirSync(dirname2(dest), { recursive: true });
   copyFileSync(src, dest);
   return { wrote: true };
 }
@@ -43819,7 +44054,7 @@ function installProviderHookTemplates(options) {
     installedFiles: [],
     skipped: []
   };
-  mkdirSync2(targetDir, { recursive: true });
+  mkdirSync(targetDir, { recursive: true });
   const coreDest = join6(targetDir, SHARED_CORE_FILE);
   const coreOutcome = copyTemplate(sharedCoreSource(), coreDest, force);
   if (coreOutcome.wrote) result.installedFiles.push(coreDest);
@@ -43852,20 +44087,13 @@ var init_hook_template_installer = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/install.ts
-import {
-  copyFileSync as copyFileSync2,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync3,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync5,
-  writeFileSync as writeFileSync3
-} from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { copyFileSync as copyFileSync2, existsSync as existsSync6, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
 import { dirname as dirname3, join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { ensureProviderInstructionFile } from "@cleocode/caamp";
+import { ensureProviderInstructionFile, updateJsonConfigFile as updateJsonConfigFile2 } from "@cleocode/caamp";
 function getClaudeConfigDir() {
-  return process.env["CLAUDE_HOME"] ?? join7(homedir6(), ".claude");
+  return process.env["CLAUDE_HOME"] ?? join7(homedir4(), ".claude");
 }
 function getAdapterCommandsDir() {
   const thisDir = dirname3(fileURLToPath2(import.meta.url));
@@ -43876,6 +44104,7 @@ var init_install = __esm({
   "packages/adapters/src/providers/claude-code/install.ts"() {
     "use strict";
     init_hook_template_installer();
+    init_paths();
     ClaudeCodeInstallProvider = class {
       /**
        * Install CLEO into a Claude Code project.
@@ -43897,16 +44126,28 @@ var init_install = __esm({
         if (commandsInstalled.length > 0) {
           details.commands = commandsInstalled;
         }
-        const pluginResult = this.registerPlugin();
-        if (pluginResult) {
-          details.plugin = pluginResult;
+        const settingsErrors = [];
+        try {
+          const pluginResult = await this.registerPlugin();
+          if (pluginResult) {
+            details.plugin = pluginResult;
+          }
+        } catch (err) {
+          settingsErrors.push(err instanceof Error ? err.message : String(err));
         }
-        const hookResult = this.installHookTemplates();
-        if (hookResult) {
-          details.hookTemplates = hookResult;
+        try {
+          const hookResult = await this.installHookTemplates();
+          if (hookResult) {
+            details.hookTemplates = hookResult;
+          }
+        } catch (err) {
+          settingsErrors.push(err instanceof Error ? err.message : String(err));
+        }
+        if (settingsErrors.length > 0) {
+          details.settingsErrors = settingsErrors;
         }
         return {
-          success: true,
+          success: settingsErrors.length === 0,
           installedAt,
           instructionFileUpdated,
           details
@@ -43925,10 +44166,10 @@ var init_install = __esm({
        * Checks for plugin enabled in ~/.claude/settings.json.
        */
       async isInstalled() {
-        const settingsPath = join7(getClaudeConfigDir(), "settings.json");
+        const settingsPath = claudeSettingsPath();
         if (existsSync6(settingsPath)) {
           try {
-            const settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
+            const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
             const plugins = settings.enabledPlugins;
             if (plugins && plugins["cleo@cleocode"] === true) {
               return true;
@@ -43964,7 +44205,7 @@ var init_install = __esm({
           return [];
         }
         const targetDir = join7(projectDir, ".claude", "commands");
-        mkdirSync3(targetDir, { recursive: true });
+        mkdirSync2(targetDir, { recursive: true });
         const installed = [];
         const files = readdirSync2(adapterCommandsDir).filter((f) => f.endsWith(".md"));
         for (const file2 of files) {
@@ -43980,29 +44221,24 @@ var init_install = __esm({
        *
        * @returns Description of what was registered, or null if no change needed
        */
-      registerPlugin() {
-        const claudeDir = getClaudeConfigDir();
-        const settingsPath = join7(claudeDir, "settings.json");
-        let settings = {};
-        if (existsSync6(settingsPath)) {
-          try {
-            settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
-          } catch {
-          }
-        }
-        const enabledPlugins = settings.enabledPlugins ?? {};
+      async registerPlugin() {
         const pluginKey = "cleo@cleocode";
-        if (enabledPlugins[pluginKey] === true) {
-          return null;
-        }
-        if (enabledPlugins["claude-mem@thedotmack"] === true) {
-          enabledPlugins["claude-mem@thedotmack"] = false;
-        }
-        enabledPlugins[pluginKey] = true;
-        settings.enabledPlugins = enabledPlugins;
-        mkdirSync3(claudeDir, { recursive: true });
-        writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-        return `Enabled ${pluginKey} in ~/.claude/settings.json`;
+        const wrote = await updateJsonConfigFile2(claudeSettingsPath(), (settings) => {
+          const enabledPlugins = settings.enabledPlugins ?? {};
+          if (!isPlainObject2(enabledPlugins)) {
+            throw new Error('settings.json "enabledPlugins" is not an object; not modifying it');
+          }
+          if (enabledPlugins[pluginKey] === true) {
+            return false;
+          }
+          if (enabledPlugins["claude-mem@thedotmack"] === true) {
+            enabledPlugins["claude-mem@thedotmack"] = false;
+          }
+          enabledPlugins[pluginKey] = true;
+          settings.enabledPlugins = enabledPlugins;
+          return true;
+        });
+        return wrote ? `Enabled ${pluginKey} in ~/.claude/settings.json` : null;
       }
       /**
        * Install the CLEO PreCompact hook templates for Claude Code (T1013).
@@ -44024,7 +44260,7 @@ var init_install = __esm({
        *
        * @task T1013
        */
-      installHookTemplates() {
+      async installHookTemplates() {
         const claudeDir = getClaudeConfigDir();
         const hooksDir = join7(claudeDir, "hooks");
         let templates;
@@ -44036,7 +44272,7 @@ var init_install = __esm({
         } catch {
           return null;
         }
-        const settingsEntryAdded = this.registerPreCompactHook(
+        const settingsEntryAdded = await this.registerPreCompactHook(
           join7(hooksDir, "precompact-safestop.sh")
         );
         if (templates.installedFiles.length === 0 && !settingsEntryAdded) {
@@ -44058,41 +44294,24 @@ var init_install = __esm({
        *
        * @task T1013
        */
-      registerPreCompactHook(shimPath) {
-        const claudeDir = getClaudeConfigDir();
-        const settingsPath = join7(claudeDir, "settings.json");
-        let settings = {};
-        if (existsSync6(settingsPath)) {
-          try {
-            settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
-          } catch {
+      async registerPreCompactHook(shimPath) {
+        return updateJsonConfigFile2(claudeSettingsPath(), (settings) => {
+          const hooks = hookMap(settings);
+          if (hasCleoHook(hooks.PreCompact, "precompact-safestop.sh")) {
+            return false;
           }
-        }
-        const hooks = settings.hooks ?? {};
-        const preCompactEntries = hooks.PreCompact ?? [];
-        const alreadyWired = preCompactEntries.some(
-          (entry) => typeof entry === "object" && entry !== null && Array.isArray(entry.hooks) && entry.hooks.some(
-            (h) => typeof h.command === "string" && h.command.includes("# cleo-hook") && h.command.includes("precompact-safestop.sh")
-          )
-        );
-        if (alreadyWired) {
-          return false;
-        }
-        preCompactEntries.push({
-          matcher: "",
-          hooks: [
-            {
-              type: "command",
-              command: `"${shimPath}" # cleo-hook`,
-              timeout: 30
-            }
-          ]
+          appendHookEntry(hooks, "PreCompact", {
+            matcher: "",
+            hooks: [
+              {
+                type: "command",
+                command: `"${shimPath}" # cleo-hook`,
+                timeout: 30
+              }
+            ]
+          });
+          return true;
         });
-        hooks.PreCompact = preCompactEntries;
-        settings.hooks = hooks;
-        mkdirSync3(claudeDir, { recursive: true });
-        writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-        return true;
       }
     };
   }
@@ -44100,7 +44319,8 @@ var init_install = __esm({
 
 // packages/adapters/src/providers/shared/agent-spawn-wrapper.ts
 import { spawnSync } from "node:child_process";
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { resolveSpawnInvocation } from "@cleocode/paths";
 function hasSystemdRun() {
   if (_systemdRunAvailable !== void 0) return _systemdRunAvailable;
   if (process.platform !== "linux") {
@@ -44114,7 +44334,7 @@ function hasSystemdRun() {
 function readMemTotalBytes() {
   if (process.platform !== "linux") return 32 * 1024 * 1024 * 1024;
   try {
-    const raw = readFileSync6("/proc/meminfo", "utf8");
+    const raw = readFileSync5("/proc/meminfo", "utf8");
     const m = raw.match(/^MemTotal:\s+(\d+)\s+kB/m);
     if (m?.[1]) return parseInt(m[1], 10) * 1024;
   } catch {
@@ -44123,12 +44343,21 @@ function readMemTotalBytes() {
 }
 function buildAgentSpawnArgs(command, args, scopeId) {
   if (!hasSystemdRun()) {
-    if (!_demotionLogged) {
+    if (!_demotionLogged && process.platform === "linux" && process.env["CLEO_DEBUG"]) {
       _demotionLogged = true;
       process.stderr.write(
         "[cleo:agent-spawn-wrapper] systemd-run unavailable \u2014 falling back to plain pgid (detached) spawn; no cgroup containment\n"
       );
     }
+    if (process.platform === "win32") {
+      const inv = resolveSpawnInvocation(command, args);
+      return {
+        command: inv.file,
+        args: inv.args,
+        ...inv.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {},
+        ownership: { mode: "pgid" }
+      };
+    }
     return {
       command: "sh",
       args: ["-c", 'ulimit -c 0; exec "$@"', "sh", command, ...args],
@@ -44186,6 +44415,25 @@ var init_agent_spawn_wrapper = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/prompt-file.ts
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname as dirname4, join as join8 } from "node:path";
+async function writeSpawnPromptFile(prefix, prompt) {
+  const dir = await mkdtemp(join8(tmpdir(), `cleo-${prefix}-`));
+  const file2 = join8(dir, "prompt.txt");
+  await writeFile(file2, prompt, "utf-8");
+  return file2;
+}
+async function removeSpawnPromptFile(file2) {
+  await rm(dirname4(file2), { recursive: true, force: true }).catch(() => void 0);
+}
+var init_prompt_file = __esm({
+  "packages/adapters/src/providers/shared/prompt-file.ts"() {
+    "use strict";
+  }
+});
+
 // packages/adapters/src/providers/claude-code/suite-reaper.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 async function reapAgentSuite(ownership) {
@@ -44281,32 +44529,26 @@ var init_suite_reaper = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/spawn.ts
-import { exec, spawn as nodeSpawn } from "node:child_process";
-import { unlink, writeFile } from "node:fs/promises";
-import { promisify as promisify2 } from "node:util";
-var execAsync, ClaudeCodeSpawnProvider;
+import { spawn as nodeSpawn } from "node:child_process";
+import { findOnPath } from "@cleocode/paths";
+var ClaudeCodeSpawnProvider;
 var init_spawn2 = __esm({
   "packages/adapters/src/providers/claude-code/spawn.ts"() {
     "use strict";
     init_src();
     init_agent_spawn_wrapper();
+    init_prompt_file();
     init_suite_reaper();
-    execAsync = promisify2(exec);
     ClaudeCodeSpawnProvider = class {
       /** Map of instance IDs to tracked process info. */
       processMap = /* @__PURE__ */ new Map();
       /**
        * Check if the Claude CLI is available in PATH.
        *
-       * @returns true if `claude` is found via `which`
+       * @returns true if `claude` is found on PATH (PATHEXT-aware on Windows)
        */
       async canSpawn() {
-        try {
-          await execAsync("which claude");
-          return true;
-        } catch {
-          return false;
-        }
+        return findOnPath("claude") !== null;
       }
       /**
        * Spawn a subagent via Claude CLI.
@@ -44336,8 +44578,7 @@ var init_spawn2 = __esm({
             });
           } catch {
           }
-          tmpFile = `/tmp/claude-spawn-${instanceId}.txt`;
-          await writeFile(tmpFile, enrichedPrompt, "utf-8");
+          tmpFile = await writeSpawnPromptFile("claude-spawn", enrichedPrompt);
           const claudeArgs = [
             "--print",
             "--dangerously-skip-permissions",
@@ -44349,7 +44590,9 @@ var init_spawn2 = __esm({
           const isSystemd = spawnBuild.ownership.mode === "systemd";
           const spawnOpts = {
             detached: !isSystemd,
-            stdio: ["ignore", "pipe", "pipe"]
+            stdio: ["ignore", "pipe", "pipe"],
+            // win32 `.cmd` shim routed through cmd.exe: keep its quoting (T12618).
+            ...spawnBuild.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
           };
           if (context.workingDirectory) {
             spawnOpts.cwd = context.workingDirectory;
@@ -44376,10 +44619,7 @@ var init_spawn2 = __esm({
           const capturedTmpFile = tmpFile;
           child.on("exit", async () => {
             this.processMap.delete(instanceId);
-            try {
-              await unlink(capturedTmpFile);
-            } catch {
-            }
+            await removeSpawnPromptFile(capturedTmpFile);
           });
           return {
             instanceId,
@@ -44394,10 +44634,7 @@ var init_spawn2 = __esm({
         } catch (error48) {
           console.error(`[ClaudeCodeSpawnProvider] Failed to spawn: ${getErrorMessage(error48)}`);
           if (tmpFile) {
-            try {
-              await unlink(tmpFile);
-            } catch {
-            }
+            await removeSpawnPromptFile(tmpFile);
           }
           return {
             instanceId,
@@ -44482,7 +44719,7 @@ var init_spawn2 = __esm({
 
 // packages/adapters/src/providers/claude-code/task-sync.ts
 import { readFile as readFile2, stat } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function parseTaskId(content) {
   const match = content.match(/^\[T(\d+)\]/);
   return match ? `T${match[1]}` : null;
@@ -44503,7 +44740,7 @@ function mapStatus(twStatus) {
   }
 }
 function getTodoWriteFilePath(projectDir) {
-  return join8(projectDir, ".cleo", "sync", "todowrite-state.json");
+  return join9(projectDir, ".cleo", "sync", "todowrite-state.json");
 }
 var ClaudeCodeTaskSyncProvider;
 var init_task_sync = __esm({
@@ -44574,12 +44811,11 @@ var init_transport = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/adapter.ts
-import { exec as exec2 } from "node:child_process";
 import { existsSync as existsSync7 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join9 } from "node:path";
-import { promisify as promisify3 } from "node:util";
-var execAsync2, ClaudeCodeAdapter;
+import { homedir as homedir5 } from "node:os";
+import { join as join10 } from "node:path";
+import { findOnPath as findOnPath2 } from "@cleocode/paths";
+var ClaudeCodeAdapter;
 var init_adapter = __esm({
   "packages/adapters/src/providers/claude-code/adapter.ts"() {
     "use strict";
@@ -44591,7 +44827,6 @@ var init_adapter = __esm({
     init_spawn2();
     init_task_sync();
     init_transport();
-    execAsync2 = promisify3(exec2);
     ClaudeCodeAdapter = class {
       /** Unique provider identifier. */
       id = "claude-code";
@@ -44727,14 +44962,11 @@ var init_adapter = __esm({
           };
         }
         let cliAvailable = false;
-        try {
-          const { stdout } = await execAsync2("which claude");
-          cliAvailable = stdout.trim().length > 0;
-          details.cliPath = stdout.trim();
-        } catch {
-          details.cliAvailable = false;
-        }
-        const claudeConfigDir = join9(homedir7(), ".claude");
+        const resolvedCli = findOnPath2("claude");
+        cliAvailable = resolvedCli !== null;
+        if (resolvedCli) details.cliPath = resolvedCli;
+        else details.cliAvailable = false;
+        const claudeConfigDir = join10(homedir5(), ".claude");
         const configExists = existsSync7(claudeConfigDir);
         details.configDirExists = configExists;
         const entrypointSet = process.env.CLAUDE_CODE_ENTRYPOINT !== void 0;
@@ -44764,17 +44996,17 @@ var init_adapter = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/statusline.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join11 } from "node:path";
 function getClaudeSettingsPath() {
-  return process.env["CLAUDE_SETTINGS"] ?? join10(process.env["CLAUDE_HOME"] ?? join10(homedir8(), ".claude"), "settings.json");
+  return process.env["CLAUDE_SETTINGS"] ?? join11(process.env["CLAUDE_HOME"] ?? join11(homedir6(), ".claude"), "settings.json");
 }
 function checkStatuslineIntegration() {
   const settingsPath = getClaudeSettingsPath();
   if (!existsSync8(settingsPath)) return "no_settings";
   try {
-    const settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync6(settingsPath, "utf-8"));
     const statusLine = settings.statusLine;
     if (!statusLine?.type) return "not_configured";
     if (statusLine.type !== "command") return "custom_no_cleo";
@@ -44782,10 +45014,10 @@ function checkStatuslineIntegration() {
     if (cmd.includes("context-monitor.sh") || cmd.includes("cleo-statusline") || cmd.includes(".context-state.json") || cmd.includes("context-states")) {
       return "configured";
     }
-    const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir8()) : cmd;
+    const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir6()) : cmd;
     if (existsSync8(scriptPath)) {
       try {
-        const content = readFileSync7(scriptPath, "utf-8");
+        const content = readFileSync6(scriptPath, "utf-8");
         if (content.includes("context-state.json")) return "configured";
       } catch {
       }
@@ -44799,7 +45031,7 @@ function getStatuslineConfig(cleoHome) {
   return {
     statusLine: {
       type: "command",
-      command: join10(cleoHome, "lib", "session", "context-monitor.sh")
+      command: join11(cleoHome, "lib", "session", "context-monitor.sh")
     }
   };
 }
@@ -44864,6 +45096,23 @@ var init_paths2 = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/cli-spawn.ts
+import { spawn } from "node:child_process";
+import { resolveSpawnInvocation as resolveSpawnInvocation2 } from "@cleocode/paths";
+function spawnCli(command, args, options) {
+  const inv = resolveSpawnInvocation2(command, args);
+  return spawn(
+    inv.file,
+    inv.args,
+    inv.windowsVerbatimArguments ? { ...options, windowsVerbatimArguments: true } : options
+  );
+}
+var init_cli_spawn = __esm({
+  "packages/adapters/src/providers/shared/cli-spawn.ts"() {
+    "use strict";
+  }
+});
+
 // packages/adapters/src/providers/cursor/hooks.ts
 var PROVIDER_ID2, CURSOR_EVENT_MAP, CursorHookProvider;
 var init_hooks2 = __esm({
@@ -45018,15 +45267,30 @@ var init_hooks2 = __esm({
 });
 
 // packages/adapters/src/providers/cursor/install.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join16 } from "node:path";
-import { ensureProviderInstructionFile as ensureProviderInstructionFile3 } from "@cleocode/caamp";
-var CursorInstallProvider;
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "node:fs";
+import { join as join17 } from "node:path";
+import {
+  ensureProviderInstructionFile as ensureProviderInstructionFile3,
+  ensureProviderRuleFile,
+  updateJsonConfigFile as updateJsonConfigFile3
+} from "@cleocode/caamp";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var CLEO_MDC_FRONTMATTER, CursorInstallProvider;
 var init_install2 = __esm({
   "packages/adapters/src/providers/cursor/install.ts"() {
     "use strict";
     init_hook_template_installer();
     init_paths2();
+    CLEO_MDC_FRONTMATTER = [
+      "---",
+      "description: CLEO task management protocol references",
+      'globs: "**/*"',
+      "alwaysApply: true",
+      "---",
+      ""
+    ].join("\n");
     CursorInstallProvider = class {
       /**
        * Install CLEO into a Cursor project.
@@ -45040,17 +45304,23 @@ var init_install2 = __esm({
         let instructionFileUpdated = false;
         const details = {};
         const instructionResult = await ensureProviderInstructionFile3("cursor", projectDir, {});
-        const cursorFilesUpdated = this.updateInstructionFiles(projectDir);
+        const cursorFilesUpdated = await this.updateInstructionFiles(projectDir);
         instructionFileUpdated = instructionResult.action !== "intact" || cursorFilesUpdated;
         if (instructionFileUpdated) {
           details.instructionFiles = this.getUpdatedFileList(projectDir);
         }
-        const hookResult = this.installHookTemplates(projectDir);
-        if (hookResult) {
-          details.hookTemplates = hookResult;
+        let hooksError = null;
+        try {
+          const hookResult = await this.installHookTemplates(projectDir);
+          if (hookResult) {
+            details.hookTemplates = hookResult;
+          }
+        } catch (err) {
+          hooksError = err instanceof Error ? err.message : String(err);
+          details.hooksError = hooksError;
         }
         return {
-          success: true,
+          success: hooksError === null,
           installedAt,
           instructionFileUpdated,
           details
@@ -45069,14 +45339,14 @@ var init_install2 = __esm({
        * Checks for .cursor/rules/cleo.mdc or .cursorrules with CLEO references.
        */
       async isInstalled() {
-        const mdcPath = join16(process.cwd(), ".cursor", "rules", "cleo.mdc");
+        const mdcPath = join17(process.cwd(), ".cursor", "rules", "cleo.mdc");
         if (existsSync11(mdcPath)) {
           return true;
         }
-        const rulesPath = join16(process.cwd(), ".cursorrules");
+        const rulesPath = join17(process.cwd(), ".cursorrules");
         if (existsSync11(rulesPath)) {
           try {
-            const content = readFileSync8(rulesPath, "utf-8");
+            const content = readFileSync7(rulesPath, "utf-8");
             const injectionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
             if (content.includes(injectionRef) || content.includes("@.cleo/memory-bridge.md")) {
               return true;
@@ -45096,98 +45366,46 @@ var init_install2 = __esm({
        */
       async ensureInstructionReferences(projectDir) {
         await ensureProviderInstructionFile3("cursor", projectDir, {});
-        this.updateInstructionFiles(projectDir);
+        await this.updateInstructionFiles(projectDir);
       }
       /**
-       * Update instruction files with CLEO @-references.
-       *
-       * Handles both legacy (.cursorrules) and modern (.cursor/rules/cleo.mdc) formats.
+       * Update Cursor's auxiliary rule files through the CAAMP writer.
        *
-       * @returns true if any file was created or modified
-       */
-      updateInstructionFiles(projectDir) {
-        let updated = false;
-        if (this.updateLegacyRules(projectDir)) {
-          updated = true;
-        }
-        if (this.updateModernRules(projectDir)) {
-          updated = true;
-        }
-        return updated;
-      }
-      /**
-       * Update legacy .cursorrules file with @-references.
+       * @remarks
+       * ADR-064 / T12385: both files are written by CAAMP's
+       * `ensureProviderRuleFile` — locked, atomic, with references taken from the
+       * provider registry — instead of raw `writeFileSync` with a local copy of
+       * the references.
        *
-       * References are sourced from the CAAMP provider registry (T1919) rather than
-       * a local constant, keeping this adapter in sync with the single source of truth.
-       * Only modifies the file if it already exists (does not create it).
+       * - Legacy `.cursorrules` is only updated when it already exists; CLEO's
+       *   references live in a CAAMP block and user text is preserved.
+       * - Modern `.cursor/rules/cleo.mdc` is CLEO-owned: MDC frontmatter followed
+       *   by the CAAMP block.
        *
-       * @returns true if the file was modified
-       */
-      updateLegacyRules(projectDir) {
-        const rulesPath = join16(projectDir, ".cursorrules");
-        if (!existsSync11(rulesPath)) {
-          return false;
-        }
-        let content = readFileSync8(rulesPath, "utf-8");
-        const cursorRefs = [
-          `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`,
-          "@.cleo/memory-bridge.md"
-        ];
-        const missingRefs = cursorRefs.filter((ref) => !content.includes(ref));
-        if (missingRefs.length === 0) {
-          return false;
-        }
-        const separator = content.endsWith("\n") ? "" : "\n";
-        content = content + separator + missingRefs.join("\n") + "\n";
-        writeFileSync4(rulesPath, content, "utf-8");
-        return true;
-      }
-      /**
-       * Create or update .cursor/rules/cleo.mdc with CLEO references.
-       *
-       * MDC (Markdown Component) format is Cursor's modern rule file format.
-       * Each .mdc file in .cursor/rules/ is loaded as a rule set.
-       * References are sourced from the CAAMP provider registry (T1919).
-       *
-       * @returns true if the file was created or modified
+       * @returns true if any file was created or modified
        */
-      updateModernRules(projectDir) {
-        const rulesDir = join16(projectDir, ".cursor", "rules");
-        const mdcPath = join16(rulesDir, "cleo.mdc");
-        const cursorRefs = [
-          `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`,
-          "@.cleo/memory-bridge.md"
+      async updateInstructionFiles(projectDir) {
+        const results = [
+          await ensureProviderRuleFile("cursor", projectDir, {
+            relativePath: ".cursorrules",
+            onlyIfExists: true
+          }),
+          await ensureProviderRuleFile("cursor", projectDir, {
+            relativePath: join17(".cursor", "rules", "cleo.mdc"),
+            preamble: CLEO_MDC_FRONTMATTER
+          })
         ];
-        const expectedContent = [
-          "---",
-          "description: CLEO task management protocol references",
-          'globs: "**/*"',
-          "alwaysApply: true",
-          "---",
-          "",
-          ...cursorRefs,
-          ""
-        ].join("\n");
-        if (existsSync11(mdcPath)) {
-          const existing = readFileSync8(mdcPath, "utf-8");
-          if (existing === expectedContent) {
-            return false;
-          }
-        }
-        mkdirSync4(rulesDir, { recursive: true });
-        writeFileSync4(mdcPath, expectedContent, "utf-8");
-        return true;
+        return results.some((r) => r !== null && r.action !== "intact");
       }
       /**
        * Get list of instruction files that were updated.
        */
       getUpdatedFileList(projectDir) {
         const files = [];
-        if (existsSync11(join16(projectDir, ".cursorrules"))) {
-          files.push(join16(projectDir, ".cursorrules"));
+        if (existsSync11(join17(projectDir, ".cursorrules"))) {
+          files.push(join17(projectDir, ".cursorrules"));
         }
-        files.push(join16(projectDir, ".cursor", "rules", "cleo.mdc"));
+        files.push(join17(projectDir, ".cursor", "rules", "cleo.mdc"));
         return files;
       }
       /**
@@ -45208,8 +45426,8 @@ var init_install2 = __esm({
        *
        * @task T1013
        */
-      installHookTemplates(projectDir) {
-        const hooksDir = join16(projectDir, ".cursor", "hooks");
+      async installHookTemplates(projectDir) {
+        const hooksDir = join17(projectDir, ".cursor", "hooks");
         let templates;
         try {
           templates = installProviderHookTemplates({
@@ -45219,9 +45437,9 @@ var init_install2 = __esm({
         } catch {
           return null;
         }
-        const hooksJsonEntryAdded = this.registerPreCompactHook(
+        const hooksJsonEntryAdded = await this.registerPreCompactHook(
           projectDir,
-          join16(hooksDir, "precompact.sh")
+          join17(hooksDir, "precompact.sh")
         );
         if (templates.installedFiles.length === 0 && !hooksJsonEntryAdded) {
           return null;
@@ -45241,33 +45459,30 @@ var init_install2 = __esm({
        *
        * @task T1013
        */
-      registerPreCompactHook(projectDir, shimPath) {
-        const hooksJsonPath = join16(projectDir, ".cursor", "hooks.json");
-        let config2 = {};
-        if (existsSync11(hooksJsonPath)) {
-          try {
-            config2 = JSON.parse(readFileSync8(hooksJsonPath, "utf-8"));
-          } catch {
+      async registerPreCompactHook(projectDir, shimPath) {
+        const hooksJsonPath = join17(projectDir, ".cursor", "hooks.json");
+        return updateJsonConfigFile3(hooksJsonPath, (config2) => {
+          const hooks = config2.hooks ?? {};
+          if (!isRecord(hooks)) {
+            throw new Error('.cursor/hooks.json "hooks" is not an object; not modifying it');
+          }
+          const entries = hooks.preCompact ?? [];
+          if (!Array.isArray(entries)) {
+            throw new Error('.cursor/hooks.json "hooks.preCompact" is not an array; not modifying it');
+          }
+          const alreadyWired = entries.some(
+            (entry) => isRecord(entry) && typeof entry.command === "string" && entry.command.includes("# cleo-hook") && entry.command.includes("precompact.sh")
+          );
+          if (alreadyWired) {
+            return false;
           }
-        }
-        const hooks = config2.hooks ?? {};
-        const entries = hooks.preCompact ?? [];
-        const alreadyWired = entries.some(
-          (entry) => typeof entry === "object" && entry !== null && typeof entry.command === "string" && entry.command.includes("# cleo-hook") && entry.command.includes("precompact.sh")
-        );
-        if (alreadyWired) {
-          return false;
-        }
-        entries.push({
-          type: "command",
-          command: `"${shimPath}" # cleo-hook`,
-          timeout: 30
+          hooks.preCompact = [
+            ...entries,
+            { type: "command", command: `"${shimPath}" # cleo-hook`, timeout: 30 }
+          ];
+          config2.hooks = hooks;
+          return true;
         });
-        hooks.preCompact = entries;
-        config2.hooks = hooks;
-        mkdirSync4(join16(projectDir, ".cursor"), { recursive: true });
-        writeFileSync4(hooksJsonPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
-        return true;
       }
     };
   }
@@ -45275,7 +45490,7 @@ var init_install2 = __esm({
 
 // packages/adapters/src/providers/cursor/adapter.ts
 import { existsSync as existsSync12 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var CursorAdapter;
 var init_adapter2 = __esm({
   "packages/adapters/src/providers/cursor/adapter.ts"() {
@@ -45369,14 +45584,14 @@ var init_adapter2 = __esm({
         }
         let configExists = false;
         if (this.projectDir) {
-          const cursorConfigDir = join17(this.projectDir, ".cursor");
+          const cursorConfigDir = join18(this.projectDir, ".cursor");
           configExists = existsSync12(cursorConfigDir);
           details.configDirExists = configExists;
         }
         const editorEnvSet = process.env.CURSOR_EDITOR !== void 0;
         details.editorEnvSet = editorEnvSet;
         if (this.projectDir) {
-          const legacyRulesExist = existsSync12(join17(this.projectDir, ".cursorrules"));
+          const legacyRulesExist = existsSync12(join18(this.projectDir, ".cursorrules"));
           details.legacyRulesExist = legacyRulesExist;
         }
         const healthy = configExists || editorEnvSet;
@@ -45580,8 +45795,8 @@ var init_hooks3 = __esm({
 });
 
 // packages/adapters/src/providers/opencode/install.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join24 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile6 } from "@cleocode/caamp";
 var OpenCodeInstallProvider;
 var init_install3 = __esm({
@@ -45606,7 +45821,7 @@ var init_install3 = __esm({
         });
         const instructionFileUpdated = instructResult.action !== "intact";
         if (instructionFileUpdated) {
-          details.instructionFile = join23(projectDir, instructResult.instructFile);
+          details.instructionFile = join24(projectDir, instructResult.instructFile);
         }
         const hookResult = this.installHookTemplates(projectDir);
         if (hookResult) {
@@ -45679,8 +45894,8 @@ var init_install3 = __esm({
        * @task T1013
        */
       installHookTemplates(projectDir) {
-        const pluginsDir = join23(projectDir, ".opencode", "plugins");
-        const hooksDir = join23(pluginsDir, "hooks");
+        const pluginsDir = join24(projectDir, ".opencode", "plugins");
+        const hooksDir = join24(pluginsDir, "hooks");
         let templates;
         try {
           templates = installProviderHookTemplates({
@@ -45692,7 +45907,7 @@ var init_install3 = __esm({
         }
         let pluginWritten = false;
         try {
-          pluginWritten = this.writePrecompactPlugin(pluginsDir, join23(hooksDir, "precompact.sh"));
+          pluginWritten = this.writePrecompactPlugin(pluginsDir, join24(hooksDir, "precompact.sh"));
         } catch {
         }
         if (templates.installedFiles.length === 0 && !pluginWritten) {
@@ -45716,7 +45931,7 @@ var init_install3 = __esm({
        * @task T1013
        */
       writePrecompactPlugin(pluginsDir, shimPath) {
-        const pluginPath = join23(pluginsDir, "cleo-precompact.js");
+        const pluginPath = join24(pluginsDir, "cleo-precompact.js");
         const generated = [
           "// CLEO PreCompact plugin for OpenCode (generated by @cleocode/adapters).",
           "// Bridges the canonical CAAMP `PreCompact` event",
@@ -45744,14 +45959,14 @@ var init_install3 = __esm({
         ].join("\n");
         if (existsSync17(pluginPath)) {
           try {
-            if (readFileSync11(pluginPath, "utf-8") === generated) {
+            if (readFileSync10(pluginPath, "utf-8") === generated) {
               return false;
             }
           } catch {
           }
         }
-        mkdirSync5(pluginsDir, { recursive: true });
-        writeFileSync5(pluginPath, generated, "utf-8");
+        mkdirSync3(pluginsDir, { recursive: true });
+        writeFileSync2(pluginPath, generated, "utf-8");
         return true;
       }
     };
@@ -45759,10 +45974,9 @@ var init_install3 = __esm({
 });
 
 // packages/adapters/src/providers/opencode/spawn.ts
-import { exec as exec9, spawn as nodeSpawn4 } from "node:child_process";
 import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join24 } from "node:path";
-import { promisify as promisify10 } from "node:util";
+import { join as join25 } from "node:path";
+import { findOnPath as findOnPath9 } from "@cleocode/paths";
 function buildOpenCodeAgentMarkdown(description, instructions) {
   const normalizedDesc = description.replace(/\s+/g, " ").trim();
   return [
@@ -45777,8 +45991,8 @@ function buildOpenCodeAgentMarkdown(description, instructions) {
   ].join("\n");
 }
 async function ensureSubagentDefinition(workingDirectory, enrichedInstructions) {
-  const agentDir = join24(workingDirectory, ".opencode", "agent");
-  const agentPath = join24(agentDir, `${OPENCODE_SUBAGENT_NAME}.md`);
+  const agentDir = join25(workingDirectory, ".opencode", "agent");
+  const agentPath = join25(agentDir, `${OPENCODE_SUBAGENT_NAME}.md`);
   const description = "CLEO task executor with protocol compliance and CANT context.";
   const instructions = enrichedInstructions ?? [
     "# CLEO Subagent",
@@ -45801,12 +46015,12 @@ async function ensureSubagentDefinition(workingDirectory, enrichedInstructions)
   }
   return OPENCODE_SUBAGENT_NAME;
 }
-var execAsync9, OPENCODE_SUBAGENT_NAME, OPENCODE_FALLBACK_AGENT, OpenCodeSpawnProvider;
+var OPENCODE_SUBAGENT_NAME, OPENCODE_FALLBACK_AGENT, OpenCodeSpawnProvider;
 var init_spawn3 = __esm({
   "packages/adapters/src/providers/opencode/spawn.ts"() {
     "use strict";
+    init_cli_spawn();
     init_paths2();
-    execAsync9 = promisify10(exec9);
     OPENCODE_SUBAGENT_NAME = "cleo-subagent";
     OPENCODE_FALLBACK_AGENT = "general";
     OpenCodeSpawnProvider = class {
@@ -45815,15 +46029,10 @@ var init_spawn3 = __esm({
       /**
        * Check if the OpenCode CLI is available in PATH.
        *
-       * @returns true if `opencode` is found via `which`
+       * @returns true if `opencode` is found on PATH (PATHEXT-aware on Windows)
        */
       async canSpawn() {
-        try {
-          await execAsync9("which opencode");
-          return true;
-        } catch {
-          return false;
-        }
+        return findOnPath9("opencode") !== null;
       }
       /**
        * Spawn a subagent via OpenCode CLI.
@@ -45856,24 +46065,17 @@ var init_spawn3 = __esm({
           } catch {
             agentName = OPENCODE_FALLBACK_AGENT;
           }
-          const child = nodeSpawn4(
+          const child = spawnCli(
             "opencode",
-            [
-              "run",
-              "--format",
-              "json",
-              "--agent",
-              agentName,
-              "--title",
-              `CLEO ${context.taskId}`,
-              context.prompt
-            ],
+            ["run", "--format", "json", "--agent", agentName, "--title", `CLEO ${context.taskId}`],
             {
               cwd: workingDirectory,
               detached: true,
-              stdio: "ignore"
+              stdio: ["pipe", "ignore", "ignore"]
             }
           );
+          child.stdin?.on("error", () => void 0);
+          child.stdin?.end(context.prompt, "utf-8");
           child.unref();
           if (child.pid) {
             this.processMap.set(instanceId, {
@@ -45885,6 +46087,9 @@ var init_spawn3 = __esm({
           child.on("exit", () => {
             this.processMap.delete(instanceId);
           });
+          child.on("error", () => {
+            this.processMap.delete(instanceId);
+          });
           return {
             instanceId,
             taskId: context.taskId,
@@ -45951,18 +46156,16 @@ var init_spawn3 = __esm({
 });
 
 // packages/adapters/src/providers/opencode/adapter.ts
-import { exec as exec10 } from "node:child_process";
 import { existsSync as existsSync18 } from "node:fs";
-import { join as join25 } from "node:path";
-import { promisify as promisify11 } from "node:util";
-var execAsync10, OpenCodeAdapter;
+import { join as join26 } from "node:path";
+import { findOnPath as findOnPath10 } from "@cleocode/paths";
+var OpenCodeAdapter;
 var init_adapter3 = __esm({
   "packages/adapters/src/providers/opencode/adapter.ts"() {
     "use strict";
     init_hooks3();
     init_install3();
     init_spawn3();
-    execAsync10 = promisify11(exec10);
     OpenCodeAdapter = class {
       /** Unique provider identifier. */
       id = "opencode";
@@ -46057,15 +46260,12 @@ var init_adapter3 = __esm({
           };
         }
         let cliAvailable = false;
-        try {
-          const { stdout } = await execAsync10("which opencode");
-          cliAvailable = stdout.trim().length > 0;
-          details.cliPath = stdout.trim();
-        } catch {
-          details.cliAvailable = false;
-        }
+        const resolvedCli = findOnPath10("opencode");
+        cliAvailable = resolvedCli !== null;
+        if (resolvedCli) details.cliPath = resolvedCli;
+        else details.cliAvailable = false;
         if (this.projectDir) {
-          const openCodeConfigDir = join25(this.projectDir, ".opencode");
+          const openCodeConfigDir = join26(this.projectDir, ".opencode");
           const configExists = existsSync18(openCodeConfigDir);
           details.configDirExists = configExists;
         }
@@ -46275,7 +46475,7 @@ var init_hooks4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/install.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile7 } from "@cleocode/caamp";
 function getCleoReferences() {
   return [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"];
@@ -46302,7 +46502,7 @@ var init_install4 = __esm({
         });
         const projectUpdated = projectResult.action !== "intact";
         if (projectUpdated) {
-          details.instructionFile = join26(projectDir, projectResult.instructFile);
+          details.instructionFile = join27(projectDir, projectResult.instructFile);
         }
         let globalUpdated = false;
         try {
@@ -46373,40 +46573,30 @@ var init_install4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/spawn.ts
-import { exec as exec11, spawn as nodeSpawn5 } from "node:child_process";
-import { unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
-import { promisify as promisify12 } from "node:util";
+import { findOnPath as findOnPath11 } from "@cleocode/paths";
 function getPiCliPath() {
   return process.env["PI_CLI_PATH"] ?? "pi";
 }
-var execAsync11, PiSpawnProvider;
+var PiSpawnProvider;
 var init_spawn4 = __esm({
   "packages/adapters/src/providers/pi/spawn.ts"() {
     "use strict";
     init_src();
-    execAsync11 = promisify12(exec11);
+    init_cli_spawn();
+    init_prompt_file();
     PiSpawnProvider = class {
       /** Map of instance IDs to tracked process info. */
       processMap = /* @__PURE__ */ new Map();
       /**
        * Check if the Pi CLI is available.
        *
-       * Checks `PI_CLI_PATH` env var first, then tries `which pi`.
+       * Checks `PI_CLI_PATH` env var first, then searches PATH for `pi`.
        *
        * @returns true if the Pi CLI is accessible
        */
       async canSpawn() {
         const cliPath = getPiCliPath();
-        try {
-          if (cliPath !== "pi") {
-            const { stdout } = await execAsync11(`test -x "${cliPath}" && echo ok`);
-            return stdout.trim() === "ok";
-          }
-          await execAsync11("which pi");
-          return true;
-        } catch {
-          return false;
-        }
+        return findOnPath11(cliPath) !== null;
       }
       /**
        * Spawn a subagent via Pi CLI.
@@ -46422,8 +46612,7 @@ var init_spawn4 = __esm({
         const startTime = (/* @__PURE__ */ new Date()).toISOString();
         let tmpFile;
         try {
-          tmpFile = `/tmp/pi-spawn-${instanceId}.txt`;
-          await writeFile3(tmpFile, context.prompt, "utf-8");
+          tmpFile = await writeSpawnPromptFile("pi-spawn", context.prompt);
           const cliPath = getPiCliPath();
           const args = [tmpFile];
           const spawnOpts = {
@@ -46433,7 +46622,7 @@ var init_spawn4 = __esm({
           if (context.workingDirectory) {
             spawnOpts.cwd = context.workingDirectory;
           }
-          const child = nodeSpawn5(cliPath, args, spawnOpts);
+          const child = spawnCli(cliPath, args, spawnOpts);
           child.unref();
           if (child.pid) {
             this.processMap.set(instanceId, {
@@ -46445,10 +46634,7 @@ var init_spawn4 = __esm({
           const capturedTmpFile = tmpFile;
           child.on("exit", async () => {
             this.processMap.delete(instanceId);
-            try {
-              await unlink2(capturedTmpFile);
-            } catch {
-            }
+            await removeSpawnPromptFile(capturedTmpFile);
           });
           return {
             instanceId,
@@ -46460,10 +46646,7 @@ var init_spawn4 = __esm({
         } catch (error48) {
           console.error(`[PiSpawnProvider] Failed to spawn: ${getErrorMessage(error48)}`);
           if (tmpFile) {
-            try {
-              await unlink2(tmpFile);
-            } catch {
-            }
+            await removeSpawnPromptFile(tmpFile);
           }
           return {
             instanceId,
@@ -46524,32 +46707,30 @@ var init_spawn4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/adapter.ts
-import { exec as exec12 } from "node:child_process";
 import { existsSync as existsSync19 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
-import { join as join27 } from "node:path";
-import { promisify as promisify13 } from "node:util";
+import { homedir as homedir12 } from "node:os";
+import { join as join28 } from "node:path";
+import { findOnPath as findOnPath12 } from "@cleocode/paths";
 function getPiAgentDir() {
   const env = process.env["PI_CODING_AGENT_DIR"];
   if (env !== void 0 && env.length > 0) {
-    if (env === "~") return homedir14();
-    if (env.startsWith("~/")) return join27(homedir14(), env.slice(2));
+    if (env === "~") return homedir12();
+    if (env.startsWith("~/")) return join28(homedir12(), env.slice(2));
     return env;
   }
   const piHome = process.env["PI_HOME"];
   if (piHome !== void 0 && piHome.length > 0) {
-    return join27(piHome, "agent");
+    return join28(piHome, "agent");
   }
-  return join27(homedir14(), ".pi", "agent");
+  return join28(homedir12(), ".pi", "agent");
 }
-var execAsync12, PiAdapter;
+var PiAdapter;
 var init_adapter4 = __esm({
   "packages/adapters/src/providers/pi/adapter.ts"() {
     "use strict";
     init_hooks4();
     init_install4();
     init_spawn4();
-    execAsync12 = promisify13(exec12);
     PiAdapter = class {
       /** Unique provider identifier. */
       id = "pi";
@@ -46628,7 +46809,7 @@ var init_adapter4 = __esm({
        *
        * Checks:
        * 1. Adapter has been initialized
-       * 2. Pi CLI is available (via PI_CLI_PATH or `which pi`)
+       * 2. Pi CLI is available (via PI_CLI_PATH or a PATH search for `pi`)
        * 3. Pi global state root (~/.pi/agent/ or PI_CODING_AGENT_DIR) exists
        *
        * @returns Health status with details about each check
@@ -46644,25 +46825,16 @@ var init_adapter4 = __esm({
         }
         let cliAvailable = false;
         const cliPath = process.env["PI_CLI_PATH"] ?? "pi";
-        try {
-          if (cliPath !== "pi") {
-            const { stdout } = await execAsync12(`test -x "${cliPath}" && echo ok`);
-            cliAvailable = stdout.trim() === "ok";
-            details.cliPath = cliPath;
-          } else {
-            const { stdout } = await execAsync12("which pi");
-            cliAvailable = stdout.trim().length > 0;
-            details.cliPath = stdout.trim();
-          }
-        } catch {
-          details.cliAvailable = false;
-        }
+        const resolvedCli = findOnPath12(cliPath);
+        cliAvailable = resolvedCli !== null;
+        if (resolvedCli) details.cliPath = cliPath === "pi" ? resolvedCli : cliPath;
+        else details.cliAvailable = false;
         const agentDir = getPiAgentDir();
         const agentDirExists = existsSync19(agentDir);
         details.agentDirExists = agentDirExists;
         details.agentDir = agentDir;
         if (this.projectDir) {
-          const projectPiDir = join27(this.projectDir, ".pi");
+          const projectPiDir = join28(this.projectDir, ".pi");
           details.projectPiDirExists = existsSync19(projectPiDir);
         }
         details.piCodingAgentDirSet = process.env["PI_CODING_AGENT_DIR"] !== void 0;
@@ -46837,14 +47009,14 @@ var ClaudeSDKAdapter = class {
 
 // packages/adapters/src/providers/claude-sdk/mcp-registry.ts
 import { existsSync as existsSync9 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var CLEO_MCP_CANDIDATES = [
   { name: "brain", binary: "cleo-mcp-brain" },
   { name: "nexus", binary: "cleo-mcp-nexus" },
   { name: "tasks", binary: "cleo-mcp-tasks" }
 ];
 function findInNodeModules(binary, workingDir) {
-  const binPath = join11(workingDir, "node_modules", ".bin", binary);
+  const binPath = join12(workingDir, "node_modules", ".bin", binary);
   if (existsSync9(binPath)) {
     return binPath;
   }
@@ -46874,19 +47046,18 @@ function createAdapter2() {
 }
 
 // packages/adapters/src/providers/codex/adapter.ts
-import { exec as exec3 } from "node:child_process";
 import { existsSync as existsSync10 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join15 } from "node:path";
-import { promisify as promisify4 } from "node:util";
+import { homedir as homedir8 } from "node:os";
+import { join as join16 } from "node:path";
+import { findOnPath as findOnPath3 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/codex/hooks.ts
-import { homedir as homedir9 } from "node:os";
-import { join as join13 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join14 } from "node:path";
 
 // packages/adapters/src/providers/shared/transcript-reader.ts
 import { readdir as readdir2, readFile as readFile3 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function parseTranscriptLines(raw) {
   const turns = [];
   const lines = raw.split("\n").filter((l) => l.trim());
@@ -46911,7 +47082,7 @@ async function readLatestTranscript(providerDir) {
       if (!entry.isFile()) continue;
       const name15 = entry.name;
       if (name15.endsWith(".json") || name15.endsWith(".jsonl")) {
-        allFiles.push(join12(providerDir, name15));
+        allFiles.push(join13(providerDir, name15));
       }
     }
   } catch {
@@ -47001,13 +47172,13 @@ var CodexHookProvider = class {
    * @task T162 @epic T134
    */
   async getTranscript(_sessionId, _projectDir) {
-    return readLatestTranscript(join13(homedir9(), ".codex"));
+    return readLatestTranscript(join14(homedir7(), ".codex"));
   }
 };
 
 // packages/adapters/src/providers/codex/install.ts
 init_paths2();
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile2 } from "@cleocode/caamp";
 var CodexInstallProvider = class {
   /**
@@ -47027,7 +47198,7 @@ var CodexInstallProvider = class {
     });
     const instructionFileUpdated = result.action !== "intact";
     if (instructionFileUpdated) {
-      details.instructionFile = join14(projectDir, result.instructFile);
+      details.instructionFile = join15(projectDir, result.instructFile);
     }
     return {
       success: true,
@@ -47081,7 +47252,6 @@ var CodexInstallProvider = class {
 };
 
 // packages/adapters/src/providers/codex/adapter.ts
-var execAsync3 = promisify4(exec3);
 var CodexAdapter = class {
   /** Unique provider identifier. */
   id = "codex";
@@ -47158,14 +47328,11 @@ var CodexAdapter = class {
       };
     }
     let cliAvailable = false;
-    try {
-      const { stdout } = await execAsync3("which codex");
-      cliAvailable = stdout.trim().length > 0;
-      details.cliPath = stdout.trim();
-    } catch {
-      details.cliAvailable = false;
-    }
-    const codexConfigDir = join15(homedir10(), ".codex");
+    const resolvedCli = findOnPath3("codex");
+    cliAvailable = resolvedCli !== null;
+    if (resolvedCli) details.cliPath = resolvedCli;
+    else details.cliAvailable = false;
+    const codexConfigDir = join16(homedir8(), ".codex");
     const configExists = existsSync10(codexConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
@@ -47193,10 +47360,10 @@ var CodexAdapter = class {
 };
 
 // packages/adapters/src/providers/codex/spawn.ts
-import { exec as exec4, spawn as nodeSpawn2 } from "node:child_process";
 init_src();
-import { promisify as promisify5 } from "node:util";
-var execAsync4 = promisify5(exec4);
+init_cli_spawn();
+init_prompt_file();
+import { findOnPath as findOnPath4 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/codex/index.ts
 function createAdapter3() {
@@ -47207,15 +47374,14 @@ function createAdapter3() {
 init_cursor();
 
 // packages/adapters/src/providers/gemini-cli/adapter.ts
-import { exec as exec5 } from "node:child_process";
 import { existsSync as existsSync14 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { join as join20 } from "node:path";
-import { promisify as promisify6 } from "node:util";
+import { homedir as homedir10 } from "node:os";
+import { join as join21 } from "node:path";
+import { findOnPath as findOnPath5 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/gemini-cli/hooks.ts
-import { homedir as homedir11 } from "node:os";
-import { join as join18 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join19 } from "node:path";
 var GEMINI_CLI_EVENT_MAP = {
   SessionStart: "SessionStart",
   SessionEnd: "SessionEnd",
@@ -47293,14 +47459,14 @@ var GeminiCliHookProvider = class {
    * @task T161 @epic T134
    */
   async getTranscript(_sessionId, _projectDir) {
-    return readLatestTranscript(join18(homedir11(), ".gemini"));
+    return readLatestTranscript(join19(homedir9(), ".gemini"));
   }
 };
 
 // packages/adapters/src/providers/gemini-cli/install.ts
 init_paths2();
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync8 } from "node:fs";
+import { join as join20 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile4 } from "@cleocode/caamp";
 var GeminiCliInstallProvider = class {
   /**
@@ -47345,10 +47511,10 @@ var GeminiCliInstallProvider = class {
    */
   async isInstalled() {
     const instructionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
-    const geminiMdPath = join19(process.cwd(), "GEMINI.md");
+    const geminiMdPath = join20(process.cwd(), "GEMINI.md");
     if (existsSync13(geminiMdPath)) {
       try {
-        const content = readFileSync9(geminiMdPath, "utf-8");
+        const content = readFileSync8(geminiMdPath, "utf-8");
         if (content.includes(instructionRef)) {
           return true;
         }
@@ -47374,7 +47540,6 @@ var GeminiCliInstallProvider = class {
 };
 
 // packages/adapters/src/providers/gemini-cli/adapter.ts
-var execAsync5 = promisify6(exec5);
 var GeminiCliAdapter = class {
   /** Unique provider identifier. */
   id = "gemini-cli";
@@ -47462,14 +47627,11 @@ var GeminiCliAdapter = class {
       };
     }
     let cliAvailable = false;
-    try {
-      const { stdout } = await execAsync5("which gemini");
-      cliAvailable = stdout.trim().length > 0;
-      details.cliPath = stdout.trim();
-    } catch {
-      details.cliAvailable = false;
-    }
-    const geminiConfigDir = join20(homedir12(), ".gemini");
+    const resolvedCli = findOnPath5("gemini");
+    cliAvailable = resolvedCli !== null;
+    if (resolvedCli) details.cliPath = resolvedCli;
+    else details.cliAvailable = false;
+    const geminiConfigDir = join21(homedir10(), ".gemini");
     const configExists = existsSync14(geminiConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
@@ -47498,9 +47660,8 @@ var GeminiCliAdapter = class {
 
 // packages/adapters/src/providers/gemini-cli/spawn.ts
 init_src();
-import { exec as exec6, spawn as nodeSpawn3 } from "node:child_process";
-import { promisify as promisify7 } from "node:util";
-var execAsync6 = promisify7(exec6);
+init_cli_spawn();
+import { findOnPath as findOnPath6 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/gemini-cli/index.ts
 function createAdapter5() {
@@ -47508,11 +47669,10 @@ function createAdapter5() {
 }
 
 // packages/adapters/src/providers/kimi/adapter.ts
-import { exec as exec7 } from "node:child_process";
 import { existsSync as existsSync16 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join22 } from "node:path";
-import { promisify as promisify8 } from "node:util";
+import { homedir as homedir11 } from "node:os";
+import { join as join23 } from "node:path";
+import { findOnPath as findOnPath7 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/kimi/hooks.ts
 var KimiHookProvider = class {
@@ -47571,8 +47731,8 @@ var KimiHookProvider = class {
 
 // packages/adapters/src/providers/kimi/install.ts
 init_paths2();
-import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
+import { join as join22 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile5 } from "@cleocode/caamp";
 var KimiInstallProvider = class {
   /**
@@ -47617,10 +47777,10 @@ var KimiInstallProvider = class {
    */
   async isInstalled() {
     const instructionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
-    const agentsMdPath = join21(process.cwd(), "AGENTS.md");
+    const agentsMdPath = join22(process.cwd(), "AGENTS.md");
     if (existsSync15(agentsMdPath)) {
       try {
-        const content = readFileSync10(agentsMdPath, "utf-8");
+        const content = readFileSync9(agentsMdPath, "utf-8");
         if (content.includes(instructionRef)) {
           return true;
         }
@@ -47646,7 +47806,6 @@ var KimiInstallProvider = class {
 };
 
 // packages/adapters/src/providers/kimi/adapter.ts
-var execAsync7 = promisify8(exec7);
 var KimiAdapter = class {
   /** Unique provider identifier. */
   id = "kimi";
@@ -47721,14 +47880,11 @@ var KimiAdapter = class {
       };
     }
     let cliAvailable = false;
-    try {
-      const { stdout } = await execAsync7("which kimi");
-      cliAvailable = stdout.trim().length > 0;
-      details.cliPath = stdout.trim();
-    } catch {
-      details.cliAvailable = false;
-    }
-    const kimiConfigDir = join22(homedir13(), ".kimi");
+    const resolvedCli = findOnPath7("kimi");
+    cliAvailable = resolvedCli !== null;
+    if (resolvedCli) details.cliPath = resolvedCli;
+    else details.cliAvailable = false;
+    const kimiConfigDir = join23(homedir11(), ".kimi");
     const configExists = existsSync16(kimiConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
@@ -47757,9 +47913,7 @@ var KimiAdapter = class {
 
 // packages/adapters/src/providers/kimi/spawn.ts
 init_src();
-import { exec as exec8 } from "node:child_process";
-import { promisify as promisify9 } from "node:util";
-var execAsync8 = promisify9(exec8);
+import { findOnPath as findOnPath8 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/kimi/index.ts
 function createAdapter6() {
@@ -47771,17 +47925,17 @@ init_opencode();
 init_hook_template_installer();
 
 // packages/adapters/src/registry.ts
-import { readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname4, join as join28, resolve as resolve2 } from "node:path";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname5, join as join29, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PROVIDER_IDS = ["claude-code", "opencode", "cursor", "pi"];
 function getProviderManifests() {
   const manifests = [];
-  const baseDir = resolve2(dirname4(fileURLToPath3(import.meta.url)), "providers");
+  const baseDir = resolve2(dirname5(fileURLToPath3(import.meta.url)), "providers");
   for (const providerId of PROVIDER_IDS) {
     try {
-      const manifestPath = join28(baseDir, providerId, "manifest.json");
-      const raw = readFileSync12(manifestPath, "utf-8");
+      const manifestPath = join29(baseDir, providerId, "manifest.json");
+      const raw = readFileSync11(manifestPath, "utf-8");
       manifests.push(JSON.parse(raw));
     } catch {
     }