@dadado/agent-kit-cli 5.10.3 → 5.12.0

package/dist/index.js

@@ -10,12 +10,15 @@ import { defineCommand } from "citty";
 import { copyFile, mkdir as mkdir3, readFile as readFile3 } from "fs/promises";
 import path4 from "path";
 
+// src/utils/kit-paths.ts
+var HANDOFF_REL = ".cursor/HANDOFF.md";
+
 // src/manifest/types.ts
 var MANIFEST_FILENAME = "agent-kit.json";
 var MANIFEST_RELATIVE_PATH = `.cursor/${MANIFEST_FILENAME}`;
 var MANIFEST_SCHEMA_VERSION = 1;
 var DEFAULT_PROTECTED_PATHS = [
-  ".cursor/HANDOFF.md",
+  HANDOFF_REL,
   ".cursor/plans/**",
   ".cursor/memory/**",
   ".cursor/context/config.json",
@@ -342,7 +345,16 @@ var KNOWN_SHIPPED_OVERLAY_HASHES = /* @__PURE__ */ new Set([
   "18426bc3bc8fdf0ab7577d92e31310faf3b83001f8e6e6fe5ef1a1043230e178",
   "24cc918e7ffa54df7f6007989fe62b83af1035c9bf6071cac8c4f848e28b04ca",
   "76757eae42daccc0d82c9630eab31041c6d6ea8fe4b4a47843574a6057dd2a4b",
-  "88db17beb9ce2b95b2ce2c1df753b96933024a464cc847770d3f05cd7de2872c"
+  "88db17beb9ce2b95b2ce2c1df753b96933024a464cc847770d3f05cd7de2872c",
+  "71fff34e9392692d58f3dc92ed65d070f0b476446e0a183a8fbad66d46f3a785",
+  "73e3ca429cb522b0877f0d6d46bedbaf270f94bc63bb87f4e0fc7c512bf36e9c",
+  "9a61f7432cf66be53d42b5d6f3c67ea71dd5efa1cc18d77d996f08ffea873373",
+  "fd2a8867de62f83c89ae11295cae5b5699360b5205f9726c2c47c064318bd7a4",
+  "364126473e089ed09a71e3f9eed80b1d602b35b4baa669b0a4f4be0519a787f8",
+  "cb14c0162e66ac565679089a566a725b26989db3536b7dba89bff77cb6010969",
+  "ebf490086ea45a7b342b3ec7408c9a82b22031daaefddf4425b6e6e931f6d6c8",
+  "3077e013297c7dd1e32eb2fa86e1ffa1de7d8740058652782bb8d391782eed71",
+  "7e0fa1bb73c8b6f1358cae19477304d85edfb7d4d9a7faf37c00e0578ed79edf"
 ]);
 
 // src/lifecycle/paths.ts
@@ -713,6 +725,11 @@ import { mkdir as mkdir4, readFile as readFile4, rename, rm, stat, writeFile as
 import { homedir } from "os";
 import path5 from "path";
 import { promisify } from "util";
+
+// src/registry/paths.ts
+var REGISTRY_INDEX_REL = "registry/registry.json";
+
+// src/registry/resolve.ts
 var execFileAsync = promisify(execFile);
 var LOCK_TIMEOUT_MS = 6e4;
 var LOCK_RETRY_MS = 200;
@@ -871,7 +888,7 @@ function cacheKey(url, ref) {
   return createHash2("sha256").update(`${url}@${ref}`).digest("hex").slice(0, 16);
 }
 async function hasRegistryIndex(root) {
-  return fileExists(path5.join(root, "registry", "registry.json"));
+  return fileExists(path5.join(root, REGISTRY_INDEX_REL));
 }
 async function cloneRegistry(url, ref, dest) {
   const { mkdir: mkdir9 } = await import("fs/promises");
@@ -919,7 +936,7 @@ async function resolveRegistryRoot(options) {
   if (options.registryPath) {
     const root = path5.resolve(options.registryPath);
     if (!await hasRegistryIndex(root)) {
-      throw new Error(`No registry/registry.json under --registry ${root}`);
+      throw new Error(`No ${REGISTRY_INDEX_REL} under --registry ${root}`);
     }
     return { root, source: "flag" };
   }
@@ -927,7 +944,7 @@ async function resolveRegistryRoot(options) {
   if (envPath) {
     const root = path5.resolve(envPath);
     if (!await hasRegistryIndex(root)) {
-      throw new Error(`No registry/registry.json under AGENT_KIT_REGISTRY=${root}`);
+      throw new Error(`No ${REGISTRY_INDEX_REL} under AGENT_KIT_REGISTRY=${root}`);
     }
     return { root, source: "env", url: options.registryUrl, ref: options.registryRef };
   }
@@ -951,7 +968,7 @@ async function resolveRegistryRoot(options) {
     } else {
       await cloneRegistry(url, ref, dest);
       if (!await hasRegistryIndex(dest)) {
-        throw new Error(`Cloned ${url}@${ref} but registry/registry.json is missing`);
+        throw new Error(`Cloned ${url}@${ref} but ${REGISTRY_INDEX_REL} is missing`);
       }
     }
     ownershipTransferred = true;
@@ -1201,7 +1218,7 @@ async function loadAgentKitManifest(cwd) {
 // src/registry/client.ts
 import path7 from "path";
 async function loadRegistry(rootDir) {
-  const indexPath = path7.join(rootDir, "registry", "registry.json");
+  const indexPath = path7.join(rootDir, REGISTRY_INDEX_REL);
   const index = await readJson(indexPath);
   if (!index) throw new Error(`Registry not found at ${indexPath}`);
   return index;
@@ -1318,7 +1335,7 @@ async function installSkill(registryRoot, projectRoot, skill, options = {}) {
   return stats;
 }
 async function installSkillsByIds(registryRoot, projectRoot, skillIds, options = {}) {
-  const index = await readJson(path8.join(registryRoot, "registry", "registry.json"));
+  const index = await readJson(path8.join(registryRoot, REGISTRY_INDEX_REL));
   const stats = emptyStats();
   if (!index) return stats;
   const pool = allSkills(index);
@@ -2117,22 +2134,40 @@ import { defineCommand as defineCommand3 } from "citty";
 
 // src/lifecycle/cursor-update-awareness.ts
 import { access as access2, readFile as readFile7 } from "fs/promises";
+import path11 from "path";
+
+// src/lifecycle/context-config.ts
 import path10 from "path";
+var CONTEXT_CONFIG_REL = path10.join(".cursor", "context", "config.json");
+function contextConfigPath(cwd) {
+  return path10.join(cwd, CONTEXT_CONFIG_REL);
+}
+async function loadContextConfig(cwd) {
+  return readJson(contextConfigPath(cwd));
+}
+function intervalElapsed(lastCheckedAt, intervalDays) {
+  if (!lastCheckedAt) return true;
+  const last = Date.parse(lastCheckedAt);
+  if (Number.isNaN(last)) return true;
+  return Date.now() - last >= intervalDays * 24 * 60 * 60 * 1e3;
+}
+
+// src/lifecycle/cursor-update-awareness.ts
 var DEFAULT_CURSOR_CHANGELOG_URL = "https://cursor.com/changelog";
 var CHANGELOG_FETCH_TIMEOUT_MS = 15e3;
 var CURSOR_VERSION_MAJOR_MAX = 20;
-var INVENTORY_REL = path10.join("docs", "cursor-native-audit.md");
-var FEATURES_REL = path10.join("docs", "cursor-3-features.md");
+var INVENTORY_REL = path11.join("docs", "cursor-native-audit.md");
+var FEATURES_REL = path11.join("docs", "cursor-3-features.md");
 async function resolveInventoryRoot(cwd) {
-  let dir = path10.resolve(cwd);
+  let dir = path11.resolve(cwd);
   for (; ; ) {
     try {
-      await access2(path10.join(dir, INVENTORY_REL));
+      await access2(path11.join(dir, INVENTORY_REL));
       return dir;
     } catch {
     }
-    if (await fileExists(path10.join(dir, ".git"))) break;
-    const parent = path10.dirname(dir);
+    if (await fileExists(path11.join(dir, ".git"))) break;
+    const parent = path11.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -2168,18 +2203,7 @@ function readCursorUpdateCheckPrefs(config) {
     changelogUrl
   };
 }
-function intervalElapsed(lastCheckedAt, intervalDays) {
-  if (!lastCheckedAt) return true;
-  const last = Date.parse(lastCheckedAt);
-  if (Number.isNaN(last)) return true;
-  return Date.now() - last >= intervalDays * 24 * 60 * 60 * 1e3;
-}
-async function loadContextConfig(cwd) {
-  const configPath = path10.join(cwd, ".cursor", "context", "config.json");
-  return readJson(configPath);
-}
 async function stampCursorUpdateCheck(cwd, patch) {
-  const configPath = path10.join(cwd, ".cursor", "context", "config.json");
   const existing = await loadContextConfig(cwd) ?? {};
   const prev = existing.cursorUpdateCheck && typeof existing.cursorUpdateCheck === "object" ? { ...existing.cursorUpdateCheck } : {};
   const nextSeen = patch.lastSeenCursorVersion !== void 0 ? patch.lastSeenCursorVersion : void 0;
@@ -2189,7 +2213,7 @@ async function stampCursorUpdateCheck(cwd, patch) {
       ...prev,
       lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    await writeJson(configPath, existing);
+    await writeJson(contextConfigPath(cwd), existing);
     return;
   }
   existing.cursorUpdateCheck = {
@@ -2198,7 +2222,7 @@ async function stampCursorUpdateCheck(cwd, patch) {
     lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
     ...nextSeen !== void 0 ? { lastSeenCursorVersion: nextSeen } : {}
   };
-  await writeJson(configPath, existing);
+  await writeJson(contextConfigPath(cwd), existing);
 }
 function isPlausibleCursorVersion(version) {
   const parts = String(version).split(".");
@@ -2448,8 +2472,8 @@ async function checkCursorUpdateAwareness(cwd, options = {}) {
       message: missingInventoryMessage()
     });
   }
-  const inventoryPath = path10.join(inventoryRoot, INVENTORY_REL);
-  const featuresPath = path10.join(inventoryRoot, FEATURES_REL);
+  const inventoryPath = path11.join(inventoryRoot, INVENTORY_REL);
+  const featuresPath = path11.join(inventoryRoot, FEATURES_REL);
   let inventoryMd;
   try {
     inventoryMd = await readFile7(inventoryPath, "utf8");
@@ -2662,14 +2686,14 @@ var cursorAwarenessCommand = defineCommand3({
 // src/commands/dashboard-broadcast.ts
 import { spawn as spawn3 } from "child_process";
 import { access as access4 } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 import { defineCommand as defineCommand5 } from "citty";
 
 // src/commands/dashboard.ts
 import { execFileSync, spawn as spawn2 } from "child_process";
 import { existsSync, readFileSync as readFileSync2, realpathSync } from "fs";
 import { access as access3 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 import { fileURLToPath } from "url";
 import { defineCommand as defineCommand4 } from "citty";
 
@@ -2679,7 +2703,7 @@ import { networkInterfaces } from "os";
 import { resolve } from "path";
 var REPO_ROOT_ENV = "MISSION_CONTROL_REPO_ROOT";
 var KIT_ROOT_ENV_KEYS = Object.freeze(["MISSION_CONTROL_KIT_ROOT", "AGENT_KIT_HOME"]);
-var CONTEXT_CONFIG_REL = ".cursor/context/config.json";
+var CONTEXT_CONFIG_REL2 = ".cursor/context/config.json";
 var CONFIG_PERSONA_IDS = Object.freeze(["autopilot", "night-shift", "ghost-runner"]);
 var CONFIG_PERSONA_MODES = Object.freeze(["continue-plan", "run-plan", "cli-run-plan"]);
 var CONFIG_REVIEW_BACKENDS = Object.freeze(["auto", "claude", "cursor"]);
@@ -2692,7 +2716,7 @@ function resolveContextConfigPath(repoRoot, fsHooks = {}) {
   if (typeof repoRoot !== "string" || !repoRoot) {
     return { ok: false, error: "invalid repo root" };
   }
-  const abs = resolve(repoRoot, CONTEXT_CONFIG_REL);
+  const abs = resolve(repoRoot, CONTEXT_CONFIG_REL2);
   const contextDir = resolve(repoRoot, ".cursor", "context");
   const absNorm = abs.replace(/\\/g, "/");
   if (!absNorm.endsWith("/.cursor/context/config.json")) {
@@ -2758,7 +2782,7 @@ function readPreferredBrowserFromConfig(configPath, fsHooks = {}) {
 
 // src/commands/dashboard.ts
 function readPreferredBrowserFromWorkspace(cwd, readFile31 = readFileSync2) {
-  const resolved = resolveContextConfigPath(path11.resolve(cwd), {
+  const resolved = resolveContextConfigPath(path12.resolve(cwd), {
     existsSync,
     realpathSync
   });
@@ -2780,61 +2804,61 @@ function applyDashboardOpenEnv(env, opts) {
   return next;
 }
 function dashboardSpawnEnv(env, snapshotRoot, opts) {
-  const root = path11.resolve(snapshotRoot);
+  const root = path12.resolve(snapshotRoot);
   return applyDashboardOpenEnv({ ...env, MISSION_CONTROL_REPO_ROOT: root }, { ...opts, cwd: root });
 }
 function dashboardProcessTitle(snapshotRoot) {
-  const base = path11.basename(path11.resolve(snapshotRoot)) || "workspace";
+  const base = path12.basename(path12.resolve(snapshotRoot)) || "workspace";
   return `Mission Control \xB7 ${base}`;
 }
 function bundledDashboardCandidates(filename, moduleUrl = import.meta.url) {
-  const here = path11.dirname(fileURLToPath(moduleUrl));
+  const here = path12.dirname(fileURLToPath(moduleUrl));
   return [
     // Published / built: <pkg>/dist/index.js -> <pkg>/dashboard/
-    path11.join(here, "..", "dashboard", filename),
+    path12.join(here, "..", "dashboard", filename),
     // Dev source: packages/cli/src/commands/*.ts -> packages/cli/dashboard/ (sync copy)
-    path11.join(here, "..", "..", "dashboard", filename),
+    path12.join(here, "..", "..", "dashboard", filename),
     // From src/commands: packages/dashboard/ (unused layout); from dist: two levels above package
-    path11.join(here, "..", "..", "..", "dashboard", filename)
+    path12.join(here, "..", "..", "..", "dashboard", filename)
   ];
 }
 async function firstExisting(candidates) {
   for (const candidate2 of candidates) {
     try {
       await access3(candidate2);
-      return path11.resolve(candidate2);
+      return path12.resolve(candidate2);
     } catch {
     }
   }
   return null;
 }
 async function findDashboardStart(cwd, env = process.env, options = {}) {
-  let dir = path11.resolve(cwd);
+  let dir = path12.resolve(cwd);
   for (; ; ) {
-    const candidate2 = path11.join(dir, "dashboard", "start.mjs");
+    const candidate2 = path12.join(dir, "dashboard", "start.mjs");
     try {
       await access3(candidate2);
       return candidate2;
     } catch {
     }
-    const parent = path11.dirname(dir);
+    const parent = path12.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   for (const key of ["MISSION_CONTROL_KIT_ROOT", "AGENT_KIT_HOME"]) {
     const base = env[key];
     if (!base || typeof base !== "string" || !base.trim()) continue;
-    const candidate2 = path11.join(path11.resolve(base.trim()), "dashboard", "start.mjs");
+    const candidate2 = path12.join(path12.resolve(base.trim()), "dashboard", "start.mjs");
     try {
       await access3(candidate2);
       return candidate2;
     } catch {
     }
   }
-  const sibling = path11.join(path11.resolve(cwd), "..", "agent-kit", "dashboard", "start.mjs");
+  const sibling = path12.join(path12.resolve(cwd), "..", "agent-kit", "dashboard", "start.mjs");
   try {
     await access3(sibling);
-    return path11.resolve(sibling);
+    return path12.resolve(sibling);
   } catch {
   }
   return firstExisting(
@@ -2842,13 +2866,13 @@ async function findDashboardStart(cwd, env = process.env, options = {}) {
   );
 }
 function resolveDashboardSnapshotRoot(cwd) {
-  const abs = path11.resolve(cwd);
+  const abs = path12.resolve(cwd);
   let dir = abs;
   for (; ; ) {
-    if (existsSync(path11.join(dir, ".cursor", "agent-kit.json"))) {
+    if (existsSync(path12.join(dir, ".cursor", "agent-kit.json"))) {
       return dir;
     }
-    const parent = path11.dirname(dir);
+    const parent = path12.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -2858,7 +2882,7 @@ function resolveDashboardSnapshotRoot(cwd) {
       timeout: 5e3,
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
-    if (top) return path11.resolve(top);
+    if (top) return path12.resolve(top);
   } catch {
   }
   return abs;
@@ -2866,7 +2890,7 @@ function resolveDashboardSnapshotRoot(cwd) {
 function runStartScript(startPath, env) {
   return new Promise((resolve3, reject) => {
     const child = spawn2(process.execPath, [startPath], {
-      cwd: path11.dirname(path11.dirname(startPath)),
+      cwd: path12.dirname(path12.dirname(startPath)),
       env,
       stdio: "inherit"
     });
@@ -2934,30 +2958,30 @@ var dashboardCommand = defineCommand4({
 
 // src/commands/dashboard-broadcast.ts
 async function findDashboardBroadcastStart(cwd, env = process.env, options = {}) {
-  let dir = path12.resolve(cwd);
+  let dir = path13.resolve(cwd);
   for (; ; ) {
-    const candidate2 = path12.join(dir, "dashboard", "start-broadcast.mjs");
+    const candidate2 = path13.join(dir, "dashboard", "start-broadcast.mjs");
     try {
       await access4(candidate2);
       return candidate2;
     } catch {
     }
-    const parent = path12.dirname(dir);
+    const parent = path13.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   for (const key of ["MISSION_CONTROL_KIT_ROOT", "AGENT_KIT_HOME"]) {
     const base = env[key];
     if (!base || typeof base !== "string" || !base.trim()) continue;
-    const candidate2 = path12.join(path12.resolve(base.trim()), "dashboard", "start-broadcast.mjs");
+    const candidate2 = path13.join(path13.resolve(base.trim()), "dashboard", "start-broadcast.mjs");
     try {
       await access4(candidate2);
       return candidate2;
     } catch {
     }
   }
-  const sibling = path12.join(
-    path12.resolve(cwd),
+  const sibling = path13.join(
+    path13.resolve(cwd),
     "..",
     "agent-kit",
     "dashboard",
@@ -2965,7 +2989,7 @@ async function findDashboardBroadcastStart(cwd, env = process.env, options = {})
   );
   try {
     await access4(sibling);
-    return path12.resolve(sibling);
+    return path13.resolve(sibling);
   } catch {
   }
   for (const candidate2 of bundledDashboardCandidates(
@@ -2974,7 +2998,7 @@ async function findDashboardBroadcastStart(cwd, env = process.env, options = {})
   )) {
     try {
       await access4(candidate2);
-      return path12.resolve(candidate2);
+      return path13.resolve(candidate2);
     } catch {
     }
   }
@@ -2983,7 +3007,7 @@ async function findDashboardBroadcastStart(cwd, env = process.env, options = {})
 function runStartScript2(startPath, env) {
   return new Promise((resolve3, reject) => {
     const child = spawn3(process.execPath, [startPath], {
-      cwd: path12.dirname(path12.dirname(startPath)),
+      cwd: path13.dirname(path13.dirname(startPath)),
       env,
       stdio: "inherit"
     });
@@ -3038,7 +3062,7 @@ import { defineCommand as defineCommand6 } from "citty";
 
 // src/lifecycle/diff.ts
 import { readFile as readFile8 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 async function readIfExists(abs) {
   try {
     return await readFile8(abs, "utf8");
@@ -3047,7 +3071,7 @@ async function readIfExists(abs) {
   }
 }
 async function comparePair(registryRoot, projectRoot, sourceRel, targetRel, protectedGlobs) {
-  const posixTarget = targetRel.split(path13.sep).join("/");
+  const posixTarget = targetRel.split(path14.sep).join("/");
   if (isProtectedPath(posixTarget, protectedGlobs)) {
     return { path: posixTarget, status: "protected" };
   }
@@ -3077,7 +3101,7 @@ async function diffAgainstRegistry(registryRoot, projectRoot, manifest) {
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   const pushUnique = async (sourceRel, targetRel) => {
-    const key = targetRel.split(path13.sep).join("/");
+    const key = targetRel.split(path14.sep).join("/");
     if (seen.has(key)) return;
     seen.add(key);
     entries.push(
@@ -3182,14 +3206,116 @@ var diffCommand = defineCommand6({
 });
 
 // src/commands/doctor.ts
-import path26 from "path";
+import path28 from "path";
 import { defineCommand as defineCommand7 } from "citty";
 
 // src/invariants/hooks-health.ts
 import { execFile as execFile2 } from "child_process";
-import { constants as constants2, access as access5, readFile as readFile9, readdir as readdir4, stat as stat2 } from "fs/promises";
-import path14 from "path";
+import { constants as constants2, access as access5, readFile as readFile10, readdir as readdir4, stat as stat2 } from "fs/promises";
+import path16 from "path";
 import { promisify as promisify2 } from "util";
+
+// src/generator/claude-session-start-hook.ts
+import { readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
+import path15 from "path";
+var CLAUDE_SETTINGS_REL = ".claude/settings.json";
+var RESOLVE_AGENT_KIT_REL = ".cursor/hooks/agent/resolve-agent-kit.sh";
+var SESSION_START_HOOK_MARKER = "hook session-start --format claude";
+var SESSION_START_DEGRADED_TEXT = "Agent Kit hooks are running in degraded fail-open mode: the agent-kit CLI could not be resolved (checked AGENT_KIT_HOOK_BIN, PATH, node_modules/.bin/agent-kit). Slash command adapters still work; session-context injection is inactive. Fix: install the CLI (npm i -D @dadado/agent-kit-cli) or set AGENT_KIT_HOOK_BIN.";
+function buildSessionStartHookCommand() {
+  return `. "\${CLAUDE_PROJECT_DIR}/${RESOLVE_AGENT_KIT_REL}" 2>/dev/null && resolve_agent_kit && exec $AGENT_KIT_RESOLVED hook session-start --format claude; printf '%s' ${shellSingleQuote(SESSION_START_DEGRADED_TEXT)}`;
+}
+function shellSingleQuote(text) {
+  return `'${text.replace(/'/g, "'\\''")}'`;
+}
+function buildSessionStartHookEntry() {
+  return {
+    type: "command",
+    command: buildSessionStartHookCommand(),
+    timeout: 15,
+    statusMessage: "Loading Agent Kit session context"
+  };
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function groupHasMarker(group) {
+  if (!isPlainObject2(group) || !Array.isArray(group.hooks)) return false;
+  return group.hooks.some(
+    (h) => isPlainObject2(h) && typeof h.command === "string" && h.command.includes(SESSION_START_HOOK_MARKER)
+  );
+}
+function mergeSessionStartHookIntoSettings(existingRaw) {
+  const entry = buildSessionStartHookEntry();
+  const newGroup = { hooks: [entry] };
+  let root = {};
+  if (existingRaw !== null && existingRaw.trim() !== "") {
+    try {
+      const parsed = JSON.parse(existingRaw);
+      if (!isPlainObject2(parsed)) throw new Error("root is not an object");
+      root = parsed;
+    } catch {
+      return {
+        content: null,
+        status: "unavailable",
+        instructions: instructionsBlock(entry)
+      };
+    }
+  }
+  const hooks = isPlainObject2(root.hooks) ? { ...root.hooks } : {};
+  const sessionStart = Array.isArray(hooks.SessionStart) ? [...hooks.SessionStart] : [];
+  const existingIndex = sessionStart.findIndex((g) => groupHasMarker(g));
+  let status;
+  if (existingIndex === -1) {
+    sessionStart.push(newGroup);
+    status = "applied";
+  } else {
+    const current = sessionStart[existingIndex];
+    if (JSON.stringify(current) === JSON.stringify(newGroup)) {
+      status = "unchanged";
+    } else {
+      sessionStart[existingIndex] = newGroup;
+      status = "refreshed";
+    }
+  }
+  hooks.SessionStart = sessionStart;
+  root.hooks = hooks;
+  return { content: `${JSON.stringify(root, null, 2)}
+`, status };
+}
+function instructionsBlock(entry) {
+  return [
+    `Could not parse the existing ${CLAUDE_SETTINGS_REL} as JSON, so Agent Kit did not touch it.`,
+    "Add this hook by hand under hooks.SessionStart (create the arrays if they do not exist):",
+    "",
+    JSON.stringify(entry, null, 2)
+  ].join("\n");
+}
+async function writeClaudeSessionStartHook(rootDir) {
+  const abs = path15.join(rootDir, CLAUDE_SETTINGS_REL);
+  let existing = null;
+  try {
+    existing = await readFile9(abs, "utf8");
+  } catch {
+    existing = null;
+  }
+  const merged = mergeSessionStartHookIntoSettings(existing);
+  if (merged.status === "unavailable" || merged.content === null) {
+    return {
+      relativePath: CLAUDE_SETTINGS_REL,
+      status: "unavailable",
+      instructions: merged.instructions
+    };
+  }
+  if (merged.status === "unchanged") {
+    return { relativePath: CLAUDE_SETTINGS_REL, status: "unchanged" };
+  }
+  await ensureDir(path15.dirname(abs));
+  await writeFile5(abs, merged.content, "utf8");
+  return { relativePath: CLAUDE_SETTINGS_REL, status: merged.status };
+}
+
+// src/invariants/hooks-health.ts
 var execFileAsync2 = promisify2(execFile2);
 var GIT_HOOK_CANONICAL_NAMES = ["pre-commit", "pre-push", "prepare-commit-msg"];
 var EXPECTED_EVENTS = [
@@ -3216,10 +3342,10 @@ async function isExecutable(p) {
   }
 }
 async function resolveAgentKitCli(rootDir) {
-  const root = path14.resolve(rootDir);
+  const root = path16.resolve(rootDir);
   const candidates = [
-    path14.join(root, "node_modules", ".bin", "agent-kit"),
-    path14.join(root, "packages", "cli", "dist", "index.js")
+    path16.join(root, "node_modules", ".bin", "agent-kit"),
+    path16.join(root, "packages", "cli", "dist", "index.js")
   ];
   for (const c of candidates) {
     if (await exists(c)) return c;
@@ -3239,8 +3365,8 @@ function commandLooksLikeAdapter(command) {
   return m?.[1] ?? null;
 }
 async function assessGitHooksInstallDrift(rootDir) {
-  const root = path14.resolve(rootDir);
-  const canonicalDir = path14.join(root, "git-hooks");
+  const root = path16.resolve(rootDir);
+  const canonicalDir = path16.join(root, "git-hooks");
   if (!await exists(canonicalDir)) return [];
   let hooksPathCfg = "";
   try {
@@ -3253,12 +3379,12 @@ async function assessGitHooksInstallDrift(rootDir) {
   } catch {
   }
   if (hooksPathCfg) {
-    const resolved = path14.isAbsolute(hooksPathCfg) ? path14.normalize(hooksPathCfg) : path14.normalize(path14.join(root, hooksPathCfg));
-    if (resolved === path14.normalize(canonicalDir)) {
+    const resolved = path16.isAbsolute(hooksPathCfg) ? path16.normalize(hooksPathCfg) : path16.normalize(path16.join(root, hooksPathCfg));
+    if (resolved === path16.normalize(canonicalDir)) {
       return [];
     }
   }
-  const gitDir = path14.join(root, ".git");
+  const gitDir = path16.join(root, ".git");
   if (!await exists(gitDir)) return [];
   try {
     const st = await stat2(gitDir);
@@ -3266,7 +3392,7 @@ async function assessGitHooksInstallDrift(rootDir) {
   } catch {
     return [];
   }
-  const installedDir = path14.join(gitDir, "hooks");
+  const installedDir = path16.join(gitDir, "hooks");
   const advisories = [];
   const installHint = "Install or refresh with: `cp git-hooks/<name> .git/hooks/<name> && chmod +x .git/hooks/<name>` (see git-hooks/README.md)";
   let names = [...GIT_HOOK_CANONICAL_NAMES];
@@ -3279,8 +3405,8 @@ async function assessGitHooksInstallDrift(rootDir) {
   } catch {
   }
   for (const name of names) {
-    const canonical = path14.join(canonicalDir, name);
-    const installed = path14.join(installedDir, name);
+    const canonical = path16.join(canonicalDir, name);
+    const installed = path16.join(installedDir, name);
     if (!await exists(canonical)) continue;
     if (!await exists(installed)) {
       advisories.push(
@@ -3289,7 +3415,7 @@ async function assessGitHooksInstallDrift(rootDir) {
       continue;
     }
     try {
-      const [a, b] = await Promise.all([readFile9(canonical, "utf8"), readFile9(installed, "utf8")]);
+      const [a, b] = await Promise.all([readFile10(canonical, "utf8"), readFile10(installed, "utf8")]);
       if (a !== b) {
         advisories.push(
           `git-hooks drift: \`.git/hooks/${name}\` differs from \`git-hooks/${name}\`. ${installHint}`
@@ -3304,9 +3430,9 @@ async function assessGitHooksInstallDrift(rootDir) {
   return advisories;
 }
 async function assessHooksHealth(rootDir) {
-  const root = path14.resolve(rootDir);
+  const root = path16.resolve(rootDir);
   const hooksJsonPath = ".cursor/hooks.json";
-  const hooksJsonAbs = path14.join(root, hooksJsonPath);
+  const hooksJsonAbs = path16.join(root, hooksJsonPath);
   const reasons = [];
   const wiredEvents = [];
   const advisories = await assessGitHooksInstallDrift(root);
@@ -3322,7 +3448,7 @@ async function assessHooksHealth(rootDir) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(await readFile9(hooksJsonAbs, "utf8"));
+    parsed = JSON.parse(await readFile10(hooksJsonAbs, "utf8"));
   } catch {
     return {
       status: "degraded",
@@ -3352,14 +3478,14 @@ async function assessHooksHealth(rootDir) {
       reasons.push(`missing hook event: ${event}`);
     }
   }
-  const resolveLib = path14.join(root, ".cursor", "hooks", "agent", "resolve-agent-kit.sh");
+  const resolveLib = path16.join(root, RESOLVE_AGENT_KIT_REL);
   if (!await exists(resolveLib)) {
-    reasons.push("missing `.cursor/hooks/agent/resolve-agent-kit.sh` (thin adapter resolver)");
+    reasons.push(`missing \`${RESOLVE_AGENT_KIT_REL}\` (thin adapter resolver)`);
   } else if (!await isExecutable(resolveLib)) {
-    reasons.push("`.cursor/hooks/agent/resolve-agent-kit.sh` is not executable (chmod +x)");
+    reasons.push(`\`${RESOLVE_AGENT_KIT_REL}\` is not executable (chmod +x)`);
   }
   for (const rel of adapterRels) {
-    const abs = path14.join(root, rel);
+    const abs = path16.join(root, rel);
     if (!await exists(abs)) {
       reasons.push(`missing adapter script: \`${rel}\``);
       continue;
@@ -3400,7 +3526,7 @@ async function assessHooksHealth(rootDir) {
 
 // src/lifecycle/check-updates.ts
 import { execFile as execFile3 } from "child_process";
-import path15 from "path";
+import path17 from "path";
 import { promisify as promisify3 } from "util";
 var execFileAsync3 = promisify3(execFile3);
 var SEMVER_CORE = /^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/i;
@@ -3500,31 +3626,19 @@ function readUpdateCheckPrefs(config) {
     lastCheckedAt: typeof uc.lastCheckedAt === "string" ? uc.lastCheckedAt : null
   };
 }
-function intervalElapsed2(lastCheckedAt, intervalDays) {
-  if (!lastCheckedAt) return true;
-  const last = Date.parse(lastCheckedAt);
-  if (Number.isNaN(last)) return true;
-  const ms = intervalDays * 24 * 60 * 60 * 1e3;
-  return Date.now() - last >= ms;
-}
-async function loadContextConfig2(cwd) {
-  const configPath = path15.join(cwd, ".cursor", "context", "config.json");
-  return readJson(configPath);
-}
 async function stampLastCheckedAt(cwd) {
-  const configPath = path15.join(cwd, ".cursor", "context", "config.json");
-  const existing = await loadContextConfig2(cwd) ?? {};
+  const existing = await loadContextConfig(cwd) ?? {};
   const prev = existing.updateCheck && typeof existing.updateCheck === "object" ? { ...existing.updateCheck } : {};
   existing.updateCheck = {
     ...DEFAULT_UPDATE_CHECK,
     ...prev,
     lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await writeJson(configPath, existing);
+  await writeJson(contextConfigPath(cwd), existing);
 }
 async function readLocalKitVersion(registryRoot) {
   for (const rel of ["packages/cli/package.json", "package.json"]) {
-    const data = await readJson(path15.join(registryRoot, rel));
+    const data = await readJson(path17.join(registryRoot, rel));
     if (data && typeof data.version === "string" && data.version.length > 0) {
       return data.version;
     }
@@ -3545,7 +3659,7 @@ async function checkAgainstLocalRegistry(cwd, manifest, options) {
       status: "error",
       installedVersion: manifest.version,
       latestVersion: null,
-      registryUrl: path15.resolve(registryPath),
+      registryUrl: path17.resolve(registryPath),
       registryRef: "local",
       applyRecommended: false,
       message: `Failed to resolve --registry: ${msg}`
@@ -3663,7 +3777,7 @@ async function checkForUpdates(cwd, options = {}) {
     };
   }
   if (options.respectPrefs) {
-    const config = await loadContextConfig2(cwd);
+    const config = await loadContextConfig(cwd);
     const prefs = readUpdateCheckPrefs(config);
     if (!prefs.enabled) {
       return {
@@ -3676,7 +3790,7 @@ async function checkForUpdates(cwd, options = {}) {
         message: "updateCheck.enabled is false (opt-in). Set true in .cursor/context/config.json to nudge."
       };
     }
-    if (!intervalElapsed2(prefs.lastCheckedAt, prefs.intervalDays)) {
+    if (!intervalElapsed(prefs.lastCheckedAt, prefs.intervalDays)) {
       return {
         status: "skipped-interval",
         installedVersion: manifest.version,
@@ -3773,7 +3887,7 @@ function runningCliBehindMessage(running, latest) {
 async function checkRunningCliVsNpmLatest(cwd, options = {}) {
   const running = normalizeSemver(KIT_VERSION) ?? KIT_VERSION;
   if (options.respectPrefs) {
-    const config = await loadContextConfig2(cwd);
+    const config = await loadContextConfig(cwd);
     const prefs = readUpdateCheckPrefs(config);
     if (!prefs.enabled) {
       return {
@@ -3783,7 +3897,7 @@ async function checkRunningCliVsNpmLatest(cwd, options = {}) {
         message: "updateCheck.enabled is false (opt-in). Set true in .cursor/context/config.json to nudge."
       };
     }
-    if (!intervalElapsed2(prefs.lastCheckedAt, prefs.intervalDays)) {
+    if (!intervalElapsed(prefs.lastCheckedAt, prefs.intervalDays)) {
       return {
         status: "skipped-interval",
         runningVersion: running,
@@ -3882,11 +3996,11 @@ async function warnIfRunningCliBehindNpm(cwd, options = {}) {
 }
 
 // src/readiness/env-checks.ts
-import { constants as constants3, access as access6, readFile as readFile10, stat as stat3 } from "fs/promises";
+import { constants as constants3, access as access6, readFile as readFile11, stat as stat3 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import path16 from "path";
+import path18 from "path";
 var MIN_NODE_MAJOR = 20;
-var CLI_PACKAGE_JSON_REL = path16.join(
+var CLI_PACKAGE_JSON_REL = path18.join(
   "lib",
   "node_modules",
   "@dadado",
@@ -3907,7 +4021,7 @@ function expandBinDirVars(raw, binDir) {
   return raw.replace(/\$\{basedir\}/g, binDir).replace(/\$basedir/g, binDir);
 }
 function packageJsonFromDistIndex(distIndex) {
-  return path16.join(path16.dirname(distIndex), "..", "package.json");
+  return path18.join(path18.dirname(distIndex), "..", "package.json");
 }
 function parsePackageVersion(contents) {
   try {
@@ -3918,23 +4032,23 @@ function parsePackageVersion(contents) {
   }
 }
 async function readBinVersion(binPath, options = {}) {
-  const readFileImpl = options.readFileImpl ?? ((filePath) => readFile10(filePath, "utf8"));
-  const binDir = path16.dirname(binPath);
+  const readFileImpl = options.readFileImpl ?? ((filePath) => readFile11(filePath, "utf8"));
+  const binDir = path18.dirname(binPath);
   const candidates = [
-    path16.join(binDir, "..", CLI_PACKAGE_JSON_REL),
-    path16.join(binDir, "..", "node_modules", "@dadado", "agent-kit-cli", "package.json")
+    path18.join(binDir, "..", CLI_PACKAGE_JSON_REL),
+    path18.join(binDir, "..", "node_modules", "@dadado", "agent-kit-cli", "package.json")
   ];
   try {
     const contents = await readFileImpl(binPath);
     for (const raw of extractDistIndexFromBinScript(contents)) {
-      const distIndex = path16.resolve(binDir, expandBinDirVars(raw, binDir));
+      const distIndex = path18.resolve(binDir, expandBinDirVars(raw, binDir));
       candidates.push(packageJsonFromDistIndex(distIndex));
     }
   } catch {
   }
   const seen = /* @__PURE__ */ new Set();
   for (const candidate2 of candidates) {
-    const resolved = path16.resolve(candidate2);
+    const resolved = path18.resolve(candidate2);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     try {
@@ -3948,11 +4062,11 @@ async function readBinVersion(binPath, options = {}) {
 async function resolveBinOnPath(binName, env, platform) {
   const pathVar = env.PATH ?? env.Path ?? "";
   if (!pathVar) return null;
-  const dirs = pathVar.split(path16.delimiter).filter(Boolean);
+  const dirs = pathVar.split(path18.delimiter).filter(Boolean);
   const candidates = platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.exe`, `${binName}.bat`] : [binName];
   for (const dir of dirs) {
     for (const candidate2 of candidates) {
-      const abs = path16.join(dir, candidate2);
+      const abs = path18.join(dir, candidate2);
       try {
         await access6(abs, platform === "win32" ? void 0 : constants3.X_OK);
         return abs;
@@ -3976,13 +4090,13 @@ function detectShellName(env, platform) {
   }
   const shellPath = env.SHELL;
   if (!shellPath) return null;
-  const base = path16.basename(shellPath).trim();
+  const base = path18.basename(shellPath).trim();
   return base || null;
 }
 function detectShellProfile(env, platform, homeDir) {
   const shellName = detectShellName(env, platform);
-  if (shellName === "zsh") return path16.join(homeDir, ".zshrc");
-  if (shellName === "bash") return path16.join(homeDir, ".bashrc");
+  if (shellName === "zsh") return path18.join(homeDir, ".zshrc");
+  if (shellName === "bash") return path18.join(homeDir, ".bashrc");
   return null;
 }
 function parseNpmrcPrefix(content, homeDir) {
@@ -3991,12 +4105,12 @@ function parseNpmrcPrefix(content, homeDir) {
   if (!captured) return null;
   let value = captured.trim().replace(/^["']|["']$/g, "");
   if (value.startsWith("~")) {
-    value = path16.join(homeDir, value.slice(1));
+    value = path18.join(homeDir, value.slice(1));
   }
   return value || null;
 }
 function heuristicPrefixFromExecPath(execPath, platform) {
-  const p = platform === "win32" ? path16.win32 : path16.posix;
+  const p = platform === "win32" ? path18.win32 : path18.posix;
   return platform === "win32" ? p.dirname(execPath) : p.dirname(p.dirname(execPath));
 }
 async function detectNpmPrefix(options = {}) {
@@ -4004,12 +4118,12 @@ async function detectNpmPrefix(options = {}) {
   const platform = options.platform ?? process.platform;
   const homeDir = options.homeDir ?? homedir2();
   const execPath = options.execPath ?? process.execPath;
-  const readFileImpl = options.readFileImpl ?? ((filePath) => readFile10(filePath, "utf8"));
+  const readFileImpl = options.readFileImpl ?? ((filePath) => readFile11(filePath, "utf8"));
   const envPrefix = env.npm_config_prefix ?? env.NPM_CONFIG_PREFIX;
   if (envPrefix?.trim()) {
     return { prefix: envPrefix.trim(), source: "env" };
   }
-  const userconfigPath = env.NPM_CONFIG_USERCONFIG ?? path16.join(homeDir, ".npmrc");
+  const userconfigPath = env.NPM_CONFIG_USERCONFIG ?? path18.join(homeDir, ".npmrc");
   try {
     const content = await readFileImpl(userconfigPath);
     const npmrcPrefix = parseNpmrcPrefix(content, homeDir);
@@ -4336,12 +4450,17 @@ function createReadinessReport(scan, options) {
 }
 
 // src/scanner/safe-fixes.ts
-import { readFile as readFile15, writeFile as writeFile5 } from "fs/promises";
-import path24 from "path";
+import { readFile as readFile16, writeFile as writeFile6 } from "fs/promises";
+import path26 from "path";
+
+// src/scanner/detect-repository.ts
+import { readFile as readFile12 } from "fs/promises";
+import path19 from "path";
+
+// src/scanner/paths.ts
+var REPOSITORY_PROFILE_REL = ".cursor/agent-kit.config.json";
 
 // src/scanner/detect-repository.ts
-import { readFile as readFile11 } from "fs/promises";
-import path17 from "path";
 var CONTEXT_PATHS = [
   ["README.md", "README"],
   ["README", "README"],
@@ -4360,7 +4479,7 @@ var CONTEXT_PATHS = [
 async function existingEvidence(rootDir, candidates) {
   const evidence = await Promise.all(
     candidates.map(
-      async ([relativePath, label]) => await fileExists(path17.join(rootDir, relativePath)) ? { source: "file", value: `${relativePath}:${label}` } : void 0
+      async ([relativePath, label]) => await fileExists(path19.join(rootDir, relativePath)) ? { source: "file", value: `${relativePath}:${label}` } : void 0
     )
   );
   return evidence.flatMap((item) => item ? [item] : []);
@@ -4394,7 +4513,7 @@ function isRepositoryPurpose(value) {
 }
 async function readConfirmedPurpose(rootDir) {
   const configuration = await readJson(
-    path17.join(rootDir, ".cursor", "agent-kit.config.json")
+    path19.join(rootDir, REPOSITORY_PROFILE_REL)
   );
   const configuredPurpose = configuration?.purpose;
   if (!configuredPurpose || !isRepositoryPurpose(configuredPurpose.value) || configuredPurpose.value === "unknown") {
@@ -4406,7 +4525,7 @@ async function readConfirmedPurpose(rootDir) {
     value: configuredPurpose.value,
     categories: categories.length > 0 ? categories : [configuredPurpose.value],
     confidence: "high",
-    evidence: evidence.length > 0 ? evidence : [{ source: "configuration", value: ".cursor/agent-kit.config.json#purpose.value" }]
+    evidence: evidence.length > 0 ? evidence : [{ source: "configuration", value: `${REPOSITORY_PROFILE_REL}#purpose.value` }]
   };
 }
 async function detectPurpose(rootDir, stack) {
@@ -4414,7 +4533,7 @@ async function detectPurpose(rootDir, stack) {
   if (confirmed) return confirmed;
   const entries = await listDirectory(rootDir);
   const lowerEntries = entries.map((entry) => entry.toLowerCase());
-  const packageJson = await readJson(path17.join(rootDir, "package.json"));
+  const packageJson = await readJson(path19.join(rootDir, "package.json"));
   const categories = [];
   const evidence = [];
   const add = (category, value2) => {
@@ -4454,16 +4573,16 @@ async function detectPurpose(rootDir, stack) {
 }
 async function detectAgentKit(rootDir) {
   const manifestRelativePath = ".cursor/agent-kit.json";
-  const manifestPath = path17.join(rootDir, manifestRelativePath);
+  const manifestPath = path19.join(rootDir, manifestRelativePath);
   const installed = await fileExists(manifestPath);
   const manifest = installed ? await readJson(manifestPath) : null;
   return {
     installed,
     manifestPath: installed ? manifestRelativePath : void 0,
     version: manifest?.version,
-    hasPlans: await fileExists(path17.join(rootDir, ".cursor/plans")),
-    hasHandoff: await fileExists(path17.join(rootDir, ".cursor/HANDOFF.md")),
-    hasMemory: await fileExists(path17.join(rootDir, ".cursor/memory"))
+    hasPlans: await fileExists(path19.join(rootDir, ".cursor/plans")),
+    hasHandoff: await fileExists(path19.join(rootDir, ".cursor/HANDOFF.md")),
+    hasMemory: await fileExists(path19.join(rootDir, ".cursor/memory"))
   };
 }
 var REQUIRED_SECRET_PATTERNS = [
@@ -4484,9 +4603,9 @@ var KIT_OWNED_IGNORE_PATTERNS = [
   ".cursor/context/mission-timing.json"
 ];
 async function detectSafety(rootDir, trackedFiles) {
-  const gitignorePath = path17.join(rootDir, ".gitignore");
+  const gitignorePath = path19.join(rootDir, ".gitignore");
   const hasGitignore = await fileExists(gitignorePath);
-  const gitignore = hasGitignore ? await readFile11(gitignorePath, "utf8") : "";
+  const gitignore = hasGitignore ? await readFile12(gitignorePath, "utf8") : "";
   const lines = gitignore.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   const ignoredSecretPatterns = REQUIRED_SECRET_PATTERNS.filter(
     (pattern) => lines.includes(pattern)
@@ -4495,7 +4614,7 @@ async function detectSafety(rootDir, trackedFiles) {
     (file) => /(^|\/)(\.env(\..+)?|.*\.(key|pem|p12|pfx)|.*credentials.*\.json)$/i.test(file)
   );
   const hookPaths = [".husky", ".git/hooks/pre-commit", "git-hooks/pre-commit"];
-  const hasHooks = (await Promise.all(hookPaths.map((item) => fileExists(path17.join(rootDir, item))))).some(Boolean);
+  const hasHooks = (await Promise.all(hookPaths.map((item) => fileExists(path19.join(rootDir, item))))).some(Boolean);
   const guardCandidates = [
     ".husky/pre-commit",
     ".husky/pre-push",
@@ -4504,7 +4623,7 @@ async function detectSafety(rootDir, trackedFiles) {
   ];
   const guardContents = await Promise.all(
     guardCandidates.map(
-      async (item) => await fileExists(path17.join(rootDir, item)) ? readFile11(path17.join(rootDir, item), "utf8") : ""
+      async (item) => await fileExists(path19.join(rootDir, item)) ? readFile12(path19.join(rootDir, item), "utf8") : ""
     )
   );
   return {
@@ -4522,11 +4641,11 @@ async function detectSafety(rootDir, trackedFiles) {
 }
 
 // src/scanner/scan.ts
-import path23 from "path";
+import path25 from "path";
 
 // src/scanner/detect-git.ts
 import { execFile as execFile4 } from "child_process";
-import path18 from "path";
+import path20 from "path";
 import { promisify as promisify4 } from "util";
 var exec = promisify4(execFile4);
 function remoteHostname(remoteUrl) {
@@ -4550,7 +4669,7 @@ function sanitizeRemoteUrl(remoteUrl) {
 }
 async function detectProvider(rootDir, remoteUrl) {
   const configuration = await readJson(
-    path18.join(rootDir, ".cursor", "agent-kit.config.json")
+    path20.join(rootDir, REPOSITORY_PROFILE_REL)
   );
   const configuredProvider = configuration?.git?.provider;
   if (configuredProvider) {
@@ -4559,7 +4678,7 @@ async function detectProvider(rootDir, remoteUrl) {
       provider: configuredProvider,
       providerKind: configuredKind,
       confidence: "high",
-      evidence: [{ source: "configuration", value: ".cursor/agent-kit.config.json#git.provider" }]
+      evidence: [{ source: "configuration", value: `${REPOSITORY_PROFILE_REL}#git.provider` }]
     };
   }
   if (!remoteUrl) {
@@ -4607,7 +4726,7 @@ async function detectProvider(rootDir, remoteUrl) {
       evidence: remoteEvidence
     };
   }
-  if (await fileExists(path18.join(rootDir, ".gitlab-ci.yml"))) {
+  if (await fileExists(path20.join(rootDir, ".gitlab-ci.yml"))) {
     return {
       provider: "gitlab",
       providerKind: "gitlab-self-hosted",
@@ -4697,11 +4816,11 @@ async function detectGit(rootDir) {
 }
 
 // src/scanner/detect-ide.ts
-import path19 from "path";
+import path21 from "path";
 async function detectIde(rootDir) {
-  const hasCursor = await fileExists(path19.join(rootDir, ".cursor"));
-  const hasVSCode = await fileExists(path19.join(rootDir, ".vscode"));
-  const hasWindsurf = await fileExists(path19.join(rootDir, ".windsurfrules"));
+  const hasCursor = await fileExists(path21.join(rootDir, ".cursor"));
+  const hasVSCode = await fileExists(path21.join(rootDir, ".vscode"));
+  const hasWindsurf = await fileExists(path21.join(rootDir, ".windsurfrules"));
   if (hasCursor) return { ide: "cursor", plan: "cursor-pro" };
   if (hasVSCode) return { ide: "vscode", plan: "vscode-pro" };
   if (hasWindsurf) return { ide: "windsurf", plan: "windsurf" };
@@ -4709,8 +4828,8 @@ async function detectIde(rootDir) {
 }
 
 // src/scanner/detect-infra.ts
-import { readFile as readFile12, readdir as readdir5 } from "fs/promises";
-import path20 from "path";
+import { readFile as readFile13, readdir as readdir5 } from "fs/promises";
+import path22 from "path";
 
 // src/types.ts
 var GIT_PLATFORM_META = {
@@ -4790,7 +4909,7 @@ function extractRunCommands(yaml) {
   return Array.from(new Set(commands));
 }
 async function detectCiRunCommands(rootDir) {
-  const workflowsDir = path20.join(rootDir, ".github", "workflows");
+  const workflowsDir = path22.join(rootDir, ".github", "workflows");
   if (!await fileExists(workflowsDir)) return [];
   let entries;
   try {
@@ -4802,7 +4921,7 @@ async function detectCiRunCommands(rootDir) {
   const perFile = await Promise.all(
     workflowFiles.map(async (name) => {
       try {
-        return extractRunCommands(await readFile12(path20.join(workflowsDir, name), "utf8"));
+        return extractRunCommands(await readFile13(path22.join(workflowsDir, name), "utf8"));
       } catch {
         return [];
       }
@@ -4811,12 +4930,12 @@ async function detectCiRunCommands(rootDir) {
   return Array.from(new Set(perFile.flat()));
 }
 async function detectInfra(rootDir) {
-  const docker = await fileExists(path20.join(rootDir, "Dockerfile")) || await fileExists(path20.join(rootDir, "docker-compose.yml")) || await fileExists(path20.join(rootDir, "docker-compose.yaml"));
-  const kubernetes = await fileExists(path20.join(rootDir, "k8s")) || await fileExists(path20.join(rootDir, "kubernetes"));
+  const docker = await fileExists(path22.join(rootDir, "Dockerfile")) || await fileExists(path22.join(rootDir, "docker-compose.yml")) || await fileExists(path22.join(rootDir, "docker-compose.yaml"));
+  const kubernetes = await fileExists(path22.join(rootDir, "k8s")) || await fileExists(path22.join(rootDir, "kubernetes"));
   let ci = "none";
   const ciFiles = [];
   for (const [platform, filePath] of Object.entries(CI_PLATFORM_FILES)) {
-    if (await fileExists(path20.join(rootDir, filePath))) {
+    if (await fileExists(path22.join(rootDir, filePath))) {
       if (ci === "none") ci = platform;
       ciFiles.push(filePath);
     }
@@ -4841,12 +4960,12 @@ async function detectInfra(rootDir) {
   ];
   const infrastructureFiles = (await Promise.all(
     infrastructureCandidates.map(
-      async (file) => await fileExists(path20.join(rootDir, file)) ? file : void 0
+      async (file) => await fileExists(path22.join(rootDir, file)) ? file : void 0
     )
   )).filter((file) => file !== void 0);
   const deploymentFiles = (await Promise.all(
     deploymentCandidates.map(
-      async (file) => await fileExists(path20.join(rootDir, file)) ? file : void 0
+      async (file) => await fileExists(path22.join(rootDir, file)) ? file : void 0
     )
   )).filter((file) => file !== void 0);
   const ciRunCommands = ci === "github-actions" ? await detectCiRunCommands(rootDir) : [];
@@ -4854,18 +4973,18 @@ async function detectInfra(rootDir) {
 }
 
 // src/scanner/detect-services.ts
-import { readFile as readFile13 } from "fs/promises";
-import path21 from "path";
+import { readFile as readFile14 } from "fs/promises";
+import path23 from "path";
 async function detectProjectManagement(rootDir) {
   const tools = [];
   const mcpConfigPaths = [
-    path21.join(rootDir, ".cursor", "mcp.json"),
-    path21.join(rootDir, "mcp.json")
+    path23.join(rootDir, ".cursor", "mcp.json"),
+    path23.join(rootDir, "mcp.json")
   ];
   for (const configPath of mcpConfigPaths) {
     if (!await fileExists(configPath)) continue;
     try {
-      const raw = await readFile13(configPath, "utf8");
+      const raw = await readFile14(configPath, "utf8");
       const lower = raw.toLowerCase();
       if (lower.includes("clickup")) tools.push("clickup");
       if (lower.includes("jira") || lower.includes("atlassian")) tools.push("jira");
@@ -4876,20 +4995,20 @@ async function detectProjectManagement(rootDir) {
     } catch {
     }
   }
-  if (await fileExists(path21.join(rootDir, ".github", "ISSUE_TEMPLATE"))) {
+  if (await fileExists(path23.join(rootDir, ".github", "ISSUE_TEMPLATE"))) {
     tools.push("github-issues");
   }
-  if (await fileExists(path21.join(rootDir, ".github", "projects"))) {
+  if (await fileExists(path23.join(rootDir, ".github", "projects"))) {
     tools.push("github-projects");
   }
   return [...new Set(tools)];
 }
 async function detectServices(rootDir) {
-  const hasPrisma = await fileExists(path21.join(rootDir, "prisma/schema.prisma"));
-  const hasSequelize = await fileExists(path21.join(rootDir, "sequelize"));
-  const hasDrizzle = await fileExists(path21.join(rootDir, "drizzle.config.ts"));
-  const hasKnex = await fileExists(path21.join(rootDir, "knexfile.ts"));
-  const hasTypeorm = await fileExists(path21.join(rootDir, "ormconfig.json"));
+  const hasPrisma = await fileExists(path23.join(rootDir, "prisma/schema.prisma"));
+  const hasSequelize = await fileExists(path23.join(rootDir, "sequelize"));
+  const hasDrizzle = await fileExists(path23.join(rootDir, "drizzle.config.ts"));
+  const hasKnex = await fileExists(path23.join(rootDir, "knexfile.ts"));
+  const hasTypeorm = await fileExists(path23.join(rootDir, "ormconfig.json"));
   const database = hasPrisma || hasSequelize || hasDrizzle || hasKnex || hasTypeorm ? "postgresql" : void 0;
   const orm = hasPrisma ? "prisma" : hasDrizzle ? "drizzle" : hasSequelize ? "sequelize" : hasKnex ? "knex" : hasTypeorm ? "typeorm" : void 0;
   const projectManagement = await detectProjectManagement(rootDir);
@@ -4901,8 +5020,8 @@ async function detectServices(rootDir) {
 }
 
 // src/scanner/detect-stack.ts
-import { readFile as readFile14, readdir as readdir6 } from "fs/promises";
-import path22 from "path";
+import { readFile as readFile15, readdir as readdir6 } from "fs/promises";
+import path24 from "path";
 var PROJECT_MARKERS = [
   "package.json",
   "requirements.txt",
@@ -4928,7 +5047,7 @@ async function scanSubdirectoryMarkers(rootDir) {
   const candidates = dirs.flatMap((dir) => PROJECT_MARKERS.map((marker) => ({ dir, marker })));
   const found = await Promise.all(
     candidates.map(async (candidate2) => {
-      const exists2 = await fileExists(path22.join(rootDir, candidate2.dir, candidate2.marker));
+      const exists2 = await fileExists(path24.join(rootDir, candidate2.dir, candidate2.marker));
       return exists2 ? candidate2 : null;
     })
   );
@@ -4944,7 +5063,7 @@ var DART_VALIDATION_COMMANDS = [
 async function detectDartFlavor(pubspecDir) {
   let content = "";
   try {
-    content = await readFile14(path22.join(pubspecDir, "pubspec.yaml"), "utf8");
+    content = await readFile15(path24.join(pubspecDir, "pubspec.yaml"), "utf8");
   } catch {
   }
   return { isFlutter: isFlutterPubspec(content) };
@@ -4957,7 +5076,7 @@ async function detectStackFromSubdirHits(rootDir, hits) {
   const dartHits = hits.filter((hit) => hit.marker === "pubspec.yaml");
   if (dartHits.length > 0) {
     const flavors = await Promise.all(
-      dartHits.map((hit) => detectDartFlavor(path22.join(rootDir, hit.dir)))
+      dartHits.map((hit) => detectDartFlavor(path24.join(rootDir, hit.dir)))
     );
     const testCommands = Array.from(
       new Set(flavors.map((flavor) => flavor.isFlutter ? "flutter test" : "dart test"))
@@ -4974,8 +5093,8 @@ async function detectStackFromSubdirHits(rootDir, hits) {
   }
   const nodeHit = hits.find((hit) => hit.marker === "package.json");
   if (nodeHit) {
-    const subRoot = path22.join(rootDir, nodeHit.dir);
-    const packageJson = await readJson(path22.join(subRoot, "package.json")) ?? {};
+    const subRoot = path24.join(rootDir, nodeHit.dir);
+    const packageJson = await readJson(path24.join(subRoot, "package.json")) ?? {};
     const scripts = packageJson.scripts ?? {};
     const packageManager = await detectPackageManager(subRoot, packageJson);
     const commands = commandsForScripts(scripts, packageManager.packageManager);
@@ -5032,7 +5151,7 @@ function isDetectionEvidenceArray(value) {
 }
 async function readConfirmedStack(rootDir) {
   const configuration = await readJson(
-    path22.join(rootDir, ".cursor", "agent-kit.config.json")
+    path24.join(rootDir, REPOSITORY_PROFILE_REL)
   );
   const configured = configuration?.stack;
   const language = configured?.language;
@@ -5046,7 +5165,7 @@ async function readConfirmedStack(rootDir) {
   const scripts = configured.scripts && typeof configured.scripts === "object" && !Array.isArray(configured.scripts) ? configured.scripts : void 0;
   const packageManagerEvidence = isDetectionEvidenceArray(
     configured.packageManagerEvidence
-  ) ? configured.packageManagerEvidence : [{ source: "configuration", value: ".cursor/agent-kit.config.json#stack.language" }];
+  ) ? configured.packageManagerEvidence : [{ source: "configuration", value: `${REPOSITORY_PROFILE_REL}#stack.language` }];
   return {
     language,
     framework: typeof configured.framework === "string" ? configured.framework : void 0,
@@ -5075,7 +5194,7 @@ async function detectPackageManager(rootDir, packageJson) {
     };
   }
   for (const [lockfile, packageManager] of LOCKFILES) {
-    if (await fileExists(path22.join(rootDir, lockfile))) {
+    if (await fileExists(path24.join(rootDir, lockfile))) {
       return {
         packageManager,
         evidence: [{ source: "file", value: lockfile }]
@@ -5094,33 +5213,33 @@ function commandsForScripts(scripts, packageManager) {
 async function detectStack(rootDir) {
   const confirmed = await readConfirmedStack(rootDir);
   if (confirmed) return confirmed;
-  const hasAnyProjectMarker = (await Promise.all(PROJECT_MARKERS.map((item) => fileExists(path22.join(rootDir, item))))).some(Boolean);
+  const hasAnyProjectMarker = (await Promise.all(PROJECT_MARKERS.map((item) => fileExists(path24.join(rootDir, item))))).some(Boolean);
   if (!hasAnyProjectMarker) {
     const subdirHits = await scanSubdirectoryMarkers(rootDir);
     if (subdirHits.length > 0) {
       return detectStackFromSubdirHits(rootDir, subdirHits);
     }
   }
-  const hasPackageJson = await fileExists(path22.join(rootDir, "package.json"));
+  const hasPackageJson = await fileExists(path24.join(rootDir, "package.json"));
   if (hasPackageJson) {
-    const packageJson = await readJson(path22.join(rootDir, "package.json")) ?? {};
+    const packageJson = await readJson(path24.join(rootDir, "package.json")) ?? {};
     const scripts = packageJson.scripts ?? {};
     const packageManager = await detectPackageManager(rootDir, packageJson);
     const commands = commandsForScripts(scripts, packageManager.packageManager);
-    const hasNextConfig = await fileExists(path22.join(rootDir, "next.config.js")) || await fileExists(path22.join(rootDir, "next.config.mjs")) || await fileExists(path22.join(rootDir, "next.config.ts"));
-    const hasNestConfig = await fileExists(path22.join(rootDir, "nest-cli.json"));
+    const hasNextConfig = await fileExists(path24.join(rootDir, "next.config.js")) || await fileExists(path24.join(rootDir, "next.config.mjs")) || await fileExists(path24.join(rootDir, "next.config.ts"));
+    const hasNestConfig = await fileExists(path24.join(rootDir, "nest-cli.json"));
     return {
       language: "node",
       framework: hasNextConfig ? "nextjs" : hasNestConfig ? "nestjs" : "node",
       packageManager: packageManager.packageManager,
       packageManagerEvidence: packageManager.evidence,
       scripts,
-      workspaces: packageJson.workspaces !== void 0 || await fileExists(path22.join(rootDir, "pnpm-workspace.yaml")),
+      workspaces: packageJson.workspaces !== void 0 || await fileExists(path24.join(rootDir, "pnpm-workspace.yaml")),
       ...commands,
       hasProjectFiles: hasAnyProjectMarker
     };
   }
-  if (await fileExists(path22.join(rootDir, "pyproject.toml"))) {
+  if (await fileExists(path24.join(rootDir, "pyproject.toml"))) {
     return {
       language: "python",
       framework: "python",
@@ -5130,7 +5249,7 @@ async function detectStack(rootDir) {
       hasProjectFiles: hasAnyProjectMarker
     };
   }
-  if (await fileExists(path22.join(rootDir, "go.mod"))) {
+  if (await fileExists(path24.join(rootDir, "go.mod"))) {
     return {
       language: "go",
       framework: "go",
@@ -5140,7 +5259,7 @@ async function detectStack(rootDir) {
       hasProjectFiles: hasAnyProjectMarker
     };
   }
-  if (await fileExists(path22.join(rootDir, "Cargo.toml"))) {
+  if (await fileExists(path24.join(rootDir, "Cargo.toml"))) {
     return {
       language: "rust",
       framework: "rust",
@@ -5150,7 +5269,7 @@ async function detectStack(rootDir) {
       hasProjectFiles: hasAnyProjectMarker
     };
   }
-  if (await fileExists(path22.join(rootDir, "composer.json"))) {
+  if (await fileExists(path24.join(rootDir, "composer.json"))) {
     return {
       language: "php",
       framework: "php",
@@ -5160,7 +5279,7 @@ async function detectStack(rootDir) {
       hasProjectFiles: hasAnyProjectMarker
     };
   }
-  if (await fileExists(path22.join(rootDir, "pubspec.yaml"))) {
+  if (await fileExists(path24.join(rootDir, "pubspec.yaml"))) {
     const { isFlutter } = await detectDartFlavor(rootDir);
     return {
       language: "dart",
@@ -5194,7 +5313,7 @@ function isGreenfieldByEntries(entries) {
   return meaningful.length === 0;
 }
 async function runScanner(rootDir) {
-  const normalizedRoot = path23.resolve(rootDir);
+  const normalizedRoot = path25.resolve(rootDir);
   const entries = await listDirectory(normalizedRoot);
   const stack = await detectStack(normalizedRoot);
   const purpose = await detectPurpose(normalizedRoot, stack);
@@ -5232,8 +5351,7 @@ async function runScanner(rootDir) {
 }
 
 // src/scanner/safe-fixes.ts
-var PROFILE_RELATIVE_PATH = ".cursor/agent-kit.config.json";
-var CONTEXT_CONFIG_RELATIVE_PATH = ".cursor/context/config.json";
+var CONTEXT_CONFIG_REL_POSIX = CONTEXT_CONFIG_REL.replace(/\\/g, "/");
 var ESSENTIAL_DIRECTORIES = [
   ".cursor",
   ".cursor/context",
@@ -5418,7 +5536,7 @@ async function refreshRepositoryProfile(rootDir, options) {
     generatedAt
   });
   const desiredProfile = createProfile(scan, report, generatedAt);
-  const profilePath = path24.join(scan.rootDir, PROFILE_RELATIVE_PATH);
+  const profilePath = path26.join(scan.rootDir, REPOSITORY_PROFILE_REL);
   const existingProfile = await readJson(profilePath) ?? {};
   const reconciled = reconcileFreshOverExisting(desiredProfile, existingProfile);
   const meaningfulChange = !jsonEqual(
@@ -5441,7 +5559,7 @@ async function executeSafeReadinessFixes(rootDir, options) {
   });
   const changes = [];
   for (const relativePath of ESSENTIAL_DIRECTORIES) {
-    const absolutePath = path24.join(beforeScan.rootDir, relativePath);
+    const absolutePath = path26.join(beforeScan.rootDir, relativePath);
     const exists2 = await fileExists(absolutePath);
     if (!exists2 && !dryRun) await ensureDir(absolutePath);
     recordChange(
@@ -5454,14 +5572,14 @@ async function executeSafeReadinessFixes(rootDir, options) {
     );
   }
   const gitignoreRelativePath = ".gitignore";
-  const gitignorePath = path24.join(beforeScan.rootDir, gitignoreRelativePath);
-  const existingGitignore = await fileExists(gitignorePath) ? await readFile15(gitignorePath, "utf8") : "";
+  const gitignorePath = path26.join(beforeScan.rootDir, gitignoreRelativePath);
+  const existingGitignore = await fileExists(gitignorePath) ? await readFile16(gitignorePath, "utf8") : "";
   const gitignoreAfterSecrets = mergeSecretIgnores(existingGitignore);
   const secretsChanged = gitignoreAfterSecrets !== existingGitignore;
   const mergedGitignore = mergeKitOwnedIgnores(gitignoreAfterSecrets);
   const gitignoreChanged = mergedGitignore !== existingGitignore;
   const kitOwnedChanged = mergedGitignore !== gitignoreAfterSecrets;
-  if (gitignoreChanged && !dryRun) await writeFile5(gitignorePath, mergedGitignore, "utf8");
+  if (gitignoreChanged && !dryRun) await writeFile6(gitignorePath, mergedGitignore, "utf8");
   recordChange(
     changes,
     "merge-secret-ignores",
@@ -5484,7 +5602,7 @@ async function executeSafeReadinessFixes(rootDir, options) {
       kitOwnedChanged ? "kit-owned session/derived paths are missing" : "kit-owned session/derived paths are present"
     )
   );
-  const profilePath = path24.join(beforeScan.rootDir, PROFILE_RELATIVE_PATH);
+  const profilePath = path26.join(beforeScan.rootDir, REPOSITORY_PROFILE_REL);
   const existingProfile = await readJson(profilePath) ?? {};
   const desiredProfile = createProfile(beforeScan, before, generatedAt);
   const mergedProfile = mergeMissing(existingProfile, desiredProfile);
@@ -5493,11 +5611,11 @@ async function executeSafeReadinessFixes(rootDir, options) {
   recordChange(
     changes,
     "merge-repository-profile",
-    PROFILE_RELATIVE_PATH,
+    REPOSITORY_PROFILE_REL,
     profileChanged,
     dryRun,
     relativeEvidence(
-      PROFILE_RELATIVE_PATH,
+      REPOSITORY_PROFILE_REL,
       profileChanged ? "missing scanner-derived facts" : "existing facts preserved"
     )
   );
@@ -5506,22 +5624,22 @@ async function executeSafeReadinessFixes(rootDir, options) {
     generatorVersion: options.generatorVersion,
     generatedAt
   });
-  const contextConfigPath = path24.join(beforeScan.rootDir, CONTEXT_CONFIG_RELATIVE_PATH);
-  const existingContextConfig = await readJson(contextConfigPath) ?? {};
+  const configPath = contextConfigPath(beforeScan.rootDir);
+  const existingContextConfig = await readJson(configPath) ?? {};
   const onboarding = reconcileOnboardingState(evidenceReport, existingContextConfig, generatedAt);
   const defaults = preferenceDefaults(onboarding, existingContextConfig.onboarded);
   const mergedContextConfig = mergeMissing(existingContextConfig, defaults);
   mergedContextConfig.onboarding = onboarding;
   const contextConfigChanged = !jsonEqual(existingContextConfig, mergedContextConfig);
-  if (contextConfigChanged && !dryRun) await writeJson(contextConfigPath, mergedContextConfig);
+  if (contextConfigChanged && !dryRun) await writeJson(configPath, mergedContextConfig);
   recordChange(
     changes,
     "merge-onboarding-state",
-    CONTEXT_CONFIG_RELATIVE_PATH,
+    CONTEXT_CONFIG_REL_POSIX,
     contextConfigChanged,
     dryRun,
     relativeEvidence(
-      CONTEXT_CONFIG_RELATIVE_PATH,
+      CONTEXT_CONFIG_REL_POSIX,
       contextConfigChanged ? "missing preferences or onboarding state" : "state already merged"
     )
   );
@@ -5535,10 +5653,10 @@ async function executeSafeReadinessFixes(rootDir, options) {
 }
 
 // src/scanner/snapshot.ts
-import path25 from "path";
+import path27 from "path";
 var READINESS_SNAPSHOT_RELATIVE_PATH = ".cursor/context/readiness.json";
 async function writeReadinessSnapshot(rootDir, report) {
-  const snapshotPath = path25.join(rootDir, READINESS_SNAPSHOT_RELATIVE_PATH);
+  const snapshotPath = path27.join(rootDir, READINESS_SNAPSHOT_RELATIVE_PATH);
   await writeJson(snapshotPath, report);
   return snapshotPath;
 }
@@ -5730,7 +5848,7 @@ async function withCliProgress(label, fn, opts) {
 // src/commands/doctor.ts
 async function readDeferredEssentials(rootDir, report) {
   const config = await readJson(
-    path26.join(rootDir, ".cursor", "context", "config.json")
+    path28.join(rootDir, ".cursor", "context", "config.json")
   );
   const deferredItems = config?.onboarding?.deferredItems;
   if (!Array.isArray(deferredItems)) return [];
@@ -5742,7 +5860,7 @@ async function readDeferredEssentials(rootDir, report) {
   ).map((item) => ({ checkId: item.checkId, reason: item.reason }));
 }
 async function runDoctor(cwd, options = {}) {
-  const rootDir = path26.resolve(cwd);
+  const rootDir = path28.resolve(cwd);
   const hooks = await assessHooksHealth(rootDir);
   const env = await assessEnvironment();
   if (options.fixSafe) {
@@ -6270,8 +6388,8 @@ var guardCommand = defineCommand8({
 
 // src/commands/handoff.ts
 import { spawn as spawn4 } from "child_process";
-import { appendFile, readFile as readFile16, readdir as readdir7, writeFile as writeFile6 } from "fs/promises";
-import path27 from "path";
+import { appendFile, readFile as readFile17, readdir as readdir7, writeFile as writeFile7 } from "fs/promises";
+import path29 from "path";
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/invariants/handoff-prune.ts
@@ -6412,12 +6530,12 @@ function pruneArchiveTimestamp(now2 = /* @__PURE__ */ new Date()) {
   return `${now2.getFullYear()}-${pad(now2.getMonth() + 1)}-${pad(now2.getDate())}-${pad(now2.getHours())}${pad(now2.getMinutes())}`;
 }
 async function runPrune(cwd, keep) {
-  const handoffPath = path27.join(cwd, ".cursor", "HANDOFF.md");
+  const handoffPath = path29.join(cwd, ".cursor", "HANDOFF.md");
   if (!await fileExists(handoffPath)) {
     logger.warn("No .cursor/HANDOFF.md to prune.");
     return;
   }
-  const original = await readFile16(handoffPath, "utf8");
+  const original = await readFile17(handoffPath, "utf8");
   const result = pruneHandoffText(original, keep);
   if (!result.ok) {
     logger.warn(`Refusing to prune: ${result.reason}`);
@@ -6430,9 +6548,9 @@ async function runPrune(cwd, keep) {
     );
     return;
   }
-  const archiveDir = path27.join(cwd, ".cursor", "context", "archive");
+  const archiveDir = path29.join(cwd, ".cursor", "context", "archive");
   await ensureDir(archiveDir);
-  const archivePath = path27.join(archiveDir, `handoff-${pruneArchiveTimestamp()}.md`);
+  const archivePath = path29.join(archiveDir, `handoff-${pruneArchiveTimestamp()}.md`);
   const header = [
     `<!-- Pruned from .cursor/HANDOFF.md at ${(/* @__PURE__ */ new Date()).toISOString()} -->`,
     `<!-- ${result.archived.length} narrative ${result.archived.length === 1 ? "entry" : "entries"} archived, keep=${keep} -->`,
@@ -6444,11 +6562,11 @@ async function runPrune(cwd, keep) {
     await appendFile(archivePath, `
 ${header}${body}`, "utf8");
   } else {
-    await writeFile6(archivePath, `${header}${body}`, "utf8");
+    await writeFile7(archivePath, `${header}${body}`, "utf8");
   }
-  await writeFile6(handoffPath, result.text ?? original, "utf8");
+  await writeFile7(handoffPath, result.text ?? original, "utf8");
   logger.success(
-    `HANDOFF.md pruned: kept ${result.keptCount} narrative ${result.keptCount === 1 ? "entry" : "entries"}, archived ${result.archived.length} to ${path27.relative(cwd, archivePath)}.`
+    `HANDOFF.md pruned: kept ${result.keptCount} narrative ${result.keptCount === 1 ? "entry" : "entries"}, archived ${result.archived.length} to ${path29.relative(cwd, archivePath)}.`
   );
 }
 function parsePlanFrontmatter(raw) {
@@ -6469,19 +6587,19 @@ async function findActivePlan(plansDir) {
   if (!await fileExists(plansDir)) return null;
   const files = (await readdir7(plansDir)).filter((f) => f.endsWith(".plan.md")).sort().reverse();
   for (const file of files) {
-    const raw = await readFile16(path27.join(plansDir, file), "utf8");
+    const raw = await readFile17(path29.join(plansDir, file), "utf8");
     const fm = parsePlanFrontmatter(raw);
     if (fm?.todos?.some((t) => t.status !== "completed" && t.status !== "cancelled")) {
       return { file, raw };
     }
   }
-  return files[0] ? { file: files[0], raw: await readFile16(path27.join(plansDir, files[0]), "utf8") } : null;
+  return files[0] ? { file: files[0], raw: await readFile17(path29.join(plansDir, files[0]), "utf8") } : null;
 }
 function now() {
   return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 16);
 }
 async function loadProfile(rootDir) {
-  const configPath = path27.join(rootDir, ".cursor", "agent-kit.config.json");
+  const configPath = path29.join(rootDir, ".cursor", "agent-kit.config.json");
   try {
     return await readJson(configPath);
   } catch {
@@ -6596,15 +6714,15 @@ var handoffCommand = defineCommand9({
       return;
     }
     const profile = await loadProfile(args.cwd);
-    const plansDir = path27.join(args.cwd, ".cursor", "plans");
-    const handoffPath = path27.join(args.cwd, ".cursor", "HANDOFF.md");
+    const plansDir = path29.join(args.cwd, ".cursor", "plans");
+    const handoffPath = path29.join(args.cwd, ".cursor", "HANDOFF.md");
     const plan = await findActivePlan(plansDir);
     if (plan) {
       const fm = parsePlanFrontmatter(plan.raw);
       if (fm) {
-        await ensureDir(path27.join(args.cwd, ".cursor"));
+        await ensureDir(path29.join(args.cwd, ".cursor"));
         const content = buildHandoff(plan.file, fm, profile);
-        await writeFile6(handoffPath, content, "utf8");
+        await writeFile7(handoffPath, content, "utf8");
         logger.success("HANDOFF.md updated: .cursor/HANDOFF.md");
         logger.info(
           `Plan: ${plan.file} (${fm.todos?.filter((t) => t.status === "completed").length}/${fm.todos?.length} completed)`
@@ -6622,7 +6740,7 @@ var handoffCommand = defineCommand9({
       }
       logger.warn(`Plan ${plan.file} without valid frontmatter; trying legacy flow.`);
     }
-    const scriptPath = path27.join(args.cwd, "cursor-handoff");
+    const scriptPath = path29.join(args.cwd, "cursor-handoff");
     if (!await fileExists(scriptPath)) {
       printV3Guidance();
       return;
@@ -6647,7 +6765,7 @@ var handoffCommand = defineCommand9({
 });
 
 // src/commands/hook.ts
-import path30 from "path";
+import path32 from "path";
 import { defineCommand as defineCommand10 } from "citty";
 
 // src/hooks/format-session-start.ts
@@ -6673,8 +6791,8 @@ function buildPreCompactUserMessage(payload = {}) {
 
 // src/hooks/session-start.ts
 import { spawn as spawn5 } from "child_process";
-import { access as access7, readFile as readFile18, stat as stat4 } from "fs/promises";
-import path29 from "path";
+import { readFile as readFile19, stat as stat4 } from "fs/promises";
+import path31 from "path";
 
 // src/invariants/handoff-schema.ts
 var MACHINE_LIST_CHECKS = [
@@ -6716,8 +6834,8 @@ function validateHandoffText(text) {
 }
 
 // src/plan-index/plan-index.ts
-import { readFile as readFile17, writeFile as writeFile7 } from "fs/promises";
-import path28 from "path";
+import { readFile as readFile18, writeFile as writeFile8 } from "fs/promises";
+import path30 from "path";
 var PLAN_INDEX_REL = ".cursor/context/plan-index.json";
 var NONE = /^(none|n\/a|empty|nil)$/i;
 var OPEN_STATUSES = /* @__PURE__ */ new Set(["pending", "in_progress"]);
@@ -6725,14 +6843,14 @@ function defaultPlanIndexIo() {
   return {
     async readFile(absPath) {
       try {
-        return await readFile17(absPath, "utf8");
+        return await readFile18(absPath, "utf8");
       } catch {
         return null;
       }
     },
     async writeFile(absPath, body) {
-      await ensureDir(path28.dirname(absPath));
-      await writeFile7(absPath, body, "utf8");
+      await ensureDir(path30.dirname(absPath));
+      await writeFile8(absPath, body, "utf8");
     }
   };
 }
@@ -6757,11 +6875,11 @@ function collectNamedPlanBasenames(named) {
   return out;
 }
 function namedPlanCandidatePaths(root, basename) {
-  const safe = path28.basename(basename);
+  const safe = path30.basename(basename);
   if (!/^[A-Za-z0-9._-]+\.plan\.md$/i.test(safe)) return [];
   return [
-    path28.join(root, ".cursor", "plans", safe),
-    path28.join(root, ".cursor", "plans", "archive", safe)
+    path30.join(root, ".cursor", "plans", safe),
+    path30.join(root, ".cursor", "plans", "archive", safe)
   ];
 }
 function classifyPlanRole(file, named, openTodos) {
@@ -6793,7 +6911,7 @@ function parsePlanFrontmatter2(raw) {
   return { name, todos };
 }
 async function buildPlanIndex(root, io = defaultPlanIndexIo(), now2 = () => /* @__PURE__ */ new Date()) {
-  const handoffPath = path28.join(root, ".cursor", "HANDOFF.md");
+  const handoffPath = path30.join(root, HANDOFF_REL);
   const handoffText = await io.readFile(handoffPath) ?? "";
   const named = extractHandoffNamedPlans(handoffText);
   const plans = [];
@@ -6822,7 +6940,7 @@ async function buildPlanIndex(root, io = defaultPlanIndexIo(), now2 = () => /* @
 }
 async function writePlanIndex(root, io = defaultPlanIndexIo(), now2 = () => /* @__PURE__ */ new Date()) {
   const index = await buildPlanIndex(root, io, now2);
-  const dest = path28.join(root, PLAN_INDEX_REL);
+  const dest = path30.join(root, PLAN_INDEX_REL);
   const write = io.writeFile ?? defaultPlanIndexIo().writeFile;
   if (write) {
     await write(dest, `${JSON.stringify(index, null, 2)}
@@ -7034,11 +7152,11 @@ var HARD_RULES = `# Agent Kit session hard rules (manual mode default)
 2. **Do not burn the window.** Never run an entire multi-phase plan in one conversation unless the user explicitly ran \`/run-plan\` (or a deprecated alias \`/run-plan-loop\` / \`/run-plan-orchestrated\`).
 3. **Context questions are not optional.** If the user asks about context / contexto / window size, run the context-guardian protocol: warn, offer handoff, do NOT dismiss with "it's fine" and keep coding.
 4. **Read HANDOFF first** when resuming. Do not restart the plan from scratch.
-5. **Git:** suggest \`/git-staging\` after a phase with a diff; never \`/git-prod\` without explicit confirmation.
+5. **Git:** suggest \`/git-staging\` after a phase with a diff; never \`/git-prod\` without explicit confirmation. A \`/run-plan-all\` queue confirm with Ship auth \`per-plan-release\` is that confirmation for one ship per completed plan.
 6. **HITL slash commands win.** When waiting for confirmation on \`/git-staging\` or \`/git-prod\` (or similar), do not divert to continue-plan / phase-boundary chatter; stay on that routine until the user answers.
 7. **\`/start-project\` is plan bootstrap, not execute.** Broad Intake Review first, then two gates: (A) single composite question (with active plan: backlog+write / park+write / modify / cancel; without: write / write+backlog (\`Write plan and add to backlog\`) / modify / cancel): approve/write the plan file only, (B) approve the first unit. Goal text in the same message is NOT permission to edit product files. Never "create plan and start Phase 1" in one turn. If HANDOFF already has an active plan, disposition is merged into Gate A composite options; never park silently. Gates use Ask questions per \`.cursor/skills/core/hitl-gates/SKILL.md\` and \`.cursor/rules/hitl-ask-questions.mdc\`. Fallback: numbered list is path 1.
 8. **\`/continue-plan\` waits for yes.** Summarize next \`[to-do-id]\`, then stop until the user confirms before editing.
-9. **\`/run-plan-all\` is a pure orchestrator.** After the confirm queue Ask, dispatch one Task subagent per plan (run the \`/run-plan\` tick contract inside it); never implement to-dos, run tests, or write changelogs in the orchestrator window.
+9. **\`/run-plan-all\` is a pure orchestrator.** After the confirm queue Ask, dispatch one Task subagent per plan (run the \`/run-plan\` tick contract inside it). Do not implement that plan's to-dos in the orchestrator window. When Ship auth is \`per-plan-release\`, this window ships one release after each completed plan and waits until it is Done before the next plan. \`Run plans only\` does not ship. A red public sync stops the queue.
 10. **Backlog CRUD never activates.** \`/backlog-add\` enqueues (Broad Intake + write Ask + plan file + HANDOFF Backlog) without park, activate, or Gate B. \`/backlog-edit\` / \`/backlog-delete\` / \`/backlog-cancel\` require Ask confirm before mutate; delete archives from Backlog, cancel is soft in place. No Field Report cards for routine backlog CRUD.
 11. **HANDOFF machine fields are bullet fields, not \`##\` headings.** Mission Control parses \`- **Plan:**\`, \`- **Backlog plans:**\`, \`- **Parked plans:**\`, \`- **Run queue:**\` (etc.). Canonical Plan: \`- **Plan:** \\\`name.plan.md\\\`\` or \`none\`. Nested backlog/parked rows: \`- \\\`other.plan.md\\\`\`. Never invent \`## Backlog plans\` / \`## Parked plans\` / \`## Run queue\` headings in place of those fields (Checklist / Current mission go empty or idle).
 12. **Plans inventory is index + HANDOFF.** \`/continue-plan\`, \`/run-plan-all\`, and Broad Intake read \`.cursor/context/plan-index.json\` and \`.cursor/HANDOFF.md\` only. Do not glob \`.cursor/plans/*.plan.md\`. Named single-file reads of a known basename remain OK. Delegation stays (ADR \`decisions/2026-07-26_command-orchestration-delegation-pattern.md\`).`;
@@ -7061,19 +7179,11 @@ var NONE_PLACEHOLDERS = /* @__PURE__ */ new Set(["none", "n/a", "empty", "nil"])
 var CURSOR_AWARENESS_SPAWN_TIMEOUT_MS = CHANGELOG_FETCH_TIMEOUT_MS + 3e3;
 async function readFull(filePath) {
   try {
-    return await readFile18(filePath, "utf8");
+    return await readFile19(filePath, "utf8");
   } catch {
     return "";
   }
 }
-async function fileExists2(p) {
-  try {
-    await access7(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
 function isMarkdownTableSeparator(line) {
   const stripped = line.trim();
   if (!stripped.startsWith("|")) return false;
@@ -7135,8 +7245,7 @@ function extractUnprocessedDogfoodLine(line) {
   return raw;
 }
 async function l0Present(root) {
-  const cursor = path29.join(root, ".cursor");
-  return await fileExists2(path29.join(cursor, "agent-kit.json")) || await fileExists2(path29.join(cursor, "commands", "agent-kit-onboard.md")) || await fileExists2(path29.join(cursor, "commands", "start-project.md"));
+  return await fileExists(path31.join(root, MANIFEST_RELATIVE_PATH)) || await fileExists(path31.join(root, ".cursor", "commands", "agent-kit-onboard.md")) || await fileExists(path31.join(root, ".cursor", "commands", "start-project.md"));
 }
 function checkLabelAndRecommendation(check2) {
   const checkId = check2.id;
@@ -7175,10 +7284,10 @@ function unresolvedReadinessChecks(data) {
   return { essential, nonessential };
 }
 async function readinessSection(root) {
-  const snapshotPath = path29.join(root, ".cursor", "context", "readiness.json");
+  const snapshotPath = path31.join(root, READINESS_SNAPSHOT_RELATIVE_PATH);
   let data;
   try {
-    data = JSON.parse(await readFile18(snapshotPath, "utf8"));
+    data = JSON.parse(await readFile19(snapshotPath, "utf8"));
   } catch {
     return null;
   }
@@ -7209,13 +7318,13 @@ Optional readiness item: \`${first.id}\`. ${first.recommendation} This does not
 }
 async function dogfoodInboxSection(root) {
   const candidateReadmes = [
-    path29.join(root, "dogfood", "README.md"),
-    path29.join(root, ".cursor", "dogfood", "README.md")
+    path31.join(root, "dogfood", "README.md"),
+    path31.join(root, ".cursor", "dogfood", "README.md")
   ];
   for (const readme of candidateReadmes) {
-    if (!await fileExists2(readme)) continue;
+    if (!await fileExists(readme)) continue;
     try {
-      const text = await readFile18(readme, "utf8");
+      const text = await readFile19(readme, "utf8");
       if (parseUnprocessedDogfoodItems(text).length) return DOGFOOD_INBOX_HINT;
     } catch {
     }
@@ -7223,18 +7332,13 @@ async function dogfoodInboxSection(root) {
   return null;
 }
 async function loadUpdateCheckPrefs(root) {
-  try {
-    const data = JSON.parse(
-      await readFile18(path29.join(root, ".cursor", "context", "config.json"), "utf8")
-    );
-    const uc = data.updateCheck;
-    if (!uc || typeof uc !== "object" || uc.enabled !== true) {
-      return null;
-    }
-    return uc;
-  } catch {
+  const data = await loadContextConfig(root);
+  if (!data) return null;
+  const uc = data.updateCheck;
+  if (!uc || typeof uc !== "object" || uc.enabled !== true) {
     return null;
   }
+  return uc;
 }
 function runUpdateCheckJson(root) {
   return new Promise((resolve3) => {
@@ -7301,18 +7405,13 @@ async function updateCheckSection(root) {
   return UPDATE_CHECK_NUDGE.replace("{installed}", installed).replace("{latest}", latest);
 }
 async function loadCursorUpdateCheckPrefs(root) {
-  try {
-    const data = JSON.parse(
-      await readFile18(path29.join(root, ".cursor", "context", "config.json"), "utf8")
-    );
-    const uc = data.cursorUpdateCheck;
-    if (!uc || typeof uc !== "object" || uc.enabled !== true) {
-      return null;
-    }
-    return uc;
-  } catch {
+  const data = await loadContextConfig(root);
+  if (!data) return null;
+  const uc = data.cursorUpdateCheck;
+  if (!uc || typeof uc !== "object" || uc.enabled !== true) {
     return null;
   }
+  return uc;
 }
 function runCursorAwarenessJson(root) {
   return new Promise((resolve3) => {
@@ -7447,7 +7546,7 @@ function parseScreenDetachedAuditSessions(listing) {
     const [, pid, name, marker] = m;
     if (!name || !name.startsWith(AUDIT_SESSION_NS_PREFIX)) continue;
     if (marker && /[Aa]ttached/.test(marker)) continue;
-    entries.push({ name, socketPath: sockdir ? path29.join(sockdir, `${pid}.${name}`) : null });
+    entries.push({ name, socketPath: sockdir ? path31.join(sockdir, `${pid}.${name}`) : null });
   }
   return entries;
 }
@@ -7495,8 +7594,8 @@ ${sessions.length} detached \`agent-kit-audit-*\` PTY ${noun} on this host (${ol
   }
 }
 async function buildSessionStartAdditionalContext(rootDir, _payload = {}) {
-  const root = path29.resolve(rootDir);
-  const handoffPath = path29.join(root, ".cursor", "HANDOFF.md");
+  const root = path31.resolve(rootDir);
+  const handoffPath = path31.join(root, HANDOFF_REL);
   const handoffFull = await readFull(handoffPath);
   const handoff = capHandoffExcerpt(handoffFull);
   const parts = [HARD_RULES];
@@ -7563,7 +7662,7 @@ async function runSessionStartHook(cwd, formatArg, deps = {}) {
     const readStdin = deps.readStdin ?? readStdinJson;
     const buildContext = deps.buildContext ?? buildSessionStartAdditionalContext;
     const payload = await readStdin();
-    const root = resolveSessionRoot(payload, path30.resolve(cwd));
+    const root = resolveSessionRoot(payload, path32.resolve(cwd));
     const out = await buildContext(root, payload);
     return formatSessionStartOutput(out.additional_context, format);
   } catch {
@@ -7616,12 +7715,12 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/lifecycle/path-cli.ts
 import { spawn as spawn6 } from "child_process";
-import path32 from "path";
+import path34 from "path";
 
 // src/utils/terminal.ts
 import { readdir as readdir8 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import path31 from "path";
+import path33 from "path";
 import { confirm, isCancel } from "@clack/prompts";
 function isNonInteractive() {
   if (process.env.CI === "true" || process.env.CI === "1") return true;
@@ -7645,14 +7744,14 @@ async function findNestedRepoChildren(resolved) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
     scanned += 1;
-    if (await fileExists(path31.join(resolved, entry.name, ".git"))) {
+    if (await fileExists(path33.join(resolved, entry.name, ".git"))) {
       nested.push(entry.name);
     }
   }
   return nested;
 }
 async function validateProjectRoot(resolved) {
-  const home = path31.resolve(homedir3());
+  const home = path33.resolve(homedir3());
   if (resolved === "/" || resolved === home) {
     return {
       ok: false,
@@ -7660,12 +7759,12 @@ async function validateProjectRoot(resolved) {
       recovery: "Change into a project directory and re-run. Agent Kit installs per project."
     };
   }
-  const hasGit = await fileExists(path31.join(resolved, ".git"));
-  const hasManifest = await fileExists(path31.join(resolved, ".cursor", "agent-kit.json"));
+  const hasGit = await fileExists(path33.join(resolved, ".git"));
+  const hasManifest = await fileExists(path33.join(resolved, MANIFEST_RELATIVE_PATH));
   if (!hasGit && !hasManifest) {
     return {
       ok: false,
-      reason: `Refused ${resolved}: no .git and no .cursor/agent-kit.json.`,
+      reason: `Refused ${resolved}: no .git and no ${MANIFEST_RELATIVE_PATH}.`,
       recovery: [
         "Starting from an empty folder? Pick one of these:",
         "  1. git init          - then re-run. Recommended: readiness and the",
@@ -7694,7 +7793,7 @@ async function validateProjectRoot(resolved) {
   return { ok: true };
 }
 async function confirmProjectRoot(cwd, opts) {
-  const resolved = path31.resolve(cwd);
+  const resolved = path33.resolve(cwd);
   if (opts.forceRoot) {
     return resolved;
   }
@@ -7808,9 +7907,9 @@ function npxPinned(runtimeVersion, subcommand) {
   return `npx -y ${pinnedCliSpec(runtimeVersion)} ${subcommand}`;
 }
 function isBinUnderPrefix(binPath, prefix) {
-  const bin = path32.resolve(binPath);
-  const root = path32.resolve(prefix);
-  return bin === root || bin.startsWith(`${root}${path32.sep}`);
+  const bin = path34.resolve(binPath);
+  const root = path34.resolve(prefix);
+  return bin === root || bin.startsWith(`${root}${path34.sep}`);
 }
 function pathCliStatus(env, runtimeVersion) {
   if (!env.binOnPath || !env.binPath) return "missing";
@@ -7908,17 +8007,17 @@ async function syncPathCliToRuntime(options = {}) {
 }
 
 // src/commands/install.ts
-import path39 from "path";
+import path40 from "path";
 import { defineCommand as defineCommand11 } from "citty";
 import { bold, cyan as cyan3, green as green2, options as koloristOptions2 } from "kolorist";
 
 // src/generator/personalization.ts
 import { readFile as readFile21, writeFile as writeFile12 } from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 
 // src/generator/claude-command-adapters.ts
-import { readFile as readFile19, readdir as readdir9, writeFile as writeFile8 } from "fs/promises";
-import path33 from "path";
+import { readFile as readFile20, readdir as readdir9, writeFile as writeFile9 } from "fs/promises";
+import path35 from "path";
 var CURSOR_COMMANDS_DIR_REL = ".cursor/commands";
 var CLAUDE_COMMANDS_DIR_REL = ".claude/commands";
 var RESERVED_ADAPTER_NAMES = /* @__PURE__ */ new Set(["agent-kit"]);
@@ -7947,7 +8046,7 @@ Adapter rules (Claude Code CLI):
 `;
 }
 async function discoverInstalledCommands(rootDir) {
-  const dir = path33.join(rootDir, CURSOR_COMMANDS_DIR_REL);
+  const dir = path35.join(rootDir, CURSOR_COMMANDS_DIR_REL);
   let entries;
   try {
     entries = (await readdir9(dir)).filter((f) => f.endsWith(".md"));
@@ -7959,7 +8058,7 @@ async function discoverInstalledCommands(rootDir) {
     const name = file.slice(0, -3);
     if (RESERVED_ADAPTER_NAMES.has(name)) continue;
     try {
-      const raw = await readFile19(path33.join(dir, file), "utf8");
+      const raw = await readFile20(path35.join(dir, file), "utf8");
       const parsed = parseCommandFrontmatter(name, raw);
       if (parsed) commands.push(parsed);
     } catch {
@@ -7974,18 +8073,18 @@ async function generateClaudeCommandAdapters(rootDir) {
   const results = [];
   let ledgerDirty = false;
   for (const command of commands) {
-    const relPath = path33.posix.join(CLAUDE_COMMANDS_DIR_REL, `${command.name}.md`);
+    const relPath = path35.posix.join(CLAUDE_COMMANDS_DIR_REL, `${command.name}.md`);
     const rendered = renderClaudeCommandAdapter(command);
-    const abs = path33.join(rootDir, relPath);
+    const abs = path35.join(rootDir, relPath);
     if (!await fileExists(abs)) {
-      await ensureDir(path33.dirname(abs));
-      await writeFile8(abs, rendered, "utf8");
+      await ensureDir(path35.dirname(abs));
+      await writeFile9(abs, rendered, "utf8");
       ledger.hashes[relPath] = contentHash(rendered);
       ledgerDirty = true;
       results.push({ relativePath: relPath, status: "applied" });
       continue;
     }
-    const localContent = await readFile19(abs, "utf8");
+    const localContent = await readFile20(abs, "utf8");
     if (localContent === rendered) {
       if (ledger.hashes[relPath] !== contentHash(rendered)) {
         ledger.hashes[relPath] = contentHash(rendered);
@@ -7998,7 +8097,7 @@ async function generateClaudeCommandAdapters(rootDir) {
       results.push({ relativePath: relPath, status: "preserved-customized" });
       continue;
     }
-    await writeFile8(abs, rendered, "utf8");
+    await writeFile9(abs, rendered, "utf8");
     ledger.hashes[relPath] = contentHash(rendered);
     ledgerDirty = true;
     results.push({ relativePath: relPath, status: "refreshed" });
@@ -8008,8 +8107,8 @@ async function generateClaudeCommandAdapters(rootDir) {
 }
 
 // src/generator/claude-kit-load.ts
-import { writeFile as writeFile9 } from "fs/promises";
-import path34 from "path";
+import { writeFile as writeFile10 } from "fs/promises";
+import path36 from "path";
 var CLAUDE_MD_REL = "CLAUDE.md";
 var AGENT_KIT_COMMAND_REL = ".claude/commands/agent-kit.md";
 function renderClaudeMd() {
@@ -8065,12 +8164,12 @@ Non-goals: not audits / \`/plan-external-review\`, not a second tick dialect (\`
 `;
 }
 async function writeUnlessExists(rootDir, relativePath, content) {
-  const target = path34.join(rootDir, relativePath);
+  const target = path36.join(rootDir, relativePath);
   if (await fileExists(target)) {
     return { relativePath, status: "skipped-customized" };
   }
-  await ensureDir(path34.dirname(target));
-  await writeFile9(target, content, "utf8");
+  await ensureDir(path36.dirname(target));
+  await writeFile10(target, content, "utf8");
   return { relativePath, status: "applied" };
 }
 async function generateClaudeKitLoadArtifacts(rootDir) {
@@ -8080,109 +8179,9 @@ async function generateClaudeKitLoadArtifacts(rootDir) {
   ]);
 }
 
-// src/generator/claude-session-start-hook.ts
-import { readFile as readFile20, writeFile as writeFile10 } from "fs/promises";
-import path35 from "path";
-var CLAUDE_SETTINGS_REL = ".claude/settings.json";
-var RESOLVE_AGENT_KIT_REL = ".cursor/hooks/agent/resolve-agent-kit.sh";
-var SESSION_START_HOOK_MARKER = "hook session-start --format claude";
-var SESSION_START_DEGRADED_TEXT = "Agent Kit hooks are running in degraded fail-open mode: the agent-kit CLI could not be resolved (checked AGENT_KIT_HOOK_BIN, PATH, node_modules/.bin/agent-kit). Slash command adapters still work; session-context injection is inactive. Fix: install the CLI (npm i -D @dadado/agent-kit-cli) or set AGENT_KIT_HOOK_BIN.";
-function buildSessionStartHookCommand() {
-  return `. "\${CLAUDE_PROJECT_DIR}/${RESOLVE_AGENT_KIT_REL}" 2>/dev/null && resolve_agent_kit && exec $AGENT_KIT_RESOLVED hook session-start --format claude; printf '%s' ${shellSingleQuote(SESSION_START_DEGRADED_TEXT)}`;
-}
-function shellSingleQuote(text) {
-  return `'${text.replace(/'/g, "'\\''")}'`;
-}
-function buildSessionStartHookEntry() {
-  return {
-    type: "command",
-    command: buildSessionStartHookCommand(),
-    timeout: 15,
-    statusMessage: "Loading Agent Kit session context"
-  };
-}
-function isPlainObject2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function groupHasMarker(group) {
-  if (!isPlainObject2(group) || !Array.isArray(group.hooks)) return false;
-  return group.hooks.some(
-    (h) => isPlainObject2(h) && typeof h.command === "string" && h.command.includes(SESSION_START_HOOK_MARKER)
-  );
-}
-function mergeSessionStartHookIntoSettings(existingRaw) {
-  const entry = buildSessionStartHookEntry();
-  const newGroup = { hooks: [entry] };
-  let root = {};
-  if (existingRaw !== null && existingRaw.trim() !== "") {
-    try {
-      const parsed = JSON.parse(existingRaw);
-      if (!isPlainObject2(parsed)) throw new Error("root is not an object");
-      root = parsed;
-    } catch {
-      return {
-        content: null,
-        status: "unavailable",
-        instructions: instructionsBlock(entry)
-      };
-    }
-  }
-  const hooks = isPlainObject2(root.hooks) ? { ...root.hooks } : {};
-  const sessionStart = Array.isArray(hooks.SessionStart) ? [...hooks.SessionStart] : [];
-  const existingIndex = sessionStart.findIndex((g) => groupHasMarker(g));
-  let status;
-  if (existingIndex === -1) {
-    sessionStart.push(newGroup);
-    status = "applied";
-  } else {
-    const current = sessionStart[existingIndex];
-    if (JSON.stringify(current) === JSON.stringify(newGroup)) {
-      status = "unchanged";
-    } else {
-      sessionStart[existingIndex] = newGroup;
-      status = "refreshed";
-    }
-  }
-  hooks.SessionStart = sessionStart;
-  root.hooks = hooks;
-  return { content: `${JSON.stringify(root, null, 2)}
-`, status };
-}
-function instructionsBlock(entry) {
-  return [
-    `Could not parse the existing ${CLAUDE_SETTINGS_REL} as JSON, so Agent Kit did not touch it.`,
-    "Add this hook by hand under hooks.SessionStart (create the arrays if they do not exist):",
-    "",
-    JSON.stringify(entry, null, 2)
-  ].join("\n");
-}
-async function writeClaudeSessionStartHook(rootDir) {
-  const abs = path35.join(rootDir, CLAUDE_SETTINGS_REL);
-  let existing = null;
-  try {
-    existing = await readFile20(abs, "utf8");
-  } catch {
-    existing = null;
-  }
-  const merged = mergeSessionStartHookIntoSettings(existing);
-  if (merged.status === "unavailable" || merged.content === null) {
-    return {
-      relativePath: CLAUDE_SETTINGS_REL,
-      status: "unavailable",
-      instructions: merged.instructions
-    };
-  }
-  if (merged.status === "unchanged") {
-    return { relativePath: CLAUDE_SETTINGS_REL, status: "unchanged" };
-  }
-  await ensureDir(path35.dirname(abs));
-  await writeFile10(abs, merged.content, "utf8");
-  return { relativePath: CLAUDE_SETTINGS_REL, status: merged.status };
-}
-
 // src/generator/vscode.ts
 import { writeFile as writeFile11 } from "fs/promises";
-import path36 from "path";
+import path37 from "path";
 
 // src/generator/platform.ts
 function gitProviderLabel(profile) {
@@ -8206,10 +8205,10 @@ function prTerminology(profile) {
 // src/generator/vscode.ts
 async function generateVSCodeArtifacts(profile) {
   const results = [];
-  const vscodeDir = path36.join(profile.rootDir, ".vscode");
-  const githubDir = path36.join(profile.rootDir, ".github");
+  const vscodeDir = path37.join(profile.rootDir, ".vscode");
+  const githubDir = path37.join(profile.rootDir, ".github");
   await Promise.all([ensureDir(vscodeDir), ensureDir(githubDir)]);
-  const settingsPath = path36.join(vscodeDir, "settings.json");
+  const settingsPath = path37.join(vscodeDir, "settings.json");
   if (await fileExists(settingsPath)) {
     results.push({ relativePath: ".vscode/settings.json", status: "skipped-customized" });
   } else {
@@ -8233,7 +8232,7 @@ async function generateVSCodeArtifacts(profile) {
   }
   const provider = gitProviderLabel(profile);
   const prTerm = prTerminology(profile);
-  const copilotPath = path36.join(githubDir, "copilot-instructions.md");
+  const copilotPath = path37.join(githubDir, "copilot-instructions.md");
   if (await fileExists(copilotPath)) {
     results.push({ relativePath: ".github/copilot-instructions.md", status: "skipped-customized" });
   } else {
@@ -8251,7 +8250,7 @@ async function generateVSCodeArtifacts(profile) {
     results.push({ relativePath: ".github/copilot-instructions.md", status: "applied" });
   }
   if (profile.ide.plan === "vscode-pro") {
-    const securityPath = path36.join(vscodeDir, "security-review.agent.md");
+    const securityPath = path37.join(vscodeDir, "security-review.agent.md");
     if (await fileExists(securityPath)) {
       results.push({
         relativePath: ".vscode/security-review.agent.md",
@@ -8463,7 +8462,7 @@ function renderProjectContext(profile, skillItems = []) {
 `;
 }
 async function createOwnedFile(rootDir, relativePath, content, evidence) {
-  const target = path37.join(rootDir, relativePath);
+  const target = path38.join(rootDir, relativePath);
   if (await fileExists(target)) {
     return {
       kind: "file",
@@ -8473,7 +8472,7 @@ async function createOwnedFile(rootDir, relativePath, content, evidence) {
       evidence
     };
   }
-  await ensureDir(path37.dirname(target));
+  await ensureDir(path38.dirname(target));
   await writeFile12(target, content, "utf8");
   return {
     kind: "file",
@@ -8490,7 +8489,7 @@ async function packTargets(registryRoot, packId) {
 async function existingTargets(projectRoot, targets) {
   const checks = await Promise.all(
     targets.map(
-      async (target) => await fileExists(path37.join(projectRoot, target)) ? target : null
+      async (target) => await fileExists(path38.join(projectRoot, target)) ? target : null
     )
   );
   return checks.filter((target) => target !== null);
@@ -8512,14 +8511,14 @@ async function applyPersonalization(input) {
         componentResults.push({ ...item, status: "unavailable" });
         continue;
       }
-      const target = path37.posix.join(
+      const target = path38.posix.join(
         ".cursor",
         "skills",
         skill.path.includes("/core/") ? "core" : "community",
         skill.id,
         "SKILL.md"
       );
-      if (await fileExists(path37.join(input.rootDir, target))) {
+      if (await fileExists(path38.join(input.rootDir, target))) {
         componentResults.push({ ...item, status: "skipped-customized", path: target });
         protectedPaths.add(target);
         continue;
@@ -8664,7 +8663,7 @@ async function applyPersonalization(input) {
     protectedPaths: [...protectedPaths].sort(),
     ...claudeSessionStartInstructions ? { claudeSessionStartInstructions } : {}
   };
-  await writeJson(path37.join(input.rootDir, RESULT_PATH), result);
+  await writeJson(path38.join(input.rootDir, RESULT_PATH), result);
   return {
     result,
     manifest: {
@@ -8682,7 +8681,7 @@ async function applyPersonalization(input) {
   };
 }
 async function readRepositoryProfile(rootDir) {
-  const target = path37.join(rootDir, ".cursor/agent-kit.config.json");
+  const target = path38.join(rootDir, REPOSITORY_PROFILE_REL);
   if (!await fileExists(target)) return null;
   return JSON.parse(await readFile21(target, "utf8"));
 }
@@ -8690,16 +8689,16 @@ async function readRepositoryProfile(rootDir) {
 // src/lifecycle/onboard-migration.ts
 import { createHash as createHash4 } from "crypto";
 import { readFile as readFile22, unlink } from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 var LEGACY_ONBOARD_PATH = ".cursor/commands/onboard.md";
 var NAMESPACED_ONBOARD_PATH = ".cursor/commands/agent-kit-onboard.md";
 var MANAGED_LEGACY_HASHES = /* @__PURE__ */ new Set([
   "b274a68941813f19b185893cb7c5561dff027f53270890029992f208e24992fe"
 ]);
 async function migrateLegacyOnboardCommand(projectRoot, managedHashes = MANAGED_LEGACY_HASHES) {
-  const legacyPath = path38.join(projectRoot, LEGACY_ONBOARD_PATH);
+  const legacyPath = path39.join(projectRoot, LEGACY_ONBOARD_PATH);
   if (!await fileExists(legacyPath)) return "absent";
-  const namespacedPath = path38.join(projectRoot, NAMESPACED_ONBOARD_PATH);
+  const namespacedPath = path39.join(projectRoot, NAMESPACED_ONBOARD_PATH);
   if (!await fileExists(namespacedPath)) return "preserved-customized";
   const content = await readFile22(legacyPath);
   const hash = createHash4("sha256").update(content).digest("hex");
@@ -8751,6 +8750,21 @@ async function syncFromManifest(registryRoot, projectRoot, manifest) {
   return stats;
 }
 
+// src/commands/shared-args.ts
+var NON_INTERACTIVE_ROOT_ARGS = {
+  yes: {
+    type: "boolean",
+    alias: "y",
+    description: "Skip interactive prompts; use defaults (IDE-agnostic non-interactive mode)",
+    default: false
+  },
+  "force-root": {
+    type: "boolean",
+    description: "Bypass the ambiguous-root guard (use with caution)",
+    default: false
+  }
+};
+
 // src/commands/install.ts
 function parsePackList(raw) {
   if (!raw?.trim()) return [];
@@ -8835,7 +8849,7 @@ async function printPostInstallSummary(result) {
   printInstallEpilogue(sync.env, { runtimeVersion: KIT_VERSION });
 }
 async function performInstall(options) {
-  const projectRoot = path39.resolve(options.cwd);
+  const projectRoot = path40.resolve(options.cwd);
   const packs = parsePackList(options.pack);
   const existing = await loadAgentKitManifest(projectRoot);
   const registry = await resolveRegistryFromCli({
@@ -8912,17 +8926,7 @@ var installCommand = defineCommand11({
       type: "string",
       description: `Comma-separated L1 pack ids (e.g. cybersec,devops). Known: ${DOMAIN_PACK_IDS.join(", ")}`
     },
-    yes: {
-      type: "boolean",
-      alias: "y",
-      description: "Skip interactive prompts; use defaults (IDE-agnostic non-interactive mode)",
-      default: false
-    },
-    "force-root": {
-      type: "boolean",
-      description: "Bypass the ambiguous-root guard (use with caution)",
-      default: false
-    },
+    ...NON_INTERACTIVE_ROOT_ARGS,
     claude: {
       type: "boolean",
       description: "Opt-in: generate .claude/commands/*.md thin pointer adapters for the installed .cursor/commands set, and merge a SessionStart context hook into .claude/settings.json (default install behavior is unchanged without this flag)",
@@ -9017,17 +9021,7 @@ var initCommand = defineCommand12({
       description: "Project root directory",
       default: process.cwd()
     },
-    yes: {
-      type: "boolean",
-      alias: "y",
-      description: "Skip interactive prompts; use defaults (IDE-agnostic non-interactive mode)",
-      default: false
-    },
-    "force-root": {
-      type: "boolean",
-      description: "Bypass the ambiguous-root guard (use with caution)",
-      default: false
-    }
+    ...NON_INTERACTIVE_ROOT_ARGS
   },
   async run({ args }) {
     const nonInteractive = args.yes || isNonInteractive();
@@ -9561,8 +9555,8 @@ function renderMcLive(view, opts = {}) {
 
 // src/mission-control/snapshot.ts
 import { execFile as execFile6 } from "child_process";
-import { access as access8 } from "fs/promises";
-import path40 from "path";
+import { access as access7 } from "fs/promises";
+import path41 from "path";
 
 // ../../dashboard/lib/live-refresh.mjs
 import { join, resolve as resolve2 } from "path";
@@ -9594,8 +9588,8 @@ function dataScriptTimeoutMs(env = process.env) {
 async function firstExisting2(candidates) {
   for (const candidate2 of candidates) {
     try {
-      await access8(candidate2);
-      return path40.resolve(candidate2);
+      await access7(candidate2);
+      return path41.resolve(candidate2);
     } catch {
     }
   }
@@ -9604,9 +9598,9 @@ async function firstExisting2(candidates) {
 async function findDashboardDataScript(cwd, env = process.env, options = {}) {
   const startPath = await findDashboardStart(cwd, env, options);
   if (startPath) {
-    const sibling = path40.join(path40.dirname(startPath), "dashboard-data.mjs");
+    const sibling = path41.join(path41.dirname(startPath), "dashboard-data.mjs");
     try {
-      await access8(sibling);
+      await access7(sibling);
       return sibling;
     } catch {
     }
@@ -9619,7 +9613,7 @@ async function loadDashboardSnapshot(opts) {
   const env = opts.env ?? process.env;
   const timeout = dataScriptTimeoutMs(env);
   const run = opts.execFileFn ?? execFile6;
-  const snapshotRoot = path40.resolve(opts.snapshotRoot);
+  const snapshotRoot = path41.resolve(opts.snapshotRoot);
   return new Promise((resolve3) => {
     run(
       process.execPath,
@@ -9942,13 +9936,13 @@ var missionControlCommand = defineCommand13({
 });
 
 // src/commands/monitors.ts
-import path42 from "path";
+import path43 from "path";
 import { defineCommand as defineCommand14 } from "citty";
 
 // src/invariants/monitors-untriaged.ts
 import { execFile as execFile7 } from "child_process";
 import { readFile as readFile23, readdir as readdir10, stat as stat5 } from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 import { promisify as promisify6 } from "util";
 
 // src/invariants/triage-heading.ts
@@ -9989,7 +9983,7 @@ async function gitFreshMonitorNames(rootDir) {
     for (const line of stdout.split("\n")) {
       if (!line.trim()) continue;
       const file = line.slice(3).trim().replace(/^.* -> /, "");
-      const base = path41.basename(file);
+      const base = path42.basename(file);
       if (base.startsWith("plan-monitor-") && base.endsWith(".md")) {
         names.add(base);
       }
@@ -10012,13 +10006,13 @@ function monitorSlugFromName(fileName) {
   return fileName.replace(/^plan-monitor-/, "").replace(/\.md$/, "").toLowerCase();
 }
 async function selectUntriagedMonitors(rootDir) {
-  const root = path41.resolve(rootDir);
-  const memoryDir = path41.join(root, ".cursor", "memory");
+  const root = path42.resolve(rootDir);
+  const memoryDir = path42.join(root, ".cursor", "memory");
   const allNames = await listMonitorFiles(memoryDir);
   const selectionOrder = ["git-fresh", "handoff-aligned", "untriaged-scan"];
   const byName = /* @__PURE__ */ new Map();
   for (const name of allNames) {
-    const abs = path41.join(memoryDir, name);
+    const abs = path42.join(memoryDir, name);
     try {
       const [content, st] = await Promise.all([readFile23(abs, "utf8"), stat5(abs)]);
       byName.set(name, { content, mtimeMs: st.mtimeMs });
@@ -10033,7 +10027,7 @@ async function selectUntriagedMonitors(rootDir) {
   const gitFreshSet = [...gitFresh].filter(untriaged).sort();
   let handoff = "";
   try {
-    handoff = await readFile23(path41.join(root, ".cursor", "HANDOFF.md"), "utf8");
+    handoff = await readFile23(path42.join(root, ".cursor", "HANDOFF.md"), "utf8");
   } catch {
     handoff = "";
   }
@@ -10053,8 +10047,8 @@ async function selectUntriagedMonitors(rootDir) {
     const row = byName.get(name);
     if (!row) continue;
     entries.push({
-      path: path41.join(memoryDir, name),
-      relativePath: path41.relative(root, path41.join(memoryDir, name)).split(path41.sep).join("/"),
+      path: path42.join(memoryDir, name),
+      relativePath: path42.relative(root, path42.join(memoryDir, name)).split(path42.sep).join("/"),
       mtimeMs: row.mtimeMs,
       hasTriageHeading: false,
       hasOpenGaps: hasOpenGaps(row.content),
@@ -10100,7 +10094,7 @@ var monitorsCommand = defineCommand14({
       process.exitCode = 2;
       return;
     }
-    const result = await selectUntriagedMonitors(path42.resolve(args.cwd));
+    const result = await selectUntriagedMonitors(path43.resolve(args.cwd));
     if (args.json) {
       console.log(JSON.stringify(result, null, 2));
       return;
@@ -10116,7 +10110,7 @@ var monitorsCommand = defineCommand14({
 });
 
 // src/commands/plan-index.ts
-import path43 from "path";
+import path44 from "path";
 import { defineCommand as defineCommand15 } from "citty";
 var planIndexCommand = defineCommand15({
   meta: {
@@ -10135,7 +10129,7 @@ var planIndexCommand = defineCommand15({
     }
   },
   async run({ args }) {
-    const root = path43.resolve(args.cwd);
+    const root = path44.resolve(args.cwd);
     const index = await writePlanIndex(root);
     if (args.json) {
       console.log(JSON.stringify(index, null, 2));
@@ -10151,14 +10145,14 @@ var planIndexCommand = defineCommand15({
 });
 
 // src/commands/run-plan.ts
-import path50 from "path";
+import path51 from "path";
 import { defineCommand as defineCommand16 } from "citty";
 
 // src/plan-loop/backends.ts
 import { execFileSync as execFileSync2, spawn as spawn7 } from "child_process";
 import { createWriteStream } from "fs";
-import { access as access9 } from "fs/promises";
-import path44 from "path";
+import { access as access8 } from "fs/promises";
+import path45 from "path";
 import { StringDecoder as StringDecoder3 } from "string_decoder";
 
 // src/plan-loop/hitl-relay.ts
@@ -11186,26 +11180,32 @@ function createRelay(hitl, child, redactedError) {
     }
   };
 }
+function cursorAgentHeadlessArgs(opts) {
+  const args = [
+    "-p",
+    "--force",
+    "--sandbox",
+    "disabled",
+    "--output-format",
+    "stream-json",
+    "--workspace",
+    opts.workspace
+  ];
+  if (opts.model) args.push("--model", opts.model);
+  args.push(opts.prompt);
+  return args;
+}
 var cursorAgentBackend = {
   id: "cursor-agent",
   async resolve() {
     return whichBinary("cursor-agent");
   },
   async run(opts) {
-    const args = [
-      "-p",
-      "--force",
-      "--sandbox",
-      "disabled",
-      "--output-format",
-      "stream-json",
-      "--workspace",
-      opts.workspace
-    ];
-    if (opts.model) {
-      args.push("--model", opts.model);
-    }
-    args.push(opts.prompt);
+    const args = cursorAgentHeadlessArgs({
+      workspace: opts.workspace,
+      prompt: opts.prompt,
+      model: opts.model
+    });
     const env = opts.env ? mergeChildEnv(opts.env) : void 0;
     return spawnLogged("cursor-agent", args, opts.logPath, {
       spawnFn: opts.spawnFn,
@@ -11292,9 +11292,9 @@ function claudeHeadlessArgs(opts = {}) {
 async function missingClaudeAdapter(workspace, prompt) {
   const m = /^\/([A-Za-z0-9][A-Za-z0-9_-]*)/.exec(prompt.trimStart());
   if (!m?.[1]) return null;
-  const rel = path44.join(".claude", "commands", `${m[1]}.md`);
+  const rel = path45.join(".claude", "commands", `${m[1]}.md`);
   try {
-    await access9(path44.join(workspace, rel));
+    await access8(path45.join(workspace, rel));
     return null;
   } catch {
     return rel;
@@ -11417,15 +11417,15 @@ async function detectAgentBackend(requested, whichFn = whichBinary) {
 
 // src/plan-loop/run-loop.ts
 import { mkdir as mkdir6, readFile as readFile27, rm as rm2, unlink as unlink2 } from "fs/promises";
-import path49 from "path";
+import path50 from "path";
 
 // src/mission-control/live-run.ts
 import { readFile as readFile25 } from "fs/promises";
-import path46 from "path";
+import path47 from "path";
 
 // src/plan-loop/plan-state.ts
 import { readFile as readFile24, readdir as readdir11 } from "fs/promises";
-import path45 from "path";
+import path46 from "path";
 function countPendingTodos(raw) {
   const lines = raw.split(/\r?\n/);
   let inFront = 0;
@@ -11453,7 +11453,7 @@ function countPendingTodos(raw) {
 async function findActivePlanFile(plansDir) {
   if (!await fileExists(plansDir)) return null;
   const files = (await readdir11(plansDir)).filter((f) => f.endsWith(".plan.md")).sort();
-  return files[0] ? path45.join(plansDir, files[0]) : null;
+  return files[0] ? path46.join(plansDir, files[0]) : null;
 }
 async function readPlan(planPath) {
   return readFile24(planPath, "utf8");
@@ -11641,7 +11641,7 @@ function firstWord(raw) {
 }
 async function readLiveMission(root, io = defaultMissionIo()) {
   const mission = emptyLiveMission();
-  const handoff = await io.readFile(path46.join(root, ".cursor", "HANDOFF.md")) ?? "";
+  const handoff = await io.readFile(path47.join(root, ".cursor", "HANDOFF.md")) ?? "";
   const named = extractHandoffNamedPlans(handoff);
   mission.mode = firstWord(MODE_RE.exec(handoff)?.[1]);
   let cursorIndex = null;
@@ -11677,13 +11677,13 @@ async function readLiveMission(root, io = defaultMissionIo()) {
       state: finished || cursor !== null && i < cursor ? "done" : i === cursor ? "current" : "pending"
     }));
   }
-  const plansDir = path46.join(root, ".cursor", "plans");
+  const plansDir = path47.join(root, ".cursor", "plans");
   const planBase = (mission.queue && !finished ? mission.queue.current : null) ?? named.active;
-  const planPath = planBase ? path46.join(plansDir, planBase) : await io.findActivePlan(plansDir);
+  const planPath = planBase ? path47.join(plansDir, planBase) : await io.findActivePlan(plansDir);
   if (planPath) {
     const raw = await io.readFile(planPath);
     if (raw !== null) {
-      mission.planFile = path46.basename(planPath);
+      mission.planFile = path47.basename(planPath);
       const { todos } = parsePlanFrontmatter2(raw);
       const open = todos.filter((t) => t.status !== "cancelled");
       mission.todos = {
@@ -11734,7 +11734,7 @@ async function withLiveTui(opts, run) {
     columns,
     now: now2,
     backend: opts.backend,
-    logPath: path46.relative(opts.root, opts.logPath) || opts.logPath
+    logPath: path47.relative(opts.root, opts.logPath) || opts.logPath
   });
   opts.onFeed?.(feed);
   const missionLoader = opts.missionLoader ?? createLiveMissionLoader(opts.root, { now: now2 });
@@ -11871,9 +11871,9 @@ async function withLiveTui(opts, run) {
 
 // src/plan-loop/external-review.ts
 import { spawn as spawn8 } from "child_process";
-import path47 from "path";
-var CANONICAL_REL = path47.join(".cursor", "scripts", "plan-external-review.sh");
-var FALLBACK_REL = path47.join("scripts", "plan-external-review.sh");
+import path48 from "path";
+var CANONICAL_REL = path48.join(".cursor", "scripts", "plan-external-review.sh");
+var FALLBACK_REL = path48.join("scripts", "plan-external-review.sh");
 function isPlanExhaustedReason(reason) {
   const r = reason.trim().toLowerCase();
   if (!r) return false;
@@ -11895,8 +11895,8 @@ async function armExternalPlanReview(root, options = {}) {
   const existsFn = options.existsFn ?? fileExists;
   const log = options.log ?? ((line) => console.log(line));
   const force = options.force === true;
-  const canonicalPath = path47.join(root, CANONICAL_REL);
-  const fallbackPath = path47.join(root, FALLBACK_REL);
+  const canonicalPath = path48.join(root, CANONICAL_REL);
+  const fallbackPath = path48.join(root, FALLBACK_REL);
   let scriptPath = null;
   let scriptRel = CANONICAL_REL;
   if (await existsFn(canonicalPath)) {
@@ -11949,7 +11949,7 @@ async function armExternalPlanReview(root, options = {}) {
 }
 
 // src/plan-loop/persona-banners.ts
-import path48 from "path";
+import path49 from "path";
 import {
   blue,
   cyan as cyan4,
@@ -11985,7 +11985,7 @@ function resolveColor(name, fallback) {
 async function resolveCliPersonaId(root) {
   try {
     const cfg = await readJson(
-      path48.join(root, ".cursor", "context", "config.json")
+      path49.join(root, ".cursor", "context", "config.json")
     );
     const modes = cfg?.agentPersona?.modes ?? cfg?.workspaceSkin?.modes;
     const id = modes?.[CLI_RUN_PLAN_MODE];
@@ -11996,7 +11996,7 @@ async function resolveCliPersonaId(root) {
 }
 async function loadPersonaPack(root, personaId) {
   try {
-    const personaPath = path48.join(root, "registry", "personas", "core", personaId, "persona.json");
+    const personaPath = path49.join(root, "registry", "personas", "core", personaId, "persona.json");
     const pack = await readJson(personaPath);
     if (!pack || typeof pack.id !== "string") return null;
     return pack;
@@ -12175,9 +12175,9 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 async function runPlanLoop(opts) {
-  const plansDir = path49.join(opts.root, ".cursor", "plans");
-  const stopFile = path49.join(opts.root, ".cursor", "loop.stop");
-  const logDir = path49.join(opts.root, ".cursor", "loop-logs");
+  const plansDir = path50.join(opts.root, ".cursor", "plans");
+  const stopFile = path50.join(opts.root, ".cursor", "loop.stop");
+  const logDir = path50.join(opts.root, ".cursor", "loop-logs");
   const planPath = await findActivePlanFile(plansDir);
   if (!planPath) {
     logger.error("No active plan in .cursor/plans/");
@@ -12198,7 +12198,7 @@ async function runPlanLoop(opts) {
   try {
     const persona = await loadCliRunPlanPersona(opts.root);
     const banners = createPersonaBannerPrinter(persona);
-    console.log(`Active plan: ${path49.basename(planPath)}`);
+    console.log(`Active plan: ${path50.basename(planPath)}`);
     console.log(`Pending to-dos: ${await pending()} | max ticks: ${opts.maxTicks}`);
     console.log(`Backend: ${opts.backend.id}`);
     if (persona) {
@@ -12242,8 +12242,8 @@ async function runPlanLoop(opts) {
         planExhausted = true;
         break;
       }
-      const logPath = path49.join(logDir, `tick-${stamp()}.log`);
-      const relLog = path49.relative(opts.root, logPath);
+      const logPath = path50.join(logDir, `tick-${stamp()}.log`);
+      const relLog = path50.relative(opts.root, logPath);
       console.log("");
       const tickLine = `=== tick ${tick}/${opts.maxTicks} - pending: ${before} - log: ${relLog} ===`;
       if (banners) banners.tickStart(tickLine);
@@ -12351,7 +12351,7 @@ async function runPlanLoop(opts) {
     const finishDetail = `after ${tick} tick(s); pending: ${pendingNow}`;
     if (banners) banners.phaseComplete(finishDetail);
     console.log(
-      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path49.relative(opts.root, logDir)}/`
+      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path50.relative(opts.root, logDir)}/`
     );
     if (planExhausted || shouldArmExternalPlanReview({ pending: pendingNow, stopReason })) {
       await armExternalPlanReview(opts.root);
@@ -12443,7 +12443,7 @@ var runPlanCommand = defineCommand16({
       return;
     }
     const code = await runPlanLoop({
-      root: path50.resolve(args.cwd),
+      root: path51.resolve(args.cwd),
       maxTicks,
       sleepSeconds,
       model: args.model ? String(args.model) : void 0,
@@ -12458,12 +12458,12 @@ var runPlanCommand = defineCommand16({
 
 // src/commands/run.ts
 import { homedir as homedir4 } from "os";
-import path52 from "path";
+import path53 from "path";
 import { defineCommand as defineCommand17 } from "citty";
 
 // src/plan-loop/dispatch.ts
 import { mkdir as mkdir7, readFile as readFile28 } from "fs/promises";
-import path51 from "path";
+import path52 from "path";
 var RUN_CATALOG = [
   "run-plan",
   "run-plan-all",
@@ -12477,7 +12477,7 @@ var RUN_CATALOG = [
   "kit-staging"
 ];
 var FIRST_CLASS_SLASH_COMMANDS = ["run-plan", "run-plan-all"];
-var RUN_PROMOTE_BLOCKED = ["git-prod", "kit-prod"];
+var RUN_PROMOTE_BLOCKED = RESERVED_GATE_IDS;
 function normalizeSlashName(raw) {
   return raw.replace(/^\//, "").replace(/\.md$/i, "").trim();
 }
@@ -12507,7 +12507,7 @@ function rewriteRootArgvToRun(argv) {
   return next;
 }
 function commandMarkdownPath(root, name) {
-  return path51.join(root, ".cursor", "commands", `${normalizeSlashName(name)}.md`);
+  return path52.join(root, ".cursor", "commands", `${normalizeSlashName(name)}.md`);
 }
 function buildDispatchPrompt(commandBody) {
   return [
@@ -12541,19 +12541,7 @@ function stamp2() {
   return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}${p(d.getMilliseconds(), 3)}`;
 }
 function cursorAgentDispatchArgs(opts) {
-  const args = [
-    "-p",
-    "--force",
-    "--sandbox",
-    "disabled",
-    "--output-format",
-    "stream-json",
-    "--workspace",
-    opts.workspace
-  ];
-  if (opts.model) args.push("--model", opts.model);
-  args.push(opts.prompt);
-  return args;
+  return cursorAgentHeadlessArgs(opts);
 }
 function claudeDispatchArgs(opts = {}) {
   return claudeHeadlessArgs(opts);
@@ -12607,20 +12595,20 @@ async function runHeadlessDispatch(opts) {
   });
 }
 async function ensureDispatchLogPath(root) {
-  const logDir = path51.join(root, ".cursor", "loop-logs");
+  const logDir = path52.join(root, ".cursor", "loop-logs");
   await mkdir7(logDir, { recursive: true });
-  return path51.join(logDir, `run-${stamp2()}.log`);
+  return path52.join(logDir, `run-${stamp2()}.log`);
 }
 
 // src/commands/run.ts
 function displayPath(target, home = homedir4()) {
-  const resolvedHome = path52.resolve(home);
+  const resolvedHome = path53.resolve(home);
   if (target === resolvedHome) return "~";
-  const prefix = resolvedHome.endsWith(path52.sep) ? resolvedHome : `${resolvedHome}${path52.sep}`;
-  return target.startsWith(prefix) ? `~${path52.sep}${target.slice(prefix.length)}` : target;
+  const prefix = resolvedHome.endsWith(path53.sep) ? resolvedHome : `${resolvedHome}${path53.sep}`;
+  return target.startsWith(prefix) ? `~${path53.sep}${target.slice(prefix.length)}` : target;
 }
 async function executeRun(input) {
-  const root = path52.resolve(input.cwd);
+  const root = path53.resolve(input.cwd);
   const slash = normalizeSlashName(input.slash);
   if (!slash) {
     return { exitCode: 1, error: "Provide a slash: agent-kit run <slash>" };
@@ -12671,7 +12659,7 @@ async function executeRun(input) {
     const stdout = [
       "--dry-run: no agent will be started.",
       `Slash: ${slash}`,
-      `Command file: ${path52.relative(root, file.path)}`,
+      `Command file: ${path53.relative(root, file.path)}`,
       `Backend: ${detected.id} (${displayPath(detected.bin)})`,
       "Prompt:",
       prompt
@@ -12680,8 +12668,8 @@ async function executeRun(input) {
   }
   const logPath = await ensureDispatchLogPath(root);
   console.log(`Dispatch: ${slash} via ${detected.id}`);
-  console.log(`Command file: ${path52.relative(root, file.path)}`);
-  console.log(`Log: ${path52.relative(root, logPath)}`);
+  console.log(`Command file: ${path53.relative(root, file.path)}`);
+  console.log(`Log: ${path53.relative(root, logPath)}`);
   try {
     const dispatch = {
       backendId: detected.id,
@@ -12838,7 +12826,7 @@ var scanCommand = defineCommand18({
 import { spawn as spawn9 } from "child_process";
 import { appendFile as appendFile2, mkdir as mkdir8, readFile as readFile29, writeFile as writeFile13 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import path53 from "path";
+import path54 from "path";
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
 import { defineCommand as defineCommand19 } from "citty";
 import { cyan as cyan5, green as green4, yellow as yellow3 } from "kolorist";
@@ -12847,9 +12835,9 @@ var SETUP_GLOBAL_MARKER = "# agent-kit setup-global";
 function planSetupGlobalSteps(env, options = {}) {
   const homeDir = options.homeDir ?? homedir5();
   const packageSpec = options.packageSpec ?? pinnedCliSpec();
-  const npmGlobalDir = path53.join(homeDir, NPM_GLOBAL_DIR_NAME);
-  const npmGlobalBin = path53.join(npmGlobalDir, "bin");
-  const npmrcPath = path53.join(homeDir, ".npmrc");
+  const npmGlobalDir = path54.join(homeDir, NPM_GLOBAL_DIR_NAME);
+  const npmGlobalBin = path54.join(npmGlobalDir, "bin");
+  const npmrcPath = path54.join(homeDir, ".npmrc");
   const npmrcPrefixValue = `~/${NPM_GLOBAL_DIR_NAME}`;
   const pathExportLine = `export PATH="${npmGlobalBin}:$PATH"`;
   const shellProfile = env.shellProfile;
@@ -13148,7 +13136,7 @@ var setupGlobalCommand = defineCommand19({
 });
 
 // src/commands/status.ts
-import path54 from "path";
+import path55 from "path";
 import { defineCommand as defineCommand20 } from "citty";
 function profileStatus(profile) {
   if (!profile) return { origin: "none", evidence: [], profile: null };
@@ -13179,11 +13167,11 @@ var statusCommand = defineCommand20({
     }
   },
   async run({ args }) {
-    const rootDir = path54.resolve(args.cwd);
+    const rootDir = path55.resolve(args.cwd);
     const [manifest, rawProfile, scan, env] = await Promise.all([
       loadAgentKitManifest(rootDir),
       readJson(
-        path54.join(rootDir, ".cursor", "agent-kit.config.json")
+        path55.join(rootDir, ".cursor", "agent-kit.config.json")
       ),
       runScanner(rootDir),
       assessEnvironment()
@@ -13291,17 +13279,7 @@ var updateCommand = defineCommand21({
       description: "Apply even when this CLI is older than the registry it is syncing from; the manifest is then stamped with this CLI's version, not the registry's (factory/dev only)",
       default: false
     },
-    yes: {
-      type: "boolean",
-      alias: "y",
-      description: "Skip interactive prompts; use defaults (IDE-agnostic non-interactive mode)",
-      default: false
-    },
-    "force-root": {
-      type: "boolean",
-      description: "Bypass the ambiguous-root guard (use with caution)",
-      default: false
-    },
+    ...NON_INTERACTIVE_ROOT_ARGS,
     ...REGISTRY_CLI_ARGS
   },
   async run({ args }) {
@@ -13429,7 +13407,7 @@ ${err.recovery}
 
 // src/commands/validate.ts
 import { readFile as readFile30 } from "fs/promises";
-import path55 from "path";
+import path56 from "path";
 import { defineCommand as defineCommand22 } from "citty";
 
 // src/invariants/plan-schema.ts
@@ -13476,7 +13454,7 @@ function validatePlanFrontmatterText(text) {
 // src/commands/validate.ts
 async function resolveEditedPath(cwd, explicit) {
   if (explicit) {
-    const filePath2 = path55.resolve(cwd, explicit);
+    const filePath2 = path56.resolve(cwd, explicit);
     try {
       return { filePath: filePath2, content: await readFile30(filePath2, "utf8") };
     } catch {
@@ -13486,7 +13464,7 @@ async function resolveEditedPath(cwd, explicit) {
   const payload = await readStdinJson();
   const rel = typeof payload.file_path === "string" && payload.file_path || typeof payload.path === "string" && payload.path || typeof payload.file === "string" && payload.file || "";
   if (!rel) return null;
-  const filePath = path55.isAbsolute(rel) ? rel : path55.resolve(cwd, rel);
+  const filePath = path56.isAbsolute(rel) ? rel : path56.resolve(cwd, rel);
   try {
     return { filePath, content: await readFile30(filePath, "utf8") };
   } catch {
@@ -13516,7 +13494,7 @@ var validateCommand = defineCommand22({
       async run({ args }) {
         const cwd = typeof args.cwd === "string" ? args.cwd : process.cwd();
         const fileArg = typeof args.file === "string" ? args.file : void 0;
-        const filePath = fileArg ? path55.resolve(cwd, fileArg) : path55.join(path55.resolve(cwd), ".cursor", "HANDOFF.md");
+        const filePath = fileArg ? path56.resolve(cwd, fileArg) : path56.join(path56.resolve(cwd), ".cursor", "HANDOFF.md");
         let content = "";
         try {
           content = await readFile30(filePath, "utf8");
@@ -13549,7 +13527,7 @@ var validateCommand = defineCommand22({
           process.exitCode = 2;
           return;
         }
-        const filePath = path55.resolve(cwd, fileArg);
+        const filePath = path56.resolve(cwd, fileArg);
         let content = "";
         try {
           content = await readFile30(filePath, "utf8");
@@ -13571,7 +13549,7 @@ var validateCommand = defineCommand22({
       },
       async run({ args }) {
         const cwd = typeof args.cwd === "string" ? args.cwd : process.cwd();
-        const resolved = await resolveEditedPath(path55.resolve(cwd));
+        const resolved = await resolveEditedPath(path56.resolve(cwd));
         if (!resolved) {
           console.log(JSON.stringify({}));
           return;