@event4u/agent-config 16.1.0 → 16.3.0

package/dist/cli-delegate/{chunk-HDVVGPQW.js → chunk-RQNNW7IF.js}

@@ -2,20 +2,17 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   ZodFirstPartyTypeKind,
   settingsSchema
-} from "./chunk-UNCRJBT3.js";
+} from "./chunk-JQVYKIZA.js";
 import {
   main
-} from "./chunk-6KFEC3G7.js";
+} from "./chunk-CQWX336L.js";
 import {
+  GLOBAL_DEPLOY_SOURCES,
   RULE_SOURCE_REL
 } from "./chunk-WOKWX5PL.js";
-import {
-  classifyOwnership,
-  recordedHashesForRoot
-} from "./chunk-YDPILCOL.js";
 import {
   appendTxLog
-} from "./chunk-5R7HOLAF.js";
+} from "./chunk-NYX3L2PZ.js";
 import {
   SCOPE_DETECT_AI_DIRS,
   SCOPE_DETECT_MANIFESTS
@@ -31,8 +28,12 @@ import {
   reap_stale,
   reap_tagged_orphans,
   record_deploy,
+  recorded_rel_files,
   save_inventory
-} from "./chunk-6KM6ORRY.js";
+} from "./chunk-S4YWNRKO.js";
+import {
+  write_managed_block
+} from "./chunk-ULQRUR23.js";
 import {
   check_version,
   classify_mismatch,
@@ -56,19 +57,31 @@ import {
   ruleScopeFromSettings
 } from "./chunk-DMSZHXZS.js";
 import {
+  HOOK_SIGNATURES,
+  deepMerge,
+  isManagedEntry,
+  isPlainObject,
+  jsonEqual,
+  mergeHostConfig
+} from "./chunk-DEIV7XP7.js";
+import {
+  NO_RECORDED_HASHES,
   ScopeMismatchError,
+  classifyOwnership,
   manifest_path,
+  readRecordedHashes,
   read_manifest,
+  recordedHashesForRoot,
   upsert_tool,
   write_manifest
-} from "./chunk-4E2W63DA.js";
+} from "./chunk-OKJUIAPS.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
 import {
   find_project_root_with_anchor,
   load_agent_settings
-} from "./chunk-FC75PGJE.js";
+} from "./chunk-JY2I2DXV.js";
 import {
   event4u_root,
   legacy_xdg_root,
@@ -181,6 +194,7 @@ function _is_plain_object(value) {
 function collect_pointers(overlay, options = {}) {
   const prefix = options.prefix ?? "";
   const include_arrays = options.include_arrays ?? true;
+  const entry_signature = options.entry_signature ?? "";
   const entries = [];
   for (const [key, value] of Object.entries(overlay)) {
     const pointer = `${prefix}/${_escape_segment(String(key))}`;
@@ -189,14 +203,26 @@ function collect_pointers(overlay, options = {}) {
         entries.push({ json_pointer: pointer, value_hash: null });
       } else {
         entries.push(
-          ...collect_pointers(value, { prefix: pointer, include_arrays })
+          ...collect_pointers(value, {
+            prefix: pointer,
+            include_arrays,
+            entry_signature
+          })
         );
       }
     } else if (Array.isArray(value)) {
-      entries.push({
-        json_pointer: pointer,
-        value_hash: include_arrays ? value_hash(value) : null
-      });
+      if (entry_signature !== "" && pointer.startsWith("/hooks/")) {
+        entries.push({
+          json_pointer: pointer,
+          value_hash: null,
+          entry_signature
+        });
+      } else {
+        entries.push({
+          json_pointer: pointer,
+          value_hash: include_arrays ? value_hash(value) : null
+        });
+      }
     } else {
       entries.push({ json_pointer: pointer, value_hash: null });
     }
@@ -207,11 +233,14 @@ function collect_pointers(overlay, options = {}) {
   return entries;
 }
 function build_merge_entries(file_label, overlay) {
-  const pointers = collect_pointers(overlay);
+  const pointers = collect_pointers(overlay, {
+    entry_signature: HOOK_SIGNATURES[file_label] ?? ""
+  });
   return pointers.map((entry) => ({
     file: file_label,
     json_pointer: entry.json_pointer,
-    value_hash: entry.value_hash
+    value_hash: entry.value_hash,
+    ...entry.entry_signature === void 0 ? {} : { entry_signature: entry.entry_signature }
   }));
 }
 function _split_segments(pointer) {
@@ -251,7 +280,33 @@ function subtract_pointers(doc, entries) {
       continue;
     }
     const [parent, leaf] = nav;
-    if (expected !== null) {
+    const signature = entry.entry_signature ?? "";
+    if (signature !== "") {
+      const current = parent[leaf];
+      if (!Array.isArray(current)) {
+        warnings.push({
+          pointer,
+          reason: "missing",
+          expected_hash: null,
+          actual_hash: null
+        });
+        continue;
+      }
+      const kept = current.filter((item) => !isManagedEntry(item, signature));
+      if (kept.length === current.length) {
+        warnings.push({
+          pointer,
+          reason: "missing",
+          expected_hash: null,
+          actual_hash: null
+        });
+        continue;
+      }
+      if (kept.length > 0) {
+        parent[leaf] = kept;
+        continue;
+      }
+    } else if (expected !== null) {
       const actual = value_hash(parent[leaf]);
       if (actual !== expected) {
         warnings.push({
@@ -283,11 +338,89 @@ function subtract_pointers(doc, entries) {
 // src/scripts/install.ts
 import { spawn, spawnSync } from "node:child_process";
 import * as crypto5 from "node:crypto";
-import * as fs14 from "node:fs";
-import * as os3 from "node:os";
-import * as path12 from "node:path";
+import * as fs20 from "node:fs";
+import * as os6 from "node:os";
+import * as path20 from "node:path";
 import process2 from "node:process";
-import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+import { fileURLToPath as fileURLToPath4, pathToFileURL } from "node:url";
+
+// src/scripts/_lib/reserved_name_sweep.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+function sweepReservedNames(commandsDir, currentFiles, isBuiltinName, recordedFiles) {
+  const reserved = [];
+  const foreign = [];
+  let entries = [];
+  try {
+    entries = fs.readdirSync(commandsDir).filter((f) => f.endsWith(".md"));
+  } catch {
+    return { reserved, foreign };
+  }
+  for (const fname of entries.sort()) {
+    const slug = fname.slice(0, -".md".length);
+    if (!isBuiltinName(slug)) continue;
+    const rel = `commands/${fname}`;
+    const ours = currentFiles.has(rel) || recordedFiles.has(rel);
+    if (!ours) {
+      foreign.push(slug);
+      continue;
+    }
+    fs.rmSync(path.join(commandsDir, fname), { force: true });
+    currentFiles.delete(rel);
+    reserved.push(slug);
+  }
+  return { reserved, foreign };
+}
+
+// src/scripts/_lib/host_env_write.ts
+var YAML = __toESM(require_dist(), 1);
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+var WRITABLE_HOST_ENV = [
+  { variable: "BASH_MAX_OUTPUT_LENGTH", settingsKey: "bash_max_output_length" },
+  { variable: "MAX_MCP_OUTPUT_TOKENS", settingsKey: "max_mcp_output_tokens" }
+];
+var SETTINGS_CANDIDATES = [
+  ["agents", "settings", ".agent-settings.yml"],
+  [".agent-settings.yml"]
+];
+function readSettingsDoc(projectRoot) {
+  for (const parts of SETTINGS_CANDIDATES) {
+    const p = path2.join(projectRoot, ...parts);
+    let text;
+    try {
+      text = fs2.readFileSync(p, "utf-8");
+    } catch {
+      continue;
+    }
+    let doc;
+    try {
+      doc = YAML.parse(text, { version: "1.1" });
+    } catch {
+      return null;
+    }
+    return doc === null || doc === void 0 || typeof doc !== "object" ? null : doc;
+  }
+  return null;
+}
+function hostEnvBlock(settings) {
+  const root = settings;
+  const he = root?.["host_environment"];
+  const caps = he?.["request_size_caps"];
+  if (caps === void 0) return null;
+  const out = {};
+  for (const { variable, settingsKey } of WRITABLE_HOST_ENV) {
+    const v = caps[settingsKey];
+    if (typeof v === "number" && Number.isInteger(v) && v > 0) out[variable] = String(v);
+  }
+  return Object.keys(out).length === 0 ? null : out;
+}
+function withHostEnv(bridge, projectRoot, announce) {
+  const env = hostEnvBlock(readSettingsDoc(projectRoot));
+  if (env === null) return bridge;
+  announce(`.claude/settings.json: wrote ${Object.keys(env).join(", ")} (request-size caps)`);
+  return { ...bridge, env };
+}
 
 // src/scripts/_lib/json_python_parity.ts
 function jsonStrNoAscii(s) {
@@ -497,8 +630,8 @@ function is_claude_builtin_name(slug) {
 }
 
 // src/scripts/_lib/mcp_bridge.ts
-import * as fs from "node:fs";
-import * as path from "node:path";
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
 var MCP_SERVER_KEY = "agent-config";
 var MCP_PACKAGE_NAME = "@event4u/agent-config";
 function mcpBridgeEntry(packageRoot) {
@@ -515,7 +648,7 @@ function mcpBridgeEntry(packageRoot) {
 }
 function readPackageVersion(packageRoot) {
   try {
-    const raw = fs.readFileSync(path.join(packageRoot, "package.json"), "utf-8");
+    const raw = fs3.readFileSync(path3.join(packageRoot, "package.json"), "utf-8");
     const v = JSON.parse(raw).version;
     return typeof v === "string" && v.trim() !== "" ? v : null;
   } catch {
@@ -524,7 +657,7 @@ function readPackageVersion(packageRoot) {
 }
 function makeEnsureMcpBridge(mergeJsonFile) {
   return (projectRoot, force, packageRoot = projectRoot) => mergeJsonFile(
-    path.join(projectRoot, ".mcp.json"),
+    path3.join(projectRoot, ".mcp.json"),
     mcpBridgeEntry(packageRoot),
     force,
     ".mcp.json"
@@ -550,7 +683,7 @@ function makeEnsureMcpRegistrations(mergeJsonFile) {
     const merged = {};
     for (const t of targets) {
       merged[t.toolId] = mergeJsonFile(
-        path.join(projectRoot, ...t.relPath.split("/")),
+        path3.join(projectRoot, ...t.relPath.split("/")),
         mcpBridgeEntry(packageRoot),
         force,
         t.relPath
@@ -581,10 +714,10 @@ function projectionModeOf(raw) {
   return raw === "scoped" ? "scoped" : raw === "tiered" ? "tiered" : "legacy-all";
 }
 function resolveTierB(packageRoot) {
-  const p = path.join(packageRoot, "agents", "runtime", "state", "skill-tiers.json");
-  if (!fs.existsSync(p)) return null;
+  const p = path3.join(packageRoot, "agents", "runtime", "state", "skill-tiers.json");
+  if (!fs3.existsSync(p)) return null;
   try {
-    const parsed = JSON.parse(fs.readFileSync(p, "utf-8"));
+    const parsed = JSON.parse(fs3.readFileSync(p, "utf-8"));
     if (!Array.isArray(parsed.tier_b)) return null;
     return new Set(parsed.tier_b.filter((n) => typeof n === "string"));
   } catch {
@@ -592,7 +725,7 @@ function resolveTierB(packageRoot) {
   }
 }
 function tierBPrunePredicate(tierB) {
-  return (mdPath) => tierB.has(path.basename(path.dirname(mdPath)));
+  return (mdPath) => tierB.has(path3.basename(path3.dirname(mdPath)));
 }
 function tierBAdvisory(packageRoot) {
   const tierB = resolveTierB(packageRoot);
@@ -621,35 +754,35 @@ function applyTieredPrune(deployResults, packageRoot, pruneBy) {
 
 // src/install/conflictTracker.ts
 import * as crypto2 from "node:crypto";
-import * as fs3 from "node:fs";
-import * as path3 from "node:path";
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
 
 // src/install/fsPrimitives.ts
 import * as crypto from "node:crypto";
-import * as fs2 from "node:fs";
-import * as path2 from "node:path";
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
 function resolvePath(p) {
   try {
-    return fs2.realpathSync(path2.resolve(p));
+    return fs4.realpathSync(path4.resolve(p));
   } catch {
-    return path2.resolve(p);
+    return path4.resolve(p);
   }
 }
 function pathExists(p) {
   try {
-    fs2.statSync(p);
+    fs4.statSync(p);
     return true;
   } catch {
     return false;
   }
 }
 function mkdirp(p) {
-  fs2.mkdirSync(p, { recursive: true });
+  fs4.mkdirSync(p, { recursive: true });
 }
 function sha256OfFile(p) {
   let data;
   try {
-    data = fs2.readFileSync(p);
+    data = fs4.readFileSync(p);
   } catch {
     return null;
   }
@@ -690,20 +823,20 @@ function createConflictTracker(host) {
   function recordedHashFor(target) {
     if (conflictState.root === null) return void 0;
     conflictState.recorded ??= recordedHashesForRoot(conflictState.root);
-    const plain = path3.resolve(target);
+    const plain = path5.resolve(target);
     if (conflictState.recorded.has(plain)) return conflictState.recorded.get(plain);
     const real = resolvePath(target);
     return real === plain ? void 0 : conflictState.recorded.get(real);
   }
   function stageInto(target, sidecar, produce) {
-    mkdirp(path3.dirname(sidecar));
-    const tmp = path3.join(
-      path3.dirname(sidecar),
-      `.${path3.basename(sidecar)}.${process.pid}.${crypto2.randomBytes(6).toString("hex")}${path3.extname(target)}`
+    mkdirp(path5.dirname(sidecar));
+    const tmp = path5.join(
+      path5.dirname(sidecar),
+      `.${path5.basename(sidecar)}.${process.pid}.${crypto2.randomBytes(6).toString("hex")}${path5.extname(target)}`
     );
     const discard = () => {
       try {
-        fs3.unlinkSync(tmp);
+        fs5.unlinkSync(tmp);
       } catch {
       }
     };
@@ -730,7 +863,7 @@ function createConflictTracker(host) {
       }
     }
     try {
-      fs3.renameSync(tmp, sidecar);
+      fs5.renameSync(tmp, sidecar);
     } catch (exc) {
       discard();
       host.fail(
@@ -779,7 +912,7 @@ function createConflictTracker(host) {
     preserve(target, source, packageRoot) {
       const sidecar = sidecarPathFor(target);
       stageInto(target, sidecar, (tmp) => {
-        fs3.copyFileSync(source, tmp);
+        fs5.copyFileSync(source, tmp);
         host.tagDeployed(tmp, source, packageRoot);
       });
       record(target, sidecar);
@@ -795,7 +928,7 @@ function createConflictTracker(host) {
      */
     preserveContent(target, content) {
       const sidecar = sidecarPathFor(target);
-      stageInto(target, sidecar, (tmp) => fs3.writeFileSync(tmp, content, "utf-8"));
+      stageInto(target, sidecar, (tmp) => fs5.writeFileSync(tmp, content, "utf-8"));
       record(target, sidecar);
     },
     /**
@@ -814,10 +947,10 @@ function createConflictTracker(host) {
 }
 
 // src/install/manifestFiles.ts
-var YAML = __toESM(require_dist(), 1);
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+var YAML2 = __toESM(require_dist(), 1);
+import { existsSync as existsSync2, readFileSync as readFileSync4 } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, join as join3, resolve as resolve3 } from "node:path";
+import { isAbsolute, join as join5, resolve as resolve3 } from "node:path";
 function fileEntry(p, kind, hashContent) {
   return { path: p, kind, sha256: hashContent ? sha256OfFile(p) : null };
 }
@@ -840,7 +973,7 @@ function filesByToolFromBridges(tools, projectRoot, scope, bridgeMarker) {
   for (const toolId of [...tools].sort()) {
     const marker = bridgeMarker(toolId, scope);
     if (!marker) continue;
-    const markerPath = isAbsolute(marker) ? marker : join3(projectRoot, marker);
+    const markerPath = isAbsolute(marker) ? marker : join5(projectRoot, marker);
     out[toolId] = [fileEntry(markerPath, "bridge", false)];
   }
   return out;
@@ -848,7 +981,7 @@ function filesByToolFromBridges(tools, projectRoot, scope, bridgeMarker) {
 function expanduser(p) {
   if (p === "~") return homedir();
   if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
-    return join3(homedir(), p.slice(2));
+    return join5(homedir(), p.slice(2));
   }
   return p;
 }
@@ -861,7 +994,7 @@ function readRecordedByTool(manifestPath, projectRoot) {
   if (!existsSync2(manifestPath)) return out;
   let doc;
   try {
-    doc = YAML.parse(readFileSync3(manifestPath, "utf8"));
+    doc = YAML2.parse(readFileSync4(manifestPath, "utf8"));
   } catch {
     return out;
   }
@@ -940,8 +1073,9 @@ function preservedIndex(preservedTargets, staged) {
 }
 
 // src/scripts/_lib/rule_layer_overlap.ts
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
+import * as fs6 from "node:fs";
+import * as os from "node:os";
+import * as path6 from "node:path";
 var INSTALLER_PROVENANCE_KEYS = ["package", "source_path"];
 function stripProvenance(text) {
   const lines = text.split("\n");
@@ -992,17 +1126,23 @@ function compareLayers(global_layer, project_layer) {
     redundant_chars
   };
 }
+function hostRuleLayerDirs(projectRoot) {
+  return [
+    path6.join(os.homedir(), ".claude", "rules"),
+    path6.join(projectRoot, ".claude", "rules")
+  ];
+}
 function readRuleLayer(dir) {
   let names;
   try {
-    names = fs4.readdirSync(dir);
+    names = fs6.readdirSync(dir);
   } catch {
     return null;
   }
   const files = /* @__PURE__ */ new Map();
   for (const name of names.filter((n) => n.endsWith(".md")).sort()) {
     try {
-      files.set(name, fs4.readFileSync(path4.join(dir, name), "utf-8"));
+      files.set(name, fs6.readFileSync(path6.join(dir, name), "utf-8"));
     } catch {
       continue;
     }
@@ -1010,7 +1150,7 @@ function readRuleLayer(dir) {
   return { dir, files };
 }
 function claudeMdExcludesGlob(dir) {
-  return `${path4.resolve(dir).replace(/\/+$/, "")}/**`;
+  return `${path6.resolve(dir).replace(/\/+$/, "")}/**`;
 }
 function mergeClaudeMdExcludes(existing, entry) {
   if (!Array.isArray(existing)) return [entry];
@@ -1041,25 +1181,25 @@ function decideLayerAction(report, choice, global_dir, project_dir) {
 // src/scripts/_lib/install_drift.ts
 var import_yaml = __toESM(require_dist(), 1);
 import * as crypto3 from "node:crypto";
-import * as fs5 from "node:fs";
-import * as os from "node:os";
-import * as path5 from "node:path";
+import * as fs7 from "node:fs";
+import * as os2 from "node:os";
+import * as path7 from "node:path";
 function expanduser2(p) {
   if (p === "~") {
-    return os.homedir();
+    return os2.homedir();
   }
   if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
-    return path5.join(os.homedir(), p.slice(2));
+    return path7.join(os2.homedir(), p.slice(2));
   }
   return p;
 }
 function resolve_entry_path(project_root, raw) {
   const p = expanduser2(raw);
-  return path5.isAbsolute(p) ? p : path5.join(project_root, p);
+  return path7.isAbsolute(p) ? p : path7.join(project_root, p);
 }
 function sha256_of_file(p) {
   try {
-    return crypto3.createHash("sha256").update(fs5.readFileSync(p)).digest("hex");
+    return crypto3.createHash("sha256").update(fs7.readFileSync(p)).digest("hex");
   } catch {
     return null;
   }
@@ -1068,7 +1208,7 @@ function collect_drift(project_root, env) {
   const target = manifest_path(project_root, env);
   let text;
   try {
-    text = fs5.readFileSync(target, "utf-8");
+    text = fs7.readFileSync(target, "utf-8");
   } catch {
     return null;
   }
@@ -1113,7 +1253,7 @@ function collect_drift(project_root, env) {
         continue;
       }
       const resolved = resolve_entry_path(project_root, raw_path);
-      if (!fs5.existsSync(resolved)) {
+      if (!fs7.existsSync(resolved)) {
         out.push({
           tool_id,
           path: resolved,
@@ -1166,15 +1306,15 @@ function format_drift_report(entries) {
 }
 
 // src/scripts/_lib/skill_catalogue.ts
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
+import * as fs8 from "node:fs";
+import * as path8 from "node:path";
 var PROJECT_CATALOGUE_ROOTS = ["src/skills", ".claude/skills"];
 var HOST_CATALOGUE_ROOT = ".claude/skills";
 var DEFAULT_CATALOGUE_ROOTS = [
   ...PROJECT_CATALOGUE_ROOTS,
   `~/${HOST_CATALOGUE_ROOT}`
 ];
-var OBSERVATION_LOG = path6.join(
+var OBSERVATION_LOG = path8.join(
   "agents",
   "evidence",
   "metrics",
@@ -1218,9 +1358,9 @@ function descriptionOf(frontmatter) {
   return "";
 }
 function readProjectedCatalogue(root) {
-  const names = fs6.readdirSync(root).filter((n) => fs6.existsSync(path6.join(root, n, "SKILL.md"))).sort();
+  const names = fs8.readdirSync(root).filter((n) => fs8.existsSync(path8.join(root, n, "SKILL.md"))).sort();
   return names.map((name, index) => {
-    const content = fs6.readFileSync(path6.join(root, name, "SKILL.md"), "utf-8");
+    const content = fs8.readFileSync(path8.join(root, name, "SKILL.md"), "utf-8");
     const frontmatter = frontmatterOf(content);
     const description = descriptionOf(frontmatter);
     return {
@@ -1237,12 +1377,12 @@ function truncationModeOf(record) {
   return record.truncation_mode ?? "per-entry";
 }
 function markdownFilesUnder(root) {
-  if (!fs6.existsSync(root)) return [];
+  if (!fs8.existsSync(root)) return [];
   const out = [];
   const walk = (dir) => {
-    for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
-      const full = path6.join(dir, entry.name);
-      if (fs6.statSync(full).isDirectory()) walk(full);
+    for (const entry of fs8.readdirSync(dir, { withFileTypes: true })) {
+      const full = path8.join(dir, entry.name);
+      if (fs8.statSync(full).isDirectory()) walk(full);
       else if (entry.name.endsWith(".md")) out.push(full);
     }
   };
@@ -1250,9 +1390,9 @@ function markdownFilesUnder(root) {
   return out;
 }
 function measureCatalogueVolume(host, root) {
-  const skillsRoot = path6.join(root, "skills");
-  const skills = fs6.existsSync(skillsRoot) ? readProjectedCatalogue(skillsRoot) : [];
-  const commandEntries = markdownFilesUnder(path6.join(root, "commands")).length;
+  const skillsRoot = path8.join(root, "skills");
+  const skills = fs8.existsSync(skillsRoot) ? readProjectedCatalogue(skillsRoot) : [];
+  const commandEntries = markdownFilesUnder(path8.join(root, "commands")).length;
   return {
     host,
     root,
@@ -1330,9 +1470,9 @@ function migrationPromptLines(host, eligibility, settingsPath) {
   ];
 }
 function readObservationLog(logPath) {
-  if (!fs6.existsSync(logPath)) return [];
+  if (!fs8.existsSync(logPath)) return [];
   const out = [];
-  for (const line of fs6.readFileSync(logPath, "utf-8").split("\n")) {
+  for (const line of fs8.readFileSync(logPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (trimmed.length === 0) continue;
     try {
@@ -1373,8 +1513,8 @@ function isInteractiveSession(probe) {
 
 // src/scripts/_lib/claude_desktop_bundler.ts
 import * as crypto4 from "node:crypto";
-import * as fs7 from "node:fs";
-import * as path7 from "node:path";
+import * as fs9 from "node:fs";
+import * as path9 from "node:path";
 
 // src/scripts/_lib/zip_min.ts
 import * as zlib from "node:zlib";
@@ -1481,7 +1621,7 @@ function _is_excluded(rel_parts) {
 }
 function _is_dir(p) {
   try {
-    return fs7.statSync(p).isDirectory();
+    return fs9.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -1493,12 +1633,12 @@ function _compare_rel_parts(a, b) {
 }
 function _walk_skill_files(skill_dir) {
   const out = [];
-  const resolved = fs7.realpathSync(skill_dir);
+  const resolved = fs9.realpathSync(skill_dir);
   const walk = (root, relRoot) => {
     const dirNames = [];
     const fileNames = [];
-    for (const dirent of fs7.readdirSync(root, { withFileTypes: true })) {
-      const full = path7.join(root, dirent.name);
+    for (const dirent of fs9.readdirSync(root, { withFileTypes: true })) {
+      const full = path9.join(root, dirent.name);
       const isDir2 = dirent.isDirectory() || dirent.isSymbolicLink() && _is_dir(full);
       if (isDir2) {
         dirNames.push(dirent.name);
@@ -1511,13 +1651,13 @@ function _walk_skill_files(skill_dir) {
       if (_is_excluded(rel_parts)) {
         continue;
       }
-      out.push([path7.join(root, fname), rel_parts]);
+      out.push([path9.join(root, fname), rel_parts]);
     }
     for (const dname of dirNames) {
       if (_is_excluded([dname])) {
         continue;
       }
-      walk(path7.join(root, dname), [...relRoot, dname]);
+      walk(path9.join(root, dname), [...relRoot, dname]);
     }
   };
   walk(resolved, []);
@@ -1530,53 +1670,53 @@ function _manifest_digest(files) {
     const rel = rel_parts.join("/");
     h.update(Buffer.from(rel, "utf-8"));
     h.update(Buffer.from([0]));
-    h.update(crypto4.createHash("sha256").update(fs7.readFileSync(abs_path)).digest());
+    h.update(crypto4.createHash("sha256").update(fs9.readFileSync(abs_path)).digest());
     h.update(Buffer.from([0]));
   }
   return h.digest("hex");
 }
 function _atomic_write_zip(zip_path, files) {
-  fs7.mkdirSync(path7.dirname(zip_path), { recursive: true });
-  const stem = path7.basename(zip_path, path7.extname(zip_path));
-  const tmp_path = path7.join(
-    path7.dirname(zip_path),
+  fs9.mkdirSync(path9.dirname(zip_path), { recursive: true });
+  const stem = path9.basename(zip_path, path9.extname(zip_path));
+  const tmp_path = path9.join(
+    path9.dirname(zip_path),
     `.${stem}.${crypto4.randomBytes(6).toString("hex")}.zip.tmp`
   );
   try {
     const entries = files.map(([abs_path, rel_parts]) => ({
       name: rel_parts.join("/"),
-      data: fs7.readFileSync(abs_path)
+      data: fs9.readFileSync(abs_path)
     }));
-    fs7.writeFileSync(tmp_path, zip_write_sync(entries));
-    fs7.renameSync(tmp_path, zip_path);
+    fs9.writeFileSync(tmp_path, zip_write_sync(entries));
+    fs9.renameSync(tmp_path, zip_path);
   } finally {
-    if (fs7.existsSync(tmp_path)) {
-      fs7.unlinkSync(tmp_path);
+    if (fs9.existsSync(tmp_path)) {
+      fs9.unlinkSync(tmp_path);
     }
   }
 }
 function _write_if_changed(dest_dir, slug, files, force, written) {
   const digest = _manifest_digest(files);
-  const zip_path = path7.join(dest_dir, `${slug}.zip`);
-  const digest_path = path7.join(dest_dir, `${slug}.sha256`);
-  const recorded = fs7.existsSync(digest_path) ? fs7.readFileSync(digest_path, "utf-8").trim() : "";
-  if (!force && recorded === digest && fs7.existsSync(zip_path)) {
+  const zip_path = path9.join(dest_dir, `${slug}.zip`);
+  const digest_path = path9.join(dest_dir, `${slug}.sha256`);
+  const recorded = fs9.existsSync(digest_path) ? fs9.readFileSync(digest_path, "utf-8").trim() : "";
+  if (!force && recorded === digest && fs9.existsSync(zip_path)) {
     return;
   }
   _atomic_write_zip(zip_path, files);
-  fs7.writeFileSync(digest_path, digest + "\n", "utf-8");
+  fs9.writeFileSync(digest_path, digest + "\n", "utf-8");
   written.push(zip_path);
 }
 function build_skill_bundles(package_root, dest_dir, force = false, curation = null) {
-  const skills_root = path7.join(package_root, "dist/agent-src", "skills");
+  const skills_root = path9.join(package_root, "dist/agent-src", "skills");
   if (!_is_dir(skills_root)) {
     return [];
   }
-  fs7.mkdirSync(dest_dir, { recursive: true });
+  fs9.mkdirSync(dest_dir, { recursive: true });
   const written = [];
-  for (const name of fs7.readdirSync(skills_root).sort()) {
-    const entry = path7.join(skills_root, name);
-    const isSymlink2 = fs7.lstatSync(entry).isSymbolicLink();
+  for (const name of fs9.readdirSync(skills_root).sort()) {
+    const entry = path9.join(skills_root, name);
+    const isSymlink2 = fs9.lstatSync(entry).isSymbolicLink();
     if (!(_is_dir(entry) || isSymlink2)) {
       continue;
     }
@@ -1584,8 +1724,8 @@ function build_skill_bundles(package_root, dest_dir, force = false, curation = n
     if (curation !== null && !curation.includes(skill_name)) {
       continue;
     }
-    const skill_md = path7.join(entry, "SKILL.md");
-    if (!fs7.existsSync(skill_md)) {
+    const skill_md = path9.join(entry, "SKILL.md");
+    if (!fs9.existsSync(skill_md)) {
       continue;
     }
     const files = _walk_skill_files(entry);
@@ -1597,15 +1737,15 @@ function build_skill_bundles(package_root, dest_dir, force = false, curation = n
   return written;
 }
 function _command_slug(source_file, commands_root) {
-  const rel = path7.relative(commands_root, source_file);
-  const noExt = rel.slice(0, rel.length - path7.extname(rel).length);
-  return noExt.split(path7.sep).join("-");
+  const rel = path9.relative(commands_root, source_file);
+  const noExt = rel.slice(0, rel.length - path9.extname(rel).length);
+  return noExt.split(path9.sep).join("-");
 }
 function _iter_command_files(commands_root) {
   const found = [];
   const walk = (dir) => {
-    for (const dirent of fs7.readdirSync(dir, { withFileTypes: true })) {
-      const full = path7.join(dir, dirent.name);
+    for (const dirent of fs9.readdirSync(dir, { withFileTypes: true })) {
+      const full = path9.join(dir, dirent.name);
       if (dirent.isDirectory() || dirent.isSymbolicLink() && _is_dir(full)) {
         walk(full);
       } else if (dirent.name.endsWith(".md")) {
@@ -1615,21 +1755,21 @@ function _iter_command_files(commands_root) {
   };
   walk(commands_root);
   found.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-  return found.filter((source_file) => path7.basename(source_file) !== "AGENTS.md");
+  return found.filter((source_file) => path9.basename(source_file) !== "AGENTS.md");
 }
 function build_command_bundles(package_root, dest_dir, force = false, curation = null) {
-  const commands_root = path7.join(package_root, "dist/agent-src", "commands");
+  const commands_root = path9.join(package_root, "dist/agent-src", "commands");
   if (!_is_dir(commands_root)) {
     return [];
   }
-  const skills_root = path7.join(package_root, "dist/agent-src", "skills");
+  const skills_root = path9.join(package_root, "dist/agent-src", "skills");
   let skill_names = /* @__PURE__ */ new Set();
   if (_is_dir(skills_root)) {
     skill_names = new Set(
-      fs7.readdirSync(skills_root).filter((name) => _is_dir(path7.join(skills_root, name)))
+      fs9.readdirSync(skills_root).filter((name) => _is_dir(path9.join(skills_root, name)))
     );
   }
-  fs7.mkdirSync(dest_dir, { recursive: true });
+  fs9.mkdirSync(dest_dir, { recursive: true });
   const written = [];
   for (const source_file of _iter_command_files(commands_root)) {
     const slug = _command_slug(source_file, commands_root);
@@ -1639,7 +1779,7 @@ function build_command_bundles(package_root, dest_dir, force = false, curation =
     if (curation !== null && !curation.includes(slug)) {
       continue;
     }
-    const files = [[fs7.realpathSync(source_file), ["SKILL.md"]]];
+    const files = [[fs9.realpathSync(source_file), ["SKILL.md"]]];
     _write_if_changed(dest_dir, slug, files, force, written);
   }
   return written;
@@ -1647,15 +1787,25 @@ function build_command_bundles(package_root, dest_dir, force = false, curation =
 
 // src/scripts/hooks/host_lowering.ts
 var import_yaml2 = __toESM(require_dist(), 1);
-import * as fs8 from "node:fs";
-import * as path8 from "node:path";
+import * as fs10 from "node:fs";
+import * as path10 from "node:path";
 import { fileURLToPath } from "node:url";
+
+// src/scripts/hooks/table_fingerprint.ts
+import { createHash as createHash5 } from "node:crypto";
+function tableFingerprint(text) {
+  const digest = createHash5("sha256").update(text, "utf-8").digest("hex");
+  return `${digest}:${String(text.length)}`;
+}
+
+// src/scripts/hooks/host_lowering.ts
 var _IN_BUNDLE = true;
-var _REPO_ROOT = path8.resolve(
-  path8.dirname(fileURLToPath(import.meta.url)),
+var _REPO_ROOT = path10.resolve(
+  path10.dirname(fileURLToPath(import.meta.url)),
   ..._IN_BUNDLE ? ["..", ".."] : ["..", "..", ".."]
 );
-var HOST_LOWERING_PATH = path8.join(_REPO_ROOT, "src", "scripts", "hooks", "host_lowering.yaml");
+var HOST_LOWERING_PATH = path10.join(_REPO_ROOT, "src", "scripts", "hooks", "host_lowering.yaml");
+var HOST_LOWERING_JSON_PATH = path10.join(_REPO_ROOT, "src", "scripts", "hooks", "host_lowering.json");
 var DEFAULT_SURFACE = "any";
 function _asString(v) {
   if (v === null || v === void 0) return null;
@@ -1663,7 +1813,9 @@ function _asString(v) {
   return String(v);
 }
 function _parse(text) {
-  const raw = (0, import_yaml2.parse)(text);
+  return _structure((0, import_yaml2.parse)(text));
+}
+function _structure(raw) {
   const hostsRaw = raw?.["hosts"];
   if (typeof hostsRaw !== "object" || hostsRaw === null) {
     throw new Error("host_lowering.yaml: missing `hosts:` map");
@@ -1687,6 +1839,7 @@ function _parse(text) {
         verified = {
           docs_at: _asString(verifiedRaw["docs_at"]),
           docs_url: _asString(verifiedRaw["docs_url"]),
+          docs_digest: _asString(verifiedRaw["docs_digest"]),
           probe_at: _asString(verifiedRaw["probe_at"]),
           host_version: _asString(verifiedRaw["host_version"]),
           expires
@@ -1700,7 +1853,9 @@ function _parse(text) {
         const be = rv["block_exit"];
         const row = {
           native,
-          block_exit: typeof be === "number" ? be : null
+          block_exit: typeof be === "number" ? be : null,
+          answered_at: _asString(rv["answered_at"]),
+          docs_url: _asString(rv["docs_url"])
         };
         if (typeof rv["matcher"] === "string") row.matcher = rv["matcher"];
         slots.set(slot, row);
@@ -1721,9 +1876,47 @@ function _parse(text) {
 }
 var _cache = null;
 function loadHostLowering() {
-  if (_cache === null) _cache = _parse(fs8.readFileSync(HOST_LOWERING_PATH, "utf-8"));
+  if (_cache !== null) return _cache;
+  const text = fs10.readFileSync(HOST_LOWERING_PATH, "utf-8");
+  let compiled;
+  try {
+    compiled = fs10.readFileSync(HOST_LOWERING_JSON_PATH, "utf-8");
+  } catch {
+    compiled = null;
+  }
+  _cache = resolveTable(text, compiled);
   return _cache;
 }
+function resolveTable(yamlText, compiledText) {
+  if (compiledText !== null) {
+    try {
+      const raw = JSON.parse(compiledText);
+      const table = raw["table"];
+      if (raw["fingerprint"] === tableFingerprint(yamlText) && typeof table === "object" && table !== null && // road-to-blocking-severities 2.3 — the BODY, not only its
+      // label. `fingerprint` above says the file was compiled from
+      // the YAML as it stands; it says nothing about whether the
+      // body underneath was edited afterwards, and an edited body
+      // with an untouched label was served. `body_fingerprint` is
+      // the fingerprint of the exact bytes the compiler emitted, so
+      // re-stringifying what we just parsed recovers them.
+      //
+      // A compiled file WITHOUT the field — one written before 2.3 —
+      // falls through here, which is slow and correct: accepting it
+      // would make the check optional and therefore absent.
+      //
+      // What it covers is a partial edit, never an author: anyone
+      // who edits the body can recompute this as easily as the
+      // compiler. The deny in `block_plumbing_writes` and the
+      // ratification record are the mechanisms aimed at an author;
+      // this one is aimed at a mistake.
+      raw["body_fingerprint"] === tableFingerprint(JSON.stringify(table))) {
+        return _structure(table);
+      }
+    } catch {
+    }
+  }
+  return _parse(yamlText);
+}
 function surfaceRow(host, surface = DEFAULT_SURFACE, table = loadHostLowering()) {
   return table.get(host)?.get(surface) ?? table.get(host)?.get(DEFAULT_SURFACE) ?? null;
 }
@@ -1740,26 +1933,26 @@ function hostBindings(host, table = loadHostLowering()) {
 }
 
 // src/install/partitionEligibility.ts
-import * as fs10 from "node:fs";
-import * as os2 from "node:os";
+import * as fs12 from "node:fs";
+import * as os3 from "node:os";
 
 // src/install/hostLayerFingerprint.ts
-import { createHash as createHash5 } from "node:crypto";
-import * as fs9 from "node:fs";
-import * as path9 from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import * as fs11 from "node:fs";
+import * as path11 from "node:path";
 var FINGERPRINT_SCHEMA = 1;
 function collectFiles(dir) {
   const out = [];
   const walk = (d) => {
     let entries;
     try {
-      entries = fs9.readdirSync(d, { withFileTypes: true });
+      entries = fs11.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
     const sorted = [...entries].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     for (const e of sorted) {
-      const p = path9.join(d, e.name);
+      const p = path11.join(d, e.name);
       if (e.isDirectory()) {
         walk(p);
       } else if (e.isFile()) {
@@ -1771,15 +1964,15 @@ function collectFiles(dir) {
   return out.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
 }
 function fingerprintLayers(layers) {
-  const h = createHash5("sha256");
+  const h = createHash6("sha256");
   h.update(`v${FINGERPRINT_SCHEMA}\0`);
   for (const layer of layers) {
     h.update(`layer:${layer.label}\0`);
     for (const file of collectFiles(layer.root)) {
-      h.update(path9.relative(layer.root, file));
+      h.update(path11.relative(layer.root, file));
       h.update("\0");
       try {
-        h.update(fs9.readFileSync(file));
+        h.update(fs11.readFileSync(file));
       } catch {
         h.update("\0unreadable\0");
       }
@@ -1789,11 +1982,11 @@ function fingerprintLayers(layers) {
   return h.digest("hex");
 }
 function hostLayerInputs(userHome) {
-  const claude = path9.join(userHome, ".claude");
+  const claude = path11.join(userHome, ".claude");
   return [
-    { label: "rules", root: path9.join(claude, "rules") },
-    { label: "skills", root: path9.join(claude, "skills") },
-    { label: "commands", root: path9.join(claude, "commands") }
+    { label: "rules", root: path11.join(claude, "rules") },
+    { label: "skills", root: path11.join(claude, "skills") },
+    { label: "commands", root: path11.join(claude, "commands") }
   ];
 }
 
@@ -1802,7 +1995,7 @@ var MAINTAINER_WORKSPACE = "agent-config-maintainer";
 function isExclusivelyPackageOnly(source_path) {
   let meta;
   try {
-    [meta] = parseFrontmatter(fs10.readFileSync(source_path, "utf-8"));
+    [meta] = parseFrontmatter(fs12.readFileSync(source_path, "utf-8"));
   } catch {
     return false;
   }
@@ -1817,7 +2010,7 @@ function stampHostLayerFingerprint(installedVersion, tools, lockfilePath, skip2,
     return null;
   }
   try {
-    const fingerprint = fingerprintLayers(hostLayerInputs(os2.homedir()));
+    const fingerprint = fingerprintLayers(hostLayerInputs(os3.homedir()));
     write_lockfile(installedVersion, [...tools], {
       path: lockfilePath,
       host_layer_fingerprint: fingerprint
@@ -1833,8 +2026,8 @@ function stampHostLayerFingerprint(installedVersion, tools, lockfilePath, skip2,
 }
 
 // src/install/claudeRuleRewrite.ts
-import * as fs11 from "node:fs";
-import * as path10 from "node:path";
+import * as fs13 from "node:fs";
+import * as path12 from "node:path";
 
 // src/install/claudePathsPlan.ts
 function derive_trigger_globs(meta) {
@@ -1874,14 +2067,22 @@ function _expanded_pattern_count(pattern) {
   return n;
 }
 var CLAUDE_PATHS_PATTERN_BUDGET = 1e3;
+var PATH_SHAPED_TRIGGER_KEYS = /* @__PURE__ */ new Set(["file_pattern", "path_prefix"]);
+var NON_MATCHING_TRIGGER_KEYS = /* @__PURE__ */ new Set(["reason"]);
 function _has_non_path_trigger(meta) {
   const triggers = meta["triggers"];
   if (!Array.isArray(triggers)) return false;
   for (const t of triggers) {
     if (t === null || typeof t !== "object" || Array.isArray(t)) continue;
     const obj = t;
-    if (typeof obj["keyword"] === "string" && obj["keyword"]) return true;
-    if (typeof obj["phrase"] === "string" && obj["phrase"]) return true;
+    for (const [key, value] of Object.entries(obj)) {
+      if (PATH_SHAPED_TRIGGER_KEYS.has(key) || NON_MATCHING_TRIGGER_KEYS.has(key)) continue;
+      if (typeof value === "string") {
+        if (value.trim() !== "") return true;
+      } else if (value !== void 0 && value !== null) {
+        return true;
+      }
+    }
   }
   return false;
 }
@@ -1949,6 +2150,11 @@ function rewriteAndReport(rulesDir, quiet, info2, warn2, wrappers, preserved = /
         `  claude-code: ${wrappers.reserved.length} flat command(s) withheld \u2014 name is a Claude Code built-in (${wrappers.reserved.join(", ")}); nested /cluster:sub commands remain available`
       );
     }
+    if (wrappers.foreign !== void 0 && wrappers.foreign.length > 0) {
+      info2(
+        `  claude-code: kept ${wrappers.foreign.length} neighbour command file(s) whose name is a Claude Code built-in (${wrappers.foreign.join(", ")}); not ours to remove`
+      );
+    }
   }
   if (result.rewritten > 0 && !quiet) {
     info2(
@@ -1990,23 +2196,23 @@ function rewriteClaudeRules(rulesDir, preserved = /* @__PURE__ */ new Set()) {
   const result = { rewritten: 0, scoped: [], dropped: [], failed: [] };
   let entries;
   try {
-    entries = fs11.readdirSync(rulesDir);
+    entries = fs13.readdirSync(rulesDir);
   } catch {
     return result;
   }
   for (const name of entries.filter((n) => n.endsWith(".md")).sort()) {
-    const full = path10.join(rulesDir, name);
-    if (preserved.has(path10.resolve(full))) continue;
+    const full = path12.join(rulesDir, name);
+    if (preserved.has(path12.resolve(full))) continue;
     let stat;
     try {
-      stat = fs11.lstatSync(full);
+      stat = fs13.lstatSync(full);
     } catch {
       continue;
     }
     if (!stat.isFile() || stat.isSymbolicLink()) continue;
     let text;
     try {
-      text = fs11.readFileSync(full, "utf-8");
+      text = fs13.readFileSync(full, "utf-8");
     } catch {
       continue;
     }
@@ -2016,7 +2222,7 @@ function rewriteClaudeRules(rulesDir, preserved = /* @__PURE__ */ new Set()) {
     const withOwnership = _withPreservedKeys(rendered.text, text);
     if (withOwnership !== text) {
       try {
-        fs11.writeFileSync(full, withOwnership, "utf-8");
+        fs13.writeFileSync(full, withOwnership, "utf-8");
       } catch (e) {
         result.failed.push({
           rule: name.slice(0, -3),
@@ -2035,6 +2241,744 @@ function rewriteClaudeRules(rulesDir, preserved = /* @__PURE__ */ new Set()) {
   return result;
 }
 
+// src/install/installThinLayer.ts
+import * as fs17 from "node:fs";
+import * as path17 from "node:path";
+import * as os5 from "node:os";
+
+// src/scripts/_lib/installed_layer.ts
+import * as fs14 from "node:fs";
+import * as path14 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/install/globalRuleLayers.ts
+import * as os4 from "node:os";
+import * as path13 from "node:path";
+var GLOBAL_RULE_DIRS = {
+  "claude-code": ".claude/rules",
+  cursor: ".cursor/rules",
+  augment: ".augment/rules",
+  // Windsurf's scope root is `~/.codeium/windsurf/`, not `~/.windsurf/`.
+  windsurf: ".codeium/windsurf/rules",
+  // Cline's scope root IS the rules directory — no `rules/` suffix.
+  cline: "Documents/Cline/Rules"
+};
+function globalRuleLayerPath(toolId, home = process.env["HOME"] ?? os4.homedir()) {
+  const rel = GLOBAL_RULE_DIRS[toolId];
+  return rel === void 0 ? null : path13.join(home, rel);
+}
+
+// src/scripts/_lib/rule_law_section.ts
+var IRON_LAW_RE = /\biron\s+laws?\b/i;
+var HEADING_RE = /^(#{1,6})\s+(.+?)\s*$/;
+var FENCE_RE = /^\s*```/;
+function splitFrontmatter(text) {
+  if (text.startsWith("---\n")) {
+    const end = text.indexOf("\n---\n", 4);
+    if (end !== -1) {
+      return [text.slice(0, end + 5), text.slice(end + 5)];
+    }
+  }
+  return ["", text];
+}
+function ruleBody(text) {
+  const [, body] = splitFrontmatter(text);
+  return body.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
+function lawSections(body) {
+  const lines = body.split("\n");
+  let inFence = false;
+  const headings = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const raw = lines[i];
+    if (FENCE_RE.test(raw)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence) continue;
+    const m = HEADING_RE.exec(raw);
+    if (m) headings.push({ i, depth: m[1].length, title: m[2].trim() });
+  }
+  const out = [];
+  for (let k = 0; k < headings.length; k += 1) {
+    const h = headings[k];
+    if (!IRON_LAW_RE.test(h.title)) continue;
+    let end = lines.length;
+    for (let j = k + 1; j < headings.length; j += 1) {
+      const n = headings[j];
+      if (n.depth <= h.depth) {
+        end = n.i;
+        break;
+      }
+    }
+    out.push({
+      title: h.title,
+      depth: h.depth,
+      line: h.i + 1,
+      text: lines.slice(h.i, end).join("\n").trim()
+    });
+  }
+  return out;
+}
+function lawText(body) {
+  const sections = lawSections(body);
+  if (sections.length === 0) return null;
+  return sections.map((s) => s.text).join("\n\n");
+}
+
+// src/scripts/_lib/installed_layer.ts
+var TOP_FILES = 20;
+var LIMIT_WARN_FRACTION = 0.8;
+function isUnconditional(text) {
+  return !/^paths:/m.test(text);
+}
+function readLayer(host, scope, dir, recorded) {
+  const empty = {
+    files: 0,
+    unconditional: 0,
+    chars: 0,
+    package_owned: 0,
+    foreign: 0,
+    package_owned_chars: 0,
+    foreign_chars: 0,
+    top: []
+  };
+  let names;
+  try {
+    names = fs14.readdirSync(dir);
+  } catch {
+    return { host, scope, dir, present: false, ...empty };
+  }
+  const readings = [];
+  for (const name of names.sort()) {
+    if (!name.endsWith(".md")) continue;
+    const abs = path14.join(dir, name);
+    let text;
+    try {
+      const st = fs14.statSync(abs);
+      if (!st.isFile()) continue;
+      text = fs14.readFileSync(abs, "utf-8");
+    } catch {
+      continue;
+    }
+    const owned = recorded.has(abs);
+    readings.push({
+      file: name,
+      // THE STRIP IS THE PROJECTOR'S OWN. `ruleBody` is what
+      // `project_thin_rules` and the delivery carrier both call, so "what
+      // a host loads" and "what a delivery carries" cannot drift into two
+      // spellings of the same measurement.
+      chars: ruleBody(text).length,
+      unconditional: isUnconditional(text),
+      package_owned: owned
+    });
+  }
+  const top = [...readings].sort((a, b) => b.chars - a.chars || a.file.localeCompare(b.file)).slice(0, TOP_FILES);
+  return {
+    host,
+    scope,
+    dir,
+    present: true,
+    files: readings.length,
+    unconditional: readings.filter((r) => r.unconditional).length,
+    chars: readings.reduce((n, r) => n + r.chars, 0),
+    package_owned: readings.filter((r) => r.package_owned).length,
+    foreign: readings.filter((r) => !r.package_owned).length,
+    package_owned_chars: readings.reduce((n, r) => n + (r.package_owned ? r.chars : 0), 0),
+    foreign_chars: readings.reduce((n, r) => n + (r.package_owned ? 0 : r.chars), 0),
+    top
+  };
+}
+function defaultHostLimitsPath() {
+  return path14.join(
+    path14.dirname(fileURLToPath2(import.meta.url)),
+    "..",
+    "..",
+    "config",
+    "host-instruction-limits.json"
+  );
+}
+function loadHostInstructionLimits(file = defaultHostLimitsPath()) {
+  const out = /* @__PURE__ */ new Map();
+  let raw;
+  try {
+    raw = JSON.parse(fs14.readFileSync(file, "utf-8"));
+  } catch {
+    return out;
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return out;
+  for (const [host, v] of Object.entries(raw)) {
+    if (host.startsWith("_")) continue;
+    if (typeof v !== "object" || v === null || Array.isArray(v)) continue;
+    const e = v;
+    const n = e.limit;
+    const limit = typeof n === "number" && Number.isFinite(n) && n > 0 ? n : null;
+    const k = e.kind;
+    const kind = limit === null ? "unpublished" : k === "vendor-published" || k === "reported" ? k : "reported";
+    out.set(host, { limit, kind });
+  }
+  return out;
+}
+function buildHostLimitRows(layers, limits) {
+  const byHost = /* @__PURE__ */ new Map();
+  for (const l of layers) {
+    if (!l.present) continue;
+    const acc = byHost.get(l.host) ?? { chars: 0, owned: 0, foreign: 0 };
+    acc.chars += l.chars;
+    acc.owned += l.package_owned_chars;
+    acc.foreign += l.foreign_chars;
+    byHost.set(l.host, acc);
+  }
+  for (const l of layers) if (!byHost.has(l.host)) byHost.set(l.host, { chars: 0, owned: 0, foreign: 0 });
+  for (const [host, e] of limits) if (e.limit !== null && !byHost.has(host)) {
+    byHost.set(host, { chars: 0, owned: 0, foreign: 0 });
+  }
+  const rows = [];
+  for (const host of [...byHost.keys()].sort()) {
+    const a = byHost.get(host);
+    const e = limits.get(host) ?? { limit: null, kind: "unpublished" };
+    const fraction = e.limit === null ? null : a.chars / e.limit;
+    rows.push({
+      host,
+      limit: e.limit,
+      kind: e.kind,
+      chars: a.chars,
+      package_owned_chars: a.owned,
+      foreign_chars: a.foreign,
+      fraction,
+      warn: fraction !== null && fraction >= LIMIT_WARN_FRACTION
+    });
+  }
+  return rows;
+}
+function renderHostLimitRows(rows) {
+  const out = [
+    "host instruction budgets \u2014 package-owned + foreign against the published limit"
+  ];
+  for (const r of rows) {
+    const split = `${String(r.package_owned_chars)} package-owned + ${String(r.foreign_chars)} foreign = ${String(r.chars)} chars`;
+    if (r.limit === null) {
+      out.push(`  ${r.host} \u2014 ${split}; no published limit recorded \u2014 not measured`);
+      continue;
+    }
+    const pct = (r.fraction * 100).toFixed(1);
+    out.push(
+      `  ${r.host} \u2014 ${split}; ${pct}% of ${String(r.limit)} (${r.kind})` + (r.warn ? ` \u2014 WARNING: at or past ${String(Math.round(LIMIT_WARN_FRACTION * 100))}% of the published limit` : "")
+    );
+  }
+  return out;
+}
+
+// src/scripts/_lib/thin_rules.ts
+import { createHash as createHash7 } from "node:crypto";
+import * as fs16 from "node:fs";
+import * as path16 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/scripts/_lib/rule_consequence_class.ts
+import * as fs15 from "node:fs";
+import * as path15 from "node:path";
+var CLASS_CONFIG_REL = "src/config/rule-consequence-class.json";
+function readConsequenceClass(repoRoot) {
+  const raw = JSON.parse(fs15.readFileSync(path15.join(repoRoot, CLASS_CONFIG_REL), "utf-8"));
+  return {
+    criterion_ref: raw.criterion_ref ?? "",
+    members: raw.members ?? {},
+    no_stub: raw.no_stub ?? {},
+    excluded: raw.excluded ?? {}
+  };
+}
+function stubLawIds(cfg) {
+  return new Set(Object.keys(cfg.members).filter((id) => cfg.no_stub[id] === void 0));
+}
+
+// src/scripts/_lib/rule_injection.ts
+var PATH_TRIGGER_KINDS = ["path_prefix", "file_pattern"];
+function tierEntries(router, tier) {
+  const raw = router[tier];
+  if (!Array.isArray(raw)) return [];
+  return raw.map((r) => ({
+    id: String(r["id"] ?? ""),
+    triggers: Array.isArray(r["triggers"]) ? r["triggers"] : []
+  }));
+}
+function allTierRules(router) {
+  const out = [];
+  for (const tier of ["tier_1", "tier_2"]) {
+    for (const e of tierEntries(router, tier)) out.push({ ...e, tier });
+  }
+  return out;
+}
+function pathOnlyRuleIds(router) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const r of allTierRules(router)) {
+    if (r.triggers.length === 0) continue;
+    const allPath = r.triggers.every(
+      (t) => PATH_TRIGGER_KINDS.some((k) => k in t)
+    );
+    if (allPath) ids.add(r.id);
+  }
+  return ids;
+}
+function triggerlessRuleIds(router) {
+  return allTierRules(router).filter((r) => r.triggers.length === 0).map((r) => r.id);
+}
+
+// src/scripts/_lib/thin_rules.ts
+var _HERE = fileURLToPath3(import.meta.url);
+var REPO_ROOT = path16.resolve(path16.dirname(_HERE), "..", "..", "..");
+var RULES_SOURCE = path16.join(REPO_ROOT, "dist/agent-src", "rules");
+var ROUTER = path16.join(REPO_ROOT, "dist", "router.json");
+function _globSortedMd(dir) {
+  let names;
+  try {
+    names = fs16.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = names.filter((n) => n.endsWith(".md")).map((n) => path16.join(dir, n));
+  out.sort();
+  return out;
+}
+function kernel_ids(routerPath = ROUTER) {
+  const data = JSON.parse(fs16.readFileSync(routerPath, "utf-8"));
+  const kernel = data.kernel;
+  if (Array.isArray(kernel)) {
+    return new Set(kernel.map((x) => String(x)));
+  }
+  return /* @__PURE__ */ new Set();
+}
+function _router(routerPath = ROUTER) {
+  return JSON.parse(fs16.readFileSync(routerPath, "utf-8"));
+}
+function path_only_ids(routerPath = ROUTER) {
+  return pathOnlyRuleIds(_router(routerPath));
+}
+function no_trigger_ids(routerPath = ROUTER) {
+  return new Set(triggerlessRuleIds(_router(routerPath)));
+}
+function rule_workspaces_map(routerPath = ROUTER) {
+  const data = JSON.parse(fs16.readFileSync(routerPath, "utf-8"));
+  const map = /* @__PURE__ */ new Map();
+  for (const tier of ["tier_1", "tier_2"]) {
+    const entries = data[tier];
+    if (!Array.isArray(entries)) continue;
+    for (const e of entries) {
+      const obj = e;
+      const ws = Array.isArray(obj.workspaces) ? obj.workspaces.map((w) => String(w)) : [];
+      map.set(String(obj.id), ws);
+    }
+  }
+  return map;
+}
+function id_in_scope(rule_id, scope, kernel, wsMap, fallback_ws = []) {
+  if (scope === null || kernel.has(rule_id)) {
+    return true;
+  }
+  const ws = wsMap.get(rule_id) ?? fallback_ws;
+  if (ws.length === 0) {
+    return true;
+  }
+  return ws.some((w) => scope.includes(w));
+}
+function fm_workspaces(text) {
+  const [fm] = split_frontmatter(text);
+  const flow = /^workspaces:[ \t]*\[([^\]]*)\]/m.exec(fm);
+  if (flow) {
+    return flow[1].split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter((s) => s.length > 0);
+  }
+  const m = /^workspaces:[ \t]*\n((?:[ \t]+-[ \t]+.*(?:\n|$))+)/m.exec(fm);
+  if (!m) {
+    return [];
+  }
+  return [...m[1].matchAll(/-[ \t]+(\S+)/g)].map((x) => x[1]);
+}
+function split_frontmatter(text) {
+  if (text.startsWith("---\n")) {
+    const end = text.indexOf("\n---\n", 4);
+    if (end !== -1) {
+      return [text.slice(0, end + 5), text.slice(end + 5)];
+    }
+  }
+  return ["", text];
+}
+function _description(fm) {
+  const m = /^description:\s*"?(.+?)"?\s*$/m.exec(fm);
+  return m ? m[1].trim() : "";
+}
+var _TRIGGER_HINT_LIMIT = 6;
+function _trigger_hint(fm) {
+  const hits = [];
+  const re = /^\s*-\s*(?:keyword|phrase):\s*"?(.+?)"?\s*$/gm;
+  let m;
+  while ((m = re.exec(fm)) !== null) {
+    hits.push(m[1].trim());
+    if (hits.length >= _TRIGGER_HINT_LIMIT) {
+      break;
+    }
+  }
+  return hits.join(", ");
+}
+function _title(s) {
+  return s.replace(/[A-Za-z]+/g, (w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase());
+}
+var THIN_ENTRY_MARKER = "> Routed rule \u2014 load the body on trigger-match.";
+var BODY_LINK_PREFIX = "../../dist/agent-src/rules/";
+function absoluteBodyLinkPrefix(packageRoot) {
+  return `${path16.join(path16.resolve(packageRoot), "dist", "agent-src", "rules")}${path16.sep}`;
+}
+function thin_entry(rule_id, text, bodyLinkPrefix = BODY_LINK_PREFIX) {
+  const [fm] = split_frontmatter(text);
+  const desc = _description(fm);
+  const hint = _trigger_hint(fm);
+  const title = _title(rule_id.replace(/-/g, " "));
+  const fires = hint ? ` Fires on: ${hint}.` : "";
+  return `## ${title}
+${THIN_ENTRY_MARKER}${fires} ${desc} Body: [\`${rule_id}\`](${bodyLinkPrefix}${rule_id}.md)
+`;
+}
+var STUB_LAW_OPEN = "<!-- law: byte-copied from the rule, sha256 ";
+var STUB_LAW_CLOSE = "<!-- /law -->";
+function lawDigest(law) {
+  return createHash7("sha256").update(law, "utf-8").digest("hex").slice(0, 16);
+}
+var StubLawError = class extends Error {
+  ruleId;
+  constructor(ruleId, message) {
+    super(message);
+    this.name = "StubLawError";
+    this.ruleId = ruleId;
+  }
+};
+var STUB_LAW_MAX_CHARS = 2e3;
+function thin_entry_with_law(rule_id, text, bodyLinkPrefix = BODY_LINK_PREFIX) {
+  const law = lawText(ruleBody(text));
+  if (law === null) {
+    throw new StubLawError(
+      rule_id,
+      `${rule_id} is a high-consequence class member with no law section \u2014 write one, or record it under \`no_stub\` in src/config/rule-consequence-class.json with the reason`
+    );
+  }
+  if (law.length > STUB_LAW_MAX_CHARS) {
+    throw new StubLawError(
+      rule_id,
+      `${rule_id} is a high-consequence class member whose law section is ${law.length} chars, over the ${STUB_LAW_MAX_CHARS} ceiling \u2014 a stub never ships a shortened copy, so either the law moves under the ceiling or the rule is recorded under \`no_stub\` in src/config/rule-consequence-class.json with the reason`
+    );
+  }
+  return thin_entry(rule_id, text, bodyLinkPrefix) + `
+${STUB_LAW_OPEN}${lawDigest(law)} -->
+${law}
+${STUB_LAW_CLOSE}
+`;
+}
+function build_thin(rules_dir = RULES_SOURCE, scope = null, announce = null, consequenceClass = null, roots = null) {
+  const routerPath = roots?.routerPath ?? (roots?.packageRoot === void 0 ? ROUTER : path16.join(roots.packageRoot, "dist", "router.json"));
+  const classRoot = roots?.packageRoot ?? REPO_ROOT;
+  const bodyLinkPrefix = roots?.bodyLinkPrefix ?? BODY_LINK_PREFIX;
+  const kernel = kernel_ids(routerPath);
+  const noTrigger = no_trigger_ids(routerPath);
+  const pathOnly = path_only_ids(routerPath);
+  const cls = consequenceClass ?? readConsequenceClass(classRoot);
+  const lawInStub = stubLawIds(cls);
+  const wsMap = scope !== null ? rule_workspaces_map(routerPath) : /* @__PURE__ */ new Map();
+  const out = /* @__PURE__ */ new Map();
+  for (const p of _globSortedMd(rules_dir)) {
+    const text = fs16.readFileSync(p, "utf-8");
+    const stem = path16.basename(p).replace(/\.md$/, "");
+    if (!id_in_scope(stem, scope, kernel, wsMap, fm_workspaces(text))) {
+      continue;
+    }
+    const noStub = cls.no_stub[stem] !== void 0;
+    const full = kernel.has(stem) || noTrigger.has(stem) || pathOnly.has(stem) || noStub;
+    if (announce !== null && noTrigger.has(stem) && !kernel.has(stem)) {
+      announce(`D3: trigger-less auto rule ${path16.basename(p)} \u2014 kept full-bodied, never thinned`);
+    }
+    if (announce !== null && pathOnly.has(stem) && !kernel.has(stem) && !noTrigger.has(stem)) {
+      announce(
+        `E2: path-only auto rule ${path16.basename(p)} \u2014 kept full-bodied; its only triggers are path-shaped and the delivery concern is not bound on pre_tool_use`
+      );
+    }
+    if (full) {
+      out.set(path16.basename(p), text);
+      continue;
+    }
+    if (lawInStub.has(stem)) {
+      if (announce !== null) {
+        announce(
+          `LAW: high-consequence rule ${path16.basename(p)} \u2014 stub carries its own law section, byte-copied`
+        );
+      }
+      out.set(path16.basename(p), thin_entry_with_law(stem, text, bodyLinkPrefix));
+      continue;
+    }
+    out.set(path16.basename(p), thin_entry(stem, text, bodyLinkPrefix));
+  }
+  return out;
+}
+
+// src/install/installThinLayer.ts
+function thinInstalledRuleLayer(opts) {
+  const packageRoot = path17.resolve(opts.packageRoot);
+  const bodySourceDir = path17.join(packageRoot, "dist", "agent-src", "rules");
+  const bodyLinkPrefix = absoluteBodyLinkPrefix(packageRoot);
+  const preserved = opts.preserved ?? /* @__PURE__ */ new Set();
+  const stubs = build_thin(bodySourceDir, null, null, null, { packageRoot, bodyLinkPrefix });
+  let thinned = 0;
+  let rewritten = 0;
+  let kept = 0;
+  let charsBefore = 0;
+  let charsAfter = 0;
+  const preservedHits = [];
+  const absent = [];
+  const failed = [];
+  for (const [name, stubText] of stubs) {
+    const target = path17.join(opts.rulesDir, name);
+    let installed;
+    try {
+      installed = fs17.readFileSync(target, "utf-8");
+    } catch (e) {
+      if (e.code === "ENOENT") absent.push(name);
+      else failed.push({ rule: name, reason: String(e) });
+      continue;
+    }
+    let sourceText;
+    try {
+      sourceText = fs17.readFileSync(path17.join(bodySourceDir, name), "utf-8");
+    } catch {
+      sourceText = null;
+    }
+    if (stubText === sourceText) {
+      kept += 1;
+      charsBefore += installed.length;
+      charsAfter += installed.length;
+      continue;
+    }
+    if (preserved.has(path17.resolve(target))) {
+      preservedHits.push(name);
+      charsBefore += installed.length;
+      charsAfter += installed.length;
+      continue;
+    }
+    const [frontmatter] = split_frontmatter(installed);
+    charsBefore += installed.length;
+    if (frontmatter === "" && /^\uFEFF?[\s]*---/.test(installed)) {
+      failed.push({
+        rule: name,
+        reason: "opens a frontmatter block that never closes \u2014 left untouched so its ownership keys survive"
+      });
+      charsAfter += installed.length;
+      continue;
+    }
+    const next = `${frontmatter}${stubText}`;
+    try {
+      if (next !== installed) {
+        fs17.writeFileSync(target, next, "utf-8");
+        rewritten += 1;
+      }
+      thinned += 1;
+      charsAfter += next.length;
+    } catch (e) {
+      failed.push({ rule: name, reason: String(e) });
+      charsAfter += installed.length;
+    }
+  }
+  if (stubs.size === 0) {
+    failed.push({
+      rule: bodySourceDir,
+      reason: "no rule bodies found to build stubs from \u2014 the layer was left full-bodied"
+    });
+  }
+  return {
+    thinned,
+    rewritten,
+    kept,
+    preserved: preservedHits,
+    absent,
+    failed,
+    bodyLinkPrefix,
+    charsBefore,
+    charsAfter
+  };
+}
+function describeThinInstalledLayer(res) {
+  const out = [];
+  out.push(
+    res.rewritten === 0 && res.thinned > 0 ? `  claude-code: ${String(res.thinned)} rule(s) already thinned, ${String(res.kept)} kept full-bodied; ${String(res.charsAfter)} chars \u2014 nothing to rewrite` : `  claude-code: thinned ${String(res.rewritten)} rule(s) to stubs, ${String(res.kept)} kept full-bodied; ${String(res.charsBefore)} -> ${String(res.charsAfter)} chars`
+  );
+  if (res.preserved.length > 0) {
+    out.push(
+      `  claude-code: ${String(res.preserved.length)} rule(s) left full \u2014 you edited them and they are preserved, never overwritten (${res.preserved.join(", ")})`
+    );
+  }
+  for (const f of res.failed) {
+    out.push(`  claude-code: ${f.rule}: could not write stub \u2014 ${f.reason}`);
+  }
+  return out;
+}
+function installReceiptBudgetLines(packageRoot, home = os5.homedir()) {
+  try {
+    const recorded = (() => {
+      try {
+        return readRecordedHashes(manifest_path(packageRoot), packageRoot);
+      } catch {
+        return NO_RECORDED_HASHES;
+      }
+    })();
+    const layers = [];
+    for (const host of Object.keys(GLOBAL_RULE_DIRS).sort()) {
+      const dir = globalRuleLayerPath(host, home);
+      if (dir === null) continue;
+      layers.push(readLayer(host, "global", dir, recorded));
+    }
+    const rows = buildHostLimitRows(layers, loadHostInstructionLimits());
+    return rows.length === 0 ? [] : renderHostLimitRows(rows).map((l) => `  ${l}`);
+  } catch {
+    return [];
+  }
+}
+
+// src/install/globalRuleScope.ts
+function isPlainObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function resolveGlobalRuleScope(inputs) {
+  const { packageRoot, warn: warn2 } = inputs;
+  const settings_path = inputs.settingsPath;
+  if (settings_path === null) {
+    try {
+      return ruleScopeFromSettings(inputs.loadDefaults(), packageRoot);
+    } catch {
+      return LEGACY_ALL;
+    }
+  }
+  let text;
+  try {
+    text = inputs.readText(settings_path);
+  } catch (e) {
+    warn2(
+      `could not read ${settings_path} (${String(e)}) \u2014 rule scoping falls back to legacy-all, so ALL rules including maintainer-only ones will be installed. Fix the file to restore scoping.`
+    );
+    return LEGACY_ALL;
+  }
+  const parsed = inputs.parseYaml(text);
+  if (!isPlainObject2(parsed)) {
+    warn2(
+      `${settings_path} is not a YAML mapping \u2014 rule scoping falls back to legacy-all, so ALL rules including maintainer-only ones will be installed. Fix the file to restore scoping.`
+    );
+    return LEGACY_ALL;
+  }
+  try {
+    return ruleScopeFromSettings(parsed, packageRoot);
+  } catch (e) {
+    warn2(
+      `could not derive rule scope from ${settings_path} (${String(e)}) \u2014 falling back to legacy-all; ALL rules will be installed.`
+    );
+    return LEGACY_ALL;
+  }
+}
+
+// src/scripts/_lib/lean_projection_mode.ts
+import * as path18 from "node:path";
+var DEFAULT_LEAN_PROJECTION_MODE = "eager-all";
+function normalizeLeanProjectionMode(raw) {
+  const v = typeof raw === "string" ? raw.trim().toLowerCase() : "";
+  if (v === "thin") return "thin";
+  if (v === "delivery") return "delivery";
+  return DEFAULT_LEAN_PROJECTION_MODE;
+}
+function writesThinFiles(mode) {
+  return mode === "thin" || mode === "delivery";
+}
+var THINNABLE_HOSTS = ["claude-code", "cursor", "cline"];
+var DEFAULT_LEAN_PROJECTION_HOSTS = ["claude-code"];
+function resolveLeanProjectionHosts(raw) {
+  const known = new Set(THINNABLE_HOSTS);
+  if (!Array.isArray(raw) || raw.length === 0) {
+    return { hosts: [...DEFAULT_LEAN_PROJECTION_HOSTS], dropped: [], usedDefault: true };
+  }
+  const hosts = [];
+  const dropped = [];
+  for (const entry of raw) {
+    const id = typeof entry === "string" ? entry.trim().toLowerCase() : "";
+    if (id === "") {
+      dropped.push({ id: String(entry), reason: "unknown" });
+      continue;
+    }
+    if (!known.has(id)) {
+      dropped.push({ id, reason: KNOWN_NON_THINNABLE_HOSTS.has(id) ? "not-thinnable" : "unknown" });
+      continue;
+    }
+    if (!hosts.includes(id)) hosts.push(id);
+  }
+  hosts.sort();
+  return { hosts, dropped, usedDefault: false };
+}
+var KNOWN_NON_THINNABLE_HOSTS = /* @__PURE__ */ new Set([
+  "claude-desktop",
+  "augment",
+  "copilot",
+  "windsurf",
+  "gemini",
+  "codex",
+  "cowork"
+]);
+function thinsHost(mode, hosts, hostId) {
+  return writesThinFiles(mode) && hosts.includes(hostId);
+}
+function resolveLeanProjection(opts = {}) {
+  const file = opts.settingsPath ?? path18.join(opts.projectRoot ?? process.cwd(), ".agent-settings.yml");
+  const tpl = opts.packageRoot == null ? null : path18.join(opts.packageRoot, "src", "config", "agent-settings.template.yml");
+  let lean;
+  try {
+    lean = load_agent_settings(
+      tpl === null ? { project_path: file } : { project_path: file, template_path: tpl }
+    )["lean_projection"];
+  } catch {
+  }
+  const obj = typeof lean === "object" && lean !== null && !Array.isArray(lean) ? lean : {};
+  const o = obj;
+  return {
+    mode: normalizeLeanProjectionMode(o["mode"] ?? ""),
+    hosts: resolveLeanProjectionHosts(o["hosts"]),
+    // LAZY, and the hot path is the reason. Provenance needs a SECOND,
+    // template-isolated cascade, and only the installer reads it — the
+    // delivery concern on `user_prompt_submit` destructures `{ mode, hosts }`
+    // and discards this field, so computing it eagerly doubled the per-prompt
+    // settings read for an answer nobody asked for. A getter keeps the
+    // field's shape (`readonly modeExplicit: boolean`) and charges only the
+    // caller that touches it.
+    get modeExplicit() {
+      return rawExplicitLeanProjectionMode(opts) !== "";
+    }
+  };
+}
+var NO_TEMPLATE_LAYER = path18.join(path18.sep, "dev", "null", "agent-config-absent-template.yml");
+function rawExplicitLeanProjectionMode(opts = {}) {
+  const file = opts.settingsPath ?? path18.join(opts.projectRoot ?? process.cwd(), ".agent-settings.yml");
+  let lean;
+  try {
+    lean = load_agent_settings({ project_path: file, template_path: NO_TEMPLATE_LAYER })["lean_projection"];
+  } catch {
+    return "";
+  }
+  if (typeof lean !== "object" || lean === null || Array.isArray(lean)) return "";
+  const m = lean["mode"];
+  return typeof m === "string" ? m.trim() : "";
+}
+function installerThinsHost(hostId, opts = {}) {
+  const { mode, hosts, modeExplicit } = resolveLeanProjection({
+    ...opts,
+    settingsPath: opts.settingsPath ?? NO_PROJECT_LAYER
+  });
+  return modeExplicit && thinsHost(mode, hosts.hosts, hostId);
+}
+var NO_PROJECT_LAYER = path18.join(
+  path18.sep,
+  "dev",
+  "null",
+  "agent-config-absent-project-settings.yml"
+);
+
 // src/shared/settingsSurface.ts
 function unwrapRef(root) {
   if (root.$ref !== void 0 && root.definitions !== void 0) {
@@ -3390,8 +4334,8 @@ var zodToJsonSchema = (schema, options) => {
 };
 
 // src/scripts/_lib/module_detection.ts
-import * as fs12 from "node:fs";
-import * as path11 from "node:path";
+import * as fs18 from "node:fs";
+import * as path19 from "node:path";
 var _SKIP_DIRS = /* @__PURE__ */ new Set([".module-template", ".example"]);
 var _RULES = [
   ["app/Modules", "laravel-hmvc", "App\\Modules\\{ModuleName}"],
@@ -3405,14 +4349,14 @@ var _RULES = [
 ];
 function _isDir(p) {
   try {
-    return fs12.statSync(p).isDirectory();
+    return fs18.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function _isFile(p) {
   try {
-    return fs12.statSync(p).isFile();
+    return fs18.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -3426,13 +4370,13 @@ function _isUpperChar(ch) {
 function _list_module_subdirs(root) {
   let entries;
   try {
-    entries = fs12.readdirSync(root).sort();
+    entries = fs18.readdirSync(root).sort();
   } catch {
     return [];
   }
   const out = [];
   for (const name of entries) {
-    if (!_isDir(path11.join(root, name))) {
+    if (!_isDir(path19.join(root, name))) {
       continue;
     }
     if (name.startsWith(".")) {
@@ -3454,11 +4398,11 @@ function _score_confidence(stack, root, subdirs) {
     return capitalized.length > 0 ? "high" : "medium";
   }
   if (stack === "node-monorepo") {
-    const withPkgJson = subdirs.filter((name) => _isFile(path11.join(root, name, "package.json")));
+    const withPkgJson = subdirs.filter((name) => _isFile(path19.join(root, name, "package.json")));
     return withPkgJson.length > 0 ? "high" : "medium";
   }
   if (stack === "python-src") {
-    const withInit = subdirs.filter((name) => _isFile(path11.join(root, name, "__init__.py")));
+    const withInit = subdirs.filter((name) => _isFile(path19.join(root, name, "__init__.py")));
     return withInit.length > 0 ? "high" : "medium";
   }
   if (stack === "go-internal") {
@@ -3470,7 +4414,7 @@ function detect_module_roots(project_root) {
   const high = [];
   const medium = [];
   for (const [rel_path, stack, namespace_template] of _RULES) {
-    const abs_path = path11.join(project_root, rel_path);
+    const abs_path = path19.join(project_root, rel_path);
     if (!_isDir(abs_path)) {
       continue;
     }
@@ -3492,7 +4436,7 @@ function detect_module_roots(project_root) {
 }
 
 // src/scripts/_lib/model_tier.ts
-import fs13 from "node:fs";
+import fs19 from "node:fs";
 var TIER_TO_CLAUDE_MODEL = {
   frontier: "fable",
   high: "opus",
@@ -3501,8 +4445,8 @@ var TIER_TO_CLAUDE_MODEL = {
 };
 var MODEL_TIER_RE = /^model_tier:\s*"?([a-z]+)"?\s*$/m;
 function read_model_tier(skill_md) {
-  if (!fs13.existsSync(skill_md)) return null;
-  const text = fs13.readFileSync(skill_md).toString("utf-8");
+  if (!fs19.existsSync(skill_md)) return null;
+  const text = fs19.readFileSync(skill_md).toString("utf-8");
   if (!text.startsWith("---\n")) return null;
   const end = text.indexOf("\n---\n", 4);
   if (end === -1) return null;
@@ -3518,15 +4462,15 @@ function render_native_model_md(text, tier) {
 }
 
 // src/install/paths.ts
-import { homedir as homedir4, tmpdir } from "node:os";
-import { join as join12 } from "node:path";
+import { homedir as homedir7, tmpdir } from "node:os";
+import { join as join20 } from "node:path";
 var INSTALL_ROOT_SUBPATH = ".event4u/agent-config";
 var INSTALL_LOG_FILENAME = "install-log.jsonl";
 function resolveHome(home) {
   if (home && home.length > 0) {
     return home;
   }
-  const fromOs = homedir4();
+  const fromOs = homedir7();
   if (!fromOs) {
     throw new Error(
       "Cannot resolve home directory \u2014 both $HOME (POSIX) and $USERPROFILE (Windows) are unset."
@@ -3535,14 +4479,14 @@ function resolveHome(home) {
   return fromOs;
 }
 function getInstallRoot(home) {
-  return join12(resolveHome(home), INSTALL_ROOT_SUBPATH);
+  return join20(resolveHome(home), INSTALL_ROOT_SUBPATH);
 }
 function getLogPath(home) {
-  return join12(getInstallRoot(home), INSTALL_LOG_FILENAME);
+  return join20(getInstallRoot(home), INSTALL_LOG_FILENAME);
 }
 
 // src/scripts/install.ts
-var _HERE = fileURLToPath2(import.meta.url);
+var _HERE2 = fileURLToPath4(import.meta.url);
 var SystemExitError = class extends Error {
   constructor(code) {
     super(`system-exit-${code}`);
@@ -3558,43 +4502,43 @@ var ArgparseExit = class extends Error {
   code;
 };
 function expanduser3(p) {
-  if (p === "~") return os3.homedir();
+  if (p === "~") return os6.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
-    return path12.join(os3.homedir(), p.slice(2));
+    return path20.join(os6.homedir(), p.slice(2));
   }
   return p;
 }
 function isFile(p) {
   try {
-    return fs14.statSync(p).isFile();
+    return fs20.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function isDir(p) {
   try {
-    return fs14.statSync(p).isDirectory();
+    return fs20.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function isSymlink(p) {
   try {
-    return fs14.lstatSync(p).isSymbolicLink();
+    return fs20.lstatSync(p).isSymbolicLink();
   } catch {
     return false;
   }
 }
 function readText(p) {
-  return fs14.readFileSync(p, "utf-8");
+  return fs20.readFileSync(p, "utf-8");
 }
 function writeText(p, content) {
-  fs14.writeFileSync(p, content, "utf-8");
+  fs20.writeFileSync(p, content, "utf-8");
 }
 function sortedGlobStems(directory, suffix) {
   let entries;
   try {
-    entries = fs14.readdirSync(directory);
+    entries = fs20.readdirSync(directory);
   } catch {
     return [];
   }
@@ -3614,34 +4558,34 @@ function sortedGlobStems(directory, suffix) {
 function countZips(directory) {
   if (!isDir(directory)) return 0;
   let n = 0;
-  for (const name of fs14.readdirSync(directory)) {
+  for (const name of fs20.readdirSync(directory)) {
     if (name.endsWith(".zip")) n += 1;
   }
   return n;
 }
 function atomicWrite0644(target, body, prefix) {
-  const dir = path12.dirname(target);
-  const tmpName = path12.join(
+  const dir = path20.dirname(target);
+  const tmpName = path20.join(
     dir,
     `${prefix}${process2.pid}.${crypto5.randomBytes(6).toString("hex")}.yml.tmp`
   );
   let fd = null;
   try {
-    fd = fs14.openSync(tmpName, "wx", 420);
-    fs14.writeFileSync(fd, body, "utf-8");
-    fs14.closeSync(fd);
+    fd = fs20.openSync(tmpName, "wx", 420);
+    fs20.writeFileSync(fd, body, "utf-8");
+    fs20.closeSync(fd);
     fd = null;
-    fs14.chmodSync(tmpName, 420);
-    fs14.renameSync(tmpName, target);
+    fs20.chmodSync(tmpName, 420);
+    fs20.renameSync(tmpName, target);
   } catch (err) {
     if (fd !== null) {
       try {
-        fs14.closeSync(fd);
+        fs20.closeSync(fd);
       } catch {
       }
     }
     try {
-      fs14.unlinkSync(tmpName);
+      fs20.unlinkSync(tmpName);
     } catch {
     }
     throw err;
@@ -3653,14 +4597,14 @@ function utcStamp(now) {
   return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}T${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}Z`;
 }
 function yamlSafeLoad(text) {
-  let YAML2;
+  let YAML3;
   try {
-    YAML2 = require_dist();
+    YAML3 = require_dist();
   } catch {
     return null;
   }
   try {
-    const data = YAML2.parse(text, { version: "1.1" });
+    const data = YAML3.parse(text, { version: "1.1" });
     return data;
   } catch {
     return void 0;
@@ -3676,12 +4620,12 @@ var LEGACY_SETTINGS_FILE = ".agent-settings";
 var LEGACY_BACKUP_FILE = ".agent-settings.backup.key-value";
 var SETTINGS_SUBDIR = ["agents", "settings"];
 function _canonical_settings_target(project_root) {
-  return path12.join(project_root, ...SETTINGS_SUBDIR, SETTINGS_FILE);
+  return path20.join(project_root, ...SETTINGS_SUBDIR, SETTINGS_FILE);
 }
 function _resolve_settings_read(project_root) {
   const canonical = _canonical_settings_target(project_root);
   if (pathExists(canonical)) return canonical;
-  const legacy = path12.join(project_root, SETTINGS_FILE);
+  const legacy = path20.join(project_root, SETTINGS_FILE);
   if (pathExists(legacy)) return legacy;
   return canonical;
 }
@@ -3747,9 +4691,9 @@ function fail(msg) {
   throw new SystemExitError(1);
 }
 function detect_package_root(project_root) {
-  const npm_path = path12.join(project_root, "node_modules", "@event4u", "agent-config");
+  const npm_path = path20.join(project_root, "node_modules", "@event4u", "agent-config");
   if (isDir(npm_path)) return resolvePath(npm_path);
-  if (pathExists(path12.join(project_root, "src", "config", "profiles", "minimal.ini"))) {
+  if (pathExists(path20.join(project_root, "src", "config", "profiles", "minimal.ini"))) {
     return project_root;
   }
   fail(
@@ -3757,12 +4701,12 @@ function detect_package_root(project_root) {
   );
 }
 function detect_package_type(package_root) {
-  if (package_root.split(path12.sep).includes("node_modules")) return "npm";
+  if (package_root.split(path20.sep).includes("node_modules")) return "npm";
   return "local";
 }
 function detect_package_type_for_project(project_root, package_root) {
   const npm_path = resolvePath(
-    path12.join(project_root, "node_modules", "@event4u", "agent-config")
+    path20.join(project_root, "node_modules", "@event4u", "agent-config")
   );
   const package_resolved = resolvePath(package_root);
   if (package_resolved === npm_path) return "npm";
@@ -3786,7 +4730,7 @@ function ensure_directory(p) {
   mkdirp(p);
 }
 function write_file(p, content) {
-  ensure_directory(path12.dirname(p));
+  ensure_directory(path20.dirname(p));
   writeText(p, content);
 }
 function read_json_file(p) {
@@ -3807,50 +4751,6 @@ function write_json_file(p, data) {
   const content = jsonDumpsIndent(data, 4) + "\n";
   write_file(p, content);
 }
-function _isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function deepcopy(v) {
-  if (v === null || typeof v !== "object") return v;
-  if (Array.isArray(v)) return v.map((x) => deepcopy(x));
-  const out = {};
-  for (const k of Object.keys(v)) {
-    out[k] = deepcopy(v[k]);
-  }
-  return out;
-}
-function deep_merge(base, overlay) {
-  const result = deepcopy(base);
-  for (const key of Object.keys(overlay)) {
-    const value = overlay[key];
-    if (Object.prototype.hasOwnProperty.call(result, key) && _isPlainObject(result[key]) && _isPlainObject(value)) {
-      result[key] = deep_merge(
-        result[key],
-        value
-      );
-    } else {
-      result[key] = deepcopy(value);
-    }
-  }
-  return result;
-}
-function jsonEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (Array.isArray(a) || Array.isArray(b)) {
-    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-    return a.every((v, i) => jsonEqual(v, b[i]));
-  }
-  if (_isPlainObject(a) && _isPlainObject(b)) {
-    const ka = Object.keys(a);
-    const kb = Object.keys(b);
-    if (ka.length !== kb.length) return false;
-    return ka.every(
-      (k) => Object.prototype.hasOwnProperty.call(b, k) && jsonEqual(a[k], b[k])
-    );
-  }
-  return false;
-}
 function merge_json_file(p, new_data, _force, label) {
   const new_entries = build_merge_entries(label, new_data);
   if (!pathExists(p)) {
@@ -3859,7 +4759,7 @@ function merge_json_file(p, new_data, _force, label) {
     return new_entries;
   }
   const existing = read_json_file(p);
-  const merged = deep_merge(existing, new_data);
+  const merged = mergeHostConfig(existing, new_data, HOOK_SIGNATURES[label] ?? "", deepMerge);
   if (jsonEqual(merged, existing)) {
     skip(`${label} already configured`);
     return new_entries;
@@ -3957,7 +4857,7 @@ function _append_unknown_legacy(rendered, legacy_values, unknown_keys) {
   return rendered + "\n" + suffix;
 }
 function _migrate_legacy_if_present(project_root, template_body) {
-  const legacy_target = path12.join(project_root, LEGACY_SETTINGS_FILE);
+  const legacy_target = path20.join(project_root, LEGACY_SETTINGS_FILE);
   if (!isFile(legacy_target)) return null;
   const legacy_text = readText(legacy_target);
   const [values, unknown] = _parse_legacy_settings(legacy_text);
@@ -3972,9 +4872,9 @@ function _migrate_legacy_if_present(project_root, template_body) {
     }
   }
   rendered = _append_unknown_legacy(rendered, values, unknown);
-  const backup_target = path12.join(project_root, LEGACY_BACKUP_FILE);
+  const backup_target = path20.join(project_root, LEGACY_BACKUP_FILE);
   writeText(backup_target, legacy_text);
-  fs14.unlinkSync(legacy_target);
+  fs20.unlinkSync(legacy_target);
   info(`Migrated legacy ${LEGACY_SETTINGS_FILE} \u2192 ${SETTINGS_FILE}`);
   info(`Backup saved to ${LEGACY_BACKUP_FILE}`);
   if (unknown.length > 0) {
@@ -4009,7 +4909,7 @@ function _render_template(template, profile_values) {
   return body;
 }
 function _load_valid_user_types(package_root) {
-  const directory = path12.join(package_root, USER_TYPES_DIR);
+  const directory = path20.join(package_root, USER_TYPES_DIR);
   if (!isDir(directory)) return [];
   return sortedGlobStems(directory, ".yml");
 }
@@ -4066,8 +4966,8 @@ function splitlinesKeepends(text) {
 }
 function ensure_agent_settings(project_root, package_root, profile, force, user_type = "", packs = null) {
   const target = _canonical_settings_target(project_root);
-  const profile_source = path12.join(package_root, "src", "config", "profiles", `${profile}.ini`);
-  const template_source = path12.join(package_root, "src", "config", "agent-settings.template.yml");
+  const profile_source = path20.join(package_root, "src", "config", "profiles", `${profile}.ini`);
+  const template_source = path20.join(package_root, "src", "config", "agent-settings.template.yml");
   if (!pathExists(profile_source)) fail(`Missing profile preset: ${profile_source}`);
   if (!pathExists(template_source)) fail(`Missing settings template: ${template_source}`);
   const template = readText(template_source);
@@ -4081,21 +4981,21 @@ function ensure_agent_settings(project_root, package_root, profile, force, user_
   if (profile_values["rule_loading_tier"] !== profile) {
     const got = "rule_loading_tier" in profile_values ? `'${profile_values["rule_loading_tier"]}'` : "None";
     fail(
-      `Profile preset ${path12.basename(profile_source)} has rule_loading_tier=${got} but --profile=${profile}`
+      `Profile preset ${path20.basename(profile_source)} has rule_loading_tier=${got} but --profile=${profile}`
     );
   }
   profile_values["user_type"] = _validate_user_type(package_root, user_type);
   let template_body = _render_template(template, profile_values);
   template_body = _inject_packs(template_body, packs ?? []);
-  const legacy_root = path12.join(project_root, SETTINGS_FILE);
+  const legacy_root = path20.join(project_root, SETTINGS_FILE);
   if (isFile(legacy_root) && !pathExists(target)) {
-    mkdirp(path12.dirname(target));
+    mkdirp(path20.dirname(target));
     writeText(target, readText(legacy_root));
-    fs14.unlinkSync(legacy_root);
+    fs20.unlinkSync(legacy_root);
     success(`Migrated ${SETTINGS_FILE} \u2192 agents/settings/${SETTINGS_FILE} (ADR-038)`);
     return;
   }
-  const legacy_target = path12.join(project_root, LEGACY_SETTINGS_FILE);
+  const legacy_target = path20.join(project_root, LEGACY_SETTINGS_FILE);
   if (isFile(legacy_target) && pathExists(target)) {
     warn(
       `Both ${SETTINGS_FILE} and legacy ${LEGACY_SETTINGS_FILE} exist. Skipping migration to avoid overwriting ${SETTINGS_FILE}. Delete one of them manually and re-run.`
@@ -4112,7 +5012,7 @@ function ensure_agent_settings(project_root, package_root, profile, force, user_
     skip(`${SETTINGS_FILE} already exists`);
     return;
   }
-  mkdirp(path12.dirname(target));
+  mkdirp(path20.dirname(target));
   write_file(target, template_body);
   const user_type_value = profile_values["user_type"] ?? "";
   const suffix = user_type_value ? `, user_type=${user_type_value}` : "";
@@ -4125,7 +5025,7 @@ function ensure_vscode_bridge(project_root, package_type, force) {
   const plugin_path = plugin_paths[package_type] ?? "./plugin/agent-config";
   const bridge = { "chat.pluginLocations": { [plugin_path]: true } };
   return merge_json_file(
-    path12.join(project_root, ".vscode", "settings.json"),
+    path20.join(project_root, ".vscode", "settings.json"),
     bridge,
     force,
     ".vscode/settings.json"
@@ -4134,14 +5034,14 @@ function ensure_vscode_bridge(project_root, package_type, force) {
 function ensure_augment_bridge(project_root, force) {
   const bridge = { enabledPlugins: { "agent-config@event4u": true } };
   return merge_json_file(
-    path12.join(project_root, ".augment", "settings.json"),
+    path20.join(project_root, ".augment", "settings.json"),
     bridge,
     force,
     ".augment/settings.json"
   );
 }
-var AUGMENT_USER_DIR = path12.join(os3.homedir(), ".augment");
-var AUGMENT_USER_HOOKS_DIR = path12.join(AUGMENT_USER_DIR, "hooks");
+var AUGMENT_USER_DIR = path20.join(os6.homedir(), ".augment");
+var AUGMENT_USER_HOOKS_DIR = path20.join(AUGMENT_USER_DIR, "hooks");
 var AUGMENT_DISPATCHER_TRAMPOLINE = "augment-dispatcher.sh";
 var AUGMENT_LEGACY_TRAMPOLINES = [
   "augment-chat-history.sh",
@@ -4150,29 +5050,29 @@ var AUGMENT_LEGACY_TRAMPOLINES = [
   "augment-context-hygiene.sh"
 ];
 function _deploy_augment_trampoline(package_root, name, force) {
-  const src = path12.join(package_root, "scripts", "hooks", name);
+  const src = path20.join(package_root, "scripts", "hooks", name);
   if (!pathExists(src)) {
     skip(`augment trampoline missing in package: ${src}`);
     return null;
   }
   mkdirp(AUGMENT_USER_HOOKS_DIR);
-  const dst = path12.join(AUGMENT_USER_HOOKS_DIR, name);
+  const dst = path20.join(AUGMENT_USER_HOOKS_DIR, name);
   const src_text = readText(src);
   if (pathExists(dst) && readText(dst) === src_text && !force) {
     skip(`~/.augment/hooks/${name} already up to date`);
   } else {
     writeText(dst, src_text);
-    fs14.chmodSync(dst, 493);
+    fs20.chmodSync(dst, 493);
     success(`~/.augment/hooks/${name} installed`);
   }
   return dst;
 }
 function _remove_legacy_augment_trampolines() {
   for (const name of AUGMENT_LEGACY_TRAMPOLINES) {
-    const legacy = path12.join(AUGMENT_USER_HOOKS_DIR, name);
+    const legacy = path20.join(AUGMENT_USER_HOOKS_DIR, name);
     try {
       if (isFile(legacy)) {
-        fs14.unlinkSync(legacy);
+        fs20.unlinkSync(legacy);
         skip(`removed legacy ~/.augment/hooks/${name}`);
       }
     } catch (err) {
@@ -4192,7 +5092,7 @@ function ensure_augment_user_hooks(package_root, force) {
   }
   const settings_patch = { hooks: per_event };
   return merge_json_file(
-    path12.join(AUGMENT_USER_DIR, "settings.json"),
+    path20.join(AUGMENT_USER_DIR, "settings.json"),
     settings_patch,
     force,
     "~/.augment/settings.json"
@@ -4207,7 +5107,7 @@ function _heal_legacy_claude_plugin_ids(p) {
   if (!pathExists(p)) return [];
   const data = read_json_file(p);
   const enabled = data["enabledPlugins"];
-  if (!_isPlainObject(enabled)) return [];
+  if (!isPlainObject(enabled)) return [];
   const removed = CLAUDE_LEGACY_PLUGIN_IDS.filter((pid) => pid in enabled);
   if (removed.length === 0) return [];
   for (const pid of removed) {
@@ -4217,12 +5117,10 @@ function _heal_legacy_claude_plugin_ids(p) {
   return removed;
 }
 function ensure_claude_bridge(project_root, force) {
-  const target = path12.join(project_root, ".claude", "settings.json");
+  const target = path20.join(project_root, ".claude", "settings.json");
   const healed = _heal_legacy_claude_plugin_ids(target);
-  for (const pid of healed) {
-    success(`.claude/settings.json: removed stale plugin id \`${pid}\``);
-  }
-  const bridge = { enabledPlugins: { [CLAUDE_PLUGIN_ID]: true } };
+  for (const pid of healed) success(`.claude/settings.json: removed stale plugin id \`${pid}\``);
+  const bridge = withHostEnv({ enabledPlugins: { [CLAUDE_PLUGIN_ID]: true } }, project_root, success);
   return merge_json_file(target, bridge, force || healed.length > 0, ".claude/settings.json");
 }
 var ensure_mcp_bridge = makeEnsureMcpBridge(merge_json_file);
@@ -4237,29 +5135,29 @@ function ensure_cursor_bridge(project_root, force) {
   }
   const bridge = { version: 1, hooks };
   return merge_json_file(
-    path12.join(project_root, ".cursor", "hooks.json"),
+    path20.join(project_root, ".cursor", "hooks.json"),
     bridge,
     force,
     ".cursor/hooks.json"
   );
 }
-var CURSOR_USER_DIR = path12.join(os3.homedir(), ".cursor");
-var CURSOR_USER_HOOKS_DIR = path12.join(CURSOR_USER_DIR, "hooks");
+var CURSOR_USER_DIR = path20.join(os6.homedir(), ".cursor");
+var CURSOR_USER_HOOKS_DIR = path20.join(CURSOR_USER_DIR, "hooks");
 var CURSOR_DISPATCHER_TRAMPOLINE = "cursor-dispatcher.sh";
 function ensure_cursor_user_hooks(package_root, force) {
-  const src = path12.join(package_root, "scripts", "hooks", CURSOR_DISPATCHER_TRAMPOLINE);
+  const src = path20.join(package_root, "scripts", "hooks", CURSOR_DISPATCHER_TRAMPOLINE);
   if (!pathExists(src)) {
     skip(`cursor trampoline missing in package: ${src}`);
     return [];
   }
   mkdirp(CURSOR_USER_HOOKS_DIR);
-  const dst = path12.join(CURSOR_USER_HOOKS_DIR, CURSOR_DISPATCHER_TRAMPOLINE);
+  const dst = path20.join(CURSOR_USER_HOOKS_DIR, CURSOR_DISPATCHER_TRAMPOLINE);
   const src_text = readText(src);
   if (pathExists(dst) && readText(dst) === src_text && !force) {
     skip(`~/.cursor/hooks/${CURSOR_DISPATCHER_TRAMPOLINE} already up to date`);
   } else {
     writeText(dst, src_text);
-    fs14.chmodSync(dst, 493);
+    fs20.chmodSync(dst, 493);
     success(`~/.cursor/hooks/${CURSOR_DISPATCHER_TRAMPOLINE} installed`);
   }
   const hooks = {};
@@ -4268,7 +5166,7 @@ function ensure_cursor_user_hooks(package_root, force) {
   }
   const settings_patch = { version: 1, hooks };
   return merge_json_file(
-    path12.join(CURSOR_USER_DIR, "hooks.json"),
+    path20.join(CURSOR_USER_DIR, "hooks.json"),
     settings_patch,
     force,
     "~/.cursor/hooks.json"
@@ -4303,12 +5201,12 @@ exit 0
 `;
 }
 function ensure_cline_bridge(project_root, force) {
-  const hooks_dir = path12.join(project_root, ".clinerules", "hooks");
+  const hooks_dir = path20.join(project_root, ".clinerules", "hooks");
   mkdirp(hooks_dir);
   const workspace_quoted = shlexQuote(resolvePath(project_root));
   let written = 0;
   for (const { slot, native } of hostBindings("cline")) {
-    const target = path12.join(hooks_dir, native);
+    const target = path20.join(hooks_dir, native);
     const body = clineProjectHookBody(native, slot, workspace_quoted);
     if (pathExists(target) && readText(target) === body && !force) {
       continue;
@@ -4318,7 +5216,7 @@ function ensure_cline_bridge(project_root, force) {
       continue;
     }
     writeText(target, body);
-    fs14.chmodSync(target, 493);
+    fs20.chmodSync(target, 493);
     written += 1;
   }
   if (written) {
@@ -4327,27 +5225,27 @@ function ensure_cline_bridge(project_root, force) {
     skip(".clinerules/hooks/ already up to date");
   }
 }
-var CLINE_USER_DIR = path12.join(os3.homedir(), "Documents", "Cline", "Hooks");
+var CLINE_USER_DIR = path20.join(os6.homedir(), "Documents", "Cline", "Hooks");
 var CLINE_DISPATCHER_TRAMPOLINE = "cline-dispatcher.sh";
 function ensure_cline_user_hooks(package_root, force) {
-  const src = path12.join(package_root, "scripts", "hooks", CLINE_DISPATCHER_TRAMPOLINE);
+  const src = path20.join(package_root, "scripts", "hooks", CLINE_DISPATCHER_TRAMPOLINE);
   if (!pathExists(src)) {
     skip(`cline trampoline missing in package: ${src}`);
     return;
   }
   mkdirp(CLINE_USER_DIR);
-  const trampoline = path12.join(CLINE_USER_DIR, CLINE_DISPATCHER_TRAMPOLINE);
+  const trampoline = path20.join(CLINE_USER_DIR, CLINE_DISPATCHER_TRAMPOLINE);
   const src_text = readText(src);
   if (pathExists(trampoline) && readText(trampoline) === src_text && !force) {
     skip(`~/Documents/Cline/Hooks/${CLINE_DISPATCHER_TRAMPOLINE} already up to date`);
   } else {
     writeText(trampoline, src_text);
-    fs14.chmodSync(trampoline, 493);
+    fs20.chmodSync(trampoline, 493);
     success(`~/Documents/Cline/Hooks/${CLINE_DISPATCHER_TRAMPOLINE} installed`);
   }
   const trampoline_quoted = shlexQuote(trampoline);
   for (const { slot, native } of hostBindings("cline")) {
-    const wrapper = path12.join(CLINE_USER_DIR, native);
+    const wrapper = path20.join(CLINE_USER_DIR, native);
     const body = `#!/usr/bin/env bash
 # Generated by event4u/agent-config \u2014 DO NOT EDIT.
 # User-scope Cline hook for ${native} \u2192 agent-config ${slot}.
@@ -4357,7 +5255,7 @@ exec ${trampoline_quoted} ${slot} ${native}
       continue;
     }
     writeText(wrapper, body);
-    fs14.chmodSync(wrapper, 493);
+    fs20.chmodSync(wrapper, 493);
   }
 }
 function _windsurf_dispatch_command(ac_event, native) {
@@ -4373,29 +5271,29 @@ function ensure_windsurf_bridge(project_root, force) {
   }
   const bridge = { hooks };
   return merge_json_file(
-    path12.join(project_root, ".windsurf", "hooks.json"),
+    path20.join(project_root, ".windsurf", "hooks.json"),
     bridge,
     force,
     ".windsurf/hooks.json"
   );
 }
-var WINDSURF_USER_DIR = path12.join(os3.homedir(), ".codeium", "windsurf");
-var WINDSURF_USER_HOOKS_DIR = path12.join(WINDSURF_USER_DIR, "hooks");
+var WINDSURF_USER_DIR = path20.join(os6.homedir(), ".codeium", "windsurf");
+var WINDSURF_USER_HOOKS_DIR = path20.join(WINDSURF_USER_DIR, "hooks");
 var WINDSURF_DISPATCHER_TRAMPOLINE = "windsurf-dispatcher.sh";
 function ensure_windsurf_user_hooks(package_root, force) {
-  const src = path12.join(package_root, "scripts", "hooks", WINDSURF_DISPATCHER_TRAMPOLINE);
+  const src = path20.join(package_root, "scripts", "hooks", WINDSURF_DISPATCHER_TRAMPOLINE);
   if (!pathExists(src)) {
     skip(`windsurf trampoline missing in package: ${src}`);
     return [];
   }
   mkdirp(WINDSURF_USER_HOOKS_DIR);
-  const dst = path12.join(WINDSURF_USER_HOOKS_DIR, WINDSURF_DISPATCHER_TRAMPOLINE);
+  const dst = path20.join(WINDSURF_USER_HOOKS_DIR, WINDSURF_DISPATCHER_TRAMPOLINE);
   const src_text = readText(src);
   if (pathExists(dst) && readText(dst) === src_text && !force) {
     skip(`~/.codeium/windsurf/hooks/${WINDSURF_DISPATCHER_TRAMPOLINE} already up to date`);
   } else {
     writeText(dst, src_text);
-    fs14.chmodSync(dst, 493);
+    fs20.chmodSync(dst, 493);
     success(`~/.codeium/windsurf/hooks/${WINDSURF_DISPATCHER_TRAMPOLINE} installed`);
   }
   const hooks = {};
@@ -4407,7 +5305,7 @@ function ensure_windsurf_user_hooks(package_root, force) {
   }
   const settings_patch = { hooks };
   return merge_json_file(
-    path12.join(WINDSURF_USER_DIR, "hooks.json"),
+    path20.join(WINDSURF_USER_DIR, "hooks.json"),
     settings_patch,
     force,
     "~/.codeium/windsurf/hooks.json"
@@ -4429,43 +5327,43 @@ function _gemini_hooks_dict(command_factory) {
 function ensure_gemini_bridge(project_root, force) {
   const bridge = { hooks: _gemini_hooks_dict(_gemini_dispatch_command) };
   return merge_json_file(
-    path12.join(project_root, ".gemini", "settings.json"),
+    path20.join(project_root, ".gemini", "settings.json"),
     bridge,
     force,
     ".gemini/settings.json"
   );
 }
-var GEMINI_USER_DIR = path12.join(os3.homedir(), ".gemini");
-var GEMINI_USER_HOOKS_DIR = path12.join(GEMINI_USER_DIR, "hooks");
+var GEMINI_USER_DIR = path20.join(os6.homedir(), ".gemini");
+var GEMINI_USER_HOOKS_DIR = path20.join(GEMINI_USER_DIR, "hooks");
 var GEMINI_DISPATCHER_TRAMPOLINE = "gemini-dispatcher.sh";
 function ensure_gemini_user_hooks(package_root, force) {
-  const src = path12.join(package_root, "scripts", "hooks", GEMINI_DISPATCHER_TRAMPOLINE);
+  const src = path20.join(package_root, "scripts", "hooks", GEMINI_DISPATCHER_TRAMPOLINE);
   if (!pathExists(src)) {
     skip(`gemini trampoline missing in package: ${src}`);
     return [];
   }
   mkdirp(GEMINI_USER_HOOKS_DIR);
-  const dst = path12.join(GEMINI_USER_HOOKS_DIR, GEMINI_DISPATCHER_TRAMPOLINE);
+  const dst = path20.join(GEMINI_USER_HOOKS_DIR, GEMINI_DISPATCHER_TRAMPOLINE);
   const src_text = readText(src);
   if (pathExists(dst) && readText(dst) === src_text && !force) {
     skip(`~/.gemini/hooks/${GEMINI_DISPATCHER_TRAMPOLINE} already up to date`);
   } else {
     writeText(dst, src_text);
-    fs14.chmodSync(dst, 493);
+    fs20.chmodSync(dst, 493);
     success(`~/.gemini/hooks/${GEMINI_DISPATCHER_TRAMPOLINE} installed`);
   }
   const settings_patch = {
     hooks: _gemini_hooks_dict((ac_event, native) => `${dst} ${ac_event} ${native}`)
   };
   return merge_json_file(
-    path12.join(GEMINI_USER_DIR, "settings.json"),
+    path20.join(GEMINI_USER_DIR, "settings.json"),
     settings_patch,
     force,
     "~/.gemini/settings.json"
   );
 }
 function ensure_copilot_bridge(project_root, force) {
-  const target = path12.join(project_root, ".github", "plugin", "marketplace.json");
+  const target = path20.join(project_root, ".github", "plugin", "marketplace.json");
   const bridge = {
     marketplace: {
       name: "event4u-agent-marketplace",
@@ -4508,7 +5406,7 @@ See \`docs/setup/per-ide/roocode.md\` for the full activation guide.
 Run \`./agent-config --help\` for available commands.
 `;
 function ensure_roocode_bridge(project_root, force) {
-  const target = path12.join(project_root, ".roo", "rules", "agent-config.md");
+  const target = path20.join(project_root, ".roo", "rules", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".roo/rules/agent-config.md already exists");
     return;
@@ -4530,7 +5428,7 @@ To wire Claude Desktop to this project's rules, run:
 Canonical rule and skill source: \`.augment/\` (see \`AGENTS.md\`).
 `;
 function ensure_claude_desktop_bridge(project_root, force) {
-  const target = path12.join(project_root, ".claude-desktop", "agent-config.md");
+  const target = path20.join(project_root, ".claude-desktop", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".claude-desktop/agent-config.md already exists");
     return;
@@ -4555,7 +5453,7 @@ Or pass \`--read .aider/agent-config.md\` on the command line.
 Canonical rule and skill source: \`.augment/\` (see \`AGENTS.md\`).
 `;
 function ensure_aider_bridge(project_root, force) {
-  const target = path12.join(project_root, ".aider", "agent-config.md");
+  const target = path20.join(project_root, ".aider", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".aider/agent-config.md already exists");
     return;
@@ -4574,7 +5472,7 @@ developers where the rules and skills live.
 Canonical rule and skill source: \`.augment/\` (see project \`AGENTS.md\`).
 `;
 function ensure_codex_bridge(project_root, force) {
-  const target = path12.join(project_root, ".codex", "agent-config.md");
+  const target = path20.join(project_root, ".codex", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".codex/agent-config.md already exists");
     return;
@@ -4592,7 +5490,7 @@ rules per session. The canonical rule and skill source lives under
 orientation).
 `;
 function ensure_continue_bridge(project_root, force) {
-  const target = path12.join(project_root, ".continue", "rules", "agent-config.md");
+  const target = path20.join(project_root, ".continue", "rules", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".continue/rules/agent-config.md already exists");
     return;
@@ -4623,7 +5521,7 @@ orientation).
 See \`docs/setup/per-ide/kilocode.md\` for the full activation guide.
 `;
 function ensure_kilocode_bridge(project_root, force) {
-  const target = path12.join(project_root, ".kilocode", "rules", "agent-config.md");
+  const target = path20.join(project_root, ".kilocode", "rules", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".kilocode/rules/agent-config.md already exists");
     return;
@@ -4650,7 +5548,7 @@ canonical source (or symlink it):
 Canonical rule and skill source: \`.augment/\` (see \`AGENTS.md\`).
 `;
 function ensure_zed_bridge(project_root, force) {
-  const target = path12.join(project_root, ".zed", "agent-config.md");
+  const target = path20.join(project_root, ".zed", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".zed/agent-config.md already exists");
     return;
@@ -4671,7 +5569,7 @@ rules into your JetBrains profile.
 Canonical rule and skill source: \`.augment/\` (see \`AGENTS.md\`).
 `;
 function ensure_jetbrains_bridge(project_root, force) {
-  const target = path12.join(project_root, ".jetbrains", "agent-config.md");
+  const target = path20.join(project_root, ".jetbrains", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".jetbrains/agent-config.md already exists");
     return;
@@ -4702,7 +5600,7 @@ session. The canonical rule and skill source lives under \`.augment/\`
 See \`docs/setup/per-ide/kiro.md\` for the full activation guide.
 `;
 function ensure_kiro_bridge(project_root, force) {
-  const target = path12.join(project_root, ".kiro", "steering", "agent-config.md");
+  const target = path20.join(project_root, ".kiro", "steering", "agent-config.md");
   if (pathExists(target) && !force) {
     skip(".kiro/steering/agent-config.md already exists");
     return;
@@ -4739,35 +5637,35 @@ var SMOKE_BRIDGE_PATHS = {
 };
 function dirHasEntries(p) {
   try {
-    return fs14.readdirSync(p).length > 0;
+    return fs20.readdirSync(p).length > 0;
   } catch {
     return false;
   }
 }
 function _resolve_tsx_invocation(scriptPath, scriptArgs) {
   const binName = process2.platform === "win32" ? "tsx.cmd" : "tsx";
-  let dir = path12.dirname(scriptPath);
+  let dir = path20.dirname(scriptPath);
   for (; ; ) {
-    const candidate = path12.join(dir, "node_modules", ".bin", binName);
+    const candidate = path20.join(dir, "node_modules", ".bin", binName);
     if (isFile(candidate)) {
       return { command: candidate, args: [scriptPath, ...scriptArgs] };
     }
-    const parent = path12.dirname(dir);
+    const parent = path20.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return { command: "npx", args: ["tsx", scriptPath, ...scriptArgs] };
 }
 function _smoke_test_hooks(project_root, package_root) {
-  const dispatcher = path12.join(package_root, "scripts", "hooks", "dispatch_hook.ts");
-  const manifest = path12.join(package_root, "scripts", "hook_manifest.yaml");
+  const dispatcher = path20.join(package_root, "scripts", "hooks", "dispatch_hook.ts");
+  const manifest = path20.join(package_root, "scripts", "hook_manifest.yaml");
   if (!isFile(dispatcher) || !isFile(manifest)) return 0;
   const failed = [];
   const skipped = [];
   const passed = [];
   for (const [platform, native] of smokeProbeEvents()) {
     const rel_bridge = SMOKE_BRIDGE_PATHS[platform] ?? "";
-    const bridge_path = rel_bridge ? path12.join(project_root, rel_bridge) : null;
+    const bridge_path = rel_bridge ? path20.join(project_root, rel_bridge) : null;
     const bridge_present = Boolean(
       bridge_path && (isFile(bridge_path) || isDir(bridge_path) && dirHasEntries(bridge_path))
     );
@@ -4816,7 +5714,7 @@ function _smoke_test_hooks(project_root, package_root) {
       failed.push(`${platform}: dispatcher did not emit JSON plan`);
       continue;
     }
-    const concerns = _isPlainObject(plan) ? plan["concerns"] : void 0;
+    const concerns = isPlainObject(plan) ? plan["concerns"] : void 0;
     if (!Array.isArray(concerns)) {
       failed.push(`${platform}: plan.concerns missing or not a list`);
       continue;
@@ -4898,47 +5796,6 @@ var PROJECT_BRIDGE_MARKERS = {
   jetbrains: ".jetbrains/agent-config.md",
   kiro: ".kiro/steering/agent-config.md"
 };
-var _CLAUDE_SKILL_BUNDLE = [
-  ["dist/agent-src/rules", "rules"],
-  ["dist/agent-src/skills", "skills"],
-  ["dist/agent-src/commands", "commands"],
-  ["dist/agent-src/personas", "personas"]
-];
-var GLOBAL_DEPLOY_SOURCES = {
-  "claude-code": _CLAUDE_SKILL_BUNDLE,
-  augment: [
-    ["dist/agent-src/rules", "rules"],
-    ["dist/agent-src/skills", "skills"],
-    ["dist/agent-src/commands", "commands"],
-    ["dist/agent-src/contexts", "contexts"],
-    ["dist/agent-src/personas", "personas"],
-    ["dist/agent-src/templates", "templates"]
-  ],
-  cursor: [
-    ["dist/agent-src/rules", "rules"],
-    ["dist/agent-src/commands", "commands"],
-    ["dist/agent-src/personas", "personas"]
-  ],
-  windsurf: [["dist/agent-src/rules", "rules"]],
-  cline: [["dist/agent-src/rules", ""]],
-  "gemini-cli": _CLAUDE_SKILL_BUNDLE,
-  codex: _CLAUDE_SKILL_BUNDLE,
-  continue: _CLAUDE_SKILL_BUNDLE,
-  roocode: _CLAUDE_SKILL_BUNDLE,
-  kilocode: _CLAUDE_SKILL_BUNDLE,
-  qoder: _CLAUDE_SKILL_BUNDLE,
-  opencode: _CLAUDE_SKILL_BUNDLE,
-  trae: _CLAUDE_SKILL_BUNDLE,
-  antigravity: _CLAUDE_SKILL_BUNDLE,
-  codebuddy: _CLAUDE_SKILL_BUNDLE,
-  droid: _CLAUDE_SKILL_BUNDLE,
-  warp: _CLAUDE_SKILL_BUNDLE,
-  kiro: [
-    ["dist/agent-src/rules", "rules"],
-    ["dist/agent-src/skills", "steering"],
-    ["dist/agent-src/personas", "personas"]
-  ]
-};
 function claudeDesktopMarkerBody(lockfile, anchor, bundles_dir, bundle_count) {
   return `# agent-config \u2014 Claude Desktop marker
 
@@ -4967,9 +5824,9 @@ To remove this marker, delete this file.
 `;
 }
 var _CLAUDE_DESKTOP_BUNDLES_SUBPATH = "claude-desktop/bundles";
-var GLOBAL_ROOT = path12.join(os3.homedir(), ".event4u", "agent-config");
-var GLOBAL_USER_SETTINGS_PATH = path12.join(GLOBAL_ROOT, ".agent-user.yml");
-var GLOBAL_AGENT_SETTINGS_PATH = path12.join(GLOBAL_ROOT, ".agent-settings.yml");
+var GLOBAL_ROOT = path20.join(os6.homedir(), ".event4u", "agent-config");
+var GLOBAL_USER_SETTINGS_PATH = path20.join(GLOBAL_ROOT, ".agent-user.yml");
+var GLOBAL_AGENT_SETTINGS_PATH = path20.join(GLOBAL_ROOT, ".agent-settings.yml");
 function _bridge_marker(tool_id, scope) {
   if (scope === "global") return USER_SCOPE_PATHS[tool_id] ?? "";
   return PROJECT_BRIDGE_MARKERS[tool_id] ?? "";
@@ -5015,10 +5872,10 @@ function _load_yaml_doc(p) {
     return {};
   }
   const data = yamlSafeLoad(text);
-  return _isPlainObject(data) ? data : {};
+  return isPlainObject(data) ? data : {};
 }
 function _load_default_settings(package_root) {
-  const template_source = path12.join(package_root, "src", "config", "agent-settings.template.yml");
+  const template_source = path20.join(package_root, "src", "config", "agent-settings.template.yml");
   if (!pathExists(template_source)) return {};
   let text;
   try {
@@ -5028,15 +5885,15 @@ function _load_default_settings(package_root) {
   }
   const rendered = text.split(RULE_LOADING_TIER_PLACEHOLDER).join(DEFAULT_PROFILE).split(USER_TYPE_PLACEHOLDER).join("");
   const data = yamlSafeLoad(rendered);
-  return _isPlainObject(data) ? data : {};
+  return isPlainObject(data) ? data : {};
 }
 var RULE_LAYER_CHOICES = ["global", "project", "both-acknowledged"];
 function _suppress_rule_layer(project_root, suppress_dir) {
-  const target = path12.join(project_root, ".claude", "settings.local.json");
+  const target = path20.join(project_root, ".claude", "settings.local.json");
   const existing = pathExists(target) ? read_json_file(target) : {};
   let real_dir = suppress_dir;
   try {
-    real_dir = fs14.realpathSync(suppress_dir);
+    real_dir = fs20.realpathSync(suppress_dir);
   } catch {
     real_dir = suppress_dir;
   }
@@ -5047,8 +5904,7 @@ function _suppress_rule_layer(project_root, suppress_dir) {
   success(`.claude/settings.local.json: claudeMdExcludes += ${entry}`);
 }
 function _gate_rule_layer_overlap(project_root, layer, dry_run) {
-  const global_dir = path12.join(os3.homedir(), ".claude", "rules");
-  const project_dir = path12.join(project_root, ".claude", "rules");
+  const [global_dir, project_dir] = hostRuleLayerDirs(project_root);
   const g = readRuleLayer(global_dir);
   const p = readRuleLayer(project_dir);
   if (g === null || p === null) return true;
@@ -5136,9 +5992,9 @@ function detect_scope(cwd) {
   if (pathExists(_resolve_settings_read(cwd))) {
     return ["project", `existing ${SETTINGS_FILE}`];
   }
-  const has_manifest = SCOPE_DETECT_MANIFESTS.find((m) => pathExists(path12.join(cwd, m))) ?? null;
-  const has_ai_dir = SCOPE_DETECT_AI_DIRS.find((d) => isDir(path12.join(cwd, d))) ?? null;
-  const has_ai_file = SCOPE_DETECT_AI_FILES.find((f) => pathExists(path12.join(cwd, f))) ?? null;
+  const has_manifest = SCOPE_DETECT_MANIFESTS.find((m) => pathExists(path20.join(cwd, m))) ?? null;
+  const has_ai_dir = SCOPE_DETECT_AI_DIRS.find((d) => isDir(path20.join(cwd, d))) ?? null;
+  const has_ai_file = SCOPE_DETECT_AI_FILES.find((f) => pathExists(path20.join(cwd, f))) ?? null;
   if (has_manifest && (has_ai_dir || has_ai_file)) {
     const marker = has_ai_dir || has_ai_file;
     return ["prompt", `manifest (${has_manifest}) + AI-tool config (${marker})`];
@@ -5159,7 +6015,7 @@ function readLineSyncRaw(promptText) {
   for (; ; ) {
     let n;
     try {
-      n = fs14.readSync(0, buf, 0, 1, null);
+      n = fs20.readSync(0, buf, 0, 1, null);
     } catch (err) {
       const code = err.code;
       if (code === "EAGAIN") {
@@ -5242,26 +6098,26 @@ function _update_installed_tools_manifest(project_root, tools, scope, force, fil
   }
   write_manifest(target, version, entries);
   if (!state.QUIET) {
-    const rel = isRelativeTo(target, project_root) ? path12.relative(project_root, target) : target;
+    const rel = isRelativeTo(target, project_root) ? path20.relative(project_root, target) : target;
     info(`Manifest updated: ${rel}`);
   }
   return 0;
 }
 function isRelativeTo(child, parent) {
-  const rel = path12.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path12.isAbsolute(rel);
+  const rel = path20.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path20.isAbsolute(rel);
 }
 function _resolve_package_root_for_global() {
-  const here = resolvePath(_HERE);
-  const candidate = path12.dirname(path12.dirname(path12.dirname(here)));
-  if (!pathExists(path12.join(candidate, "src", "config", "profiles", "minimal.ini"))) {
+  const here = resolvePath(_HERE2);
+  const candidate = path20.dirname(path20.dirname(path20.dirname(here)));
+  if (!pathExists(path20.join(candidate, "src", "config", "profiles", "minimal.ini"))) {
     fail(
       `Could not locate agent-config package root from ${here}. Expected src/config/profiles/minimal.ini at the parent directory.`
     );
   }
   return candidate;
 }
-var CONSUMER_BRIDGE_MARKER_RELPATH = path12.join("agents", ".event4u-bridge.yml");
+var CONSUMER_BRIDGE_MARKER_RELPATH = path20.join("agents", ".event4u-bridge.yml");
 var MIGRATE_LEGACY_YAML_FILES = [".agent-settings.yml", ".agent-user.yml"];
 var MIGRATE_LEGACY_TOOL_DIRS = [".augment", ".claude", ".cursor"];
 var AGENT_CONFIG_PACKAGE_NAME = "@event4u/agent-config";
@@ -5269,7 +6125,7 @@ function _is_agent_config_source_repo(project_root) {
   if (process2.env["AGENT_CONFIG_CONSUMER_MODE"] === "1") {
     return [false, "consumer-mode-override"];
   }
-  const pkg_json = path12.join(project_root, "package.json");
+  const pkg_json = path20.join(project_root, "package.json");
   if (isFile(pkg_json)) {
     let data = {};
     try {
@@ -5277,17 +6133,17 @@ function _is_agent_config_source_repo(project_root) {
     } catch {
       data = {};
     }
-    if (_isPlainObject(data) && data["name"] === AGENT_CONFIG_PACKAGE_NAME) {
+    if (isPlainObject(data) && data["name"] === AGENT_CONFIG_PACKAGE_NAME) {
       return [true, "package.json:name"];
     }
   }
-  if (isDir(path12.join(project_root, ".agent-src.uncondensed"))) {
+  if (isDir(path20.join(project_root, ".agent-src.uncondensed"))) {
     return [true, ".agent-src.uncondensed/"];
   }
-  const packages_dir = path12.join(project_root, "packages");
+  const packages_dir = path20.join(project_root, "packages");
   if (isDir(packages_dir)) {
-    for (const child of fs14.readdirSync(packages_dir)) {
-      if (isDir(path12.join(packages_dir, child, ".agent-src.uncondensed"))) {
+    for (const child of fs20.readdirSync(packages_dir)) {
+      if (isDir(path20.join(packages_dir, child, ".agent-src.uncondensed"))) {
         return [true, `packages/${child}/.agent-src.uncondensed/`];
       }
     }
@@ -5305,17 +6161,17 @@ function _detect_legacy_for_migration(project_root) {
     }
     return [];
   }
-  if (isFile(path12.join(project_root, INSTALL_MODE_MARKER_REL))) return [];
+  if (isFile(path20.join(project_root, INSTALL_MODE_MARKER_REL))) return [];
   const found = [];
   for (const name of MIGRATE_LEGACY_YAML_FILES) {
-    if (isFile(path12.join(project_root, name))) {
+    if (isFile(path20.join(project_root, name))) {
       found.push(name);
-    } else if (isFile(path12.join(project_root, "settings", name))) {
+    } else if (isFile(path20.join(project_root, "settings", name))) {
       found.push(`settings/${name}`);
     }
   }
   for (const name of MIGRATE_LEGACY_TOOL_DIRS) {
-    const p = path12.join(project_root, name);
+    const p = path20.join(project_root, name);
     if (isDir(p) && !isSymlink(p)) {
       found.push(`${name}/`);
     }
@@ -5327,7 +6183,7 @@ function _prompt_migrate_to_global(project_root, artefacts) {
     process2.stdout.write("\n");
     warn("Legacy project-local artefacts detected \u2014 pre-ADR-020 layout:");
     for (const rel of artefacts) {
-      info(`  ${path12.join(project_root, rel)}`);
+      info(`  ${path20.join(project_root, rel)}`);
     }
     info("The unified `agent-config migrate` sweeps these in one pass.");
     info("The wizard recreates fresh config afterwards.");
@@ -5356,22 +6212,22 @@ function _run_migrate_to_global(project_root) {
   }
 }
 function _format_global_root_for_marker(global_root) {
-  const home = resolvePath(os3.homedir());
+  const home = resolvePath(os6.homedir());
   const resolved = resolvePath(global_root);
-  const rel = path12.relative(home, resolved);
-  if (rel === "" || rel.startsWith("..") || path12.isAbsolute(rel)) {
+  const rel = path20.relative(home, resolved);
+  if (rel === "" || rel.startsWith("..") || path20.isAbsolute(rel)) {
     return global_root;
   }
-  return `~/${rel.split(path12.sep).join("/")}`;
+  return `~/${rel.split(path20.sep).join("/")}`;
 }
 function _remove_legacy_consumer_bridge_marker(project_root, env = null) {
   const env_map = env ?? process2.env;
   if (env_map["AGENT_CONFIG_DEV_MODE"] === "1") return null;
-  if (isDir(path12.join(project_root, ".agent-src.uncondensed"))) return null;
-  const target = path12.join(project_root, CONSUMER_BRIDGE_MARKER_RELPATH);
+  if (isDir(path20.join(project_root, ".agent-src.uncondensed"))) return null;
+  const target = path20.join(project_root, CONSUMER_BRIDGE_MARKER_RELPATH);
   if (!isFile(target)) return null;
   try {
-    fs14.rmSync(target);
+    fs20.rmSync(target);
   } catch {
     return null;
   }
@@ -5385,7 +6241,7 @@ var PROJECT_ANCHOR_TOOLS = {
 function _write_per_tool_project_anchors(project_root, tools, env = null, now = null) {
   const env_map = env ?? process2.env;
   if (env_map["AGENT_CONFIG_DEV_MODE"] === "1") return [];
-  if (isDir(path12.join(project_root, ".agent-src.uncondensed"))) return [];
+  if (isDir(path20.join(project_root, ".agent-src.uncondensed"))) return [];
   const global_root_str = _format_global_root_for_marker(
     event4u_root(env_map)
   );
@@ -5394,8 +6250,8 @@ function _write_per_tool_project_anchors(project_root, tools, env = null, now =
   for (const tool_id of Object.keys(PROJECT_ANCHOR_TOOLS).sort()) {
     const rel_path = PROJECT_ANCHOR_TOOLS[tool_id];
     if (!tools.has(tool_id)) continue;
-    const target = path12.join(project_root, rel_path);
-    mkdirp(path12.dirname(target));
+    const target = path20.join(project_root, rel_path);
+    mkdirp(path20.dirname(target));
     const body = `# event4u/agent-config \u2014 per-tool project anchor (auto-written).
 # Spec: docs/contracts/consumer-bridge.md \xA7 Per-tool anchor strategy.
 # Tool: ${tool_id}. Resolves the global install directly \u2014 no
@@ -5413,7 +6269,7 @@ installed_at: ${stamp}
 }
 var PACKAGE_TAG_ID = "event4u/agent-config";
 function _inject_package_tag(target, source, package_root) {
-  if (path12.extname(target) !== ".md") return;
+  if (path20.extname(target) !== ".md") return;
   let text;
   try {
     text = readText(target);
@@ -5441,8 +6297,8 @@ function _inject_package_tag(target, source, package_root) {
       resolved_src = source;
     }
     if (package_root !== null) {
-      const rel = path12.relative(resolvePath(package_root), resolved_src);
-      if (rel !== "" && !rel.startsWith("..") && !path12.isAbsolute(rel)) {
+      const rel = path20.relative(resolvePath(package_root), resolved_src);
+      if (rel !== "" && !rel.startsWith("..") && !path20.isAbsolute(rel)) {
         source_value = rel;
       } else {
         source_value = resolved_src;
@@ -5477,7 +6333,7 @@ function _escapes_package_root(resolved, package_root) {
   if (package_root === null) return false;
   let root;
   try {
-    root = fs14.realpathSync(package_root);
+    root = fs20.realpathSync(package_root);
   } catch {
     return false;
   }
@@ -5503,7 +6359,7 @@ function _copy_dir_dereferencing_symlinks(src, dest, force, package_root = null,
     if (file_filter !== null && !file_filter(src)) return [0, 0, written_paths];
     let resolved_src = src;
     try {
-      resolved_src = fs14.realpathSync(src);
+      resolved_src = fs20.realpathSync(src);
     } catch {
       resolved_src = src;
     }
@@ -5511,14 +6367,14 @@ function _copy_dir_dereferencing_symlinks(src, dest, force, package_root = null,
       warn(`refused: ${src} dereferences outside the package root \u2014 not copied`);
       return [0, 0, written_paths];
     }
-    mkdirp(path12.dirname(dest));
+    mkdirp(path20.dirname(dest));
     const decision = tracker.resolve(dest, force);
     if (decision === "preserve") {
       tracker.preserve(dest, resolved_src, package_root);
       _log_tx_entry("skip", dest);
       return [0, 1, written_paths];
     }
-    fs14.copyFileSync(src, dest);
+    fs20.copyFileSync(src, dest);
     _inject_package_tag(dest, src, package_root);
     _log_tx_entry("write", dest);
     written_paths.push(dest);
@@ -5527,11 +6383,11 @@ function _copy_dir_dereferencing_symlinks(src, dest, force, package_root = null,
   mkdirp(dest);
   const walk = (node) => {
     const acc = [];
-    const names = fs14.readdirSync(node).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+    const names = fs20.readdirSync(node).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     for (const name of names) {
-      const entry = path12.join(node, name);
+      const entry = path20.join(node, name);
       acc.push(entry);
-      const lst = fs14.lstatSync(entry);
+      const lst = fs20.lstatSync(entry);
       if (lst.isDirectory() && !lst.isSymbolicLink()) {
         acc.push(...walk(entry));
       }
@@ -5539,9 +6395,9 @@ function _copy_dir_dereferencing_symlinks(src, dest, force, package_root = null,
     return acc;
   };
   for (const entry of walk(src)) {
-    const rel = path12.relative(src, entry);
-    const target = path12.join(dest, rel);
-    const lst = fs14.lstatSync(entry);
+    const rel = path20.relative(src, entry);
+    const target = path20.join(dest, rel);
+    const lst = fs20.lstatSync(entry);
     if (lst.isDirectory() && !lst.isSymbolicLink()) {
       mkdirp(target);
       continue;
@@ -5549,8 +6405,8 @@ function _copy_dir_dereferencing_symlinks(src, dest, force, package_root = null,
     let resolvedIsDir = false;
     let resolved = entry;
     try {
-      resolved = fs14.realpathSync(entry);
-      resolvedIsDir = fs14.statSync(entry).isDirectory();
+      resolved = fs20.realpathSync(entry);
+      resolvedIsDir = fs20.statSync(entry).isDirectory();
     } catch {
       resolvedIsDir = false;
     }
@@ -5582,8 +6438,8 @@ function _copy_dir_dereferencing_symlinks(src, dest, force, package_root = null,
       _log_tx_entry("skip", target);
       continue;
     }
-    mkdirp(path12.dirname(target));
-    fs14.copyFileSync(resolved, target);
+    mkdirp(path20.dirname(target));
+    fs20.copyFileSync(resolved, target);
     _inject_package_tag(target, resolved, package_root);
     _log_tx_entry("write", target);
     written += 1;
@@ -5596,7 +6452,7 @@ function _claude_desktop_bundles_dir() {
 }
 function _write_claude_desktop_marker(force, lockfile_path2, bundles_dir, bundle_count) {
   const anchor = expanduser3(USER_SCOPE_PATHS["claude-desktop"]);
-  const target = path12.join(anchor, "agent-config.md");
+  const target = path20.join(anchor, "agent-config.md");
   mkdirp(anchor);
   const body = claudeDesktopMarkerBody(lockfile_path2, anchor, bundles_dir, bundle_count);
   if (tracker.resolve(target, force) === "preserve") {
@@ -5621,27 +6477,15 @@ function _deploy_claude_desktop(force, package_root, lockfile_path2) {
   return [bundle_count, 0, "deployed", [bundles_dir, ...marker_paths]];
 }
 var _CLAUDE_FLAT_WRAPPER_EXTRA = /* @__PURE__ */ new Set(["commit"]);
-function _apply_claude_flat_command_wrappers(anchor, package_root, current_files) {
+function _apply_claude_flat_command_wrappers(anchor, package_root, current_files, recorded_files = /* @__PURE__ */ new Set()) {
   const wrapped = [];
   const collisions = [];
-  const reserved = [];
-  const commands_dir = path12.join(anchor, "commands");
-  let flat_entries = [];
-  try {
-    flat_entries = fs14.readdirSync(commands_dir).filter((f) => f.endsWith(".md"));
-  } catch {
-  }
-  for (const fname of flat_entries.sort()) {
-    const slug = fname.slice(0, -".md".length);
-    if (!is_claude_builtin_name(slug)) continue;
-    fs14.rmSync(path12.join(commands_dir, fname), { force: true });
-    current_files.delete(`commands/${fname}`);
-    reserved.push(slug);
-  }
+  const commands_dir = path20.join(anchor, "commands");
+  const { reserved, foreign } = sweepReservedNames(commands_dir, current_files, is_claude_builtin_name, recorded_files);
   const eligible = new Set(_CLAUDE_FLAT_WRAPPER_EXTRA);
   try {
     const manifest = JSON.parse(
-      fs14.readFileSync(path12.join(package_root, "dist", "discovery", "discovery-manifest.json"), "utf8")
+      fs20.readFileSync(path20.join(package_root, "dist", "discovery", "discovery-manifest.json"), "utf8")
     );
     for (const a of manifest.artefacts ?? []) {
       if (a.category !== "command" || typeof a.slug !== "string") continue;
@@ -5652,27 +6496,27 @@ function _apply_claude_flat_command_wrappers(anchor, package_root, current_files
   }
   for (const slug of [...eligible].sort()) {
     const flat_rel = `commands/${slug}.md`;
-    const flat_abs = path12.join(anchor, "commands", `${slug}.md`);
-    if (!fs14.existsSync(flat_abs)) continue;
-    const skill_dir = path12.join(anchor, "skills", slug);
-    if (fs14.existsSync(skill_dir)) {
+    const flat_abs = path20.join(anchor, "commands", `${slug}.md`);
+    if (!fs20.existsSync(flat_abs)) continue;
+    const skill_dir = path20.join(anchor, "skills", slug);
+    if (fs20.existsSync(skill_dir)) {
       collisions.push(slug);
       continue;
     }
-    let body = fs14.readFileSync(flat_abs, "utf8");
+    let body = fs20.readFileSync(flat_abs, "utf8");
     if (body.startsWith("---\n") && !/^name:/m.test(body.split("\n---")[0] ?? "")) {
       body = body.replace("---\n", `---
 name: ${slug}
 `);
     }
-    fs14.mkdirSync(skill_dir, { recursive: true });
-    fs14.writeFileSync(path12.join(skill_dir, "SKILL.md"), body, "utf8");
-    fs14.rmSync(flat_abs, { force: true });
+    fs20.mkdirSync(skill_dir, { recursive: true });
+    fs20.writeFileSync(path20.join(skill_dir, "SKILL.md"), body, "utf8");
+    fs20.rmSync(flat_abs, { force: true });
     current_files.delete(flat_rel);
     current_files.add(`skills/${slug}/SKILL.md`);
     wrapped.push(slug);
   }
-  return { wrapped, collisions, reserved };
+  return { wrapped, collisions, reserved, foreign };
 }
 function _deploy_global_content(tools, force, package_root, lockfile_path2) {
   const results = {};
@@ -5699,8 +6543,8 @@ function _deploy_global_content(tools, force, package_root, lockfile_path2) {
     const written_paths = [];
     let current_files = /* @__PURE__ */ new Set();
     for (const [src_rel, dest_sub] of plan) {
-      const src = path12.join(package_root, src_rel);
-      const dest = dest_sub ? path12.join(anchor, dest_sub) : anchor;
+      const src = path20.join(package_root, src_rel);
+      const dest = dest_sub ? path20.join(anchor, dest_sub) : anchor;
       const rule_filter = _rule_filter_for_source(src_rel, rule_scope);
       const [w, s, paths] = _copy_dir_dereferencing_symlinks(
         src,
@@ -5722,15 +6566,31 @@ function _deploy_global_content(tools, force, package_root, lockfile_path2) {
       );
     }
     if (tool_id === "claude-code") {
-      const res = _apply_claude_flat_command_wrappers(anchor, package_root, current_files);
+      const res = _apply_claude_flat_command_wrappers(anchor, package_root, current_files, recorded_rel_files(tool_id, anchor));
+      const preserved_now = new Set(
+        tracker.conflictState.preserved.map((p) => path20.resolve(p))
+      );
       rewriteAndReport(
-        path12.join(anchor, "rules"),
+        path20.join(anchor, "rules"),
         state.QUIET,
         info,
         warn,
         res,
-        new Set(tracker.conflictState.preserved.map((p) => path12.resolve(p)))
+        preserved_now
       );
+      if (installerThinsHost(tool_id, { packageRoot: package_root })) {
+        try {
+          const thin = thinInstalledRuleLayer({
+            rulesDir: path20.join(anchor, "rules"),
+            packageRoot: package_root,
+            preserved: preserved_now
+          });
+          if (!state.QUIET) for (const l of describeThinInstalledLayer(thin)) info(l);
+        } catch (e) {
+          warn(`claude-code: thinned rule layer not written \u2014 ${String(e)}`);
+        }
+      }
+      if (!state.QUIET) for (const l of installReceiptBudgetLines(package_root)) info(l);
     }
     const missing_targets = _verify_deploy_targets(anchor, plan);
     if (missing_targets.length > 0) {
@@ -5772,10 +6632,10 @@ function _deploy_global_content(tools, force, package_root, lockfile_path2) {
     results[tool_id] = [written_total, skipped_total, "deployed", written_paths];
     if (tool_id === "claude-code") {
       try {
-        const manifest = path12.join(package_root, "src", "scripts", "hook_manifest.yaml");
+        const manifest = path20.join(package_root, "src", "scripts", "hook_manifest.yaml");
         const matrix = build_claude_hook_matrix(manifest);
         const res = ensure_managed_hooks(
-          path12.join(anchor, "settings.json"),
+          path20.join(anchor, "settings.json"),
           matrix
         );
         if (!state.QUIET) {
@@ -5812,7 +6672,7 @@ function _preview_global_reap(tools, package_root) {
     const anchor = expanduser3(anchor_raw);
     let current_files = /* @__PURE__ */ new Set();
     for (const [src_rel, dest_sub] of plan) {
-      const src = path12.join(package_root, src_rel);
+      const src = path20.join(package_root, src_rel);
       current_files = setUnion(
         current_files,
         expected_deploy_files(
@@ -5846,14 +6706,14 @@ function _preview_global_reap(tools, package_root) {
 function _verify_deploy_targets(anchor, plan) {
   const missing = [];
   for (const [, dest_sub] of plan) {
-    const target = dest_sub ? path12.join(anchor, dest_sub) : anchor;
+    const target = dest_sub ? path20.join(anchor, dest_sub) : anchor;
     const label = dest_sub || ".";
     if (!isDir(target)) {
       missing.push(label);
       continue;
     }
     try {
-      const entries = fs14.readdirSync(target);
+      const entries = fs20.readdirSync(target);
       if (entries.length === 0) missing.push(label);
     } catch {
       missing.push(label);
@@ -5871,54 +6731,30 @@ function _resolve_global_settings_doc() {
 }
 function _resolve_global_settings_path() {
   const root = event4u_root();
-  const canonical = path12.join(root, "settings", SETTINGS_FILE);
+  const canonical = path20.join(root, "settings", SETTINGS_FILE);
   if (pathExists(canonical)) return canonical;
-  const legacy = path12.join(root, SETTINGS_FILE);
+  const legacy = path20.join(root, SETTINGS_FILE);
   if (pathExists(legacy)) return legacy;
   return null;
 }
 function _resolve_scoped_projection(package_root) {
   const doc = _resolve_global_settings_doc() ?? _load_default_settings(package_root);
-  const projection = _isPlainObject(doc["projection"]) ? doc["projection"] : {};
+  const projection = isPlainObject(doc["projection"]) ? doc["projection"] : {};
   const mode = projectionModeOf(projection["mode"]);
-  const runtime = _isPlainObject(doc["runtime"]) ? doc["runtime"] : {};
+  const runtime = isPlainObject(doc["runtime"]) ? doc["runtime"] : {};
   const active_packs_raw = runtime["active_packs"];
   const active_packs = Array.isArray(active_packs_raw) ? active_packs_raw.filter((v) => typeof v === "string") : [];
   return { mode, active_packs };
 }
 function _resolve_global_rule_scope(package_root) {
-  const settings_path = _resolve_global_settings_path();
-  if (settings_path === null) {
-    try {
-      return ruleScopeFromSettings(_load_default_settings(package_root), package_root);
-    } catch {
-      return LEGACY_ALL;
-    }
-  }
-  let text;
-  try {
-    text = readText(settings_path);
-  } catch (e) {
-    warn(
-      `could not read ${settings_path} (${String(e)}) \u2014 rule scoping falls back to legacy-all, so ALL rules including maintainer-only ones will be installed. Fix the file to restore scoping.`
-    );
-    return LEGACY_ALL;
-  }
-  const parsed = yamlSafeLoad(text);
-  if (!_isPlainObject(parsed)) {
-    warn(
-      `${settings_path} is not a YAML mapping \u2014 rule scoping falls back to legacy-all, so ALL rules including maintainer-only ones will be installed. Fix the file to restore scoping.`
-    );
-    return LEGACY_ALL;
-  }
-  try {
-    return ruleScopeFromSettings(parsed, package_root);
-  } catch (e) {
-    warn(
-      `could not derive rule scope from ${settings_path} (${String(e)}) \u2014 falling back to legacy-all; ALL rules will be installed.`
-    );
-    return LEGACY_ALL;
-  }
+  return resolveGlobalRuleScope({
+    settingsPath: _resolve_global_settings_path(),
+    packageRoot: package_root,
+    readText,
+    parseYaml: yamlSafeLoad,
+    loadDefaults: () => _load_default_settings(package_root),
+    warn
+  });
 }
 function _rule_filter_for_source(src_rel, scope) {
   if (src_rel !== RULE_SOURCE_REL) return null;
@@ -5984,7 +6820,7 @@ function install_global(tools, force, project_root = null, core_only = false) {
     info(`  schema_version=1, agent_config_version=${installed_version}`);
     info(`  tools=${merged_tools.join(",")}`);
   }
-  if (project_root !== null && pathExists(_resolve_settings_read(project_root)) && !isDir(path12.join(project_root, ".agent-src.uncondensed"))) {
+  if (project_root !== null && pathExists(_resolve_settings_read(project_root)) && !isDir(path20.join(project_root, ".agent-src.uncondensed"))) {
     const drift = collect_drift(project_root);
     if (!state.QUIET) {
       process2.stdout.write("\n");
@@ -6098,19 +6934,19 @@ function install_global(tools, force, project_root = null, core_only = false) {
       }
     }
   }
-  if (project_root !== null && pathExists(_resolve_settings_read(project_root)) && !isDir(path12.join(project_root, ".agent-src.uncondensed"))) {
+  if (project_root !== null && pathExists(_resolve_settings_read(project_root)) && !isDir(path20.join(project_root, ".agent-src.uncondensed"))) {
     const files_by_tool = filesByToolFromDeploy(deploy_results);
     const rc = _update_installed_tools_manifest(project_root, tools, "global", force, files_by_tool);
     if (rc !== 0) return rc;
     const removed_marker = _remove_legacy_consumer_bridge_marker(project_root);
     if (removed_marker !== null && !state.QUIET) {
-      const rel = isRelativeTo(removed_marker, project_root) ? path12.relative(project_root, removed_marker) : removed_marker;
+      const rel = isRelativeTo(removed_marker, project_root) ? path20.relative(project_root, removed_marker) : removed_marker;
       info(`Removed legacy bridge marker: ${rel}`);
     }
     const anchor_paths = _write_per_tool_project_anchors(project_root, tools);
     if (anchor_paths.length > 0 && !state.QUIET) {
       for (const p of anchor_paths) {
-        const rel = isRelativeTo(p, project_root) ? path12.relative(project_root, p) : p;
+        const rel = isRelativeTo(p, project_root) ? path20.relative(project_root, p) : p;
         info(`Project anchor written: ${rel}`);
       }
     }
@@ -6146,8 +6982,8 @@ function install_global(tools, force, project_root = null, core_only = false) {
 }
 function _catalogue_truncation_warnings(deploy_results, project_root) {
   const log_candidates = [
-    path12.join(event4u_root(), "state", "skill-catalogue.jsonl"),
-    ...project_root ? [path12.join(project_root, OBSERVATION_LOG)] : []
+    path20.join(event4u_root(), "state", "skill-catalogue.jsonl"),
+    ...project_root ? [path20.join(project_root, OBSERVATION_LOG)] : []
   ];
   const records = log_candidates.flatMap((p) => readObservationLog(p));
   if (records.length === 0) return [];
@@ -6170,13 +7006,13 @@ function _catalogue_truncation_warnings(deploy_results, project_root) {
 function _scoped_migration_notice(deploy_results, project_root, package_root, probe) {
   if (!isInteractiveSession(probe)) return [];
   const log_candidates = [
-    path12.join(event4u_root(), "state", "skill-catalogue.jsonl"),
-    ...project_root ? [path12.join(project_root, OBSERVATION_LOG)] : []
+    path20.join(event4u_root(), "state", "skill-catalogue.jsonl"),
+    ...project_root ? [path20.join(project_root, OBSERVATION_LOG)] : []
   ];
   const limits = knownHostLimits(log_candidates.flatMap((p) => readObservationLog(p)));
   if (limits.size === 0) return [];
   const resolved = _resolve_scoped_projection(package_root);
-  const settings_path = _resolve_global_settings_path() ?? path12.join(event4u_root(), "settings", SETTINGS_FILE);
+  const settings_path = _resolve_global_settings_path() ?? path20.join(event4u_root(), "settings", SETTINGS_FILE);
   for (const tool_id of Object.keys(deploy_results).sort()) {
     const [, , status] = deploy_results[tool_id];
     if (status !== "deployed") continue;
@@ -6195,8 +7031,8 @@ function _scoped_migration_notice(deploy_results, project_root, package_root, pr
   }
   return [];
 }
-var SETTINGS_SURFACE_REL = path12.join("state", "settings-surface.json");
-var SETTINGS_DELTA_REL = path12.join("state", "settings-delta.json");
+var SETTINGS_SURFACE_REL = path20.join("state", "settings-surface.json");
+var SETTINGS_DELTA_REL = path20.join("state", "settings-delta.json");
 function _current_settings_surface(version) {
   const jsonSchema = zodToJsonSchema(settingsSchema, {
     name: "AgentSettings",
@@ -6207,20 +7043,20 @@ function _current_settings_surface(version) {
 }
 function _write_settings_surface_snapshot(installed_version) {
   const root = event4u_root();
-  const surface_path = path12.join(root, SETTINGS_SURFACE_REL);
-  const delta_path = path12.join(root, SETTINGS_DELTA_REL);
+  const surface_path = path20.join(root, SETTINGS_SURFACE_REL);
+  const delta_path = path20.join(root, SETTINGS_DELTA_REL);
   const next = _current_settings_surface(installed_version);
   let previous = null;
   try {
-    const parsed = JSON.parse(fs14.readFileSync(surface_path, "utf8"));
+    const parsed = JSON.parse(fs20.readFileSync(surface_path, "utf8"));
     if (parsed !== null && typeof parsed === "object" && parsed.entries !== void 0) previous = parsed;
   } catch {
   }
   if (previous !== null && previous.version !== next.version) {
     const delta = computeSurfaceDelta(previous, next);
     if (delta.changes.length > 0) {
-      fs14.mkdirSync(path12.dirname(delta_path), { recursive: true, mode: 448 });
-      fs14.writeFileSync(delta_path, `${JSON.stringify(delta, null, 2)}
+      fs20.mkdirSync(path20.dirname(delta_path), { recursive: true, mode: 448 });
+      fs20.writeFileSync(delta_path, `${JSON.stringify(delta, null, 2)}
 `, { mode: 384 });
       if (!state.QUIET) {
         const counts = {};
@@ -6232,8 +7068,8 @@ function _write_settings_surface_snapshot(installed_version) {
       }
     }
   }
-  fs14.mkdirSync(path12.dirname(surface_path), { recursive: true, mode: 448 });
-  fs14.writeFileSync(surface_path, `${JSON.stringify(next, null, 2)}
+  fs20.mkdirSync(path20.dirname(surface_path), { recursive: true, mode: 448 });
+  fs20.writeFileSync(surface_path, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
 }
 function arrayStrEqual(a, b) {
@@ -6449,17 +7285,17 @@ function _is_tool_enabled(tools, tool_id) {
   return tools.has(tool_id);
 }
 function _minimal_templates_root() {
-  const start = resolvePath(_HERE);
+  const start = resolvePath(_HERE2);
   const chain = [start];
   let cur = start;
   for (; ; ) {
-    const parent = path12.dirname(cur);
+    const parent = path20.dirname(cur);
     if (parent === cur) break;
     chain.push(parent);
     cur = parent;
   }
   for (const ancestor of chain) {
-    const candidate = path12.join(ancestor, "src", "templates", "minimal");
+    const candidate = path20.join(ancestor, "src", "templates", "minimal");
     if (isDir(candidate)) return candidate;
   }
   fail("Could not locate src/templates/minimal/ \u2014 package install is corrupt.");
@@ -6467,9 +7303,9 @@ function _minimal_templates_root() {
 var INSTALL_MODE_MARKER_REL = "agents/.agent-state/install-mode.txt";
 function _write_install_mode_marker(project_root, mode) {
   if (mode !== "minimal" && mode !== "full") return;
-  const marker = path12.join(project_root, INSTALL_MODE_MARKER_REL);
+  const marker = path20.join(project_root, INSTALL_MODE_MARKER_REL);
   try {
-    mkdirp(path12.dirname(marker));
+    mkdirp(path20.dirname(marker));
     writeText(marker, `${mode}
 `);
   } catch {
@@ -6478,7 +7314,7 @@ function _write_install_mode_marker(project_root, mode) {
 function install_minimal(target_root_in, force, user_type = "") {
   let target_root = resolvePath(target_root_in);
   mkdirp(target_root);
-  const parent = path12.dirname(target_root);
+  const parent = path20.dirname(target_root);
   if (parent !== target_root) {
     const existing = find_project_root_with_anchor(parent);
     if (existing !== null && existing[0] !== target_root) {
@@ -6489,21 +7325,21 @@ function install_minimal(target_root_in, force, user_type = "") {
     }
   }
   const templates = _minimal_templates_root();
-  const settings_src = path12.join(templates, SETTINGS_FILE);
-  const overrides_gitkeep_src = path12.join(templates, "overrides-gitkeep");
-  const overrides_readme_src = path12.join(templates, "agents-overrides-readme.md");
+  const settings_src = path20.join(templates, SETTINGS_FILE);
+  const overrides_gitkeep_src = path20.join(templates, "overrides-gitkeep");
+  const overrides_readme_src = path20.join(templates, "agents-overrides-readme.md");
   if (!isFile(settings_src)) fail(`Bundled minimal settings template missing under ${templates}`);
   if (!isFile(overrides_gitkeep_src) || !isFile(overrides_readme_src)) {
     fail(`Bundled overrides scaffold templates missing under ${templates}`);
   }
   info(`Minimal init \u2192 ${target_root}`);
-  const overrides_root = path12.join(target_root, "agents", "overrides");
+  const overrides_root = path20.join(target_root, "agents", "overrides");
   mkdirp(overrides_root);
   const gitkeep_body = readText(overrides_gitkeep_src);
   for (const sub of ["rules", "skills", "commands"]) {
-    const sub_dir = path12.join(overrides_root, sub);
+    const sub_dir = path20.join(overrides_root, sub);
     mkdirp(sub_dir);
-    const gitkeep_dst = path12.join(sub_dir, ".gitkeep");
+    const gitkeep_dst = path20.join(sub_dir, ".gitkeep");
     if (pathExists(gitkeep_dst) && !force) {
       skip(`agents/overrides/${sub}/.gitkeep already exists (use --force to overwrite)`);
     } else {
@@ -6511,7 +7347,7 @@ function install_minimal(target_root_in, force, user_type = "") {
       success(`Wrote agents/overrides/${sub}/.gitkeep`);
     }
   }
-  const readme_dst = path12.join(overrides_root, "README.md");
+  const readme_dst = path20.join(overrides_root, "README.md");
   if (pathExists(readme_dst) && !force) {
     skip("agents/overrides/README.md already exists (use --force to overwrite)");
   } else {
@@ -6529,14 +7365,14 @@ function install_minimal(target_root_in, force, user_type = "") {
 personal:
   user_type: ${user_type}
 `;
-      mkdirp(path12.dirname(settings_dst));
+      mkdirp(path20.dirname(settings_dst));
       writeText(settings_dst, body);
       success(`Wrote ${SETTINGS_FILE} (user_type=${user_type})`);
     }
   }
   const removed_marker = _remove_legacy_consumer_bridge_marker(target_root);
   if (removed_marker !== null) {
-    const rel = isRelativeTo(removed_marker, target_root) ? path12.relative(target_root, removed_marker) : removed_marker;
+    const rel = isRelativeTo(removed_marker, target_root) ? path20.relative(target_root, removed_marker) : removed_marker;
     success(`Removed legacy bridge marker: ${rel}`);
   }
   _write_install_mode_marker(target_root, "minimal");
@@ -6610,7 +7446,7 @@ function run_interactive_init(project_root, force) {
     );
     return 0;
   }
-  const target = path12.join(project_root, _LOCAL_CONFIG_FILE);
+  const target = path20.join(project_root, _LOCAL_CONFIG_FILE);
   if (pathExists(target) && !force) {
     warn(
       `${_LOCAL_CONFIG_FILE} already exists; re-run with --force to overwrite. Skipping interactive init.`
@@ -6637,7 +7473,7 @@ function run_interactive_init(project_root, force) {
     warn(`Could not write ${target}: ${String(exc)}`);
     return 1;
   }
-  success(`Wrote ${path12.relative(project_root, target)} (${user_type} / ${stack} / ${verbosity})`);
+  success(`Wrote ${path20.relative(project_root, target)} (${user_type} / ${stack} / ${verbosity})`);
   return 0;
 }
 var _WIZARD_READY_RE = /^WIZARD_READY (http:\/\/(?:127\.0\.0\.1|localhost):\d+\/\S*)\r?$/;
@@ -6655,12 +7491,12 @@ function _wizard_should_launch(opts) {
   return [true, ""];
 }
 function _wizard_cli_dist(_project_root) {
-  const package_root = path12.dirname(path12.dirname(path12.dirname(resolvePath(_HERE))));
-  const cli = path12.join(package_root, "dist", "cli", "agent-config.js");
+  const package_root = path20.dirname(path20.dirname(path20.dirname(resolvePath(_HERE2))));
+  const cli = path20.join(package_root, "dist", "cli", "agent-config.js");
   return pathExists(cli) ? cli : null;
 }
 function _server_info_path() {
-  return path12.join(os3.homedir(), ".event4u", "agent-config", "local-server.json");
+  return path20.join(os6.homedir(), ".event4u", "agent-config", "local-server.json");
 }
 function _pid_is_agent_config(pid) {
   let res;
@@ -6677,7 +7513,7 @@ function _pid_is_agent_config(pid) {
 }
 function unlinkMissingOk(p) {
   try {
-    fs14.unlinkSync(p);
+    fs20.unlinkSync(p);
   } catch {
   }
 }
@@ -6755,14 +7591,14 @@ function _wizard_spawn(project_root, pass_project_root = true) {
 }
 function _wizard_run_sync(cmd, env, cli) {
   const total = _WIZARD_TIMEOUTS.reduce((a, b) => a + b, 0);
-  const log_path = path12.join(
-    os3.tmpdir(),
+  const log_path = path20.join(
+    os6.tmpdir(),
     `agent-config-wizard-${process2.pid}-${Date.now()}.log`
   );
   let child;
   let log_fd = null;
   try {
-    log_fd = fs14.openSync(log_path, "w");
+    log_fd = fs20.openSync(log_path, "w");
     child = spawn(cmd[0], cmd.slice(1), {
       env,
       detached: true,
@@ -6780,7 +7616,7 @@ function _wizard_run_sync(cmd, env, cli) {
   } finally {
     if (log_fd !== null) {
       try {
-        fs14.closeSync(log_fd);
+        fs20.closeSync(log_fd);
       } catch {
       }
     }
@@ -6957,7 +7793,7 @@ function main2(argv) {
     } catch (exc) {
       fail(`--apply-payload JSON parse error: ${String(exc)}`);
     }
-    if (!_isPlainObject(payload)) fail("--apply-payload root must be a JSON object");
+    if (!isPlainObject(payload)) fail("--apply-payload root must be a JSON object");
     const pl = payload;
     const schema_version = pl["schema_version"];
     if (schema_version !== "wizard-v2" && schema_version !== "installer-v1") {
@@ -6976,13 +7812,13 @@ function main2(argv) {
         opts.scope = "global";
       }
       const settings = pl["settings"];
-      if (_isPlainObject(settings)) {
+      if (isPlainObject(settings)) {
         const rule_loading_tier = settings["rule_loading_tier"] || settings["cost_profile"];
         if (typeof rule_loading_tier === "string" && rule_loading_tier) {
           opts.profile = rule_loading_tier;
         }
         const personal = settings["personal"];
-        if (_isPlainObject(personal)) {
+        if (isPlainObject(personal)) {
           const user_type = personal["user_type"];
           if (typeof user_type === "string" && user_type) {
             opts.user_type = user_type;
@@ -7030,8 +7866,8 @@ function main2(argv) {
     const target_root = resolvePath(
       opts.custom_path || opts.project || process2.env["PROJECT_ROOT"] || process2.cwd()
     );
-    const minimal_package_root = path12.dirname(
-      path12.dirname(path12.dirname(_minimal_templates_root()))
+    const minimal_package_root = path20.dirname(
+      path20.dirname(path20.dirname(_minimal_templates_root()))
     );
     const validated_user_type = _validate_user_type(minimal_package_root, opts.user_type);
     return install_minimal(target_root, opts.force, validated_user_type);
@@ -7067,7 +7903,7 @@ function main2(argv) {
     return rc2;
   }
   const project_root = custom_path || resolvePath(opts.project || process2.env["PROJECT_ROOT"] || process2.cwd());
-  const is_first_run = !pathExists(path12.join(project_root, SETTINGS_FILE));
+  const is_first_run = !pathExists(path20.join(project_root, SETTINGS_FILE));
   tracker.begin(project_root);
   let rc = _main_project_install(opts, project_root, parsed_tools, is_first_run);
   if (rc === 0 && opts.interactive) {
@@ -7112,8 +7948,8 @@ function _read_consumer_auto_switch(project_root) {
   } catch {
     return "suggest";
   }
-  const model = _isPlainObject(data) ? data["model"] : null;
-  const value = _isPlainObject(model) ? model["auto_switch"] : null;
+  const model = isPlainObject(data) ? data["model"] : null;
+  const value = isPlainObject(model) ? model["auto_switch"] : null;
   if (typeof value === "string" && ["auto", "suggest", "off"].includes(value.trim().toLowerCase())) {
     return value.trim().toLowerCase();
   }
@@ -7126,23 +7962,23 @@ function _team_setup_hint_line(project_root) {
   } catch {
     data = {};
   }
-  const ai_team = _isPlainObject(data) ? data["ai_team"] : null;
-  const flag = _isPlainObject(ai_team) ? ai_team["suppress_setup_hint"] : null;
+  const ai_team = isPlainObject(data) ? data["ai_team"] : null;
+  const flag = isPlainObject(ai_team) ? ai_team["suppress_setup_hint"] : null;
   const suppressed = flag === true || typeof flag === "string" && ["true", "yes", "on", "1"].includes(flag.trim().toLowerCase());
   if (suppressed) return null;
   return "  \u2022 Claude Code team mode (optional cross-model review via the official codex plugin): run `agent-config doctor --check team` for setup status.";
 }
 function finalize_claude_model_tiers(project_root) {
-  const claude_skills = path12.join(project_root, ".claude", "skills");
-  const augment_skills = path12.join(project_root, ".augment", "skills");
+  const claude_skills = path20.join(project_root, ".claude", "skills");
+  const augment_skills = path20.join(project_root, ".augment", "skills");
   if (!isDir(claude_skills) || !isDir(augment_skills)) return 0;
   if (_read_consumer_auto_switch(project_root) !== "auto") return 0;
   let rendered = 0;
-  const entries = fs14.readdirSync(claude_skills).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const entries = fs20.readdirSync(claude_skills).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
   for (const name of entries) {
-    const entry = path12.join(claude_skills, name);
-    const src_dir = path12.join(augment_skills, name);
-    const src_md = path12.join(src_dir, "SKILL.md");
+    const entry = path20.join(claude_skills, name);
+    const src_dir = path20.join(augment_skills, name);
+    const src_md = path20.join(src_dir, "SKILL.md");
     let tier;
     try {
       tier = read_model_tier(src_md);
@@ -7151,22 +7987,22 @@ function finalize_claude_model_tiers(project_root) {
     }
     if (tier === null || !(tier in TIER_TO_CLAUDE_MODEL) || !isDir(src_dir)) continue;
     if (isSymlink(entry) || isFile(entry)) {
-      fs14.unlinkSync(entry);
+      fs20.unlinkSync(entry);
     } else if (isDir(entry)) {
-      fs14.rmSync(entry, { recursive: true, force: true });
+      fs20.rmSync(entry, { recursive: true, force: true });
     }
     mkdirp(entry);
-    const srcFiles = fs14.readdirSync(src_dir).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+    const srcFiles = fs20.readdirSync(src_dir).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
     for (const fname of srcFiles) {
       if (fname === "SKILL.md") {
         writeText(
-          path12.join(entry, "SKILL.md"),
+          path20.join(entry, "SKILL.md"),
           render_native_model_md(readText(src_md), tier)
         );
       } else {
-        fs14.symlinkSync(
-          path12.join("../../../.augment/skills", name, fname),
-          path12.join(entry, fname)
+        fs20.symlinkSync(
+          path20.join("../../../.augment/skills", name, fname),
+          path20.join(entry, fname)
         );
       }
     }
@@ -7184,7 +8020,7 @@ function _main_project_install(opts, project_root, parsed_tools, is_first_run) {
   let package_type;
   if (opts.package) {
     package_root = resolvePath(opts.package);
-    if (!pathExists(path12.join(package_root, "src", "config", "profiles", "minimal.ini"))) {
+    if (!pathExists(path20.join(package_root, "src", "config", "profiles", "minimal.ini"))) {
       fail(`Invalid --package path (missing src/config/profiles/minimal.ini): ${package_root}`);
     }
     package_type = detect_package_type_for_project(project_root, package_root);
@@ -7322,19 +8158,21 @@ function _main_project_install(opts, project_root, parsed_tools, is_first_run) {
   if (will_launch) {
     return _wizard_spawn(project_root);
   }
+  const ign = write_managed_block(project_root, opts.dry_run);
+  if (ign > 0) success(`.gitignore: ${opts.dry_run ? "would add " : "+"}${ign} managed entries`);
   return 0;
 }
 function _resolvedArgv1() {
   if (process2.argv[1] === void 0) return void 0;
   try {
-    return fs14.realpathSync(path12.resolve(process2.argv[1]));
+    return fs20.realpathSync(path20.resolve(process2.argv[1]));
   } catch {
-    return path12.resolve(process2.argv[1]);
+    return path20.resolve(process2.argv[1]);
   }
 }
 var _argv1 = _resolvedArgv1();
 var _isCliEntry = _argv1 !== void 0 && import.meta.url === pathToFileURL(_argv1).href;
-if (_isCliEntry || _argv1 === _HERE) {
+if (_isCliEntry || _argv1 === _HERE2) {
   try {
     process2.exitCode = main2(process2.argv.slice(2));
   } catch (e) {