@fabricorg/cli 0.6.0 → 0.6.1

package/dist/fabric.js

@@ -6,7 +6,7 @@ import { Command as Command22 } from "commander";
 // package.json
 var package_default = {
   name: "@fabricorg/cli",
-  version: "0.6.0",
+  version: "0.6.1",
   description: "CLI for the Fabric AI platform",
   keywords: [
     "fabric",
@@ -235,10 +235,10 @@ var FabricHttpClient = class _FabricHttpClient {
    * Inject default `org` / `personal` query params if the path doesn't already
    * carry one. Resources that explicitly pass `?org=other` are untouched.
    */
-  buildUrl(path29) {
-    const url = `${this.baseUrl}/api/v1${path29}`;
-    const hasOrg = /[?&]org=/.test(path29);
-    const hasPersonal = /[?&]personal=/.test(path29);
+  buildUrl(path30) {
+    const url = `${this.baseUrl}/api/v1${path30}`;
+    const hasOrg = /[?&]org=/.test(path30);
+    const hasPersonal = /[?&]personal=/.test(path30);
     if (hasOrg || hasPersonal) {
       return url;
     }
@@ -251,11 +251,11 @@ var FabricHttpClient = class _FabricHttpClient {
     if (additions.length === 0) {
       return url;
     }
-    const sep = path29.includes("?") ? "&" : "?";
+    const sep = path30.includes("?") ? "&" : "?";
     return `${url}${sep}${additions.join("&")}`;
   }
-  async request(method, path29, options = {}) {
-    const url = this.buildUrl(path29);
+  async request(method, path30, options = {}) {
+    const url = this.buildUrl(path30);
     const isMutating = MUTATING_METHODS.has(method);
     const idempotencyKey = options.idempotencyKey ?? (isMutating ? randomId() : void 0);
     const maxAttempts = (options.retry ?? this.retry).maxRetries + 1;
@@ -265,7 +265,7 @@ var FabricHttpClient = class _FabricHttpClient {
         throw options.signal.reason;
       }
       const start = Date.now();
-      this.emit({ kind: "request", method, path: path29, attempt: attempt2 });
+      this.emit({ kind: "request", method, path: path30, attempt: attempt2 });
       try {
         const result = await this.executeOnce(
           method,
@@ -276,7 +276,7 @@ var FabricHttpClient = class _FabricHttpClient {
         this.emit({
           kind: "response",
           method,
-          path: path29,
+          path: path30,
           attempt: attempt2,
           status: 200,
           durationMs: Date.now() - start
@@ -289,7 +289,7 @@ var FabricHttpClient = class _FabricHttpClient {
         this.emit({
           kind: retriable ? "retry" : "error",
           method,
-          path: path29,
+          path: path30,
           attempt: attempt2,
           status,
           durationMs: Date.now() - start,
@@ -433,28 +433,28 @@ var FabricHttpClient = class _FabricHttpClient {
     } catch {
     }
   }
-  get(path29, options = {}) {
+  get(path30, options = {}) {
     return this.request(
       "GET",
-      path29,
+      path30,
       options.signal ? { signal: options.signal } : {}
     );
   }
-  post(path29, body, options = {}) {
-    return this.request("POST", path29, {
+  post(path30, body, options = {}) {
+    return this.request("POST", path30, {
       body,
       idempotencyKey: options.idempotencyKey,
       retry: options.retry
     });
   }
-  patch(path29, body, options = {}) {
-    return this.request("PATCH", path29, {
+  patch(path30, body, options = {}) {
+    return this.request("PATCH", path30, {
       body,
       idempotencyKey: options.idempotencyKey
     });
   }
-  put(path29, body, options = {}) {
-    return this.request("PUT", path29, {
+  put(path30, body, options = {}) {
+    return this.request("PUT", path30, {
       body,
       idempotencyKey: options.idempotencyKey,
       retry: options.retry
@@ -465,8 +465,8 @@ var FabricHttpClient = class _FabricHttpClient {
    * delete names the path and the version in its body). Without `body`,
    * nothing is sent, as before.
    */
-  delete(path29, body, options = {}) {
-    return this.request("DELETE", path29, {
+  delete(path30, body, options = {}) {
+    return this.request("DELETE", path30, {
       body,
       idempotencyKey: options.idempotencyKey
     });
@@ -1091,14 +1091,14 @@ function buildQuery3(opts) {
 
 // ../sdk/src/resources/integrations.ts
 var RESOURCE_BUILTINS = /* @__PURE__ */ new Set(["list", "constructor", "then"]);
-function makeDotPath(http, slug, path29) {
-  const fn = (args) => http.post(`/integrations/${slug}/${path29.join(".")}`, args ?? {});
+function makeDotPath(http, slug, path30) {
+  const fn = (args) => http.post(`/integrations/${slug}/${path30.join(".")}`, args ?? {});
   return new Proxy(fn, {
     get(target, prop) {
       if (prop in target || typeof prop !== "string") {
         return Reflect.get(target, prop);
       }
-      return makeDotPath(http, slug, [...path29, prop]);
+      return makeDotPath(http, slug, [...path30, prop]);
     }
   });
 }
@@ -2238,19 +2238,23 @@ function pathAsCommandWord(file, platform = process.platform) {
   }
   return `"${normalised}"`;
 }
-function launcherWords(origin = launcherOrigin ?? implicitOrigin(), script) {
+function launcherWords(script) {
   if (!isServedBundle()) {
     return ["fabric"];
   }
   const tarball = bundleTarballPath();
-  if (tarball !== void 0) {
-    return ["npx", "-y", `${origin}${tarball}`];
+  const packedFor = bakedOrigin();
+  if (tarball !== void 0 && packedFor !== void 0) {
+    return ["npx", "-y", `${packedFor}${tarball}`];
   }
   const word = pathAsCommandWord(script ?? bundleScriptPath());
   return word === null ? ["fabric"] : ["node", word];
 }
-function printableLauncherWords(origin = launcherOrigin ?? implicitOrigin()) {
-  const words = launcherWords(origin);
+function printableLauncherWords() {
+  if (launcherOrigin !== void 0 && launcherOrigin !== implicitOrigin() && !isSafeArgument(launcherOrigin)) {
+    return null;
+  }
+  const words = launcherWords();
   return words[0] === "npx" && !isSafeArgument(words[2] ?? "") ? null : words;
 }
 function launcherPathText() {
@@ -2262,7 +2266,7 @@ function implicitOrigin() {
 }
 function fabricCommand(args, origin = launcherOrigin) {
   const deployment = origin ?? implicitOrigin();
-  const words = printableLauncherWords(deployment);
+  const words = printableLauncherWords();
   const bound = deployment !== implicitOrigin() && !args.includes("--base-url") ? ` --base-url ${deployment}` : "";
   if (words === null || bound !== "" && !isSafeArgument(deployment)) {
     return NO_COMMAND;
@@ -2341,8 +2345,8 @@ function sameOriginEndpoint(value, field2, issuer) {
 }
 function authorizationServerMetadataUrl(issuer) {
   const url = new URL(issuer);
-  const path29 = url.pathname.replace(/\/+$/, "");
-  return `${url.origin}/.well-known/oauth-authorization-server${path29}`;
+  const path30 = url.pathname.replace(/\/+$/, "");
+  return `${url.origin}/.well-known/oauth-authorization-server${path30}`;
 }
 async function discoverAuthorizationServer(baseUrl, options = {}) {
   const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
@@ -2399,6 +2403,20 @@ async function discoverAuthorizationServer(baseUrl, options = {}) {
 import { createServer } from "http";
 var CALLBACK_PATH = "/callback";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var CallbackError = class extends Error {
+  constructor(error, description) {
+    super(
+      error === "access_denied" ? "Sign-in was denied in the browser." : `Sign-in failed (${error}).`
+    );
+    this.error = error;
+    this.description = description;
+    this.name = "CallbackError";
+  }
+};
+var FINAL_PAGE_HEADERS = {
+  "Content-Type": "text/html; charset=utf-8",
+  Connection: "close"
+};
 var PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem"><h1 style="font-weight:400">${title}</h1><p>${body}</p></body>`;
 async function startLoopbackListener(options) {
   const callbackPath = options.callbackPath ?? CALLBACK_PATH;
@@ -2415,9 +2433,9 @@ async function startLoopbackListener(options) {
   });
   result.catch(() => {
   });
-  const server = createServer((request, response) => {
-    const url = new URL(request.url ?? "/", "http://127.0.0.1");
-    if (request.method !== "GET" || url.pathname !== callbackPath) {
+  const server = createServer((request2, response) => {
+    const url = new URL(request2.url ?? "/", "http://127.0.0.1");
+    if (request2.method !== "GET" || url.pathname !== callbackPath) {
       response.writeHead(404).end();
       return;
     }
@@ -2434,17 +2452,17 @@ async function startLoopbackListener(options) {
       return;
     }
     if (error) {
-      response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(
+      const failure = new CallbackError(
+        error,
+        url.searchParams.get("error_description")
+      );
+      response.writeHead(200, FINAL_PAGE_HEADERS).end(
         PAGE(
           "Sign-in cancelled",
           "You can close this tab and return to your terminal."
-        )
+        ),
+        () => settle({ error: failure })
       );
-      settle({
-        error: new Error(
-          error === "access_denied" ? "Sign-in was denied in the browser." : `Sign-in failed (${error}).`
-        )
-      });
       return;
     }
     if (!code) {
@@ -2456,13 +2474,13 @@ async function startLoopbackListener(options) {
       );
       return;
     }
-    response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(
+    response.writeHead(200, FINAL_PAGE_HEADERS).end(
       PAGE(
         "Signed in",
         "You can close this tab and return to your terminal."
-      )
+      ),
+      () => settle({ code, params: url.searchParams })
     );
-    settle({ code, params: url.searchParams });
   });
   const listen = (port2) => new Promise((resolve, reject) => {
     server.once("error", reject);
@@ -2526,15 +2544,73 @@ function isProjectId(value) {
 function projectResource(origin, audience, projectId) {
   return `${origin.replace(/\/+$/, "")}${RESOURCE_BASE_PATH[audience]}/projects/${projectId}`;
 }
+function normalizeServerUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:" || parsed.username !== "" || parsed.password !== "") {
+    return null;
+  }
+  return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}${parsed.search}${parsed.hash}`;
+}
 function isGatewayUrlOf(origin, url) {
-  const gateway = `${origin.replace(/\/+$/, "")}${RESOURCE_BASE_PATH.mcp}`;
-  return url === gateway || new RegExp(`^${escaped(gateway)}/projects/[A-Za-z0-9_-]{1,64}$`).test(
-    url
+  const gateway = normalizeServerUrl(
+    `${origin.replace(/\/+$/, "")}${RESOURCE_BASE_PATH.mcp}`
+  );
+  const candidate = normalizeServerUrl(url);
+  if (gateway === null || candidate === null) {
+    return false;
+  }
+  return candidate === gateway || new RegExp(`^${escaped(gateway)}/projects/[A-Za-z0-9_-]{1,64}$`).test(
+    candidate
+  );
+}
+function isOrgGatewayUrlOf(origin, url) {
+  const gateway = normalizeServerUrl(
+    `${origin.replace(/\/+$/, "")}${RESOURCE_BASE_PATH.mcp}`
   );
+  return gateway !== null && normalizeServerUrl(url) === gateway;
 }
 function escaped(text3) {
   return text3.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function originOf2(value) {
+  const normal = normalizeServerUrl(value);
+  return normal === null ? null : new URL(normal).origin;
+}
+function classifyGatewayUrl(origin, projectId, url) {
+  const candidate = normalizeServerUrl(url);
+  if (candidate === null || originOf2(url) !== originOf2(origin)) {
+    return "foreign";
+  }
+  if (candidate === normalizeServerUrl(projectResource(origin, "mcp", projectId))) {
+    return "this-project";
+  }
+  if (isOrgGatewayUrlOf(origin, url)) {
+    return "org-wide";
+  }
+  return isGatewayUrlOf(origin, url) ? "other-project" : "unfamiliar";
+}
+function classifyGatewayResource(origin, projectId, resource) {
+  const relation = classifyGatewayUrl(origin, projectId, resource);
+  if (relation !== "unfamiliar") {
+    return relation;
+  }
+  const api = normalizeServerUrl(
+    `${origin.replace(/\/+$/, "")}${RESOURCE_BASE_PATH.api}`
+  );
+  const candidate = normalizeServerUrl(resource);
+  const named = api === null || candidate === null ? null : new RegExp(
+    `^${escaped(api)}/projects/([A-Za-z0-9_-]{1,64})$`
+  ).exec(candidate);
+  if (named === null) {
+    return "unfamiliar";
+  }
+  return named[1] === projectId ? "this-project" : "other-project";
+}
 
 // src/lib/oauth/flow.ts
 var REQUESTED_SCOPES = [
@@ -4111,7 +4187,7 @@ async function loginInBrowser(opts) {
   if (origin === null) {
     printError(BAD_BASE_URL_LINE, 2);
   }
-  const forProject = opts.project === void 0 ? "" : ` for project ${opts.project}`;
+  const forProject2 = opts.project === void 0 ? "" : ` for project ${opts.project}`;
   let identity;
   try {
     identity = await signInWithBrowser({
@@ -4121,7 +4197,7 @@ async function loginInBrowser(opts) {
       project: opts.project,
       announce: (url) => {
         process.stdout.write(
-          `Opening your browser to sign in to ${effectiveBaseUrl}${forProject}.
+          `Opening your browser to sign in to ${effectiveBaseUrl}${forProject2}.
 If it does not open, visit:
 
   ${url}
@@ -4137,7 +4213,7 @@ If it does not open, visit:
     throw error;
   }
   printSuccess(
-    `Authenticated as ${identity.name} (${identity.email})${forProject}`
+    `Authenticated as ${identity.name} (${identity.email})${forProject2}`
   );
 }
 function buildLoginCommand() {
@@ -4649,16 +4725,47 @@ var AGENT_NAME = "Fabric";
 function registrationPath() {
   return join(dirname(getConfigPath()), "chatgpt-plan-host.json");
 }
-async function loadRegistration(path29 = registrationPath()) {
+async function loadRegistrationStore(path30 = registrationPath()) {
+  let stored;
   try {
-    return JSON.parse(await readFile(path29, "utf8"));
+    stored = JSON.parse(await readFile(path30, "utf8"));
   } catch {
-    return { hostId: `urn:uuid:${randomUUID2()}` };
+    stored = {};
+  }
+  const hostId = stored.hostId ?? `urn:uuid:${randomUUID2()}`;
+  if (stored.accounts && typeof stored.accounts === "object") {
+    return { hostId, accounts: stored.accounts };
   }
+  return {
+    hostId,
+    accounts: stored.subject && stored.clientId ? { [stored.subject]: { clientId: stored.clientId } } : {}
+  };
 }
-async function saveRegistration(registration, path29 = registrationPath()) {
-  await mkdir(dirname(path29), { recursive: true, mode: 448 });
-  await writeFile(path29, JSON.stringify(registration), { mode: 384 });
+async function saveAccountRegistration(account, path30 = registrationPath()) {
+  const store = await loadRegistrationStore(path30);
+  const { hostId, subject, ...registration } = account;
+  const next = {
+    hostId,
+    accounts: { ...store.accounts, [subject]: registration }
+  };
+  await mkdir(dirname(path30), { recursive: true, mode: 448 });
+  await writeFile(path30, JSON.stringify(next), { mode: 384 });
+}
+function selectRegistration(store, account) {
+  if (account === void 0) {
+    return { hostId: store.hostId };
+  }
+  const email = account.toLowerCase();
+  const match = Object.entries(store.accounts).find(
+    ([subject2, saved2]) => subject2 === account || saved2.email?.toLowerCase() === email
+  );
+  if (!match) {
+    throw new Error(
+      `No ChatGPT account ${account} is saved on this machine; run without --account to sign in with a new registration`
+    );
+  }
+  const [subject, saved] = match;
+  return { hostId: store.hostId, clientId: saved.clientId, subject };
 }
 function randomToken() {
   return randomBytes2(24).toString("base64url");
@@ -4747,6 +4854,84 @@ function checkIdToken(idToken, expected) {
   }
   return { sub: claims.sub, email: claims.email };
 }
+var WORKSPACE_DENIED_ERROR = "3p_login_workspace_scope_denied";
+function isWorkspaceDenied(err) {
+  if (err instanceof CallbackError) {
+    return err.error === WORKSPACE_DENIED_ERROR || /workspace/i.test(err.description ?? "");
+  }
+  return err instanceof Error && err.message.includes(WORKSPACE_DENIED_ERROR);
+}
+function explainDenial(err) {
+  if (!isWorkspaceDenied(err)) {
+    return err;
+  }
+  const description = err instanceof CallbackError && err.description ? ` ${err.description}` : "";
+  return new Error(
+    `${err.message}${description} ChatGPT refused it for that workspace: run \`fabric connect chatgpt\` again without --account (the same as --new-registration) and choose your personal Plus or Pro workspace when ChatGPT asks which one to sign in to.`
+  );
+}
+async function attemptSignIn(registration, options) {
+  const verifier = createCodeVerifier();
+  const state = createState();
+  const nonce = randomToken();
+  const listener = await startLoopbackListener({
+    state,
+    callbackPath: CHATGPT_CALLBACK_PATH,
+    preferredPort: options.preferredPort ?? CHATGPT_CALLBACK_PORT
+  });
+  try {
+    options.open(
+      buildAuthorizeUrl({
+        clientId: registration.clientId ?? DYNAMIC_CLIENT_ID,
+        hostId: registration.hostId,
+        redirectUri: listener.redirectUri,
+        state,
+        nonce,
+        codeChallenge: codeChallengeS256(verifier)
+      })
+    );
+    const { code, params } = await listener.result;
+    const clientId = issuedClientId(params, registration);
+    const tokens = await exchangeCode(
+      {
+        clientId,
+        code,
+        codeVerifier: verifier,
+        redirectUri: listener.redirectUri
+      },
+      options.fetchImpl
+    );
+    const { sub, email } = checkIdToken(tokens.id_token ?? "", {
+      nonce,
+      subject: registration.subject
+    });
+    await options.save?.({
+      hostId: registration.hostId,
+      subject: sub,
+      clientId,
+      ...email !== void 0 && { email }
+    });
+    return { tokens, clientId, subject: sub, email };
+  } finally {
+    listener.close();
+  }
+}
+async function signInWithChatGpt(options) {
+  const { registration } = options;
+  try {
+    return await attemptSignIn(registration, options);
+  } catch (err) {
+    if (!registration.clientId || !isWorkspaceDenied(err)) {
+      throw explainDenial(err);
+    }
+  }
+  options.onRetry?.();
+  try {
+    return await attemptSignIn({ hostId: registration.hostId }, options);
+  } catch (err) {
+    throw explainDenial(err);
+  }
+}
 function buildUploadPayload(tokens, registration) {
   if (!tokens.refresh_token || !tokens.id_token) {
     throw new Error("OpenAI's reply is missing the refresh or ID token");
@@ -4815,6 +5000,12 @@ function connectOptionsError(opts) {
   if (opts.org && !opts.shared) {
     return "--org is used only with --shared, to connect an account the organization shares.";
   }
+  if (opts.account !== void 0 && opts.newRegistration) {
+    return "--account reuses a saved registration; --new-registration makes a new one. Use one of them.";
+  }
+  if (opts.account !== void 0 && opts.shared) {
+    return "--account is for your own plan; a shared account always signs in with a new registration.";
+  }
   return null;
 }
 function open(url, what) {
@@ -4878,75 +5069,50 @@ async function connect(opts) {
     printError(BAD_BASE_URL_LINE, 2);
   }
   const sharedOrganizationSlug = opts.shared ? opts.org : void 0;
+  let registration;
+  if (sharedOrganizationSlug) {
+    registration = { hostId: `urn:uuid:${randomUUID3()}` };
+  } else {
+    try {
+      registration = selectRegistration(
+        await loadRegistrationStore(),
+        opts.account
+      );
+    } catch (err) {
+      printError(err.message, 2);
+    }
+  }
   let ticket;
   try {
     ticket = await approveInFabric(origin, sharedOrganizationSlug);
   } catch (err) {
     printError(err.message, 1);
   }
-  const stored = await loadRegistration();
-  let registration = stored;
-  if (sharedOrganizationSlug) {
-    registration = { hostId: `urn:uuid:${randomUUID3()}` };
-  } else if (opts.newRegistration) {
-    registration = { hostId: stored.hostId };
-  }
-  const verifier = createCodeVerifier();
-  const state = createState();
-  const nonce = randomToken();
-  const listener = await startLoopbackListener({
-    state,
-    callbackPath: CHATGPT_CALLBACK_PATH,
-    preferredPort: CHATGPT_CALLBACK_PORT
-  });
-  open(
-    buildAuthorizeUrl({
-      clientId: registration.clientId ?? DYNAMIC_CLIENT_ID,
-      hostId: registration.hostId,
-      redirectUri: listener.redirectUri,
-      state,
-      nonce,
-      codeChallenge: codeChallengeS256(verifier)
-    }),
-    "sign in with ChatGPT"
-  );
   let result;
-  let clientId;
-  let subject;
   try {
-    const { code, params } = await listener.result;
-    clientId = issuedClientId(params, registration);
-    if (!sharedOrganizationSlug) {
-      await saveRegistration({ ...registration, clientId });
-    }
-    const tokens = await exchangeCode({
-      clientId,
-      code,
-      codeVerifier: verifier,
-      redirectUri: listener.redirectUri
+    const signIn = await signInWithChatGpt({
+      registration,
+      open: (url) => open(url, "sign in with ChatGPT"),
+      ...!sharedOrganizationSlug && { save: saveAccountRegistration },
+      onRetry: () => process.stdout.write(
+        "ChatGPT refused this machine's saved registration; signing in again with a new one.\n"
+      )
     });
-    subject = checkIdToken(tokens.id_token ?? "", {
-      nonce,
-      subject: registration.subject
-    }).sub;
     result = await uploadChatGptPlan({
       origin,
       ticket,
-      payload: buildUploadPayload(tokens, {
-        clientId,
+      payload: buildUploadPayload(signIn.tokens, {
+        clientId: signIn.clientId,
         hostId: registration.hostId
       })
     });
   } catch (err) {
     printError(err.message, 1);
-  } finally {
-    listener.close();
   }
   if ("shared" in result) {
     printSuccess(describeSharedAccount(result));
     return;
   }
-  await saveRegistration({ hostId: registration.hostId, clientId, subject });
   printSuccess(
     `Connected your ChatGPT plan${result.email ? ` (${result.email})` : ""} to Fabric.`
   );
@@ -4960,9 +5126,12 @@ function buildConnectCommand() {
   connectCommand.addCommand(
     new Command8("chatgpt").description(
       "Approve in Fabric, sign in with ChatGPT and run your own Fabric AI work on your plan"
+    ).option(
+      "--account <subject-or-email>",
+      "Reuse the registration saved for this ChatGPT account instead of making a new one"
     ).option(
       "--new-registration",
-      "Register this machine with OpenAI again, for example to switch accounts"
+      "Register this machine with OpenAI again (the default without --account)"
     ).option(
       "--base-url <url>",
       "Deployment to connect, such as https://example.com"
@@ -5582,23 +5751,23 @@ function normalizeContextSourcePath(input) {
   if (slashed.startsWith("/") || DRIVE_LETTER_PREFIX.test(slashed)) {
     return { ok: false, reason: "absolute" };
   }
-  let path29 = slashed.replace(/\/{2,}/g, "/");
-  while (path29.startsWith("./")) {
-    path29 = path29.slice(2);
+  let path30 = slashed.replace(/\/{2,}/g, "/");
+  while (path30.startsWith("./")) {
+    path30 = path30.slice(2);
   }
-  if (path29.length === 0) {
+  if (path30.length === 0) {
     return { ok: false, reason: "empty" };
   }
-  if (path29.endsWith("/")) {
+  if (path30.endsWith("/")) {
     return { ok: false, reason: "trailing-slash" };
   }
-  if (path29.split("/").some((segment) => segment === "." || segment === "..")) {
+  if (path30.split("/").some((segment) => segment === "." || segment === "..")) {
     return { ok: false, reason: "dot-segment" };
   }
-  if (path29.length > MAX_CONTEXT_SOURCE_PATH_LENGTH) {
+  if (path30.length > MAX_CONTEXT_SOURCE_PATH_LENGTH) {
     return { ok: false, reason: "too-long" };
   }
-  return { ok: true, sourcePath: path29 };
+  return { ok: true, sourcePath: path30 };
 }
 
 // src/lib/context-sync/lock.ts
@@ -5810,8 +5979,8 @@ async function walkContextDirectory(root, rules) {
   const pending = [""];
   while (pending.length > 0) {
     const relativeDirectory = pending.pop();
-    const names = await readdir(path5.join(root, relativeDirectory));
-    for (const name of names) {
+    const names2 = await readdir(path5.join(root, relativeDirectory));
+    for (const name of names2) {
       const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
       let stats;
       try {
@@ -5897,8 +6066,8 @@ function sharedPathProblem(entry, group2) {
   if (others.length === 0) {
     return null;
   }
-  const names = others.map((other) => other.diskPath).join(", ");
-  return others.every((other) => other.sourcePath === entry.sourcePath) ? `names the same source as ${names}` : `case-only collision with ${names}`;
+  const names2 = others.map((other) => other.diskPath).join(", ");
+  return others.every((other) => other.sourcePath === entry.sourcePath) ? `names the same source as ${names2}` : `case-only collision with ${names2}`;
 }
 async function computeContextPlan(input) {
   const { root, lock } = input;
@@ -6486,9 +6655,9 @@ async function pushContextPlan(input) {
     }
   };
   const pruneTargetsSoFar = () => {
-    const keptByMoves = results.map(moveKeptOldPath).filter((path29) => path29 !== null);
-    return [.../* @__PURE__ */ new Set([...input.plan.removed, ...keptByMoves])].filter((path29) => {
-      const locked = input.lock?.files[path29];
+    const keptByMoves = results.map(moveKeptOldPath).filter((path30) => path30 !== null);
+    return [.../* @__PURE__ */ new Set([...input.plan.removed, ...keptByMoves])].filter((path30) => {
+      const locked = input.lock?.files[path30];
       return locked !== void 0 && locked.state !== "duplicate";
     }).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
   };
@@ -7126,7 +7295,7 @@ function pruneSummary(results, targets) {
       (r) => r.status === "deleted" || r.status === "already-gone"
     ).map((r) => r.sourcePath)
   );
-  const notDeleted = targets.filter((path29) => !settled.has(path29)).length;
+  const notDeleted = targets.filter((path30) => !settled.has(path30)).length;
   let text3 = `--prune: ${count("deleted")} deleted, ${count("already-gone")} already gone, ${notDeleted} not deleted`;
   const first = results.find((r) => r.status === "delete-failed");
   if (first && first.status === "delete-failed") {
@@ -7510,7 +7679,7 @@ function buildFramesCommand() {
 
 // src/commands/instructions/index.ts
 import { readdir as readdir3 } from "fs/promises";
-import path28 from "path";
+import path29 from "path";
 import { Command as Command13 } from "commander";
 
 // src/lib/environment.ts
@@ -7523,15 +7692,15 @@ function runningInCi(env2 = process.env) {
 }
 
 // src/lib/instructions/adoption.ts
-import path9 from "path";
+import path11 from "path";
 
 // src/lib/instructions/checkout.ts
 import { realpath as realpath2 } from "fs/promises";
-import path8 from "path";
+import path10 from "path";
 
 // src/lib/instructions/git.ts
-import { lstat as lstat4, stat } from "fs/promises";
-import path7 from "path";
+import { lstat as lstat5, stat } from "fs/promises";
+import path9 from "path";
 
 // src/lib/instructions/git-literals.ts
 var COMMIT_SHA = /^[0-9a-f]{40}$/;
@@ -7560,10 +7729,21 @@ function cloneableUrl(url) {
 }
 
 // src/lib/instructions/git-run.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
+
+// src/lib/instructions/taskkill-path.ts
+import path7 from "path";
+function taskkillPath(env2 = process.env) {
+  const root = env2.SystemRoot ?? env2.SYSTEMROOT ?? env2.windir ?? "C:\\Windows";
+  return path7.win32.join(root, "System32", "taskkill.exe");
+}
+
+// src/lib/instructions/git-run.ts
 var STDOUT_CAP_BYTES = 64 * 1024;
 var STDERR_CAP_BYTES = 8 * 1024;
 var KILL_GRACE_MS = 1e3;
+var GROUP_KILL_GRACE_MS = 500;
+var BINARY_STDOUT_CAP_BYTES = 1024 * 1024;
 var STRIPPED_VARIABLES = /* @__PURE__ */ new Set([
   "GIT_DIR",
   "GIT_WORK_TREE",
@@ -7657,6 +7837,8 @@ function runGit(cwd, args, deadline, options = {}) {
       });
       return;
     }
+    const grouped = Boolean(options.write && options.unattended);
+    let escalate;
     let settled = false;
     const finish = (result) => {
       if (!settled) {
@@ -7687,9 +7869,16 @@ function runGit(cwd, args, deadline, options = {}) {
             ...options.write && options.unattended ? hookWriteEnvironment(process.env) : gitEnvironment(process.env, options),
             ...gateway.env
           },
-          stdio: ["ignore", "pipe", "pipe"],
+          stdio: [
+            options.input === void 0 ? "ignore" : "pipe",
+            "pipe",
+            "pipe"
+          ],
           shell: false,
-          windowsHide: true
+          windowsHide: true,
+          // Its own process group, so the deadline can take the
+          // transport children with it (`killTree`).
+          detached: grouped && process.platform !== "win32"
         }
       );
     } catch (error) {
@@ -7701,12 +7890,17 @@ function runGit(cwd, args, deadline, options = {}) {
     let outOverflow = false;
     const err = [];
     let errBytes = 0;
+    const stdoutCap = options.binary ? options.binaryCapBytes ?? BINARY_STDOUT_CAP_BYTES : STDOUT_CAP_BYTES;
+    if (options.input !== void 0) {
+      child.stdin?.on("error", () => void 0);
+      child.stdin?.end(options.input);
+    }
     child.stdout?.on("data", (chunk) => {
-      if (chunk.length > STDOUT_CAP_BYTES - outBytes) {
+      if (chunk.length > stdoutCap - outBytes) {
         outOverflow = true;
       }
-      if (outBytes < STDOUT_CAP_BYTES) {
-        const room = STDOUT_CAP_BYTES - outBytes;
+      if (outBytes < stdoutCap) {
+        const room = stdoutCap - outBytes;
         out.push(chunk.subarray(0, room));
         outBytes += Math.min(room, chunk.length);
       }
@@ -7718,12 +7912,34 @@ function runGit(cwd, args, deadline, options = {}) {
         errBytes += Math.min(room, chunk.length);
       }
     });
-    let escalate;
+    let stoppingGroup = false;
+    const releaseGroup = () => {
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      child.unref();
+    };
     const timer = setTimeout(() => {
-      child.kill("SIGTERM");
-      escalate = setTimeout(() => {
-        child.kill("SIGKILL");
-      }, KILL_GRACE_MS);
+      if (grouped) {
+        stopTree(child, "SIGTERM");
+        if (process.platform !== "win32") {
+          stoppingGroup = true;
+          escalate = setTimeout(() => {
+            stopTree(child, "SIGKILL");
+            releaseGroup();
+            finish({
+              kind: "unavailable",
+              reason: "git timed out"
+            });
+          }, GROUP_KILL_GRACE_MS);
+          return;
+        }
+        releaseGroup();
+      } else {
+        child.kill("SIGTERM");
+        escalate = setTimeout(() => {
+          child.kill("SIGKILL");
+        }, KILL_GRACE_MS);
+      }
       finish({ kind: "unavailable", reason: "git timed out" });
     }, remaining);
     timer.unref();
@@ -7731,6 +7947,9 @@ function runGit(cwd, args, deadline, options = {}) {
       finish(spawnFailure(error));
     });
     child.on("close", (code) => {
+      if (stoppingGroup) {
+        return;
+      }
       clearTimeout(escalate);
       if (outOverflow) {
         finish({
@@ -7742,12 +7961,36 @@ function runGit(cwd, args, deadline, options = {}) {
       finish({
         kind: "exited",
         code: code ?? -1,
-        stdout: Buffer.concat(out).toString("utf8"),
+        stdout: Buffer.concat(out).toString(
+          options.binary ? "latin1" : "utf8"
+        ),
         stderr: Buffer.concat(err).toString("utf8")
       });
     });
   });
 }
+function stopTree(child, signal) {
+  const pid = child.pid;
+  if (pid === void 0) {
+    child.kill(signal);
+    return;
+  }
+  try {
+    if (process.platform === "win32") {
+      if (child.exitCode === null && child.signalCode === null) {
+        spawnSync(taskkillPath(), ["/PID", String(pid), "/T", "/F"], {
+          stdio: "ignore",
+          windowsHide: true,
+          timeout: 2e3
+        });
+      }
+    } else {
+      process.kill(-pid, signal);
+    }
+  } catch {
+  }
+  child.kill(signal);
+}
 function spawnFailure(error) {
   const code = error?.code;
   if (code === "ENOENT") {
@@ -7831,7 +8074,12 @@ async function changedTrackedPaths(root, deadline) {
 }
 
 // src/lib/instructions/git-write.ts
+import { lstat as lstat4, readFile as readFile3 } from "fs/promises";
+import path8 from "path";
 function fetchFailureOf(stderr) {
+  if (/config-env/i.test(stderr) && /unknown option|usage:/i.test(stderr)) {
+    return "old-git";
+  }
   if (/\(non-fast-forward\)|\[rejected\]|cannot fast-forward/i.test(stderr)) {
     return "diverged";
   }
@@ -7885,12 +8133,16 @@ function blockedFilesOf(stderr) {
   }
   return files;
 }
-async function fetchRef(root, remote, ref, deadline) {
+var fetchHeadFlagWorks = true;
+function timedOut(reason) {
+  return reason === "git timed out";
+}
+async function fetchInto(root, source, remote, ref, deadline, httpAuthorization) {
   if (!isRemoteName(remote) || !isBranchLiteral(ref)) {
     return { kind: "unavailable", reason: "not a branch this will fetch" };
   }
   const tracking = `refs/remotes/${remote}/${ref}`;
-  const fetched = await runGit(
+  const fetchWith = (skipFetchHead) => runGit(
     root,
     [
       "-c",
@@ -7899,15 +8151,26 @@ async function fetchRef(root, remote, ref, deadline) {
       "maintenance.auto=false",
       "fetch",
       "--no-recurse-submodules",
+      "--no-tags",
+      ...skipFetchHead ? ["--no-write-fetch-head"] : [],
       "--",
-      remote,
+      source,
       `refs/heads/${ref}:${tracking}`
     ],
     deadline,
-    { write: true, unattended: true }
+    {
+      write: true,
+      unattended: true,
+      ...httpAuthorization === void 0 ? {} : { httpAuthorization }
+    }
   );
+  let fetched = await fetchWith(fetchHeadFlagWorks);
+  if (fetched.kind === "exited" && fetched.code !== 0 && fetchHeadFlagWorks && /no-write-fetch-head/i.test(fetched.stderr)) {
+    fetchHeadFlagWorks = false;
+    fetched = await fetchWith(false);
+  }
   if (fetched.kind === "unavailable") {
-    return fetched.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: fetched.reason };
+    return timedOut(fetched.reason) ? { kind: "timed-out" } : { kind: "unavailable", reason: fetched.reason };
   }
   if (fetched.code !== 0) {
     return { kind: "failed", reason: fetchFailureOf(fetched.stderr) };
@@ -7918,7 +8181,7 @@ async function fetchRef(root, remote, ref, deadline) {
     deadline
   );
   if (tip.kind === "unavailable") {
-    return tip.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: tip.reason };
+    return timedOut(tip.reason) ? { kind: "timed-out" } : { kind: "unavailable", reason: tip.reason };
   }
   const [sha] = lines(tip.stdout);
   if (tip.code !== 0 || !sha || !COMMIT_SHA.test(sha)) {
@@ -7926,59 +8189,29 @@ async function fetchRef(root, remote, ref, deadline) {
   }
   return { kind: "fetched", tip: sha };
 }
-async function fetchRefFromUrl(root, url, remote, ref, deadline, httpAuthorization) {
-  if (!isRemoteName(remote) || !isBranchLiteral(ref)) {
-    return { kind: "unavailable", reason: "not a branch this will fetch" };
-  }
-  const tracking = `refs/remotes/${remote}/${ref}`;
-  const fetched = await runGit(
+function fetchRef(root, remote, ref, deadline) {
+  return fetchInto(root, remote, remote, ref, deadline);
+}
+function fetchRefFromUrl(root, url, remote, ref, deadline, httpAuthorization) {
+  return fetchInto(root, url, remote, ref, deadline, httpAuthorization);
+}
+async function mergeOnce(root, sha, deadline) {
+  const merged = await runGit(
     root,
     [
       "-c",
-      "gc.auto=0",
-      "-c",
-      "maintenance.auto=false",
-      "fetch",
-      "--no-recurse-submodules",
-      "--",
-      url,
-      `refs/heads/${ref}:${tracking}`
+      "core.quotepath=false",
+      "merge",
+      "--ff-only",
+      "--no-edit",
+      "--quiet",
+      sha
     ],
     deadline,
-    { write: true, unattended: true, httpAuthorization }
-  );
-  if (fetched.kind === "unavailable") {
-    return fetched.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: fetched.reason };
-  }
-  if (fetched.code !== 0) {
-    return { kind: "failed", reason: fetchFailureOf(fetched.stderr) };
-  }
-  const tip = await runGit(
-    root,
-    ["rev-parse", "--verify", "-q", `${tracking}^{commit}`],
-    deadline
-  );
-  if (tip.kind === "unavailable") {
-    return tip.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: tip.reason };
-  }
-  const [sha] = lines(tip.stdout);
-  if (tip.code !== 0 || !sha || !COMMIT_SHA.test(sha)) {
-    return { kind: "failed", reason: "missing-ref" };
-  }
-  return { kind: "fetched", tip: sha };
-}
-async function fastForwardTo(root, sha, deadline) {
-  if (!COMMIT_SHA.test(sha)) {
-    return { kind: "unavailable", reason: "not a commit name" };
-  }
-  const merged = await runGit(
-    root,
-    ["merge", "--ff-only", "--no-edit", "--quiet", sha],
-    deadline,
     { write: true, unattended: true }
   );
   if (merged.kind === "unavailable") {
-    return merged.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: merged.reason };
+    return timedOut(merged.reason) ? { kind: "timed-out" } : { kind: "unavailable", reason: merged.reason };
   }
   if (merged.code !== 0) {
     const reason = mergeFailureOf(merged.stderr);
@@ -7990,55 +8223,294 @@ async function fastForwardTo(root, sha, deadline) {
     deadline
   );
   if (head.kind === "unavailable") {
-    return head.reason === "git timed out" ? { kind: "timed-out" } : { kind: "unavailable", reason: head.reason };
+    return timedOut(head.reason) ? { kind: "timed-out" } : { kind: "unavailable", reason: head.reason };
   }
   const [now] = lines(head.stdout);
   return head.code === 0 && now === sha ? { kind: "merged", head: now } : { kind: "failed", reason: "other" };
 }
-
-// src/lib/instructions/git.ts
-var OPERATION_MARKERS = [
-  { marker: "MERGE_HEAD", operation: "merge" },
-  { marker: "REBASE_HEAD", operation: "rebase" },
-  { marker: "rebase-merge", operation: "rebase" },
-  { marker: "rebase-apply", operation: "rebase" },
-  { marker: "CHERRY_PICK_HEAD", operation: "cherry-pick" },
-  { marker: "REVERT_HEAD", operation: "revert" },
-  { marker: "BISECT_LOG", operation: "bisect" },
-  // Left by a multi-commit cherry-pick or revert between steps; the two
-  // HEAD markers above name which one while a step is stopped.
-  { marker: "sequencer", operation: "cherry-pick" }
-];
-async function nearestExistingDirectory(dir) {
-  let current = path7.resolve(dir);
-  for (; ; ) {
-    const found = await stat(current).catch(() => null);
-    if (found?.isDirectory()) {
-      return current;
-    }
-    const parent = path7.dirname(current);
-    if (parent === current) {
-      return null;
-    }
-    current = parent;
+function nulPaths(stdout) {
+  return stdout.split("\0").filter((entry) => entry !== "");
+}
+var CONVERTING_ATTRIBUTES = ["filter", "ident", "working-tree-encoding"];
+var MAX_COMPARED_BYTES = 1024 * 1024;
+var CRLF = /\r\n/g;
+function nulFields(stdout) {
+  const fields = stdout.split("\0");
+  if (fields[fields.length - 1] === "") {
+    fields.pop();
+  }
+  return fields;
+}
+async function readBlobs(root, ids, deadline) {
+  const read = /* @__PURE__ */ new Map();
+  const unique = [...new Set(ids)];
+  if (unique.length === 0) {
+    return read;
+  }
+  const answer = await runGit(root, ["cat-file", "--batch"], deadline, {
+    binary: true,
+    binaryCapBytes: 16 * MAX_COMPARED_BYTES,
+    input: `${unique.join("\n")}
+`
+  });
+  if (answer.kind === "unavailable") {
+    return timedOut(answer.reason) ? "ran-out-of-time" : void 0;
   }
-}
-async function hasGitEntryAbove(dir) {
-  let current = dir;
-  for (; ; ) {
-    if (await lstat4(path7.join(current, ".git")).catch(() => null) !== null) {
-      return true;
+  if (answer.code !== 0) {
+    return void 0;
+  }
+  let at = 0;
+  for (const id of unique) {
+    const end = answer.stdout.indexOf("\n", at);
+    if (end === -1) {
+      return void 0;
     }
-    const parent = path7.dirname(current);
-    if (parent === current) {
-      return false;
+    const header = answer.stdout.slice(at, end).split(" ");
+    if (header[1] === "missing") {
+      read.set(id, null);
+      at = end + 1;
+      continue;
     }
-    current = parent;
+    const size = Number(header[2]);
+    if (header[1] !== "blob" || !Number.isInteger(size)) {
+      return void 0;
+    }
+    read.set(
+      id,
+      size > MAX_COMPARED_BYTES ? null : answer.stdout.slice(end + 1, end + 1 + size)
+    );
+    at = end + 1 + size + 1;
   }
+  return read;
 }
-async function findWorkTree(dir, deadline) {
-  const cwd = await nearestExistingDirectory(dir);
-  if (cwd === null) {
+async function restorableBytes(root, file, entry, indexed, fileMode) {
+  if (indexed === null || indexed === void 0 || entry.mode === "120000") {
+    return null;
+  }
+  const absolute = path8.join(root, file);
+  const info = await lstat4(absolute).catch(() => null);
+  if (info === null || !info.isFile() || info.size > MAX_COMPARED_BYTES) {
+    return null;
+  }
+  const executable = (info.mode & 73) !== 0;
+  if (fileMode && executable !== (entry.mode === "100755")) {
+    return null;
+  }
+  const local = await readFile3(absolute).catch(() => null);
+  if (local === null) {
+    return null;
+  }
+  const mine = local.toString("latin1");
+  if (mine.includes("\0") || indexed.includes("\0")) {
+    return null;
+  }
+  return mine.replace(CRLF, "\n") === indexed.replace(CRLF, "\n") ? local : null;
+}
+async function realBlockers(root, files, deadline) {
+  const scope = ["--literal-pathspecs", "-c", "core.quotepath=false"];
+  const [staged, unstaged, flags, stages, attributes, fileModeSetting] = await Promise.all([
+    runGit(
+      root,
+      [
+        ...scope,
+        "diff",
+        "--cached",
+        "--name-only",
+        "-z",
+        "--",
+        ...files
+      ],
+      deadline
+    ),
+    runGit(
+      root,
+      [...scope, "diff", "--name-only", "-z", "--", ...files],
+      deadline
+    ),
+    runGit(
+      root,
+      [...scope, "ls-files", "-v", "-z", "--", ...files],
+      deadline
+    ),
+    runGit(
+      root,
+      [...scope, "ls-files", "-s", "-z", "--", ...files],
+      deadline
+    ),
+    runGit(
+      root,
+      [
+        ...scope,
+        "check-attr",
+        "-z",
+        ...CONVERTING_ATTRIBUTES,
+        "--",
+        ...files
+      ],
+      deadline
+    ),
+    runGit(
+      root,
+      ["config", "--type=bool", "--get", "core.fileMode"],
+      deadline
+    )
+  ]);
+  const answers = [
+    staged,
+    unstaged,
+    flags,
+    stages,
+    attributes,
+    fileModeSetting
+  ];
+  if (answers.some((answer) => answer.kind === "unavailable")) {
+    return answers.some(
+      (answer) => answer.kind === "unavailable" && timedOut(answer.reason)
+    ) ? "ran-out-of-time" : null;
+  }
+  if (staged.kind !== "exited" || unstaged.kind !== "exited" || flags.kind !== "exited" || stages.kind !== "exited" || attributes.kind !== "exited" || fileModeSetting.kind !== "exited" || [staged, unstaged, flags, stages, attributes].some(
+    (answer) => answer.kind === "exited" && answer.code !== 0
+  )) {
+    return null;
+  }
+  const fileMode = fileModeSetting.stdout.trim() !== "false";
+  const changed = /* @__PURE__ */ new Set([
+    ...nulPaths(staged.stdout),
+    ...nulPaths(unstaged.stdout)
+  ]);
+  const ordinary = new Set(
+    nulPaths(flags.stdout).filter((entry) => entry.startsWith("H ")).map((entry) => entry.slice(2))
+  );
+  const entries = /* @__PURE__ */ new Map();
+  for (const entry of nulPaths(stages.stdout)) {
+    const match = /^(\d+) ([0-9a-f]{40,64}) (\d)\t([\s\S]*)$/.exec(entry);
+    if (match?.[3] === "0" && match[1] !== void 0 && match[2] !== void 0 && match[4] !== void 0) {
+      entries.set(match[4], { mode: match[1], blob: match[2] });
+    }
+  }
+  const converted = /* @__PURE__ */ new Set();
+  const fields = nulFields(attributes.stdout);
+  for (let at = 0; at + 2 < fields.length; at += 3) {
+    if (fields[at + 2] !== "unspecified") {
+      converted.add(fields[at]);
+    }
+  }
+  const candidates = files.filter(
+    (file) => entries.has(file) && ordinary.has(file) && !converted.has(file) && !changed.has(file)
+  );
+  const blobs = await readBlobs(
+    root,
+    candidates.map((file) => entries.get(file)?.blob ?? ""),
+    deadline
+  );
+  if (blobs === "ran-out-of-time" || blobs === void 0) {
+    return blobs === void 0 ? null : blobs;
+  }
+  const real = [];
+  const restorable = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const entry = entries.get(file);
+    const bytes = entry === void 0 || !candidates.includes(file) ? null : await restorableBytes(
+      root,
+      file,
+      entry,
+      blobs.get(entry.blob),
+      fileMode
+    );
+    if (bytes === null) {
+      real.push(file);
+    } else {
+      restorable.set(file, bytes);
+    }
+  }
+  return { real, restorable };
+}
+var RESTORE_AND_MERGE_FLOOR_MS = 1500;
+async function stillUntouched(root, restorable) {
+  for (const [file, bytes] of restorable) {
+    const now = await readFile3(path8.join(root, file)).catch(() => null);
+    if (now === null || !now.equals(bytes)) {
+      return false;
+    }
+  }
+  return true;
+}
+async function fastForwardTo(root, sha, deadline) {
+  if (!COMMIT_SHA.test(sha)) {
+    return { kind: "unavailable", reason: "not a commit name" };
+  }
+  const first = await mergeOnce(root, sha, deadline);
+  if (first.kind !== "failed" || first.reason !== "local-changes" || first.files.length === 0) {
+    return first;
+  }
+  const judged = await realBlockers(root, first.files, deadline);
+  if (judged === "ran-out-of-time") {
+    return { kind: "timed-out" };
+  }
+  if (judged === null) {
+    return first;
+  }
+  if (judged.real.length > 0) {
+    return { kind: "failed", reason: "local-changes", files: judged.real };
+  }
+  if (deadline - Date.now() < RESTORE_AND_MERGE_FLOOR_MS || !await stillUntouched(root, judged.restorable)) {
+    return first;
+  }
+  const restored = await runGit(
+    root,
+    ["--literal-pathspecs", "checkout", "--", ...first.files],
+    deadline,
+    { write: true, unattended: true }
+  );
+  if (restored.kind !== "exited" || restored.code !== 0) {
+    return first;
+  }
+  return mergeOnce(root, sha, deadline);
+}
+
+// src/lib/instructions/git.ts
+var OPERATION_MARKERS = [
+  { marker: "MERGE_HEAD", operation: "merge" },
+  { marker: "REBASE_HEAD", operation: "rebase" },
+  { marker: "rebase-merge", operation: "rebase" },
+  { marker: "rebase-apply", operation: "rebase" },
+  { marker: "CHERRY_PICK_HEAD", operation: "cherry-pick" },
+  { marker: "REVERT_HEAD", operation: "revert" },
+  { marker: "BISECT_LOG", operation: "bisect" },
+  // Left by a multi-commit cherry-pick or revert between steps; the two
+  // HEAD markers above name which one while a step is stopped.
+  { marker: "sequencer", operation: "cherry-pick" }
+];
+async function nearestExistingDirectory(dir) {
+  let current = path9.resolve(dir);
+  for (; ; ) {
+    const found = await stat(current).catch(() => null);
+    if (found?.isDirectory()) {
+      return current;
+    }
+    const parent = path9.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+async function hasGitEntryAbove(dir) {
+  let current = dir;
+  for (; ; ) {
+    if (await lstat5(path9.join(current, ".git")).catch(() => null) !== null) {
+      return true;
+    }
+    const parent = path9.dirname(current);
+    if (parent === current) {
+      return false;
+    }
+    current = parent;
+  }
+}
+async function findWorkTree(dir, deadline) {
+  const cwd = await nearestExistingDirectory(dir);
+  if (cwd === null) {
     return { kind: "absent" };
   }
   const result = await runGit(
@@ -8075,7 +8547,7 @@ async function findWorkTree(dir, deadline) {
     kind: "ok",
     value: {
       toplevel,
-      gitDir: path7.resolve(cwd, gitDir),
+      gitDir: path9.resolve(cwd, gitDir),
       shallow: shallow === "true",
       superproject: superproject ? superproject : null
     }
@@ -8174,7 +8646,7 @@ async function isAncestor(root, ancestorSha, descendantSha, deadline) {
   }
   return { kind: "unavailable", reason: "the commit is not in this clone" };
 }
-async function isClean(root, deadline) {
+async function hasNoTrackedContentChanges(root, deadline) {
   for (const scope of [[], ["--cached"]]) {
     const result = await simple(
       root,
@@ -8201,7 +8673,7 @@ async function trackedPaths(root, relativePaths, deadline) {
     return { kind: "ok", value: [] };
   }
   if (relativePaths.some(
-    (relativePath) => relativePath === "" || relativePath.startsWith("-") || path7.isAbsolute(relativePath) || path7.win32.isAbsolute(relativePath) || relativePath.split(/[\\/]/).some((part) => part === "..")
+    (relativePath) => relativePath === "" || relativePath.startsWith("-") || path9.isAbsolute(relativePath) || path9.win32.isAbsolute(relativePath) || relativePath.split(/[\\/]/).some((part) => part === "..")
   )) {
     return {
       kind: "unavailable",
@@ -8287,8 +8759,8 @@ async function operationInProgress(root, deadline) {
     return { kind: "unavailable", reason: "git answered unexpectedly" };
   }
   for (const [index, { operation }] of OPERATION_MARKERS.entries()) {
-    const marker = path7.resolve(root, paths[index]);
-    if (await lstat4(marker).catch(() => null) !== null) {
+    const marker = path9.resolve(root, paths[index]);
+    if (await lstat5(marker).catch(() => null) !== null) {
       return { kind: "ok", value: operation };
     }
   }
@@ -8378,7 +8850,7 @@ async function lockFilesPresent(root, deadline) {
     return { kind: "unavailable", reason: "git answered unexpectedly" };
   }
   for (const lock of paths) {
-    if (await lstat4(path7.resolve(root, lock)).catch(() => null) !== null) {
+    if (await lstat5(path9.resolve(root, lock)).catch(() => null) !== null) {
       return { kind: "ok", value: true };
     }
   }
@@ -8426,7 +8898,7 @@ async function commonDir(root, deadline) {
   if (result.value.code !== 0 || !dir) {
     return { kind: "unavailable", reason: "git answered unexpectedly" };
   }
-  return { kind: "ok", value: path7.resolve(root, dir) };
+  return { kind: "ok", value: path9.resolve(root, dir) };
 }
 async function excludeFilePath(root, deadline) {
   const result = await simple(
@@ -8441,7 +8913,7 @@ async function excludeFilePath(root, deadline) {
   if (result.value.code !== 0 || !answer) {
     return { kind: "unavailable", reason: "git answered unexpectedly" };
   }
-  return { kind: "ok", value: path7.resolve(root, answer) };
+  return { kind: "ok", value: path9.resolve(root, answer) };
 }
 async function isIgnored(root, relativePath, deadline) {
   if (relativePath.startsWith("-") || relativePath === "") {
@@ -8470,6 +8942,9 @@ async function isIgnored(root, relativePath, deadline) {
   };
 }
 function cloneFailureOf(stderr) {
+  if (/config-env/i.test(stderr) && /unknown option|usage:/i.test(stderr)) {
+    return "old-git";
+  }
   if (/already exists and is not an empty directory/i.test(stderr)) {
     return "not-empty";
   }
@@ -8550,6 +9025,12 @@ var TRAIT_TEXT = {
   sparse: " (sparse checkout)",
   superproject: " (inside a superproject)"
 };
+function forProject(project, otherProjects) {
+  return project !== void 0 && otherProjects === true ? ` for project ${project} (it is signed in for other projects)` : "";
+}
+function shown(value) {
+  return sanitizeDisplayText(value, 255);
+}
 var MAX_BLOCKED_FILES = 3;
 function blockedFilesText(files) {
   if (files.length === 0) {
@@ -8559,8 +9040,8 @@ function blockedFilesText(files) {
   const more = files.length - MAX_BLOCKED_FILES;
   return ` (${named}${more > 0 ? ` and ${more} more` : ""})`;
 }
-function shown(value) {
-  return sanitizeDisplayText(value, 255);
+function isUserActionableMergeFailure(reason) {
+  return reason === "diverged" || reason === "local-changes";
 }
 var LAG_TEXT = {
   refused: "a commit was refused by the secret scan \u2014 see the project's Coding Instructions tab",
@@ -8575,15 +9056,15 @@ var TOOL_LABEL = {
   codex: "Codex"
 };
 function sessionStartClause(tools, applies) {
-  const names = tools.map((tool) => TOOL_LABEL[tool]);
-  const single = names.length === 1;
+  const names2 = tools.map((tool) => TOOL_LABEL[tool]);
+  const single = names2.length === 1;
   const verb = applies ? `${single ? "applies" : "apply"} updates` : `${single ? "checks" : "check"} for updates`;
-  return `${names.join(" and ")} ${verb} at every session start.`;
+  return `${names2.join(" and ")} ${verb} at every session start.`;
 }
 function fastForwardClause(tools, ref) {
-  const names = tools.map((tool) => TOOL_LABEL[tool]);
-  const verb = names.length === 1 ? "fast-forwards" : "fast-forward";
-  return `${names.join(" and ")} ${verb} ${ref} at session start when safe.`;
+  const names2 = tools.map((tool) => TOOL_LABEL[tool]);
+  const verb = names2.length === 1 ? "fast-forwards" : "fast-forward";
+  return `${names2.join(" and ")} ${verb} ${ref} at session start when safe.`;
 }
 function loginCommand(origin, project) {
   if (!isSafeArgument(origin)) {
@@ -8594,6 +9075,22 @@ function loginCommand(origin, project) {
     origin
   );
 }
+function behindAdvice(condition, ref) {
+  switch (condition.kind) {
+    case "clean":
+      return ` \u2014 run: ${condition.pull}`;
+    case "dirty":
+      return " and has uncommitted changes \u2014 commit or stash, then pull.";
+    case "operation":
+      return `; a ${condition.operation} is in progress; nothing was changed.`;
+    case "detached":
+      return `; HEAD is detached \u2014 check out ${ref} and pull.`;
+    case "other-branch":
+      return `; you are on ${condition.branch} \u2014 pull ${ref} when you switch to it.`;
+    default:
+      return condition;
+  }
+}
 var LINES = {
   "needs-project": ({ verb }) => `This folder is not a git checkout, so its project cannot be found. Run: ${fabricCommand(`instructions ${verb} --project <id>`)}`,
   "no-remote": ({ verb }) => `This checkout has no remote, so its project cannot be found. Run: ${fabricCommand(`instructions ${verb} --project <id>`)}`,
@@ -8612,8 +9109,8 @@ var LINES = {
   "bad-project-id": () => "--project must be a project id: letters, digits, '.', '_' or '-', starting with a letter or digit, at most 64 characters.",
   "bad-org-slug": () => "--org must be an organization slug: letters, digits, '.', '_' or '-', starting with a letter or digit, at most 64 characters.",
   "bad-remote-name": () => "--remote must be the name of a git remote: letters, digits, '.', '_', '-' and '/', starting with a letter, digit, '.' or '_'.",
-  "not-signed-in": ({ origin, project }) => `Not signed in to ${origin}. Run: ${loginCommand(origin, project)}`,
-  "hook-signed-out": ({ origin, project }) => `not signed in to ${origin} \u2014 run: ${loginCommand(origin, project)}`,
+  "not-signed-in": ({ origin, project, otherProjects }) => `Not signed in to ${origin}${forProject(project, otherProjects)}. Run: ${loginCommand(origin, project)}`,
+  "hook-signed-out": ({ origin, project, otherProjects }) => `not signed in to ${origin}${forProject(project, otherProjects)} \u2014 run: ${loginCommand(origin, project)}`,
   "sign-in-failed": ({ origin, project }) => `Could not sign in to ${origin}. Run: ${loginCommand(origin, project)} to see why.`,
   "unknown-tool": ({ tool }) => `Unsupported tool "${tool}". Use --tool claude-code or --tool codex.`,
   "lessons-need-claude": () => "--lessons is not yet supported for codex; Codex hooks for lesson capture are not wired.",
@@ -8644,6 +9141,8 @@ var LINES = {
         return `Could not clone ${repo}: it has no branch ${shown(ref)}. The Fabric MCP server was not registered.`;
       case "checkout":
         return `Could not finish checking out ${repo}. Fabric did not change the partial checkout or register its MCP server. Inspect it with git status, then repair or remove it yourself before trying again.`;
+      case "old-git":
+        return `Could not clone ${repo}: this git is older than 2.31, which Fabric's repository transport needs. The Fabric MCP server was not registered. Update git and try again.`;
       case "other":
         return `Could not clone ${repo}. The Fabric MCP server was not registered. Run: git clone -- ${url} to see why.`;
       default:
@@ -8653,23 +9152,8 @@ var LINES = {
   "no-clone-url": ({ repo }) => `This deployment did not say where to clone ${repo} from. Clone it yourself, then run: ${fabricCommand("instructions init")}`,
   "lock-removed": ({ repo }) => `Removed .fabric/instructions.lock: this checkout follows ${repo} through git now.`,
   "exclude-failed": ({ entries }) => `Could not update .git/info/exclude. Add these to your own ignore rules: ${entries.map(shown).join(" ")}`,
-  behind: ({ version, sha7, ref, notFetched, traits, condition }) => {
-    const state = `${HOOK_PREFIX} v${version} (${sha7}) is on ${ref}; this checkout ${notFetched ? "has not fetched it yet" : "is behind"}${traits.map((trait) => TRAIT_TEXT[trait]).join("")}`;
-    switch (condition.kind) {
-      case "clean":
-        return `${state} \u2014 run: ${condition.pull}`;
-      case "dirty":
-        return `${state} and has uncommitted changes \u2014 commit or stash, then pull.`;
-      case "operation":
-        return `${state}; a ${condition.operation} is in progress; nothing was changed.`;
-      case "detached":
-        return `${state}; HEAD is detached \u2014 check out ${ref} and pull.`;
-      case "other-branch":
-        return `${state}; you are on ${condition.branch} \u2014 pull ${ref} when you switch to it.`;
-      default:
-        return condition;
-    }
-  },
+  behind: ({ version, sha7, ref, notFetched, traits, condition }) => `${HOOK_PREFIX} v${version} (${sha7}) is on ${ref}; this checkout ${notFetched ? "has not fetched it yet" : "is behind"}${traits.map((trait) => TRAIT_TEXT[trait]).join("")}${behindAdvice(condition, ref)}`,
+  "behind-direct": ({ repo, sha7, ref, traits, condition }) => `${HOOK_PREFIX}: read directly from ${repo} at ${sha7}; this checkout is behind${traits.map((trait) => TRAIT_TEXT[trait]).join("")}${behindAdvice(condition, ref)}`,
   "earlier-source": ({ version, sourceRef, ref, repo }) => `${HOOK_PREFIX} v${version} was published from ${sourceRef}; the project now syncs ${ref} of ${repo} \u2014 pull ${ref} to pick up the next publication`,
   "nothing-published": ({ repo }) => `${HOOK_PREFIX}: the project is repository-sourced but nothing has been published from ${repo} yet`,
   "already-current": ({ version, sha7, ref, repo }) => `${HOOK_PREFIX} v${version}${sha7 === null ? "" : ` (${sha7})`} from ${ref} of ${repo} is already in this checkout's history; nothing to sync`,
@@ -8702,16 +9186,18 @@ var LINES = {
         return `could not fetch ${repo}: it has no branch ${ref}; nothing was updated.`;
       case "timeout":
         return `could not fetch ${repo}: ${host} answered too slowly; nothing was updated.`;
+      case "old-git":
+        return `${HOOK_PREFIX}: could not fetch ${repo}: this git is older than 2.31, which Fabric's repository transport needs. Update git.`;
       case "other":
         return `could not fetch ${repo}. Run: ${commands.fetch} to see why.`;
       default:
         return reason;
     }
   },
-  "ff-merge-failed": ({ reason, files, ref, remote, commands }) => {
-    switch (reason) {
+  "ff-merge-failed": ({ failure, ref, remote, commands }) => {
+    switch (failure.reason) {
       case "local-changes":
-        return `${HOOK_PREFIX}: ${ref} is behind ${remote}/${ref}, but local changes would be overwritten${blockedFilesText(files ?? [])}, so nothing was updated. Commit or stash them, then run: ${commands.pull}`;
+        return `${HOOK_PREFIX}: ${ref} is behind ${remote}/${ref}, but local changes would be overwritten${blockedFilesText(failure.files)}, so nothing was updated. Stash them or move them to another branch; the next session start updates this checkout on its own.`;
       case "diverged":
         return `${HOOK_PREFIX}: ${ref} and ${remote}/${ref} have diverged, so nothing was updated. Run: ${commands.rebase}, or merge ${remote}/${ref} yourself.`;
       case "timeout":
@@ -8719,7 +9205,7 @@ var LINES = {
       case "other":
         return `git could not fast-forward ${ref}. Run: ${commands.pull} to see why.`;
       default:
-        return reason;
+        return failure;
     }
   },
   "ff-locked": () => `${HOOK_PREFIX}: another fabric process is updating this checkout; nothing was changed.`,
@@ -8783,6 +9269,7 @@ var EXIT_CODES = {
   "lock-removed": 0,
   "exclude-failed": 0,
   behind: 0,
+  "behind-direct": 0,
   "earlier-source": 0,
   "nothing-published": 0,
   "already-current": 0,
@@ -9056,7 +9543,7 @@ function downloadsIn(classification, manual) {
   return manual && classification.class === "foreign";
 }
 function isSafeRootPath(rootPath) {
-  if (path8.posix.isAbsolute(rootPath) || path8.win32.isAbsolute(rootPath) || rootPath.startsWith("~")) {
+  if (path10.posix.isAbsolute(rootPath) || path10.win32.isAbsolute(rootPath) || rootPath.startsWith("~")) {
     return false;
   }
   return !rootPath.split(/[\\/]/).some((segment) => segment === "..");
@@ -9120,15 +9607,15 @@ async function classify({
       reason: "the project's branch name is not one this hook will use"
     };
   }
-  const names = await remotes(root, deadline);
-  if (names.kind !== "ok") {
+  const names2 = await remotes(root, deadline);
+  if (names2.kind !== "ok") {
     return {
       class: "unknown",
-      reason: names.kind === "absent" ? "not a git checkout" : names.reason
+      reason: names2.kind === "absent" ? "not a git checkout" : names2.reason
     };
   }
   const matching = [];
-  for (const name of remote === void 0 ? names.value : names.value.filter((candidate) => candidate === remote)) {
+  for (const name of remote === void 0 ? names2.value : names2.value.filter((candidate) => candidate === remote)) {
     const url = await effectiveFetchUrl(root, name, deadline);
     if (url.kind !== "ok") {
       return {
@@ -9150,7 +9637,7 @@ async function classify({
   if (matching.length > 1) {
     return { class: "ambiguous", remotes: matching };
   }
-  const mapped = path8.join(root, repository.rootPath);
+  const mapped = path10.join(root, repository.rootPath);
   if (!await sameDirectory(destination, mapped)) {
     return {
       class: "unmapped",
@@ -9176,34 +9663,29 @@ async function inspectMatchingCheckout(input) {
   const { classification, repository, snapshot, deadline } = input;
   const root = classification.toplevel;
   const unknown = (reason) => reportFor(repository, { class: "unknown", reason });
-  const branch = await currentBranch(root, deadline);
-  if (branch.kind !== "ok") {
-    return unknown(
-      branch.kind === "absent" ? "not a git checkout" : branch.reason
-    );
-  }
-  const head = await headSha(root, deadline);
-  if (head.kind !== "ok") {
-    return unknown(
-      head.kind === "absent" ? "not a git checkout" : head.reason
-    );
-  }
-  const clean = await isClean(root, deadline);
-  if (clean.kind !== "ok") {
-    return unknown(
-      clean.kind === "absent" ? "not a git checkout" : clean.reason
-    );
+  const [branch, head, operation, readClean] = await Promise.all([
+    currentBranch(root, deadline),
+    headSha(root, deadline),
+    operationInProgress(root, deadline),
+    input.contentChanges === "always" ? hasNoTrackedContentChanges(root, deadline) : Promise.resolve(null)
+  ]);
+  for (const answer of [branch, head, operation, readClean]) {
+    if (answer === null) {
+      continue;
+    }
+    if (answer.kind !== "ok") {
+      return unknown(
+        answer.kind === "absent" ? "not a git checkout" : answer.reason
+      );
+    }
   }
-  const operation = await operationInProgress(root, deadline);
-  if (operation.kind !== "ok") {
-    return unknown(
-      operation.kind === "absent" ? "not a git checkout" : operation.reason
-    );
+  if (branch.kind !== "ok" || head.kind !== "ok" || operation.kind !== "ok") {
+    return unknown("the checkout could not be read");
   }
-  const state = {
+  let state = {
     branch: branch.value,
     head: head.value,
-    clean: clean.value,
+    clean: readClean === null ? true : readClean.kind === "ok" && readClean.value,
     operation: operation.value,
     traits: classification.traits
   };
@@ -9222,13 +9704,21 @@ async function inspectMatchingCheckout(input) {
       contains = answer.kind === "ok" ? answer.value : null;
     }
   }
-  const { kind: reportKind, line: line2 } = matchingReport({
+  const report = () => matchingReport({
     repository,
     remote: classification.remote,
     snapshot: snapshot ? { version: snapshot.version, source: snapshot.source } : null,
     state,
     contains
   });
+  let { kind: reportKind, line: line2 } = report();
+  if (readClean === null && reportKind === "behind") {
+    const content = await hasNoTrackedContentChanges(root, deadline);
+    if (content.kind === "ok") {
+      state = { ...state, clean: content.value };
+      ({ kind: reportKind, line: line2 } = report());
+    }
+  }
   return {
     classification,
     state,
@@ -9302,30 +9792,6 @@ function matchingReport(input) {
   if (contains === true) {
     return { kind: "current", line: null };
   }
-  let condition;
-  if (state.operation !== null) {
-    condition = { kind: "operation", operation: state.operation };
-  } else if (state.branch === null) {
-    condition = { kind: "detached" };
-  } else if (state.branch !== repository.ref) {
-    condition = {
-      kind: "other-branch",
-      branch: show(state.branch, MAX.ref)
-    };
-  } else if (!state.clean) {
-    condition = { kind: "dirty" };
-  } else {
-    condition = {
-      kind: "clean",
-      pull: [
-        "git",
-        "pull",
-        "--ff-only",
-        shellQuote(show(remote, MAX.remote)),
-        shellQuote(ref)
-      ].join(" ")
-    };
-  }
   return {
     kind: "behind",
     line: outcomeLine("behind", {
@@ -9334,10 +9800,43 @@ function matchingReport(input) {
       ref,
       notFetched: contains !== false,
       traits: traitNames(state.traits),
-      condition
+      condition: behindCondition(state, repository.ref, remote)
     })
   };
 }
+function behindCondition(state, branchRef, remote) {
+  if (state.operation !== null) {
+    return { kind: "operation", operation: state.operation };
+  }
+  if (state.branch === null) {
+    return { kind: "detached" };
+  }
+  if (state.branch !== branchRef) {
+    return { kind: "other-branch", branch: show(state.branch, MAX.ref) };
+  }
+  if (!state.clean) {
+    return { kind: "dirty" };
+  }
+  return {
+    kind: "clean",
+    pull: [
+      "git",
+      "pull",
+      "--ff-only",
+      shellQuote(show(remote, MAX.remote)),
+      shellQuote(show(branchRef, MAX.ref))
+    ].join(" ")
+  };
+}
+function directBehindLine(input) {
+  return outcomeLine("behind-direct", {
+    repo: repositoryName(input.repository),
+    sha7: show(input.commitSha.slice(0, 7), 7),
+    ref: show(input.ref, MAX.ref),
+    traits: traitNames(input.state.traits),
+    condition: behindCondition(input.state, input.ref, input.remote)
+  });
+}
 function classLine(classification, repository) {
   const name = repository ? repositoryName(repository) : "its repository";
   switch (classification.class) {
@@ -9371,7 +9870,11 @@ function classLine(classification, repository) {
 }
 async function inspectCheckout(input) {
   const classification = await classifyCheckout(input);
-  return reportForClassification({ ...input, classification });
+  return reportForClassification({
+    contentChanges: "always",
+    ...input,
+    classification
+  });
 }
 async function reportForClassification(input) {
   const { classification, repository } = input;
@@ -9384,6 +9887,7 @@ async function reportForClassification(input) {
   try {
     return await inspectMatchingCheckout({
       ...input,
+      contentChanges: input.contentChanges ?? "always",
       classification,
       repository
     });
@@ -9436,7 +9940,7 @@ function providerLoginCommand(provider, gitCommand) {
   }
 }
 function folderForCommand(dest, relative) {
-  const inside = relative.split(path9.sep).join("/") || ".";
+  const inside = relative.split(path11.sep).join("/") || ".";
   const typed = dest?.replace(/\\/g, "/").replace(/\/+$/, "");
   return shellQuote(
     typed === void 0 || typed === "" ? inside : inside === "." ? typed : `${typed}/${inside}`
@@ -9478,9 +9982,9 @@ function adoptionFor(input) {
           repo,
           where: folderForCommand(
             input.rerun.dest,
-            path9.relative(
+            path11.relative(
               input.destination,
-              path9.join(
+              path11.join(
                 classification.toplevel,
                 classification.rootPath
               )
@@ -9512,8 +10016,9 @@ function adoptionFor(input) {
 }
 
 // src/lib/instructions/agent-mcp-config.ts
-import { readFile as readFile3, stat as stat2 } from "fs/promises";
-import path10 from "path";
+import { readFile as readFile4, stat as stat2 } from "fs/promises";
+import path12 from "path";
+var LEGACY_SERVER_NAME = "fabric";
 var MAX_CONFIG_BYTES = 16 * 1024 * 1024;
 async function readText(file) {
   try {
@@ -9521,7 +10026,7 @@ async function readText(file) {
     if (!info.isFile() || info.size > MAX_CONFIG_BYTES) {
       return { kind: "unusable" };
     }
-    return { kind: "text", text: await readFile3(file, "utf8") };
+    return { kind: "text", text: await readFile4(file, "utf8") };
   } catch (error) {
     return error.code === "ENOENT" ? { kind: "absent" } : { kind: "unusable" };
   }
@@ -9533,13 +10038,17 @@ function projectKey(folder, platform) {
   const slashed = folder.replace(/\\/g, "/").replace(/\/+$/, "");
   return platform === "win32" ? slashed.toLowerCase() : slashed;
 }
-function serverIn(servers, name) {
-  const server = field(servers, name);
-  if (typeof server !== "object" || server === null) {
-    return void 0;
+function serversIn(servers) {
+  if (typeof servers !== "object" || servers === null) {
+    return [];
   }
-  const url = field(server, "url");
-  return { url: typeof url === "string" ? url : null };
+  return Object.entries(servers).flatMap(([name, server]) => {
+    if (typeof server !== "object" || server === null) {
+      return [];
+    }
+    const url = field(server, "url");
+    return [{ name, url: typeof url === "string" ? url : null }];
+  });
 }
 async function readClaudeServers(input) {
   const directory = input.env.CLAUDE_CONFIG_DIR ?? input.home;
@@ -9547,7 +10056,7 @@ async function readClaudeServers(input) {
     return { state: "unlocated" };
   }
   const servers = [];
-  const config2 = await readText(path10.join(directory, ".claude.json"));
+  const config2 = await readText(path12.join(directory, ".claude.json"));
   if (config2.kind === "unusable") {
     return { state: "unreadable" };
   }
@@ -9563,29 +10072,24 @@ async function readClaudeServers(input) {
     if (typeof projects === "object" && projects !== null) {
       for (const [key, project] of Object.entries(projects)) {
         if (projectKey(key, input.platform) === wanted) {
-          const found2 = serverIn(
-            field(project, "mcpServers"),
-            input.name
-          );
-          if (found2 !== void 0) {
-            servers.push({ scope: "local", ...found2 });
+          for (const found of serversIn(
+            field(project, "mcpServers")
+          )) {
+            servers.push({ scope: "local", ...found });
           }
         }
       }
     }
-    const found = serverIn(field(parsed, "mcpServers"), input.name);
-    if (found !== void 0) {
+    for (const found of serversIn(field(parsed, "mcpServers"))) {
       servers.push({ scope: "user", ...found });
     }
   }
-  const shared = await readText(path10.join(input.cwd, ".mcp.json"));
+  const shared = await readText(path12.join(input.cwd, ".mcp.json"));
   if (shared.kind === "text") {
     try {
-      const found = serverIn(
-        field(JSON.parse(shared.text), "mcpServers"),
-        input.name
-      );
-      if (found !== void 0) {
+      for (const found of serversIn(
+        field(JSON.parse(shared.text), "mcpServers")
+      )) {
         servers.push({ scope: "project", ...found });
       }
     } catch {
@@ -9599,11 +10103,11 @@ var CODEX_SERVER_SUBTABLE = /^\[mcp_servers\.(?:"[^"]+"|'[^']+'|[A-Za-z0-9_-]+)\
 var CODEX_OTHER_HEADER = /^\[{1,2}\s*mcp_servers\b/;
 var CODEX_OTHER_KEY = /^mcp_servers\b/;
 async function readCodexServers(input) {
-  const directory = input.env.CODEX_HOME ?? (input.home === null ? void 0 : path10.join(input.home, ".codex"));
+  const directory = input.env.CODEX_HOME ?? (input.home === null ? void 0 : path12.join(input.home, ".codex"));
   if (directory === void 0) {
     return { state: "unlocated" };
   }
-  const config2 = await readText(path10.join(directory, "config.toml"));
+  const config2 = await readText(path12.join(directory, "config.toml"));
   if (config2.kind === "absent") {
     return { state: "read", servers: [] };
   }
@@ -9639,32 +10143,122 @@ async function readCodexServers(input) {
     servers: [...servers].map(([name, url]) => ({ name, url }))
   };
 }
-async function readRegistration(input) {
-  if (input.tool === "codex") {
-    const read2 = await readCodexServers(input);
-    if (read2.state !== "read") {
-      return read2.state === "unlocated" ? "missing" : "unreadable";
-    }
-    if (read2.servers.some((server) => server.url === input.url)) {
-      return "registered";
+
+// src/lib/instructions/agent-mcp-servers.ts
+var MAX_PROBES = 4;
+var SCOPE_PRECEDENCE = ["local", "project", "user"];
+var PLAIN_NAME = /^[A-Za-z0-9_-]{1,64}$/;
+function shownName(name) {
+  return PLAIN_NAME.test(name) ? name : "(a name with unusual characters)";
+}
+function describeTarget(url) {
+  if (url === null) {
+    return "a local command";
+  }
+  try {
+    const { host } = new URL(url);
+    return host !== "" && isSafeArgument(host) ? host : "another address";
+  } catch {
+    return "another address";
+  }
+}
+function effectiveFlags(servers) {
+  const winners = /* @__PURE__ */ new Map();
+  for (const server of servers) {
+    const current = winners.get(server.name);
+    if (server.scope !== null && (current === void 0 || SCOPE_PRECEDENCE.indexOf(server.scope) < SCOPE_PRECEDENCE.indexOf(current))) {
+      winners.set(server.name, server.scope);
     }
-    return read2.servers.some((server) => server.name === input.name) ? "elsewhere" : "missing";
   }
-  const read = await readClaudeServers(input);
-  if (read.state !== "read") {
-    return read.state === "unlocated" ? "missing" : "unreadable";
+  return servers.map(
+    (server) => server.scope === null || winners.get(server.name) === server.scope
+  );
+}
+async function classifyServers(servers, context) {
+  const flags = effectiveFlags(servers);
+  const probed = /* @__PURE__ */ new Map();
+  const classified = [];
+  for (const [index, server] of servers.entries()) {
+    const points = describeTarget(server.url);
+    const effective = flags[index] === true;
+    const base = {
+      name: server.name,
+      scope: server.scope,
+      points,
+      effective
+    };
+    if (server.url === null) {
+      classified.push({ ...base, kind: "command" });
+      continue;
+    }
+    const relation = classifyGatewayUrl(
+      context.origin,
+      context.projectId,
+      server.url
+    );
+    if (relation !== "unfamiliar") {
+      classified.push({ ...base, kind: relation });
+      continue;
+    }
+    const url = server.url;
+    let answer = probed.get(url);
+    if (answer === void 0) {
+      answer = context.probe === void 0 || probed.size >= MAX_PROBES ? Promise.resolve("unknown") : context.probe(url).catch(() => "unknown");
+      probed.set(url, answer);
+    }
+    classified.push({ ...base, kind: await answer });
   }
-  if (read.servers.some((server) => server.url === input.url)) {
-    return "registered";
+  return classified;
+}
+async function inspectServers(input) {
+  if (input.tool === "codex") {
+    const read2 = await readCodexServers(input);
+    return read2.state === "read" ? {
+      state: "read",
+      servers: await classifyServers(
+        read2.servers.map((server) => ({
+          ...server,
+          scope: null
+        })),
+        input
+      )
+    } : { state: read2.state };
   }
-  return read.servers.length > 0 ? "elsewhere" : "missing";
+  const read = await readClaudeServers(input);
+  return read.state === "read" ? { state: "read", servers: await classifyServers(read.servers, input) } : { state: read.state };
+}
+function names(servers) {
+  return [...new Set(servers.map((server) => server.name))];
+}
+function projectServersOf(servers) {
+  return servers.filter(
+    (server) => server.effective && server.kind === "this-project"
+  );
+}
+function orgWideServersOf(servers) {
+  return servers.filter(
+    (server) => server.effective && server.kind === "org-wide"
+  );
+}
+function registrationOf(servers, name) {
+  const here = names(projectServersOf(servers));
+  const sameName2 = servers.filter((server) => server.name === name);
+  const state = here.length === 0 ? sameName2.length > 0 ? "elsewhere" : "missing" : !here.includes(name) && here.every((n) => n === LEGACY_SERVER_NAME) ? "legacy" : "registered";
+  return {
+    state,
+    projectServers: here.map(shownName),
+    orgWide: names(orgWideServersOf(servers)).map(shownName),
+    foreignSameName: sameName2.some(
+      (server) => server.effective && (server.kind === "foreign" || server.kind === "command" || server.kind === "unknown")
+    )
+  };
 }
 
 // src/lib/instructions/hook.ts
 import { createHash as createHash4 } from "crypto";
 import { mkdir as mkdir3 } from "fs/promises";
 import { tmpdir } from "os";
-import path11 from "path";
+import path13 from "path";
 
 // src/lib/instructions/identifiers.ts
 var IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
@@ -9673,11 +10267,11 @@ function isIdentifier(value) {
 }
 
 // src/lib/instructions/hook.ts
-var CLAUDE_SETTINGS_RELATIVE_PATH = path11.join(
+var CLAUDE_SETTINGS_RELATIVE_PATH = path13.join(
   ".claude",
   "settings.local.json"
 );
-var CODEX_HOOKS_RELATIVE_PATH = path11.join(".codex", "hooks.json");
+var CODEX_HOOKS_RELATIVE_PATH = path13.join(".codex", "hooks.json");
 var CLAUDE_SETTINGS_POSIX_PATH = ".claude/settings.local.json";
 var CODEX_HOOKS_POSIX_PATH = ".codex/hooks.json";
 var HOOK_TIMEOUT_SECONDS = 15;
@@ -9694,10 +10288,10 @@ function subcommandsForEvent(event) {
   return event === "Stop" ? STOP_SUBCOMMANDS : SESSION_START_SUBCOMMANDS;
 }
 async function withHookConfigLock(root, posixPath, work) {
-  const directory = path11.join(tmpdir(), "fabric-instructions-hook-locks");
+  const directory = path13.join(tmpdir(), "fabric-instructions-hook-locks");
   await mkdir3(directory, { recursive: true });
-  const identity = createHash4("sha256").update(path11.resolve(root)).update("\0").update(posixPath).digest("hex");
-  const lockPath2 = path11.join(directory, `${identity}.lock`);
+  const identity = createHash4("sha256").update(path13.resolve(root)).update("\0").update(posixPath).digest("hex");
+  const lockPath2 = path13.join(directory, `${identity}.lock`);
   try {
     return await withExclusiveLock(work, {
       lockPath: lockPath2,
@@ -9752,7 +10346,7 @@ async function assertKeyStaysOutside(destination, configPath) {
   }
 }
 async function readHookConfig(root, hookTarget) {
-  const settingsPath = path11.join(root, hookTarget.relativePath);
+  const settingsPath = path13.join(root, hookTarget.relativePath);
   let existingRaw;
   try {
     const existing = await readFileSafely(root, hookTarget.posixPath, {
@@ -9831,7 +10425,7 @@ function pruneMatching(groups, projectId, subcommands) {
 async function mergeCommandHook(input) {
   const hookTarget = hookTargetFor(input.tool ?? "claude-code");
   return withHookConfigLock(input.root, hookTarget.posixPath, async () => {
-    const settingsPath = path11.join(input.root, hookTarget.relativePath);
+    const settingsPath = path13.join(input.root, hookTarget.relativePath);
     const { settings, existingRaw } = await readHookConfig(
       input.root,
       hookTarget
@@ -9878,7 +10472,7 @@ async function mergeSessionStartHook(input) {
 async function removeCommandHook(input) {
   const hookTarget = hookTargetFor(input.tool ?? "claude-code");
   return withHookConfigLock(input.root, hookTarget.posixPath, async () => {
-    const settingsPath = path11.join(input.root, hookTarget.relativePath);
+    const settingsPath = path13.join(input.root, hookTarget.relativePath);
     const { settings, existingRaw } = await readHookConfig(
       input.root,
       hookTarget
@@ -10072,9 +10666,9 @@ function isRecord2(value) {
 }
 
 // src/lib/instructions/agent-mcp.ts
-var CLAUDE_SERVER_NAME = "fabric";
 var WRITE_TIMEOUT_MS = 2e4;
 var LOGIN_TIMEOUT_MS2 = 5 * 6e4;
+var STATUS_TIMEOUT_MS = 5e3;
 var TOOL_LABEL2 = {
   "claude-code": "Claude Code",
   codex: "Codex"
@@ -10083,11 +10677,23 @@ var TOOL_COMMAND = {
   "claude-code": "claude",
   codex: "codex"
 };
+function isRegistered(result) {
+  return result.outcome.kind === "registered" || result.outcome.kind === "replaced" || result.outcome.kind === "already";
+}
 function mcpRegistrationComplete(results) {
-  return results.every(
-    (result) => result.outcome.kind === "registered" || result.outcome.kind === "replaced" || result.outcome.kind === "already"
+  return results.every(isRegistered);
+}
+function mcpSetupFailed(results) {
+  return results.some(
+    (result) => !isRegistered(result) && result.outcome.kind !== "manual"
   );
 }
+function mcpManualSteps(results) {
+  return results.filter((result) => result.outcome.kind === "manual").map((result) => ({
+    tool: result.tool,
+    registerLine: result.registerLine
+  }));
+}
 function mcpAuthenticationPending(results) {
   return results.some(
     (result) => result.login === "printed" || result.login === "not-finished"
@@ -10098,12 +10704,8 @@ function codexServerName(projectId) {
   const suffix = projectId.toLowerCase().replace(/[^a-z0-9]+/g, "").slice(-SERVER_ID_SUFFIX_LENGTH);
   return `fabric-${suffix === "" ? projectId : suffix}`;
 }
-function serverNameFor(tool, projectId) {
-  return tool === "codex" ? codexServerName(projectId) : CLAUDE_SERVER_NAME;
-}
-var PLAIN_NAME = /^[A-Za-z0-9_-]{1,64}$/;
-function shownName(name) {
-  return PLAIN_NAME.test(name) ? name : "(a name with unusual characters)";
+function serverNameFor(projectId) {
+  return codexServerName(projectId);
 }
 function registerArguments(tool, name, url) {
   return tool === "codex" ? ["mcp", "add", name, "--url", url] : ["mcp", "add", "--scope", "local", "--transport", "http", name, url];
@@ -10129,19 +10731,26 @@ async function agentRegistrationFacts(input) {
     if (hooks.state !== "ok" || hooks.commands.length === 0) {
       continue;
     }
-    const name = serverNameFor(tool, input.projectId);
+    const name = serverNameFor(input.projectId);
+    const inspected = await inspectServers({
+      tool,
+      origin: input.origin,
+      projectId: input.projectId,
+      probe: input.probe,
+      cwd: input.cwd,
+      home: input.home,
+      env: input.env,
+      platform: input.platform
+    });
     facts.push({
       tool,
       name,
-      state: await readRegistration({
-        tool,
-        name,
-        url,
-        cwd: input.cwd,
-        home: input.home,
-        env: input.env,
-        platform: input.platform
-      }),
+      ...inspected.state === "read" ? registrationOf(inspected.servers, name) : {
+        state: inspected.state === "unlocated" ? "missing" : "unreadable",
+        projectServers: [],
+        orgWide: [],
+        foreignSameName: false
+      },
       registerLine: lineOf(
         TOOL_COMMAND[tool],
         registerArguments(tool, name, url)
@@ -10153,36 +10762,65 @@ async function agentRegistrationFacts(input) {
 function succeeded(run3) {
   return run3.kind === "exited" && run3.code === 0;
 }
-function isOurs(origin, url) {
-  return url !== null && isGatewayUrlOf(origin, url);
+function sameServerUrl(left, right) {
+  if (left === null) {
+    return false;
+  }
+  const normal = normalizeServerUrl(left);
+  return normal === null ? left === right : normal === normalizeServerUrl(right);
+}
+function surroundingsOf(servers) {
+  const orgWide = orgWideServersOf(servers)[0];
+  const unverified = servers.filter((server) => server.effective && server.kind === "unknown").map((server) => ({
+    name: shownName(server.name),
+    points: server.points
+  }));
+  return {
+    ...orgWide === void 0 ? {} : { orgWide: shownName(orgWide.name) },
+    unverified
+  };
+}
+function foundUnder(here, name) {
+  return (here.find((server) => server.name === name) ?? here.find((server) => server.name === LEGACY_SERVER_NAME) ?? here[0])?.name;
 }
 async function registerWithClaude(run3, context) {
-  const name = CLAUDE_SERVER_NAME;
-  const read = await readClaudeServers({
-    name,
+  const name = serverNameFor(context.projectId);
+  const inspected = await inspectServers({
+    tool: "claude-code",
+    origin: context.origin,
+    projectId: context.projectId,
+    probe: context.probe,
     cwd: context.cwd,
     home: context.home,
     env: context.env,
     platform: context.platform
   });
-  if (read.state !== "read") {
+  if (inspected.state !== "read") {
     return { outcome: { kind: "failed" }, name };
   }
-  const existing = read.servers;
-  if (existing.some((server) => server.url === context.url)) {
-    return { outcome: { kind: "already" }, name };
+  const servers = inspected.servers;
+  const around = surroundingsOf(servers);
+  const alreadyAs = foundUnder(projectServersOf(servers), name);
+  if (alreadyAs !== void 0) {
+    return { outcome: { kind: "already" }, name: alreadyAs, ...around };
   }
-  if (existing.some((server) => !isOurs(context.origin, server.url))) {
-    return { outcome: { kind: "left", reason: "foreign" }, name };
+  const local = servers.find(
+    (server) => server.scope === "local" && server.name === name
+  );
+  if (local !== void 0 && local.kind !== "other-project") {
+    return {
+      outcome: { kind: "left", scope: "local", points: local.points },
+      name,
+      ...around
+    };
   }
-  const replacing = existing.length > 0;
-  if (replacing) {
-    if (!existing.some((server) => server.scope === "local")) {
-      return { outcome: { kind: "left", reason: "other-scope" }, name };
-    }
+  const stale = servers.filter(
+    (server) => server.scope === "local" && server.kind === "other-project" && (server.name === name || server.name === LEGACY_SERVER_NAME)
+  ).map((server) => server.name);
+  for (const staleName of stale) {
     const removed = await run3(
       "claude",
-      ["mcp", "remove", name, "--scope", "local"],
+      ["mcp", "remove", staleName, "--scope", "local"],
       { cwd: context.cwd, timeoutMs: WRITE_TIMEOUT_MS }
     );
     if (removed.kind === "missing") {
@@ -10200,33 +10838,45 @@ async function registerWithClaude(run3, context) {
   if (added.kind === "missing") {
     return { outcome: { kind: "skipped" }, name };
   }
-  return {
-    outcome: succeeded(added) ? { kind: replacing ? "replaced" : "registered" } : { kind: "failed" },
-    name
-  };
+  return succeeded(added) ? {
+    outcome: { kind: stale.length > 0 ? "replaced" : "registered" },
+    name,
+    ...around,
+    shadowed: servers.flatMap(
+      (server) => server.name === name && (server.scope === "user" || server.scope === "project") ? [{ scope: server.scope, points: server.points }] : []
+    )
+  } : { outcome: { kind: "failed" }, name };
 }
 async function registerWithCodex(run3, context, interactive) {
-  const read = await readCodexServers({
+  const inspected = await inspectServers({
+    tool: "codex",
+    origin: context.origin,
+    projectId: context.projectId,
+    probe: context.probe,
+    cwd: context.cwd,
     home: context.home,
-    env: context.env
+    env: context.env,
+    platform: context.platform
   });
-  if (read.state !== "read") {
+  if (inspected.state !== "read") {
     return { outcome: { kind: "failed" }, name: context.name };
   }
-  const servers = read.servers;
-  const sameUrl = servers.find((server) => server.url === context.url);
-  if (sameUrl !== void 0) {
-    return { outcome: { kind: "already" }, name: sameUrl.name };
+  const servers = inspected.servers;
+  const around = surroundingsOf(servers);
+  const alreadyAs = foundUnder(projectServersOf(servers), context.name);
+  if (alreadyAs !== void 0) {
+    return { outcome: { kind: "already" }, name: alreadyAs, ...around };
   }
   const sameName2 = servers.find((server) => server.name === context.name);
-  if (sameName2 !== void 0 && !isOurs(context.origin, sameName2.url)) {
+  if (sameName2 !== void 0 && sameName2.kind !== "other-project") {
     return {
-      outcome: { kind: "left", reason: "foreign" },
-      name: context.name
+      outcome: { kind: "left", scope: null, points: sameName2.points },
+      name: context.name,
+      ...around
     };
   }
   if (!interactive) {
-    return { outcome: { kind: "manual" }, name: context.name };
+    return { outcome: { kind: "manual" }, name: context.name, ...around };
   }
   const written = sameName2 === void 0 ? "registered" : "replaced";
   const added = await run3(
@@ -10241,7 +10891,8 @@ async function registerWithCodex(run3, context, interactive) {
     return {
       outcome: { kind: written },
       name: context.name,
-      login: "completed"
+      login: "completed",
+      ...around
     };
   }
   const after = await readCodexServers({
@@ -10249,27 +10900,30 @@ async function registerWithCodex(run3, context, interactive) {
     env: context.env
   });
   const registered = after.state === "read" && after.servers.some(
-    (server) => server.name === context.name && server.url === context.url
+    (server) => server.name === context.name && sameServerUrl(server.url, context.url)
   );
   return registered ? {
     outcome: { kind: written },
     name: context.name,
-    login: "not-finished"
+    login: "not-finished",
+    ...around
   } : { outcome: { kind: "failed" }, name: context.name };
 }
 async function registerAgentMcp(input) {
   const url = projectResource(input.origin, "mcp", input.projectId);
   const where = {
+    projectId: input.projectId,
     cwd: input.cwd,
     origin: input.origin,
     url,
     home: input.home,
     env: input.env,
-    platform: input.platform
+    platform: input.platform,
+    probe: input.probe
   };
   const results = [];
   for (const tool of input.tools) {
-    const intendedName = serverNameFor(tool, input.projectId);
+    const intendedName = serverNameFor(input.projectId);
     const command = TOOL_COMMAND[tool];
     const registration = tool === "codex" ? await registerWithCodex(
       input.run,
@@ -10283,6 +10937,11 @@ async function registerAgentMcp(input) {
       expectedName: intendedName,
       url,
       outcome: registration.outcome,
+      shadowed: registration.shadowed ?? [],
+      orgWide: registration.orgWide ?? null,
+      unverified: registration.unverified ?? [],
+      status: "unchecked",
+      host: describeTarget(url),
       login: registration.login ?? (registration.outcome.kind === "already" && loginLine !== null ? "hint" : "unneeded"),
       registerLine: lineOf(
         command,
@@ -10291,6 +10950,25 @@ async function registerAgentMcp(input) {
       loginLine
     });
   }
+  for (const result of results) {
+    if (!isRegistered(result)) {
+      continue;
+    }
+    if (result.tool === "codex") {
+      result.status = "unavailable";
+    } else if (input.checkSignIn !== false) {
+      result.status = await claudeStatus(
+        input.run,
+        result.name,
+        input.cwd
+      );
+    }
+    if (result.status === "connected") {
+      result.login = "signed-in";
+    } else if (result.status === "needs-sign-in" && result.outcome.kind === "already" && result.loginLine !== null) {
+      result.login = "printed";
+    }
+  }
   for (const result of results) {
     if (result.login !== "unneeded" || result.outcome.kind !== "registered" && result.outcome.kind !== "replaced") {
       continue;
@@ -10312,6 +10990,24 @@ async function registerAgentMcp(input) {
   }
   return results;
 }
+var STATUS_LINE = /^\s*Status:\s*(?:[^\sA-Za-z0-9]+\s+)?(.+?)\s*$/m;
+async function claudeStatus(run3, name, cwd) {
+  const answer = await run3("claude", ["mcp", "get", name], {
+    cwd,
+    timeoutMs: STATUS_TIMEOUT_MS
+  });
+  if (answer.kind !== "exited" || answer.code !== 0) {
+    return "unavailable";
+  }
+  const status = STATUS_LINE.exec(answer.stdout)?.[1]?.toLowerCase() ?? "";
+  if (status === "connected") {
+    return "connected";
+  }
+  if (status === "needs authentication") {
+    return "needs-sign-in";
+  }
+  return /^(?:failed|disconnected|not connected|error)\b/.test(status) ? "unreachable" : "unavailable";
+}
 function agentMcpLines(results) {
   const lines2 = [];
   for (const result of results) {
@@ -10335,7 +11031,7 @@ function agentMcpLines(results) {
         break;
       case "left":
         lines2.push(
-          outcome.reason === "foreign" ? `${label} already has a server named "${result.name}" that is not a Fabric gateway, so it was left alone. Remove it, then ${byHand(result.registerLine)}` : `${label} has a "${result.name}" server in another scope that points at a different Fabric gateway, so it was left alone. Remove it with: ${TOOL_COMMAND[result.tool]} mcp remove ${result.name}, then ${byHand(result.registerLine)}`
+          `${label} already has a server named "${result.name}" ${outcome.scope === "local" ? "in this checkout's local settings" : "in its settings"} that points at ${outcome.points}, not at this project's gateway, so it was left alone. Remove it, then ${byHand(result.registerLine)}`
         );
         break;
       case "skipped":
@@ -10358,6 +11054,21 @@ function agentMcpLines(results) {
         return unreachable;
       }
     }
+    if (result.orgWide !== null && isRegistered(result)) {
+      lines2.push(
+        `Your organization-wide Fabric server "${result.orgWide}" stays as it is; coding instructions use the project server "${result.name}".`
+      );
+    }
+    for (const server of result.unverified) {
+      lines2.push(
+        `${label} has a server "${server.name}" at ${server.points} that could not be told apart from Fabric's, so it was left as it is.`
+      );
+    }
+    for (const server of result.shadowed) {
+      lines2.push(
+        `${label} also has a "${result.name}" server in your ${server.scope} settings (${server.points}); in this checkout the project's gateway takes precedence.`
+      );
+    }
     if (result.login === "printed") {
       lines2.push(
         result.loginLine === null ? `To finish, sign ${label} in to the server with its own mcp login command.` : `To finish, sign ${label} in to it: ${result.loginLine}`
@@ -10376,14 +11087,42 @@ function agentMcpLines(results) {
   }
   return lines2;
 }
+function agentMcpSummaryLines(results) {
+  return results.map((result) => {
+    const label = TOOL_LABEL2[result.tool];
+    const outcome = result.outcome;
+    if (!isRegistered(result)) {
+      return outcome.kind === "manual" ? `${label}: not registered yet, see above.` : `${label}: nothing usable for this project, see above.`;
+    }
+    const server = `"${result.name}"`;
+    if (result.login === "completed" || result.login === "signed-in") {
+      return `${label}: ${server} connected.`;
+    }
+    switch (result.status) {
+      case "connected":
+        return `${label}: ${server} connected.`;
+      case "needs-sign-in":
+        return `${label}: ${server} registered, needs sign-in.`;
+      case "unreachable":
+        return `${label}: ${server} registered, unreachable (${result.host}).`;
+      case "unavailable":
+        return result.tool === "codex" ? `${label}: ${server} registered; sign-in status not available for Codex.` : `${label}: ${server} registered; its status could not be read.`;
+      case "unchecked":
+        return `${label}: ${server} registered.`;
+      default: {
+        const unreachable = result.status;
+        return unreachable;
+      }
+    }
+  });
+}
 
 // src/lib/instructions/agent-run.ts
 import { spawn as spawn3 } from "child_process";
-import path13 from "path";
 
 // src/lib/instructions/path-lookup.ts
 import { stat as stat3 } from "fs/promises";
-import path12 from "path";
+import path14 from "path";
 var MAX_PATH_ENTRIES = 256;
 var MAX_PATHEXT_ENTRIES = 32;
 var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
@@ -10397,7 +11136,7 @@ function readVariable(lookup, name) {
   return key === void 0 ? void 0 : lookup.env[key];
 }
 function pathApi(platform) {
-  return platform === "win32" ? path12.win32 : path12.posix;
+  return platform === "win32" ? path14.win32 : path14.posix;
 }
 function searchDirectories(lookup) {
   const api = pathApi(lookup.platform);
@@ -10489,10 +11228,6 @@ function launch(file, args, platform, env2) {
   }
   return { file, args: [...args], verbatim: false };
 }
-function taskkillPath(env2 = process.env) {
-  const root = env2.SystemRoot ?? env2.SYSTEMROOT ?? env2.windir ?? "C:\\Windows";
-  return path13.win32.join(root, "System32", "taskkill.exe");
-}
 function stop(child, signal) {
   if (process.platform === "win32" && child.pid !== void 0) {
     try {
@@ -10597,8 +11332,8 @@ import { createHash as createHash5 } from "crypto";
 import { chmod } from "fs/promises";
 
 // src/lib/instructions/lock.ts
-import { readFile as readFile4 } from "fs/promises";
-import path14 from "path";
+import { readFile as readFile5 } from "fs/promises";
+import path15 from "path";
 var LOCK_DIRECTORY = ".fabric";
 var LOCK_FILENAME = "instructions.lock";
 var LOCK_VERSION = 3;
@@ -10606,13 +11341,13 @@ var READABLE_LOCK_VERSIONS = [1, 2, LOCK_VERSION];
 var LOCK_RELATIVE_PATH = `${LOCK_DIRECTORY}/${LOCK_FILENAME}`;
 var SHA256_HEX2 = /^[0-9a-f]{64}$/;
 function lockPath(destination) {
-  return path14.join(destination, LOCK_DIRECTORY, LOCK_FILENAME);
+  return path15.join(destination, LOCK_DIRECTORY, LOCK_FILENAME);
 }
 async function readLock(destination) {
   const file = lockPath(destination);
   let raw;
   try {
-    raw = await readFile4(file, "utf8");
+    raw = await readFile5(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return null;
@@ -11214,11 +11949,11 @@ function extractBundle(archive, wanted) {
 }
 
 // src/lib/instructions/clone-target.ts
-import { lstat as lstat5 } from "fs/promises";
-import path15 from "path";
+import { lstat as lstat6 } from "fs/promises";
+import path16 from "path";
 async function resolveCloneFolder(base, folder) {
-  const target = path15.resolve(base, folder);
-  const stats = await lstat5(target).catch((error) => {
+  const target = path16.resolve(base, folder);
+  const stats = await lstat6(target).catch((error) => {
     if (error.code === "ENOENT") {
       return null;
     }
@@ -11236,7 +11971,7 @@ async function resolveCloneFolder(base, folder) {
 // src/lib/instructions/doctor.ts
 import { createHash as createHash9 } from "crypto";
 import { stat as stat4 } from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 
 // src/lib/instructions/file-downloads.ts
 import { createHash as createHash6 } from "crypto";
@@ -11583,11 +12318,11 @@ function isTooLarge(error) {
 import { createHash as createHash8 } from "crypto";
 import { mkdtemp, realpath as realpath3, rm } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import path16 from "path";
+import path17 from "path";
 var IN_MEMORY_SNAPSHOT_BYTES = 50 * 1024 * 1024;
 async function stageFilesByUrl(options) {
   const root = await realpath3(
-    await mkdtemp(path16.join(tmpdir2(), "fabric-instructions-"))
+    await mkdtemp(path17.join(tmpdir2(), "fabric-instructions-"))
   );
   const files = /* @__PURE__ */ new Map();
   const dispose = () => rm(root, { recursive: true, force: true });
@@ -11633,11 +12368,12 @@ var MAX_LOCK_BYTES = 16 * 1024 * 1024;
 var MAX_DOWNLOAD_BYTES = 52428800 + 1048576 + 5e3 * (512 + 2 * 1024);
 var PROBE_TIMEOUT_MS = 5e3;
 var PROBE_BUDGET_MS = 15e3;
-var MAX_PROBES = 20;
+var MAX_PROBES2 = 20;
 var PROBE_CONCURRENCY = 4;
 var CLI_INSTALL_COMMAND = "npm install -g @fabricorg/cli";
 var GIT_BUDGET_MS = 1e4;
 var LOCK_NOT_USED = "not used in a checkout of the repository";
+var LOCK_NOT_USED_DIRECT = "not used: this project reads its repository directly, so Fabric keeps no copy here";
 var LOCK_NOT_HERE = "not used here: this folder is not a checkout of the project's repository";
 var SKIP_AFTER_AUTH = "not evaluated: the API key check failed";
 var SKIP_AFTER_ACCESS = "not evaluated: the project could not be read";
@@ -11755,9 +12491,9 @@ function buildFabricCommand(args, platform = process.platform) {
 function sha256Hex(bytes) {
   return createHash9("sha256").update(bytes).digest("hex");
 }
-function listNames(names) {
-  const shown2 = names.slice(0, MAX_NAMES_IN_FIX);
-  const rest = names.length - shown2.length;
+function listNames(names2) {
+  const shown2 = names2.slice(0, MAX_NAMES_IN_FIX);
+  const rest = names2.length - shown2.length;
   return rest > 0 ? `${shown2.join(", ")} and ${rest} more` : shown2.join(", ");
 }
 function capItems(items, status) {
@@ -11963,13 +12699,14 @@ async function resolveCheckout(input, access) {
   }
   const { repository, snapshot } = access.published;
   try {
-    return input.inspectCheckout ? await input.inspectCheckout({ repository, snapshot }) : await inspectCheckout({
+    const report = input.inspectCheckout ? await input.inspectCheckout({ repository, snapshot }) : await inspectCheckout({
       destination: input.root,
       repository,
       snapshot,
       deadline: Date.now() + GIT_BUDGET_MS,
       remote: input.remote
     });
+    return await withDirectContains(report, access.published);
   } catch {
     return reportFor(repository, {
       class: "unknown",
@@ -11977,6 +12714,20 @@ async function resolveCheckout(input, access) {
     });
   }
 }
+async function withDirectContains(report, published) {
+  const direct = published.direct;
+  const head = report.state?.head;
+  if (report.classification.class !== "matching" || report.contains !== void 0 || direct?.availability !== "READY" || head === null || head === void 0) {
+    return report;
+  }
+  const answer = await isAncestor(
+    report.classification.toplevel,
+    direct.currentCommitSha,
+    head,
+    Date.now() + GIT_BUDGET_MS
+  );
+  return { ...report, contains: answer.kind === "ok" ? answer.value : null };
+}
 async function checkAuth(input, client) {
   const id = "auth";
   const login = loginCommand2(input);
@@ -12197,6 +12948,28 @@ function checkPublished(access) {
   }
   const answer = access.published;
   const repository = answer.sourceOfTruth === "REPOSITORY";
+  const direct = answer.direct;
+  if (repository && answer.repository && direct?.availability === "READY") {
+    const where = sanitizeDisplayText(
+      `${answer.repository.host}/${answer.repository.path}`,
+      200
+    );
+    const commit = sanitizeDisplayText(direct.currentCommitSha, 40);
+    return [
+      makeCheck(
+        id,
+        "server",
+        "pass",
+        `read directly from ${where} at ${commit.slice(0, 12)}\u2026 on ${sanitizeDisplayText(answer.repository.ref, 200)}; Fabric copies nothing`,
+        { repository: answer.repository }
+      ),
+      {
+        kind: "direct",
+        commitSha: direct.currentCommitSha,
+        ref: answer.repository.ref
+      }
+    ];
+  }
   const repositoryConfig = answer.repository ?? null;
   if (answer.published !== true) {
     return [
@@ -12317,7 +13090,12 @@ function checkCheckout(access, snapshot, checkout) {
   if (snapshot.kind === "unpublished") {
     return makeCheck(id, "machine", "skip", NOTHING_PUBLISHED);
   }
-  const source = snapshot.snapshot.source;
+  const source = snapshot.kind === "direct" ? {
+    kind: "REPOSITORY",
+    ref: snapshot.ref,
+    commitSha: snapshot.commitSha,
+    current: true
+  } : snapshot.snapshot.source;
   const repository = access.kind === "ok" ? access.published.repository ?? null : null;
   if (source === void 0 || source.kind !== "REPOSITORY" || repository === null) {
     return makeCheck(id, "machine", "skip", PUBLISHED_NOT_SYNCED);
@@ -12368,6 +13146,12 @@ async function checkLock(input, commands, snapshot, checkout) {
       notEvaluated
     ];
   }
+  if (snapshot.kind === "direct") {
+    return [
+      makeCheck(id, "machine", "skip", LOCK_NOT_USED_DIRECT),
+      notEvaluated
+    ];
+  }
   const read = await readLockBounded(input.root);
   if (read.kind === "unreadable") {
     return [
@@ -12516,6 +13300,9 @@ async function checkDrift(input, commands, snapshot, lockState, checkout) {
   if (snapshot.kind === "unpublished") {
     return makeCheck(id, "machine", "skip", NOTHING_PUBLISHED);
   }
+  if (snapshot.kind === "direct") {
+    return makeCheck(id, "machine", "skip", LOCK_NOT_USED_DIRECT);
+  }
   if (checkout !== null && checkoutClass(checkout) !== "upload") {
     return checkoutDrift(snapshot.snapshot, checkout);
   }
@@ -13223,41 +14010,86 @@ var AGENT_TITLE = {
   codex: "Codex"
 };
 function agentRegistrationItems(input) {
-  return (input.agentMcp ?? []).map((fact) => {
-    const name = `Fabric server in ${AGENT_TITLE[fact.tool]}`;
-    switch (fact.state) {
-      case "registered":
-        return {
-          name,
-          status: "pass",
-          detail: "registered at this project's gateway"
-        };
-      case "elsewhere":
-        return {
-          name,
-          status: "warn",
-          detail: `"${fact.name}" is registered, but not at this project's gateway`
-        };
-      case "missing":
-        return {
-          name,
-          status: "skip",
-          detail: "not registered; init registers it, unless it was run with --no-mcp or, for Codex, with no terminal to sign in at"
-        };
-      case "unreadable":
-        return {
-          name,
-          status: "skip",
-          detail: "its configuration could not be read"
-        };
-      default: {
-        const unreachable = fact.state;
-        return unreachable;
-      }
+  return (input.agentMcp ?? []).flatMap((fact) => [
+    registrationItem(fact),
+    ...registrationNotes(fact)
+  ]);
+}
+function registrationNotes(fact) {
+  const title = AGENT_TITLE[fact.tool];
+  const notes = [];
+  if (fact.orgWide.length > 0) {
+    notes.push({
+      name: `Organization-wide Fabric server in ${title}`,
+      status: "skip",
+      detail: `present as ${listNames(fact.orgWide.map((name) => `"${name}"`))}; left as it is, coding instructions use the project server`
+    });
+  }
+  if (fact.foreignSameName && (fact.state === "registered" || fact.state === "legacy")) {
+    notes.push({
+      name: `Server named "${fact.name}" in ${title}`,
+      status: "skip",
+      detail: "not Fabric's; left as it is"
+    });
+  }
+  return notes;
+}
+function registrationItem(fact) {
+  const name = `Fabric server in ${AGENT_TITLE[fact.tool]}`;
+  if (fact.projectServers.length > 1) {
+    return {
+      name,
+      status: "warn",
+      detail: `this project's gateway is registered under ${fact.projectServers.length} names (${fact.projectServers.map((server) => `"${server}"`).join(", ")}); one is enough`
+    };
+  }
+  switch (fact.state) {
+    case "registered":
+      return {
+        name,
+        status: "pass",
+        detail: "registered at this project's gateway"
+      };
+    case "legacy":
+      return {
+        name,
+        status: "warn",
+        detail: `registered at this project's gateway under the older name "fabric", which still works; init now registers "${fact.name}"`
+      };
+    case "elsewhere":
+      return {
+        name,
+        status: "warn",
+        detail: `"${fact.name}" is registered, but not at this project's gateway`
+      };
+    case "missing":
+      return {
+        name,
+        status: "skip",
+        detail: "not registered; init registers it, unless it was run with --no-mcp or, for Codex, with no terminal to sign in at"
+      };
+    case "unreadable":
+      return {
+        name,
+        status: "skip",
+        detail: "its configuration could not be read"
+      };
+    default: {
+      const unreachable = fact.state;
+      return unreachable;
     }
-  });
+  }
 }
 function agentRegistrationFix(input) {
+  const legacy = (input.agentMcp ?? []).find(
+    (fact) => fact.state === "legacy" || fact.projectServers.length > 1 && fact.projectServers.includes(LEGACY_SERVER_NAME)
+  );
+  if (legacy !== void 0) {
+    return fixOf(
+      legacy.state === "legacy" ? `optional: remove the older "fabric" server from ${AGENT_TITLE[legacy.tool]} and run init, which registers "${legacy.name}" in its place, or leave it as it is` : `optional: remove the older "fabric" server from ${AGENT_TITLE[legacy.tool]}, which "${legacy.name}" already replaces, or leave it as it is`,
+      `${legacy.tool === "codex" ? "codex" : "claude"} mcp remove fabric${legacy.tool === "codex" ? "" : " --scope local"}`
+    );
+  }
   const first = (input.agentMcp ?? []).find(
     (fact) => fact.state === "elsewhere"
   );
@@ -13419,13 +14251,13 @@ async function commandResolves(input, lookup, command) {
   if (TOOL_NAME.test(command)) {
     return await isOnPath(command, lookup) ? "found" : "missing";
   }
-  const api = input.platform === "win32" ? path17.win32 : path17.posix;
+  const api = input.platform === "win32" ? path18.win32 : path18.posix;
   if (api.isAbsolute(command)) {
     return await isExecutableFile(command, input.platform) ? "found" : "missing";
   }
   if (command.includes("/") || command.includes("\\")) {
     return await isExecutableFile(
-      path17.resolve(input.root, command),
+      path18.resolve(input.root, command),
       input.platform
     ) ? "found" : "missing";
   }
@@ -13439,7 +14271,7 @@ async function runProbes(probes, items, fetchImpl) {
     while (next < probes.length) {
       const probe = probes[next++];
       const remaining = PROBE_BUDGET_MS - (Date.now() - started);
-      if (sent >= MAX_PROBES || remaining <= 0) {
+      if (sent >= MAX_PROBES2 || remaining <= 0) {
         continue;
       }
       sent++;
@@ -13602,7 +14434,7 @@ function formatDoctorText(report, destination) {
 // src/lib/instructions/drop-lock.ts
 import { createHash as createHash10 } from "crypto";
 import { rmdir } from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 var LOCK_RELATIVE = `${LOCK_DIRECTORY}/${LOCK_FILENAME}`;
 var MAX_LOCK_BYTES2 = 16 * 1024 * 1024;
 async function dropOwnLock(root, projectId) {
@@ -13622,7 +14454,7 @@ async function dropOwnLock(root, projectId) {
     if (outcome !== "deleted") {
       return false;
     }
-    await rmdir(path18.join(root, LOCK_DIRECTORY)).catch(() => void 0);
+    await rmdir(path19.join(root, LOCK_DIRECTORY)).catch(() => void 0);
     return true;
   } catch {
     return false;
@@ -13715,7 +14547,7 @@ function replacePath(text3, target, replacement) {
 
 // src/lib/instructions/fast-forward-run.ts
 import { mkdir as mkdir6, realpath as realpath4 } from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 
 // src/lib/instructions/fast-forward.ts
 function fastForwardEligibility(facts) {
@@ -13780,7 +14612,7 @@ function fabricCopyLag(input) {
   return "pending";
 }
 function isBehindReason(reason) {
-  return reason === "dirty" || reason === "wrong-branch" || reason === "detached" || reason === "operation";
+  return reason === "wrong-branch" || reason === "detached" || reason === "operation";
 }
 function skipped(text3) {
   return `${HOOK_PREFIX} sync skipped: ${text3}`;
@@ -13855,7 +14687,7 @@ function fastForwardLines(outcome, context) {
         login: context.login,
         commands: context.commands
       });
-      if (outcome.reason === "auth") {
+      if (outcome.reason === "auth" || outcome.reason === "old-git") {
         stdout.push(text3);
       } else {
         stderr.push(skipped(text3));
@@ -13865,13 +14697,12 @@ function fastForwardLines(outcome, context) {
     }
     case "merge-failed": {
       const text3 = outcomeLine("ff-merge-failed", {
-        reason: outcome.reason,
-        files: outcome.files,
+        failure: outcome,
         ref: context.ref,
         remote: context.remote,
         commands: context.commands
       });
-      if (outcome.reason === "diverged" || outcome.reason === "local-changes") {
+      if (isUserActionableMergeFailure(outcome.reason)) {
         stdout.push(text3);
         otherLine();
       } else {
@@ -13905,10 +14736,10 @@ function fastForwardLines(outcome, context) {
 }
 
 // src/lib/instructions/fast-forward-memory.ts
-import { mkdir as mkdir4, readFile as readFile5, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import path19 from "path";
+import { mkdir as mkdir4, readFile as readFile6, rename as rename2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import path20 from "path";
 function noticeFile(commonDir2) {
-  return path19.join(commonDir2, "fabric", "ff-notice.json");
+  return path20.join(commonDir2, "fabric", "ff-notice.json");
 }
 function isRecord4(value) {
   if (typeof value !== "object" || value === null) {
@@ -13919,7 +14750,7 @@ function isRecord4(value) {
 }
 async function isNewNotice(file, key) {
   try {
-    const parsed = JSON.parse(await readFile5(file, "utf8"));
+    const parsed = JSON.parse(await readFile6(file, "utf8"));
     return !(isRecord4(parsed) && parsed.projectId === key.projectId && parsed.publishedVersion === key.publishedVersion && parsed.directCommitSha === key.directCommitSha && parsed.reason === key.reason);
   } catch {
     return true;
@@ -13927,7 +14758,7 @@ async function isNewNotice(file, key) {
 }
 async function rememberNotice(file, key) {
   try {
-    await mkdir4(path19.dirname(file), { recursive: true });
+    await mkdir4(path20.dirname(file), { recursive: true });
     const temporary = `${file}.${process.pid}.tmp`;
     const record = { v: 1, ...key };
     await writeFile2(temporary, `${JSON.stringify(record)}
@@ -13944,22 +14775,27 @@ async function forgetNotice(file) {
 
 // src/lib/instructions/hook-timing.ts
 var hookTiming = {
-  deadlineMs: 1e4,
+  deadlineMs: 9500,
   gitMarginMs: 750,
   selfUpdateBudgetMs: 4e3,
-  selfUpdateMarginMs: 1e3
+  selfUpdateMarginMs: 1e3,
+  processStartedAt: void 0,
+  exitWhenDone: false
 };
+function sinceProcessStart(now = Date.now()) {
+  return hookTiming.processStartedAt === void 0 ? 0 : Math.max(0, now - hookTiming.processStartedAt);
+}
 
 // src/lib/instructions/hook-trace.ts
-import { mkdir as mkdir5, readFile as readFile6, rename as rename3, writeFile as writeFile3 } from "fs/promises";
-import path20 from "path";
+import { mkdir as mkdir5, readFile as readFile7, rename as rename3, writeFile as writeFile3 } from "fs/promises";
+import path21 from "path";
 var TRACE_LIMIT = 50;
 function traceFile(configDir) {
-  return path20.join(configDir, "traces", "instructions-hook.jsonl");
+  return path21.join(configDir, "traces", "instructions-hook.jsonl");
 }
 async function appendTrace(file, entry) {
   try {
-    const previous = await readFile6(file, "utf8").catch(() => "");
+    const previous = await readFile7(file, "utf8").catch(() => "");
     const kept = previous.split("\n").filter((line2) => {
       try {
         return typeof JSON.parse(line2)?.outcome === "string";
@@ -13968,7 +14804,7 @@ async function appendTrace(file, entry) {
       }
     }).slice(-(TRACE_LIMIT - 1));
     kept.push(JSON.stringify(entry));
-    await mkdir5(path20.dirname(file), { recursive: true, mode: 448 });
+    await mkdir5(path21.dirname(file), { recursive: true, mode: 448 });
     const temporary = `${file}.${process.pid}.tmp`;
     await writeFile3(temporary, `${kept.join("\n")}
 `, { mode: 384 });
@@ -13981,54 +14817,57 @@ async function appendTrace(file, entry) {
 var MERGE_RESERVE_MS = 1500;
 var MERGE_FLOOR_MS = 500;
 var FF_LOCK_STALE_MS = 3e4;
+var Phases = class {
+  constructor() {
+    this.totals = {};
+  }
+  async time(name, work) {
+    const started = Date.now();
+    try {
+      return await work();
+    } finally {
+      this.totals[name] = (this.totals[name] ?? 0) + (Date.now() - started);
+    }
+  }
+};
 var show2 = (value, max = 200) => sanitizeDisplayText(value, max);
 async function samePath(a, b) {
-  const resolve = async (value) => realpath4(value).catch(() => path21.resolve(value));
+  const resolve = async (value) => realpath4(value).catch(() => path22.resolve(value));
   const [left, right] = await Promise.all([resolve(a), resolve(b)]);
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
-async function readState(root, traits, deadline) {
-  const branch = await currentBranch(root, deadline);
-  const head = await headSha(root, deadline);
-  const clean = await isClean(root, deadline);
-  const operation = await operationInProgress(root, deadline);
-  if (branch.kind !== "ok" || head.kind !== "ok" || clean.kind !== "ok" || operation.kind !== "ok") {
-    return null;
-  }
-  return {
-    branch: branch.value,
-    head: head.value,
-    clean: clean.value,
-    operation: operation.value,
-    traits
-  };
-}
 async function readFacts(run3, deadline) {
   const { classification, repository } = run3;
   const root = classification.toplevel;
-  const state = await readState(root, classification.traits, deadline);
-  if (state === null) {
+  const [branch, head, operation, locks, holders] = await Promise.all([
+    currentBranch(root, deadline),
+    headSha(root, deadline),
+    operationInProgress(root, deadline),
+    lockFilesPresent(root, deadline),
+    worktreesOnBranch(root, repository.ref, deadline)
+  ]);
+  if (branch.kind !== "ok" || head.kind !== "ok" || operation.kind !== "ok" || locks.kind !== "ok" || holders.kind !== "ok") {
     return null;
   }
-  const upstream = state.branch === null ? { kind: "ok", value: null } : await upstreamOf(root, state.branch, deadline);
-  const locks = await lockFilesPresent(root, deadline);
-  const holders = await worktreesOnBranch(root, repository.ref, deadline);
-  if (upstream.kind !== "ok" || locks.kind !== "ok" || holders.kind !== "ok") {
+  const upstream = branch.value === null ? { kind: "ok", value: null } : await upstreamOf(root, branch.value, deadline);
+  if (upstream.kind !== "ok") {
     return null;
   }
-  let heldElsewhere = false;
-  for (const holder of holders.value) {
-    if (!await samePath(holder, root)) {
-      heldElsewhere = true;
-    }
-  }
+  const elsewhere = await Promise.all(
+    holders.value.map(async (holder) => !await samePath(holder, root))
+  );
   return {
     ref: repository.ref,
     remote: classification.remote,
-    state,
+    state: {
+      branch: branch.value,
+      head: head.value,
+      operation: operation.value,
+      traits: classification.traits
+    },
     upstream: upstream.value,
     lockFiles: locks.value,
-    heldElsewhere
+    heldElsewhere: elsewhere.some(Boolean)
   };
 }
 function unanswered(deadline, head, stage) {
@@ -14050,7 +14889,10 @@ async function underLock(run3, first) {
   const root = classification.toplevel;
   const remote = classification.remote;
   const ref = repository.ref;
-  const facts = await readFacts(run3, deadline);
+  const facts = await run3.phases.time(
+    "facts",
+    () => readFacts(run3, deadline)
+  );
   if (facts === null) {
     return unanswered(deadline, first.state.head, "read");
   }
@@ -14072,14 +14914,25 @@ async function underLock(run3, first) {
   if (Date.now() >= fetchDeadline) {
     return { outcome: { kind: "deadline", stage: "fetch" }, head };
   }
-  const fetched = run3.gitTransport ? await fetchRefFromUrl(
-    root,
-    run3.gitTransport.url,
-    remote,
-    ref,
-    fetchDeadline,
-    run3.gitTransport
-  ) : await fetchRef(root, remote, ref, fetchDeadline);
+  let transport;
+  if (run3.gitTransport) {
+    try {
+      transport = await run3.gitTransport();
+    } catch {
+      return { outcome: { kind: "fetch-failed", reason: "auth" }, head };
+    }
+  }
+  const fetched = await run3.phases.time(
+    "fetch",
+    () => transport ? fetchRefFromUrl(
+      root,
+      transport.url,
+      remote,
+      ref,
+      fetchDeadline,
+      transport
+    ) : fetchRef(root, remote, ref, fetchDeadline)
+  );
   switch (fetched.kind) {
     case "timed-out":
       return { outcome: { kind: "deadline", stage: "fetch" }, head };
@@ -14105,11 +14958,10 @@ async function underLock(run3, first) {
       return fetched;
   }
   const tip = fetched.tip;
-  const relation = await tipRelation(root, head, tip, deadline);
-  const changed = await factsStillMatch(run3, facts, deadline);
-  if (changed !== null) {
-    return changed;
-  }
+  const relation = await run3.phases.time(
+    "relate",
+    () => tipRelation(root, head, tip, deadline)
+  );
   switch (relation) {
     case "current":
       return { outcome: { kind: "already-current" }, head };
@@ -14123,10 +14975,20 @@ async function underLock(run3, first) {
     default:
       return relation;
   }
+  const changed = await run3.phases.time(
+    "facts",
+    () => factsStillMatch(run3, facts, deadline)
+  );
+  if (changed !== null) {
+    return changed;
+  }
   if (deadline - Date.now() < MERGE_FLOOR_MS) {
     return { outcome: { kind: "deadline", stage: "merge" }, head };
   }
-  const merged = await fastForwardTo(root, tip, deadline);
+  const merged = await run3.phases.time(
+    "merge",
+    () => fastForwardTo(root, tip, deadline)
+  );
   switch (merged.kind) {
     case "merged":
       return {
@@ -14152,11 +15014,11 @@ async function underLock(run3, first) {
         };
       }
       return {
-        outcome: {
+        outcome: merged.reason === "local-changes" ? {
           kind: "merge-failed",
           reason: merged.reason,
-          ...merged.files === void 0 ? {} : { files: merged.files }
-        },
+          files: merged.files
+        } : { kind: "merge-failed", reason: merged.reason },
         head
       };
     default:
@@ -14184,13 +15046,13 @@ async function factsStillMatch(run3, expected, deadline) {
   return null;
 }
 async function decide(run3) {
-  const { classification, deadline, report } = run3;
+  const { classification, deadline, report, phases } = run3;
   const root = classification.toplevel;
   const head = report.state?.head ?? null;
   if (run3.optedOut) {
     return { outcome: { kind: "opted-out" }, head };
   }
-  const facts = await readFacts(run3, deadline);
+  const facts = await phases.time("facts", () => readFacts(run3, deadline));
   if (facts === null) {
     return unanswered(deadline, head, "read");
   }
@@ -14201,15 +15063,32 @@ async function decide(run3) {
       head: facts.state.head
     };
   }
-  const common = await commonDir(root, deadline);
+  if (run3.directCommitSha !== void 0 && facts.state.head !== null) {
+    const holds = await phases.time(
+      "contains",
+      () => isAncestor(
+        root,
+        run3.directCommitSha,
+        facts.state.head,
+        deadline
+      )
+    );
+    if (holds.kind === "ok" && holds.value) {
+      return {
+        outcome: { kind: "already-current" },
+        head: facts.state.head
+      };
+    }
+  }
+  const common = await run3.commonDir;
   if (common.kind !== "ok") {
     return unanswered(deadline, head, "read");
   }
-  const directory = path21.join(common.value, "fabric");
+  const directory = path22.join(common.value, "fabric");
   try {
     await mkdir6(directory, { recursive: true });
     return await withExclusiveLock(() => underLock(run3, facts), {
-      lockPath: path21.join(directory, "ff.lock"),
+      lockPath: path22.join(directory, "ff.lock"),
       staleMs: FF_LOCK_STALE_MS,
       waitMs: 0
     });
@@ -14219,7 +15098,7 @@ async function decide(run3) {
       return {
         outcome: error.abandoned ? {
           kind: "abandoned-lock",
-          lockPath: path21.join(directory, "ff.lock")
+          lockPath: path22.join(directory, "ff.lock")
         } : { kind: "locked" },
         head: now.kind === "ok" ? now.value : head
       };
@@ -14243,9 +15122,12 @@ function noticeReason(outcome, lag) {
   if (outcome.kind === "not-safe") {
     return `not-safe:${outcome.reason}`;
   }
-  if (outcome.kind === "merge-failed" && (outcome.reason === "diverged" || outcome.reason === "local-changes")) {
+  if (outcome.kind === "merge-failed" && isUserActionableMergeFailure(outcome.reason)) {
     return `merge-failed:${outcome.reason}`;
   }
+  if (outcome.kind === "fetch-failed" && outcome.reason === "old-git") {
+    return "fetch-failed:old-git";
+  }
   if ((outcome.kind === "fast-forwarded" || outcome.kind === "already-current") && lag !== null) {
     return `fabric-lags:${lag}`;
   }
@@ -14266,7 +15148,9 @@ async function runFastForward(run3) {
   const started = Date.now();
   const { repository, snapshot, classification } = run3;
   const root = classification.toplevel;
-  const decision = await decide(run3);
+  const phases = new Phases();
+  const commonDir2 = commonDir(root, run3.deadline);
+  const decision = await decide({ ...run3, phases, commonDir: commonDir2 });
   const { outcome } = decision;
   const source = snapshot?.source;
   const snapshotSha = source?.kind === "REPOSITORY" && source.current && isCommitSha(source.commitSha) ? source.commitSha : null;
@@ -14274,7 +15158,7 @@ async function runFastForward(run3) {
   const moved = outcome.kind === "fast-forwarded" || outcome.kind === "already-current";
   const head = outcome.kind === "fast-forwarded" ? outcome.to : decision.head;
   let publishedInHistory = null;
-  if (moved && publishedSha !== null && head !== null && publishedSha !== head) {
+  if (moved && snapshot !== void 0 && publishedSha !== null && head !== null && publishedSha !== head) {
     const answer = await isAncestor(
       root,
       publishedSha,
@@ -14303,10 +15187,13 @@ async function runFastForward(run3) {
     version: outcome.kind === "fast-forwarded" && publishedSha === outcome.to && snapshot ? Number(snapshot.version) : null,
     lag,
     head,
-    gaveUpAfter: describeDuration(hookTiming.deadlineMs)
+    gaveUpAfter: describeDuration(
+      hookTiming.processStartedAt === void 0 ? hookTiming.deadlineMs : Math.round(sinceProcessStart() / 100) * 100
+    )
   };
   let { stdout, stderr } = fastForwardLines(outcome, context);
-  const common = await commonDir(
+  const early = await commonDir2;
+  const common = early.kind === "ok" ? early : await commonDir(
     root,
     Math.max(run3.deadline, Date.now() + 500)
   );
@@ -14336,17 +15223,90 @@ async function runFastForward(run3) {
       projectId: run3.projectId,
       outcome: outcome.kind,
       reason: reasonOf(outcome),
-      ms: Date.now() - started
+      ms: Date.now() - started,
+      totalMs: sinceProcessStart(),
+      phases: { ...run3.timings, ...phases.totals }
     });
   }
   return { outcome, stdout, stderr };
 }
 
+// src/lib/instructions/gateway-probe.ts
+var PROBE_TIMEOUT_MS2 = 3e3;
+var MAX_METADATA_CHARS = 64 * 1024;
+var CHALLENGE_METADATA = /resource_metadata="([^"]+)"/;
+function sameOrigin(left, right) {
+  const a = normalizeServerUrl(left);
+  const b = normalizeServerUrl(right);
+  return a !== null && b !== null && new URL(a).origin === new URL(b).origin;
+}
+async function discard(response) {
+  try {
+    await response.body?.cancel();
+  } catch {
+  }
+}
+function request(fetcher, url) {
+  return fetcher(url, {
+    method: "GET",
+    redirect: "manual",
+    credentials: "omit",
+    headers: { accept: "application/json" },
+    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS2)
+  });
+}
+function gatewayProbeFor(input) {
+  const fetcher = input.fetch ?? ((url, init) => fetch(url, init));
+  return async (url) => {
+    if (!sameOrigin(url, input.origin)) {
+      return "unknown";
+    }
+    try {
+      const challenged = await request(fetcher, url);
+      await discard(challenged);
+      if (challenged.status >= 500) {
+        return "unknown";
+      }
+      const metadataUrl = challenged.status === 401 ? CHALLENGE_METADATA.exec(
+        challenged.headers.get("www-authenticate") ?? ""
+      )?.[1] : void 0;
+      if (metadataUrl === void 0) {
+        return "foreign";
+      }
+      if (!sameOrigin(metadataUrl, input.origin)) {
+        return "unknown";
+      }
+      const metadata = await request(fetcher, metadataUrl);
+      if (metadata.status !== 200) {
+        await discard(metadata);
+        return "unknown";
+      }
+      const text3 = await metadata.text();
+      if (text3.length > MAX_METADATA_CHARS) {
+        return "unknown";
+      }
+      const parsed = JSON.parse(text3);
+      const resource = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "resource") : void 0;
+      if (typeof resource !== "string") {
+        return "unknown";
+      }
+      const relation = classifyGatewayResource(
+        input.origin,
+        input.projectId,
+        resource
+      );
+      return relation === "unfamiliar" ? "unknown" : relation;
+    } catch {
+      return "unknown";
+    }
+  };
+}
+
 // src/lib/instructions/git-exclude.ts
-import { appendFile, lstat as lstat6, mkdir as mkdir7, readFile as readFile7 } from "fs/promises";
-import path22 from "path";
+import { appendFile, lstat as lstat7, mkdir as mkdir7, readFile as readFile8 } from "fs/promises";
+import path23 from "path";
 function relativeToTopLevel(toplevel, directory, file) {
-  return path22.relative(toplevel, path22.join(directory, file)).split(path22.sep).join("/");
+  return path23.relative(toplevel, path23.join(directory, file)).split(path23.sep).join("/");
 }
 function isLiteralEntry(entry) {
   return !/[\n\r*?[\]\\!]/.test(entry) && !entry.startsWith("#");
@@ -14380,8 +15340,8 @@ async function excludeLocalFiles(input) {
     if (file.kind !== "ok") {
       return { kind: "failed", entries: missing };
     }
-    await mkdir7(path22.dirname(file.value), { recursive: true });
-    const existing = await lstat6(file.value).catch((error) => {
+    await mkdir7(path23.dirname(file.value), { recursive: true });
+    const existing = await lstat7(file.value).catch((error) => {
       if (error.code === "ENOENT") {
         return null;
       }
@@ -14390,7 +15350,7 @@ async function excludeLocalFiles(input) {
     if (existing !== null && !existing.isFile()) {
       return { kind: "failed", entries: missing };
     }
-    const text3 = existing === null ? "" : await readFile7(file.value, "utf8");
+    const text3 = existing === null ? "" : await readFile8(file.value, "utf8");
     const present = new Set(text3.split(/\r?\n/));
     const toAdd = missing.filter((entry) => !present.has(entry));
     if (toAdd.length === 0) {
@@ -14406,8 +15366,8 @@ async function excludeLocalFiles(input) {
 }
 
 // src/lib/instructions/hook-launcher.ts
-import { mkdir as mkdir8, readFile as readFile8, rename as rename4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
-import path23 from "path";
+import { mkdir as mkdir8, readFile as readFile9, rename as rename4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import path24 from "path";
 var NOT_ON_PATH_WARNING = "`fabric` is not on this machine's PATH, so this session hook will not run. Run the setup line from the project's Connect dialog instead: it keeps a copy of this deployment's CLI where the hook finds it.";
 var COPY_IN_USE_WARNING = "The CLI copy the session hook runs is in use and could not be replaced, so the earlier copy was kept. Run this again when no coding session is starting.";
 var UNQUOTABLE_PATH = "The CLI's config folder has characters in its path that cannot be written safely into a hook command. Set XDG_CONFIG_HOME (APPDATA on Windows) to a plain path and run this again.";
@@ -14415,7 +15375,7 @@ function deploymentFolder(origin) {
   return origin.replace(/^(https?):\/\//, "$1-").replace(/[^A-Za-z0-9.-]+/g, "-");
 }
 function bundleCopyPath(configDirectory, origin) {
-  return path23.join(
+  return path24.join(
     configDirectory,
     "cli",
     deploymentFolder(origin),
@@ -14423,11 +15383,11 @@ function bundleCopyPath(configDirectory, origin) {
   );
 }
 function samePath2(a, b) {
-  const [left, right] = [path23.resolve(a), path23.resolve(b)];
+  const [left, right] = [path24.resolve(a), path24.resolve(b)];
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 async function writeCopy(bytes, destination) {
-  await mkdir8(path23.dirname(destination), { recursive: true });
+  await mkdir8(path24.dirname(destination), { recursive: true });
   const temporary = `${destination}.${process.pid}.tmp`;
   await writeFile4(temporary, bytes, { mode: 420 });
   try {
@@ -14435,7 +15395,7 @@ async function writeCopy(bytes, destination) {
     return true;
   } catch (error) {
     await rm3(temporary, { force: true });
-    const existing = await readFile8(destination).catch(() => null);
+    const existing = await readFile9(destination).catch(() => null);
     if (existing === null) {
       throw error;
     }
@@ -14458,7 +15418,7 @@ async function resolveHookLauncher(input) {
     return { prefix: `node ${word}`, warning: null };
   }
   const current = await writeCopy(
-    await readFile8(input.bundle.scriptPath),
+    await readFile9(input.bundle.scriptPath),
     destination
   );
   return {
@@ -14512,7 +15472,7 @@ async function installHooks(input) {
 import { createHash as createHash11 } from "crypto";
 import { createReadStream } from "fs";
 import { mkdir as mkdir9, readdir as readdir2, stat as stat5, unlink as unlink2, writeFile as writeFile5 } from "fs/promises";
-import path24 from "path";
+import path25 from "path";
 import { createInterface } from "readline";
 function parseStopHookInput(text3) {
   let parsed;
@@ -14610,7 +15570,7 @@ async function pruneOldMarkers(markerDir, now) {
   const cutoff = now.getTime() - MARKER_MAX_AGE_MS;
   await Promise.all(
     entries.map(async (name) => {
-      const entryPath = path24.join(markerDir, name);
+      const entryPath = path25.join(markerDir, name);
       try {
         const stats = await stat5(entryPath);
         if (stats.mtimeMs < cutoff) {
@@ -14670,7 +15630,7 @@ async function runLessonPromptInner(input) {
     debugLog(`marker prune failed: ${describeError(error)}`);
   });
   const key = markerKey(parsedInput.sessionId, projectId);
-  const markerPath = path24.join(input.markerDir, key);
+  const markerPath = path25.join(input.markerDir, key);
   if (await markerExists(markerPath)) {
     return { output: null, why: "already-asked" };
   }
@@ -14767,16 +15727,16 @@ function assertLockMatchesManifest(lock, manifest) {
   const published = new Map(
     manifest.map((entry) => [entry.path, entry.sha256])
   );
-  for (const [path29, entry] of Object.entries(lock.files)) {
-    const expected = published.get(path29);
+  for (const [path30, entry] of Object.entries(lock.files)) {
+    const expected = published.get(path30);
     if (expected === void 0) {
       refuseStaleLedger(
-        `it lists ${path29}, which version ${lock.snapshotVersion} does not contain`
+        `it lists ${path30}, which version ${lock.snapshotVersion} does not contain`
       );
     }
     if (expected !== entry.sha256) {
       refuseStaleLedger(
-        `its record of ${path29} is not the published file`
+        `its record of ${path30} is not the published file`
       );
     }
   }
@@ -15201,14 +16161,14 @@ function splitMessage(message) {
 }
 
 // src/lib/instructions/pull-request-verdict.ts
-function pushPullRequest(pullRequest, timedOut) {
+function pushPullRequest(pullRequest, timedOut2) {
   const branch = pullRequest.branch ?? null;
   return {
     operationId: pullRequest.operationId,
     state: pullRequest.state,
     url: branch?.pullRequest?.url ?? pullRequest.url,
     failure: pullRequest.failure,
-    timedOut,
+    timedOut: timedOut2,
     branch,
     append: pullRequest.append ?? null
   };
@@ -15591,7 +16551,7 @@ async function confirm(question, streams = { input: process.stdin, output: proce
 }
 
 // src/lib/instructions/resolve-project.ts
-import path25 from "path";
+import path26 from "path";
 var MAX_CANDIDATES = 8;
 var MAX_CANDIDATE_CHARS = 512;
 var MAX_LABEL_CHARS = 80;
@@ -15621,15 +16581,15 @@ async function resolveProjectFromCheckout(input) {
   if (remotes2.value.length === 0) {
     throw outcomeFailure("no-remote", { verb: input.verb });
   }
-  const names = input.remote === void 0 ? remotes2.value : remotes2.value.filter((name) => name === input.remote);
-  if (names.length === 0) {
+  const names2 = input.remote === void 0 ? remotes2.value : remotes2.value.filter((name) => name === input.remote);
+  if (names2.length === 0) {
     throw outcomeFailure("remote-missing", {
       remote: sanitizeDisplayText(input.remote ?? "", 100)
     });
   }
   const candidates = [];
   let identity = null;
-  for (const name of names) {
+  for (const name of names2) {
     const url = await effectiveFetchUrl(toplevel, name, deadline);
     if (url.kind !== "ok") {
       throw unreadable(url);
@@ -15660,7 +16620,7 @@ async function resolveProjectFromCheckout(input) {
   for (const match of matches2) {
     if (await sameDirectory(
       destination,
-      path25.join(toplevel, match.rootPath)
+      path26.join(toplevel, match.rootPath)
     )) {
       here.push(match);
     }
@@ -15683,9 +16643,17 @@ async function resolveProjectFromCheckout(input) {
 }
 
 // src/lib/instructions/self-update.ts
+import { spawn as spawn4 } from "child_process";
 import { createHash as createHash14 } from "crypto";
-import { mkdir as mkdir10, readFile as readFile9, realpath as realpath5, writeFile as writeFile6 } from "fs/promises";
-import path26 from "path";
+import {
+  mkdir as mkdir10,
+  readFile as readFile10,
+  realpath as realpath5,
+  rm as rm4,
+  stat as stat6,
+  writeFile as writeFile6
+} from "fs/promises";
+import path27 from "path";
 
 // src/lib/instructions/npm-tarball.ts
 import { gunzipSync } from "zlib";
@@ -15803,7 +16771,7 @@ function transportIsSafe(origin) {
   const url = new URL(origin);
   return url.protocol === "https:" || url.protocol === "http:" && (LOOPBACK_HOST.test(url.hostname) || url.hostname.endsWith(".localhost"));
 }
-function reasonToStayQuiet(input, now) {
+function reasonToStayQuiet(input) {
   if (isFlagSet(input.env[SELF_UPDATE_OPT_OUT])) {
     return "opted-out";
   }
@@ -15813,22 +16781,22 @@ function reasonToStayQuiet(input, now) {
   if (!transportIsSafe(input.origin)) {
     return "insecure-origin";
   }
-  if (input.deadlineAt - now < input.timing.budgetMs + input.timing.marginMs) {
-    return "no-time";
-  }
   return null;
 }
+function outOfTime(input, now) {
+  return input.deadlineAt - now < input.timing.budgetMs + input.timing.marginMs;
+}
 async function isKeptCopy(script, copy) {
   const actual = await realpath5(copy).catch(() => null);
   if (actual === null) {
     return false;
   }
-  const running = await realpath5(script).catch(() => path26.resolve(script));
+  const running = await realpath5(script).catch(() => path27.resolve(script));
   return samePath2(running, actual);
 }
-async function readState2(file) {
+async function readState(file) {
   try {
-    const parsed = JSON.parse(await readFile9(file, "utf8"));
+    const parsed = JSON.parse(await readFile10(file, "utf8"));
     return typeof parsed.checkedAt === "number" && Number.isFinite(parsed.checkedAt) && typeof parsed.tarball === "string" ? { checkedAt: parsed.checkedAt, tarball: parsed.tarball } : null;
   } catch {
     return null;
@@ -15836,7 +16804,7 @@ async function readState2(file) {
 }
 async function writeState(file, state) {
   try {
-    await mkdir10(path26.dirname(file), { recursive: true });
+    await mkdir10(path27.dirname(file), { recursive: true });
     await writeFile6(file, `${JSON.stringify(state)}
 `);
     return true;
@@ -15844,6 +16812,30 @@ async function writeState(file, state) {
     return false;
   }
 }
+async function claimSlot(file, now, timing) {
+  try {
+    await mkdir10(path27.dirname(file), { recursive: true });
+    for (let attempt2 = 0; attempt2 < 2; attempt2 += 1) {
+      try {
+        await writeFile6(file, `${now}
+`, { flag: "wx" });
+        return true;
+      } catch (error) {
+        if (error.code !== "EEXIST") {
+          return false;
+        }
+        const held = await stat6(file).catch(() => null);
+        if (held !== null && now - held.mtimeMs < timing.budgetMs + timing.marginMs) {
+          return false;
+        }
+        await rm4(file, { force: true });
+      }
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
 function askedRecently(state, now) {
   const elapsed = now - state.checkedAt;
   return elapsed >= 0 && elapsed < SELF_UPDATE_INTERVAL_MS;
@@ -15974,7 +16966,7 @@ async function attempt({
 }
 async function refreshKeptCopy(input, deps = {}) {
   const now = deps.now ?? Date.now;
-  const quiet = reasonToStayQuiet(input, now());
+  const quiet = reasonToStayQuiet(input);
   if (quiet !== null) {
     return skipped2(quiet);
   }
@@ -15986,45 +16978,91 @@ async function refreshKeptCopy(input, deps = {}) {
   if (!await isKeptCopy(input.script, copy)) {
     return skipped2("not-a-kept-copy");
   }
-  const stateFile = path26.join(path26.dirname(copy), STATE_FILE);
-  const previous = await readState2(stateFile);
+  const stateFile = path27.join(path27.dirname(copy), STATE_FILE);
+  const previous = await readState(stateFile);
   if (previous !== null && askedRecently(previous, now())) {
     return skipped2("checked-recently");
   }
-  if (!await writeState(stateFile, { checkedAt: now(), tarball: running })) {
-    return skipped2("state-unwritable");
+  if (outOfTime(input, now())) {
+    return skipped2("no-time");
+  }
+  const claimFile = `${stateFile}.claim`;
+  if (!await claimSlot(claimFile, now(), input.timing)) {
+    return skipped2("checked-recently");
   }
-  let signal;
-  let outcome = { kind: "current" };
   try {
-    await withDeadline(input.timing.budgetMs, async (deadline) => {
-      signal = deadline;
-      outcome = await attempt({
-        input,
-        copy,
-        stateFile,
-        now,
-        fetchImpl: deps.fetchImpl ?? fetch,
-        replace: deps.replace ?? writeCopy,
-        signal: deadline,
-        running
+    const latest = await readState(stateFile);
+    if (latest !== null && askedRecently(latest, now())) {
+      return skipped2("checked-recently");
+    }
+    if (!await writeState(stateFile, {
+      checkedAt: now(),
+      tarball: running
+    })) {
+      return skipped2("state-unwritable");
+    }
+    return await runAttempt(running);
+  } finally {
+    await rm4(claimFile, { force: true }).catch(() => void 0);
+  }
+  async function runAttempt(running2) {
+    let signal;
+    let outcome = { kind: "current" };
+    try {
+      await withDeadline(input.timing.budgetMs, async (deadline) => {
+        signal = deadline;
+        outcome = await attempt({
+          input,
+          copy,
+          stateFile,
+          now,
+          fetchImpl: deps.fetchImpl ?? fetch,
+          replace: deps.replace ?? writeCopy,
+          signal: deadline,
+          running: running2
+        });
       });
-    });
-  } catch (error) {
-    if (signal?.aborted) {
-      return {
+    } catch (error) {
+      if (signal?.aborted) {
+        return {
+          kind: "failed",
+          reason: "it ran out of time",
+          cause: error
+        };
+      }
+      return error instanceof SelfUpdateFailure ? { kind: "failed", reason: error.message, cause: error.cause } : {
         kind: "failed",
-        reason: "it ran out of time",
+        reason: "it failed unexpectedly",
         cause: error
       };
     }
-    return error instanceof SelfUpdateFailure ? { kind: "failed", reason: error.message, cause: error.cause } : {
-      kind: "failed",
-      reason: "it failed unexpectedly",
-      cause: error
-    };
+    return outcome;
+  }
+}
+function startBackgroundSelfUpdate(input, spawnImpl = spawn4) {
+  try {
+    const child = spawnImpl(
+      process.execPath,
+      [
+        input.script,
+        "instructions",
+        "self-update",
+        "--base-url",
+        input.origin
+      ],
+      {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: input.env
+      }
+    );
+    child.on("error", () => void 0);
+    child.unref();
+    return true;
+  } catch {
+    return false;
   }
-  return outcome;
 }
 function selfUpdateLine(outcome) {
   switch (outcome.kind) {
@@ -16043,19 +17081,19 @@ function selfUpdateLine(outcome) {
 }
 
 // src/lib/instructions/tools.ts
-import { stat as stat6 } from "fs/promises";
-import path27 from "path";
+import { stat as stat7 } from "fs/promises";
+import path28 from "path";
 var TOOLS = [
   { tool: "claude-code", directory: ".claude", command: "claude" },
   { tool: "codex", directory: ".codex", command: "codex" }
 ];
 async function isDirectory(target) {
-  return (await stat6(target).catch(() => null))?.isDirectory() ?? false;
+  return (await stat7(target).catch(() => null))?.isDirectory() ?? false;
 }
 async function detectTools(input) {
   const present = [];
   for (const facts of TOOLS) {
-    const found = await isDirectory(path27.join(input.root, facts.directory)) || input.home !== null && await isDirectory(path27.join(input.home, facts.directory)) || await isOnPath(facts.command, input.lookup);
+    const found = await isDirectory(path28.join(input.root, facts.directory)) || input.home !== null && await isDirectory(path28.join(input.home, facts.directory)) || await isOnPath(facts.command, input.lookup);
     if (found) {
       present.push(facts.tool);
     }
@@ -16082,6 +17120,13 @@ function buildInstructionsCommand() {
   const instructions = new Command13("instructions").description(
     "Keep a checkout current with a project's published coding instructions"
   );
+  instructions.command("self-update", { hidden: true }).description("Refresh the kept copy of the served CLI, out of band").option("--base-url <origin>", BASE_URL_HELP).action(async (opts) => {
+    await refreshKeptCopyAfterHook(
+      opts,
+      Date.now() + hookTiming.selfUpdateBudgetMs + hookTiming.selfUpdateMarginMs + BACKGROUND_UPDATE_SLACK_MS,
+      { mayDefer: false }
+    );
+  });
   instructions.command("check").description(
     "Report whether the local copy is behind the published one"
   ).option("--project <id>", PROJECT_HELP).option("--base-url <origin>", BASE_URL_HELP).option("--remote <name>", REMOTE_HELP).option("--dest <dir>", "Destination directory (default: cwd)").option("--org <slug>", "Organization context").option(
@@ -16212,15 +17257,20 @@ async function run2(opts, verb, body) {
   takeAuthFailure();
   takeUpgradeNotice();
   let hookDeadlineAt;
+  hookPhases = {};
+  hookTraced = false;
   try {
     if (opts.hook) {
-      const totalMs = hookDeadlineMs();
-      activeDeadlineAt = Date.now() + totalMs;
+      hookPhases.node = sinceProcessStart();
+      activeDeadlineAt = (hookTiming.processStartedAt ?? Date.now()) + hookDeadlineMs();
       hookDeadlineAt = activeDeadlineAt;
-      await withDeadline(totalMs, (signal) => {
-        activeDeadline = signal;
-        return body();
-      }).finally(() => {
+      await withDeadline(
+        Math.max(0, activeDeadlineAt - Date.now()),
+        (signal) => {
+          activeDeadline = signal;
+          return body();
+        }
+      ).finally(() => {
         activeDeadline = void 0;
         activeDeadlineAt = void 0;
       });
@@ -16239,7 +17289,7 @@ async function run2(opts, verb, body) {
       const signedOutOf = error instanceof NotSignedInError ? error.origin : authFailure?.origin ?? (failure.exitCode === 3 ? describedOrigin(opts) : null);
       if (signedOutOf !== null) {
         line(
-          `${HOOK_PREFIX}: ${outcomeLine("hook-signed-out", { origin: signedOutOf || describedOrigin(opts), project: opts.project })}`
+          `${HOOK_PREFIX}: ${outcomeLine("hook-signed-out", { origin: signedOutOf || describedOrigin(opts), project: opts.project, otherProjects: signedInForOtherProjects(signedOutOf || describedOrigin(opts), opts.project) })}`
         );
       } else if (error instanceof UpgradeRequiredFailure) {
         line(error.line);
@@ -16249,10 +17299,17 @@ async function run2(opts, verb, body) {
 `
         );
       }
+      await traceHookFailure(opts, {
+        signedOut: signedOutOf !== null,
+        upgrade: error instanceof UpgradeRequiredFailure,
+        timedOut: /gave up after/.test(failure.message),
+        exitCode: failure.exitCode
+      });
       showUpgradeNotice(true);
       if (error instanceof UpgradeRequiredFailure) {
         await refreshKeptCopyAfterHook(opts, hookDeadlineAt);
       }
+      await endHookProcess();
       process.exit(0);
     }
     process.stderr.write(`\u2717 ${failure.message}
@@ -16263,17 +17320,58 @@ async function run2(opts, verb, body) {
   showUpgradeNotice(Boolean(opts.hook));
   if (opts.hook) {
     await refreshKeptCopyAfterHook(opts, hookDeadlineAt);
+    await endHookProcess();
+  }
+}
+var hookPhases = {};
+var hookTraced = false;
+async function timedPhase(name, work) {
+  const started = Date.now();
+  try {
+    return await work();
+  } finally {
+    hookPhases[name] = (hookPhases[name] ?? 0) + (Date.now() - started);
+  }
+}
+async function traceHookFailure(opts, why) {
+  if (hookTraced) {
+    return;
+  }
+  const reason = why.signedOut ? "not-signed-in" : why.upgrade ? "upgrade-required" : why.timedOut ? "deadline" : `failed-${why.exitCode}`;
+  await appendTrace(traceFile(path29.dirname(getConfigPath())), {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    projectId: opts.project ?? "",
+    outcome: "skipped",
+    reason,
+    ms: sinceProcessStart(),
+    totalMs: sinceProcessStart(),
+    phases: { ...hookPhases }
+  });
+}
+async function endHookProcess() {
+  if (!hookTiming.exitWhenDone) {
+    return;
   }
+  await Promise.all(
+    [process.stdout, process.stderr].map(
+      (stream) => new Promise((resolve) => {
+        stream.write("", () => resolve());
+      })
+    )
+  );
+  process.exit(0);
 }
-async function refreshKeptCopyAfterHook(opts, deadlineAt) {
+var BACKGROUND_UPDATE_SLACK_MS = 5e3;
+async function refreshKeptCopyAfterHook(opts, deadlineAt, { mayDefer = true } = {}) {
   const origin = opts.baseUrl === void 0 ? null : normalizeOrigin(opts.baseUrl);
   if (origin === null || deadlineAt === void 0) {
     return;
   }
-  const outcome = await refreshKeptCopy({
+  const started = Date.now();
+  const input = {
     origin,
     script: bundleScriptPath(),
-    configDirectory: path28.dirname(getConfigPath()),
+    configDirectory: path29.dirname(getConfigPath()),
     runningTarball: bundleTarballPath(),
     env: process.env,
     deadlineAt,
@@ -16281,7 +17379,25 @@ async function refreshKeptCopyAfterHook(opts, deadlineAt) {
       budgetMs: hookTiming.selfUpdateBudgetMs,
       marginMs: hookTiming.selfUpdateMarginMs
     }
-  });
+  };
+  const outcome = await refreshKeptCopy(input);
+  if (mayDefer && outcome.kind === "skipped" && outcome.reason === "no-time") {
+    startBackgroundSelfUpdate({
+      script: input.script,
+      origin,
+      env: process.env
+    });
+  }
+  if (outcome.kind !== "skipped") {
+    await appendTrace(traceFile(path29.dirname(getConfigPath())), {
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      projectId: "",
+      outcome: "self-update",
+      reason: outcome.kind,
+      ms: Date.now() - started,
+      totalMs: sinceProcessStart()
+    });
+  }
   if (outcome.kind === "failed" && process.env.FABRIC_DEBUG) {
     process.stderr.write(
       `debug: ${describeError(outcome.cause ?? outcome.reason)}
@@ -16333,7 +17449,7 @@ function gitDeadline() {
   return activeDeadlineAt === void 0 ? Date.now() + GIT_BUDGET_MS2 : activeDeadlineAt - hookTiming.gitMarginMs;
 }
 function destinationOf(opts) {
-  return path28.resolve(opts.dest ?? process.cwd());
+  return path29.resolve(opts.dest ?? process.cwd());
 }
 function instructionsClient(opts, timeoutMs, { neverRetry = false } = {}) {
   if (!getApiKey(deploymentOrigin(opts), opts.project)) {
@@ -16364,9 +17480,19 @@ function deploymentOrigin(opts) {
 function describedOrigin(opts) {
   return normalizeOrigin(opts.baseUrl ?? getBaseUrl() ?? DEFAULT_ORIGIN) ?? DEFAULT_ORIGIN;
 }
+function signedInForOtherProjects(origin, project) {
+  return project !== void 0 && listProjectSignIns(origin).some((entry) => entry.projectId !== project);
+}
 var NotSignedInError = class extends CliFailure {
   constructor(origin, project) {
-    super(outcomeLine("not-signed-in", { origin, project }), 3);
+    super(
+      outcomeLine("not-signed-in", {
+        origin,
+        project,
+        otherProjects: signedInForOtherProjects(origin, project)
+      }),
+      3
+    );
     this.origin = origin;
     this.name = "NotSignedInError";
   }
@@ -16383,7 +17509,7 @@ async function ensureSignedIn(opts) {
   if (opts.hook || runningInCi()) {
     throw new NotSignedInError(origin, opts.project);
   }
-  const forProject = opts.project === void 0 ? "" : ` for project ${opts.project}`;
+  const forProject2 = opts.project === void 0 ? "" : ` for project ${opts.project}`;
   try {
     const who2 = await signInWithBrowser({
       baseUrl: opts.baseUrl ?? getBaseUrl() ?? origin,
@@ -16393,7 +17519,7 @@ async function ensureSignedIn(opts) {
       ...opts.project === void 0 ? {} : { project: opts.project },
       announce: (url) => {
         process.stderr.write(
-          `Opening your browser to sign in to ${origin}${forProject}.
+          `Opening your browser to sign in to ${origin}${forProject2}.
 If it does not open, visit:
 
   ${url}
@@ -16405,7 +17531,7 @@ Waiting up to 5 minutes for the sign-in to finish.
       }
     });
     process.stderr.write(
-      `Signed in to ${origin}${forProject} as ${sanitizeDisplayText(who2.name, 80)}.
+      `Signed in to ${origin}${forProject2} as ${sanitizeDisplayText(who2.name, 80)}.
 `
     );
   } catch {
@@ -16479,6 +17605,30 @@ async function directGitTransport(opts, direct) {
   }
   return { url: base.toString(), authorization: `Bearer ${token}` };
 }
+function lazyGitTransport(opts, direct) {
+  if (!opts.hook || direct.gitGateway?.version !== "v1") {
+    return void 0;
+  }
+  let failure;
+  let pending;
+  return {
+    resolve: () => {
+      pending ??= timedPhase(
+        "token",
+        () => directGitTransport(opts, direct)
+      ).catch((error) => {
+        failure = error;
+        throw error;
+      });
+      return pending;
+    },
+    rethrow: () => {
+      if (failure !== void 0) {
+        throw failure;
+      }
+    }
+  };
+}
 function hasSignInFor(origin, project) {
   if (project === void 0) {
     return Boolean(getApiKey(origin));
@@ -16548,14 +17698,17 @@ async function fetchPublished(client, opts, sinceDigest, guard) {
   const org = orgSlugFor(opts);
   let published;
   try {
-    published = await client.instructions.getPublished(opts.project, {
-      org,
-      sinceDigest
-    });
+    published = await timedPhase(
+      "api",
+      () => client.instructions.getPublished(opts.project, {
+        org,
+        sinceDigest
+      })
+    );
   } catch (error) {
     throw fixedFailure(error);
   }
-  await guard?.admit(published);
+  await timedPhase("classify", async () => guard?.admit(published));
   return published;
 }
 var SourceGuard = class {
@@ -16608,19 +17761,23 @@ function directRepositoryRead(published) {
   const direct = published.direct;
   return published.sourceOfTruth === "REPOSITORY" && published.repository !== void 0 && published.repository !== null && direct?.availability === "READY" ? direct : null;
 }
+var NO_VERIFY_FOR_DIRECT = "--verify has nothing to check: this project reads its repository directly, so Fabric keeps no copy here. Git is the record of what this checkout holds.";
 async function directRepositoryCheckoutStatus(input) {
   const commit = input.direct.currentCommitSha.slice(0, 7);
   const repository = repositoryName(input.repository);
   if (input.checkout.class !== "matching") {
     return {
       current: false,
+      verdict: "no-checkout",
       line: `Coding instructions are read directly from ${repository} at ${commit}. Open a matching native checkout before reading them locally.`
     };
   }
-  const head = input.report.state?.head;
-  if (head === null || head === void 0) {
+  const state = input.report.state;
+  const head = state?.head;
+  if (state === null || head === null || head === void 0) {
     return {
       current: false,
+      verdict: "unknown",
       line: `Coding instructions are read directly from ${repository} at ${commit}; this checkout could not be compared to that commit.`
     };
   }
@@ -16633,6 +17790,7 @@ async function directRepositoryCheckoutStatus(input) {
   if (contains.kind === "ok" && contains.value) {
     return {
       current: true,
+      verdict: "current",
       line: `Coding instructions are read directly from ${repository} at ${commit}; this checkout already contains that commit.`
     };
   }
@@ -16646,12 +17804,20 @@ async function directRepositoryCheckoutStatus(input) {
     if (behind.kind === "ok") {
       return {
         current: false,
-        line: behind.value ? `Coding instructions are read directly from ${repository} at ${commit}; this checkout is behind. Run git pull --ff-only.` : `Coding instructions are read directly from ${repository} at ${commit}; this checkout has diverged. Inspect its Git history before choosing how to update it.`
+        verdict: behind.value ? "behind" : "diverged",
+        line: behind.value ? directBehindLine({
+          repository: input.repository,
+          commitSha: input.direct.currentCommitSha,
+          ref: input.direct.ref,
+          remote: input.checkout.remote,
+          state
+        }) : `Coding instructions are read directly from ${repository} at ${commit}; this checkout has diverged. Inspect its Git history before choosing how to update it.`
       };
     }
   }
   return {
     current: false,
+    verdict: "not-fetched",
     line: `Coding instructions are read directly from ${repository} at ${commit}; fetch that commit with your normal Git remote before continuing.`
   };
 }
@@ -16743,13 +17909,26 @@ async function runCheck(opts, format) {
           projectId: opts.project,
           destination,
           direct,
-          checkout: checkout?.json ?? null
+          // The same words and verdict as the text mode: the checkout
+          // block's own line knows nothing of a direct read.
+          checkout: checkout === null ? null : {
+            ...checkout.json,
+            line: status.current ? null : status.line,
+            verdict: status.verdict
+          },
+          verified: false
         },
         { format: "json" }
       );
-    } else if (!opts.hook || !status.current) {
-      process.stdout.write(`${status.line}
+    } else {
+      if (!opts.hook || !status.current) {
+        process.stdout.write(`${status.line}
+`);
+      }
+      if (opts.verify) {
+        process.stdout.write(`${NO_VERIFY_FOR_DIRECT}
 `);
+      }
     }
     return;
   }
@@ -16907,7 +18086,8 @@ async function runDoctorCommand(opts, format) {
       origin,
       home: machine.home(),
       env: machine.env(),
-      platform: machine.platform()
+      platform: machine.platform(),
+      probe: opts.probeNetwork ? gatewayProbeFor({ origin, projectId: opts.project }) : void 0
     }),
     client: () => instructionsClient({ ...opts, hook: false }, CHECK_TIMEOUT_MS),
     createDownloadUrl: (projectId, options) => downloadUrlClient({
@@ -17019,25 +18199,34 @@ async function syncOnce(opts) {
         7
       );
     }
-    const report = await reportForClassification({
-      classification: guard.checkout,
-      repository: directRepository,
-      snapshot: void 0,
-      deadline: gitDeadline()
-    });
-    const status = await directRepositoryCheckoutStatus({
-      repository: directRepository,
-      direct,
-      checkout: guard.checkout,
-      report
-    });
-    const gitTransport = opts.hook && direct.gitGateway?.version === "v1" ? await directGitTransport(opts, direct) : void 0;
+    const checkout = guard.checkout;
+    const report = await timedPhase(
+      "report",
+      () => reportForClassification({
+        classification: checkout,
+        repository: directRepository,
+        snapshot: void 0,
+        deadline: gitDeadline(),
+        contentChanges: opts.hook ? "when-behind" : "always"
+      })
+    );
+    const status = await timedPhase(
+      "status",
+      () => directRepositoryCheckoutStatus({
+        repository: directRepository,
+        direct,
+        checkout,
+        report
+      })
+    );
+    const lazyTransport = lazyGitTransport(opts, direct);
     const fastForward = opts.hook && guard.checkout.class === "matching" ? await runFastForward({
       classification: guard.checkout,
       repository: directRepository,
       snapshot: void 0,
       directCommitSha: direct.currentCommitSha,
-      ...gitTransport === void 0 ? {} : { gitTransport },
+      ...lazyTransport === void 0 ? {} : { gitTransport: lazyTransport.resolve },
+      timings: hookPhases,
       report: {
         ...report,
         reportKind: status.current ? "current" : "behind",
@@ -17046,8 +18235,10 @@ async function syncOnce(opts) {
       projectId: opts.project,
       deadline: gitDeadline(),
       optedOut: opts.fastForward === false,
-      traceFile: traceFile(path28.dirname(getConfigPath()))
+      traceFile: traceFile(path29.dirname(getConfigPath()))
     }) : null;
+    hookTraced = fastForward !== null;
+    lazyTransport?.rethrow();
     return {
       kind: "reported",
       destination: existing,
@@ -17066,12 +18257,17 @@ async function syncOnce(opts) {
     if (refused !== null) {
       throw refused;
     }
-    const report = await reportForClassification({
-      classification: guard.checkout,
-      repository: published.repository,
-      snapshot: published.snapshot,
-      deadline: gitDeadline()
-    });
+    const checkout = guard.checkout;
+    const report = await timedPhase(
+      "report",
+      () => reportForClassification({
+        classification: checkout,
+        repository: published.repository,
+        snapshot: published.snapshot,
+        deadline: gitDeadline(),
+        contentChanges: opts.hook ? "when-behind" : "always"
+      })
+    );
     const fastForward = opts.hook && guard.checkout.class === "matching" && published.repository ? await runFastForward({
       classification: guard.checkout,
       repository: published.repository,
@@ -17080,7 +18276,8 @@ async function syncOnce(opts) {
       projectId: opts.project,
       deadline: gitDeadline(),
       optedOut: opts.fastForward === false,
-      traceFile: traceFile(path28.dirname(getConfigPath()))
+      traceFile: traceFile(path29.dirname(getConfigPath())),
+      timings: hookPhases
     }) : null;
     return {
       kind: "reported",
@@ -17800,7 +18997,7 @@ async function runInit(opts, format) {
       );
       cloned = true;
       if (cloneFolder !== void 0 && checkout.class === "unmapped") {
-        destination = path28.join(checkout.toplevel, checkout.rootPath);
+        destination = path29.join(checkout.toplevel, checkout.rootPath);
         existing = await resolveExistingRoot(destination);
         checkout = await classifyCheckout({
           destination: existing,
@@ -17868,12 +19065,12 @@ async function runInit(opts, format) {
     throw outcomeFailure("lessons-need-claude", {});
   }
   if (matching !== null) {
-    const prefix = path28.relative(matching.toplevel, root);
+    const prefix = path29.relative(matching.toplevel, root);
     const relativeSetupPaths = [
       ...tools.tools.map(
-        (tool) => path28.join(prefix, hookPathFor(tool)).replaceAll(path28.sep, "/")
+        (tool) => path29.join(prefix, hookPathFor(tool)).replaceAll(path29.sep, "/")
       ),
-      path28.join(prefix, LOCK_DIRECTORY, LOCK_FILENAME).replaceAll(path28.sep, "/")
+      path29.join(prefix, LOCK_DIRECTORY, LOCK_FILENAME).replaceAll(path29.sep, "/")
     ];
     const tracked = await trackedPaths(
       matching.toplevel,
@@ -17912,7 +19109,7 @@ async function runInit(opts, format) {
   const applies = opts.reportOnly ? false : matching !== null ? true : Boolean(opts.apply);
   const launcher = await resolveHookLauncher({
     origin: deploymentOrigin(opts),
-    configDirectory: path28.dirname(getConfigPath()),
+    configDirectory: path29.dirname(getConfigPath()),
     lookup: { env: machine.env(), platform: machine.platform() },
     bundle: isServedBundle() ? { scriptPath: bundleScriptPath() } : null
   });
@@ -17955,6 +19152,10 @@ async function runInit(opts, format) {
     tools: tools.tools,
     projectId: opts.project,
     origin: deploymentOrigin(opts),
+    probe: gatewayProbeFor({
+      origin: deploymentOrigin(opts),
+      projectId: opts.project
+    }),
     cwd: toplevel ?? root,
     home: machine.home(),
     env: machine.env(),
@@ -17965,9 +19166,12 @@ async function runInit(opts, format) {
         platform: machine.platform()
       }
     }),
-    interactive: format !== "json" && canPrompt() && process.stdout.isTTY === true && !runningInCi()
+    interactive: format !== "json" && canPrompt() && process.stdout.isTTY === true && !runningInCi(),
+    checkSignIn: format !== "json"
   });
   const mcpComplete = !mcpRequested || mcpRegistrationComplete(mcp);
+  const mcpFailed = mcpRequested && mcpSetupFailed(mcp);
+  const mcpManual = mcpManualSteps(mcp);
   const mcpAuthPending = mcpAuthenticationPending(mcp);
   const first = hooks[0];
   if (format === "json") {
@@ -17989,12 +19193,14 @@ async function runInit(opts, format) {
         lessonsHook: Boolean(opts.lessons),
         mcpRequested,
         mcpComplete,
+        manualSteps: mcpManual,
         mcpAuthenticationPending: mcpAuthPending,
         mcp: mcp.map((result) => ({
           tool: result.tool,
           name: result.name,
           url: result.url,
           outcome: result.outcome.kind,
+          status: result.status,
           login: result.login,
           registerLine: result.registerLine,
           loginLine: result.loginLine
@@ -18006,7 +19212,7 @@ async function runInit(opts, format) {
       },
       { format: "json" }
     );
-    if (!mcpComplete) {
+    if (mcpFailed) {
       throw new CliFailure(
         "Coding tool setup is incomplete: the Fabric MCP server was not registered for every selected tool. Complete the action shown above, then run init again.",
         7
@@ -18059,7 +19265,10 @@ async function runInit(opts, format) {
   if (launcher.warning !== null) {
     line(launcher.warning);
   }
-  for (const mcpLine of agentMcpLines(mcp)) {
+  for (const mcpLine of [
+    ...agentMcpLines(mcp),
+    ...agentMcpSummaryLines(mcp)
+  ]) {
     line(mcpLine);
   }
   if (mcpAuthPending) {
@@ -18072,7 +19281,7 @@ async function runInit(opts, format) {
       outcomeLine("cloned-into", {
         where: folderForCommand(
           opts.dest,
-          path28.relative(
+          path29.relative(
             await resolveExistingRoot(destinationOf(opts)),
             root
           )
@@ -18080,7 +19289,7 @@ async function runInit(opts, format) {
       })
     );
   }
-  if (!mcpComplete) {
+  if (mcpFailed) {
     line(
       "The session hook was set up, but the Fabric MCP server was not registered for every selected tool."
     );
@@ -18118,8 +19327,8 @@ async function runLessonPromptCommand(opts) {
     stdinText = await readAllStdin(process.stdin);
   } catch {
   }
-  const markerDir = path28.join(
-    path28.dirname(getConfigPath()),
+  const markerDir = path29.join(
+    path29.dirname(getConfigPath()),
     "lesson-prompts"
   );
   const result = await runLessonPrompt({
@@ -19021,6 +20230,8 @@ function buildWorkspacesCommand() {
 }
 
 // src/bin/fabric.ts
+hookTiming.processStartedAt = Math.round(Date.now() - process.uptime() * 1e3);
+hookTiming.exitWhenDone = true;
 var program = new Command22();
 program.name("fabric").description("Fabric AI platform CLI").version(package_default.version).option(
   "--format <format>",