@fml-inc/fml 0.8.3 → 0.8.4-rc.2

package/dist/cli.js

@@ -2,21 +2,24 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "./chunk-26RJC76L.js";
+} from "./chunk-P4HOUZXC.js";
 import {
   OBSERVER_HEARTBEAT_STALE_MS,
+  execBinSync,
   getProcessIdentity,
+  handleUpdate,
   inspectObserverLease,
   isPidAlive,
   readObserverStateStatus,
-  removeObserverStateIfOwned
-} from "./chunk-3WDAKM5B.js";
+  removeObserverStateIfOwned,
+  resolveBin
+} from "./chunk-NP7HI4UC.js";
 import {
   readJsonFile,
   setHookCaptureDisabled,
   writeJsonFile,
   writeTextFileAtomic
-} from "./chunk-UZG65JUB.js";
+} from "./chunk-IIGTUGO5.js";
 import {
   CODEX_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
@@ -24,7 +27,7 @@ import {
   isObserverHealth,
   readHookInboxStatus,
   readObserverAuthToken
-} from "./chunk-F4A2POJX.js";
+} from "./chunk-732O7ISN.js";
 import "./chunk-7V7G7NVF.js";
 import {
   claudeConfigDirectory,
@@ -34,7 +37,7 @@ import {
   initializeSyncSettings,
   resolvePackageRoot,
   runRawSyncOnce
-} from "./chunk-UGUYQVUW.js";
+} from "./chunk-T3ZFT3QP.js";
 import {
   DEFAULT_PROD_URL,
   DEFAULT_TARGET_NAME,
@@ -76,11 +79,11 @@ import {
   storeServiceRefreshToken,
   writeEnvConfig,
   writeTokens
-} from "./chunk-TNJVAET3.js";
+} from "./chunk-ZBSC57CW.js";
 import "./chunk-MLKGABMK.js";
 
 // src/cli.ts
-import { Command } from "commander";
+import { Command, Option } from "commander";
 
 // src/commands/doctor.ts
 import { randomUUID } from "crypto";
@@ -124,7 +127,7 @@ var POLL_INTERVAL_MS = 50;
 var LOG_ROTATE_BYTES = 10 * 1024 * 1024;
 var LOG_ROTATE_FILES = 3;
 function expectedObserverVersion() {
-  return true ? "0.8.3+499a546c" : "dev";
+  return true ? "0.8.4-rc.2+f282df41" : "dev";
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -1062,9 +1065,9 @@ async function handleDoctor(opts) {
 }
 
 // src/commands/install.ts
-import fs10 from "fs";
+import fs9 from "fs";
 import os5 from "os";
-import path22 from "path";
+import path21 from "path";
 import { fileURLToPath } from "url";
 
 // ../../packages/agent-targets/src/install/claude/index.ts
@@ -1450,64 +1453,19 @@ var PI_EXTENSION_INSTALLER = Object.freeze({
   }
 });
 
-// src/bin-utils.ts
-import fs4 from "fs";
-import path5 from "path";
-import { execFileSync, execSync } from "child_process";
-var IS_WIN = process.platform === "win32";
-var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
-function resolveBin(name) {
-  const pathDirs = (process.env.PATH ?? "").split(path5.delimiter).filter(Boolean);
-  const hasExt = path5.extname(name) !== "";
-  const exts = !IS_WIN || hasExt ? [""] : (process.env.PATHEXT ?? DEFAULT_PATHEXT).split(";").filter(Boolean);
-  for (const dir of pathDirs) {
-    for (const ext of exts) {
-      const candidate = path5.join(dir, name + ext);
-      try {
-        if (fs4.statSync(candidate).isFile()) return candidate;
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-function isWinShim(bin) {
-  return IS_WIN && /\.(cmd|bat)$/i.test(bin);
-}
-function quoteWinArg(arg) {
-  if (arg.length === 0) return '""';
-  if (/^[A-Za-z0-9@\-_+=:/.,]+$/.test(arg)) return arg;
-  const crt = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1");
-  const quoted = `"${crt}"`;
-  return quoted.replace(/([()%!^<>&|"])/g, "^$1");
-}
-function execBinSync(bin, args, opts = {}) {
-  const {
-    timeout = 1e4,
-    encoding = "utf-8",
-    stdio = "pipe",
-    env = process.env
-  } = opts;
-  if (isWinShim(bin)) {
-    const command = [bin, ...args].map(quoteWinArg).join(" ");
-    return execSync(command, { timeout, encoding, stdio, env });
-  }
-  return execFileSync(bin, args, { timeout, encoding, stdio, env });
-}
-
 // src/managed-directories.ts
-import fs5 from "fs";
+import fs4 from "fs";
 import os from "os";
-import path6 from "path";
+import path5 from "path";
 var FML_MANAGED_DIRECTORY_MARKER = ".fml-managed-root";
 var FML_MANAGED_DIRECTORY_MARKER_CONTENT = "fml-managed-directory-v1\n";
 function comparisonPathApi(platform, targetPaths) {
   if (platform === "win32" && targetPaths.some(
     (targetPath) => /^[A-Za-z]:[\\/]/u.test(targetPath) || targetPath.startsWith("\\\\") || targetPath.startsWith("//")
   )) {
-    return path6.win32;
+    return path5.win32;
   }
-  return path6;
+  return path5;
 }
 function resolveComparisonPath(targetPath, platform) {
   return comparisonPathApi(platform, [targetPath]).resolve(targetPath);
@@ -1580,7 +1538,7 @@ function configuredManagedRoots(platform = process.platform) {
   );
 }
 function managedDirectoryMarker(directory) {
-  return path6.join(directory, FML_MANAGED_DIRECTORY_MARKER);
+  return path5.join(directory, FML_MANAGED_DIRECTORY_MARKER);
 }
 function ownershipStatus(stats, platform) {
   if (platform === "win32") return "unverifiable";
@@ -1591,8 +1549,8 @@ function ownershipStatus(stats, platform) {
 function hasManagedDirectoryMarkerContents(directory) {
   const marker = managedDirectoryMarker(directory);
   try {
-    const stats = fs5.lstatSync(marker);
-    return stats.isFile() && fs5.readFileSync(marker, "utf8") === FML_MANAGED_DIRECTORY_MARKER_CONTENT;
+    const stats = fs4.lstatSync(marker);
+    return stats.isFile() && fs4.readFileSync(marker, "utf8") === FML_MANAGED_DIRECTORY_MARKER_CONTENT;
   } catch {
     return false;
   }
@@ -1600,11 +1558,11 @@ function hasManagedDirectoryMarkerContents(directory) {
 function hasManagedDirectoryMarker(directory, platform = process.platform) {
   const marker = managedDirectoryMarker(directory);
   try {
-    const stats = fs5.lstatSync(marker);
+    const stats = fs4.lstatSync(marker);
     if (!stats.isFile() || ownershipStatus(stats, platform) !== "owned") {
       return false;
     }
-    return fs5.readFileSync(marker, "utf8") === FML_MANAGED_DIRECTORY_MARKER_CONTENT;
+    return fs4.readFileSync(marker, "utf8") === FML_MANAGED_DIRECTORY_MARKER_CONTENT;
   } catch {
     return false;
   }
@@ -1612,7 +1570,7 @@ function hasManagedDirectoryMarker(directory, platform = process.platform) {
 function writeManagedDirectoryMarker(directory, platform) {
   const marker = managedDirectoryMarker(directory);
   try {
-    fs5.writeFileSync(marker, FML_MANAGED_DIRECTORY_MARKER_CONTENT, {
+    fs4.writeFileSync(marker, FML_MANAGED_DIRECTORY_MARKER_CONTENT, {
       encoding: "utf8",
       flag: "wx",
       mode: 384
@@ -1637,23 +1595,23 @@ function prepareManagedDirectory(root, platform = process.platform) {
   let created = false;
   let existingStats = null;
   try {
-    existingStats = fs5.lstatSync(root.directory);
+    existingStats = fs4.lstatSync(root.directory);
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
     existed = false;
   }
   if (!existed) {
-    fs5.mkdirSync(path6.dirname(root.directory), {
+    fs4.mkdirSync(path5.dirname(root.directory), {
       recursive: true,
       mode: 448
     });
     try {
-      fs5.mkdirSync(root.directory, { mode: 448 });
+      fs4.mkdirSync(root.directory, { mode: 448 });
       created = true;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       existed = true;
-      existingStats = fs5.lstatSync(root.directory);
+      existingStats = fs4.lstatSync(root.directory);
     }
   }
   if (hasSymlinkedParentBelowTrustedAnchor(root.directory, platform)) {
@@ -1663,7 +1621,7 @@ function prepareManagedDirectory(root, platform = process.platform) {
       markerCreated: false
     };
   }
-  const directoryStats = existingStats ?? fs5.lstatSync(root.directory);
+  const directoryStats = existingStats ?? fs4.lstatSync(root.directory);
   const ownership = ownershipStatus(directoryStats, platform);
   const recognizedWindowsMarker = platform === "win32" && hasManagedDirectoryMarkerContents(root.directory);
   if (directoryStats.isSymbolicLink() || !directoryStats.isDirectory() || ownership === "foreign" || !root.nativeDefault && ownership !== "owned" && !(created && ownership === "unverifiable") && !recognizedWindowsMarker) {
@@ -1687,7 +1645,7 @@ function prepareManagedDirectory(root, platform = process.platform) {
       markerCreated: false
     };
   }
-  const mayClaim = fs5.readdirSync(root.directory).length === 0;
+  const mayClaim = fs4.readdirSync(root.directory).length === 0;
   if (!mayClaim) {
     return {
       directory: root.directory,
@@ -1746,7 +1704,7 @@ function hasSymlinkedParentBelowTrustedAnchor(targetPath, platform = process.pla
   for (const component of relativeParent.split(pathApi.sep)) {
     current = pathApi.join(current, component);
     try {
-      if (fs5.lstatSync(current).isSymbolicLink()) return true;
+      if (fs4.lstatSync(current).isSymbolicLink()) return true;
     } catch (error) {
       if (error.code === "ENOENT") return false;
       return true;
@@ -1771,7 +1729,7 @@ function unsafePurgeRoots(roots, platform = process.platform) {
     }
     let stats;
     try {
-      stats = fs5.lstatSync(root.directory);
+      stats = fs4.lstatSync(root.directory);
     } catch (error) {
       if (error.code === "ENOENT") continue;
       unsafe.push({
@@ -1820,14 +1778,14 @@ function unsafePurgeRoots(roots, platform = process.platform) {
 }
 
 // src/commands/hook-config.ts
-import fs6 from "fs";
+import fs5 from "fs";
 import os2 from "os";
-import path11 from "path";
+import path10 from "path";
 
 // ../../packages/agent-targets/src/install/hooks/codex.ts
 import { createHash } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-import path8 from "path";
+import path7 from "path";
 import { parse as parse2 } from "smol-toml";
 
 // ../../packages/agent-targets/src/toml.ts
@@ -1837,7 +1795,7 @@ function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function singlePath(value) {
-  const path30 = [];
+  const path29 = [];
   let current = value;
   while (true) {
     if (Array.isArray(current) && current.length === 1) {
@@ -1845,13 +1803,13 @@ function singlePath(value) {
       continue;
     }
     const record = asRecord2(current);
-    if (!record) return path30;
+    if (!record) return path29;
     const keys = Object.keys(record);
-    if (keys.length === 0) return path30;
+    if (keys.length === 0) return path29;
     if (keys.length !== 1) throw new Error("ambiguous TOML statement path");
     const key = keys[0];
     if (key === void 0) throw new Error("missing TOML statement key");
-    path30.push(key);
+    path29.push(key);
     current = record[key];
   }
 }
@@ -1933,8 +1891,8 @@ function scanStatements(source) {
   }
   return statements;
 }
-function startsWithPath(path30, prefix) {
-  return prefix.every((part, index) => path30[index] === part);
+function startsWithPath(path29, prefix) {
+  return prefix.every((part, index) => path29[index] === part);
 }
 function pathsEqual(left, right) {
   return left.length === right.length && left.every((part, index) => part === right[index]);
@@ -1960,9 +1918,9 @@ function appendToml(source, addition) {
 function hasOwn(record, key) {
   return Object.prototype.hasOwnProperty.call(record, key);
 }
-function updatedValueAtPath(updated, path30) {
+function updatedValueAtPath(updated, path29) {
   let current = updated;
-  for (const part of path30) {
+  for (const part of path29) {
     const record = asRecord2(current);
     if (!record || !hasOwn(record, part)) return { exists: false };
     current = record[part];
@@ -1976,22 +1934,22 @@ function normalizedPaths(updates) {
       throw new Error("TOML update path cannot be empty");
     }
     if (paths.some(
-      (path30) => pathsEqual(path30, update.path) || startsWithPath(update.path, path30)
+      (path29) => pathsEqual(path29, update.path) || startsWithPath(update.path, path29)
     )) {
       continue;
     }
     for (let index = paths.length - 1; index >= 0; index -= 1) {
-      const path30 = paths[index];
-      if (path30 && startsWithPath(path30, update.path)) paths.splice(index, 1);
+      const path29 = paths[index];
+      if (path29 && startsWithPath(path29, update.path)) paths.splice(index, 1);
     }
     paths.push([...update.path]);
   }
   return paths;
 }
-function valueDocument(path30, value) {
+function valueDocument(path29, value) {
   let nested = value;
-  for (let index = path30.length - 1; index >= 0; index -= 1) {
-    const part = path30[index];
+  for (let index = path29.length - 1; index >= 0; index -= 1) {
+    const part = path29[index];
     if (part === void 0) throw new Error("TOML update path is invalid");
     nested = { [part]: nested };
   }
@@ -2010,12 +1968,12 @@ function insertAfterStatement(source, statement, addition) {
   const separator = before.endsWith(eol) ? "" : eol;
   return `${before}${separator}${normalized}${eol}${source.slice(statement.end)}`;
 }
-function insertUpdatedValue(source, path30, value) {
-  const key = path30.at(-1);
+function insertUpdatedValue(source, path29, value) {
+  const key = path29.at(-1);
   if (key === void 0) throw new Error("TOML update path cannot be empty");
   const assignment = localAssignment(key, value);
   if (assignment !== null) {
-    const parent = path30.slice(0, -1);
+    const parent = path29.slice(0, -1);
     const parentTables = scanStatements(source).filter(
       (statement) => statement.isTable && pathsEqual(statement.path, parent)
     );
@@ -2029,17 +1987,17 @@ function insertUpdatedValue(source, path30, value) {
       return insertAfterStatement(source, parentTable, assignment);
     }
   }
-  return appendToml(source, stringify(valueDocument(path30, value)));
+  return appendToml(source, stringify(valueDocument(path29, value)));
 }
 function updateTomlPaths(source, updated, updates) {
   const paths = normalizedPaths(updates);
   if (paths.length === 0) return source;
   const stripped = removeStatements(source, scanStatements(source), paths);
   let result = stripped;
-  for (const path30 of paths) {
-    const next = updatedValueAtPath(updated, path30);
+  for (const path29 of paths) {
+    const next = updatedValueAtPath(updated, path29);
     if (!next.exists) continue;
-    result = insertUpdatedValue(result, path30, next.value);
+    result = insertUpdatedValue(result, path29, next.value);
   }
   let reparsed;
   try {
@@ -2058,7 +2016,7 @@ function updateTomlPaths(source, updated, updates) {
 }
 
 // ../../packages/agent-targets/src/install/hooks/shared.ts
-import path7 from "path";
+import path6 from "path";
 function asRecord3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -2118,7 +2076,7 @@ function changedMutation(snapshot, after) {
   return before === after ? null : { path: snapshot.path, before, after };
 }
 function fmlHookCommand(pluginRoot, target2) {
-  const handlerPath = path7.join(pluginRoot, "bin", "hook-handler");
+  const handlerPath = path6.join(pluginRoot, "bin", "hook-handler");
   const encodedPath = Buffer.from(handlerPath, "utf8").toString("base64url");
   return `node -e "${FML_HOOK_LOADER}" ${encodedPath} ${target2}`;
 }
@@ -2231,11 +2189,11 @@ function uniquePaths(paths) {
 function codexPaths(context) {
   const configuredHome = context.env.CODEX_HOME;
   const trimmedHome = typeof configuredHome === "string" ? configuredHome.trim() : "";
-  const dir = path8.resolve(
-    trimmedHome.length > 0 ? trimmedHome : path8.join(context.homeDir, ".codex")
+  const dir = path7.resolve(
+    trimmedHome.length > 0 ? trimmedHome : path7.join(context.homeDir, ".codex")
   );
-  const configPath4 = path8.join(dir, "config.toml");
-  const hooksPath = path8.join(dir, "hooks.json");
+  const configPath4 = path7.join(dir, "config.toml");
+  const hooksPath = path7.join(dir, "hooks.json");
   return {
     configPath: configPath4,
     hooksPath,
@@ -2667,7 +2625,7 @@ function codexConfigUpdatePaths(original, updated) {
       }
     }
   }
-  return paths.map((path30) => ({ path: path30 }));
+  return paths.map((path29) => ({ path: path29 }));
 }
 function updateCodexConfigToml(source, original, updated) {
   return updateTomlPaths(
@@ -3117,7 +3075,7 @@ var CODEX_HOOK_INSTALLER = Object.freeze({
 
 // ../../packages/agent-targets/src/install/hooks/gemini.ts
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
-import path9 from "path";
+import path8 from "path";
 
 // ../../packages/agent-targets/src/mcp/jsonc.ts
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
@@ -3173,7 +3131,7 @@ function longestCommonArraySubsequence(original, updated) {
   }
   return matches;
 }
-function arrayDiff(original, updated, path30) {
+function arrayDiff(original, updated, path29) {
   const updates = [];
   const matches = longestCommonArraySubsequence(original, updated);
   let originalStart = 0;
@@ -3191,19 +3149,19 @@ function arrayDiff(original, updated, path30) {
         ...jsoncUpdatesForObjectDiff(
           original[originalStart + offset],
           updated[updatedStart + offset],
-          [...path30, currentIndex + offset]
+          [...path29, currentIndex + offset]
         )
       );
     }
     for (let offset = pairedCount; offset < originalCount; offset += 1) {
       updates.push({
-        path: [...path30, currentIndex + pairedCount],
+        path: [...path29, currentIndex + pairedCount],
         value: void 0
       });
     }
     for (let offset = pairedCount; offset < updatedCount; offset += 1) {
       updates.push({
-        path: [...path30, currentIndex + offset],
+        path: [...path29, currentIndex + offset],
         value: updated[updatedStart + offset],
         isArrayInsertion: true
       });
@@ -3216,21 +3174,21 @@ function arrayDiff(original, updated, path30) {
   }
   return updates;
 }
-function jsoncUpdatesForObjectDiff(original, updated, path30 = []) {
+function jsoncUpdatesForObjectDiff(original, updated, path29 = []) {
   if (isDeepStrictEqual3(original, updated)) return [];
   if (Array.isArray(original) && Array.isArray(updated)) {
-    return arrayDiff(original, updated, path30);
+    return arrayDiff(original, updated, path29);
   }
   const originalObject = asObject(original);
   const updatedObject = asObject(updated);
-  if (!originalObject || !updatedObject) return [{ path: path30, value: updated }];
+  if (!originalObject || !updatedObject) return [{ path: path29, value: updated }];
   const keys = /* @__PURE__ */ new Set([
     ...Object.keys(originalObject),
     ...Object.keys(updatedObject)
   ]);
   return [...keys].flatMap(
     (key) => jsoncUpdatesForObjectDiff(originalObject[key], updatedObject[key], [
-      ...path30,
+      ...path29,
       key
     ])
   );
@@ -3278,7 +3236,7 @@ var TARGET_ID3 = TARGET3.id;
 var DISPLAY_NAME3 = TARGET3.displayName;
 var MANAGED_HOOK_NAME = "fml-capture";
 function settingsPath(context) {
-  return path9.join(geminiConfigDirectory(context), "settings.json");
+  return path8.join(geminiConfigDirectory(context), "settings.json");
 }
 function readGeminiSettings(snapshot) {
   const failure = snapshotError(snapshot);
@@ -3511,15 +3469,15 @@ var GEMINI_HOOK_INSTALLER = Object.freeze({
 });
 
 // ../../packages/agent-targets/src/install/hooks/grok.ts
-import path10 from "path";
+import path9 from "path";
 var TARGET4 = agentTarget("grok");
 var TARGET_ID4 = TARGET4.id;
 var DISPLAY_NAME4 = TARGET4.displayName;
 var HOOK_TIMEOUT_SECONDS2 = 10;
 function grokHooksPath(context) {
   const configuredHome = context.env.GROK_HOME?.trim();
-  const grokHome = configuredHome ? path10.resolve(configuredHome) : path10.join(context.homeDir, ".grok");
-  return path10.join(grokHome, "hooks", "fml.json");
+  const grokHome = configuredHome ? path9.resolve(configuredHome) : path9.join(context.homeDir, ".grok");
+  return path9.join(grokHome, "hooks", "fml.json");
 }
 function planInstall3(context) {
   const configPath4 = grokHooksPath(context);
@@ -3638,14 +3596,14 @@ var HOOK_REGISTRATION_CAPABILITIES = Object.freeze([
 ]);
 
 // src/commands/hook-config.ts
-var DEFAULT_CODEX_HOOK_OWNERSHIP_STATE_PATH = path11.join(
+var DEFAULT_CODEX_HOOK_OWNERSHIP_STATE_PATH = path10.join(
   FML_DATA_DIR,
   "codex-hook-install.json"
 );
 function readHookFile(filePath) {
   let stat;
   try {
-    stat = fs6.lstatSync(filePath);
+    stat = fs5.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") {
       return { path: filePath, kind: "missing" };
@@ -3674,7 +3632,7 @@ function readHookFile(filePath) {
     return {
       path: filePath,
       kind: "file",
-      contents: fs6.readFileSync(filePath, "utf8")
+      contents: fs5.readFileSync(filePath, "utf8")
     };
   } catch (error) {
     return {
@@ -3686,17 +3644,17 @@ function readHookFile(filePath) {
 }
 function canonicalizePath(filePath) {
   try {
-    return fs6.realpathSync(filePath);
+    return fs5.realpathSync(filePath);
   } catch {
     const missingSegments = [];
     let ancestor = filePath;
     while (true) {
-      const parent = path11.dirname(ancestor);
+      const parent = path10.dirname(ancestor);
       if (parent === ancestor) return filePath;
-      missingSegments.unshift(path11.basename(ancestor));
+      missingSegments.unshift(path10.basename(ancestor));
       ancestor = parent;
       try {
-        return path11.join(fs6.realpathSync(ancestor), ...missingSegments);
+        return path10.join(fs5.realpathSync(ancestor), ...missingSegments);
       } catch {
       }
     }
@@ -3715,7 +3673,7 @@ function assertMutationPrecondition(mutation) {
 }
 function applyMutation(mutation) {
   if (mutation.after === null) {
-    fs6.rmSync(mutation.path);
+    fs5.rmSync(mutation.path);
   } else {
     writeTextFileAtomic(mutation.path, mutation.after);
   }
@@ -3728,7 +3686,7 @@ function rollbackMutation(mutation) {
   };
   assertMutationPrecondition(inverse);
   if (inverse.after === null) {
-    fs6.rmSync(inverse.path);
+    fs5.rmSync(inverse.path);
   } else {
     writeTextFileAtomic(inverse.path, inverse.after);
   }
@@ -3796,7 +3754,7 @@ function applyPlan(plan, warn, onFailure) {
   };
 }
 function plannerContext(packageRoot, options) {
-  const ownershipStatePath = options.ownershipStatePath ?? (options.homeDir ? path11.join(options.homeDir, ".fml", "codex-hook-install.json") : DEFAULT_CODEX_HOOK_OWNERSHIP_STATE_PATH);
+  const ownershipStatePath = options.ownershipStatePath ?? (options.homeDir ? path10.join(options.homeDir, ".fml", "codex-hook-install.json") : DEFAULT_CODEX_HOOK_OWNERSHIP_STATE_PATH);
   return {
     packageRoot,
     homeDir: options.homeDir ?? os2.homedir(),
@@ -3827,10 +3785,10 @@ function removeFmlHooks(options = {}) {
 }
 
 // src/commands/marketplace-link.ts
-import fs7 from "fs";
+import fs6 from "fs";
 function existingPathKind(linkPath) {
   try {
-    return fs7.lstatSync(linkPath).isSymbolicLink() ? "symlink" : "other";
+    return fs6.lstatSync(linkPath).isSymbolicLink() ? "symlink" : "other";
   } catch (error) {
     if (error.code === "ENOENT") return "missing";
     throw error;
@@ -3839,15 +3797,15 @@ function existingPathKind(linkPath) {
 function replaceMarketplaceLink(linkPath, targetPath, type) {
   const existing = existingPathKind(linkPath);
   if (existing === "other") return "preserved";
-  if (existing === "symlink") fs7.unlinkSync(linkPath);
-  fs7.symlinkSync(targetPath, linkPath, type);
+  if (existing === "symlink") fs6.unlinkSync(linkPath);
+  fs6.symlinkSync(targetPath, linkPath, type);
   return existing === "symlink" ? "replaced" : "created";
 }
 function removeMarketplaceLink(linkPath) {
   const existing = existingPathKind(linkPath);
   if (existing === "missing") return "missing";
   if (existing === "other") return "preserved";
-  fs7.unlinkSync(linkPath);
+  fs6.unlinkSync(linkPath);
   return "removed";
 }
 
@@ -3942,10 +3900,10 @@ function configRecord(value) {
 }
 
 // ../../packages/agent-targets/src/mcp/targets/claude-desktop.ts
-import path13 from "path";
+import path12 from "path";
 
 // ../../packages/agent-targets/src/mcp/capability.ts
-import path12 from "path";
+import path11 from "path";
 import { parse as parse4 } from "smol-toml";
 
 // ../../packages/agent-targets/src/mcp/toml.ts
@@ -4051,7 +4009,7 @@ function changedConfigPlan(target2, current, before, data) {
 function generatedServer(target2, context) {
   return fmlMcpServerConfig(
     target2.command,
-    path12.join(context.packageRoot, "bin", "mcp-server")
+    path11.join(context.packageRoot, "bin", "mcp-server")
   );
 }
 function planInstall4(target2, context) {
@@ -4131,7 +4089,7 @@ var CLAUDE_DESKTOP_DIRECT_MCP = createDirectMcpCapability({
   configKey: "mcpServers",
   configPath: ({ env, homeDir, platform }) => {
     if (platform === "darwin") {
-      return path13.join(
+      return path12.join(
         homeDir,
         "Library",
         "Application Support",
@@ -4140,14 +4098,14 @@ var CLAUDE_DESKTOP_DIRECT_MCP = createDirectMcpCapability({
       );
     }
     if (platform === "win32") {
-      return path13.join(
-        env.APPDATA ?? path13.join(homeDir, "AppData", "Roaming"),
+      return path12.join(
+        env.APPDATA ?? path12.join(homeDir, "AppData", "Roaming"),
         "Claude",
         "claude_desktop_config.json"
       );
     }
-    return path13.join(
-      env.XDG_CONFIG_HOME ?? path13.join(homeDir, ".config"),
+    return path12.join(
+      env.XDG_CONFIG_HOME ?? path12.join(homeDir, ".config"),
       "Claude",
       "claude_desktop_config.json"
     );
@@ -4156,7 +4114,7 @@ var CLAUDE_DESKTOP_DIRECT_MCP = createDirectMcpCapability({
 });
 
 // ../../packages/agent-targets/src/mcp/targets/codex.ts
-import path14 from "path";
+import path13 from "path";
 var TARGET6 = agentTarget("codex");
 var CODEX_DIRECT_MCP = createDirectMcpCapability({
   targetId: TARGET6.id,
@@ -4165,26 +4123,26 @@ var CODEX_DIRECT_MCP = createDirectMcpCapability({
   configKey: "mcp_servers",
   configPath: ({ env, homeDir }) => {
     const configuredHome = env.CODEX_HOME;
-    const codexHome = typeof configuredHome === "string" && configuredHome.length > 0 ? path14.resolve(configuredHome) : path14.join(homeDir, ".codex");
-    return path14.join(codexHome, "config.toml");
+    const codexHome = typeof configuredHome === "string" && configuredHome.length > 0 ? path13.resolve(configuredHome) : path13.join(homeDir, ".codex");
+    return path13.join(codexHome, "config.toml");
   },
   command: () => "node"
 });
 
 // ../../packages/agent-targets/src/mcp/targets/gemini.ts
-import path15 from "path";
+import path14 from "path";
 var TARGET7 = agentTarget("gemini");
 var GEMINI_DIRECT_MCP = createDirectMcpCapability({
   targetId: TARGET7.id,
   displayName: TARGET7.displayName,
   configFormat: "json",
   configKey: "mcpServers",
-  configPath: (context) => path15.join(geminiConfigDirectory(context), "settings.json"),
+  configPath: (context) => path14.join(geminiConfigDirectory(context), "settings.json"),
   command: () => "node"
 });
 
 // ../../packages/agent-targets/src/mcp/targets/grok.ts
-import path16 from "path";
+import path15 from "path";
 var TARGET8 = agentTarget("grok");
 var GROK_DIRECT_MCP = createDirectMcpCapability({
   targetId: TARGET8.id,
@@ -4193,8 +4151,8 @@ var GROK_DIRECT_MCP = createDirectMcpCapability({
   configKey: "mcp_servers",
   configPath: ({ env, homeDir }) => {
     const configuredHome = env.GROK_HOME;
-    const grokHome = typeof configuredHome === "string" && configuredHome.length > 0 ? path16.resolve(configuredHome) : path16.join(homeDir, ".grok");
-    return path16.join(grokHome, "config.toml");
+    const grokHome = typeof configuredHome === "string" && configuredHome.length > 0 ? path15.resolve(configuredHome) : path15.join(homeDir, ".grok");
+    return path15.join(grokHome, "config.toml");
   },
   command: () => "node"
 });
@@ -4208,7 +4166,7 @@ var DIRECT_MCP_CAPABILITIES = Object.freeze([
 ]);
 
 // src/commands/mcp-config.ts
-import fs8 from "fs";
+import fs7 from "fs";
 import os3 from "os";
 function resolutionContext(options) {
   return {
@@ -4221,7 +4179,7 @@ function resolutionContext(options) {
 function readMcpFile(filePath) {
   let stat;
   try {
-    stat = fs8.lstatSync(filePath);
+    stat = fs7.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") {
       return { path: filePath, kind: "missing" };
@@ -4250,7 +4208,7 @@ function readMcpFile(filePath) {
     return {
       path: filePath,
       kind: "file",
-      contents: fs8.readFileSync(filePath, "utf8")
+      contents: fs7.readFileSync(filePath, "utf8")
     };
   } catch (error) {
     return {
@@ -4286,14 +4244,14 @@ function preflightMutation(mutation) {
 }
 function writeMutation(mutation) {
   if (mutation.after === null) {
-    fs8.rmSync(mutation.path, { force: true });
+    fs7.rmSync(mutation.path, { force: true });
     return;
   }
   writeTextFileAtomic(mutation.path, mutation.after);
 }
 function rollbackMutation2(mutation) {
   if (mutation.before === null) {
-    fs8.rmSync(mutation.path, { force: true });
+    fs7.rmSync(mutation.path, { force: true });
     return;
   }
   writeTextFileAtomic(mutation.path, mutation.before);
@@ -4384,12 +4342,12 @@ function removeFmlDirectMcp(target2 = "all", options = {}) {
 
 // src/commands/agent-skills.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import fs9 from "fs";
+import fs8 from "fs";
 import os4 from "os";
-import path21 from "path";
+import path20 from "path";
 
 // ../../packages/agent-targets/src/install/surfaces/capability.ts
-import path17 from "path";
+import path16 from "path";
 var SOURCE_PATH_SEGMENTS = ["agent-assets", "fml", "SKILL.md"];
 var DESTINATION_PATH_SEGMENTS = ["skills", "fml", "SKILL.md"];
 function createAgentSkillCapability(definition) {
@@ -4402,8 +4360,8 @@ function createAgentSkillCapability(definition) {
     resolve: (context) => Object.freeze({
       targetId: definition.targetId,
       displayName: definition.displayName,
-      sourcePath: path17.join(context.packageRoot, ...SOURCE_PATH_SEGMENTS),
-      destinationPath: path17.join(
+      sourcePath: path16.join(context.packageRoot, ...SOURCE_PATH_SEGMENTS),
+      destinationPath: path16.join(
         definition.destinationRoot(context),
         ...DESTINATION_PATH_SEGMENTS
       ),
@@ -4426,7 +4384,7 @@ var CLAUDE_AGENT_SKILL = createAgentSkillCapability({
 });
 
 // ../../packages/agent-targets/src/install/surfaces/targets/codex.ts
-import path18 from "path";
+import path17 from "path";
 var TARGET10 = agentTarget("codex");
 var CODEX_AGENT_SKILL = createAgentSkillCapability({
   targetId: TARGET10.id,
@@ -4434,11 +4392,11 @@ var CODEX_AGENT_SKILL = createAgentSkillCapability({
   invocation: "$fml",
   deliveryMode: "instruction-read",
   argumentMode: "user-input",
-  destinationRoot: ({ homeDir }) => path18.join(homeDir, ".agents")
+  destinationRoot: ({ homeDir }) => path17.join(homeDir, ".agents")
 });
 
 // ../../packages/agent-targets/src/install/surfaces/targets/gemini.ts
-import path19 from "path";
+import path18 from "path";
 var TARGET11 = agentTarget("gemini");
 var GEMINI_AGENT_SKILL = createAgentSkillCapability({
   targetId: TARGET11.id,
@@ -4448,13 +4406,13 @@ var GEMINI_AGENT_SKILL = createAgentSkillCapability({
   argumentMode: "post-submit-prompt",
   destinationRoot: ({ env, homeDir }) => {
     const configuredHome = env.GEMINI_CLI_HOME?.trim();
-    const homeRoot = configuredHome ? path19.resolve(configuredHome) : homeDir;
-    return path19.join(homeRoot, ".agents");
+    const homeRoot = configuredHome ? path18.resolve(configuredHome) : homeDir;
+    return path18.join(homeRoot, ".agents");
   }
 });
 
 // ../../packages/agent-targets/src/install/surfaces/targets/grok.ts
-import path20 from "path";
+import path19 from "path";
 var TARGET12 = agentTarget("grok");
 var GROK_AGENT_SKILL = createAgentSkillCapability({
   targetId: TARGET12.id,
@@ -4462,7 +4420,7 @@ var GROK_AGENT_SKILL = createAgentSkillCapability({
   invocation: "/fml",
   deliveryMode: "prompt-expansion",
   argumentMode: "template-or-append",
-  destinationRoot: ({ homeDir }) => path20.join(homeDir, ".agents")
+  destinationRoot: ({ homeDir }) => path19.join(homeDir, ".agents")
 });
 
 // ../../packages/agent-targets/src/install/surfaces/registry.ts
@@ -4476,7 +4434,7 @@ var AGENT_SKILL_CAPABILITIES = Object.freeze([
 // src/commands/agent-skills.ts
 var FML_AGENT_SKILL_MARKER = "<!-- fml-managed-agent-surface:v1 -->";
 var AGENT_SKILL_STATE_SCHEMA_VERSION = 1;
-var DEFAULT_STATE_PATH = path21.join(FML_DATA_DIR, "agent-skills.json");
+var DEFAULT_STATE_PATH = path20.join(FML_DATA_DIR, "agent-skills.json");
 function emptyState() {
   return Object.freeze({
     schemaVersion: AGENT_SKILL_STATE_SCHEMA_VERSION,
@@ -4489,7 +4447,7 @@ function sha256(contents) {
 function readSkillFile(filePath) {
   let stat;
   try {
-    stat = fs9.lstatSync(filePath);
+    stat = fs8.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") {
       return { kind: "missing" };
@@ -4512,7 +4470,7 @@ function readSkillFile(filePath) {
     };
   }
   try {
-    const contents = fs9.readFileSync(filePath, "utf8");
+    const contents = fs8.readFileSync(filePath, "utf8");
     return { kind: "file", contents, sha256: sha256(contents) };
   } catch (error) {
     return {
@@ -4581,7 +4539,7 @@ function parseState(source, statePath) {
     }
     entries.push(
       Object.freeze({
-        path: path21.resolve(entry.path),
+        path: path20.resolve(entry.path),
         sha256: entry.sha256,
         targetIds: Object.freeze([...entry.targetIds])
       })
@@ -4607,7 +4565,7 @@ function loadState(statePath) {
 }
 function serializeState(entries) {
   const sorted = [...entries].map((entry) => ({
-    path: path21.resolve(entry.path),
+    path: path20.resolve(entry.path),
     sha256: entry.sha256,
     targetIds: [...entry.targetIds].sort()
   })).sort((left, right) => left.path.localeCompare(right.path));
@@ -4646,7 +4604,7 @@ function resolvedGroups(pluginRoot, options) {
   const groups = /* @__PURE__ */ new Map();
   for (const capability of AGENT_SKILL_CAPABILITIES) {
     const resolved = capability.resolve(context);
-    const destinationPath = path21.resolve(resolved.destinationPath);
+    const destinationPath = path20.resolve(resolved.destinationPath);
     const key = process.platform === "win32" ? destinationPath.toLowerCase() : destinationPath;
     const current = groups.get(key) ?? [];
     current.push({ ...resolved, destinationPath });
@@ -4683,10 +4641,10 @@ function resultFor(group, status, reason) {
   });
 }
 function destinationDirectoryIssue(destinationPath, requireEmpty) {
-  const skillDir = path21.dirname(destinationPath);
+  const skillDir = path20.dirname(destinationPath);
   let stat;
   try {
-    stat = fs9.lstatSync(skillDir);
+    stat = fs8.lstatSync(skillDir);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     return error instanceof Error ? error.message : String(error);
@@ -4694,7 +4652,7 @@ function destinationDirectoryIssue(destinationPath, requireEmpty) {
   if (stat.isSymbolicLink()) return "skill directory is a symbolic link";
   if (!stat.isDirectory()) return "skill directory is not a directory";
   try {
-    if (!requireEmpty || fs9.readdirSync(skillDir).length === 0) return null;
+    if (!requireEmpty || fs8.readdirSync(skillDir).length === 0) return null;
     return "skill directory contains unmanaged files";
   } catch (error) {
     return error instanceof Error ? error.message : String(error);
@@ -4711,9 +4669,9 @@ function rollbackSkillWrite(destinationPath, before) {
     writeTextFileAtomic(destinationPath, before.contents);
     return;
   }
-  fs9.rmSync(destinationPath, { force: true });
+  fs8.rmSync(destinationPath, { force: true });
   try {
-    fs9.rmdirSync(path21.dirname(destinationPath));
+    fs8.rmdirSync(path20.dirname(destinationPath));
   } catch {
   }
 }
@@ -4756,12 +4714,12 @@ function installManagedAgentSkills(pluginRoot, options = {}) {
   const loaded = loadState(statePath);
   let stateSource = loaded.source;
   const entries = new Map(
-    loaded.state.entries.map((entry) => [path21.resolve(entry.path), entry])
+    loaded.state.entries.map((entry) => [path20.resolve(entry.path), entry])
   );
   const results = [];
   for (const group of resolvedGroups(pluginRoot, options)) {
     const source = sourceSkill(group.sourcePath);
-    const destinationPath = path21.resolve(group.destinationPath);
+    const destinationPath = path20.resolve(group.destinationPath);
     const current = readSkillFile(destinationPath);
     const previous = entries.get(destinationPath);
     const nextEntry = stateEntryFor(
@@ -4846,11 +4804,11 @@ function removeSkillFile(args) {
       `Agent skill changed before ${args.destinationPath} could be removed.`
     );
   }
-  const backupPath = path21.join(
-    path21.dirname(args.destinationPath),
-    `.${path21.basename(args.destinationPath)}.${process.pid}.${randomUUID3()}.bak`
+  const backupPath = path20.join(
+    path20.dirname(args.destinationPath),
+    `.${path20.basename(args.destinationPath)}.${process.pid}.${randomUUID3()}.bak`
   );
-  fs9.renameSync(args.destinationPath, backupPath);
+  fs8.renameSync(args.destinationPath, backupPath);
   let stateSource;
   try {
     stateSource = writeState(
@@ -4860,7 +4818,7 @@ function removeSkillFile(args) {
     );
   } catch (error) {
     try {
-      fs9.renameSync(backupPath, args.destinationPath);
+      fs8.renameSync(backupPath, args.destinationPath);
     } catch (rollbackError) {
       const message = error instanceof Error ? error.message : String(error);
       const rollbackMessage = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
@@ -4872,12 +4830,12 @@ function removeSkillFile(args) {
   }
   let warning;
   try {
-    fs9.rmSync(backupPath, { force: true });
+    fs8.rmSync(backupPath, { force: true });
   } catch (error) {
     warning = `agent skill removal was committed, but backup cleanup failed at ${backupPath}: ${error instanceof Error ? error.message : String(error)}`;
   }
   try {
-    fs9.rmdirSync(path21.dirname(args.destinationPath));
+    fs8.rmdirSync(path20.dirname(args.destinationPath));
   } catch {
   }
   return { stateSource, ...warning ? { warning } : {} };
@@ -4887,16 +4845,16 @@ function removeManagedAgentSkills(pluginRoot, options = {}) {
   const loaded = loadState(statePath);
   let stateSource = loaded.source;
   const entries = new Map(
-    loaded.state.entries.map((entry) => [path21.resolve(entry.path), entry])
+    loaded.state.entries.map((entry) => [path20.resolve(entry.path), entry])
   );
   const candidates = /* @__PURE__ */ new Map();
   const currentGroups = resolvedGroups(pluginRoot, options);
-  const packagedSourcePath = currentGroups[0]?.sourcePath ?? path21.join(pluginRoot, "agent-assets", "fml", "SKILL.md");
+  const packagedSourcePath = currentGroups[0]?.sourcePath ?? path20.join(pluginRoot, "agent-assets", "fml", "SKILL.md");
   for (const group of currentGroups) {
-    candidates.set(path21.resolve(group.destinationPath), group);
+    candidates.set(path20.resolve(group.destinationPath), group);
   }
   for (const entry of entries.values()) {
-    const destinationPath = path21.resolve(entry.path);
+    const destinationPath = path20.resolve(entry.path);
     if (candidates.has(destinationPath)) continue;
     const targets = entry.targetIds.filter(isAgentSkillTargetId).map(targetForId);
     if (targets.length === 0) continue;
@@ -4911,7 +4869,7 @@ function removeManagedAgentSkills(pluginRoot, options = {}) {
   for (const group of [...candidates.values()].sort(
     (left, right) => left.destinationPath.localeCompare(right.destinationPath)
   )) {
-    const destinationPath = path21.resolve(group.destinationPath);
+    const destinationPath = path20.resolve(group.destinationPath);
     const current = readSkillFile(destinationPath);
     const previous = entries.get(destinationPath);
     if (current.kind === "missing") {
@@ -4969,13 +4927,13 @@ function removeManagedAgentSkills(pluginRoot, options = {}) {
 }
 
 // src/commands/install.ts
-function resolvePluginRoot(startDir = path22.dirname(fileURLToPath(import.meta.url))) {
+function resolvePluginRoot(startDir = path21.dirname(fileURLToPath(import.meta.url))) {
   let directory = startDir;
   while (true) {
-    if (fs10.existsSync(path22.join(directory, "package.json")) && fs10.existsSync(path22.join(directory, "bin"))) {
+    if (fs9.existsSync(path21.join(directory, "package.json")) && fs9.existsSync(path21.join(directory, "bin"))) {
       return directory;
     }
-    const parent = path22.dirname(directory);
+    const parent = path21.dirname(directory);
     if (parent === directory) {
       throw new Error(
         `Could not locate the FML package root: no ancestor of ${startDir} contains both package.json and bin/. Reinstall @fml-inc/fml and retry.`
@@ -4990,7 +4948,7 @@ function getPluginRoot() {
 function readJsonFileForUpdate(filePath) {
   let source;
   try {
-    source = fs10.readFileSync(filePath, "utf8");
+    source = fs9.readFileSync(filePath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return { ok: true, exists: false, data: {} };
@@ -5054,9 +5012,9 @@ async function handleInstall(opts = {}) {
     FML_LOG_DIR,
     FML_OBSERVER_DIR
   ])) {
-    fs10.mkdirSync(directory, { recursive: true, mode: 448 });
+    fs9.mkdirSync(directory, { recursive: true, mode: 448 });
   }
-  initializeSyncSettings(path22.join(FML_OBSERVER_DIR, "sync.json"));
+  initializeSyncSettings(path21.join(FML_OBSERVER_DIR, "sync.json"));
   let skillReady = false;
   try {
     const skillResults = installManagedAgentSkills(pluginRoot);
@@ -5103,7 +5061,7 @@ async function handleInstall(opts = {}) {
       `      warn: Pi extension setup could not be completed: ${message}`
     );
   }
-  const packageJson = readJsonFile(path22.join(pluginRoot, "package.json"));
+  const packageJson = readJsonFile(path21.join(pluginRoot, "package.json"));
   const generatedManifest = readJsonFile(paths.pluginManifestPath);
   const version = typeof generatedManifest?.version === "string" ? generatedManifest.version : typeof packageJson?.version === "string" ? packageJson.version : "0.0.0-dev";
   writeJsonFile(
@@ -5120,7 +5078,7 @@ async function handleInstall(opts = {}) {
       `Warning: preserved unreadable marketplace config ${paths.marketplaceManifestPath}: ${marketplaceResult.error}`
     );
   } else {
-    fs10.mkdirSync(paths.marketplaceDir, { recursive: true, mode: 448 });
+    fs9.mkdirSync(paths.marketplaceDir, { recursive: true, mode: 448 });
     const linkUpdate = replaceMarketplaceLink(
       paths.marketplaceLinkPath,
       pluginRoot,
@@ -5229,12 +5187,12 @@ async function handleInstall(opts = {}) {
 import { statSync } from "fs";
 
 // src/commands/otel-config.ts
-import fs12 from "fs";
+import fs11 from "fs";
 import os6 from "os";
-import path27 from "path";
+import path26 from "path";
 
 // ../../packages/agent-targets/src/install/otel/claude.ts
-import path23 from "path";
+import path22 from "path";
 
 // ../../packages/agent-targets/src/install/otel/shared.ts
 import { isDeepStrictEqual as isDeepStrictEqual7 } from "util";
@@ -5371,9 +5329,9 @@ var MANAGED_MARKER = "FML_OTEL_MANAGED";
 var CLAUDE_OTEL_SOURCE_LIMITATION = "Claude Code may truncate inline raw API bodies and tool content at 60 KiB and redact extended-thinking content before export";
 function configPath(context) {
   if (context.configPathOverride) {
-    return path23.resolve(context.configPathOverride);
+    return path22.resolve(context.configPathOverride);
   }
-  return path23.join(
+  return path22.join(
     claudeConfigDirectory({ env: context.env, homeDir: context.homeDir }),
     "settings.json"
   );
@@ -5544,7 +5502,7 @@ var CLAUDE_OTEL_INSTALLER = Object.freeze({
 
 // ../../packages/agent-targets/src/install/otel/codex.ts
 import { isDeepStrictEqual as isDeepStrictEqual8 } from "util";
-import path24 from "path";
+import path23 from "path";
 import { parse as parse5 } from "smol-toml";
 var TARGET14 = agentTarget("codex");
 var TARGET_ID6 = TARGET14.id;
@@ -5553,13 +5511,13 @@ var AUTHENTICATION2 = "bearer-header";
 var CODEX_OTEL_SOURCE_LIMITATION = "Codex OTel has no documented raw API body or full tool-content export switch; tool-result content is an output snippet";
 function configPath2(context) {
   if (context.configPathOverride) {
-    return path24.resolve(context.configPathOverride);
+    return path23.resolve(context.configPathOverride);
   }
   const configuredHome = context.env.CODEX_HOME;
-  const codexHome = path24.resolve(
-    typeof configuredHome === "string" && configuredHome.trim().length > 0 ? configuredHome : path24.join(context.homeDir, ".codex")
+  const codexHome = path23.resolve(
+    typeof configuredHome === "string" && configuredHome.trim().length > 0 ? configuredHome : path23.join(context.homeDir, ".codex")
   );
-  return path24.join(codexHome, "config.toml");
+  return path23.join(codexHome, "config.toml");
 }
 function readToml(snapshot) {
   const failure = snapshotError2(snapshot);
@@ -5779,7 +5737,7 @@ var CODEX_OTEL_INSTALLER = Object.freeze({
 });
 
 // ../../packages/agent-targets/src/install/otel/gemini.ts
-import path25 from "path";
+import path24 from "path";
 var TARGET15 = agentTarget("gemini");
 var TARGET_ID7 = TARGET15.id;
 var DISPLAY_NAME7 = TARGET15.displayName;
@@ -5787,9 +5745,9 @@ var AUTHENTICATION3 = "path-token";
 var GEMINI_OTEL_SOURCE_LIMITATION = "Gemini CLI has no documented OTLP header setting; FML uses an observer-local tokenized loopback path";
 function configPath3(context) {
   if (context.configPathOverride) {
-    return path25.resolve(context.configPathOverride);
+    return path24.resolve(context.configPathOverride);
   }
-  return path25.join(geminiConfigDirectory(context), "settings.json");
+  return path24.join(geminiConfigDirectory(context), "settings.json");
 }
 function managedTelemetry(context) {
   const destination = resolveDestination(context.observer);
@@ -5943,8 +5901,8 @@ var OTEL_INSTALLER_CAPABILITIES = Object.freeze([
 ]);
 
 // src/commands/otel-config-state.ts
-import fs11 from "fs";
-import path26 from "path";
+import fs10 from "fs";
+import path25 from "path";
 var OTEL_CONFIG_STATE_SCHEMA_VERSION = 1;
 function emptyState2() {
   return Object.freeze({
@@ -5958,12 +5916,12 @@ function invalidState2(statePath, reason) {
   );
 }
 function enforceOwnerOnlyMode(statePath) {
-  if (process.platform !== "win32") fs11.chmodSync(statePath, 384);
+  if (process.platform !== "win32") fs10.chmodSync(statePath, 384);
 }
 function readStateFile(statePath) {
   let stat;
   try {
-    stat = fs11.lstatSync(statePath);
+    stat = fs10.lstatSync(statePath);
   } catch (error) {
     if (error.code === "ENOENT") {
       return { kind: "missing" };
@@ -5981,7 +5939,7 @@ function readStateFile(statePath) {
   }
   try {
     enforceOwnerOnlyMode(statePath);
-    return { kind: "file", contents: fs11.readFileSync(statePath, "utf8") };
+    return { kind: "file", contents: fs10.readFileSync(statePath, "utf8") };
   } catch (error) {
     return {
       kind: "invalid",
@@ -5990,7 +5948,7 @@ function readStateFile(statePath) {
   }
 }
 function otelConfigStateEntryKey(targetId, configPath4) {
-  const resolved = path26.resolve(configPath4);
+  const resolved = path25.resolve(configPath4);
   const pathKey = process.platform === "win32" ? resolved.toLowerCase() : resolved;
   return `${targetId}\0${pathKey}`;
 }
@@ -6026,7 +5984,7 @@ function parseState2(source, statePath) {
     if (typeof observerRecord.baseUrl !== "string" || observerRecord.baseUrl.length === 0 || typeof observerRecord.authToken !== "string" || observerRecord.authToken.length === 0) {
       throw invalidState2(statePath, "contains an invalid observer destination");
     }
-    const resolvedPath = path26.resolve(entry.path);
+    const resolvedPath = path25.resolve(entry.path);
     const key = otelConfigStateEntryKey(entry.targetId, resolvedPath);
     if (keys.has(key)) {
       throw invalidState2(statePath, "contains duplicate entries");
@@ -6064,7 +6022,7 @@ function loadFmlOtelConfigState(statePath) {
 function serializeState2(entries) {
   const sorted = [...entries].map((entry) => ({
     targetId: entry.targetId,
-    path: path26.resolve(entry.path),
+    path: path25.resolve(entry.path),
     observer: {
       baseUrl: entry.observer.baseUrl,
       authToken: entry.observer.authToken
@@ -6101,7 +6059,7 @@ function isKnownOtelTargetId(targetId) {
 }
 
 // src/commands/otel-config.ts
-var DEFAULT_OTEL_CONFIG_STATE_PATH = path27.join(
+var DEFAULT_OTEL_CONFIG_STATE_PATH = path26.join(
   FML_DATA_DIR,
   "otel-config.json"
 );
@@ -6110,7 +6068,7 @@ function readLocalObserverOtelDestination(options) {
   if (!authToken) return null;
   try {
     const parsed = JSON.parse(
-      fs12.readFileSync(options.endpointFile, "utf8")
+      fs11.readFileSync(options.endpointFile, "utf8")
     );
     const endpoint = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
     const host = endpoint?.host;
@@ -6127,7 +6085,7 @@ function readLocalObserverOtelDestination(options) {
 function readOtelFile(filePath) {
   let stat;
   try {
-    stat = fs12.lstatSync(filePath);
+    stat = fs11.lstatSync(filePath);
   } catch (error) {
     if (error.code === "ENOENT") {
       return { path: filePath, kind: "missing" };
@@ -6156,7 +6114,7 @@ function readOtelFile(filePath) {
     return {
       path: filePath,
       kind: "file",
-      contents: fs12.readFileSync(filePath, "utf8")
+      contents: fs11.readFileSync(filePath, "utf8")
     };
   } catch (error) {
     return {
@@ -6178,7 +6136,7 @@ function assertMutationPrecondition2(mutation) {
   throw new Error(`configuration changed while planning ${mutation.path}`);
 }
 function applyMutation2(mutation) {
-  if (mutation.after === null) fs12.rmSync(mutation.path);
+  if (mutation.after === null) fs11.rmSync(mutation.path);
   else writeTextFileAtomic(mutation.path, mutation.after);
 }
 function enforceOwnerOnlyConfigPermissions(filePath) {
@@ -6191,7 +6149,7 @@ function enforceOwnerOnlyConfigPermissions(filePath) {
     );
   }
   try {
-    fs12.chmodSync(filePath, 384);
+    fs11.chmodSync(filePath, 384);
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(
@@ -6286,7 +6244,7 @@ function plannerContext3(observer, options, configPathOverride, configOwnershipR
     observer,
     homeDir: options.homeDir ?? os6.homedir(),
     env: options.env ?? process.env,
-    ...configPathOverride ? { configPathOverride: path27.resolve(configPathOverride) } : {},
+    ...configPathOverride ? { configPathOverride: path26.resolve(configPathOverride) } : {},
     ...configOwnershipRecorded ? { configOwnershipRecorded: true } : {},
     readFile: readOtelFile
   };
@@ -6329,7 +6287,7 @@ function commitStateEntry(state, key, next) {
 function stateEntry(plan, observer) {
   return Object.freeze({
     targetId: plan.targetId,
-    path: path27.resolve(plan.configPath),
+    path: path26.resolve(plan.configPath),
     observer: Object.freeze({
       baseUrl: observer.baseUrl,
       authToken: observer.authToken
@@ -6887,8 +6845,8 @@ async function canOpenBrowser() {
   if (process.env.CODESPACES) return false;
   if (process.env.REMOTE_CONTAINERS) return false;
   try {
-    const fs14 = await import("fs");
-    if (fs14.existsSync("/.dockerenv")) return false;
+    const fs13 = await import("fs");
+    if (fs13.existsSync("/.dockerenv")) return false;
   } catch {
   }
   return true;
@@ -7155,7 +7113,7 @@ async function deviceLogin(options) {
 }
 
 // src/sync/client.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync } from "child_process";
 var TOKEN_TTL_MS = 5 * 60 * 1e3;
 var cachedGitHubToken = null;
 function resolveGitHubToken() {
@@ -7171,7 +7129,7 @@ function resolveGitHubToken() {
     return envToken;
   }
   try {
-    const token = execSync2("gh auth token", {
+    const token = execSync("gh auth token", {
       encoding: "utf-8",
       timeout: 5e3
     }).trim();
@@ -7370,7 +7328,7 @@ async function runInteractiveLogin(opts = {}) {
   const envName = environment.envName;
   const existingToken = await getValidToken({ env: envName });
   if (existingToken) {
-    const { readTokens: readTokens2 } = await import("./token-store-7OI3CMM4.js");
+    const { readTokens: readTokens2 } = await import("./token-store-QYXUL4NG.js");
     const stored = readTokens2(envName);
     if (stored?.tokenType === "service") {
       const label = stored.user.id === SERVICE_TOKEN_LOGIN_USER_ID ? "a service token" : `${stored.user.name} (${stored.user.email})`;
@@ -7427,7 +7385,7 @@ async function runStep(name, operation) {
     throw new Error(`FML setup could not complete ${name}.`);
   }
 }
-async function handleSetup(dependencies = defaultDependencies) {
+async function handleSetup(dependencies = defaultDependencies, options = {}) {
   if (process.exitCode) {
     throw new Error("FML setup cannot run after an earlier command failure.");
   }
@@ -7436,6 +7394,8 @@ async function handleSetup(dependencies = defaultDependencies) {
   const token = await dependencies.getActiveToken();
   if (token) {
     console.log("Already signed in.");
+  } else if (options.nonInteractive) {
+    console.log("Not signed in; skipping login (non-interactive).");
   } else {
     await runStep("login", dependencies.login);
   }
@@ -7447,9 +7407,9 @@ async function handleSetup(dependencies = defaultDependencies) {
 }
 
 // src/commands/uninstall.ts
-import fs13 from "fs";
+import fs12 from "fs";
 import os7 from "os";
-import path28 from "path";
+import path27 from "path";
 import readline from "readline/promises";
 var PURGE_WARNING = "This deletes FML credentials for ALL environments, logs, sync state, and every pending best-effort OTLP envelope.";
 function tryDisableHookCapture() {
@@ -7465,19 +7425,19 @@ function tryDisableHookCapture() {
   }
 }
 function resolvePreservedPaths(preservedFile) {
-  const logicalPath = path28.resolve(preservedFile);
+  const logicalPath = path27.resolve(preservedFile);
   try {
-    const canonicalPath = fs13.realpathSync(preservedFile);
+    const canonicalPath = fs12.realpathSync(preservedFile);
     return pathsAreSame(canonicalPath, logicalPath) ? [logicalPath] : [logicalPath, canonicalPath];
   } catch {
     return [logicalPath];
   }
 }
 function purgeDirectoryPreservingPaths(directory, preservedPaths, configuredRoot = false) {
-  const resolvedDirectory = path28.resolve(directory);
+  const resolvedDirectory = path27.resolve(directory);
   let directoryStats;
   try {
-    directoryStats = fs13.lstatSync(directory);
+    directoryStats = fs12.lstatSync(directory);
   } catch (error) {
     if (error.code === "ENOENT") return true;
     throw error;
@@ -7488,14 +7448,14 @@ function purgeDirectoryPreservingPaths(directory, preservedPaths, configuredRoot
       (preservedPath) => pathContains(resolvedDirectory, preservedPath)
     );
     if (!containsLogicalMarker) {
-      fs13.rmSync(directory, { force: true });
+      fs12.rmSync(directory, { force: true });
       return true;
     }
     return false;
   }
   const directoryPaths = [resolvedDirectory];
   try {
-    const canonicalDirectory = fs13.realpathSync(directory);
+    const canonicalDirectory = fs12.realpathSync(directory);
     if (!pathsAreSame(canonicalDirectory, resolvedDirectory)) {
       directoryPaths.push(canonicalDirectory);
     }
@@ -7507,26 +7467,26 @@ function purgeDirectoryPreservingPaths(directory, preservedPaths, configuredRoot
     )
   );
   if (!containsPreservedPath) {
-    fs13.rmSync(directory, { recursive: true, force: true });
+    fs12.rmSync(directory, { recursive: true, force: true });
     return true;
   }
   const isPreservedPath = directoryPaths.some(
     (directoryPath) => preservedPaths.some(
-      (preservedPath) => pathsAreSame(directoryPath, path28.resolve(preservedPath))
+      (preservedPath) => pathsAreSame(directoryPath, path27.resolve(preservedPath))
     )
   );
   if (isPreservedPath) return true;
   if (!directoryStats.isDirectory()) return false;
   let entries;
   try {
-    entries = fs13.readdirSync(directory);
+    entries = fs12.readdirSync(directory);
   } catch (error) {
     if (error.code === "ENOENT") return true;
     throw error;
   }
   let complete = true;
   for (const entry of entries) {
-    const entryPath = path28.join(directory, entry);
+    const entryPath = path27.join(directory, entry);
     if (!purgeDirectoryPreservingPaths(entryPath, preservedPaths, false)) {
       complete = false;
     }
@@ -7545,13 +7505,13 @@ function purgeDirectoryPreservingFiles(directory, preservedFiles) {
 }
 function finishCustomRootPurge(directory) {
   const marker = managedDirectoryMarker(directory);
-  fs13.rmSync(marker, { force: true });
+  fs12.rmSync(marker, { force: true });
   try {
-    fs13.rmdirSync(directory);
+    fs12.rmdirSync(directory);
   } catch (error) {
     if (error.code === "ENOENT") return;
     try {
-      fs13.writeFileSync(marker, FML_MANAGED_DIRECTORY_MARKER_CONTENT, {
+      fs12.writeFileSync(marker, FML_MANAGED_DIRECTORY_MARKER_CONTENT, {
         encoding: "utf8",
         flag: "wx",
         mode: 384
@@ -7649,7 +7609,7 @@ async function handleUninstall(opts) {
       return;
     }
     for (const root of purgeRoots) {
-      if (!fs13.existsSync(root.directory) && pathContains(root.directory, FML_OBSERVER_DIR)) {
+      if (!fs12.existsSync(root.directory) && pathContains(root.directory, FML_OBSERVER_DIR)) {
         prepareManagedDirectory(root);
       }
     }
@@ -7773,7 +7733,7 @@ async function handleUninstall(opts) {
       )
     );
   }
-  fs13.rmSync(paths.pluginCacheDir, { recursive: true, force: true });
+  fs12.rmSync(paths.pluginCacheDir, { recursive: true, force: true });
   const reportIntegrationWarning = (message) => {
     integrationsRemoved = false;
     console.warn(message.replace(/^warn:/u, "Warning:"));
@@ -7892,181 +7852,6 @@ async function handleUninstall(opts) {
   }
 }
 
-// src/commands/update.ts
-var SEMVER_PATTERN = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-((?:0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
-var PACKAGE_NAME = "@fml-inc/fml";
-var UPDATE_TIMEOUT_MS = 12e4;
-var SETUP_TIMEOUT_MS = 3e5;
-function getCurrentVersion() {
-  return true ? "0.8.3+499a546c" : "unknown";
-}
-function parseVersion(version) {
-  const match = SEMVER_PATTERN.exec(version);
-  if (!match) return null;
-  return {
-    major: match[1],
-    minor: match[2],
-    patch: match[3],
-    prerelease: match[4]?.split(".") ?? []
-  };
-}
-function compareNumericIdentifiers(left, right) {
-  if (left.length !== right.length) return left.length - right.length;
-  if (left === right) return 0;
-  return left < right ? -1 : 1;
-}
-function compareIdentifiers(left, right) {
-  const leftIsNumeric = /^[0-9]+$/u.test(left);
-  const rightIsNumeric = /^[0-9]+$/u.test(right);
-  if (leftIsNumeric && rightIsNumeric) {
-    return compareNumericIdentifiers(left, right);
-  }
-  if (leftIsNumeric) return -1;
-  if (rightIsNumeric) return 1;
-  if (left === right) return 0;
-  return left < right ? -1 : 1;
-}
-function compareVersions(left, right) {
-  const leftVersion = parseVersion(left);
-  const rightVersion = parseVersion(right);
-  if (!leftVersion || !rightVersion) {
-    throw new Error("FML update requires valid semantic versions.");
-  }
-  for (const part of ["major", "minor", "patch"]) {
-    const difference = compareNumericIdentifiers(
-      leftVersion[part],
-      rightVersion[part]
-    );
-    if (difference) return difference;
-  }
-  if (!leftVersion.prerelease.length && !rightVersion.prerelease.length) {
-    return 0;
-  }
-  if (!leftVersion.prerelease.length) return 1;
-  if (!rightVersion.prerelease.length) return -1;
-  const length = Math.max(
-    leftVersion.prerelease.length,
-    rightVersion.prerelease.length
-  );
-  for (let index = 0; index < length; index += 1) {
-    const leftIdentifier = leftVersion.prerelease[index];
-    const rightIdentifier = rightVersion.prerelease[index];
-    if (leftIdentifier === void 0) return -1;
-    if (rightIdentifier === void 0) return 1;
-    const difference = compareIdentifiers(leftIdentifier, rightIdentifier);
-    if (difference) return difference;
-  }
-  return 0;
-}
-function resolveUpdateChannel(version) {
-  const match = SEMVER_PATTERN.exec(version);
-  if (!match) return "latest";
-  const prerelease = match[4];
-  if (!prerelease) return "latest";
-  return prerelease.split(".").every((identifier) => {
-    return !(identifier.length > 1 && identifier.startsWith("0") && /^[0-9]+$/u.test(identifier));
-  }) ? "next" : "latest";
-}
-function resolveUpdateTarget(version) {
-  return `${PACKAGE_NAME}@${resolveUpdateChannel(version)}`;
-}
-function createUpdateEnvironment(env) {
-  const updateEnv = { ...env };
-  for (const key of Object.keys(updateEnv)) {
-    if (key.toLowerCase() === "npm_config_registry") {
-      delete updateEnv[key];
-    }
-  }
-  return updateEnv;
-}
-function parseAvailableVersion(output) {
-  let response;
-  try {
-    response = JSON.parse(output);
-  } catch {
-    throw new Error("Could not read the available FML version from npm.");
-  }
-  const version = Array.isArray(response) && response.length === 1 ? response[0] : response;
-  if (typeof version !== "string" || !parseVersion(version)) {
-    throw new Error("Could not read the available FML version from npm.");
-  }
-  return version;
-}
-function formatUpdateError(err) {
-  if (!(err instanceof Error)) return String(err);
-  const stderr = err.stderr;
-  if (typeof stderr === "string") return stderr;
-  if (Buffer.isBuffer(stderr)) return stderr.toString();
-  return err.message;
-}
-async function handleUpdate(overrides = {}) {
-  const dependencies = {
-    currentVersion: getCurrentVersion(),
-    env: process.env,
-    resolveBin,
-    execBinSync,
-    captureException: Sentry.captureException,
-    log: console.log,
-    error: console.error,
-    exit: process.exit,
-    ...overrides
-  };
-  const channel = resolveUpdateChannel(dependencies.currentVersion);
-  const target2 = resolveUpdateTarget(dependencies.currentVersion);
-  dependencies.log(`Current version: ${dependencies.currentVersion}`);
-  try {
-    const npm = dependencies.resolveBin("npm");
-    if (!npm) throw new Error("npm was not found on PATH");
-    const updateEnv = createUpdateEnvironment(dependencies.env);
-    const availableVersion = parseAvailableVersion(
-      dependencies.execBinSync(npm, ["view", target2, "version", "--json"], {
-        timeout: UPDATE_TIMEOUT_MS,
-        env: updateEnv
-      })
-    );
-    if (compareVersions(availableVersion, dependencies.currentVersion) <= 0) {
-      dependencies.log(
-        `FML is already up to date (${dependencies.currentVersion}).`
-      );
-      return;
-    }
-    dependencies.log(
-      `Updating FML from ${dependencies.currentVersion} to ${availableVersion} on the ${channel} channel...
-`
-    );
-    dependencies.execBinSync(
-      npm,
-      ["install", "--global", `${PACKAGE_NAME}@${availableVersion}`],
-      { timeout: UPDATE_TIMEOUT_MS, env: updateEnv }
-    );
-    dependencies.log(
-      `
-FML updated from ${dependencies.currentVersion} to ${availableVersion}. Refreshing setup...`
-    );
-    try {
-      const fml = dependencies.resolveBin("fml");
-      if (!fml) throw new Error("Updated FML was not found on PATH");
-      dependencies.execBinSync(fml, ["setup"], {
-        timeout: SETUP_TIMEOUT_MS,
-        stdio: "inherit"
-      });
-      dependencies.log("FML setup complete.");
-    } catch (err) {
-      dependencies.captureException(err);
-      dependencies.error(
-        "FML updated, but setup failed:",
-        formatUpdateError(err)
-      );
-      dependencies.error("Run `fml setup` to finish refreshing FML.");
-      dependencies.exit(1);
-    }
-  } catch (err) {
-    dependencies.captureException(err);
-    dependencies.error("Update failed:", formatUpdateError(err));
-    dependencies.exit(1);
-  }
-}
-
 // src/commands/logout.ts
 async function handleLogout() {
   const { name } = getActiveEnv();
@@ -9036,8 +8821,8 @@ async function handleConfigDetail(opts) {
 
 // src/commands/tools.ts
 import { readFileSync } from "fs";
-import path29 from "path";
-var pluginVersion = true ? "0.8.3+499a546c" : void 0;
+import path28 from "path";
+var pluginVersion = true ? "0.8.4-rc.2+f282df41" : void 0;
 async function getApi() {
   const api = await getAuthenticatedClient();
   if (!api) {
@@ -9144,7 +8929,7 @@ async function handleToolsCall(name, opts) {
   }
   const raw = opts.file ? (() => {
     try {
-      return readFileSync(path29.resolve(opts.file), "utf8");
+      return readFileSync(path28.resolve(opts.file), "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`Could not read args file: ${msg}`);
@@ -9194,7 +8979,7 @@ if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.
   printBanner();
 }
 var program = new Command().name("fml").description("FML CLI and agent tools").version(
-  true ? "0.8.3+499a546c" : "dev"
+  true ? "0.8.4-rc.2+f282df41" : "dev"
 );
 function formatCommandInventory(cmd, prefix = "") {
   const name = prefix ? `${prefix} ${cmd.name()}` : cmd.name();
@@ -9223,12 +9008,26 @@ tools.command("call").description("Invoke a backend tool by name with JSON args"
 program.command("mcp-server", { hidden: true }).description("Run the FML MCP server on stdio").action(async () => {
   await import("./mcp/server.js");
 });
-program.command("setup").description("Install integrations, sign in if needed, and start FML").action(() => handleSetup());
+program.command("setup").description("Install integrations, sign in if needed, and start FML").addOption(
+  new Option(
+    "--non-interactive",
+    "Skip interactive login (internal)"
+  ).hideHelp()
+).action(
+  (opts) => handleSetup(void 0, { nonInteractive: Boolean(opts.nonInteractive) })
+);
 program.command("install").description("Register FML agent integrations and the MCP server").action(() => handleInstall());
 program.command("uninstall").description("Remove FML agent integrations and optionally local data").option("--purge", "Also remove all data, logs, and auth tokens").option("-y, --yes", "Skip the purge confirmation prompt").action(
   (opts) => handleUninstall({ purge: opts.purge, assumeYes: opts.yes })
 );
-program.command("update").description("Update fml when a newer release is available and refresh setup").action(() => handleUpdate());
+program.command("update").description("Update fml when a newer release is available and refresh setup").addOption(
+  new Option(
+    "--non-interactive",
+    "Skip interactive prompts (internal)"
+  ).hideHelp()
+).action(
+  (opts) => handleUpdate({ nonInteractive: Boolean(opts.nonInteractive) })
+);
 program.command("login").description("Sign in to your FML account").option("--device", "Use device authorization flow (no browser needed)").option(
   "--service-token",
   "Sign in with an org service refresh token (prompts for fml_srt_*)"