@hasna/instructions 0.4.35 → 0.4.39

package/dist/cli/index.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -48,7 +50,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/error.js
-var require_error = __commonJS((exports) => {
+var require_error = __commonJS(function(exports) {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -72,7 +74,7 @@ var require_error = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/argument.js
-var require_argument = __commonJS((exports) => {
+var require_argument = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -151,7 +153,7 @@ var require_argument = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/help.js
-var require_help = __commonJS((exports) => {
+var require_help = __commonJS(function(exports) {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -501,7 +503,7 @@ ${itemIndentStr}`);
 });
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/option.js
-var require_option = __commonJS((exports) => {
+var require_option = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -679,7 +681,7 @@ var require_option = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS((exports) => {
+var require_suggestSimilar = __commonJS(function(exports) {
   var maxDistance = 3;
   function editDistance(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
@@ -752,7 +754,7 @@ var require_suggestSimilar = __commonJS((exports) => {
 });
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/command.js
-var require_command = __commonJS((exports) => {
+var require_command = __commonJS(function(exports) {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
   var path = __require("path");
@@ -993,7 +995,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -2062,7 +2064,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
 });
 
 // ../../node_modules/.bun/commander@13.1.0/node_modules/commander/index.js
-var require_commander = __commonJS((exports) => {
+var require_commander = __commonJS(function(exports) {
   var { Argument } = require_argument();
   var { Command } = require_command();
   var { CommanderError, InvalidArgumentError } = require_error();
@@ -2160,19 +2162,27 @@ var init_retired_storage_mode = __esm(() => {
   ];
 });
 
+// src/lib/raw-store-root.ts
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+function getRawStoreRoot() {
+  return resolve(process.env[RAW_STORE_ROOT_ENV] || join2(process.env["HOME"] || homedir2(), ".hasna", "instructions"));
+}
+var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME";
+var init_raw_store_root = () => {};
+
 // src/db/database.ts
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync2, mkdirSync, rmSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function getDbPath() {
   if (process.env["HASNA_INSTRUCTIONS_DB_PATH"]) {
     return process.env["HASNA_INSTRUCTIONS_DB_PATH"];
   }
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  const dir = join2(home, ".hasna", "instructions");
+  const dir = getRawStoreRoot();
   mkdirSync(dir, { recursive: true });
-  return join2(dir, "instructions.db");
+  return join3(dir, "instructions.db");
 }
 function uuid() {
   return randomUUID3();
@@ -2270,6 +2280,7 @@ function insertFeedback(input, db) {
 var MIGRATIONS, _db = null;
 var init_database = __esm(() => {
   init_retired_storage_mode();
+  init_raw_store_root();
   MIGRATIONS = [
     `
   CREATE TABLE IF NOT EXISTS configs (
@@ -2354,6 +2365,37 @@ var init_database = __esm(() => {
   ];
 });
 
+// src/db/snapshots.ts
+function createSnapshot(configId, content, version, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now2();
+  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
+  return { id, config_id: configId, content, version, created_at: ts };
+}
+function listSnapshots(configId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
+}
+function getSnapshot(id, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
+}
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+function pruneSnapshots(configId, keep = 10, db) {
+  const d = db || getDatabase();
+  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
+      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
+    )`, [configId, configId, keep]);
+  return result.changes;
+}
+var init_snapshots = __esm(() => {
+  init_database();
+});
+
 // src/db/configs.ts
 function rowToConfig(row) {
   let outputs = [];
@@ -2392,25 +2434,28 @@ function createConfig(input, db) {
   const slug = uniqueSlug(input.name, d);
   const tags = JSON.stringify(input.tags || []);
   const outputs = JSON.stringify(input.outputs || []);
-  d.run(`INSERT INTO configs (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at, synced_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`, [
-    id,
-    input.name,
-    slug,
-    input.kind ?? "file",
-    input.category,
-    input.agent ?? "global",
-    input.target_path ?? null,
-    outputs,
-    input.format ?? "text",
-    input.content,
-    input.description ?? null,
-    tags,
-    input.is_template ? 1 : 0,
-    ts,
-    ts
-  ]);
-  return getConfig(id, d);
+  return d.transaction(() => {
+    d.run(`INSERT INTO configs (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at, synced_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`, [
+      id,
+      input.name,
+      slug,
+      input.kind ?? "file",
+      input.category,
+      input.agent ?? "global",
+      input.target_path ?? null,
+      outputs,
+      input.format ?? "text",
+      input.content,
+      input.description ?? null,
+      tags,
+      input.is_template ? 1 : 0,
+      ts,
+      ts
+    ]);
+    createSnapshot(id, input.content, 1, d);
+    return getConfig(id, d);
+  })();
 }
 function getConfig(idOrSlug, db) {
   const d = db || getDatabase();
@@ -2515,9 +2560,13 @@ function updateConfig(idOrSlug, input, db) {
     updates.push("synced_at = ?");
     params.push(input.synced_at);
   }
-  params.push(existing.id);
-  d.run(`UPDATE configs SET ${updates.join(", ")} WHERE id = ?`, params);
-  return getConfigById(existing.id, d);
+  return d.transaction(() => {
+    params.push(existing.id);
+    d.run(`UPDATE configs SET ${updates.join(", ")} WHERE id = ?`, params);
+    const updated = getConfigById(existing.id, d);
+    createSnapshot(updated.id, updated.content, updated.version, d);
+    return updated;
+  })();
 }
 function deleteConfig(idOrSlug, db) {
   const d = db || getDatabase();
@@ -2537,16 +2586,17 @@ function getConfigStats(db) {
 var init_configs = __esm(() => {
   init_types();
   init_database();
+  init_snapshots();
 });
 
 // src/lib/template.ts
 var exports_template = {};
 __export(exports_template, {
-  renderTemplatePreview: () => renderTemplatePreview,
-  renderTemplate: () => renderTemplate,
-  parseTemplateVars: () => parseTemplateVars,
+  extractTemplateVars: () => extractTemplateVars,
   isTemplate: () => isTemplate,
-  extractTemplateVars: () => extractTemplateVars
+  parseTemplateVars: () => parseTemplateVars,
+  renderTemplate: () => renderTemplate,
+  renderTemplatePreview: () => renderTemplatePreview
 });
 function parseTemplateVars(content) {
   const names = new Set;
@@ -2610,9 +2660,9 @@ var init_template = __esm(() => {
 });
 
 // src/lib/machine.ts
-import { arch as currentArch, homedir as homedir2, hostname as currentHostname, type as currentOsType } from "os";
+import { arch as currentArch, homedir as homedir3, hostname as currentHostname, type as currentOsType } from "os";
 import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function normalizeOsFamily(os) {
   const value = (os ?? "").trim().toLowerCase();
   if (value === "darwin" || value === "macos" || value === "mac" || value === "osx")
@@ -2624,11 +2674,11 @@ function normalizeOsFamily(os) {
   return value || "unknown";
 }
 function detectMachineContext(overrides = {}) {
-  const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir2();
+  const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir3();
   const os = overrides.os ?? currentOsType();
   const osFamily = normalizeOsFamily(os);
-  const bunBinDir = overrides.bun_bin_dir ?? join3(homeDir, ".bun", "bin");
-  const defaultBunPath = osFamily === "macos" && existsSync3(BREW_BUN_PATH) ? BREW_BUN_PATH : join3(bunBinDir, "bun");
+  const bunBinDir = overrides.bun_bin_dir ?? join4(homeDir, ".bun", "bin");
+  const defaultBunPath = osFamily === "macos" && existsSync3(BREW_BUN_PATH) ? BREW_BUN_PATH : join4(bunBinDir, "bun");
   return {
     id: "current-machine",
     hostname: overrides.hostname ?? currentHostname(),
@@ -2638,10 +2688,10 @@ function detectMachineContext(overrides = {}) {
     created_at: "",
     os_family: osFamily,
     home_dir: homeDir,
-    workspace_root: overrides.workspace_root ?? join3(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
+    workspace_root: overrides.workspace_root ?? join4(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
     bun_bin_dir: bunBinDir,
     bun_path: overrides.bun_path ?? defaultBunPath,
-    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join3("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
+    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join4("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
   };
 }
 function machineContextToVariables(machine) {
@@ -6906,113 +6956,113 @@ var init_types2 = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
 });
 var init_external = __esm(() => {
   init_errors();
@@ -7265,7 +7315,7 @@ import {
   statSync,
   writeFileSync
 } from "fs";
-import { basename, dirname, isAbsolute, join as join4, parse, relative, resolve } from "path";
+import { basename, dirname, isAbsolute, join as join5, parse, relative, resolve as resolve2 } from "path";
 function managedObservationMaxBytes(relativePath) {
   return SESSION_MANAGED_OUTPUT_PATHS.includes(relativePath) ? SESSION_MANAGED_OUTPUT_MAX_BYTES : FOREIGN_INPUT_MAX_BYTES;
 }
@@ -7436,7 +7486,7 @@ function composeProjectContextSessionRender(input) {
   if (currentMarkers.block.id !== cache.project_id || currentMarkers.block.revision !== cache.revision || currentMarkers.block.hash !== cache.hash) {
     throw new ProjectContextError("MANAGED_BLOCK_CONFLICT", "project-context provider markers differ from the durable cache");
   }
-  const plannedIndexes = input.files.filter((file) => file.role === "index" && resolve(file.path) === paths.target);
+  const plannedIndexes = input.files.filter((file) => file.role === "index" && resolve2(file.path) === paths.target);
   if (plannedIndexes.length !== 1) {
     throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "session renderer does not own the selected project-context provider target");
   }
@@ -7494,7 +7544,7 @@ function withProjectContextSessionGuard(guard, action, options = {}) {
     verify();
     return action(null);
   }
-  const lockPath = resolve(validated.workspace_root, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
+  const lockPath = resolve2(validated.workspace_root, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
   const lock = acquireWorkspaceLock(validated.workspace_root, lockPath);
   try {
     verify();
@@ -7520,7 +7570,7 @@ function validateProjectContextSessionGuard(guard) {
     if (!isRecord(observed) || typeof observed.path !== "string") {
       throw new ProjectContextError("PROJECT_CONTEXT_SESSION_STALE", "session project-context guard contains malformed hash metadata");
     }
-    const path = resolve(observed.path);
+    const path = resolve2(observed.path);
     if (!allowedPaths.has(path) || observedPaths.has(path)) {
       throw new ProjectContextError("PROJECT_CONTEXT_SESSION_STALE", "session project-context guard contains an unexpected or duplicate path");
     }
@@ -7542,7 +7592,7 @@ function validateProjectContextSessionGuard(guard) {
 function applyProjectContext(options) {
   const workspaceRoot = assertSafeWorkspaceRoot(options.workspace_root);
   const now3 = options.now ?? new Date;
-  const lockPath = resolve(workspaceRoot, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
+  const lockPath = resolve2(workspaceRoot, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
   const lock = options.dry_run ? null : acquireWorkspaceLock(workspaceRoot, lockPath, options.test_hooks?.after_lock_open, options.test_hooks?.before_stale_lock_remove, options.test_hooks?.process_start_identity);
   try {
     const resolved = resolveBundleForApply(options, workspaceRoot, now3);
@@ -7689,7 +7739,7 @@ function resolveBundleForApply(options, workspaceRoot, now3) {
   if (!options.expected_project_id) {
     throw new ProjectContextError("PROJECT_CONTEXT_CACHE_ID_REQUIRED", "expected_project_id is required for stale-cache fallback");
   }
-  const cachePath = resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
+  const cachePath = resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
   const cache = readProjectContextCache(cachePath, workspaceRoot);
   if (!cache)
     throw new ProjectContextError("PROJECT_CONTEXT_CACHE_MISSING", "no last-known-good project context cache exists");
@@ -8045,7 +8095,7 @@ function buildManifest(plan, now3) {
 function buildSessionCompatibilityManifest(plan, now3) {
   const paths = runtimePaths(plan.workspace_root, plan.runtime);
   const tool = manifestTool(plan.runtime);
-  const targetHome = plan.runtime === "codewith" ? resolve(plan.workspace_root, ".codewith") : plan.workspace_root;
+  const targetHome = plan.runtime === "codewith" ? resolve2(plan.workspace_root, ".codewith") : plan.workspace_root;
   const targetRelativePath = sessionTargetRelativePath(plan.runtime);
   const existing = existsSync4(paths.sessionManifest) ? readSessionManifestRecord(paths.sessionManifest, plan.workspace_root) : {
     schema: SESSION_RENDER_SCHEMA,
@@ -8067,7 +8117,7 @@ function buildSessionCompatibilityManifest(plan, now3) {
     throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "provider session manifest is malformed or incompatible");
   }
   const existingTargetHome = safeLegacyMetadataString(existing["targetHome"], null);
-  if (existingTargetHome !== null && resolve(existingTargetHome) !== targetHome) {
+  if (existingTargetHome !== null && resolve2(existingTargetHome) !== targetHome) {
     throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "provider session manifest targets a different workspace");
   }
   const sources = sanitizeLegacySources(existing["sources"]).filter((source) => source["id"] !== "project-context-bundle");
@@ -8353,9 +8403,9 @@ function writeMetadataSnapshot(plan, now3) {
   const previous = readProjectContextManifest(plan.manifest_path, plan.workspace_root);
   if (!previous || previous.projectContext.revision === plan.bundle.revision && previous.projectContext.hash === plan.bundle.hash)
     return null;
-  const snapshotDir = resolve(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
+  const snapshotDir = resolve2(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
   ensureSafeDirectory(snapshotDir, plan.workspace_root, 448);
-  const snapshotPath = resolve(snapshotDir, `${safeFilename(previous.projectContext.revision)}-${previous.projectContext.hash.slice(-12)}.json`);
+  const snapshotPath = resolve2(snapshotDir, `${safeFilename(previous.projectContext.revision)}-${previous.projectContext.hash.slice(-12)}.json`);
   const snapshot = {
     schema: "hasna.configs.session-render-snapshot/v1",
     kind: "project-context-metadata",
@@ -8371,8 +8421,8 @@ function writeMetadataSnapshot(plan, now3) {
   return snapshotPath;
 }
 function metadataSnapshotMatchesManifest(plan, manifest) {
-  const snapshotDir = resolve(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
-  const snapshotPath = resolve(snapshotDir, `${safeFilename(manifest.projectContext.revision)}-${manifest.projectContext.hash.slice(-12)}.json`);
+  const snapshotDir = resolve2(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
+  const snapshotPath = resolve2(snapshotDir, `${safeFilename(manifest.projectContext.revision)}-${manifest.projectContext.hash.slice(-12)}.json`);
   if (!existsSync4(snapshotPath))
     return false;
   const record = readJsonRecord(snapshotPath, plan.workspace_root);
@@ -8421,10 +8471,10 @@ function writeProjectContextRollbackSnapshot(plan, now3, outputs) {
       sha256: nextHash
     };
   });
-  const snapshotDir = resolve(plan.workspace_root, ...SESSION_RENDER_SNAPSHOT_RELATIVE_DIR.split("/"));
+  const snapshotDir = resolve2(plan.workspace_root, ...SESSION_RENDER_SNAPSHOT_RELATIVE_DIR.split("/"));
   ensureSafeDirectory(snapshotDir, plan.workspace_root, 448);
   const timestamp = now3.toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve(snapshotDir, `${timestamp}-${randomUUID5()}.json`);
+  const snapshotPath = resolve2(snapshotDir, `${timestamp}-${randomUUID5()}.json`);
   const snapshot = {
     schema: "hasna.configs.session-render-snapshot/v2",
     createdAt: now3.toISOString(),
@@ -8489,7 +8539,7 @@ function readSessionManifestRecord(path, workspaceRoot) {
   }
 }
 function atomicWriteFile(path, content, workspaceRoot, defaultMode, expectedHash, afterExchange, atomicExchangeUnavailable = false, beforeInstall, portableCreateOnly = false, maxObservedBytes, allowPortableReplacement = false) {
-  const dir = resolve(path, "..");
+  const dir = resolve2(path, "..");
   ensureSafeDirectory(dir, workspaceRoot, 448);
   assertNoSymlinkSegments(workspaceRoot, path);
   const anchoredOps = portableCreateOnly ? null : resolveAnchoredFsOps();
@@ -8506,7 +8556,7 @@ function atomicWriteFile(path, content, workspaceRoot, defaultMode, expectedHash
   const previous = anchoredFileObservation(directory, targetName);
   const previousMode = previous?.mode ?? defaultMode;
   const tempName = `.project-context-${randomUUID5()}.tmp`;
-  const tempPath = join4(dir, tempName);
+  const tempPath = join5(dir, tempName);
   let fd = null;
   let preserveTemp = false;
   let directoryChanged = false;
@@ -8637,7 +8687,7 @@ function atomicWritePortable(path, content, workspaceRoot, defaultMode, expected
   }
   const dir = dirname(path);
   const directoryIdentity = captureManagedDirectoryIdentity(dir, workspaceRoot);
-  const tempPath = join4(dir, `.project-context-${randomUUID5()}.tmp`);
+  const tempPath = join5(dir, `.project-context-${randomUUID5()}.tmp`);
   let fd = null;
   let tempIdentity = null;
   try {
@@ -8694,7 +8744,7 @@ function atomicWritePortableReplacement(path, content, workspaceRoot, expectedHa
   }
   const dir = dirname(path);
   const directoryIdentity = captureManagedDirectoryIdentity(dir, workspaceRoot);
-  const tempPath = join4(dir, `.project-context-${randomUUID5()}.tmp`);
+  const tempPath = join5(dir, `.project-context-${randomUUID5()}.tmp`);
   const desiredHash = sha2562(content);
   let fd = null;
   let tempIdentity = null;
@@ -8763,11 +8813,11 @@ function portableFileHash(path, workspaceRoot, maxObservedBytes) {
   return createHash2("sha256").update(readFileSync(path)).digest("hex");
 }
 function writeProjectContextCoordinatedFile(input) {
-  atomicWriteFile(resolve(input.path), input.content, assertSafeWorkspaceRoot(input.workspace_root), input.default_mode ?? 420, input.expected_hash, undefined, false, input.test_hooks?.before_install, input.force_portable_file_ops ?? false, input.max_observed_bytes, input.allow_portable_replacement ?? false);
+  atomicWriteFile(resolve2(input.path), input.content, assertSafeWorkspaceRoot(input.workspace_root), input.default_mode ?? 420, input.expected_hash, undefined, false, input.test_hooks?.before_install, input.force_portable_file_ops ?? false, input.max_observed_bytes, input.allow_portable_replacement ?? false);
 }
 function removeProjectContextCoordinatedFile(input) {
   const workspaceRoot = assertSafeWorkspaceRoot(input.workspace_root);
-  const path = resolve(input.path);
+  const path = resolve2(input.path);
   assertNoSymlinkSegments(workspaceRoot, path);
   const dir = dirname(path);
   const anchoredOps = input.force_portable_file_ops ? null : resolveAnchoredFsOps();
@@ -8793,7 +8843,7 @@ function removeProjectContextCoordinatedFile(input) {
       throw new ProjectContextHashRace(`managed path changed during deletion: ${relativePosix(workspaceRoot, path)}`);
     }
     displaced = true;
-    input.test_hooks?.after_displace?.(join4(dir, displacedName));
+    input.test_hooks?.after_displace?.(join5(dir, displacedName));
     const moved = anchoredFileObservation(directory, displacedName);
     if (!moved || moved.dev !== observed.dev || moved.ino !== observed.ino || moved.hash !== input.expected_hash || anchoredFileObservation(directory, targetName) !== null) {
       throw new ProjectContextHashRace(`managed path changed during deletion validation: ${relativePosix(workspaceRoot, path)}`);
@@ -8839,7 +8889,7 @@ function removePortableCoordinatedFile(path, workspaceRoot, expectedHash, maxObs
   }
   const dir = dirname(path);
   const directoryIdentity = captureManagedDirectoryIdentity(dir, workspaceRoot);
-  const displacedPath = join4(dir, `.project-context-delete-${randomUUID5()}.tmp`);
+  const displacedPath = join5(dir, `.project-context-delete-${randomUUID5()}.tmp`);
   let displaced = false;
   try {
     assertManagedDirectoryStable(dir, workspaceRoot, directoryIdentity);
@@ -8910,7 +8960,7 @@ function anchoredOpenExclusive(directory, name, mode) {
   const requestedMode = mode & 4095;
   let fd;
   try {
-    fd = openSync(join4(directory.path, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, requestedMode);
+    fd = openSync(join5(directory.path, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, requestedMode);
   } catch {
     throw new ProjectContextHashRace(`could not create prepared managed file in ${relativePosix(directory.workspaceRoot, directory.path)}`);
   }
@@ -8953,7 +9003,7 @@ function anchoredFileObservation(directory, name) {
     const stat = fstatSync(fd);
     if (!stat.isFile())
       throw new ProjectContextHashRace("managed output is not a regular file");
-    const relativePath = relativePosix(directory.workspaceRoot, join4(directory.path, name));
+    const relativePath = relativePosix(directory.workspaceRoot, join5(directory.path, name));
     const maxBytes = directory.maxObservedBytes === undefined ? managedObservationMaxBytes(relativePath) : directory.maxObservedBytes;
     if (maxBytes !== null && stat.size > maxBytes) {
       throw new ProjectContextHashRace(`managed output exceeds the safe read limit: ${relativePath}`);
@@ -8979,7 +9029,7 @@ function anchoredPreparedObservation(directory, name, path, stage) {
   return observed;
 }
 function captureManagedDirectoryIdentity(path, workspaceRoot) {
-  assertNoSymlinkSegments(workspaceRoot, join4(path, ".project-context-directory-guard"));
+  assertNoSymlinkSegments(workspaceRoot, join5(path, ".project-context-directory-guard"));
   let stat;
   try {
     stat = lstatSync(path);
@@ -8992,7 +9042,7 @@ function captureManagedDirectoryIdentity(path, workspaceRoot) {
   return { dev: stat.dev, ino: stat.ino };
 }
 function assertManagedDirectoryStable(path, workspaceRoot, expected) {
-  assertNoSymlinkSegments(workspaceRoot, join4(path, ".project-context-directory-guard"));
+  assertNoSymlinkSegments(workspaceRoot, join5(path, ".project-context-directory-guard"));
   let current;
   try {
     current = lstatSync(path);
@@ -9125,10 +9175,10 @@ function resolveAnchoredFsOps() {
   return null;
 }
 function acquireWorkspaceLock(workspaceRoot, lockPath, afterOpen, beforeStaleRemove, processStartIdentityLookup = processStartIdentity) {
-  const lockDirectory = resolve(lockPath, "..");
+  const lockDirectory = resolve2(lockPath, "..");
   ensureSafeDirectory(lockDirectory, workspaceRoot, 448);
   assertNoSymlinkSegments(workspaceRoot, lockPath);
-  const tempPath = join4(lockDirectory, `.project-context-lock-${randomUUID5()}.tmp`);
+  const tempPath = join5(lockDirectory, `.project-context-lock-${randomUUID5()}.tmp`);
   let fd = null;
   let openedIdentity = null;
   let openedContentHash = null;
@@ -9200,7 +9250,7 @@ function removeOwnedLockByInode(lockPath, identity, expectedHash) {
     if (expectedHash !== undefined && sha2562(readFileSync(lockPath, "utf8")) !== expectedHash)
       return;
     rmSync2(lockPath);
-    fsyncDirectory(resolve(lockPath, ".."));
+    fsyncDirectory(resolve2(lockPath, ".."));
   } catch {}
 }
 function observeStaleWorkspaceLock(lockPath, workspaceRoot, processStartIdentityLookup = processStartIdentity) {
@@ -9279,7 +9329,7 @@ function tryTakeoverStaleWorkspaceLock(candidatePath, lockPath, workspaceRoot, c
       throw new ProjectContextError("PROJECT_CONTEXT_LOCK_LOST", "workspace lock changed during stale-lock takeover and could not be restored safely");
     }
     rmSync2(candidatePath);
-    fsyncDirectory(resolve(lockPath, ".."));
+    fsyncDirectory(resolve2(lockPath, ".."));
     exchanged = false;
     return true;
   } catch (error) {
@@ -9358,8 +9408,8 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
     }
     return;
   }
-  const lockDirectory = resolve(lockPath, "..");
-  const releasePath = join4(lockDirectory, `.project-context-release-${randomUUID5()}.tmp`);
+  const lockDirectory = resolve2(lockPath, "..");
+  const releasePath = join5(lockDirectory, `.project-context-release-${randomUUID5()}.tmp`);
   let releaseFd = null;
   let releaseIdentity = null;
   let releaseHash = null;
@@ -9439,7 +9489,7 @@ function ensureSafeDirectory(path, workspaceRoot, mode) {
   const segments = rel.split(/[\\/]+/).filter(Boolean);
   let current = workspaceRoot;
   for (const segment of segments) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     if (existsSync4(current)) {
       if (lstatSync(current).isSymbolicLink())
         throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", `managed path uses a symlink: ${current}`);
@@ -9447,7 +9497,7 @@ function ensureSafeDirectory(path, workspaceRoot, mode) {
         throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", `managed path is not a directory: ${current}`);
     } else {
       mkdirSync2(current, { mode });
-      fsyncDirectory(resolve(current, ".."));
+      fsyncDirectory(resolve2(current, ".."));
     }
   }
 }
@@ -9503,11 +9553,11 @@ function scanGeneratedContent(content) {
 function runtimePaths(workspaceRoot, runtime) {
   const relativeTarget = runtime === "claude" ? "CLAUDE.md" : runtime === "codewith" ? ".codewith/CODEWITH.md" : "AGENTS.md";
   return {
-    target: resolve(workspaceRoot, ...relativeTarget.split("/")),
-    fragment: resolve(workspaceRoot, ...PROJECT_CONTEXT_FRAGMENT_PATH.split("/")),
-    manifest: resolve(workspaceRoot, ...PROJECT_CONTEXT_MANIFEST_PATH.split("/")),
-    cache: resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/")),
-    sessionManifest: runtime === "codewith" ? resolve(workspaceRoot, ".codewith", ".hasna", "session-render-manifest.json") : resolve(workspaceRoot, ".hasna", "session-render-manifest.json")
+    target: resolve2(workspaceRoot, ...relativeTarget.split("/")),
+    fragment: resolve2(workspaceRoot, ...PROJECT_CONTEXT_FRAGMENT_PATH.split("/")),
+    manifest: resolve2(workspaceRoot, ...PROJECT_CONTEXT_MANIFEST_PATH.split("/")),
+    cache: resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/")),
+    sessionManifest: runtime === "codewith" ? resolve2(workspaceRoot, ".codewith", ".hasna", "session-render-manifest.json") : resolve2(workspaceRoot, ".hasna", "session-render-manifest.json")
   };
 }
 function projectContextSessionGuardPaths(paths, runtime) {
@@ -9517,7 +9567,7 @@ function projectContextSessionGuardPaths(paths, runtime) {
     paths.fragment,
     paths.target,
     paths.sessionManifest,
-    ...runtime === "codewith" ? [resolve(paths.target, "..", "CODEWITH.override.md")] : []
+    ...runtime === "codewith" ? [resolve2(paths.target, "..", "CODEWITH.override.md")] : []
   ];
 }
 function sessionTargetRelativePath(runtime) {
@@ -9537,12 +9587,12 @@ function projectContextRuntimeForSessionTool(tool) {
   return null;
 }
 function projectContextWorkspaceForSession(input, runtime) {
-  const targetHome = resolve(input.target_home);
+  const targetHome = resolve2(input.target_home);
   if (runtime === "codewith") {
     const workspaceRoot = basename(targetHome) === ".codewith" ? dirname(targetHome) : null;
     if (!workspaceRoot)
       return null;
-    if (input.project_root && resolve(input.project_root) !== workspaceRoot) {
+    if (input.project_root && resolve2(input.project_root) !== workspaceRoot) {
       throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "Codewith project_root must be the parent workspace of target_home");
     }
     if (!existsSync4(workspaceRoot) || !lstatSync(workspaceRoot).isDirectory())
@@ -9556,7 +9606,7 @@ function projectContextWorkspaceForSession(input, runtime) {
 function assertCodewithTargetIsConsumed(workspaceRoot, runtime) {
   if (runtime !== "codewith")
     return;
-  const override = resolve(workspaceRoot, ".codewith", "CODEWITH.override.md");
+  const override = resolve2(workspaceRoot, ".codewith", "CODEWITH.override.md");
   if (!existsSync4(override))
     return;
   assertNoSymlinkSegments(workspaceRoot, override);
@@ -9567,7 +9617,7 @@ function assertCodewithTargetIsConsumed(workspaceRoot, runtime) {
 function assertSafeWorkspaceRoot(path) {
   if (!isAbsolute(path))
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "workspace root must be absolute");
-  const normalized = resolve(path);
+  const normalized = resolve2(path);
   if (normalized === parse(normalized).root)
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "workspace root cannot be the filesystem root");
   if (!existsSync4(normalized) || !lstatSync(normalized).isDirectory())
@@ -9584,17 +9634,17 @@ function assertNoSymlinkSegments(root, target) {
   }
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     if (existsSync4(current) && lstatSync(current).isSymbolicLink()) {
       throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", `managed path uses a symlink: ${current}`);
     }
   }
 }
 function assertNoSymlinkAncestors(path) {
-  const normalized = resolve(path);
+  const normalized = resolve2(path);
   let current = parse(normalized).root;
   for (const segment of relative(current, normalized).split(/[\\/]+/).filter(Boolean)) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     if (!existsSync4(current))
       return;
     if (lstatSync(current).isSymbolicLink())
@@ -9630,10 +9680,10 @@ function fragmentMatchesBundle(path, bundle, workspaceRoot) {
 }
 function durableSourcePath(path, workspaceRoot) {
   if (!path || path.startsWith("/dev/fd/"))
-    return resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
-  const normalized = isAbsolute(path) ? resolve(path) : resolve(workspaceRoot, path);
+    return resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
+  const normalized = isAbsolute(path) ? resolve2(path) : resolve2(workspaceRoot, path);
   if (normalized.startsWith("/dev/fd/"))
-    return resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
+    return resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
   return normalized;
 }
 function compareRevisions(incoming, previous) {
@@ -10193,7 +10243,7 @@ function compareProviderVersions(left, right) {
 
 // src/lib/asset-plan.ts
 import { createHash as createHash3 } from "crypto";
-import { isAbsolute as isAbsolute2, posix, resolve as resolve2 } from "path";
+import { isAbsolute as isAbsolute2, posix, resolve as resolve3 } from "path";
 function assetCapability(provider, surface, kind, support, strategies, note, providerVersionRange = "*") {
   return Object.freeze({
     schema: ASSET_CAPABILITY_SCHEMA,
@@ -10400,8 +10450,8 @@ function resolveAssetDestination(item, roots) {
   if (!isAbsolute2(root))
     throw new Error(`Asset ${item.assetKey} destination root must be absolute.`);
   const relativePath = safeRelativePath(item.destination.relativePath);
-  const target = resolve2(root, ...relativePath.split("/"));
-  const normalizedRoot = resolve2(root);
+  const target = resolve3(root, ...relativePath.split("/"));
+  const normalizedRoot = resolve3(root);
   if (target === normalizedRoot)
     throw new Error(`Asset ${item.assetKey} destination cannot replace its root.`);
   if (!target.startsWith(`${normalizedRoot}/`))
@@ -10581,23 +10631,19 @@ var init_asset_plan = __esm(() => {
 // src/lib/cursor-authority.ts
 import { createHash as createHash4 } from "crypto";
 import { lstatSync as lstatSync2, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join5, resolve as resolve3 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join6, resolve as resolve4 } from "path";
 function sha2564(content) {
   return createHash4("sha256").update(content).digest("hex");
 }
 function homeDir() {
-  return process.env["HOME"] || homedir3();
+  return process.env["HOME"] || homedir4();
 }
-function markerPayload(content, markerLine) {
-  const withTrailingNewline = `${markerLine}
-`;
-  if (content.startsWith(withTrailingNewline))
-    return content.slice(withTrailingNewline.length);
-  if (content.startsWith(markerLine))
-    return content.slice(markerLine.length).replace(/^\n/, "");
-  return content.replace(`${markerLine}
-`, "").replace(markerLine, "");
+function markerPayload(content, markerLine, markerIndex) {
+  const index = markerIndex ?? content.indexOf(markerLine);
+  if (index < 0)
+    return content;
+  return content.slice(0, index) + content.slice(index + markerLine.length).replace(/^\n/, "");
 }
 function baseObservation(path) {
   return {
@@ -10607,12 +10653,12 @@ function baseObservation(path) {
   };
 }
 function observeCursorGlobalAuthority(options = {}) {
-  const authorityPath = resolve3(join5(options.home ?? homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+  const authorityPath = resolve4(join6(options.home ?? homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
   const readFile2 = options.readFile ?? ((path) => readFileSync2(path, "utf8"));
   return observeCursorGlobalAuthorityPath(authorityPath, readFile2);
 }
 function observeCursorGlobalAuthorityAtPath(authorityPath) {
-  return observeCursorGlobalAuthorityPath(resolve3(authorityPath), (path) => readFileSync2(path, "utf8"));
+  return observeCursorGlobalAuthorityPath(resolve4(authorityPath), (path) => readFileSync2(path, "utf8"));
 }
 function observeCursorGlobalAuthorityPath(authorityPath, readFile2) {
   const base = baseObservation(authorityPath);
@@ -10724,7 +10770,7 @@ function observeCursorGlobalAuthorityPath(authorityPath, readFile2) {
     };
   }
   const markerLine = markerMatch[0];
-  const payloadSha256 = sha2564(markerPayload(content, markerLine));
+  const payloadSha256 = sha2564(markerPayload(content, markerLine, markerMatch.index ?? -1));
   if (payloadSha256 !== markerSha256) {
     return {
       ...base,
@@ -10741,53 +10787,147 @@ function observeCursorGlobalAuthorityPath(authorityPath, readFile2) {
       }
     };
   }
-  return {
-    ...base,
-    fileType,
-    status: "unmanaged",
-    sha256: contentSha256,
+  return {
+    ...base,
+    fileType,
+    status: "managed",
+    sha256: contentSha256,
+    markers,
+    markerSha256,
+    provenance: {
+      source: "filesystem",
+      authority: "managed",
+      observedPath: authorityPath,
+      detection: "managed-marker"
+    }
+  };
+}
+function isCursorGlobalAuthorityPath(path) {
+  return resolve4(path) === resolve4(join6(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+}
+function stampCursorGlobalAuthorityMarker(content) {
+  if (CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN.test(content))
+    return content;
+  const digest = sha2564(content);
+  const markerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest} -->`;
+  const frontmatter = content.match(CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN)?.[0];
+  if (frontmatter) {
+    return `${frontmatter}${markerLine}
+${content.slice(frontmatter.length)}`;
+  }
+  return `${markerLine}
+${content}`;
+}
+function detectCursorAuthorityConflicts(observation = observeCursorGlobalAuthority()) {
+  if (observation.status === "absent" || observation.status === "managed")
+    return [];
+  const detection = observation.provenance.detection;
+  const invalid = observation.status === "invalid";
+  return [{
+    tool: "cursor",
+    relativePath: CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH,
+    path: observation.path,
+    kind: invalid ? "invalid-unmanaged-authority" : "unknown-unmanaged-authority",
+    sha256: observation.sha256,
+    markers: observation.markers,
+    provenance: {
+      source: "filesystem",
+      authority: "unmanaged",
+      observedPath: observation.path,
+      detection
+    },
+    reason: invalid ? `Cursor fixed global authority ${CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH} is not a verifiable regular managed file; refusing to render project rules.` : `Cursor fixed global authority ${CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH} is unmanaged; refusing to guess whether it conflicts with the managed project render.`
+  }];
+}
+var CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH = ".cursor/rules/hasna-global.mdc", CURSOR_GLOBAL_AUTHORITY_MAX_BYTES, CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER = "Managed by @hasna/configs cursor global authority", CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN, CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN;
+var init_cursor_authority = __esm(() => {
+  CURSOR_GLOBAL_AUTHORITY_MAX_BYTES = 256 * 1024;
+  CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN = /^<!-- Managed by @hasna\/configs cursor global authority hash=(sha256:[a-f0-9]{64}) -->$/m;
+  CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN = /^---\n[\s\S]*?\n---(?:\n|$)/;
+});
+
+// src/lib/session-authority.ts
+import { createHash as createHash5 } from "crypto";
+import { lstatSync as lstatSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { join as join7, resolve as resolve5 } from "path";
+function sha2565(content) {
+  return createHash5("sha256").update(content).digest("hex");
+}
+function detectClaudeAuthorityConflicts(targetHome) {
+  const authorityPath = resolve5(join7(targetHome, CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH));
+  let stat;
+  try {
+    stat = lstatSync3(authorityPath);
+  } catch {
+    return [];
+  }
+  const provenanceBase = {
+    tool: "claude",
+    relativePath: CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH,
+    path: authorityPath
+  };
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    return [{
+      ...provenanceBase,
+      kind: "invalid-unmanaged-authority",
+      sha256: null,
+      markers: [],
+      provenance: {
+        source: "filesystem",
+        authority: "unmanaged",
+        observedPath: authorityPath,
+        detection: "non-regular-file"
+      },
+      reason: "Claude target contains unmanaged AGENTS.md that is not a regular file; authority cannot be verified safely."
+    }];
+  }
+  if (statSync2(authorityPath).size > CLAUDE_LEGACY_AUTHORITY_MAX_BYTES) {
+    return [{
+      ...provenanceBase,
+      kind: "invalid-unmanaged-authority",
+      sha256: null,
+      markers: [],
+      provenance: {
+        source: "filesystem",
+        authority: "unmanaged",
+        observedPath: authorityPath,
+        detection: "oversized-file"
+      },
+      reason: `Claude target contains unmanaged AGENTS.md larger than ${CLAUDE_LEGACY_AUTHORITY_MAX_BYTES} bytes; authority cannot be classified safely.`
+    }];
+  }
+  const content = readFileSync3(authorityPath, "utf8");
+  const markers = CLAUDE_LEGACY_MARKERS.filter((marker) => marker.pattern.test(content)).map((marker) => marker.id);
+  const knownLegacy = markers.includes("no-worktrees-heading") && markers.includes("no-worktrees-directive");
+  return [{
+    ...provenanceBase,
+    kind: knownLegacy ? "known-legacy-no-worktree" : "unknown-unmanaged-authority",
+    sha256: sha2565(content),
     markers,
-    markerSha256,
     provenance: {
       source: "filesystem",
       authority: "unmanaged",
       observedPath: authorityPath,
-      detection: "unknown-content"
-    }
-  };
-}
-function detectCursorAuthorityConflicts(observation = observeCursorGlobalAuthority()) {
-  if (observation.status === "absent" || observation.status === "managed")
-    return [];
-  const detection = observation.provenance.detection;
-  const invalid = observation.status === "invalid";
-  return [{
-    tool: "cursor",
-    relativePath: CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH,
-    path: observation.path,
-    kind: invalid ? "invalid-unmanaged-authority" : "unknown-unmanaged-authority",
-    sha256: observation.sha256,
-    markers: observation.markers,
-    provenance: {
-      source: "filesystem",
-      authority: "unmanaged",
-      observedPath: observation.path,
-      detection
+      detection: knownLegacy ? "known-legacy-markers" : "unknown-content"
     },
-    reason: invalid ? `Cursor fixed global authority ${CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH} is not a verifiable regular managed file; refusing to render project rules.` : `Cursor fixed global authority ${CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH} is unmanaged; refusing to guess whether it conflicts with the managed project render.`
+    reason: knownLegacy ? "Claude target contains unmanaged legacy AGENTS.md with no-worktree directives; migrate or remove it through an owned authority path before applying." : "Claude target contains unmanaged AGENTS.md with unknown authority content; refusing to guess whether it conflicts with the managed Claude render."
   }];
 }
-var CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH = ".cursor/rules/hasna-global.mdc", CURSOR_GLOBAL_AUTHORITY_MAX_BYTES, CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER = "Managed by @hasna/configs cursor global authority", CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN;
-var init_cursor_authority = __esm(() => {
-  CURSOR_GLOBAL_AUTHORITY_MAX_BYTES = 256 * 1024;
-  CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN = /^<!-- Managed by @hasna\/configs cursor global authority hash=(sha256:[a-f0-9]{64}) -->$/m;
+var CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH = "AGENTS.md", CLAUDE_LEGACY_AUTHORITY_MAX_BYTES, CLAUDE_LEGACY_MARKERS;
+var init_session_authority = __esm(() => {
+  CLAUDE_LEGACY_AUTHORITY_MAX_BYTES = 256 * 1024;
+  CLAUDE_LEGACY_MARKERS = [
+    { id: "claude-agent-rules-heading", pattern: /^# Agent Rules \(Claude\)/m },
+    { id: "no-worktrees-heading", pattern: /^## No Worktrees/m },
+    { id: "no-worktrees-directive", pattern: /\bNever use git worktrees\b/m }
+  ];
 });
 
 // src/lib/session-render.ts
-import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync3, realpathSync, statSync as statSync2 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute3, join as join6, parse as parse2, posix as posix2, relative as relative2, resolve as resolve4 } from "path";
+import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync4, realpathSync, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute3, join as join8, parse as parse2, posix as posix2, relative as relative2, resolve as resolve6 } from "path";
 function normalizeSessionInstructionLayer(value) {
   if (value === "provider")
     return "tool";
@@ -10804,11 +10944,11 @@ function ensureTrailingNewline3(content) {
 `) ? content : `${content}
 `;
 }
-function sha2565(content) {
-  return createHash5("sha256").update(content).digest("hex");
+function sha2566(content) {
+  return createHash6("sha256").update(content).digest("hex");
 }
 function fingerprint(value) {
-  return sha2565(JSON.stringify(value));
+  return sha2566(JSON.stringify(value));
 }
 function canonicalFingerprintValue(value) {
   if (Array.isArray(value))
@@ -10826,7 +10966,7 @@ function ruleAttestation(rule) {
   };
   const applied = metadata["payloadFloorApplied"];
   return {
-    contentSha256: sha2565(rule.content ?? ""),
+    contentSha256: sha2566(rule.content ?? ""),
     payloadFloorApplied: typeof applied === "boolean" ? applied : null,
     flooredFromRulesVersion: read("flooredFromRulesVersion"),
     flooredFromPayloadSha256: read("flooredFromPayloadSha256"),
@@ -10872,16 +11012,14 @@ function slug(value) {
 function yamlQuote2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
-function getRawStoreRoot() {
-  return resolve4(process.env[RAW_STORE_ROOT_ENV] || join6(process.env["HOME"] || homedir4(), ".hasna", "configs"));
-}
 function defaultTargetHome(tool, profile, sessionId) {
-  return join6(getRawStoreRoot(), "sessions", tool, slug(profile), slug(sessionId || "latest"));
+  const home = process.env["HOME"] || homedir5();
+  return join8(home, ".hasna", "accounts", "profiles", tool, slug(profile));
 }
 function joinTarget(targetHome, relativePath) {
   const safeTargetHome = assertSafeTargetRoot(targetHome);
   const safeRelativePath2 = assertSafeRelativePath(relativePath);
-  return join6(safeTargetHome, ...safeRelativePath2.split("/"));
+  return join8(safeTargetHome, ...safeRelativePath2.split("/"));
 }
 function makeFile(targetHome, relativePath, role, content, sourceIds) {
   const safeTargetHome = assertSafeTargetRoot(targetHome);
@@ -10892,7 +11030,7 @@ function makeFile(targetHome, relativePath, role, content, sourceIds) {
     relativePath: safeRelativePath2,
     role,
     content: normalizedContent,
-    sha256: sha2565(normalizedContent),
+    sha256: sha2566(normalizedContent),
     sourceIds
   };
 }
@@ -10926,7 +11064,7 @@ function applyAgentOperatingRulesFloor(source, content) {
   const floored = {
     payloadFloorApplied: true,
     flooredFromRulesVersion: parseAgentOperatingRulesVersion(content),
-    flooredFromPayloadSha256: sha2565(content)
+    flooredFromPayloadSha256: sha2566(content)
   };
   return {
     content: payload.content,
@@ -10948,7 +11086,7 @@ function applyAgentOperatingRulesFloorToRule(source, rule, content) {
   const floored = {
     payloadFloorApplied: true,
     flooredFromRulesVersion: parseAgentOperatingRulesVersion(content),
-    flooredFromPayloadSha256: sha2565(content)
+    flooredFromPayloadSha256: sha2566(content)
   };
   return {
     content: payload.content,
@@ -10967,7 +11105,7 @@ function skippedSource(source, reason) {
       order: source.resolvedOrder,
       path: source.path ?? null,
       hash: source.hash ?? null,
-      renderedPayloadSha256: sha2565(source.content),
+      renderedPayloadSha256: sha2566(source.content),
       nonOverridable: source.nonOverridable === true,
       provenance: source.provenance ?? null
     }
@@ -11009,7 +11147,7 @@ function compareSessionInstructionSources(a, b) {
   return SESSION_LAYER_RANK[a.resolvedLayer] - SESSION_LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id);
 }
 function semanticPolicyIntegrity(body) {
-  return sha2565(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
+  return sha2566(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
 }
 function semanticPolicyDeclaration(source) {
   const normalize = (value) => value.replace(/\r\n/g, `
@@ -11234,7 +11372,7 @@ function composeSources(sources, tool) {
             targetSourceId: target.id,
             targetNormalizedSourceId: target.normalizedId,
             targetHash: target.hash ?? null,
-            targetRenderedPayloadSha256: sha2565(target.content),
+            targetRenderedPayloadSha256: sha2566(target.content),
             targetNonOverridable: protectedReplacement,
             authority: protectedReplacement ? "canonical-identity-export/codewith-provider/v1" : "overridable-source/v1"
           }
@@ -11416,7 +11554,7 @@ function buildOpenCodeFiles(targetHome, adapter, profile, sources, providerConfi
     ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
   ]);
   const existingConfigPath = joinTarget(targetHome, adapter.configFile);
-  const selectedConfig = existsSync5(existingConfigPath) ? readOpenCodeConfig(readFileSync3(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
+  const selectedConfig = existsSync5(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
   const preservedInstructions = normalizeOpenCodeInstructions(selectedConfig["instructions"]).filter((path) => !pathIsManagedOpenCodeInstruction(path, adapter.managedDir));
   const config = {
     ...selectedConfig,
@@ -11565,7 +11703,7 @@ function buildAssetFiles(input, targetHome, blocked) {
       relativePath: assertSafeRelativePath(relativePath),
       role: "asset",
       content,
-      sha256: sha2565(content),
+      sha256: sha2566(content),
       sourceIds: [item.sourceConfigId, item.assetId]
     };
   });
@@ -11605,7 +11743,7 @@ function adapterFor(input) {
   return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
 }
 function getHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir4();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
 }
 function cleanSessionPathInput(path) {
   const trimmed = path.trim();
@@ -11620,16 +11758,16 @@ function resolveSessionPath(path) {
     throw new Error("Session render path cannot be empty.");
   const home = getHomeDir();
   if (cleaned === "~")
-    return resolve4(home);
+    return resolve6(home);
   if (cleaned.startsWith("~/"))
-    return resolve4(home, cleaned.slice(2));
+    return resolve6(home, cleaned.slice(2));
   if (cleaned === "{{HOME}}" || cleaned === "${HOME}")
-    return resolve4(home);
+    return resolve6(home);
   if (cleaned.startsWith("{{HOME}}/"))
-    return resolve4(home, cleaned.slice("{{HOME}}/".length));
+    return resolve6(home, cleaned.slice("{{HOME}}/".length));
   if (cleaned.startsWith("${HOME}/"))
-    return resolve4(home, cleaned.slice("${HOME}/".length));
-  return resolve4(cleaned);
+    return resolve6(home, cleaned.slice("${HOME}/".length));
+  return resolve6(cleaned);
 }
 function assertSafeRelativePath(relativePath) {
   if (!relativePath.trim())
@@ -11645,7 +11783,7 @@ function assertSafeRelativePath(relativePath) {
 function assertSafeTargetRoot(targetHome) {
   if (!isAbsolute3(targetHome))
     throw new Error(`Session render target must be an absolute path: ${targetHome}`);
-  const normalized = resolve4(targetHome);
+  const normalized = resolve6(targetHome);
   if (normalized === parse2(normalized).root) {
     throw new Error(`Session render target cannot be the filesystem root: ${targetHome}`);
   }
@@ -11743,7 +11881,7 @@ function planSessionRender(input) {
     blockers: targetBlockers
   } = resolveRenderTarget(input);
   const authorityObservations = input.tool === "cursor" && targetKind !== "blocked" ? [observeCursorGlobalAuthority({ home: input.cursorAuthorityHome })] : [];
-  const authorityConflicts = input.tool === "cursor" && targetKind !== "blocked" ? detectCursorAuthorityConflicts(authorityObservations[0]) : [];
+  const authorityConflicts = input.tool === "cursor" && targetKind !== "blocked" ? detectCursorAuthorityConflicts(authorityObservations[0]) : input.tool === "claude" && targetKind !== "blocked" ? detectClaudeAuthorityConflicts(targetHome) : [];
   const blockers = [
     ...targetBlockers,
     ...authorityConflicts.map((conflict) => `${conflict.relativePath}: ${conflict.reason}`)
@@ -11841,7 +11979,7 @@ function planSessionRender(input) {
           hash: rule.hash ?? null,
           ...ruleAttestation(rule)
         })),
-        renderedPayloadSha256: sha2565(source.content),
+        renderedPayloadSha256: sha2566(source.content),
         provenance: source.provenance ?? null,
         metadata: source.metadata ?? null
       })),
@@ -11879,8 +12017,8 @@ function planSessionRender(input) {
     ...input.providerConfig ? {
       providerConfig: {
         sourceId: input.providerConfig.sourceId,
-        selectedPayloadSha256: sha2565(input.providerConfig.content),
-        renderedPayloadSha256: files.find((file) => file.relativePath === adapter.configFile)?.sha256 ?? sha2565(input.providerConfig.content),
+        selectedPayloadSha256: sha2566(input.providerConfig.content),
+        renderedPayloadSha256: files.find((file) => file.relativePath === adapter.configFile)?.sha256 ?? sha2566(input.providerConfig.content),
         selected: !existsSync5(joinTarget(targetHome, adapter.configFile))
       }
     } : {},
@@ -12166,7 +12304,7 @@ function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
     }
     return;
   }
-  const stat = statSync2(resolvedPath);
+  const stat = statSync3(resolvedPath);
   if (!stat.isFile()) {
     throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
   }
@@ -12175,7 +12313,7 @@ function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
   if (!pathIsInside(realPath, realBase)) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
   }
-  return readFileSync3(realPath, "utf-8");
+  return readFileSync4(realPath, "utf-8");
 }
 function resolveIdentitySourcePath(path, baseDir, sourceId) {
   const cleaned = cleanSessionPathInput(path);
@@ -12183,8 +12321,8 @@ function resolveIdentitySourcePath(path, baseDir, sourceId) {
     throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
   if (cleaned.includes("\\"))
     throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
-  const resolvedPath = isAbsolute3(cleaned) ? resolve4(cleaned) : resolve4(baseDir, cleaned);
-  if (!pathIsInside(resolvedPath, resolve4(baseDir))) {
+  const resolvedPath = isAbsolute3(cleaned) ? resolve6(cleaned) : resolve6(baseDir, cleaned);
+  if (!pathIsInside(resolvedPath, resolve6(baseDir))) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
   }
   return resolvedPath;
@@ -12272,7 +12410,7 @@ function asStringArray(value) {
     return [];
   return value.filter((item) => typeof item === "string");
 }
-var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME", ANTIGRAVITY_RULE_FILE_CHAR_LIMIT = 12000, SESSION_RENDERER_OWNER_ID = "instructions-session-renderer", SESSION_RENDER_TOOLS, SESSION_RENDER_PROFILE_ENTRYPOINTS, SESSION_RENDER_OWNED_CONFIG_TARGETS, IDENTITY_EXPORT_AUTHORITY, CODEWITH_PROTECTED_REPLACEMENT_TARGETS, CODEWITH_FLATTENED_ADAPTER, CODEWITH_NATIVE_ADAPTER, SESSION_TOOL_ADAPTERS, SESSION_RENDER_MANAGED_DIRS, SESSION_RENDER_SHARED_MANAGED_DIRS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, SESSION_LAYER_RANK, CANONICAL_IDENTITY_EXPORT_PACKAGES;
+var ANTIGRAVITY_RULE_FILE_CHAR_LIMIT = 12000, SESSION_RENDERER_OWNER_ID = "instructions-session-renderer", SESSION_RENDER_TOOLS, SESSION_RENDER_PROFILE_ENTRYPOINTS, SESSION_RENDER_OWNED_CONFIG_TARGETS, IDENTITY_EXPORT_AUTHORITY, CODEWITH_PROTECTED_REPLACEMENT_TARGETS, CODEWITH_FLATTENED_ADAPTER, CODEWITH_NATIVE_ADAPTER, SESSION_TOOL_ADAPTERS, SESSION_RENDER_MANAGED_DIRS, SESSION_RENDER_SHARED_MANAGED_DIRS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, SESSION_LAYER_RANK, CANONICAL_IDENTITY_EXPORT_PACKAGES;
 var init_session_render = __esm(() => {
   init_global_agent_rules_standard();
   init_codewith_shared_todos_storage_standard();
@@ -12281,8 +12419,11 @@ var init_session_render = __esm(() => {
   init_transforms();
   init_asset_plan();
   init_cursor_authority();
+  init_session_authority();
   init_session_render_contract();
   init_session_render_contract();
+  init_raw_store_root();
+  init_raw_store_root();
   SESSION_RENDER_TOOLS = [
     "claude",
     "codex",
@@ -12483,7 +12624,7 @@ var init_session_render = __esm(() => {
 });
 
 // src/lib/instruction-graph.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function capability(provider, providerVersionRange, selectedRepresentation, loadingPath, options = {}) {
   return Object.freeze({
     schema: PROVIDER_CAPABILITY_SCHEMA,
@@ -12730,7 +12871,7 @@ function compileInstructionGraph(input) {
       effective_activation: effective.get(configId),
       fallback: row.binding.fallback,
       required: row.binding.required,
-      content_sha256: sha2566(config.content),
+      content_sha256: sha2567(config.content),
       dependencies: dependencies.get(configId) ?? []
     };
   });
@@ -12767,7 +12908,7 @@ function compileInstructionGraph(input) {
     diagnostics
   };
   return {
-    plan: deepFreeze2({ ...planWithoutHash, source_hash: sha2566(stableJson2(planWithoutHash)) }),
+    plan: deepFreeze2({ ...planWithoutHash, source_hash: sha2567(stableJson2(planWithoutHash)) }),
     sources,
     capability: capability2
   };
@@ -12941,8 +13082,8 @@ function assertExactOnce(units, artifacts) {
 function errorDiagnostic(configId, code, message) {
   return { severity: "error", code, config_id: configId, message };
 }
-function sha2566(value) {
-  return createHash6("sha256").update(value).digest("hex");
+function sha2567(value) {
+  return createHash7("sha256").update(value).digest("hex");
 }
 function stableJson2(value) {
   const canonical = (entry) => Array.isArray(entry) ? entry.map(canonical) : entry && typeof entry === "object" ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => [key, canonical(child)])) : entry;
@@ -13241,37 +13382,6 @@ var init_profiles = __esm(() => {
   init_asset_plan();
 });
 
-// src/db/snapshots.ts
-function createSnapshot(configId, content, version, db) {
-  const d = db || getDatabase();
-  const id = uuid();
-  const ts = now2();
-  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
-  return { id, config_id: configId, content, version, created_at: ts };
-}
-function listSnapshots(configId, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
-}
-function getSnapshot(id, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
-}
-function getSnapshotByVersion(configId, version, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
-}
-function pruneSnapshots(configId, keep = 10, db) {
-  const d = db || getDatabase();
-  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
-      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
-    )`, [configId, configId, keep]);
-  return result.changes;
-}
-var init_snapshots = __esm(() => {
-  init_database();
-});
-
 // src/db/machines.ts
 import { arch, hostname, type } from "os";
 function currentHostname2() {
@@ -13873,8 +13983,8 @@ var init_config_store = __esm(() => {
 });
 
 // src/lib/session-render-ownership.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import { dirname as dirname3, join as join7, parse as parse3, relative as relative3, sep } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname3, join as join9, parse as parse3, relative as relative3, sep } from "path";
 function toSegments(absolutePath2) {
   return absolutePath2.replaceAll("\\", "/").split("/").filter(Boolean);
 }
@@ -13895,7 +14005,7 @@ function readManifestRelativePaths(manifestPath) {
   try {
     if (!existsSync6(manifestPath))
       return null;
-    stats = statSync3(manifestPath);
+    stats = statSync4(manifestPath);
   } catch {
     return null;
   }
@@ -13905,7 +14015,7 @@ function readManifestRelativePaths(manifestPath) {
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync4(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
   } catch {
     return null;
   }
@@ -13922,7 +14032,7 @@ function sessionRenderManifestClaimsPath(absolutePath2) {
   const root = parse3(absolutePath2).root;
   let home = dirname3(absolutePath2);
   for (let depth = 0;depth < MANIFEST_ANCESTOR_LIMIT; depth += 1) {
-    const manifestPath = join7(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
+    const manifestPath = join9(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
     const relativePaths = readManifestRelativePaths(manifestPath);
     if (relativePaths) {
       const claimed = relative3(home, absolutePath2).split(sep).join("/");
@@ -13949,25 +14059,25 @@ var init_session_render_ownership = __esm(() => {
 // src/lib/apply.ts
 var exports_apply = {};
 __export(exports_apply, {
-  previewConfigs: () => previewConfigs,
-  normalizeTargetPath: () => normalizeTargetPath,
-  getConfigHome: () => getConfigHome,
-  expandPath: () => expandPath,
-  applyConfigsWithReport: () => applyConfigsWithReport,
+  applyConfig: () => applyConfig,
   applyConfigs: () => applyConfigs,
-  applyConfig: () => applyConfig
+  applyConfigsWithReport: () => applyConfigsWithReport,
+  expandPath: () => expandPath,
+  getConfigHome: () => getConfigHome,
+  normalizeTargetPath: () => normalizeTargetPath,
+  previewConfigs: () => previewConfigs
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync5, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename4, dirname as dirname4, join as join8, resolve as resolve5 } from "path";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename4, dirname as dirname4, join as join10, resolve as resolve7 } from "path";
+import { homedir as homedir6 } from "os";
 function getConfigHome() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir6();
 }
 function expandPath(p) {
   if (p.startsWith("~/")) {
-    return resolve5(getConfigHome(), p.slice(2));
+    return resolve7(getConfigHome(), p.slice(2));
   }
-  return resolve5(p);
+  return resolve7(p);
 }
 function normalizeTargetPath(p) {
   const expanded = expandPath(p);
@@ -13979,7 +14089,7 @@ function normalizeTargetPath(p) {
     while (true) {
       if (existsSync7(current)) {
         try {
-          return resolve5(realpathSync2(current), ...missingSegments);
+          return resolve7(realpathSync2(current), ...missingSegments);
         } catch {
           return expanded;
         }
@@ -14007,8 +14117,9 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
     throw new ConfigApplyError(`Antigravity rule file ${renderedTargetPath} is ${renderedContent.length} characters; split it before applying because Antigravity limits rule files to ${ANTIGRAVITY_RULE_FILE_CHAR_LIMIT} characters.`);
   }
   const path = expandPath(renderedTargetPath);
-  const previousContent = existsSync7(path) ? readFileSync5(path, "utf-8") : null;
-  const changed = previousContent !== renderedContent;
+  const renderedForTarget = isCursorGlobalAuthorityPath(path) ? stampCursorGlobalAuthorityMarker(renderedContent) : renderedContent;
+  const previousContent = existsSync7(path) ? readFileSync6(path, "utf-8") : null;
+  const changed = previousContent !== renderedForTarget;
   if (!opts.dryRun) {
     const dir = dirname4(path);
     if (!existsSync7(dir)) {
@@ -14018,13 +14129,13 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
       const store = opts.store ?? resolveConfigStore();
       await store.createSnapshot(config.id, previousContent, config.version);
     }
-    writeFileSync2(path, renderedContent, "utf-8");
+    writeFileSync2(path, renderedForTarget, "utf-8");
   }
   return {
     config_id: config.id,
     path,
     previous_content: previousContent,
-    new_content: renderedContent,
+    new_content: renderedForTarget,
     dry_run: opts.dryRun ?? false,
     changed,
     primary_changed: changed,
@@ -14047,7 +14158,7 @@ function wouldDestroyACredential(targetPath, renderedContent, format) {
     const path = expandPath(targetPath);
     if (!existsSync7(path))
       return [];
-    current = readFileSync5(path, "utf-8");
+    current = readFileSync6(path, "utf-8");
   } catch {
     return secretTokens;
   }
@@ -14371,7 +14482,7 @@ function sessionRendererOwnsCanonicalTarget(normalized, opts) {
     getConfigHome(),
     opts.vars?.["HOME_DIR"]
   ].filter((home) => typeof home === "string" && home.length > 0));
-  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join8(home, ...relativePath.split("/"))))))
+  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join10(home, ...relativePath.split("/"))))))
     return true;
   return sessionRenderOwnsPath(normalized);
 }
@@ -14385,12 +14496,13 @@ var init_apply = __esm(() => {
   init_redact();
   init_template();
   init_transforms();
+  init_cursor_authority();
 });
 
 // src/lib/sync-dir.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { join as join9, relative as relative4 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
+import { join as join11, relative as relative4 } from "path";
+import { homedir as homedir7 } from "os";
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
 }
@@ -14399,9 +14511,9 @@ async function syncFromDir(dir, opts = {}) {
   const absDir = expandPath(dir);
   if (!existsSync8(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
-  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join9(absDir, f)).filter((f) => statSync4(f).isFile());
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join11(absDir, f)).filter((f) => statSync5(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const home = homedir6();
+  const home = homedir7();
   const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
@@ -14409,7 +14521,7 @@ async function syncFromDir(dir, opts = {}) {
       continue;
     }
     try {
-      const content = readFileSync6(file, "utf-8");
+      const content = readFileSync7(file, "utf-8");
       if (content.length > 500000) {
         result.skipped.push(file + " (too large)");
         continue;
@@ -14435,7 +14547,7 @@ async function syncFromDir(dir, opts = {}) {
 }
 async function syncToDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const home = homedir6();
+  const home = homedir7();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
   const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
@@ -14459,7 +14571,7 @@ async function syncToDir(dir, opts = {}) {
 }
 function walkDir(dir, files = []) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join9(dir, entry.name);
+    const full = join11(dir, entry.name);
     if (shouldSkip(full))
       continue;
     if (entry.isDirectory())
@@ -14480,21 +14592,21 @@ var init_sync_dir = __esm(() => {
 // src/lib/sync.ts
 var exports_sync = {};
 __export(exports_sync, {
-  syncToDisk: () => syncToDisk,
-  syncToDir: () => syncToDir,
-  syncProject: () => syncProject,
-  syncKnown: () => syncKnown,
-  syncFromDir: () => syncFromDir,
-  diffConfig: () => diffConfig,
-  detectFormat: () => detectFormat,
-  detectCategory: () => detectCategory,
-  detectAgent: () => detectAgent,
-  PROJECT_CONFIG_FILES: () => PROJECT_CONFIG_FILES,
+  CLAUDE_PROMPT_OUTPUTS: () => CLAUDE_PROMPT_OUTPUTS,
   KNOWN_CONFIGS: () => KNOWN_CONFIGS,
-  CLAUDE_PROMPT_OUTPUTS: () => CLAUDE_PROMPT_OUTPUTS
+  PROJECT_CONFIG_FILES: () => PROJECT_CONFIG_FILES,
+  detectAgent: () => detectAgent,
+  detectCategory: () => detectCategory,
+  detectFormat: () => detectFormat,
+  diffConfig: () => diffConfig,
+  syncFromDir: () => syncFromDir,
+  syncKnown: () => syncKnown,
+  syncProject: () => syncProject,
+  syncToDir: () => syncToDir,
+  syncToDisk: () => syncToDisk
 });
-import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
-import { basename as basename5, extname as extname3, join as join10 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync8 } from "fs";
+import { basename as basename5, extname as extname3, join as join12 } from "path";
 function claudeRuleOutputs(fileName) {
   const stem = basename5(fileName, extname3(fileName));
   return [
@@ -14558,11 +14670,11 @@ async function syncProject(opts) {
   const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
-    const abs = join10(absDir, pf.file);
+    const abs = join12(absDir, pf.file);
     if (!existsSync9(abs))
       continue;
     try {
-      const rawContent = readFileSync7(abs, "utf-8");
+      const rawContent = readFileSync8(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(pf.file);
         continue;
@@ -14591,20 +14703,20 @@ async function syncProject(opts) {
     }
   }
   for (const ruleDir of [
-    { dir: join10(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
-    { dir: join10(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
-    { dir: join10(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
-    { dir: join10(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
-    { dir: join10(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
-    { dir: join10(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
-    { dir: join10(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
+    { dir: join12(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
+    { dir: join12(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
+    { dir: join12(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
+    { dir: join12(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
+    { dir: join12(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
+    { dir: join12(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
+    { dir: join12(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
   ]) {
     if (!existsSync9(ruleDir.dir))
       continue;
     const mdFiles = readdirSync2(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
     for (const f of mdFiles) {
-      const abs = join10(ruleDir.dir, f);
-      const raw = readFileSync7(abs, "utf-8");
+      const abs = join12(ruleDir.dir, f);
+      const raw = readFileSync8(abs, "utf-8");
       const redacted = redactContent(raw, "markdown");
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
@@ -14650,13 +14762,13 @@ async function syncKnown(opts = {}) {
       const extensions = known.rulesExtensions ?? [".md", ".mdc"];
       const ruleFiles = readdirSync2(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
       for (const f of ruleFiles) {
-        const abs2 = join10(absDir, f);
+        const abs2 = join12(absDir, f);
         const targetPath = abs2.replace(home, "~");
         if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
           result.skipped.push(`${targetPath} (generated output)`);
           continue;
         }
-        const raw = readFileSync7(abs2, "utf-8");
+        const raw = readFileSync8(abs2, "utf-8");
         const redacted = redactContent(raw, "markdown");
         const machineAware = templateizeMachineContent(redacted.content, machine);
         const content = machineAware.content;
@@ -14689,7 +14801,7 @@ async function syncKnown(opts = {}) {
       continue;
     }
     try {
-      const rawContent = normalizeKnownConfigSource(known, readFileSync7(abs, "utf-8"));
+      const rawContent = normalizeKnownConfigSource(known, readFileSync8(abs, "utf-8"));
       if (rawContent.length > 500000) {
         result.skipped.push(known.path + " (too large)");
         continue;
@@ -14792,7 +14904,7 @@ function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
   if (!existsSync9(path))
     return `(file not found on disk: ${path})`;
-  const diskContent = readFileSync7(path, "utf-8");
+  const diskContent = readFileSync8(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
   const format = redactFormatForTarget(targetPath, storedFormat);
@@ -15025,18 +15137,18 @@ __export(exports_package_manager_guard, {
   scanPackageManagerSecrets: () => scanPackageManagerSecrets
 });
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync15, lstatSync as lstatSync4, readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir7 } from "os";
-import { basename as basename6, dirname as dirname7, isAbsolute as isAbsolute5, join as join15, relative as relative6, resolve as resolve9 } from "path";
+import { existsSync as existsSync16, lstatSync as lstatSync6, readdirSync as readdirSync4, readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir9 } from "os";
+import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute5, join as join18, relative as relative7, resolve as resolve12 } from "path";
 function scanPackageManagerSecrets(options = {}) {
-  const cwd = options.cwd ? resolve9(options.cwd) : process.cwd();
-  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve9(cwd, root));
+  const cwd = options.cwd ? resolve12(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve12(cwd, root));
   const findings = [];
   let scannedFiles = 0;
   for (const root of roots) {
-    if (!existsSync15(root))
+    if (!existsSync16(root))
       continue;
-    const stat = lstatSync4(root);
+    const stat = lstatSync6(root);
     if (stat.isFile()) {
       if (!shouldScanRepoFile(root))
         continue;
@@ -15044,14 +15156,14 @@ function scanPackageManagerSecrets(options = {}) {
       if (text === null)
         continue;
       scannedFiles++;
-      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname7(root)));
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname8(root)));
       continue;
     }
     if (!stat.isDirectory())
       continue;
     const tracked = trackedFiles(root);
     for (const file of collectRepoFiles(root)) {
-      const rel = toPosix(relative6(root, file));
+      const rel = toPosix(relative7(root, file));
       const isTracked = tracked.has(rel);
       const text = readTextFile(file);
       if (text === null)
@@ -15061,10 +15173,10 @@ function scanPackageManagerSecrets(options = {}) {
     }
   }
   if (options.includeHome) {
-    const home = homedir7();
+    const home = homedir9();
     for (const name of HOME_FILES) {
-      const file = join15(home, name);
-      if (!existsSync15(file))
+      const file = join18(home, name);
+      if (!existsSync16(file))
         continue;
       const text = readTextFile(file);
       if (text === null)
@@ -15088,12 +15200,12 @@ function collectRepoFiles(root) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name))
           continue;
-        visit(join15(dir, entry.name));
+        visit(join18(dir, entry.name));
         continue;
       }
       if (!entry.isFile())
         continue;
-      const file = join15(dir, entry.name);
+      const file = join18(dir, entry.name);
       if (shouldScanRepoFile(file))
         out.push(file);
     }
@@ -15128,10 +15240,10 @@ function isNpmrcName(name) {
 }
 function readTextFile(file) {
   try {
-    const stat = lstatSync4(file);
+    const stat = lstatSync6(file);
     if (!stat.isFile() || stat.size > 5000000)
       return null;
-    const buf = readFileSync12(file);
+    const buf = readFileSync14(file);
     if (buf.includes(0))
       return null;
     return buf.toString("utf-8");
@@ -15331,11 +15443,11 @@ function trackedFiles(root) {
 }
 function isTrackedFile(file) {
   try {
-    const repoRoot = execFileSync2("git", ["-C", dirname7(file), "rev-parse", "--show-toplevel"], {
+    const repoRoot = execFileSync2("git", ["-C", dirname8(file), "rev-parse", "--show-toplevel"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
-    const rel = toPosix(relative6(repoRoot, file));
+    const rel = toPosix(relative7(repoRoot, file));
     execFileSync2("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], {
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -15361,13 +15473,13 @@ function stripInlineComment(value) {
   return value.replace(/\s[#;].*$/, "").trim();
 }
 function displayPath(file, root) {
-  const home = homedir7();
+  const home = homedir9();
   if (root === home && (file === home || file.startsWith(home + "/")))
-    return "~/" + toPosix(relative6(home, file));
+    return "~/" + toPosix(relative7(home, file));
   if (isAbsolute5(root) && file.startsWith(root + "/"))
-    return toPosix(relative6(root, file));
+    return toPosix(relative7(root, file));
   if (file === home || file.startsWith(home + "/"))
-    return "~/" + toPosix(relative6(home, file));
+    return "~/" + toPosix(relative7(home, file));
   return file;
 }
 function toPosix(path) {
@@ -15412,7 +15524,7 @@ var init_package_manager_guard = __esm(() => {
   ];
 });
 
-// ../../node_modules/.bun/@hasna+events@0.1.15/node_modules/@hasna/events/dist/commander.js
+// ../events/dist/commander.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync } from "fs";
@@ -16613,9 +16725,9 @@ var {
 // src/cli/index.tsx
 init_apply();
 import chalk from "chalk";
-import { existsSync as existsSync16, lstatSync as lstatSync5, readFileSync as readFileSync13, readSync, writeSync } from "fs";
-import { homedir as homedir8 } from "os";
-import { basename as basename7, join as join16, resolve as resolve10 } from "path";
+import { existsSync as existsSync17, lstatSync as lstatSync7, readFileSync as readFileSync15, readSync, writeSync } from "fs";
+import { homedir as homedir10 } from "os";
+import { basename as basename7, join as join19, resolve as resolve13 } from "path";
 
 // src/lib/config-target-identity.ts
 init_apply();
@@ -16662,14 +16774,14 @@ init_redact();
 // src/lib/export.ts
 init_config_store();
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join11, resolve as resolve6 } from "path";
+import { join as join13, resolve as resolve8 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const configs = await store.listConfigs(opts.filter);
-  const absOutput = resolve6(outputPath);
-  const tmpDir = join11(tmpdir(), `configs-export-${Date.now()}`);
-  const contentsDir = join11(tmpDir, "contents");
+  const absOutput = resolve8(outputPath);
+  const tmpDir = join13(tmpdir(), `configs-export-${Date.now()}`);
+  const contentsDir = join13(tmpDir, "contents");
   try {
     mkdirSync4(contentsDir, { recursive: true });
     const manifest = {
@@ -16677,10 +16789,10 @@ async function exportConfigs(outputPath, opts = {}) {
       exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
-    writeFileSync3(join11(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    writeFileSync3(join13(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
     for (const config of configs) {
       const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
-      writeFileSync3(join11(contentsDir, fileName), config.content, "utf-8");
+      writeFileSync3(join13(contentsDir, fileName), config.content, "utf-8");
     }
     const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
       stdout: "pipe",
@@ -16701,14 +16813,14 @@ async function exportConfigs(outputPath, opts = {}) {
 
 // src/lib/import.ts
 init_config_store();
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
-import { join as join12, resolve as resolve7 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, rmSync as rmSync4 } from "fs";
+import { join as join14, resolve as resolve9 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
-  const absPath = resolve7(bundlePath);
-  const tmpDir = join12(tmpdir2(), `configs-import-${Date.now()}`);
+  const absPath = resolve9(bundlePath);
+  const tmpDir = join14(tmpdir2(), `configs-import-${Date.now()}`);
   const result = { created: 0, updated: 0, skipped: 0, errors: [] };
   try {
     mkdirSync5(tmpDir, { recursive: true });
@@ -16721,15 +16833,15 @@ async function importConfigs(bundlePath, opts = {}) {
       const stderr = await new Response(proc.stderr).text();
       throw new Error(`tar extraction failed: ${stderr}`);
     }
-    const manifestPath = join12(tmpDir, "manifest.json");
+    const manifestPath = join14(tmpDir, "manifest.json");
     if (!existsSync11(manifestPath))
       throw new Error("Invalid bundle: missing manifest.json");
-    const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
+    const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
     for (const meta of manifest.configs) {
       try {
         const ext = meta.format === "text" ? "txt" : meta.format;
-        const contentFile = join12(tmpDir, "contents", `${meta.slug}.${ext}`);
-        const content = existsSync11(contentFile) ? readFileSync8(contentFile, "utf-8") : "";
+        const contentFile = join14(tmpDir, "contents", `${meta.slug}.${ext}`);
+        const content = existsSync11(contentFile) ? readFileSync9(contentFile, "utf-8") : "";
         let existing = null;
         try {
           existing = await store.getConfig(meta.slug);
@@ -16777,16 +16889,17 @@ init_machine();
 init_project_context();
 init_session_render();
 init_cursor_authority();
-import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
+init_session_authority();
+import { createHash as createHash8, randomUUID as randomUUID7 } from "crypto";
 import {
   existsSync as existsSync12,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync4,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   readdirSync as readdirSync3,
-  statSync as statSync5
+  statSync as statSync6
 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute4, join as join13, parse as parse4, relative as relative5, resolve as resolve8 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join15, parse as parse4, relative as relative5, resolve as resolve10 } from "path";
 
 class SessionApplyError extends Error {
   constructor(message) {
@@ -16807,6 +16920,7 @@ function applySessionRenderUnlocked(plan, options, coordination) {
   }
   assertCursorAuthorityUnchanged(plan);
   const targetHome = assertSafeTargetHome(plan.targetHome);
+  assertClaudeAuthorityStillClear(plan, targetHome);
   const payloadFiles = [...plan.files, ...plan.assetFiles ?? []];
   const files = [...payloadFiles, plan.manifestFile];
   const manifestPath = resolvePlannedFilePath(plan, plan.manifestFile, targetHome);
@@ -16907,6 +17021,15 @@ function assertCursorAuthorityUnchanged(plan) {
     throw new SessionApplyError("Cursor fixed global authority changed after planning; refusing to apply a stale render plan.");
   }
 }
+function assertClaudeAuthorityStillClear(plan, targetHome) {
+  if (plan.tool !== "claude" || plan.targetKind === "blocked")
+    return;
+  const conflicts = detectClaudeAuthorityConflicts(targetHome);
+  if (conflicts.length === 0)
+    return;
+  const summary = conflicts.map((conflict) => `${conflict.relativePath}: ${conflict.reason}`).join("; ");
+  throw new SessionApplyError(`Claude authority changed after planning; refusing to apply: ${summary}`);
+}
 function ensureSessionTargetHome(targetHome) {
   if (!existsSync12(targetHome))
     mkdirSync6(targetHome, { recursive: true, mode: 448 });
@@ -16914,7 +17037,7 @@ function ensureSessionTargetHome(targetHome) {
 }
 function checkSessionRenderDrift(targetHome, manifestPath) {
   const safeTargetHome = assertSafeTargetHome(targetHome);
-  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative5(safeTargetHome, resolve8(manifestPath)), safeTargetHome) : resolve8(safeTargetHome, ".hasna", "session-render-manifest.json");
+  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative5(safeTargetHome, resolve10(manifestPath)), safeTargetHome) : resolve10(safeTargetHome, ".hasna", "session-render-manifest.json");
   const checkedAt = new Date().toISOString();
   const previousManifest = readPreviousManifest(resolvedManifestPath);
   if (!previousManifest) {
@@ -16941,7 +17064,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
       });
       continue;
     }
-    const actualSha256 = sha2567(readFileSync9(target, "utf-8"));
+    const actualSha256 = sha2568(readFileSync10(target, "utf-8"));
     if (actualSha256 !== file.sha256) {
       drifted.push({
         path: target,
@@ -16964,7 +17087,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
 function restoreSessionRenderSnapshot(snapshotPath, options = {}) {
   const snapshot = readSessionRenderSnapshot(snapshotPath);
   const targetHome = assertSafeTargetHome(snapshot.targetHome);
-  const resolvedSnapshotPath = resolve8(snapshotPath);
+  const resolvedSnapshotPath = resolve10(snapshotPath);
   const snapshotRelativePath = relative5(targetHome, resolvedSnapshotPath);
   if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute4(snapshotRelativePath)) {
     throw new SessionApplyError("Session snapshot must be stored inside its target home.");
@@ -17082,19 +17205,19 @@ function requiredRestoreHash(file) {
   return file.previousSha256;
 }
 function readSessionRenderSnapshot(snapshotPath) {
-  const resolved = resolve8(snapshotPath);
+  const resolved = resolve10(snapshotPath);
   if (!existsSync12(resolved))
     throw new SessionApplyError(`Session snapshot not found: ${snapshotPath}`);
-  const stat = lstatSync3(resolved);
+  const stat = lstatSync4(resolved);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session snapshot is not a regular file: ${snapshotPath}`);
   }
-  if (statSync5(resolved).size > 32 * 1024 * 1024) {
+  if (statSync6(resolved).size > 32 * 1024 * 1024) {
     throw new SessionApplyError(`Session snapshot exceeds the 32 MiB restore limit: ${snapshotPath}`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(resolved, "utf8"));
+    parsed = JSON.parse(readFileSync10(resolved, "utf8"));
   } catch {
     throw new SessionApplyError(`Session snapshot is not valid JSON: ${snapshotPath}`);
   }
@@ -17116,7 +17239,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   const previousManifest = snapshot.previousManifest;
   const previousFiles = new Map;
   for (const file of snapshot.files) {
-    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha2567(file.content) !== file.sha256) {
+    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha2568(file.content) !== file.sha256) {
       throw new SessionApplyError(`Session snapshot previous file metadata is invalid: ${snapshotPath}`);
     }
     resolveSnapshotFilePath(file.relativePath, file.path, targetHome);
@@ -17163,7 +17286,7 @@ function readSessionRenderSnapshot(snapshotPath) {
 }
 function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previousManifestFiles, targetHome, snapshotPath) {
   assertNoNewerSessionSnapshot(snapshotPath, snapshot.createdAt, targetHome);
-  const manifestPath = resolve8(snapshot.manifestPath);
+  const manifestPath = resolve10(snapshot.manifestPath);
   const manifestRelativePath = relative5(targetHome, manifestPath).replaceAll("\\", "/");
   resolveSnapshotFilePath(manifestRelativePath, snapshot.manifestPath, targetHome);
   const manifestSha256 = currentSessionFileHash(manifestPath, targetHome);
@@ -17172,7 +17295,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
   }
   let parsedManifest;
   try {
-    parsedManifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
+    parsedManifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
   } catch {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is not valid JSON: ${snapshotPath}`);
   }
@@ -17180,7 +17303,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is invalid: ${snapshotPath}`);
   }
   const appliedManifest = parsedManifest;
-  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve8(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
+  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve10(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest does not match its snapshot: ${snapshotPath}`);
   }
   const afterFiles = [];
@@ -17265,16 +17388,16 @@ function assertNoNewerSessionSnapshot(snapshotPath, createdAt, targetHome) {
     throw new SessionApplyError(`Pre-rollback legacy v1 snapshot has an invalid creation time: ${snapshotPath}`);
   }
   for (const entry of readdirSync3(dirname5(snapshotPath))) {
-    const candidatePath = resolve8(dirname5(snapshotPath), entry);
-    if (candidatePath === resolve8(snapshotPath) || !entry.endsWith(".json"))
+    const candidatePath = resolve10(dirname5(snapshotPath), entry);
+    if (candidatePath === resolve10(snapshotPath) || !entry.endsWith(".json"))
       continue;
-    const candidateStat = lstatSync3(candidatePath);
+    const candidateStat = lstatSync4(candidatePath);
     if (candidateStat.isSymbolicLink() || !candidateStat.isFile() || candidateStat.size > 32 * 1024 * 1024)
       continue;
     try {
-      const candidate = JSON.parse(readFileSync9(candidatePath, "utf8"));
+      const candidate = JSON.parse(readFileSync10(candidatePath, "utf8"));
       const candidateCreatedAtMs = typeof candidate.createdAt === "string" ? Date.parse(candidate.createdAt) : Number.NaN;
-      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve8(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
+      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve10(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
         throw new SessionApplyError(`Cannot restore pre-rollback legacy v1 snapshot after a newer session snapshot exists: ${candidatePath}`);
       }
     } catch (error) {
@@ -17332,7 +17455,7 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
     return "create";
   }
   if (file.role === "manifest" && previousManifest) {
-    const previousManifestSha256 = sha2567(`${JSON.stringify(previousManifest, null, 2)}
+    const previousManifestSha256 = sha2568(`${JSON.stringify(previousManifest, null, 2)}
 `);
     if (previousManifestSha256 !== file.sha256) {
       throw new SessionApplyError(`Cannot infer legacy v1 manifest action without a before-image: ${file.relativePath}`);
@@ -17343,15 +17466,15 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
 }
 function resolveSnapshotFilePath(relativePath, recordedPath, targetHome) {
   const path = resolveManifestRelativePath(relativePath, targetHome);
-  if (resolve8(recordedPath) !== path) {
+  if (resolve10(recordedPath) !== path) {
     throw new SessionApplyError(`Session snapshot file path mismatch for ${relativePath}`);
   }
   return path;
 }
 function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
   const target = resolvePlannedFilePath(plan, file, targetHome);
-  const previousContent = existsSync12(target) ? readFileSync9(target, "utf-8") : null;
-  const previousSha256 = previousContent === null ? null : sha2567(previousContent);
+  const previousContent = existsSync12(target) ? readFileSync10(target, "utf-8") : null;
+  const previousSha256 = previousContent === null ? null : sha2568(previousContent);
   const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
   const changed = previousContent !== file.content;
   if (previousContent !== null && !options.force && !previouslyManaged) {
@@ -17448,8 +17571,8 @@ function planStaleFileResult(file, targetHome, options) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
   if (!existsSync12(target))
     return null;
-  const previousContent = readFileSync9(target, "utf-8");
-  const previousSha256 = sha2567(previousContent);
+  const previousContent = readFileSync10(target, "utf-8");
+  const previousSha256 = sha2568(previousContent);
   if (!options.force && previousSha256 !== file.sha256) {
     return {
       path: target,
@@ -17493,19 +17616,19 @@ function isPreviouslyManaged(file, previousSha256, previousHashes, previousManif
   return previousHashes.get(file.relativePath) === previousSha256;
 }
 function resolvePlannedFilePath(plan, file, targetHome) {
-  const target = resolve8(targetHome, ...file.relativePath.split("/"));
+  const target = resolve10(targetHome, ...file.relativePath.split("/"));
   const rel = relative5(targetHome, target);
   if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
     throw new SessionApplyError(`Session file escapes target home: ${file.relativePath}`);
   }
-  if (resolve8(file.path) !== target) {
+  if (resolve10(file.path) !== target) {
     throw new SessionApplyError(`Session file path mismatch for ${file.relativePath}: ${file.path}`);
   }
   assertNoSymlinkSegments2(targetHome, target);
   return target;
 }
 function resolveManifestRelativePath(relativePath, targetHome) {
-  const target = resolve8(targetHome, ...relativePath.split(/[\\/]+/));
+  const target = resolve10(targetHome, ...relativePath.split(/[\\/]+/));
   const rel = relative5(targetHome, target);
   if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
     throw new SessionApplyError(`Session manifest file escapes target home: ${relativePath}`);
@@ -17517,7 +17640,7 @@ function readPreviousManifest(path) {
   if (!existsSync12(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
     if (parsed.schema !== SESSION_RENDER_SCHEMA)
       return null;
     if (!Array.isArray(parsed.files))
@@ -17558,11 +17681,11 @@ function currentSessionFileHash(path, targetHome) {
   assertNoSymlinkSegments2(targetHome, path);
   if (!existsSync12(path))
     return null;
-  const stat = lstatSync3(path);
+  const stat = lstatSync4(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session apply path is not a regular file: ${path}`);
   }
-  return sha2567(readFileSync9(path, "utf-8"));
+  return sha2568(readFileSync10(path, "utf-8"));
 }
 function requiredPreviousHash(result) {
   if (result.previousSha256 === null) {
@@ -17572,12 +17695,12 @@ function requiredPreviousHash(result) {
 }
 function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps) {
   const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync12(result.path)).map((result) => {
-    const content = readFileSync9(result.path, "utf-8");
+    const content = readFileSync10(result.path, "utf-8");
     return {
       path: result.path,
       relativePath: result.relativePath,
       role: result.role,
-      sha256: sha2567(content),
+      sha256: sha2568(content),
       content
     };
   });
@@ -17590,7 +17713,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     };
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve8(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID7()}.json`);
+  const snapshotPath = resolve10(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID7()}.json`);
   const afterFiles = results.map((result) => {
     if (result.action === "conflict") {
       throw new SessionApplyError(`Cannot snapshot unresolved conflict: ${result.relativePath}`);
@@ -17638,12 +17761,12 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
 function assertSafeTargetHome(targetHome) {
   if (!isAbsolute4(targetHome))
     throw new SessionApplyError(`Session target home must be absolute: ${targetHome}`);
-  const normalized = resolve8(targetHome);
+  const normalized = resolve10(targetHome);
   if (normalized === parse4(normalized).root) {
     throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
   }
   assertNoSymlinkAncestors2(normalized);
-  if (existsSync12(normalized) && lstatSync3(normalized).isSymbolicLink()) {
+  if (existsSync12(normalized) && lstatSync4(normalized).isSymbolicLink()) {
     throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
   }
   return normalized;
@@ -17653,32 +17776,33 @@ function assertNoSymlinkSegments2(root, target) {
   const rel = relative5(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join13(current, segment);
-    if (existsSync12(current) && lstatSync3(current).isSymbolicLink()) {
+    current = join15(current, segment);
+    if (existsSync12(current) && lstatSync4(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
   }
 }
 function assertNoSymlinkAncestors2(path) {
-  const normalized = resolve8(path);
+  const normalized = resolve10(path);
   const parsed = parse4(normalized);
   let current = parsed.root;
   const rel = relative5(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join13(current, segment);
+    current = join15(current, segment);
     if (!existsSync12(current))
       return;
-    if (lstatSync3(current).isSymbolicLink()) {
+    if (lstatSync4(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
     }
   }
 }
-function sha2567(content) {
-  return createHash7("sha256").update(content).digest("hex");
+function sha2568(content) {
+  return createHash8("sha256").update(content).digest("hex");
 }
 
 // src/cli/index.tsx
 init_session_render();
+init_raw_store_root();
 init_asset_plan();
 init_instruction_graph();
 
@@ -18025,34 +18149,433 @@ async function ensureDangerousOperationGuardStandardConfig(store = resolveConfig
 
 // src/cli/index.tsx
 init_codewith_shared_todos_storage_standard();
+
+// src/lib/managed-skill-runtimes.ts
+import { createHash as createHash9 } from "crypto";
+import { spawnSync } from "child_process";
+import {
+  existsSync as existsSync13,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync11,
+  renameSync as renameSync2,
+  rmSync as rmSync5,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname6, join as join16, parse as parse5, relative as relative6, resolve as resolve11 } from "path";
+var INBOX_CONVERSATIONS_MINIMUM_VERSION = "0.5.28";
+var INBOX_SKILL_MARKERS = [
+  [".claude", "skills", "inbox", "SKILL.md"],
+  [".codex", "skills", "inbox", "SKILL.md"],
+  [".codewith", "skills", "inbox", "SKILL.md"],
+  [".config", "opencode", "skills", "inbox", "SKILL.md"],
+  [".cursor", "skills", "inbox", "SKILL.md"]
+];
+var REQUIRED_WATCH_FLAGS = ["--from <agent>", "--all", "--full-content"];
+function sha2569(content) {
+  return createHash9("sha256").update(content).digest("hex");
+}
+function lstatOrNull(path) {
+  try {
+    return lstatSync5(path);
+  } catch {
+    return null;
+  }
+}
+function findSymlinkedAncestor(path) {
+  const normalized = resolve11(path);
+  const parsed = parse5(normalized);
+  let current = parsed.root;
+  const rel = relative6(parsed.root, normalized);
+  for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
+    current = join16(current, segment);
+    if (!existsSync13(current))
+      return null;
+    if (lstatSync5(current).isSymbolicLink())
+      return current;
+  }
+  return null;
+}
+function assertNoSymlinkAncestors3(path) {
+  const found = findSymlinkedAncestor(path);
+  if (found !== null) {
+    throw new Error(`managed skill path uses a symlink ancestor: ${found}`);
+  }
+}
+function packagedInboxSkillPath(explicitPath) {
+  if (explicitPath)
+    return explicitPath;
+  const candidates = [
+    join16(import.meta.dir, "..", "..", "assets", "skills", "inbox", "SKILL.md"),
+    join16(import.meta.dir, "..", "assets", "skills", "inbox", "SKILL.md"),
+    join16(process.cwd(), "assets", "skills", "inbox", "SKILL.md")
+  ];
+  const found = candidates.find((candidate) => existsSync13(candidate));
+  if (!found) {
+    throw new Error(`packaged inbox skill contract is missing (checked ${candidates.length} package-relative locations)`);
+  }
+  return found;
+}
+function readCanonicalSkill(explicitPath) {
+  const assetPath = packagedInboxSkillPath(explicitPath);
+  const stat = lstatOrNull(assetPath);
+  if (!stat?.isFile()) {
+    throw new Error("packaged inbox skill contract is not a regular file");
+  }
+  const content = readFileSync11(assetPath, "utf8");
+  if (!content.includes("conversations watch --from <agent> --all")) {
+    throw new Error("packaged inbox skill contract does not declare the canonical conversations watcher");
+  }
+  if (!content.includes("There is no separate")) {
+    throw new Error("packaged inbox skill contract does not retire the legacy executable");
+  }
+  return { content, sha256: sha2569(content) };
+}
+function runProbe(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    timeout: 5000,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0) {
+    return { ok: false, output: "" };
+  }
+  return {
+    ok: true,
+    output: `${result.stdout ?? ""}
+${result.stderr ?? ""}`.trim()
+  };
+}
+function parseVersion(output) {
+  return output.match(/\b(\d+\.\d+\.\d+)\b/)?.[1] ?? null;
+}
+function compareVersions(left, right) {
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  for (let i = 0;i < Math.max(a.length, b.length); i++) {
+    const delta = (a[i] ?? 0) - (b[i] ?? 0);
+    if (delta !== 0)
+      return delta;
+  }
+  return 0;
+}
+function inspectSkillMarkers(homeDir2) {
+  return INBOX_SKILL_MARKERS.map((parts) => join16(homeDir2, ...parts)).map((path) => {
+    const stat = lstatOrNull(path);
+    if (!stat)
+      return null;
+    if (!stat.isFile()) {
+      return { path, content: null, mode: null, regular: false };
+    }
+    return {
+      path,
+      content: readFileSync11(path, "utf8"),
+      mode: stat.mode & 511,
+      regular: true
+    };
+  }).filter((snapshot) => snapshot !== null);
+}
+function inspectInbox(options) {
+  const homeDir2 = options.homeDir ?? homedir8();
+  const runtimeCommand = options.conversationsCommand ?? "conversations";
+  const snapshots = inspectSkillMarkers(homeDir2);
+  const skillPresent = snapshots.length > 0;
+  let canonicalContent = null;
+  let canonicalSha256 = null;
+  let assetError = null;
+  try {
+    const canonical = readCanonicalSkill(options.assetPath);
+    canonicalContent = canonical.content;
+    canonicalSha256 = canonical.sha256;
+  } catch (error) {
+    assetError = error instanceof Error ? error.message : String(error);
+  }
+  const versionProbe = skillPresent ? runProbe(runtimeCommand, ["--version"]) : { ok: false, output: "" };
+  const helpProbe = versionProbe.ok ? runProbe(runtimeCommand, ["watch", "--help"]) : { ok: false, output: "" };
+  const runtimeVersion = versionProbe.ok ? parseVersion(versionProbe.output) : null;
+  const supportsFrom = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[0]);
+  const supportsAll = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[1]);
+  const supportsFullContent = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[2]);
+  const packageReady = versionProbe.ok && runtimeVersion !== null && compareVersions(runtimeVersion, INBOX_CONVERSATIONS_MINIMUM_VERSION) >= 0 && helpProbe.ok && supportsFrom && supportsAll && supportsFullContent;
+  const heartbeatProbe = skillPresent && packageReady && options.agent ? runProbe(runtimeCommand, ["agents", "heartbeat", "--from", options.agent, "--json"]) : null;
+  const hostedHeartbeat = heartbeatProbe === null ? "unverified" : heartbeatProbe.ok ? "passed" : "failed";
+  const deliveryVerified = hostedHeartbeat === "passed" && options.deliveryVerified === true;
+  const staleMarkers = canonicalContent === null ? snapshots.map((snapshot) => snapshot.path) : snapshots.filter((snapshot) => !snapshot.regular || snapshot.content !== canonicalContent).map((snapshot) => snapshot.path);
+  let reason = "skill not installed";
+  if (skillPresent) {
+    const nonRegular = snapshots.some((snapshot) => !snapshot.regular);
+    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname6(path))).find((found) => found !== null);
+    if (nonRegular)
+      reason = "managed skill target is not a regular file";
+    else if (symlinkAncestor)
+      reason = `managed skill path uses a symlink ancestor: ${symlinkAncestor}`;
+    else if (assetError)
+      reason = assetError;
+    else if (!versionProbe.ok)
+      reason = "conversations command unavailable";
+    else if (!runtimeVersion)
+      reason = "conversations version is unreadable";
+    else if (compareVersions(runtimeVersion, INBOX_CONVERSATIONS_MINIMUM_VERSION) < 0) {
+      reason = `conversations ${runtimeVersion} is older than ${INBOX_CONVERSATIONS_MINIMUM_VERSION}`;
+    } else if (!helpProbe.ok)
+      reason = "conversations watch help is unavailable";
+    else if (!supportsFrom || !supportsAll || !supportsFullContent) {
+      const missing = [
+        !supportsFrom ? "--from" : null,
+        !supportsAll ? "--all" : null,
+        !supportsFullContent ? "--full-content" : null
+      ].filter((flag) => flag !== null);
+      reason = `conversations watch is missing required flags: ${missing.join(", ")}`;
+    } else if (staleMarkers.length > 0)
+      reason = "skill contract stale";
+    else if (hostedHeartbeat === "failed")
+      reason = "hosted heartbeat failed; manual fallback required";
+    else if (hostedHeartbeat === "unverified")
+      reason = "hosted heartbeat unverified; manual fallback required";
+    else if (!deliveryVerified)
+      reason = "hosted heartbeat passed; channel and DM delivery verification required";
+    else
+      reason = "ready";
+  }
+  return {
+    status: {
+      skill: "inbox",
+      runtime: "conversations watch",
+      minimum_version: INBOX_CONVERSATIONS_MINIMUM_VERSION,
+      skill_present: skillPresent,
+      skill_markers: snapshots.map((snapshot) => snapshot.path),
+      skill_contracts_current: snapshots.length - staleMarkers.length,
+      stale_skill_markers: staleMarkers,
+      expected_skill_sha256: canonicalSha256,
+      runtime_command: runtimeCommand,
+      runtime_present: versionProbe.ok,
+      runtime_version: runtimeVersion,
+      watch_supports_from: supportsFrom,
+      watch_supports_all: supportsAll,
+      watch_supports_full_content: supportsFullContent,
+      hosted_heartbeat: hostedHeartbeat,
+      delivery_verified: deliveryVerified,
+      manual_fallback_ready: skillPresent && staleMarkers.length === 0 && packageReady,
+      healthy: !skillPresent || reason === "ready",
+      reason
+    },
+    canonicalContent,
+    snapshots
+  };
+}
+function inspectManagedSkillRuntimes(options = {}) {
+  const runtime = inspectInbox(options).status;
+  const installed = runtime.skill_present ? [runtime] : [];
+  return {
+    runtimes: [runtime],
+    skills_present: installed.length,
+    healthy: installed.filter((item) => item.healthy).length,
+    missing: installed.filter((item) => !item.healthy).length
+  };
+}
+function runtimeReadyForWrite(status) {
+  return status.runtime_present && status.runtime_version !== null && compareVersions(status.runtime_version, INBOX_CONVERSATIONS_MINIMUM_VERSION) >= 0 && status.watch_supports_from && status.watch_supports_all && status.watch_supports_full_content;
+}
+function projectUpdatedStatus(status, contractCount) {
+  const healthy = status.hosted_heartbeat === "passed" && status.delivery_verified;
+  return {
+    ...status,
+    skill_contracts_current: contractCount,
+    stale_skill_markers: [],
+    manual_fallback_ready: true,
+    healthy,
+    reason: healthy ? "ready" : status.hosted_heartbeat === "failed" ? "hosted heartbeat failed; manual fallback required" : status.hosted_heartbeat === "unverified" ? "hosted heartbeat unverified; manual fallback required" : "hosted heartbeat passed; channel and DM delivery verification required"
+  };
+}
+function cleanup(path) {
+  rmSync5(path, { force: true });
+}
+function writeAtomic(path, content, mode) {
+  assertNoSymlinkAncestors3(dirname6(path));
+  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  try {
+    mkdirSync7(dirname6(path), { recursive: true, mode: 493 });
+    writeFileSync4(tempPath, content, { mode, flag: "wx" });
+    renameSync2(tempPath, path);
+  } finally {
+    cleanup(tempPath);
+  }
+}
+var DEFAULT_SKILL_WRITE_FILE_OPERATIONS = {
+  lstat: lstatOrNull,
+  read: (path) => readFileSync11(path, "utf8"),
+  write: writeAtomic
+};
+function writeSkillContractsTransactional(snapshots, canonicalContent, fileOperations = DEFAULT_SKILL_WRITE_FILE_OPERATIONS) {
+  const written = [];
+  try {
+    for (const snapshot of snapshots) {
+      const currentStat = fileOperations.lstat(snapshot.path);
+      if (!currentStat?.isFile() || fileOperations.read(snapshot.path) !== snapshot.content) {
+        throw new Error("managed skill changed after inspection; refusing a stale write");
+      }
+      fileOperations.write(snapshot.path, canonicalContent, snapshot.mode);
+      written.push(snapshot);
+    }
+    return { ok: true, error: null, rollback_conflicts: [] };
+  } catch (error) {
+    const rollbackConflicts = [];
+    for (const snapshot of written.reverse()) {
+      const currentStat = fileOperations.lstat(snapshot.path);
+      if (!currentStat?.isFile()) {
+        rollbackConflicts.push(`${snapshot.path}: no longer a regular file`);
+        continue;
+      }
+      let currentContent;
+      try {
+        currentContent = fileOperations.read(snapshot.path);
+      } catch {
+        rollbackConflicts.push(`${snapshot.path}: could not read the current file`);
+        continue;
+      }
+      if (currentContent !== canonicalContent) {
+        rollbackConflicts.push(`${snapshot.path}: changed after this reconciliation wrote it`);
+        continue;
+      }
+      try {
+        fileOperations.write(snapshot.path, snapshot.content, snapshot.mode);
+      } catch {
+        rollbackConflicts.push(`${snapshot.path}: still owned but could not be restored`);
+      }
+    }
+    return {
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+      rollback_conflicts: rollbackConflicts
+    };
+  }
+}
+async function reconcileManagedSkillRuntimes(options = {}) {
+  const dryRun = options.dryRun ?? false;
+  const before = inspectInbox(options);
+  const status = before.status;
+  if (!status.skill_present) {
+    return {
+      runtimes: [{ ...status, action: "skipped", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 0,
+      dry_run: dryRun
+    };
+  }
+  if (before.snapshots.some((snapshot) => !snapshot.regular)) {
+    return {
+      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 1,
+      dry_run: dryRun
+    };
+  }
+  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname6(path))).find((found) => found !== null);
+  if (symlinkedAncestor) {
+    return {
+      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 1,
+      dry_run: dryRun
+    };
+  }
+  if (!before.canonicalContent || !runtimeReadyForWrite(status)) {
+    return {
+      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 1,
+      dry_run: dryRun
+    };
+  }
+  const staleSnapshots = before.snapshots.filter((snapshot) => snapshot.content !== before.canonicalContent);
+  if (staleSnapshots.length === 0) {
+    return {
+      runtimes: [{ ...status, action: "unchanged", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 0,
+      dry_run: dryRun
+    };
+  }
+  if (dryRun) {
+    const projected = projectUpdatedStatus(status, before.snapshots.length);
+    return {
+      runtimes: [{
+        ...projected,
+        action: "update",
+        dry_run: true,
+        skill_contracts_changed: staleSnapshots.length
+      }],
+      changed: 1,
+      failed: 0,
+      dry_run: true
+    };
+  }
+  const transaction = writeSkillContractsTransactional(staleSnapshots.map((snapshot) => ({
+    path: snapshot.path,
+    content: snapshot.content,
+    mode: snapshot.mode ?? 420
+  })), before.canonicalContent);
+  if (!transaction.ok) {
+    const rollbackConflictReason = transaction.rollback_conflicts.length > 0 ? `; rollback conflicts: ${transaction.rollback_conflicts.join("; ")}` : "";
+    const reason = `${transaction.error ?? "managed skill reconciliation failed"}${rollbackConflictReason}`;
+    return {
+      runtimes: [{
+        ...status,
+        action: "failed",
+        dry_run: false,
+        skill_contracts_changed: 0,
+        reason
+      }],
+      changed: 0,
+      failed: 1,
+      dry_run: false
+    };
+  }
+  const after = inspectInbox(options).status;
+  const accepted = after.healthy || after.manual_fallback_ready;
+  return {
+    runtimes: [{
+      ...after,
+      action: accepted ? "update" : "failed",
+      dry_run: false,
+      skill_contracts_changed: accepted ? staleSnapshots.length : 0
+    }],
+    changed: accepted ? 1 : 0,
+    failed: accepted ? 0 : 1,
+    dry_run: false
+  };
+}
+
+// src/cli/index.tsx
 init_project_context();
 
 // src/status.ts
 init_config_store();
 init_apply();
 init_config_agents();
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
 
 // src/lib/package-version.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname6, join as join14 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname7, join as join17 } from "path";
 import { fileURLToPath } from "url";
 var cached = null;
 function getPackageVersion() {
   if (cached)
     return cached;
   try {
-    let dir = dirname6(fileURLToPath(import.meta.url));
+    let dir = dirname7(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
-      const pkgPath = join14(dir, "package.json");
-      if (existsSync13(pkgPath)) {
-        const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+      const pkgPath = join17(dir, "package.json");
+      if (existsSync14(pkgPath)) {
+        const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
         if (pkg.name === "@hasna/instructions" && pkg.version) {
           cached = pkg.version;
           return cached;
         }
       }
-      const parent = dirname6(dir);
+      const parent = dirname7(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -18085,7 +18608,7 @@ function countBy(items, getValue) {
   }
   return counts;
 }
-async function getConfigsStatus(store = resolveConfigStore()) {
+async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
   let databaseReachable = true;
   let configs = [];
   let categoryStats = { total: 0 };
@@ -18109,11 +18632,11 @@ async function getConfigsStatus(store = resolveConfigStore()) {
       continue;
     knownTargets += 1;
     const targetPath = expandPath(config.target_path);
-    if (!existsSync14(targetPath)) {
+    if (!existsSync15(targetPath)) {
       missingTargets += 1;
       continue;
     }
-    const disk = readFileSync11(targetPath, "utf-8");
+    const disk = readFileSync13(targetPath, "utf-8");
     const { content: redactedDisk } = redactContent(disk, config.format);
     if (redactedDisk !== config.content) {
       driftedTargets += 1;
@@ -18139,7 +18662,11 @@ async function getConfigsStatus(store = resolveConfigStore()) {
     }
   }
   const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
-  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 && retiredAgentRows === 0 ? "ok" : "warn";
+  const managedSkillRuntimes = inspectManagedSkillRuntimes({
+    homeDir: options.homeDir,
+    conversationsCommand: options.conversationsCommand
+  });
+  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 && retiredAgentRows === 0 && managedSkillRuntimes.missing === 0 ? "ok" : "warn";
   return {
     service: "configs",
     schemaVersion: "1.0",
@@ -18169,7 +18696,12 @@ async function getConfigsStatus(store = resolveConfigStore()) {
       profileLinks,
       machines,
       snapshots,
-      knownTargets
+      knownTargets,
+      managedSkillRuntimes: {
+        skillsPresent: managedSkillRuntimes.skills_present,
+        healthy: managedSkillRuntimes.healthy,
+        missing: managedSkillRuntimes.missing
+      }
     },
     health: {
       status,
@@ -18178,10 +18710,12 @@ async function getConfigsStatus(store = resolveConfigStore()) {
       missingTargets,
       unredactedSecretFindings,
       retiredAgentRows,
+      missingManagedSkillRuntimes: managedSkillRuntimes.missing,
       hasDrift: driftedTargets > 0,
       hasMissingTargets: missingTargets > 0,
       hasUnredactedSecrets: unredactedSecretFindings > 0,
-      hasRetiredAgentRows: retiredAgentRows > 0
+      hasRetiredAgentRows: retiredAgentRows > 0,
+      hasMissingManagedSkillRuntimes: managedSkillRuntimes.missing > 0
     },
     safety: {
       includesConfigValues: false,
@@ -18223,6 +18757,17 @@ function printLine(text = "") {
 function printJson(value) {
   printLine(JSON.stringify(value, null, 2));
 }
+function printManagedSkillRuntimeReport(report) {
+  for (const runtime of report.runtimes) {
+    if (!runtime.skill_present)
+      continue;
+    const prefix = runtime.action === "failed" ? chalk.red("[failed]") : runtime.dry_run ? chalk.yellow("[dry-run]") : runtime.manual_fallback_ready && !runtime.healthy ? chalk.yellow("[degraded]") : runtime.action === "unchanged" ? chalk.dim("=") : chalk.green("\u2713");
+    console.log(`${prefix} ${runtime.skill} via ${runtime.runtime} \u2014 ${runtime.reason}`);
+    if (runtime.action === "update") {
+      console.log(chalk.dim(`  skill contracts: ${runtime.skill_contracts_changed}`));
+    }
+  }
+}
 function fmtConfig(c, format) {
   if (format === "json")
     return JSON.stringify(c, null, 2);
@@ -18289,7 +18834,7 @@ function parseSessionSource(value, order) {
   if (!path)
     throw new Error(`Invalid --source "${value}" (expected path or id=path)`);
   const absPath = resolveSessionPath(path);
-  if (!existsSync16(absPath))
+  if (!existsSync17(absPath))
     throw new Error(`Instruction source file not found: ${absPath}`);
   const content = readSessionInstructionSourceFile(absPath);
   const source = sourceFromFilePath(absPath, content, order);
@@ -18333,7 +18878,7 @@ function sessionSourceReplacements(values) {
   return replacements;
 }
 function readSessionInstructionSourceFile(path) {
-  const stat = lstatSync5(path);
+  const stat = lstatSync7(path);
   if (stat.isSymbolicLink()) {
     throw new Error("SESSION_SOURCE_SYMLINK_REJECTED: instruction source file must be a regular non-symlink file");
   }
@@ -18343,7 +18888,7 @@ function readSessionInstructionSourceFile(path) {
   if (stat.size > SESSION_MANAGED_INPUT_MAX_BYTES) {
     throw new Error(`SESSION_SOURCE_INPUT_TOO_LARGE: instruction source file exceeds ${SESSION_MANAGED_INPUT_MAX_BYTES} bytes`);
   }
-  return readFileSync13(path, "utf-8");
+  return readFileSync15(path, "utf-8");
 }
 function parseLayeredReference(value) {
   const trimmed = value.trim();
@@ -18370,9 +18915,9 @@ async function collectSessionSources(opts, tool, store) {
   }
   for (const value of opts.identityExport ?? []) {
     const path = resolveSessionPath(value);
-    if (!existsSync16(path))
+    if (!existsSync17(path))
       throw new Error(`Identity instruction export not found: ${path}`);
-    const parsed = JSON.parse(readFileSync13(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync15(path, "utf-8"));
     sources.push(...sourcesFromIdentityExport(parsed, { path, tool, orderOffset: sources.length }));
   }
   return sources.map((source) => {
@@ -18493,19 +19038,19 @@ function readProjectContextBundleOption(value, allowMissing = false) {
   if (value === "-")
     return { json: readBoundedProjectContextStdin() };
   const path = resolveSessionPath(value);
-  if (!existsSync16(path)) {
+  if (!existsSync17(path)) {
     if (allowMissing)
       return {};
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_MISSING", `bundle file not found: ${path}`);
   }
-  const stat = lstatSync5(path);
+  const stat = lstatSync7(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", "bundle input must be a regular non-symlink file");
   }
   if (stat.size > PROJECT_CONTEXT_MAX_INPUT_BYTES) {
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_TOO_LARGE", `bundle exceeds ${PROJECT_CONTEXT_MAX_INPUT_BYTES} bytes`);
   }
-  return { json: readFileSync13(path, "utf8"), sourcePath: path };
+  return { json: readFileSync15(path, "utf8"), sourcePath: path };
 }
 function readBoundedProjectContextStdin() {
   const chunks = [];
@@ -18664,15 +19209,15 @@ program.command("tag <id>").description("Add or remove tags on a stored config (
   console.log(chalk.green("\u2713") + ` Tags on ${chalk.bold(updated.name)} ${chalk.dim(`(${updated.slug})`)}: ${nextTags.join(", ") || chalk.dim("(none)")}`);
 });
 program.command("add <path>").description("Ingest a file into the config DB").option("-n, --name <name>", "config name (defaults to filename)").option("-c, --category <cat>", "category override").option("-a, --agent <agent>", "agent override").option("-k, --kind <kind>", "kind: file|reference", "file").option("--template", "mark as template (has {{VAR}} placeholders)").option("--update", "if a config already owns this path, update that row in place instead of refusing").action(async (filePath, opts) => {
-  const abs = resolve10(filePath);
-  if (!existsSync16(abs)) {
+  const abs = resolve13(filePath);
+  if (!existsSync17(abs)) {
     console.error(chalk.red(`File not found: ${abs}`));
     process.exit(1);
   }
-  const rawContent = readFileSync13(abs, "utf-8");
+  const rawContent = readFileSync15(abs, "utf-8");
   const fmt = detectFormat(abs);
   const { content, redacted, isTemplate: isTemplate2 } = redactContent(rawContent, fmt);
-  const targetPath = abs.startsWith(homedir8()) ? abs.replace(homedir8(), "~") : abs;
+  const targetPath = abs.startsWith(homedir10()) ? abs.replace(homedir10(), "~") : abs;
   const name = opts.name || filePath.split("/").pop();
   const store = resolveConfigStore();
   const allConfigs = await store.listConfigs();
@@ -18847,7 +19392,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
       for (const entry of entries) {
         if (!entry.isDirectory())
           continue;
-        const projDir = join16(absDir, entry.name);
+        const projDir = join19(absDir, entry.name);
         const hasAgentConfig = [
           "CLAUDE.md",
           ".mcp.json",
@@ -18860,7 +19405,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
           ".aicopilot",
           ".cursor",
           ".agents"
-        ].some((marker) => existsSync16(join16(projDir, marker)));
+        ].some((marker) => existsSync17(join19(projDir, marker)));
         if (!hasAgentConfig)
           continue;
         const result2 = await syncProject({ projectDir: projDir, dryRun: opts.dryRun, store });
@@ -18911,7 +19456,7 @@ program.command("import <file>").description("Import configs from a tar.gz bundl
 });
 program.command("whoami").description("Show setup summary").action(async () => {
   const store = resolveConfigStore();
-  const dbPath = isApiTransport() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join16(homedir8(), ".hasna", "instructions", "instructions.db");
+  const dbPath = isApiTransport() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join19(getRawStoreRoot(), "instructions.db");
   const stats = await store.getConfigStats();
   console.log(chalk.bold("@hasna/instructions") + chalk.dim(" v" + pkg.version));
   console.log(chalk.cyan(isApiTransport() ? "API:" : "DB:") + " " + dbPath);
@@ -19134,7 +19679,7 @@ profileCmd.command("binding <profile> <config>").description("Set a config's sch
     process.exit(1);
   }
 });
-profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
+profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
   try {
     const store = resolveConfigStore();
     const { machine, profile } = await getMachineProfileContext(opts, store);
@@ -19171,6 +19716,14 @@ profileCmd.command("apply [id]").description("Apply all configs in a profile to
     }
     if (report.failures.length > 0)
       process.exitCode = 1;
+    const runtimeReport = await reconcileManagedSkillRuntimes({
+      dryRun: opts.dryRun,
+      agent: opts.from,
+      deliveryVerified: opts.deliveryVerified
+    });
+    printManagedSkillRuntimeReport(runtimeReport);
+    if (runtimeReport.failed > 0)
+      process.exitCode = 1;
     console.log(chalk.dim(`
 ${changed}/${results.length} changed (${selected.slug} on ${machine.hostname} ${machine.os_family}/${machine.arch})`));
   } catch (e) {
@@ -19302,6 +19855,8 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
         ...planJsonForOutput(plan),
         ...globalCoverage ? { globalSourceCoverage: globalCoverage } : {}
       });
+      if (plan.blocked)
+        process.exitCode = 1;
       return;
     }
     console.log(chalk.bold(`${plan.tool} session render plan`) + chalk.dim(` (${plan.adapter.mode})`));
@@ -19328,6 +19883,8 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
       if (globalCoverage.complete)
         console.log(chalk.dim(`global source coverage: ${globalCoverage.expectedSlugs.length}/${globalCoverage.expectedSlugs.length} complete`));
     }
+    if (plan.blocked)
+      process.exitCode = 1;
     console.log(chalk.dim("Dry run only. No files were written."));
   } catch (e) {
     console.error(chalk.red(formatCliError(e)));
@@ -19654,14 +20211,14 @@ mcpCmd.command("install").alias("add").description("Install configs MCP server i
       } else if (target === "codex") {
         const { appendFileSync, existsSync: ex } = await import("fs");
         const { join: j } = await import("path");
-        const configPath = j(homedir8(), ".codex", "config.toml");
+        const configPath = j(homedir10(), ".codex", "config.toml");
         const block = `
 [mcp_servers.configs]
 command = "${mcpBinary}"
 args = []
 `;
         if (ex(configPath)) {
-          const content = readFileSync13(configPath, "utf-8");
+          const content = readFileSync15(configPath, "utf-8");
           if (content.includes("[mcp_servers.configs]")) {
             console.log(chalk.dim("= Already installed in Codex"));
             continue;
@@ -19672,7 +20229,7 @@ args = []
       } else if (target === "antigravity") {
         const { mkdirSync: md, readFileSync: rf, writeFileSync: wf, existsSync: ex } = await import("fs");
         const { dirname: dn, join: j } = await import("path");
-        const configPath = j(homedir8(), ".gemini", "config", "mcp_config.json");
+        const configPath = j(homedir10(), ".gemini", "config", "mcp_config.json");
         let settings = {};
         if (ex(configPath)) {
           try {
@@ -19756,7 +20313,7 @@ DB stats:`));
     if (count > 0)
       console.log(`  ${key.padEnd(18)} ${count}`);
   }
-  const location = isApiTransport() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join16(homedir8(), ".hasna", "instructions", "instructions.db");
+  const location = isApiTransport() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join19(getRawStoreRoot(), "instructions.db");
   console.log(chalk.dim(`
 ${isApiTransport() ? "API" : "DB"}: ${location}`));
 });
@@ -19774,14 +20331,53 @@ program.command("status").description("Health check: total configs, drift from d
   console.log(chalk.cyan("Missing:") + ` ${status.health.missingTargets === 0 ? chalk.green("0") : chalk.yellow(String(status.health.missingTargets))} (file not on disk)`);
   console.log(chalk.cyan("Secrets:") + ` ${status.health.unredactedSecretFindings === 0 ? chalk.green("0 \u2713") : chalk.red(String(status.health.unredactedSecretFindings) + " \u26A0")} unredacted`);
   console.log(chalk.cyan("Retired agents:") + ` ${status.health.retiredAgentRows === 0 ? chalk.green("0") : chalk.yellow(String(status.health.retiredAgentRows))} row(s)`);
+  console.log(chalk.cyan("Skill runtimes:") + ` ${status.health.missingManagedSkillRuntimes === 0 ? chalk.green(`${status.counts.managedSkillRuntimes.healthy} ready`) : chalk.yellow(`${status.health.missingManagedSkillRuntimes} missing`)} (${status.counts.managedSkillRuntimes.skillsPresent} managed skill(s) present)`);
   console.log(chalk.cyan("Templates:") + ` ${status.counts.configs.templates} (with {{VAR}} placeholders)`);
 });
+var managedSkillsCmd = program.command("managed-skills").description("Inspect or reconcile package-owned runtime contracts for installed managed skills");
+managedSkillsCmd.command("status").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--json", "output the full local runtime status as JSON").action((opts) => {
+  const report = inspectManagedSkillRuntimes({
+    agent: opts.from,
+    deliveryVerified: opts.deliveryVerified
+  });
+  if (opts.json) {
+    printJson(report);
+    if (report.missing > 0)
+      process.exitCode = 1;
+    return;
+  }
+  if (report.skills_present === 0) {
+    console.log(chalk.dim("No managed skills with package-owned runtime contracts are installed."));
+    return;
+  }
+  for (const runtime of report.runtimes) {
+    if (!runtime.skill_present)
+      continue;
+    const prefix = runtime.healthy ? chalk.green("\u2713") : chalk.yellow("!");
+    console.log(`${prefix} ${runtime.skill} via ${runtime.runtime} \u2014 ${runtime.reason}`);
+  }
+  if (report.missing > 0)
+    process.exitCode = 1;
+});
+managedSkillsCmd.command("apply").option("--dry-run", "preview without writing").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--json", "output the reconcile report as JSON").action(async (opts) => {
+  const report = await reconcileManagedSkillRuntimes({
+    dryRun: opts.dryRun,
+    agent: opts.from,
+    deliveryVerified: opts.deliveryVerified
+  });
+  if (opts.json)
+    printJson(report);
+  else
+    printManagedSkillRuntimeReport(report);
+  if (report.failed > 0)
+    process.exitCode = 1;
+});
 program.command("backup").description("Export configs to a timestamped backup file").action(async () => {
   const { mkdirSync: mk } = await import("fs");
-  const backupDir = join16(homedir8(), ".hasna", "instructions", "backups");
+  const backupDir = join19(getRawStoreRoot(), "backups");
   mk(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, 19);
-  const outPath = join16(backupDir, `configs-${ts}.tar.gz`);
+  const outPath = join19(backupDir, `configs-${ts}.tar.gz`);
   const result = await exportConfigs(outPath, { store: resolveConfigStore() });
   const { statSync: st } = await import("fs");
   const size = st(outPath).size;
@@ -19809,9 +20405,9 @@ program.command("doctor").description("Validate configs: syntax, permissions, mi
   console.log(chalk.cyan("Known files on disk:"));
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
-      existsSync16(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
+      existsSync17(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
     } else {
-      existsSync16(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
+      existsSync17(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
     }
   }
   const allConfigs = await store.listConfigs();
@@ -19964,16 +20560,16 @@ program.command("watch").description("Watch known config files for changes and a
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
       const absDir = expandPath2(k.rulesDir);
-      if (!existsSync16(absDir))
+      if (!existsSync17(absDir))
         continue;
       const { readdirSync: readdirSync5 } = await import("fs");
       for (const f of readdirSync5(absDir).filter((f2) => f2.endsWith(".md"))) {
-        const abs = join16(absDir, f);
+        const abs = join19(absDir, f);
         mtimes.set(abs, st(abs).mtimeMs);
       }
     } else {
       const abs = expandPath2(k.path);
-      if (existsSync16(abs))
+      if (existsSync17(abs))
         mtimes.set(abs, st(abs).mtimeMs);
     }
   }
@@ -19981,7 +20577,7 @@ program.command("watch").description("Watch known config files for changes and a
   const tick = async () => {
     let changed = 0;
     for (const [abs, oldMtime] of mtimes) {
-      if (!existsSync16(abs))
+      if (!existsSync17(abs))
         continue;
       const newMtime = st(abs).mtimeMs;
       if (newMtime !== oldMtime) {
@@ -19993,10 +20589,10 @@ program.command("watch").description("Watch known config files for changes and a
     for (const k of KNOWN_CONFIGS) {
       if (k.rulesDir) {
         const absDir = expandPath2(k.rulesDir);
-        if (!existsSync16(absDir))
+        if (!existsSync17(absDir))
           continue;
         for (const f of rd(absDir).filter((f2) => f2.endsWith(".md"))) {
-          const abs = join16(absDir, f);
+          const abs = join19(absDir, f);
           if (!mtimes.has(abs)) {
             mtimes.set(abs, st(abs).mtimeMs);
             changed++;
@@ -20004,7 +20600,7 @@ program.command("watch").description("Watch known config files for changes and a
         }
       } else {
         const abs = expandPath2(k.path);
-        if (existsSync16(abs) && !mtimes.has(abs)) {
+        if (existsSync17(abs) && !mtimes.has(abs)) {
           mtimes.set(abs, st(abs).mtimeMs);
           changed++;
         }
@@ -20032,11 +20628,11 @@ program.command("report").description("Summary of stored configs, drift, and eco
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync16(abs)) {
+    if (!existsSync17(abs)) {
       missing++;
       continue;
     }
-    const disk = readFileSync13(abs, "utf-8");
+    const disk = readFileSync15(abs, "utf-8");
     const { content: redactedDisk } = redactContent(disk, c.format);
     if (redactedDisk !== c.content)
       drifted++;
@@ -20103,7 +20699,7 @@ program.command("clean").description("Remove configs from DB whose target files
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync16(abs)) {
+    if (!existsSync17(abs)) {
       if (printed < maxPrinted) {
         if (opts.dryRun) {
           console.log(chalk.yellow("  would remove:") + ` ${c.slug} ${chalk.dim(`(${truncateMiddle(c.target_path, 88)})`)}`);
@@ -20127,7 +20723,7 @@ ${removed} orphaned config(s) ${opts.dryRun ? "found" : "removed"}${omitted > 0
       console.log(chalk.dim(`Use --limit ${removed} to print every orphan row.`));
   }
 });
-program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
+program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
   const store = resolveConfigStore();
   const packages = [
     { name: "@hasna/todos", bin: "todos", mcp: "todos-mcp" },
@@ -20190,8 +20786,22 @@ Initializing configs:`));
   } else {
     console.log(chalk.dim("  would run: configs init"));
   }
+  console.log(chalk.cyan(`
+Reconciling managed skill runtimes:`));
+  const runtimeReport = await reconcileManagedSkillRuntimes({
+    dryRun: opts.dryRun,
+    agent: opts.from,
+    deliveryVerified: opts.deliveryVerified
+  });
+  printManagedSkillRuntimeReport(runtimeReport);
+  if (runtimeReport.failed > 0) {
+    console.error(chalk.red(`
+Bootstrap incomplete: a managed skill runtime could not be reconciled.`));
+    process.exitCode = 1;
+    return;
+  }
   console.log(chalk.bold(`
-\u2713 Bootstrap complete.`) + chalk.dim(" Restart Claude Code for MCP servers to activate."));
+\u2713 Bootstrap complete.`) + chalk.dim(" Restart agent sessions to load updated integrations."));
 });
 program.command("pull").description("Alias for sync (read from disk into DB)").option("-a, --agent <agent>", "only sync this agent").option("--dry-run", "preview without writing").action(async (opts) => {
   const result = await syncKnown({ dryRun: opts.dryRun, agent: opts.agent, store: resolveConfigStore() });