@logic-joe/fleek 0.2.18 → 0.2.19

package/dist/fleek.mjs

@@ -4679,7 +4679,7 @@ var require_setup_session = __commonJS({
     exports.SETUP_SESSION_TTL_MINUTES = 30;
     exports.SETUP_SESSION_OPEN_MAX = 10;
     exports.SETUP_SESSION_CLAIM_LIMIT = 10;
-    exports.FLEEK_CLI_SETUP_VERSION_DEFAULT = "0.2.18";
+    exports.FLEEK_CLI_SETUP_VERSION_DEFAULT = "0.2.19";
     exports.FLEEK_CLI_PACKAGE = "@logic-joe/fleek";
     exports.FLEEK_CANONICAL_SERVER = "https://api.onfleek.app";
     exports.SETUP_CLIENT_APPS = ["claude-code", "codex", "orca", "cursor", "other"];
@@ -24695,8 +24695,8 @@ var require_json_schema_processors = __commonJS({
           bySchema.set(entry.schema, entry);
       }
       const rewrites = /* @__PURE__ */ new Map();
-      for (const record of pendingRecords.get(ctx) ?? []) {
-        const seen = ctx.seen.get(record);
+      for (const record2 of pendingRecords.get(ctx) ?? []) {
+        const seen = ctx.seen.get(record2);
         const names2 = (seen?.def ?? seen?.schema)?.propertyNames;
         if (!names2 || names2 === true || rewrites.has(names2))
           continue;
@@ -25556,7 +25556,7 @@ var require_schemas2 = __commonJS({
     exports.discriminatedUnion = discriminatedUnion;
     exports.intersection = intersection;
     exports.tuple = tuple;
-    exports.record = record;
+    exports.record = record2;
     exports.partialRecord = partialRecord;
     exports.looseRecord = looseRecord;
     exports.map = map;
@@ -26579,7 +26579,7 @@ var require_schemas2 = __commonJS({
       inst.keyType = def.keyType;
       inst.valueType = def.valueType;
     });
-    function record(keyType, valueType, params) {
+    function record2(keyType, valueType, params) {
       if (!valueType || !valueType._zod) {
         return new exports.ZodRecord({
           type: "record",
@@ -27055,7 +27055,7 @@ var require_schemas2 = __commonJS({
     exports.stringbool = stringbool;
     function json2(params) {
       const jsonSchema = lazy(() => {
-        return union([string4(params), number(), boolean(), _null(), array(jsonSchema), record(string4(), jsonSchema)]);
+        return union([string4(params), number(), boolean(), _null(), array(jsonSchema), record2(string4(), jsonSchema)]);
       });
       return jsonSchema;
     }
@@ -29723,7 +29723,7 @@ var require_conditions = __commonJS({
       }
       return field ? { source, key: field } : void 0;
     }
-    var ownValue = (record, key) => record && Object.hasOwn(record, key) ? record[key] : void 0;
+    var ownValue = (record2, key) => record2 && Object.hasOwn(record2, key) ? record2[key] : void 0;
     function evaluateWorkflowCondition(condition2, context, source) {
       if (!condition2)
         return true;
@@ -34642,8 +34642,8 @@ var require_project_init2 = __commonJS({
         }
       }
       const checks = (agent.statementChecks ?? []).map(({ textDigest: _agentDigest, ...check }) => {
-        const digest = digests.get(check.statementId.toLowerCase());
-        return digest ? { ...check, textDigest: digest } : check;
+        const digest2 = digests.get(check.statementId.toLowerCase());
+        return digest2 ? { ...check, textDigest: digest2 } : check;
       });
       const key = (c) => `${c.group ?? ""}\0${c.name}`;
       const notes = /* @__PURE__ */ new Map();
@@ -34785,19 +34785,19 @@ var require_project_init2 = __commonJS({
         return false;
       return (0, secret_shape_js_1.detectSecretShape)(url) === null && (0, secret_shape_js_1.detectSecretShape)(decoded) === null;
     }
-    function* strings(value, path) {
+    function* strings2(value, path) {
       if (typeof value === "string") {
         yield [path, value];
         return;
       }
       if (Array.isArray(value)) {
         for (let i = 0; i < value.length; i++)
-          yield* strings(value[i], `${path}[${i}]`);
+          yield* strings2(value[i], `${path}[${i}]`);
         return;
       }
       if (value && typeof value === "object") {
         for (const [key, item2] of Object.entries(value))
-          yield* strings(item2, path ? `${path}.${key}` : key);
+          yield* strings2(item2, path ? `${path}.${key}` : key);
       }
     }
     var EVIDENCE_PATHS = [
@@ -34812,7 +34812,7 @@ var require_project_init2 = __commonJS({
     ];
     function scanProjectInit2(summary) {
       const findings = [];
-      for (const [path, value] of strings(summary, "")) {
+      for (const [path, value] of strings2(summary, "")) {
         if (path === "format" || path === "source.commit" || path === "source.analyzedAt" || path === "facts.factsHash")
           continue;
         if (path === "application.path") {
@@ -34925,7 +34925,7 @@ var require_project_init2 = __commonJS({
     var WARNED_PATHS = /^(?:sections\.\w+|components\[\d+\]\.note|cms\.items\[\d+\]\.note|integrations\[\d+\]\.note|reviewHints\[\d+\]\.(?:question|acceptanceCriterion)|skillSuggestions\[\d+\]\.reason|openQuestions\[\d+\]|statementChecks\[\d+\]\.reason|environments\[\d+\]\.(?:url|name|purpose))$/;
     function projectInitWarnings2(summary) {
       const out = [];
-      for (const [path, value] of strings(summary, "")) {
+      for (const [path, value] of strings2(summary, "")) {
         if (!WARNED_PATHS.test(path))
           continue;
         for (const [kind, pattern] of WARNING_PATTERNS2) {
@@ -36207,6 +36207,8 @@ var require_agent_error_details = __commonJS({
       CLAIM_REQUIRED: { issueIds: list2, requiredPurpose: oneOf3(["work"]), providedPurpose: oneOf3(["review"]) },
       RENEW_LIMIT: { hardExpiresAt: string4 },
       NOT_READY: { readySelector: string4, reason: oneOf3(types_1.NOT_READY_REASONS) },
+      // TES-929 W5: a status name is bounded user text (like TRANSITION_DENIED.reachable names), the role and process flag closed lists
+      NOT_IN_REVIEW: { state: (value) => typeof value === "string" && value.length > 0 && value.length <= 240, requiredRole: oneOf3(["intake_review"]), process: oneOf3(["off"]) },
       REVISION_CONFLICT: { currentRevision: integer },
       STATE_CONFLICT: { currentStateVersion: integer },
       TYPED_COMMENT_IMMUTABLE: { kind: string4 },
@@ -36526,10 +36528,10 @@ var require_dist2 = __commonJS({
 // src/cli.ts
 var import_types11 = __toESM(require_dist(), 1);
 import { spawn as spawn9 } from "node:child_process";
-import { createHash as createHash9, randomBytes as randomBytes12 } from "node:crypto";
+import { createHash as createHash11, randomBytes as randomBytes12 } from "node:crypto";
 import { rm as rm13, stat as stat17 } from "node:fs/promises";
 import { hostname as osHostname2 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 import { parseArgs } from "node:util";
 
 // src/config.ts
@@ -37873,6 +37875,12 @@ var EN = {
   "setup.userSkills.ask": "Install the coordinator skill for {app}? [y/N/a=all]",
   "setup.userSkills.changed": "file changed meanwhile",
   "setup.userSkills.more": "… {count} more changed lines",
+  "setup.userSkills.modified": "changed locally",
+  "setup.userSkills.update": "Update {name} ({apps})? [y/N]",
+  "setup.userSkills.updated": "{name} updated ({apps})",
+  "setup.unchanged": "Setup unchanged: everything required is set up.",
+  "setup.hint": "1 note: {command}",
+  "setup.hints": "{count} notes: {command}",
   "setup.plugins.title": "Plugins from kits (vendor packages)",
   "setup.plugins.current": "installed ({version})",
   "setup.plugins.otherVersion": "version {version} (approved: {approved})",
@@ -38762,6 +38770,12 @@ var DE = {
   "setup.userSkills.ask": "Koordinator-Skill für {app} installieren? [j/N/a=alle]",
   "setup.userSkills.changed": "Datei inzwischen geändert",
   "setup.userSkills.more": "… {count} weitere geänderte Zeilen",
+  "setup.userSkills.modified": "lokal geändert",
+  "setup.userSkills.update": "{name} aktualisieren ({apps})? [j/N]",
+  "setup.userSkills.updated": "{name} aktualisiert ({apps})",
+  "setup.unchanged": "Einrichtung unverändert: Alles Nötige ist eingerichtet.",
+  "setup.hint": "1 Hinweis: {command}",
+  "setup.hints": "{count} Hinweise: {command}",
   "setup.plugins.title": "Plugins aus Kits (Hersteller-Pakete)",
   "setup.plugins.current": "installiert ({version})",
   "setup.plugins.otherVersion": "Version {version} (freigegeben: {approved})",
@@ -39737,9 +39751,9 @@ async function listen(source, options) {
         pages2[pages2.length - 1].cursor = page.cursor;
         continue;
       }
-      const record = { from, cursor: page.cursor, remaining: page.events.length, deadLetters: [] };
-      pages2.push(record);
-      held = page.events.map((event) => ({ event, page: record, attempts: 0, lastExit: "" }));
+      const record2 = { from, cursor: page.cursor, remaining: page.events.length, deadLetters: [] };
+      pages2.push(record2);
+      held = page.events.map((event) => ({ event, page: record2, attempts: 0, lastExit: "" }));
       advance();
       if (from === null && !page.events.length) await writes;
       pump();
@@ -49220,9 +49234,9 @@ function verifySigned(signed, trust, purpose, parse2) {
   return parsed;
 }
 function requireFields(expected, fields) {
-  const record = expected ?? {};
+  const record2 = expected ?? {};
   for (const field of fields)
-    if (record[field] === void 0 || record[field] === null)
+    if (record2[field] === void 0 || record2[field] === null)
       invalid5("expectation_missing", field);
 }
 var ATTESTATION_BINDING = ["issuer", "workspaceId", "kitKey", "version", "contentHash", "baseKitHash", "placement"];
@@ -51375,8 +51389,8 @@ async function orcaStart(deps, key, values) {
 }
 
 // src/uninstall.ts
-import { cp as cp2, lstat as lstat11, mkdir as mkdir5, readFile as readFile17, readdir as readdir10, realpath as realpath13, rm as rm8, rmdir as rmdir2 } from "node:fs/promises";
-import { dirname as dirname15, join as join22, sep as sep6 } from "node:path";
+import { cp as cp2, lstat as lstat11, mkdir as mkdir6, readFile as readFile18, readdir as readdir10, realpath as realpath13, rm as rm8, rmdir as rmdir2 } from "node:fs/promises";
+import { dirname as dirname15, join as join23, sep as sep6 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 import { randomBytes as randomBytes9 } from "node:crypto";
 
@@ -52631,6 +52645,7 @@ async function planFleek(system, row, binaries, binding2 = {}) {
 }
 
 // src/user-skills.ts
+import { createHash as createHash6 } from "node:crypto";
 import { lstat as lstat5, readFile as readFile10, realpath as realpath8, stat as stat8 } from "node:fs/promises";
 import { dirname as dirname8, join as join13, sep as sep4 } from "node:path";
 
@@ -52689,6 +52704,29 @@ async function writable(home, file) {
     return false;
   }
 }
+var USER_SKILL_SHIPPED = {
+  "fleek-orca-coordinator": [
+    "dbebd679b5cdd87644cc408da803f1b147821bb411a6fca0e6b7360d3d9539da",
+    "fdc6208069027b4dbe6be9a0c970925f6465c85a37873ebdf86703831c04c4a4",
+    "b28af54eb6eab688068d273ec1b7f3f87c46786bce939b7a092b941d17df0807",
+    "4defbaf8528fb31b343eed3c661415183f4cf629ea23cca7e6f58d800b1ec51c",
+    "c03bc35e59a3b20d7cae1ba64114f21555d1b687694695185bd2071d99f7900f",
+    "7182a11083c194f95b98589a73a589af16a48d5ce110a040d3dd5f7cd1f0f05e",
+    "6ec081f07fb27ade572fcf209af73483812bd4c7d439bab0dd4419cf3a8fca72",
+    "f52bdadf883c2bc15b058493684011dffb529488123d3c8764ef7bd0410d742a",
+    "d7896ddfd21ade22af5e30445cb3e8c4bc137da4be4f852ef419323996caf428",
+    "ddbdda2839b41d12115b11375299ee5e653b797093ba796e31b29cd81327dd3f",
+    "672bcc2a133cadd0a62dbb2552cf245f5e48e5e1bd2ab02261590b05cc447279",
+    "00c1a07f8683758b985db5f33078da4bfb3a1a78319db4e81f429ed7e88a2edd",
+    "da9ab30d62945309bb191546ca46dce85cc11c5e586668346f4c2f36666e7940",
+    "f546444e239cc0ce2a752208a0f24ea8728bf670af228a3754ef3e3ebb27bc5b",
+    "8654a79d7c53852bffc9e8467b33a5639c5a926f87338fdf01c60197efdb0812",
+    "a0133e457de20257a76dc0f2835f187817de2dd6e34236b00cb5217baadaad19",
+    "77c45e67d32e75fb0490b1b5394516069f410644a30da7dbb55c5520cea396c6"
+  ]
+};
+var skillHash = (content3) => createHash6("sha256").update(content3).digest("hex");
+var shippedOutdated = (row) => row.state === "outdated" && row.before !== null && (USER_SKILL_SHIPPED[row.name] ?? []).includes(skillHash(row.before));
 async function inspectUserSkills(home) {
   const rows = [];
   for (const root of USER_SKILL_ROOTS) {
@@ -52733,8 +52771,9 @@ async function orcaPresent(system) {
   if (["ORCA_WORKTREE_ID", "ORCA_TERMINAL_HANDLE", "ORCA_USER_DATA_PATH"].some((key) => system.env[key])) return true;
   return stat8(orcaUserData(system)).then((info) => info.isDirectory(), () => false);
 }
-async function userSkillStep(ctx, system, interactive, ask2) {
+async function userSkillStep(ctx, system, interactive, ask2, options = {}) {
   if (ctx.json || !await orcaPresent(system)) return 0;
+  const askMissing = options.askMissing !== false;
   const s = ctx.out.style;
   const rows = await inspectUserSkills(system.home);
   ctx.out.line();
@@ -52742,13 +52781,13 @@ async function userSkillStep(ctx, system, interactive, ask2) {
   ctx.out.line(ctx.t("setup.userSkills.purpose"));
   for (const line of s.columns(rows.map((row) => [
     s.bold(`${row.name} · ${row.app}`),
-    row.state === "current" ? s.state("ok", ctx.t("setup.userSkills.current")) : row.state === "outdated" ? s.state("outdated", ctx.t("setup.userSkills.outdated")) : row.state === "missing" ? s.state("absent", ctx.t("setup.status.missing")) : s.state("muted", ctx.t("setup.userSkills.foreign"))
+    row.state === "current" ? s.state("ok", ctx.t("setup.userSkills.current")) : row.state === "outdated" ? s.state("outdated", ctx.t(shippedOutdated(row) ? "setup.userSkills.outdated" : "setup.userSkills.modified")) : row.state === "missing" ? s.state("absent", ctx.t("setup.status.missing")) : s.state("muted", ctx.t("setup.userSkills.foreign"))
   ]))) ctx.out.line(line);
   if (!interactive) return 0;
   let all = false;
   let failed2 = 0;
   const stamp = new Date(ctx.now()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-  for (const listed of rows.filter((row) => row.state === "missing" || row.state === "outdated")) {
+  for (const listed of rows.filter((row) => row.state === "missing" && askMissing || row.state === "outdated" && !shippedOutdated(row))) {
     const [row] = (await inspectUserSkills(system.home)).filter((entry) => entry.file === listed.file);
     if (!row || row.state !== "missing" && row.state !== "outdated") continue;
     const label = `${row.name} → ${row.app}`;
@@ -52788,6 +52827,54 @@ async function userSkillStep(ctx, system, interactive, ask2) {
   }
   return failed2;
 }
+function shippedUpdateLines(rows) {
+  return byName(rows).map(([name, apps]) => `~ ${name} (${apps})`);
+}
+function byName(rows) {
+  return [...new Set(rows.map((row) => row.name))].map((name) => [name, [...new Set(rows.filter((row) => row.name === name).map((row) => row.app))].join(", ")]);
+}
+async function updateShippedSkills(ctx, system, listed, ask2) {
+  if (!listed.length) return 0;
+  const s = ctx.out.style;
+  if (ask2) {
+    const groups = byName(listed);
+    if (await ask2([ctx.t("setup.userSkills.update", { name: groups.map(([name]) => name).join(", "), apps: [...new Set(listed.map((row) => row.app))].join(", ") })]) === "no") return 0;
+  }
+  const stamp = new Date(ctx.now()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  const undo = [];
+  const done = [];
+  let failed2 = 0;
+  for (const item2 of listed) {
+    const [row] = (await inspectUserSkills(system.home)).filter((entry) => entry.file === item2.file);
+    if (!row || !shippedOutdated(row) || row.before !== item2.before) {
+      if (row?.state !== "current") {
+        failed2++;
+        ctx.out.line(`  ${s.fail(ctx.t("setup.failed", { server: item2.name, client: item2.app, reason: ctx.t("setup.userSkills.changed") }))}`);
+      }
+      continue;
+    }
+    let outcome = "failed";
+    let backup = null;
+    if (await writable(system.home, row.file)) {
+      try {
+        backup = await backupFile(ctx.configDir, stamp, row.client, row.file);
+        outcome = await writeIfUnchanged(row.file, row.before, row.content);
+      } catch {
+        outcome = "failed";
+      }
+    }
+    if (outcome !== "ok") {
+      failed2++;
+      ctx.out.line(`  ${s.fail(ctx.t("setup.failed", { server: row.name, client: row.app, reason: ctx.t(outcome === "changed" ? "setup.userSkills.changed" : "setup.reason.config") }))}`);
+      continue;
+    }
+    done.push(row);
+    undo.push(backup ? `cp ${shellWord(backup)} ${shellWord(row.file)}` : `rm ${shellWord(row.file)}`);
+  }
+  for (const [name, apps] of byName(done)) ctx.out.line(s.ok(ctx.t("setup.userSkills.updated", { name, apps })));
+  if (undo.length) ctx.out.line(`  ${s.note(ctx.t("setup.fleek.undo", { command: neutralizeLine(undo.join(" && ")) }))}`);
+  return failed2;
+}
 
 // src/uninstall-packages.ts
 import { readFile as readFile12, realpath as realpath10 } from "node:fs/promises";
@@ -53147,17 +53234,56 @@ async function copyStartCommand(system, wrapper) {
   });
 }
 
+// src/setup-marker.ts
+import { createHash as createHash7 } from "node:crypto";
+import { mkdir as mkdir4, readFile as readFile14 } from "node:fs/promises";
+import { join as join18 } from "node:path";
+var FILE = "setup-state.json";
+var MAX = 64 * 1024;
+var HEX = /^[0-9a-f]{64}$/;
+var markerPath = (configDir) => join18(configDir, FILE);
+function digest(lines) {
+  return createHash7("sha256").update([...lines].sort().join("\n")).digest("hex");
+}
+var record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var strings = (value) => record(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string" && entry[1].length < 4096)) : {};
+async function readSetupMarker(configDir) {
+  try {
+    const text6 = await readFile14(markerPath(configDir), "utf8");
+    if (text6.length > MAX) return null;
+    const value = JSON.parse(text6);
+    if (!record(value) || value.v !== 1) return null;
+    return {
+      v: 1,
+      steps: Object.fromEntries(Object.entries(strings(value.steps)).filter(([, hash]) => HEX.test(hash))),
+      startCommands: strings(value.startCommands),
+      startClients: typeof value.startClients === "string" ? value.startClients : "",
+      warnings: Array.isArray(value.warnings) ? value.warnings.filter((item2) => typeof item2 === "string" && HEX.test(item2)).slice(0, 256) : []
+    };
+  } catch {
+    return null;
+  }
+}
+async function writeSetupMarker(configDir, marker2) {
+  try {
+    await mkdir4(configDir, { recursive: true, mode: 448 });
+    await writePrivateFile(markerPath(configDir), `${JSON.stringify(marker2, null, 2)}
+`);
+  } catch {
+  }
+}
+
 // src/uninstall-checkouts.ts
-import { cp, lstat as lstat8, readFile as readFile15, readdir as readdir7 } from "node:fs/promises";
-import { dirname as dirname13, join as join19 } from "node:path";
+import { cp, lstat as lstat8, readFile as readFile16, readdir as readdir7 } from "node:fs/promises";
+import { dirname as dirname13, join as join20 } from "node:path";
 
 // src/kit-checkout.ts
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { lstat as lstat7, mkdir as mkdir4, open as open4, readFile as readFile14, rename as rename3, rm as rm7, stat as stat10 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname12, join as join18 } from "node:path";
+import { lstat as lstat7, mkdir as mkdir5, open as open4, readFile as readFile15, rename as rename3, rm as rm7, stat as stat10 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname12, join as join19 } from "node:path";
 
 // src/kit-compose.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 var unsupported = (reason, target) => new CliError("errors.kitTargetUnsupported", EXIT.failed, { reason, target }, "KIT_TARGET_UNSUPPORTED");
 var invalid6 = (reason, path = "") => new CliError("errors.kitInvalid", EXIT.failed, { reason, path }, "KIT_INVALID");
 var E1_KEY = "work";
@@ -53314,7 +53440,7 @@ function composeTarget(target, kits, options) {
     state: { files: [...privateFiles.keys()].sort(), instructions: !!instructions3, mcp: privateMcp.map((s) => s.name).sort(), e1 }
   };
 }
-var sha256 = (text6) => createHash6("sha256").update(text6, "utf8").digest("hex");
+var sha256 = (text6) => createHash8("sha256").update(text6, "utf8").digest("hex");
 
 // src/kit-checkout.ts
 var MARKER_LINE = /^<!-- fleek-kit:([a-z][a-z0-9-]{0,40})@([0-9A-Za-z.]{1,16}) ([0-9a-f]{12})(?: (begin|end))? -->$/;
@@ -53329,7 +53455,7 @@ async function readExisting(path) {
   }
   if (!info.isFile()) throw notRepoSafe("checkout_not_a_file");
   if (info.size > 1024 * 1024) throw notRepoSafe("checkout_file_too_large");
-  return readFile14(path, "utf8");
+  return readFile15(path, "utf8");
 }
 function fileMarkerOf(content3) {
   const lines = content3.replace(/\n+$/, "").split("\n");
@@ -53542,8 +53668,8 @@ ${marker(file.key, file.version, domain)}
   const untracked = [];
   for (const path of created) if (!await isTracked(root, path, input.env)) untracked.push(path);
   const common = await commonGitDir(root, input.env);
-  const excludePath = join18(common, "info", "exclude");
-  if ((await lstat7(join18(common, "info")).catch(() => null))?.isSymbolicLink()) throw notRepoSafe("checkout_symlink");
+  const excludePath = join19(common, "info", "exclude");
+  if ((await lstat7(join19(common, "info")).catch(() => null))?.isSymbolicLink()) throw notRepoSafe("checkout_symlink");
   const existingExclude = await readExisting(excludePath);
   const section = `${domain}:${sha256(root).slice(0, 8)}`;
   const begin = `# fleek-kit ${section} begin`, end = `# fleek-kit ${section} end`;
@@ -53592,9 +53718,9 @@ async function writeOne(path, content3) {
     await syncDir(dirname12(path)).catch(() => void 0);
     return;
   }
-  await mkdir4(dirname12(path), { recursive: true, mode: 493 });
+  await mkdir5(dirname12(path), { recursive: true, mode: 493 });
   const mode = await stat10(path).then((info) => info.mode & 511).catch(() => 420);
-  const temp = join18(dirname12(path), `.${basename5(path)}.fleek-${randomBytes8(6).toString("hex")}.tmp`);
+  const temp = join19(dirname12(path), `.${basename5(path)}.fleek-${randomBytes8(6).toString("hex")}.tmp`);
   const handle = await open4(temp, "wx", mode);
   try {
     await handle.writeFile(content3, "utf8");
@@ -53661,7 +53787,7 @@ async function removalPlan(row, env) {
 }
 async function planCheckoutRemovals(configDir, profileKey2, env) {
   const rows = [];
-  const profileDir = join19(configDir, "kits", profileKey2);
+  const profileDir = join20(configDir, "kits", profileKey2);
   const projects = await readdir7(profileDir).catch((error) => {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -53680,7 +53806,7 @@ async function planCheckoutRemovals(configDir, profileKey2, env) {
         const row = { domain, root, entries };
         const plan = await removalPlan(row, env).catch(() => null);
         if (plan && !plan.writes.length && !plan.entries.length) continue;
-        rows.push({ ...row, paths: plan?.writes.map((write2) => write2.path) ?? entries.map((entry) => join19(root, entry.path)), remaining: !plan || plan.handEdited });
+        rows.push({ ...row, paths: plan?.writes.map((write2) => write2.path) ?? entries.map((entry) => join20(root, entry.path)), remaining: !plan || plan.handEdited });
       }
     } catch {
       unreadable = true;
@@ -53704,15 +53830,15 @@ async function removeCheckoutParts(rows, env, backup) {
       }
       const snapshots = /* @__PURE__ */ new Map();
       for (const write2 of plan.writes) {
-        const before = await readFile15(write2.path, "utf8").catch((error) => {
+        const before = await readFile16(write2.path, "utf8").catch((error) => {
           if (error.code === "ENOENT") return null;
           throw error;
         });
         snapshots.set(write2.path, before);
-        if (before !== null) await cp(write2.path, join19(backup, `checkout-${++index}`), { force: false, errorOnExist: true });
+        if (before !== null) await cp(write2.path, join20(backup, `checkout-${++index}`), { force: false, errorOnExist: true });
       }
       for (const [path, before] of snapshots) {
-        if (await readFile15(path, "utf8").catch(() => null) !== before) {
+        if (await readFile16(path, "utf8").catch(() => null) !== before) {
           remaining.add(row.root);
           return;
         }
@@ -53725,7 +53851,7 @@ async function removeCheckoutParts(rows, env, backup) {
 
 // src/codex-skills.ts
 import { lstat as lstat9, readdir as readdir8, rmdir } from "node:fs/promises";
-import { dirname as dirname14, join as join20 } from "node:path";
+import { dirname as dirname14, join as join21 } from "node:path";
 var CODEX_SKILLS_ROOT = ".agents/skills";
 var MANIFEST = `${CODEX_SKILLS_ROOT}/.fleek-kits.json`;
 var SKILL_ID = /^fleek-[a-z0-9][a-z0-9-]{0,57}$/;
@@ -53736,7 +53862,7 @@ async function codexSkills(domain, gen) {
   const out = /* @__PURE__ */ new Map();
   for (const rel of gen?.state.targets.codex?.files ?? []) {
     const id = BUNDLE_SKILL.exec(rel)?.[1];
-    if (id) out.set(id, await domain.readFile(gen, join20("bundle", "codex", rel)));
+    if (id) out.set(id, await domain.readFile(gen, join21("bundle", "codex", rel)));
   }
   return out;
 }
@@ -53765,8 +53891,8 @@ var exists3 = (path) => lstat9(path).then(() => true, (error) => {
   throw error;
 });
 async function writeExclude(common, root, ids) {
-  if ((await lstat9(join20(common, "info")).catch(() => null))?.isSymbolicLink()) throw notRepoSafe("checkout_symlink");
-  const path = join20(common, "info", "exclude");
+  if ((await lstat9(join21(common, "info")).catch(() => null))?.isSymbolicLink()) throw notRepoSafe("checkout_symlink");
+  const path = join21(common, "info", "exclude");
   const text6 = await readExisting(path) ?? "";
   const lines = text6.split("\n");
   const tag = sha256(root).slice(0, 8);
@@ -53856,14 +53982,14 @@ async function syncCodexSkills(input) {
 }
 async function hasCodexManifest(cwd) {
   const root = await findCheckoutRoot(cwd).catch(() => null);
-  return !!root && await exists3(join20(root, MANIFEST)).catch(() => false);
+  return !!root && await exists3(join21(root, MANIFEST)).catch(() => false);
 }
 async function recordedRoots(domain) {
-  const value = await readJsonFile(join20(domain.dir, "codex-skill-roots.json")).catch(() => null);
+  const value = await readJsonFile(join21(domain.dir, "codex-skill-roots.json")).catch(() => null);
   return value?.v === 1 && Array.isArray(value.roots) ? value.roots.filter((root) => typeof root === "string" && root.startsWith("/")).slice(-ROOTS_MAX) : [];
 }
 async function writeRoots(domain, roots) {
-  await writePrivateFile(join20(domain.dir, "codex-skill-roots.json"), `${JSON.stringify({ v: 1, roots: roots.slice(-ROOTS_MAX) })}
+  await writePrivateFile(join21(domain.dir, "codex-skill-roots.json"), `${JSON.stringify({ v: 1, roots: roots.slice(-ROOTS_MAX) })}
 `);
 }
 async function recordRoot(domain, root) {
@@ -53889,7 +54015,7 @@ async function resyncRecordedRoots(configDir, domain, gen, env) {
   return failed2;
 }
 async function planCodexSkillRemovals(configDir, profileKey2) {
-  const projects = await readdir8(join20(configDir, "kits", profileKey2)).catch(() => []);
+  const projects = await readdir8(join21(configDir, "kits", profileKey2)).catch(() => []);
   const rows = [];
   for (const projectId of projects.filter((name) => /^[0-9a-f-]{36}$/.test(name))) {
     const domain = new KitDomain(configDir, profileKey2, projectId);
@@ -53910,8 +54036,8 @@ async function planCodexSkillRemovals(configDir, profileKey2) {
 }
 
 // src/plugin-step.ts
-import { lstat as lstat10, readdir as readdir9, readFile as readFile16, realpath as realpath12, stat as stat11 } from "node:fs/promises";
-import { join as join21, sep as sep5 } from "node:path";
+import { lstat as lstat10, readdir as readdir9, readFile as readFile17, realpath as realpath12, stat as stat11 } from "node:fs/promises";
+import { join as join22, sep as sep5 } from "node:path";
 var PLUGIN_CLIENTS = ["claude", "codex"];
 var LABEL3 = { claude: "Claude Code", codex: "Codex" };
 var LIST_TIMEOUT_MS = 2e4;
@@ -53982,13 +54108,13 @@ async function readSmall(path) {
   try {
     const info = await lstat10(path);
     if (!info.isFile() || info.size > STATE_READ_LIMIT) return null;
-    return await readFile16(path, "utf8");
+    return await readFile17(path, "utf8");
   } catch {
     return null;
   }
 }
 async function claudeInstalledCommit(system, home, id, installPath) {
-  const text6 = await readSmall(join21(home.configDir ?? join21(system.home, ".claude"), "plugins", "installed_plugins.json"));
+  const text6 = await readSmall(join22(home.configDir ?? join22(system.home, ".claude"), "plugins", "installed_plugins.json"));
   if (text6 === null) return null;
   let parsed;
   try {
@@ -54003,14 +54129,14 @@ async function claudeInstalledCommit(system, home, id, installPath) {
 }
 async function checkoutCommit(root) {
   if (!root) return null;
-  const git3 = join21(root, ".git");
-  const head = (await readSmall(join21(git3, "HEAD")))?.trim() ?? "";
+  const git3 = join22(root, ".git");
+  const head = (await readSmall(join22(git3, "HEAD")))?.trim() ?? "";
   if (PLUGIN_COMMIT.test(head)) return head;
   const ref = /^ref: (refs\/heads\/[A-Za-z0-9._/-]{1,200})$/.exec(head)?.[1];
   if (!ref || ref.includes("..")) return null;
-  const loose = (await readSmall(join21(git3, ref)))?.trim() ?? "";
+  const loose = (await readSmall(join22(git3, ref)))?.trim() ?? "";
   if (PLUGIN_COMMIT.test(loose)) return loose;
-  for (const line of (await readSmall(join21(git3, "packed-refs")) ?? "").split("\n")) {
+  for (const line of (await readSmall(join22(git3, "packed-refs")) ?? "").split("\n")) {
     const [sha, name] = line.trim().split(" ");
     if (name === ref && sha && PLUGIN_COMMIT.test(sha)) return sha;
   }
@@ -54023,9 +54149,9 @@ var MANIFESTS = {
 async function localPluginSource(root, client, name) {
   let text6 = null;
   for (const file of MANIFESTS[client]) {
-    const present = await lstat10(join21(root, file)).then(() => true, () => false);
+    const present = await lstat10(join22(root, file)).then(() => true, () => false);
     if (!present) continue;
-    text6 = await readSmall(join21(root, file));
+    text6 = await readSmall(join22(root, file));
     break;
   }
   if (text6 === null) return false;
@@ -54046,7 +54172,7 @@ async function localPluginSource(root, client, name) {
     if (typeof path !== "string") return false;
     const relative3 = path === "." || path === "./" ? "" : path.startsWith("./") ? path.slice(2).replace(/\/$/, "") : null;
     if (relative3 === null || relative3.includes("\\") || relative3 && relative3.split("/").some((part) => !part || part === "." || part === "..")) return false;
-    const real = await realpath12(join21(root, relative3)).catch(() => null);
+    const real = await realpath12(join22(root, relative3)).catch(() => null);
     if (!real || real !== realRoot && !real.startsWith(`${realRoot}${sep5}`) || !await stat11(real).then((info) => info.isDirectory(), () => false)) return false;
   }
   return true;
@@ -54067,7 +54193,7 @@ async function pluginHomes(system, clients, options = {}) {
       ...options.orca === false ? [] : (await orcaClaudeHomes(system)).map((orca2) => ({ client: "claude", configDir: orca2.home, account: orca2.account, accountLabel: orca2.label }))
     ];
     for (const home of candidates) {
-      const dir = home.configDir ?? join21(system.home, ".claude");
+      const dir = home.configDir ?? join22(system.home, ".claude");
       const key = await realpath12(dir).catch(() => dir);
       if (seen.has(key)) continue;
       seen.add(key);
@@ -54273,7 +54399,7 @@ async function usableSkills(dir) {
     for (const entry of await readdir9(parent, { withFileTypes: true }).catch(() => [])) {
       if (++walked >= 5e3) return false;
       if (entry.isFile() && entry.name.endsWith(".md")) return true;
-      if (entry.isDirectory()) queue.push(join21(parent, entry.name));
+      if (entry.isDirectory()) queue.push(join22(parent, entry.name));
     }
   }
   return false;
@@ -54293,13 +54419,13 @@ async function approvedPluginDirs(system, plugins) {
       gap(row.state);
       continue;
     }
-    const cache2 = join21(row.configDir ?? join21(system.home, ".claude"), "plugins", "cache");
+    const cache2 = join22(row.configDir ?? join22(system.home, ".claude"), "plugins", "cache");
     const [realCache, realDir] = await Promise.all([realpath12(cache2).catch(() => null), row.installPath ? realpath12(row.installPath).catch(() => null) : null]);
     if (!realCache || !realDir || !realDir.startsWith(`${realCache}${sep5}`) || !await stat11(realDir).then((info) => info.isDirectory(), () => false)) {
       gap("outside_cache");
       continue;
     }
-    if (!await usableSkills(join21(realDir, "skills"))) {
+    if (!await usableSkills(join22(realDir, "skills"))) {
       gap("no_skills");
       continue;
     }
@@ -54411,7 +54537,7 @@ async function text4(file) {
   try {
     const info = await lstat11(file);
     if (!info.isFile() || info.size > 2 * 1024 * 1024) throw failure();
-    return await readFile17(file, "utf8");
+    return await readFile18(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -54429,13 +54555,13 @@ async function planUninstall(system, configDir, profiles, visited = /* @__PURE__
   const edits = [], removals = [], hints = [];
   const checkouts = [], retained = [];
   const codexSkills2 = [];
-  const profileIndex = await text4(join22(configDir, "profiles.json"));
+  const profileIndex = await text4(join23(configDir, "profiles.json"));
   const jsonFiles = /* @__PURE__ */ new Set([
-    join22(system.home, ".claude.json"),
+    join23(system.home, ".claude.json"),
     userConfigPath("claude", system),
     userConfigPath("cursor", system),
-    ...system.env.CLAUDE_CONFIG_DIR?.startsWith("/") ? [join22(system.env.CLAUDE_CONFIG_DIR, ".claude.json")] : [],
-    ...(await orcaClaudeHomes(system)).map((home) => join22(home.home, ".claude.json")),
+    ...system.env.CLAUDE_CONFIG_DIR?.startsWith("/") ? [join23(system.env.CLAUDE_CONFIG_DIR, ".claude.json")] : [],
+    ...(await orcaClaudeHomes(system)).map((home) => join23(home.home, ".claude.json")),
     ...state.configs.filter((row) => row.kind === "json").map((row) => row.file)
   ]);
   for (const target of jsonFiles) {
@@ -54449,7 +54575,7 @@ async function planUninstall(system, configDir, profiles, visited = /* @__PURE__
     const after = withoutJsonFleek(before, file);
     if (after !== null) edits.push({ file, before, after, kind: "json" });
   }
-  for (const target of /* @__PURE__ */ new Set([join22(codexHome(system), "config.toml"), ...state.configs.filter((row) => row.kind === "toml").map((row) => row.file)])) {
+  for (const target of /* @__PURE__ */ new Set([join23(codexHome(system), "config.toml"), ...state.configs.filter((row) => row.kind === "toml").map((row) => row.file)])) {
     const codex = await realpath13(target).catch(() => target);
     if (!await safePath(codex)) {
       retained.push(codex);
@@ -54466,7 +54592,7 @@ async function planUninstall(system, configDir, profiles, visited = /* @__PURE__
   }
   const orca2 = await inspectOrcaStartCommands(system, configDir);
   for (const client of ["claude", "codex"]) {
-    const file = join22(configDir, "bin", `fleek-${client}`);
+    const file = join23(configDir, "bin", `fleek-${client}`);
     if (!await safePath(file)) {
       retained.push(file);
       continue;
@@ -54480,15 +54606,15 @@ async function planUninstall(system, configDir, profiles, visited = /* @__PURE__
   }
   for (const key of keys) {
     if (!/^[0-9a-f]{32}$/.test(key)) throw failure();
-    if (!await containedState(configDir, join22(configDir, "kits", key))) throw failure();
+    if (!await containedState(configDir, join23(configDir, "kits", key))) throw failure();
     const checkout2 = await planCheckoutRemovals(configDir, key, system.env);
     checkouts.push(...checkout2.rows);
     codexSkills2.push(...await planCodexSkillRemovals(configDir, key));
     const keep = checkout2.unreadable || checkout2.rows.some((row) => row.remaining);
-    if (keep) retained.push(join22(configDir, "kits", key));
+    if (keep) retained.push(join23(configDir, "kits", key));
     for (const dir of ["kits", "credentials", "listen", "dead-letter"]) {
       if (dir === "kits" && keep) continue;
-      const file = join22(configDir, dir, key);
+      const file = join23(configDir, dir, key);
       const info = await lstat11(file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
@@ -54499,15 +54625,17 @@ async function planUninstall(system, configDir, profiles, visited = /* @__PURE__
       }
     }
   }
-  const update = join22(configDir, "update-check.json"), cache2 = await text4(update);
+  const update = join23(configDir, "update-check.json"), cache2 = await text4(update);
   if (cache2 !== null) removals.push({ file: update, before: cache2 });
+  const marker2 = markerPath(configDir), shown3 = await text4(marker2);
+  if (shown3 !== null) removals.push({ file: marker2, before: shown3 });
   for (const entry of await readdir10(configDir, { withFileTypes: true }).catch((error) => {
     if (error.code === "ENOENT") return [];
     throw error;
   })) {
-    if (/^kit-run-[A-Za-z0-9_-]+$/.test(entry.name) && !entry.isSymbolicLink()) removals.push({ file: join22(configDir, entry.name) });
+    if (/^kit-run-[A-Za-z0-9_-]+$/.test(entry.name) && !entry.isSymbolicLink()) removals.push({ file: join23(configDir, entry.name) });
   }
-  const launcher = await safePath(join22(configDir, "bin", "fleek-link")) ? await text4(join22(configDir, "bin", "fleek-link")) : null;
+  const launcher = await safePath(join23(configDir, "bin", "fleek-link")) ? await text4(join23(configDir, "bin", "fleek-link")) : null;
   const hasHandler = launcher?.startsWith("#!/bin/sh\n# Fleek link handler (fleek-orca://) - written by ") === true;
   const packageCommands = await installedCliPackages(system);
   const plugins = (await plannedPluginRemovals(system, configDir)).map((row) => ({ ...row, root: configDir }));
@@ -54551,22 +54679,22 @@ async function planUninstall(system, configDir, profiles, visited = /* @__PURE__
 }
 async function finishRoot(root, preserve, backup) {
   for (const name of ["backups", "listen", "dead-letter", "locks"]) {
-    const file = join22(root.configDir, name);
+    const file = join23(root.configDir, name);
     if (!await safePath(file)) continue;
     if (name === "backups" && backup?.startsWith(file + sep6)) {
       for (const entry of await readdir10(file).catch(() => [])) {
-        const child = join22(file, entry);
+        const child = join23(file, entry);
         if (child !== dirname15(backup)) await rm8(child, { recursive: true, force: true });
       }
       for (const entry of await readdir10(dirname15(backup)).catch(() => [])) {
-        const child = join22(dirname15(backup), entry);
+        const child = join23(dirname15(backup), entry);
         if (child !== backup) await rm8(child, { recursive: true, force: true });
       }
     } else await rm8(file, { recursive: true, force: true });
   }
   if (!preserve) await rm8(statePath(root.configDir), { force: true });
   for (const name of ["kits", "credentials", "bin", "link", "backups/uninstall", "backups"]) {
-    const file = join22(root.configDir, name);
+    const file = join23(root.configDir, name);
     if (await safePath(file)) await rmdir2(file).catch((error) => {
       if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error.code)) throw error;
     });
@@ -54579,7 +54707,7 @@ async function uninstallCommand(input) {
   const { plan, out, t } = input;
   if (input.json && !input.dryRun) throw new CliError("errors.uninstallInteractive", EXIT.accessDenied, {}, "CONFIRMATION_REQUIRED");
   const items = [
-    ...plan.profileIndex === null ? [] : [join22(input.configDir, "profiles.json")],
+    ...plan.profileIndex === null ? [] : [join23(input.configDir, "profiles.json")],
     ...plan.edits.map((edit) => edit.file + " · fleek"),
     ...plan.removals.map((row) => row.file),
     ...plan.profiles.map((profile) => t("uninstall.profile", { workspace: neutralizeLine(profile.workspace.name) })),
@@ -54627,14 +54755,14 @@ async function uninstallCommand(input) {
       await input.deleteSecret?.(account);
     }
   }
-  const backup = join22(plan.roots[0].configDir, "backups", "uninstall", `${input.now}-${randomBytes9(4).toString("hex")}`);
-  await mkdir5(backup, { recursive: true, mode: 448 });
+  const backup = join23(plan.roots[0].configDir, "backups", "uninstall", `${input.now}-${randomBytes9(4).toString("hex")}`);
+  await mkdir6(backup, { recursive: true, mode: 448 });
   const remaining = await removeCheckoutParts(plan.checkouts, plan.env, backup);
   const codexFailed = /* @__PURE__ */ new Set();
   for (const row of plan.codexSkills) {
     await syncCodexSkills({ configDir: row.domain.configDir, root: row.root, domain: row.domain.hash, skills: /* @__PURE__ */ new Map(), env: plan.env, others: "keep" }).catch(() => {
       remaining.add(row.root);
-      codexFailed.add(join22(row.domain.configDir, "kits", row.domain.profileKey));
+      codexFailed.add(join23(row.domain.configDir, "kits", row.domain.profileKey));
     });
   }
   const keptPlugins = new Map(plan.plugins.map((row) => [row.root, []]));
@@ -54643,8 +54771,8 @@ async function uninstallCommand(input) {
     remaining.add(row.label);
   }
   for (const [root, installs] of keptPlugins) await writeInstalls(root, installs);
-  const preserveKits = /* @__PURE__ */ new Set([...plan.checkouts.filter((row) => remaining.has(row.root)).map((row) => join22(row.domain.configDir, "kits", row.domain.profileKey)), ...codexFailed]);
-  if (plan.profileIndex !== null) await cp2(join22(plan.roots[0].configDir, "profiles.json"), join22(backup, "profiles.json"), { force: false, errorOnExist: true });
+  const preserveKits = /* @__PURE__ */ new Set([...plan.checkouts.filter((row) => remaining.has(row.root)).map((row) => join23(row.domain.configDir, "kits", row.domain.profileKey)), ...codexFailed]);
+  if (plan.profileIndex !== null) await cp2(join23(plan.roots[0].configDir, "profiles.json"), join23(backup, "profiles.json"), { force: false, errorOnExist: true });
   let index = 0;
   for (const edit of plan.edits) {
     let applied = false;
@@ -54656,7 +54784,7 @@ async function uninstallCommand(input) {
         applied = true;
         break;
       }
-      await cp2(edit.file, join22(backup, `${++index}-config`), { force: false, errorOnExist: true });
+      await cp2(edit.file, join23(backup, `${++index}-config`), { force: false, errorOnExist: true });
       if (await writeIfUnchanged(edit.file, before, after) === "ok") {
         applied = true;
         break;
@@ -54668,7 +54796,7 @@ async function uninstallCommand(input) {
     if (preserveKits.has(row.file)) continue;
     if (!await safePath(row.file)) throw failure();
     if (row.before !== void 0 && await text4(row.file) !== row.before) throw failure();
-    await cp2(row.file, join22(backup, `${++index}-local`), { recursive: true, force: false, errorOnExist: true });
+    await cp2(row.file, join23(backup, `${++index}-local`), { recursive: true, force: false, errorOnExist: true });
     await rm8(row.file, { recursive: row.before === void 0, force: true });
     if (row.file.endsWith("/SKILL.md")) await rmdir2(dirname15(row.file)).catch((error) => {
       if (!["ENOTEMPTY", "ENOENT"].includes(error.code ?? "")) throw error;
@@ -54698,14 +54826,14 @@ function revocationPage(profile) {
 
 // src/orca-setup.ts
 import { constants as fsConstants3 } from "node:fs";
-import { access as access4, mkdir as mkdir6, readFile as readFile18, readdir as readdir11, realpath as realpath14, stat as stat12 } from "node:fs/promises";
-import { delimiter as delimiter3, dirname as dirname16, isAbsolute as isAbsolute10, join as join23, sep as sep7 } from "node:path";
+import { access as access4, mkdir as mkdir7, readFile as readFile19, readdir as readdir11, realpath as realpath14, stat as stat12 } from "node:fs/promises";
+import { delimiter as delimiter3, dirname as dirname16, isAbsolute as isAbsolute10, join as join24, sep as sep7 } from "node:path";
 var WRAPPER_CLIENTS = ["claude", "codex"];
 async function orcaPresent2(system) {
   if (Object.keys(system.env).some((key) => /^ORCA_(WORKTREE_ID|TERMINAL_HANDLE|USER_DATA_PATH)$/.test(key))) return true;
   return stat12(orcaUserData(system)).then((info) => info.isDirectory(), () => false);
 }
-var wrapperDir = (configDir) => join23(configDir, "bin");
+var wrapperDir = (configDir) => join24(configDir, "bin");
 var quote3 = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 function wrapperContent(fleek, client, program) {
   return [
@@ -54727,10 +54855,10 @@ async function realClient(system, client, configDir) {
 async function wrapperStates(system, configDir, fleek) {
   const out = [];
   for (const client of WRAPPER_CLIENTS) {
-    const path = join23(wrapperDir(configDir), `fleek-${client}`);
+    const path = join24(wrapperDir(configDir), `fleek-${client}`);
     const program = await realClient(system, client, configDir);
     const content3 = program && fleek && await isStableFleek(fleek) ? wrapperContent(fleek, client, program) : null;
-    const current2 = await readFile18(path, "utf8").catch(() => null);
+    const current2 = await readFile19(path, "utf8").catch(() => null);
     const executable = current2 !== null && await access4(path, fsConstants3.X_OK).then(() => true, () => false);
     out.push({ client, path, program, content: content3, before: current2, state: !content3 ? "unavailable" : current2 === null ? "missing" : current2 === content3 && executable ? "current" : "outdated" });
   }
@@ -54738,8 +54866,8 @@ async function wrapperStates(system, configDir, fleek) {
 }
 async function writeWrapper(state, configDir) {
   if (!state.content || state.state === "current") return false;
-  await mkdir6(dirname16(state.path), { recursive: true, mode: 448 });
-  const before = await readFile18(state.path, "utf8").catch((error) => {
+  await mkdir7(dirname16(state.path), { recursive: true, mode: 448 });
+  const before = await readFile19(state.path, "utf8").catch((error) => {
     if (error.code === "ENOENT") return null;
     throw error;
   });
@@ -54771,7 +54899,7 @@ async function clientVersion(system, program) {
 async function clientsOnPath(system, client, configDir) {
   const out = [], seen = /* @__PURE__ */ new Set();
   for (const directory2 of (system.env.PATH ?? "").split(delimiter3).filter(isAbsolute10)) {
-    const candidate = join23(directory2, client);
+    const candidate = join24(directory2, client);
     if (await programProblem(candidate, configDir) !== null) continue;
     const real = await realpath14(candidate).catch(() => candidate);
     if (seen.has(real)) continue;
@@ -54783,8 +54911,8 @@ async function clientsOnPath(system, client, configDir) {
 async function checkWrappers(system, configDir, compare) {
   const out = [];
   for (const client of WRAPPER_CLIENTS) {
-    const path = join23(wrapperDir(configDir), `fleek-${client}`);
-    const content3 = await readFile18(path, "utf8").catch(() => null);
+    const path = join24(wrapperDir(configDir), `fleek-${client}`);
+    const content3 = await readFile19(path, "utf8").catch(() => null);
     if (content3 === null) continue;
     const program = wrapperProgram(content3);
     const problem = program ? await programProblem(program, configDir) : "missing";
@@ -54966,19 +55094,19 @@ async function fleekStart(deps, key, values) {
 }
 
 // src/link-handler.ts
-import { access as access5, mkdir as mkdir7, readFile as readFile19, rm as rm9, stat as stat14, writeFile as writeFile3 } from "node:fs/promises";
+import { access as access5, mkdir as mkdir8, readFile as readFile20, rm as rm9, stat as stat14, writeFile as writeFile3 } from "node:fs/promises";
 import { constants as constants2 } from "node:fs";
-import { delimiter as delimiter4, dirname as dirname18, join as join24 } from "node:path";
+import { delimiter as delimiter4, dirname as dirname18, join as join25 } from "node:path";
 var LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
 var BUNDLE_ID = "app.onfleek.fleek-link";
 var DESKTOP = "fleek-link.desktop";
 var quote4 = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
 var failed = (step) => new CliError("errors.linkHandler", EXIT.failed, { step }, "LINK_HANDLER_FAILED");
-var launcherPath = (configDir) => join24(configDir, "bin", "fleek-link");
-var appPath = (configDir) => join24(configDir, "link", "Fleek Link.app");
+var launcherPath = (configDir) => join25(configDir, "bin", "fleek-link");
+var appPath = (configDir) => join25(configDir, "link", "Fleek Link.app");
 var desktopPath = (system) => {
   const xdg = system.env.XDG_DATA_HOME;
-  return join24(xdg && xdg.startsWith("/") ? xdg : join24(system.home, ".local", "share"), "applications", DESKTOP);
+  return join25(xdg && xdg.startsWith("/") ? xdg : join25(system.home, ".local", "share"), "applications", DESKTOP);
 };
 function launcherContent(fleek, pathDirs, env, configDir) {
   const dirs = [.../* @__PURE__ */ new Set([...pathDirs, "/usr/bin", "/bin", "/usr/sbin", "/sbin"])].filter((dir) => dir.startsWith("/") && !dir.includes(delimiter4));
@@ -55034,15 +55162,15 @@ async function installLinkHandler(system, fleek) {
   const launcher = launcherPath(system.configDir);
   const orca2 = await system.which("orca-ide") ?? await system.which("orca");
   const pathDirs = [dirname18(fleek), dirname18(process.execPath), ...orca2 ? [dirname18(orca2)] : []];
-  await mkdir7(dirname18(launcher), { recursive: true, mode: 448 });
+  await mkdir8(dirname18(launcher), { recursive: true, mode: 448 });
   await writeFile3(launcher, launcherContent(fleek, pathDirs, system.env, system.configDir), { mode: 493 });
   if (system.platform === "darwin") {
     const app = appPath(system.configDir);
-    const source = join24(dirname18(app), "fleek-link.applescript");
-    await mkdir7(dirname18(app), { recursive: true, mode: 448 });
+    const source = join25(dirname18(app), "fleek-link.applescript");
+    await mkdir8(dirname18(app), { recursive: true, mode: 448 });
     await rm9(app, { recursive: true, force: true });
     await writeFile3(source, appleScriptSource(launcher), { mode: 384 });
-    const plist = join24(app, "Contents", "Info.plist");
+    const plist = join25(app, "Contents", "Info.plist");
     await run(system, "osacompile", "/usr/bin/osacompile", ["-o", app, source]);
     await run(system, "plist", "/usr/bin/plutil", ["-replace", "CFBundleIdentifier", "-string", BUNDLE_ID, plist]);
     await run(system, "plist", "/usr/bin/plutil", ["-replace", "LSUIElement", "-bool", "YES", plist]);
@@ -55058,11 +55186,11 @@ async function installLinkHandler(system, fleek) {
     return { platform: system.platform, paths: [launcher, app] };
   }
   const desktop = desktopPath(system);
-  const before = await readFile19(desktop, "utf8").catch(() => null);
+  const before = await readFile20(desktop, "utf8").catch(() => null);
   if (before !== null && !before.includes(launcher)) throw failed("desktop");
   const xdgMime = await system.which("xdg-mime");
   if (!xdgMime) throw failed("xdg-mime");
-  await mkdir7(dirname18(desktop), { recursive: true });
+  await mkdir8(dirname18(desktop), { recursive: true });
   await writeFile3(desktop, desktopEntry(launcher), { mode: 420 });
   await run(system, "register", xdgMime, ["default", DESKTOP, `x-scheme-handler/${LINK_SCHEME}`]);
   return { platform: system.platform, paths: [launcher, desktop] };
@@ -55077,12 +55205,12 @@ async function removeLinkHandler(system) {
     if (await exists4(app)) {
       await system.exec(LSREGISTER, ["-u", app]).catch(() => null);
       await rm9(app, { recursive: true, force: true });
-      await rm9(join24(dirname18(app), "fleek-link.applescript"), { force: true });
+      await rm9(join25(dirname18(app), "fleek-link.applescript"), { force: true });
       removed = true;
     }
   } else {
     const desktop = desktopPath(system);
-    if ((await readFile19(desktop, "utf8").catch(() => "")).includes(launcher)) {
+    if ((await readFile20(desktop, "utf8").catch(() => "")).includes(launcher)) {
       await rm9(desktop, { force: true });
       removed = true;
     }
@@ -55096,11 +55224,11 @@ async function removeLinkHandler(system) {
 async function linkHandlerInstalled(system) {
   if (system.platform === "win32") return false;
   const launcher = launcherPath(system.configDir);
-  const content3 = await readFile19(launcher, "utf8").catch(() => "");
+  const content3 = await readFile20(launcher, "utf8").catch(() => "");
   if (!content3.startsWith("#!/bin/sh\n# Fleek link handler (fleek-orca://) - written by ") || !await access5(launcher, constants2.X_OK).then(() => true, () => false)) return false;
   if (system.platform === "darwin") {
-    const plist = join24(appPath(system.configDir), "Contents", "Info.plist");
-    if (!await stat14(join24(appPath(system.configDir), "Contents", "MacOS", "applet")).then((info) => info.isFile(), () => false)) return false;
+    const plist = join25(appPath(system.configDir), "Contents", "Info.plist");
+    if (!await stat14(join25(appPath(system.configDir), "Contents", "MacOS", "applet")).then((info) => info.isFile(), () => false)) return false;
     const result2 = await system.exec("/usr/bin/plutil", ["-extract", "CFBundleURLTypes", "json", "-o", "-", plist]).catch(() => null);
     if (result2?.code !== 0) return false;
     try {
@@ -55110,7 +55238,7 @@ async function linkHandlerInstalled(system) {
       return false;
     }
   }
-  if (await readFile19(desktopPath(system), "utf8").catch(() => "") !== desktopEntry(launcher)) return false;
+  if (await readFile20(desktopPath(system), "utf8").catch(() => "") !== desktopEntry(launcher)) return false;
   const xdgMime = await system.which("xdg-mime");
   if (!xdgMime) return false;
   const result = await system.exec(xdgMime, ["query", "default", `x-scheme-handler/${LINK_SCHEME}`]).catch(() => null);
@@ -55272,8 +55400,8 @@ async function visibleProject(client, ref) {
 // src/kit.ts
 import { spawn as spawn7 } from "node:child_process";
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { readFile as readFile21, realpath as realpath16 } from "node:fs/promises";
-import { isAbsolute as isAbsolute11, join as join28, resolve as resolve6, sep as sep8 } from "node:path";
+import { readFile as readFile22, realpath as realpath16 } from "node:fs/promises";
+import { isAbsolute as isAbsolute11, join as join29, resolve as resolve6, sep as sep8 } from "node:path";
 var import_types8 = __toESM(require_dist(), 1);
 
 // src/kit-keys.ts
@@ -55349,15 +55477,15 @@ async function setupLinkHandler(ctx, interactive, confirm2) {
 
 // src/kit-setup.ts
 import { readdir as readdir12 } from "node:fs/promises";
-import { join as join26, resolve as resolve5 } from "node:path";
+import { join as join27, resolve as resolve5 } from "node:path";
 
 // src/init-scan.ts
 import { spawn as spawn6 } from "node:child_process";
 var import_validation2 = __toESM(require_dist2(), 1);
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { constants as fsConstants4 } from "node:fs";
-import { lstat as lstat12, mkdir as mkdir8, open as open5, realpath as realpath15, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname19, join as join25, posix as posix3 } from "node:path";
+import { lstat as lstat12, mkdir as mkdir9, open as open5, realpath as realpath15, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename6, dirname as dirname19, join as join26, posix as posix3 } from "node:path";
 var INIT_SCAN_LIMITS = Object.freeze({
   depth: 4,
   candidates: 20,
@@ -55449,8 +55577,8 @@ async function readJson(root, path) {
 async function readSmall2(root, path, max) {
   try {
     if (!(0, import_validation2.evidencePathAllowed)(path)) return null;
-    const realRoot = await realpath15(root), source = join25(root, path);
-    if (await realpath15(source) !== join25(realRoot, ...path.split("/"))) return null;
+    const realRoot = await realpath15(root), source = join26(root, path);
+    if (await realpath15(source) !== join26(realRoot, ...path.split("/"))) return null;
     const seen = await lstat12(source);
     if (!seen.isFile() || seen.nlink !== 1 || seen.size > max) return null;
     const handle = await open5(source, fsConstants4.O_RDONLY | (fsConstants4.O_NOFOLLOW ?? 0) | (fsConstants4.O_NONBLOCK ?? 0));
@@ -55753,7 +55881,7 @@ async function scanFacts(checkout2, app) {
     ...Object.keys(designSources).length ? { designSources } : {},
     ...environmentNames.length ? { environmentNames } : {}
   };
-  const factsHash = createHash7("sha256").update((0, import_validation2.projectInitCanonical)(base)).digest("hex");
+  const factsHash = createHash9("sha256").update((0, import_validation2.projectInitCanonical)(base)).digest("hex");
   return { facts: { ...base, factsHash }, components };
 }
 var ENV_EXAMPLE = /^\.env\.(?:example|sample|template)$/;
@@ -55834,9 +55962,9 @@ function environmentKeys(text6) {
 }
 async function stageApplication(checkout2, app, dir) {
   const prefix = app.path ? `${app.path}/` : "";
-  const target = join25(dir, "files");
-  await mkdir8(target, { recursive: true, mode: 448 });
-  const hash = createHash7("sha256");
+  const target = join26(dir, "files");
+  await mkdir9(target, { recursive: true, mode: 448 });
+  const hash = createHash9("sha256");
   const files = [];
   let skipped = 0, total = 0, patternFiles = 0, patternBytes = 0;
   const root = await realpath15(checkout2.root);
@@ -55847,14 +55975,14 @@ async function stageApplication(checkout2, app, dir) {
       skipped++;
       continue;
     }
-    const source = join25(checkout2.root, file);
+    const source = join26(checkout2.root, file);
     const own4 = file.startsWith(prefix);
     const inputPath = own4 ? file.slice(prefix.length) : `_root/${file}`;
     const envExample = ENV_EXAMPLE.test(posix3.basename(file));
     const relative3 = envExample ? `env-keys/${inputPath}.txt` : inputPath;
     try {
       const resolved = await realpath15(source);
-      if (resolved !== join25(root, ...file.split("/"))) {
+      if (resolved !== join26(root, ...file.split("/"))) {
         skipped++;
         continue;
       }
@@ -55881,8 +56009,8 @@ async function stageApplication(checkout2, app, dir) {
         skipped++;
         continue;
       }
-      const destination = join25(target, ...relative3.split("/"));
-      await mkdir8(dirname19(destination), { recursive: true, mode: 448 });
+      const destination = join26(target, ...relative3.split("/"));
+      await mkdir9(dirname19(destination), { recursive: true, mode: 448 });
       await writeFile4(destination, bytes, { mode: 256, flag: "wx" });
       total += sourceBytes;
       if (isPattern(file)) {
@@ -55890,7 +56018,7 @@ async function stageApplication(checkout2, app, dir) {
         patternBytes += sourceBytes;
       }
       files.push(relative3);
-      hash.update(relative3).update("\0").update(createHash7("sha256").update(bytes).digest("hex")).update("\n");
+      hash.update(relative3).update("\0").update(createHash9("sha256").update(bytes).digest("hex")).update("\n");
     } catch {
       skipped++;
     }
@@ -56594,7 +56722,7 @@ function printResult(ctx, input) {
     ].join(s.dim(" · "))]);
   }
   const backups = [...new Set(applied.map((item2) => item2.backup).filter((path) => !!path))];
-  if (backups.length) labels.push([ctx.t("setup.backups"), neutralizeLine(tilde(join26(backups[0], ".."), systemOf(ctx).home))]);
+  if (backups.length) labels.push([ctx.t("setup.backups"), neutralizeLine(tilde(join27(backups[0], ".."), systemOf(ctx).home))]);
   if (open8) labels.push([ctx.t("setup.openLabel"), mode === "pull" ? `${open8} - ${s.cmd("fleek kit setup")}` : String(open8)]);
   lines.push(...s.labels(labels, ""));
   for (const row of applied.filter((item2) => item2.ok)) {
@@ -56620,9 +56748,28 @@ function fleekState(ctx, row) {
   if (row.state === "other") return s.state("muted", ctx.t("setup.fleek.other"));
   return s.state("error", ctx.t("setup.reason.config"));
 }
-async function fleekStep(ctx, report, interactive, options = {}) {
-  const system = systemOf(ctx);
+function fleekWarnings(ctx, step) {
   const s = ctx.out.style;
+  return [
+    ...step.rows.filter((entry) => entry.aliases.length).map((row) => ({
+      key: digest(["alias", row.target.file, ...row.aliases]),
+      line: s.warn(ctx.t("setup.fleek.aliases", { client: fleekLabel(row), names: row.aliases.map(neutralizeLine).join(", ") }))
+    })),
+    ...step.shadows.map((shadow) => ({
+      key: digest(["shadow", shadow.client, shadow.scope, shadow.file]),
+      line: s.warn(ctx.t("setup.fleek.shadowed", { client: LABEL4[shadow.client], file: neutralizeLine(shadow.file) }))
+    }))
+  ];
+}
+function printWarnings(ctx, step, known) {
+  const warnings = fleekWarnings(ctx, step);
+  const fresh = known ? warnings.filter((item2) => !known.warnings.has(item2.key)) : warnings;
+  for (const item2 of fresh) ctx.out.line(`  ${item2.line}`);
+  const hidden = warnings.length - fresh.length;
+  if (hidden) ctx.out.line(`  ${ctx.out.style.note(ctx.t(hidden === 1 ? "setup.hint" : "setup.hints", { count: hidden, command: ctx.out.style.cmd("fleek doctor") }))}`);
+}
+async function inspectFleekStep(ctx, report, probe) {
+  const system = systemOf(ctx);
   const binaries = { claude: report.clients.find((client) => client.id === "claude")?.binary ?? null, fleek: await system.which("fleek") };
   const configDir = ctx.env.FLEEK_CONFIG_DIR ? resolve5(ctx.configDir) : null;
   const bindings = /* @__PURE__ */ new Map();
@@ -56636,7 +56783,7 @@ async function fleekStep(ctx, report, interactive, options = {}) {
   const userLevel = await Promise.all(rows.filter((row) => row.target.writable).map(async (row) => [row.target.client, await readProxyEntry(row.target).catch(() => null)]));
   const effective = async (row) => await readProxyEntry(row.target).catch(() => null) ?? (row.target.writable ? null : userLevel.find(([client]) => client === row.target.client)?.[1] ?? null);
   const handshakes = /* @__PURE__ */ new Map();
-  if (options.probe) {
+  if (probe) {
     const cache2 = /* @__PURE__ */ new Map();
     for (const row of rows) {
       const entry = await effective(row);
@@ -56655,7 +56802,17 @@ async function fleekStep(ctx, report, interactive, options = {}) {
       if (file.scope !== "user" && file.entries.some((entry) => entry.name === "fleek")) shadows.push({ client, scope: file.scope, file: file.path });
     }
   }
-  const step = { rows, applied, orca: { present, wrappers, ...present ? { startCommands: await inspectOrcaStartCommands(system, ctx.configDir) } : {} }, handshakes, shadows };
+  const step = { rows, applied, orca: { present, wrappers, ...present ? { startCommands: await inspectOrcaStartCommands(system, ctx.configDir) } : {} }, handshakes, shadows, answered: {} };
+  return { step, binaries, bindings };
+}
+async function fleekStep(ctx, report, interactive, options = {}) {
+  const system = systemOf(ctx);
+  const s = ctx.out.style;
+  const { step, binaries, bindings } = options.inspected ?? await inspectFleekStep(ctx, report, options.probe === true);
+  const { rows, applied, handshakes } = step;
+  const { present } = step.orca;
+  const wrappers = step.orca.wrappers;
+  const known = options.known ?? null;
   if (!rows.length || ctx.json) return step;
   ctx.out.line();
   ctx.out.line(s.bold(ctx.t("setup.fleek.title")));
@@ -56669,8 +56826,7 @@ async function fleekStep(ctx, report, interactive, options = {}) {
     `${fleekState(ctx, row)}${handshakeText(row)}`,
     row.state === "proxy" || row.manual === "orca_merge" ? s.dim("-") : row.manual ? s.dim(ctx.t("setup.action.manual", { reason: reasonText(ctx, row.manual) })) : s.cmd(ctx.t("setup.fleek.switch"))
   ]))) ctx.out.line(line);
-  for (const row of rows.filter((entry) => entry.aliases.length)) ctx.out.line(`  ${s.warn(ctx.t("setup.fleek.aliases", { client: fleekLabel(row), names: row.aliases.map(neutralizeLine).join(", ") }))}`);
-  for (const shadow of shadows) ctx.out.line(`  ${s.warn(ctx.t("setup.fleek.shadowed", { client: LABEL4[shadow.client], file: neutralizeLine(shadow.file) }))}`);
+  printWarnings(ctx, step, known);
   const printWrappers = () => {
     if (!present) return;
     ctx.out.line();
@@ -56728,11 +56884,12 @@ async function fleekStep(ctx, report, interactive, options = {}) {
     }
   }
   printWrappers();
-  for (const wrapper of wrappers.filter((row) => row.state === "current" && step.orca.startCommands?.clients[row.client] !== true)) {
+  for (const wrapper of wrappers.filter((row) => row.state === "current" && step.orca.startCommands?.clients[row.client] !== true && known?.startCommands?.[row.client] !== row.path)) {
     if (await ask2([ctx.t("setup.orca.copy", { client: LABEL4[wrapper.client] })]) !== "no") {
       const copied = await copyStartCommand(system, wrapper);
       ctx.out.line(ctx.t(copied ? "setup.orca.copied" : "setup.orca.copyFailed", { client: LABEL4[wrapper.client] }));
     }
+    step.answered[wrapper.client] = wrapper.path;
   }
   return step;
 }
@@ -56762,16 +56919,48 @@ var orcaJson = (step) => ({
   startCommands: step.orca.startCommands ?? null,
   wrappers: step.orca.wrappers.map((wrapper) => ({ client: wrapper.client, path: wrapper.path, state: wrapper.state, program: wrapper.program }))
 });
+function stepLines(report, step) {
+  return [
+    `orca ${step.orca.present}`,
+    ...report.clients.map((client) => `client ${client.id}`),
+    ...report.rows.map((row) => row.required ? `kit ${row.server} ${row.client} ${row.status === "missing" ? "missing" : "present"}` : `proposal ${row.server} ${row.client} ${row.action ?? "-"} ${row.configured?.scope ?? "-"}`),
+    ...step.rows.map((row) => `fleek ${row.target.client} ${row.target.file} ${row.state} ${row.manual ?? "-"}`),
+    ...step.orca.wrappers.map((wrapper) => `wrapper ${wrapper.client} ${wrapper.path} ${wrapper.state}`)
+  ];
+}
 async function provisionAfterPull(ctx, pulled, options) {
   const domain = new KitDomain(ctx.configDir, pulled.profile.key, pulled.projectId);
   const gen = await domain.current();
   const terminal = isTty(ctx) && !ctx.json && !options.yes;
   const report = await inspect(ctx, { gen, projectId: pulled.projectId, session: pulled.session, checkout: pulled.checkout, pulled: true, probe: options.probe === true });
   if (!options.setup && report.clients.length === 0) return { exit: EXIT.ok, report: null };
+  const state = options.setup && !ctx.json ? options.state ?? null : null;
+  const key = `${pulled.profile.key}/${pulled.projectId}`;
+  const clients = report.clients.map((client) => client.id).sort().join(",");
+  const marker2 = state && !state.all ? state.marker : null;
+  const known = marker2 ? { warnings: new Set(marker2.warnings), startCommands: marker2.startClients === clients ? marker2.startCommands : null } : null;
+  const inspected = state ? await inspectFleekStep(ctx, report, options.probe === true) : void 0;
+  if (state && inspected) {
+    const step = inspected.step;
+    const lines = stepLines(report, step);
+    const pluginRows = await inspectPlugins(systemOf(ctx), report.clients, await generationPlugins(domain, gen)).catch(() => null);
+    const startsKnown = step.orca.wrappers.every((wrapper) => wrapper.state !== "current" || step.orca.startCommands?.clients[wrapper.client] === true || known?.startCommands?.[wrapper.client] === wrapper.path);
+    const warnings = fleekWarnings(ctx, step).map((item2) => item2.key);
+    if (marker2 && !state.embedded && marker2.steps[key] === digest([...lines, ...state.extra]) && startsKnown && pulled.clean !== false && exitOf(report) === EXIT.ok && fleekReady(step) && pluginRows !== null && !pluginActionNeeded(pluginRows)) {
+      ctx.out.line();
+      ctx.out.line(ctx.out.style.ok(ctx.t("setup.unchanged")));
+      printWarnings(ctx, step, known);
+      return {
+        exit: EXIT.ok,
+        report: { ...reportJson(report), applied: [], fleek: fleekJson(step), fleekApplied: [], orca: orcaJson(step), plugins: pluginJson(pluginRows), pluginsApplied: [] },
+        setup: { quiet: true, key, clients, lines, answered: {}, warnings }
+      };
+    }
+  }
   if (!ctx.json) printReport(ctx, report, options.setup ? gen : null, systemOf(ctx).home, options.setup);
   const proposals = report.rows.some((row) => row.action === "install" || row.action === "update");
   const interactive = terminal && (options.setup || proposals && await chooser(ctx)([ctx.t("setup.askSetupNow")]) !== "no");
-  const fleek = options.setup || interactive ? await fleekStep(ctx, report, interactive, { probe: options.probe === true }) : { rows: [], applied: [], orca: { present: false, wrappers: [] }, handshakes: /* @__PURE__ */ new Map(), shadows: [] };
+  const fleek = options.setup || interactive ? await fleekStep(ctx, report, interactive, { probe: options.probe === true, ...inspected ? { inspected, known } : {} }) : { rows: [], applied: [], orca: { present: false, wrappers: [] }, handshakes: /* @__PURE__ */ new Map(), shadows: [] };
   const { applied, skipped } = interactive ? await applyRows(ctx, report, pulled.checkout) : { applied: [], skipped: 0 };
   const plugins = options.setup ? await pluginStep(ctx, systemOf(ctx), report.clients, await generationPlugins(domain, gen), interactive, chooser(ctx), { auto: options.servicePlugins !== void 0 && options.servicePlugins === pulled.profile.key }) : { rows: [], failed: 0, applied: [] };
   const pluginsOpen = plugins.failed > 0 || pluginActionNeeded(plugins.rows);
@@ -56800,7 +56989,25 @@ async function provisionAfterPull(ctx, pulled, options) {
     });
   }
   const exit2 = exitOf(after) === EXIT.ok && (!fleekReady(fleek) || pluginsOpen) ? PROVISION_ACTION_NEEDED : exitOf(after);
-  return { exit: exit2, report: { ...reportJson(after), applied, fleek: fleekJson(fleek), fleekApplied: fleek.applied, orca: orcaJson(fleek), plugins: pluginJson(plugins.rows), pluginsApplied: plugins.applied } };
+  const setup = state ? {
+    quiet: false,
+    key,
+    clients,
+    lines: stepLines(after, (await inspectFleekStep(ctx, after, false)).step),
+    answered: fleek.answered ?? {},
+    warnings: fleekWarnings(ctx, fleek).map((item2) => item2.key)
+  } : void 0;
+  return {
+    exit: exit2,
+    report: { ...reportJson(after), applied, fleek: fleekJson(fleek), fleekApplied: fleek.applied, orca: orcaJson(fleek), plugins: pluginJson(plugins.rows), pluginsApplied: plugins.applied },
+    ...setup ? { setup } : {}
+  };
+}
+function setupExtraLines(skills, handler) {
+  return [
+    ...skills.map((row) => `skill ${row.client} ${row.name} ${row.state !== "outdated" ? row.state : shippedOutdated(row) ? "current" : `modified ${skillHash(row.before ?? "")}`}`),
+    ...handler ? [`handler ${handler.state}`] : []
+  ];
 }
 function afterPull(ctx, values) {
   return async (pulled) => {
@@ -56822,13 +57029,23 @@ function capturing(ctx) {
   return { ctx: { ...ctx, out }, value: () => value };
 }
 async function kitSetup(ctx, projectRef, values, pull) {
-  const detected = await detectClients(systemOf(ctx));
+  const system = systemOf(ctx);
+  const detected = await detectClients(system);
   const defaultTargets = detected.map((client) => client.id).filter((id) => id === "claude" || id === "codex");
   const captured = ctx.json ? capturing(ctx) : null;
   const project = projectRef ?? values.project;
   let provision = EXIT.ok;
   let report = null;
   embedded = values.embedded === true;
+  const interactive = isTty(ctx) && values.yes !== true && !ctx.json;
+  const marker2 = ctx.json ? null : await readSetupMarker(ctx.configDir);
+  const all = values.all === true;
+  const orcaHere = !ctx.json && await orcaPresent(system);
+  const skills = orcaHere ? await inspectUserSkills(system.home) : [];
+  const handlerBefore = ctx.json || embedded ? null : await inspectSetupHandler(ctx);
+  const shipped = interactive ? skills.filter(shippedOutdated) : [];
+  let outcome;
+  let shippedFailures = 0;
   try {
     if (!ctx.json) {
       if (!embedded) {
@@ -56842,20 +57059,35 @@ async function kitSetup(ctx, projectRef, values, pull) {
       ...defaultTargets.length ? { defaultTargets } : {},
       // the next step of setup comes once, in its result
       nextStep: false,
+      ...shipped.length ? { extraChanges: shippedUpdateLines(shipped) } : {},
       after: async (pulled) => {
-        ({ exit: provision, report } = await provisionAfterPull(captured?.ctx ?? ctx, pulled, {
+        if (shipped.length) shippedFailures = await updateShippedSkills(ctx, system, shipped, pulled.confirmed ? null : chooser(ctx));
+        ({ exit: provision, report, setup: outcome } = await provisionAfterPull(captured?.ctx ?? ctx, pulled, {
           setup: true,
           yes: values.yes === true,
           probe: values.probe === true,
           ...values.servicePlugins ? { servicePlugins: values.servicePlugins } : {},
-          ...project !== void 0 ? { project } : {}
+          ...project !== void 0 ? { project } : {},
+          ...ctx.json ? {} : { state: { marker: marker2, all, embedded, extra: setupExtraLines(skills, handlerBefore) } }
         }));
         return EXIT.ok;
       }
     });
-    const skillFailures = await userSkillStep(ctx, systemOf(ctx), isTty(ctx) && values.yes !== true, chooser(ctx));
-    const handler = embedded ? null : await setupLinkHandler(ctx, isTty(ctx) && values.yes !== true, async (lines) => await chooser(ctx)(lines) === "yes");
+    const quiet = outcome?.quiet === true;
+    const skillFailures = shippedFailures + (quiet ? 0 : await userSkillStep(ctx, system, isTty(ctx) && values.yes !== true, chooser(ctx), { askMissing: marker2 === null || all }));
+    const handler = embedded ? null : quiet && handlerBefore ? { ...handlerBefore, status: handlerBefore.state === "installed" ? "ok" : "skipped" } : await setupLinkHandler(ctx, isTty(ctx) && values.yes !== true, async (lines) => await chooser(ctx)(lines) === "yes");
     const exit2 = code !== EXIT.ok ? code : handler?.status === "failed" ? EXIT.failed : provision !== EXIT.ok ? provision : skillFailures ? EXIT.failed : EXIT.ok;
+    if (interactive && outcome) {
+      const extra = setupExtraLines(orcaHere ? await inspectUserSkills(system.home) : [], embedded ? null : await inspectSetupHandler(ctx));
+      const starts = marker2 && marker2.startClients === outcome.clients ? marker2.startCommands : {};
+      await writeSetupMarker(ctx.configDir, {
+        v: 1,
+        steps: { ...marker2?.steps, [outcome.key]: digest([...outcome.lines, ...extra]) },
+        startCommands: { ...starts, ...outcome.answered },
+        startClients: outcome.clients,
+        warnings: [.../* @__PURE__ */ new Set([...marker2?.warnings ?? [], ...outcome.warnings])].slice(-256)
+      });
+    }
     if (ctx.json) ctx.out.json({ pull: captured.value(), provisioning: report, handler, exit: exit2 });
     return exit2;
   } finally {
@@ -56880,7 +57112,7 @@ async function doctorProject(ctx, profile, value, checkout2) {
 }
 async function orphanBinding(configDir, checkout2) {
   const known = new Set((await new ProfileStore(configDir).list().catch(() => [])).map((profile) => profile.key));
-  const names2 = await readdir12(join26(configDir, "kits"), { withFileTypes: true }).catch(() => []);
+  const names2 = await readdir12(join27(configDir, "kits"), { withFileTypes: true }).catch(() => []);
   for (const entry of names2) {
     if (!entry.isDirectory() || !/^[0-9a-f]{32}$/.test(entry.name) || known.has(entry.name)) continue;
     const projectId = await new CheckoutIndex(configDir, entry.name).get(checkout2).catch(() => null);
@@ -57022,21 +57254,21 @@ async function kitDoctor(ctx, values) {
 }
 
 // src/kit-proxy-launch.ts
-import { mkdir as mkdir9, mkdtemp, readFile as readFile20, rm as rm10, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname20, join as join27 } from "node:path";
+import { mkdir as mkdir10, mkdtemp, readFile as readFile21, rm as rm10, writeFile as writeFile5 } from "node:fs/promises";
+import { dirname as dirname20, join as join28 } from "node:path";
 async function proxyLaunchPlugin(input) {
   const unchanged = { pluginDir: input.pluginDir, cleanup: async () => {
   } };
   if (!input.files.includes("plugin/.mcp.json")) return unchanged;
   let config;
   try {
-    config = JSON.parse(await readFile20(join27(input.pluginDir, ".mcp.json"), "utf8"));
+    config = JSON.parse(await readFile21(join28(input.pluginDir, ".mcp.json"), "utf8"));
   } catch {
     throw new CliError("errors.kitStateCorrupt", EXIT.failed, { path: input.pluginDir }, "KIT_STATE_CORRUPT");
   }
   if (!config?.mcpServers || !Object.hasOwn(config.mcpServers, "fleek")) return unchanged;
-  const root = await mkdtemp(join27(input.configDir, "kit-run-"));
-  const pluginDir = join27(root, "plugin");
+  const root = await mkdtemp(join28(input.configDir, "kit-run-"));
+  const pluginDir = join28(root, "plugin");
   const cleanup = async () => {
     await rm10(root, { recursive: true, force: true });
   };
@@ -57046,9 +57278,9 @@ async function proxyLaunchPlugin(input) {
       if (!relative3 || relative3.split("/").some((part) => !part || part === ".." || part === ".") || relative3.includes("\\")) {
         throw new CliError("errors.kitStateCorrupt", EXIT.failed, { path: input.pluginDir }, "KIT_STATE_CORRUPT");
       }
-      const destination = join27(pluginDir, relative3);
-      await mkdir9(dirname20(destination), { recursive: true, mode: 448 });
-      const bytes = relative3 === ".mcp.json" ? JSON.stringify({ ...config, mcpServers: { ...config.mcpServers, fleek: { type: "stdio", command: input.proxy.command, args: [...input.proxy.args], ...input.proxy.env ? { env: input.proxy.env } : {} } } }, null, 2) + "\n" : await readFile20(join27(input.pluginDir, relative3));
+      const destination = join28(pluginDir, relative3);
+      await mkdir10(dirname20(destination), { recursive: true, mode: 448 });
+      const bytes = relative3 === ".mcp.json" ? JSON.stringify({ ...config, mcpServers: { ...config.mcpServers, fleek: { type: "stdio", command: input.proxy.command, args: [...input.proxy.args], ...input.proxy.env ? { env: input.proxy.env } : {} } } }, null, 2) + "\n" : await readFile21(join28(input.pluginDir, relative3));
       await writeFile5(destination, bytes, { flag: "wx", mode: 384 });
     }
     return { pluginDir, cleanup };
@@ -57194,7 +57426,7 @@ async function globalE1(home, target) {
   const spec = KIT_CAPABILITIES[target].globalE1;
   if (!spec) return false;
   try {
-    const text6 = await readFile21(join28(home, spec.path), "utf8");
+    const text6 = await readFile22(join29(home, spec.path), "utf8");
     return spec.contains ? text6.includes(spec.contains) : true;
   } catch {
     return false;
@@ -57212,7 +57444,7 @@ async function composeAll(kits, targets, checkout2, home, domain) {
       checkout: checkout2,
       globalE1: await globalE1(home, target),
       domainHash: domain.hash,
-      pluginDir: join28(domain.dir, "gen-000000000000000000000000", "bundle", target, "plugin")
+      pluginDir: join29(domain.dir, "gen-000000000000000000000000", "bundle", target, "plugin")
     });
     for (const [rel, content3] of composition.privateFiles) files.set(`bundle/${target}/${rel}`, content3);
     states[target] = composition.state;
@@ -57501,7 +57733,7 @@ async function writeComposition(input) {
   }
   const journal = Object.keys(pending).length > 0 || canonicalJson(carry) !== canonicalJson(current2?.state.undecided ?? {});
   if (!summary.changed && !journal) return { summary, skippedRoots, listedMcp };
-  const confirmed = summary.changed && !input.unattendedRemoval ? await confirm(ctx, summary, input.yes, input.acceptApproved === true) : false;
+  const confirmed = summary.changed && !input.unattendedRemoval ? await confirm(ctx, input.extraChanges?.length ? { ...summary, lines: [...summary.lines, ...input.extraChanges] } : summary, input.yes, input.acceptApproved === true) : false;
   await assertPrivateLocation(ctx.configDir, domain.dir, ctx.env);
   if (plans.length) await domain.writePending(journalUnion(pending, Object.fromEntries(plans.map((plan) => [plan.root, plan.entries]))));
   await ctx.deps.kitFault?.("journal-written");
@@ -57668,6 +57900,7 @@ async function kitPull(ctx, projectRef, values, options = {}) {
   const checkoutRoot = values.acceptApproved ? null : values.checkout !== void 0 ? await resolveCheckout(resolve6(ctx.deps.cwd ?? process.cwd(), values.checkout), ctx.env).then((root) => root ?? Promise.reject(new CliError("errors.kitNoCheckout", EXIT.usage, {}, "USAGE"))) : await resolveCheckout(ctx.deps.cwd ?? process.cwd(), ctx.env).catch(() => null);
   const trust = trustFor(ctx.deps.kitTrust ?? PINNED_KIT_TRUST, profile.issuer);
   let here = null;
+  let changesConfirmed = false;
   const code = await withProfileLock(ctx.configDir, `kit-${domain.hash}`, async () => {
     const current2 = await domain.current();
     const targets = targetsArg(values.target) ?? (current2 ? Object.keys(current2.state.targets) : null) ?? (options.defaultTargets?.length ? [...options.defaultTargets] : null) ?? ["claude"];
@@ -57772,8 +58005,10 @@ async function kitPull(ctx, projectRef, values, options = {}) {
       yes: values.yes === true,
       acceptApproved: values.acceptApproved === true,
       removals,
-      withdrawnTuples
+      withdrawnTuples,
+      ...options.extraChanges?.length ? { extraChanges: options.extraChanges } : {}
     });
+    changesConfirmed = confirmed === true;
     await domain.markChecked(ctx.now());
     await domain.markPulled(ctx.now());
     if (skippedRoots.length) await domain.setCleanupPending(skippedRoots, "merge");
@@ -57819,7 +58054,7 @@ async function kitPull(ctx, projectRef, values, options = {}) {
     return skippedRoots.length || former.pending.length ? KIT_EXIT.revokedOrNotEntitled : EXIT.ok;
   }, ctx.lock);
   if (!options.after) return code;
-  const after = await options.after({ profile, session, projectId, checkout: checkoutRoot ?? here, clean: code === EXIT.ok });
+  const after = await options.after({ profile, session, projectId, checkout: checkoutRoot ?? here, clean: code === EXIT.ok, confirmed: changesConfirmed });
   return code !== EXIT.ok ? code : after;
 }
 var DISPLAY = { current: "current", superseded: "update", revoked: "revoked", not_entitled: "not_entitled", unsigned: "unsigned" };
@@ -58078,18 +58313,18 @@ async function kitRun(ctx, client, values, userArgs) {
   if (!gen) throw new CliError("errors.kitNotPulled", EXIT.failed, { project: projectId }, "KIT_NOT_PULLED");
   const state = gen.state.targets[target];
   if (!state) throw new CliError("errors.kitTargetNotPulled", EXIT.failed, { target }, "KIT_NOT_PULLED");
-  const bundleDir = join28(gen.dir, "bundle", target);
-  const readOptional = (rel) => state.files.includes(rel) ? readFile21(join28(bundleDir, rel), "utf8") : Promise.resolve(null);
+  const bundleDir = join29(gen.dir, "bundle", target);
+  const readOptional = (rel) => state.files.includes(rel) ? readFile22(join29(bundleDir, rel), "utf8") : Promise.resolve(null);
   const instructions3 = await readOptional("instructions.md");
   const mcpRaw = await readOptional("mcp.json");
   let bundle = {
-    pluginDir: state.files.includes("plugin/.claude-plugin/plugin.json") ? join28(bundleDir, "plugin") : null,
+    pluginDir: state.files.includes("plugin/.claude-plugin/plugin.json") ? join29(bundleDir, "plugin") : null,
     instructions: instructions3,
     mcpServers: mcpRaw ? bundleMcp(mcpRaw, gen.dir) : []
   };
   let runtime;
   try {
-    const pluginMcp = state.files.includes("plugin/.mcp.json") ? JSON.parse(await readFile21(join28(bundleDir, "plugin/.mcp.json"), "utf8")) : null;
+    const pluginMcp = state.files.includes("plugin/.mcp.json") ? JSON.parse(await readFile22(join29(bundleDir, "plugin/.mcp.json"), "utf8")) : null;
     const reserved = bundle.mcpServers.some((server) => server.name === FLEEK_SERVER) || !!pluginMcp?.mcpServers && Object.hasOwn(pluginMcp.mcpServers, FLEEK_SERVER);
     if (reserved) {
       const executable = profile.cliPath ?? await resolveExecutable("fleek", ctx.env);
@@ -58144,12 +58379,12 @@ async function kitRun(ctx, client, values, userArgs) {
 }
 
 // src/init.ts
-import { createHash as createHash8, randomUUID as randomUUID4 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID4 } from "node:crypto";
 var import_validation3 = __toESM(require_dist2(), 1);
 import { constants as fsConstants5 } from "node:fs";
-import { lstat as lstat13, mkdir as mkdir10, mkdtemp as mkdtemp2, open as open6, readdir as readdir13, realpath as realpath17, rename as rename4, rm as rm11, writeFile as writeFile6 } from "node:fs/promises";
+import { lstat as lstat13, mkdir as mkdir11, mkdtemp as mkdtemp2, open as open6, readdir as readdir13, realpath as realpath17, rename as rename4, rm as rm11, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname as dirname21, join as join29, relative as relative2, resolve as resolve7, sep as sep9 } from "node:path";
+import { dirname as dirname21, join as join30, relative as relative2, resolve as resolve7, sep as sep9 } from "node:path";
 
 // src/terminal-choice.ts
 import { emitKeypressEvents } from "node:readline";
@@ -58310,7 +58545,7 @@ function projectFactLines(de, facts) {
 function manualInitCommand(stagingDir, outputDir, prompt) {
   if ([stagingDir, outputDir].some((path) => /[\u0000-\u001f\u007f]/.test(path))) throw usage3("errors.initWorkDirUnsafe");
   const quote5 = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
-  const outputFile = join29(outputDir, "agent-output.json");
+  const outputFile = join30(outputDir, "agent-output.json");
   return `( set -C; cd -- ${quote5(stagingDir)} && command claude ${initAgentArgs(prompt).map(quote5).join(" ")} > ${quote5(outputFile + ".tmp")} && mv -- ${quote5(outputFile + ".tmp")} ${quote5(outputFile)} )`;
 }
 function detectedDesignSources(facts) {
@@ -58571,9 +58806,9 @@ async function initCommand(ctx, values) {
   }
   if (checkout2.dirty && !ctx.json) ctx.info(s.warn(ctx.t("init.dirty")));
   const ownBase = !values["work-dir"];
-  const base = values["work-dir"] ? await ownWorkDir(values["work-dir"], checkout2.root) : await mkdtemp2(join29(tmpdir(), "fleek-init-"));
+  const base = values["work-dir"] ? await ownWorkDir(values["work-dir"], checkout2.root) : await mkdtemp2(join30(tmpdir(), "fleek-init-"));
   if (!ownBase) await assertPrivateAncestors(dirname21(base));
-  if (!ownBase) await mkdir10(base, { mode: 448 }).catch((error) => {
+  if (!ownBase) await mkdir11(base, { mode: 448 }).catch((error) => {
     if (error.code !== "EEXIST") throw usage3("errors.initWorkDirUnsafe");
   });
   await assertPrivateBase(base);
@@ -58612,7 +58847,7 @@ async function initCommand(ctx, values) {
     }
     if (values.keep && !unknownOutcome) {
       for (const saved of summaries) {
-        const path = join29(saved.dir, "summary.json");
+        const path = join30(saved.dir, "summary.json");
         await writeFile6(path, `${JSON.stringify(saved.summary, null, 2)}
 `, { mode: 384, flag: "wx" });
         retained.add(saved.dir);
@@ -58676,20 +58911,20 @@ async function ownWorkDir(path, checkoutRoot) {
   } catch (error) {
     if (error instanceof CliError) throw error;
     if (error.code !== "ENOENT") throw usage3("errors.initWorkDirNotEmpty");
-    real = join29(await realpath17(resolve7(absolute, "..")).catch(() => resolve7(absolute, "..")), absolute.split(sep9).pop() ?? "");
+    real = join30(await realpath17(resolve7(absolute, "..")).catch(() => resolve7(absolute, "..")), absolute.split(sep9).pop() ?? "");
   }
   const inside = relative2(root, real);
   if (inside === "" || !inside.startsWith("..") && !inside.startsWith(sep9) && !/^[A-Za-z]:/.test(inside)) throw usage3("errors.initWorkDirInCheckout");
   return absolute;
 }
 async function runApplication(ctx, client, values, checkout2, context, app, application, known, base, runId, timeoutSeconds, created, summaries) {
-  const appDir = join29(base, app.key);
-  await mkdir10(appDir, { mode: 448 });
+  const appDir = join30(base, app.key);
+  await mkdir11(appDir, { mode: 448 });
   created.push(await identityOf(appDir));
-  const stagingDir = join29(appDir, "staging"), outputDir = join29(appDir, "out");
-  await mkdir10(stagingDir, { mode: 448 });
+  const stagingDir = join30(appDir, "staging"), outputDir = join30(appDir, "out");
+  await mkdir11(stagingDir, { mode: 448 });
   created.push(await identityOf(stagingDir));
-  await mkdir10(outputDir, { mode: 448 });
+  await mkdir11(outputDir, { mode: 448 });
   created.push(await identityOf(outputDir));
   const { facts, components } = await ctx.out.waiting(ctx.t("progress.prepare", { app: app.name, path: app.path }), () => scanFacts(checkout2, app));
   const staged = await stageApplication(checkout2, app, stagingDir);
@@ -58703,13 +58938,13 @@ async function runApplication(ctx, client, values, checkout2, context, app, appl
     statements: Array.isArray(known?.statements) ? known.statements.slice(0, 100) : [],
     outputFormat: import_validation3.PROJECT_INIT_AGENT_FORMAT
   };
-  const inputFile = join29(stagingDir, "fleek-input.json"), instructionsFile = join29(stagingDir, "FLEEK-INIT.md"), outputFile = join29(outputDir, "agent-output.json");
+  const inputFile = join30(stagingDir, "fleek-input.json"), instructionsFile = join30(stagingDir, "FLEEK-INIT.md"), outputFile = join30(outputDir, "agent-output.json");
   await writeFile6(inputFile, `${JSON.stringify(input, null, 2)}
 `, { mode: 256 });
   await writeFile6(instructionsFile, `${instructions2(ctx, app, facts)}
 `, { mode: 256 });
-  const stagingDigest = createHash8("sha256").update(JSON.stringify([import_validation3.PROJECT_INIT_FORMAT, INIT_CLI_VERSION, staged.digest, facts.factsHash, input.base, input.statements])).digest("hex");
-  const idempotencyKey = values.yes ? `pi-${createHash8("sha256").update(JSON.stringify([context.project.teamId, applicationKey, checkout2.commit, stagingDigest])).digest("hex")}` : `pi-${createHash8("sha256").update(`${runId}:${app.key}`).digest("hex")}`;
+  const stagingDigest = createHash10("sha256").update(JSON.stringify([import_validation3.PROJECT_INIT_FORMAT, INIT_CLI_VERSION, staged.digest, facts.factsHash, input.base, input.statements])).digest("hex");
+  const idempotencyKey = values.yes ? `pi-${createHash10("sha256").update(JSON.stringify([context.project.teamId, applicationKey, checkout2.commit, stagingDigest])).digest("hex")}` : `pi-${createHash10("sha256").update(`${runId}:${app.key}`).digest("hex")}`;
   if (values.yes && !values["dry-run"] && (await client.availableTools()).has(ACTION_STATUS_TOOL)) {
     const status = await client.callTool(ACTION_STATUS_TOOL, { action: WIRE.projectInitSubmit, idempotencyKey }).then((r) => r.structured).catch(() => null);
     if (status?.state === "completed") {
@@ -58815,7 +59050,7 @@ async function runApplication(ctx, client, values, checkout2, context, app, appl
       client,
       WIRE.projectKnowledgeCheck,
       { teamId: context.project.teamId, summary, locale: ctx.lang },
-      { idempotencyKey: `km-${createHash8("sha256").update(JSON.stringify([context.project.teamId, applicationKey, checkout2.commit, stagingDigest])).digest("hex")}`, backoffMs: ctx.deps.mutationBackoffMs }
+      { idempotencyKey: `km-${createHash10("sha256").update(JSON.stringify([context.project.teamId, applicationKey, checkout2.commit, stagingDigest])).digest("hex")}`, backoffMs: ctx.deps.mutationBackoffMs }
     );
     emit(ctx, { event: "maintenance", app: app.key, result: check.result.result, runId: check.result.runId ?? null });
     if (check.result.fundamental !== true) {
@@ -58849,9 +59084,9 @@ var import_types9 = __toESM(require_dist(), 1);
 import { spawn as spawn8 } from "node:child_process";
 import { randomBytes as randomBytes11, randomUUID as randomUUID5 } from "node:crypto";
 import { constants as fsConstants6 } from "node:fs";
-import { access as access6, chmod as chmod4, chown, lstat as lstat14, open as open7, readFile as readFile22, rename as rename5, rm as rm12, stat as stat15 } from "node:fs/promises";
+import { access as access6, chmod as chmod4, chown, lstat as lstat14, open as open7, readFile as readFile23, rename as rename5, rm as rm12, stat as stat15 } from "node:fs/promises";
 import { hostname as osHostname } from "node:os";
-import { delimiter as delimiter5, dirname as dirname22, join as join30 } from "node:path";
+import { delimiter as delimiter5, dirname as dirname22, join as join31 } from "node:path";
 var SERVICE_KIND = "review";
 var SERVICE_PATHS = Object.freeze({
   releases: "/opt/fleek/releases",
@@ -59186,10 +59421,10 @@ function kitVersionOf(value) {
 async function install(ctx, version2) {
   const sys = ctx.system, P = SERVICE_PATHS;
   await recordServiceOwnership(ctx, version2);
-  const releaseDir = join30(P.releases, `npm-${version2}`);
-  const packageDir = join30(releaseDir, "node_modules", "@logic-joe", "fleek");
+  const releaseDir = join31(P.releases, `npm-${version2}`);
+  const packageDir = join31(releaseDir, "node_modules", "@logic-joe", "fleek");
   const ok = async (program, args, options) => (await sys.run(program, args, options)).code === 0;
-  const present = await sys.readText(join30(packageDir, "package.json")).then((text6) => {
+  const present = await sys.readText(join31(packageDir, "package.json")).then((text6) => {
     try {
       return JSON.parse(text6 ?? "").version === version2;
     } catch {
@@ -59206,16 +59441,16 @@ async function install(ctx, version2) {
   if (await sys.exists(P.bin) && !await sys.exists(P.binBackup)) await ok("cp", ["-p", P.bin, P.binBackup]);
   const linked = (await sys.run("readlink", ["-f", P.current])).stdout.trim();
   const changed = !present || linked !== packageDir;
-  if (!await ok("ln", ["-sfn", packageDir, P.current]) || !await ok("ln", ["-sfn", join30(P.current, "dist", "fleek.mjs"), P.bin])) return { ok: false, reason: "error" };
+  if (!await ok("ln", ["-sfn", packageDir, P.current]) || !await ok("ln", ["-sfn", join31(P.current, "dist", "fleek.mjs"), P.bin])) return { ok: false, reason: "error" };
   if ((await sys.run("id", ["-u", P.broker])).code !== 0 && !await ok("useradd", ["--create-home", "--home-dir", P.brokerHome, "--shell", "/usr/sbin/nologin", "--user-group", P.broker])) return { ok: false, reason: "error" };
-  const untrusted = await untrustedPath(sys, join30(packageDir, "service-agents", "install-system-service"));
+  const untrusted = await untrustedPath(sys, join31(packageDir, "service-agents", "install-system-service"));
   if (untrusted) {
     ctx.out.error(ctx.out.style.fail(ctx.t("service.untrustedPath", { path: untrusted })));
     return { ok: false, reason: "denied" };
   }
-  if (!await ok("bash", [join30(packageDir, "service-agents", "install-system-service"), SERVICE_KIND])) return { ok: false, reason: "error" };
+  if (!await ok("bash", [join31(packageDir, "service-agents", "install-system-service"), SERVICE_KIND])) return { ok: false, reason: "error" };
   if (!await sys.exists(P.keyringCredential)) {
-    if (await sys.exists(join30(P.keyring, "login.keyring"))) {
+    if (await sys.exists(join31(P.keyring, "login.keyring"))) {
       ctx.out.error(ctx.out.style.fail(ctx.t("service.keyringOrphan", { path: P.keyring })));
       return { ok: false, reason: "error" };
     }
@@ -59295,9 +59530,9 @@ async function imageDigest(ctx) {
     "--format",
     "{{.Digest}}"
   ]);
-  const digest = result.stdout.trim();
-  if (result.code !== 0 || !/^sha256:[a-f0-9]{64}$/.test(digest)) return null;
-  return `localhost/fleek-agents@${digest}`;
+  const digest2 = result.stdout.trim();
+  if (result.code !== 0 || !/^sha256:[a-f0-9]{64}$/.test(digest2)) return null;
+  return `localhost/fleek-agents@${digest2}`;
 }
 async function providerStep(ctx, skip) {
   const sys = ctx.system, P = SERVICE_PATHS;
@@ -59384,7 +59619,7 @@ async function startUnit(ctx, restart) {
 async function serviceStatus(ctx) {
   const sys = ctx.system, P = SERVICE_PATHS;
   if (sys.uid() !== 0) throw new CliError("errors.serviceRoot", EXIT.accessDenied, {}, "ROOT_REQUIRED");
-  const release = await sys.readText(join30(P.current, "package.json")).then((raw) => {
+  const release = await sys.readText(join31(P.current, "package.json")).then((raw) => {
     try {
       return String(JSON.parse(raw ?? "").version ?? "");
     } catch {
@@ -59460,7 +59695,7 @@ async function recordServiceOwnership(ctx, version2) {
   };
   state.ownedPaths ??= [];
   if (!previous2) state.keepLinger = (await sys.run("loginctl", ["show-user", P.broker, "--property=Linger", "--value"])).stdout.trim() === "yes";
-  const candidates = [join30(P.releases, `npm-${version2}`), P.current, P.bin, ...["run-job", "knowledge-poll", "unlock-keyring", "run-service", "kit-setup", "broker-run", "egress-allowlist"].map((name) => join30(P.agents, name))];
+  const candidates = [join31(P.releases, `npm-${version2}`), P.current, P.bin, ...["run-job", "knowledge-poll", "unlock-keyring", "run-service", "kit-setup", "broker-run", "egress-allowlist"].map((name) => join31(P.agents, name))];
   for (const path of candidates) if (!state.ownedPaths.includes(path) && !await sys.exists(path)) state.ownedPaths.push(path);
   if ((await sys.run("install", ["-d", "-m", "0750", "/etc/fleek-agents"])).code !== 0) throw usage4();
   const content3 = JSON.stringify(state) + "\n";
@@ -59748,7 +59983,7 @@ function realSystem(options = {}) {
     async which(name) {
       for (const dir of (process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin").split(delimiter5)) {
         if (!dir.startsWith("/")) continue;
-        const path = join30(dir, name);
+        const path = join31(dir, name);
         try {
           await access6(path, fsConstants6.X_OK);
           if ((await stat15(path)).isFile()) return path;
@@ -59783,9 +60018,9 @@ function realSystem(options = {}) {
     },
     exists: (path) => lstat14(path).then(() => true, () => false),
     entry: (path) => lstat14(path).then((info) => ({ uid: info.uid, mode: info.mode & 4095, symlink: info.isSymbolicLink() }), () => null),
-    readText: (path) => readFile22(path, "utf8").catch(() => null),
+    readText: (path) => readFile23(path, "utf8").catch(() => null),
     async writeAtomic(path, content3, options2) {
-      const temp = join30(dirname22(path), `.${randomBytes11(6).toString("hex")}.tmp`);
+      const temp = join31(dirname22(path), `.${randomBytes11(6).toString("hex")}.tmp`);
       const handle = await open7(temp, "wx", options2.mode);
       try {
         await handle.writeFile(content3);
@@ -59833,13 +60068,13 @@ function realSystem(options = {}) {
 // src/setup.ts
 var import_types10 = __toESM(require_dist(), 1);
 import { hostname } from "node:os";
-import { join as join32, resolve as resolve8 } from "node:path";
+import { join as join33, resolve as resolve8 } from "node:path";
 import { realpath as realpath19 } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 
 // src/setup-install.ts
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute as isAbsolute12, join as join31 } from "node:path";
+import { isAbsolute as isAbsolute12, join as join32 } from "node:path";
 import { realpath as realpath18 } from "node:fs/promises";
 async function installSetupCli(input) {
   if (!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(input.version) || !input.update && input.version !== input.runningVersion) {
@@ -59862,29 +60097,29 @@ async function installSetupCli(input) {
       return null;
     }
   };
-  const candidates = input.update && input.cliPath ? [input.cliPath] : [...isAbsolute12(prefix) ? [join31(prefix, "bin", "fleek")] : [], join31(cwd, ".fleek", "cli", "bin", "fleek")];
+  const candidates = input.update && input.cliPath ? [input.cliPath] : [...isAbsolute12(prefix) ? [join32(prefix, "bin", "fleek")] : [], join32(cwd, ".fleek", "cli", "bin", "fleek")];
   for (const candidate of candidates) {
     const existing = await verify3(candidate);
     if (existing) return existing;
   }
   if (!await input.confirm()) throw new CliError("errors.setupInstallDeclined", EXIT.accessDenied, {}, "CONFIRMATION_REQUIRED");
   const spec = `@logic-joe/fleek@${input.version}`;
-  const privatePrefix = join31(cwd, ".fleek", "cli");
+  const privatePrefix = join32(cwd, ".fleek", "cli");
   if (input.update && input.cliPath?.startsWith(privatePrefix + "/")) {
     const installed = await run2(npm, ["install", "--global", "--prefix", privatePrefix, "--no-audit", "--no-fund", spec], options);
-    const verified2 = installed.code === 0 ? await verify3(join31(privatePrefix, "bin", "fleek")) : null;
+    const verified2 = installed.code === 0 ? await verify3(join32(privatePrefix, "bin", "fleek")) : null;
     if (verified2) return verified2;
     throw new CliError("errors.setupInstall", EXIT.failed, {}, "SETUP_INSTALL_FAILED");
   }
   const global = await run2(npm, ["install", "--global", "--no-audit", "--no-fund", spec], options);
   if (global.code === 0 && isAbsolute12(prefix)) {
-    const installed = await verify3(join31(prefix, "bin", "fleek"));
+    const installed = await verify3(join32(prefix, "bin", "fleek"));
     if (installed) return installed;
   }
   if (input.update) throw new CliError("errors.setupInstall", EXIT.failed, {}, "SETUP_INSTALL_FAILED");
-  const fallback = await run2(npm, ["install", "--global", "--prefix", join31(cwd, ".fleek", "cli"), "--no-audit", "--no-fund", spec], options);
+  const fallback = await run2(npm, ["install", "--global", "--prefix", join32(cwd, ".fleek", "cli"), "--no-audit", "--no-fund", spec], options);
   if (fallback.code === 0) {
-    const installed = await verify3(join31(cwd, ".fleek", "cli", "bin", "fleek"));
+    const installed = await verify3(join32(cwd, ".fleek", "cli", "bin", "fleek"));
     if (installed) return installed;
   }
   throw new CliError("errors.setupInstall", EXIT.failed, {}, "SETUP_INSTALL_FAILED");
@@ -60014,7 +60249,7 @@ async function setupCommand(ctx, code, values) {
       rl.close();
     }
   };
-  const folderPath = (value) => value === "~" ? contextHome(ctx) : value.startsWith("~/") ? join32(contextHome(ctx), value.slice(2)) : resolve8(ctx.deps.cwd ?? process.cwd(), value);
+  const folderPath = (value) => value === "~" ? contextHome(ctx) : value.startsWith("~/") ? join33(contextHome(ctx), value.slice(2)) : resolve8(ctx.deps.cwd ?? process.cwd(), value);
   let cwd = folderPath(values.checkout ?? ".");
   let checkout2 = await readCheckout(cwd);
   if (!checkout2) {
@@ -60486,12 +60721,12 @@ function readableResult(out, t, result) {
       if (!uuid.test(String(value))) line(text6(value));
       return;
     }
-    const record = value;
-    if (Object.hasOwn(record, "trust") && typeof record.text === "string") {
-      walk(record.text, depth);
+    const record2 = value;
+    if (Object.hasOwn(record2, "trust") && typeof record2.text === "string") {
+      walk(record2.text, depth);
       return;
     }
-    for (const [key, item2] of Object.entries(record)) {
+    for (const [key, item2] of Object.entries(record2)) {
       if (remaining <= 0) {
         truncated = true;
         break;
@@ -60887,7 +61122,7 @@ var COMMAND_USAGE = {
   "kit list": "[--project <key|id>]",
   "kit status": "[--project <key|id>]",
   "kit pull": "[<project>] [--target claude|codex|orca|cursor|generic] [--checkout <dir>] [--tracked] [--yes] [--accept-approved]",
-  "kit setup": "[<project>] [--target <client>] [--probe] [--yes]",
+  "kit setup": "[<project>] [--target <client>] [--probe] [--all] [--yes]",
   "kit doctor": "[--project <key|id>] [--probe]",
   "kit run": "claude|codex|orca [--project <key|id>] [--dry-run] [--auto] [--program <path>] [-- <client args>]",
   init: "--project <key> [--app <key>[=<application>]] [--all-apps] [--refresh] [--maintenance] [--agent claude|manual] [--verbose] [--yes] [--dry-run] [--show] [--work-dir <dir>] [--keep]",
@@ -61301,7 +61536,7 @@ async function login(ctx, values, guided = false) {
     if (!label || label.length > 80 || /[\u0000-\u001f\u007f]/.test(label)) throw usage5();
     const options = { now: ctx.now, signal: ctx.deps.signal, wait: ctx.deps.deviceWait };
     const setupCode = ctx.env.FLEEK_SETUP_CODE ? normalizeSetupCode(ctx.env.FLEEK_SETUP_CODE) : void 0;
-    pendingDeviceKey = setupCode ? `setup-device-${createHash9("sha256").update(`${info.issuer}\0${info.resource}\0${setupCode}`).digest("hex")}` : void 0;
+    pendingDeviceKey = setupCode ? `setup-device-${createHash11("sha256").update(`${info.issuer}\0${info.resource}\0${setupCode}`).digest("hex")}` : void 0;
     const pending = pendingDeviceKey ? await store.get(pendingDeviceKey) : null;
     let device;
     if (pending) {
@@ -61697,8 +61932,8 @@ async function processTemplate(ctx, sub, args, values) {
   const { client } = await ctx.session();
   const id = () => claimRef(args[0]);
   const file = async () => {
-    const { readFile: readFile23 } = await import("node:fs/promises");
-    const raw = await readFile23(text5(values.file, 1024), "utf8");
+    const { readFile: readFile24 } = await import("node:fs/promises");
+    const raw = await readFile24(text5(values.file, 1024), "utf8");
     if (Buffer.byteLength(raw) > 256 * 1024) throw usage5();
     try {
       return JSON.parse(raw);
@@ -61747,8 +61982,8 @@ async function workflow(ctx, sub, args, values) {
   const id = () => claimRef(args[0]);
   const spec = async () => {
     const path = text5(values.file, 1024);
-    const { readFile: readFile23 } = await import("node:fs/promises");
-    const raw = await readFile23(path, "utf8");
+    const { readFile: readFile24 } = await import("node:fs/promises");
+    const raw = await readFile24(path, "utf8");
     if (Buffer.byteLength(raw) > 200 * 1024) throw usage5();
     try {
       const value = JSON.parse(raw);
@@ -61839,8 +62074,8 @@ async function listenCommand(ctx, values, exec) {
   await client.assertAvailable(WIRE.wait);
   await client.assertAvailable(WIRE.inbox);
   if (session.profile.clientId === SERVICE_CLIENT_ID) serviceExpiry(ctx, await whoamiContext(client));
-  const stateDir = join33(ctx.configDir, "listen", session.profile.key);
-  const deadLetterDir = join33(ctx.configDir, "dead-letter", session.profile.key);
+  const stateDir = join34(ctx.configDir, "listen", session.profile.key);
+  const deadLetterDir = join34(ctx.configDir, "dead-letter", session.profile.key);
   ctx.info(ctx.s.note(ctx.t("listen.started", { program: neutralizeLine(exec.program) })));
   const result = await listen(waitSource(client, [1e3, 2e3, 5e3, 1e4, 3e4]), {
     program: exec.program,
@@ -62004,8 +62239,8 @@ async function dispatch(ctx, positionals, values, exec, passthrough) {
         forget: async (profile, configDir) => {
           const profiles = new ProfileStore(configDir);
           await profiles.remove(profile.key);
-          await rm13(join33(configDir, "credentials", profile.key), { recursive: true, force: true });
-          if (!(await profiles.list()).length) await rm13(join33(configDir, "profiles.json"), { force: true });
+          await rm13(join34(configDir, "credentials", profile.key), { recursive: true, force: true });
+          if (!(await profiles.list()).length) await rm13(join34(configDir, "profiles.json"), { force: true });
         },
         clearSecrets: async (key, configDir) => {
           await clearCredentialSecrets(configDir, key, await ctx.secrets());
@@ -62522,7 +62757,7 @@ async function repos(ctx, sub, args, values) {
   }, values, () => ctx.t("result.ok"));
 }
 function repositoryCredentialName(ref) {
-  return `FA_GIT_READ_${createHash9("sha256").update(ref, "utf8").digest("hex").slice(0, 32).toUpperCase()}`;
+  return `FA_GIT_READ_${createHash11("sha256").update(ref, "utf8").digest("hex").slice(0, 32).toUpperCase()}`;
 }
 function kitContext(ctx, values, pinned) {
   let resolved;