@lovrozagar/grunt 0.6.0 → 0.6.2

package/.rulesync/reference/map.md

@@ -36,6 +36,7 @@ Cheap outline. Not a file dump.
 
 ## Scripts
 - `scripts/pipeline.mjs` — inner generate/check/watch chain (rulesync + emit-* + hooks-union / check-globals). Called by `guarded-roots`; not a public npm script (`rulesync:generate` `rulesync:check` `rulesync:watch` only)
+- `scripts/guarded-md.mjs` — sentinel merge for `AGENTS.md` `CLAUDE.md` `GEMINI.md`; copied into consumers
 - `scripts/guarded-roots.mjs` — snapshot/remerge `AGENTS.md` `CLAUDE.md` `GEMINI.md` around pipeline; check interiors wrapper
 - `scripts/check-globals.mjs` — `$HOME/.grok/config.toml` `[agent].name==orchestrator` + `[features].two_pass_compaction==true`
 - `scripts/gate-fat-tools.mjs`

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-09-17
+
+### Changed
+
+- TTY init defaults `Apply global prompt optimizations? (recommended)` to Yes (`--skip-globals` still defaults No)
+
+### Fixed
+
+- Init in `$HOME` no longer fails `emit-mcp-policy --check` after globals write `[features]` into the same `~/.grok/config.toml`
+- TTY init spinner `stop` keeps the phase name (no empty `◇`)
+
+## [0.6.1] - 2026-09-17
+
+### Changed
+
+- TTY init asks `Apply global prompt optimizations? (recommended)` instead of `Apply globals?`
+
+### Fixed
+
+- Windows tests: host `whichBin` PATHEXT/`F_OK`, cmd shims, and `path.resolve` scratch paths
+- Consumer `init` generate: product scripts imported `../cli/` which is not copied. Sentinel helpers live in `scripts/guarded-md.mjs`; setup prompts live in `scripts/prompt.mjs` / `scripts/interactive.mjs`. After init, tests spawn `node ./scripts/guarded-roots.mjs generate` and require every copied script's relative imports to exist on dest
+
 ## [0.6.0] - 2026-09-17
 
 ### Added

package/README.md

@@ -95,7 +95,8 @@ Rulesync schema doctor is separate: `npm run grunt:rulesync:doctor`.
 
 - Merge SoT `npm install` `grunt:rulesync:generate` `grunt:sync:globals:apply` `grunt:rulesync:check`
 - `--skip-globals` skips apply
-- Re-init auto-skips globals when `<!-- grunt:begin -->` in `AGENTS.md`/`CLAUDE.md`
+- TTY init asks `Apply global prompt optimizations? (recommended)` (default Yes; `--skip-globals` defaults No)
+- Non-interactive re-init auto-skips globals when `<!-- grunt:begin -->` in `AGENTS.md`/`CLAUDE.md`
 - First init (no sentinel) applies globals unless flagged
 - Owned trees/scripts refresh; extra `.rulesync` files kept; patches to grunt-owned files lost
 - `cp` cannot delete dest extras. Init/upgrade then prune: retired skills `parent` `solo` `cascade`, agents `implementer` `thinker` (plus `.grok/roles/{implementer,thinker}.toml` and `.gemini/agents/{name}/`), scripts `telemetry.mjs` `grunt-config.mjs`, paths `.grok/parent.md` `.grok/skills/shared` `.rulesync/grunt.config.jsonc` plus local overlay and example, and reserved skill dirs this package no longer ships. Consumer extras stay.
@@ -346,7 +347,7 @@ Repo-relative (repository root):
 
 ## Layout
 
-Published (`package.json` `files`): `bin/grunt.js` `cli` `scripts/check-globals.mjs` `scripts/emit-agent-shell-tools.mjs` `scripts/emit-gemini.mjs` `scripts/guarded-roots.mjs` `scripts/emit-mcp-policy.mjs` `scripts/gate-fat-tools.mjs` `scripts/hooks-union.mjs` `scripts/pipeline.mjs` `scripts/grunt-job.mjs` `scripts/parse-need.mjs` `scripts/persist-handoff.mjs` `scripts/persist-implementation.mjs` `scripts/persist-tmp.mjs` `scripts/persist-plan.mjs` `scripts/purge-global-mcps.mjs` `scripts/scrub-spawn-prompt.mjs` `scripts/scrub-text-lib.mjs` `scripts/sync-global-settings.mjs` `scripts/browser.mjs` `scripts/speak.mjs` `scripts/listen.mjs` `scripts/google-workspace.mjs` `scripts/setup.mjs` `scripts/doctor.mjs` `scripts/scrub-text` `.rulesync` `.grok` `.codex` `.claude` `.agents` `AGENTS.md` `CLAUDE.md` `.mcp.json` `README.md` `LICENSE` `CHANGELOG.md`
+Published (`package.json` `files`): `bin/grunt.js` `cli` `scripts/check-globals.mjs` `scripts/emit-agent-shell-tools.mjs` `scripts/emit-gemini.mjs` `scripts/emit-maps.mjs` `scripts/guarded-md.mjs` `scripts/guarded-roots.mjs` `scripts/emit-mcp-policy.mjs` `scripts/gate-fat-tools.mjs` `scripts/hooks-union.mjs` `scripts/pipeline.mjs` `scripts/grunt-job.mjs` `scripts/parse-need.mjs` `scripts/persist-handoff.mjs` `scripts/persist-implementation.mjs` `scripts/persist-tmp.mjs` `scripts/persist-plan.mjs` `scripts/purge-global-mcps.mjs` `scripts/scrub-spawn-prompt.mjs` `scripts/scrub-text-lib.mjs` `scripts/sync-global-settings.mjs` `scripts/browser.mjs` `scripts/speak.mjs` `scripts/listen.mjs` `scripts/google-workspace.mjs` `scripts/interactive.mjs` `scripts/prompt.mjs` `scripts/setup.mjs` `scripts/doctor.mjs` `scripts/skill-conflicts.mjs` `scripts/scrub-text` `.rulesync` `.grok` `.codex` `.claude` `.agents` `AGENTS.md` `CLAUDE.md` `.mcp.json` `README.md` `LICENSE` `CHANGELOG.md`
 
 No `scripts/*.test.ts` `scripts/fixtures/` `docs/` `coverage/` `vitest.config.ts` in `files`. `cli` dir ships whole (includes `cli/*.test.ts`).
 

package/cli/grunt.mjs

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process"
 import { readFileSync } from "node:fs"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
-import { destAlreadyInited, init, RESERVED_SKILLS, shouldAutoSkipGlobals, toGruntScriptName } from "./init.mjs"
+import { destAlreadyInited, init, RESERVED_SKILLS, toGruntScriptName } from "./init.mjs"
 import { confirm, isInteractive, select, spinner } from "./prompt.mjs"
 
 const PKG_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..")
@@ -105,10 +105,12 @@ function bindSpinner() {
   const spin = spinner()
   return (name, action) => {
     if (action === "start") spin.start(name)
-    else if (action === "stop") spin.stop()
+    else if (action === "stop") spin.stop(name)
   }
 }
 
+export const APPLY_GLOBALS_CONFIRM = "Apply global prompt optimizations? (recommended)"
+
 async function runInit(cwd, { skipGlobals, interactive }) {
   if (!interactive) {
     init(cwd, { skipGlobals })
@@ -121,10 +123,9 @@ async function runInit(cwd, { skipGlobals, interactive }) {
     })
     if (!again) return
   }
-  const autoSkip = skipGlobals || shouldAutoSkipGlobals(cwd)
   const applyGlobals = await confirm({
-    message: "Apply globals?",
-    initialValue: !autoSkip,
+    message: APPLY_GLOBALS_CONFIRM,
+    initialValue: !skipGlobals,
   })
   init(cwd, {
     skipGlobals: !applyGlobals,

package/cli/grunt.test.ts

@@ -35,7 +35,7 @@ vi.mock("./prompt.mjs", () => ({
   bailIfCancel,
 }));
 
-import { parseArgv, start } from "./grunt.mjs";
+import { APPLY_GLOBALS_CONFIRM, parseArgv, start } from "./grunt.mjs";
 
 const USAGE = `Usage: grunt [command]
 
@@ -320,6 +320,10 @@ describe("start", () => {
     ]);
     expect(init).toHaveBeenCalled();
     expect(isInteractive).toHaveBeenCalledOnce();
+    expect(confirm).toHaveBeenCalledWith({
+      message: APPLY_GLOBALS_CONFIRM,
+      initialValue: true,
+    });
   });
 
   it("TTY menu generate", async () => {
@@ -393,9 +397,12 @@ describe("start", () => {
     await start();
     expect(confirm).toHaveBeenCalled();
     const globalsConfirm = confirm.mock.calls.find(
-      (c) => String((c[0] as { message?: string }).message).includes("globals"),
+      (c) => (c[0] as { message?: string }).message === APPLY_GLOBALS_CONFIRM,
     );
-    expect(globalsConfirm?.[0]).toMatchObject({ initialValue: false });
+    expect(globalsConfirm?.[0]).toMatchObject({
+      message: APPLY_GLOBALS_CONFIRM,
+      initialValue: true,
+    });
     expect(init).toHaveBeenCalledWith(
       process.cwd(),
       expect.objectContaining({
@@ -406,8 +413,9 @@ describe("start", () => {
     );
     expect(isInteractive).toHaveBeenCalledOnce();
     expect(spin.start).toHaveBeenCalledWith("merge");
-    expect(spin.stop).toHaveBeenCalled();
+    expect(spin.stop).toHaveBeenCalledWith("merge");
     expect(spin.start).toHaveBeenCalledWith("install");
+    expect(spin.stop).toHaveBeenCalledWith("install");
   });
 
   it("TTY init --skip-globals default confirm false maps to skip", async () => {
@@ -415,6 +423,10 @@ describe("start", () => {
     confirm.mockResolvedValue(false);
     process.argv = ["node", "grunt", "init", "--skip-globals"];
     await start();
+    expect(confirm).toHaveBeenCalledWith({
+      message: APPLY_GLOBALS_CONFIRM,
+      initialValue: false,
+    });
     expect(init).toHaveBeenCalledWith(
       process.cwd(),
       expect.objectContaining({

package/cli/init.mjs

@@ -8,14 +8,40 @@ import {
   formatSkillConflictWarn,
   listSkillDirNames,
 } from "../scripts/skill-conflicts.mjs"
+import {
+  SENTINEL_BEGIN,
+  extractGruntBody,
+  writeMergedGuardedFile,
+  snapshotGuardedRoots,
+  remergeGuardedRoots,
+  withGuardedCheckInteriors,
+} from "../scripts/guarded-md.mjs"
+
+export {
+  GUARDED_ROOT_FILES,
+  SENTINEL_BEGIN,
+  SENTINEL_END,
+  MAX_GUARDED_MARKDOWN_BYTES,
+  extractUserMarkdown,
+  extractGruntBody,
+  composeGuardedMarkdown,
+  mergeGuardedContent,
+  writeMergedGuardedFile,
+  guardedMarkdownDrift,
+  snapshotGuardedRoots,
+  remergeGuardedRoots,
+  healGuardedRootFile,
+  withGuardedCheckInteriors,
+} from "../scripts/guarded-md.mjs"
 
 const PKG_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..")
 
-const PRODUCT_SCRIPTS = [
+export const PRODUCT_SCRIPTS = [
   "check-globals.mjs",
   "emit-agent-shell-tools.mjs",
   "emit-gemini.mjs",
   "emit-maps.mjs",
+  "guarded-md.mjs",
   "guarded-roots.mjs",
   "emit-mcp-policy.mjs",
   "gate-fat-tools.mjs",
@@ -35,6 +61,8 @@ const PRODUCT_SCRIPTS = [
   "speak.mjs",
   "listen.mjs",
   "google-workspace.mjs",
+  "interactive.mjs",
+  "prompt.mjs",
   "setup.mjs",
   "doctor.mjs",
   "skill-conflicts.mjs",
@@ -88,7 +116,6 @@ const AGENT_MIRROR_DIRS = [
   [".codex", "agents"],
 ]
 const GUARDED_MD_FILES = ["AGENTS.md", "CLAUDE.md"]
-export const GUARDED_ROOT_FILES = ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]
 // .mcp.json is intentionally not copied here: scripts/emit-mcp-policy.mjs
 // (run via consumer `grunt:rulesync:generate`, see mergeClaudeSettings ordering) owns and
 // merges it, so a plain-copy would just be clobbered/redundant.
@@ -104,16 +131,6 @@ export const LAUNCH_SCRIPTS = {
   grok: "grok --yolo",
 }
 const OWNED_HOOK_FILES = ["scrub-spawn-prompt.mjs", "gate-fat-tools.mjs", "orchestrate-parent.js"]
-export const SENTINEL_BEGIN = "<!-- grunt:begin -->"
-export const SENTINEL_END = "<!-- grunt:end -->"
-export const MAX_GUARDED_MARKDOWN_BYTES = 2 * 1024 * 1024
-const GRUNT_REGION_RE =
-  /(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:begin -->[ \t]*\r?\n?[\s\S]*?(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:end -->[ \t]*\r?\n?/g
-const GRUNT_INTERIOR_RE =
-  /(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:begin -->[ \t]*\r?\n?([\s\S]*?)(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:end -->/g
-const ORPHAN_END_RE = /(?:^|\r?\n)[ \t]*<!-- grunt:end -->[ \t]*(?=\r?\n|$)|<!-- grunt:end -->/g
-const BEGIN_LINE_RE = /^[ \t]*<!-- grunt:begin -->[ \t]*$/
-const END_LINE_RE = /^[ \t]*<!-- grunt:end -->[ \t]*$/
 
 function sortKeys(obj) {
   return Object.fromEntries(Object.keys(obj).sort().map((k) => [k, obj[k]]))
@@ -199,120 +216,6 @@ export function shouldAutoSkipGlobals(dest) {
   return destHasGruntSentinel(dest)
 }
 
-function detectNewline(text) {
-  return String(text).includes("\r\n") ? "\r\n" : "\n"
-}
-
-function toNewline(text, nl) {
-  return String(text).replace(/\r\n/g, "\n").replace(/\n/g, nl)
-}
-
-function trimTrailingNewlines(text) {
-  return String(text).replace(/(?:\r?\n)+$/, "")
-}
-
-function normEq(a, b) {
-  return trimTrailingNewlines(String(a).replace(/\r\n/g, "\n")) ===
-    trimTrailingNewlines(String(b).replace(/\r\n/g, "\n"))
-}
-
-function cloneRe(re) {
-  return new RegExp(re.source, re.flags)
-}
-
-function inspectGuardedBuffer(buf) {
-  if (buf.length > MAX_GUARDED_MARKDOWN_BYTES) return "huge"
-  if (buf.includes(0)) return "binary"
-  return null
-}
-
-export function extractUserMarkdown(text) {
-  let user = String(text).replace(cloneRe(GRUNT_REGION_RE), "")
-  const i = user.indexOf(SENTINEL_BEGIN)
-  if (i >= 0) user = user.slice(0, i)
-  user = user.replace(cloneRe(ORPHAN_END_RE), "")
-  return userRemainderIsBlank(user) ? "" : user
-}
-
-function unwrapStackedMarkers(text) {
-  const lines = String(text).split(/\r?\n/)
-  let start = 0
-  let end = lines.length
-  while (start < end && BEGIN_LINE_RE.test(lines[start])) start++
-  while (end > start && lines[end - 1] === "") end--
-  while (end > start && END_LINE_RE.test(lines[end - 1])) {
-    end--
-    while (end > start && lines[end - 1] === "") end--
-  }
-  return lines.slice(start, end).join("\n")
-}
-
-export function extractGruntBody(text) {
-  const src = String(text)
-  const parts = []
-  const re = cloneRe(GRUNT_INTERIOR_RE)
-  let m
-  while ((m = re.exec(src))) {
-    parts.push(trimTrailingNewlines(unwrapStackedMarkers(m[1])))
-  }
-  if (parts.length) return parts.join("\n")
-  const i = src.indexOf(SENTINEL_BEGIN)
-  if (i >= 0) {
-    return trimTrailingNewlines(
-      unwrapStackedMarkers(src.slice(i + SENTINEL_BEGIN.length).replace(/^[ \t]*\r?\n/, "")),
-    )
-  }
-  if (!src.includes(SENTINEL_END)) return null
-  return trimTrailingNewlines(unwrapStackedMarkers(src))
-}
-
-function userRemainderIsBlank(user) {
-  return String(user).replace(/\r\n/g, "\n").replace(/\n/g, "") === ""
-}
-
-export function composeGuardedMarkdown(gruntBody, userRemainder, nl = "\n") {
-  const raw = extractGruntBody(gruntBody) ?? gruntBody
-  const body = toNewline(trimTrailingNewlines(raw), nl)
-  const block = `${SENTINEL_BEGIN}${nl}${body}${nl}${SENTINEL_END}${nl}`
-  const user = extractUserMarkdown(userRemainder == null ? "" : String(userRemainder))
-  if (!user || userRemainderIsBlank(user)) return block
-  return block + toNewline(user, nl)
-}
-
-export function mergeGuardedContent(existingText, gruntBody) {
-  const existing = existingText == null ? "" : String(existingText)
-  const nl = existing.includes("\r\n") || String(gruntBody).includes("\r\n")
-    ? detectNewline(existing || gruntBody)
-    : "\n"
-  if (!existing) return composeGuardedMarkdown(gruntBody, "", nl)
-  const hadSentinel = existing.includes(SENTINEL_BEGIN) && existing.includes(SENTINEL_END)
-  const user = extractUserMarkdown(existing)
-  if (!hadSentinel && normEq(existing, gruntBody)) {
-    return composeGuardedMarkdown(gruntBody, "", nl)
-  }
-  return composeGuardedMarkdown(gruntBody, user, nl)
-}
-
-export function writeMergedGuardedFile(destPath, gruntBody) {
-  if (!fs.existsSync(destPath)) {
-    fs.writeFileSync(destPath, mergeGuardedContent("", gruntBody))
-    return
-  }
-  const buf = fs.readFileSync(destPath)
-  if (inspectGuardedBuffer(buf)) return "aborted-unsafe"
-  fs.writeFileSync(destPath, mergeGuardedContent(buf.toString("utf8"), gruntBody))
-}
-
-export function guardedMarkdownDrift(destPath, gruntBody) {
-  if (!fs.existsSync(destPath)) return true
-  const buf = fs.readFileSync(destPath)
-  if (inspectGuardedBuffer(buf)) return true
-  const text = buf.toString("utf8")
-  const interior = extractGruntBody(text)
-  if (interior == null) return !normEq(text, gruntBody)
-  return !normEq(interior, gruntBody)
-}
-
 export function mergeGuardedMarkdown(dest, pkgRoot, file, { alreadyInited = false } = {}) {
   void alreadyInited
   const src = path.join(pkgRoot, file)
@@ -322,104 +225,6 @@ export function mergeGuardedMarkdown(dest, pkgRoot, file, { alreadyInited = fals
   return writeMergedGuardedFile(d, extractGruntBody(srcText) ?? srcText)
 }
 
-export function snapshotGuardedRoots(root) {
-  const snap = {}
-  for (const file of GUARDED_ROOT_FILES) {
-    const p = path.join(root, file)
-    if (!fs.existsSync(p)) continue
-    const buf = fs.readFileSync(p)
-    const unsafe = inspectGuardedBuffer(buf)
-    if (unsafe) {
-      snap[file] = { unsafe, rawBuf: buf }
-      continue
-    }
-    const raw = buf.toString("utf8")
-    snap[file] = { raw, user: extractUserMarkdown(raw) }
-  }
-  return snap
-}
-
-export function remergeGuardedRoots(root, snap) {
-  for (const file of GUARDED_ROOT_FILES) {
-    const p = path.join(root, file)
-    const rec = snap[file]
-    if (rec?.unsafe) {
-      fs.writeFileSync(p, rec.rawBuf)
-      continue
-    }
-    if (!fs.existsSync(p)) {
-      if (rec?.raw != null) fs.writeFileSync(p, rec.raw)
-      continue
-    }
-    const buf = fs.readFileSync(p)
-    if (inspectGuardedBuffer(buf)) {
-      if (rec?.raw != null) fs.writeFileSync(p, rec.raw)
-      continue
-    }
-    const current = buf.toString("utf8")
-    if (rec && current === rec.raw) continue
-    const gruntBody = extractGruntBody(current) ?? current
-    const nl = detectNewline((rec && rec.raw) || current)
-    let user = rec ? rec.user : extractUserMarkdown(current)
-    if (rec && !rec.raw.includes(SENTINEL_BEGIN) && normEq(rec.raw, gruntBody)) user = ""
-    if (!rec && extractGruntBody(current) == null && normEq(current, gruntBody)) user = ""
-    fs.writeFileSync(p, composeGuardedMarkdown(gruntBody, user, nl))
-  }
-}
-
-export function healGuardedRootFile(root, file, snap) {
-  if (!GUARDED_ROOT_FILES.includes(file)) return
-  const p = path.join(root, file)
-  const rec = snap[file]
-  if (!fs.existsSync(p)) return
-  if (rec?.unsafe) {
-    fs.writeFileSync(p, rec.rawBuf)
-    return
-  }
-  const buf = fs.readFileSync(p)
-  if (inspectGuardedBuffer(buf)) {
-    if (rec?.raw != null) fs.writeFileSync(p, rec.raw)
-    return
-  }
-  const current = buf.toString("utf8")
-  const interior = extractGruntBody(current)
-  if (interior != null) {
-    snap[file] = { raw: current, user: extractUserMarkdown(current) }
-    return
-  }
-  if (rec && current === rec.raw) return
-  const gruntBody = current
-  const nl = detectNewline((rec && rec.raw) || current)
-  let user = rec ? rec.user : extractUserMarkdown(current)
-  if (rec && !rec.raw.includes(SENTINEL_BEGIN) && normEq(rec.raw, gruntBody)) user = ""
-  if (!rec && normEq(current, gruntBody)) user = ""
-  const out = composeGuardedMarkdown(gruntBody, user, nl)
-  fs.writeFileSync(p, out)
-  snap[file] = { raw: out, user }
-}
-
-export function withGuardedCheckInteriors(root, fn) {
-  const snap = snapshotGuardedRoots(root)
-  try {
-    for (const file of GUARDED_ROOT_FILES) {
-      const rec = snap[file]
-      if (!rec || rec.unsafe) continue
-      const body = extractGruntBody(rec.raw)
-      if (body == null) continue
-      const nl = detectNewline(rec.raw)
-      fs.writeFileSync(path.join(root, file), `${toNewline(trimTrailingNewlines(body), nl)}${nl}`)
-    }
-    return fn()
-  } finally {
-    for (const file of GUARDED_ROOT_FILES) {
-      const rec = snap[file]
-      if (!rec) continue
-      if (rec.unsafe) fs.writeFileSync(path.join(root, file), rec.rawBuf)
-      else fs.writeFileSync(path.join(root, file), rec.raw)
-    }
-  }
-}
-
 export function mergeClaudeSettings(destRoot, pkgRoot) {
   const srcPath = path.join(pkgRoot, ".claude", "settings.json")
   const destPath = path.join(destRoot, ".claude", "settings.json")
@@ -576,6 +381,8 @@ export function mergePackageJson(dest, pkgRoot) {
   destPkg.devDependencies = { ...(destPkg.devDependencies || {}) }
   destPkg.devDependencies["smol-toml"] = srcPkg.devDependencies["smol-toml"]
   destPkg.devDependencies["rulesync"] = srcPkg.devDependencies["rulesync"]
+  const clack = srcPkg.dependencies?.["@clack/prompts"]
+  if (clack) destPkg.devDependencies["@clack/prompts"] = clack
   destPkg.scripts = sortKeys(destPkg.scripts)
   destPkg.devDependencies = sortKeys(destPkg.devDependencies)
   fs.writeFileSync(destPath, `${JSON.stringify(destPkg, null, 2)}\n`)

package/cli/init.test.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -5,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   MAX_GUARDED_MARKDOWN_BYTES,
+  PRODUCT_SCRIPTS,
   composeGuardedMarkdown,
   destAlreadyInited,
   extractGruntBody,
@@ -52,34 +54,8 @@ function tmp(prefix: string) {
 
 const COPY_DIRS = [".rulesync", ".grok", ".codex", ".claude", ".agents"];
 const GUARDED_MD_FILES = ["AGENTS.md", "CLAUDE.md"];
-const PRODUCT_FILES = [
-  "check-globals.mjs",
-  "emit-agent-shell-tools.mjs",
-  "emit-gemini.mjs",
-  "emit-maps.mjs",
-  "guarded-roots.mjs",
-  "emit-mcp-policy.mjs",
-  "gate-fat-tools.mjs",
-  "hooks-union.mjs",
-  "pipeline.mjs",
-  "grunt-job.mjs",
-  "parse-need.mjs",
-  "persist-handoff.mjs",
-  "persist-implementation.mjs",
-  "persist-tmp.mjs",
-  "persist-plan.mjs",
-  "purge-global-mcps.mjs",
-  "scrub-spawn-prompt.mjs",
-  "scrub-text-lib.mjs",
-  "sync-global-settings.mjs",
-  "browser.mjs",
-  "speak.mjs",
-  "listen.mjs",
-  "google-workspace.mjs",
-  "setup.mjs",
-  "doctor.mjs",
-  "skill-conflicts.mjs",
-];
+const PRODUCT_FILES = PRODUCT_SCRIPTS.filter((name) => name !== "scrub-text");
+const PKG_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
 
 const SRC_CLAUDE_SETTINGS = {
   permissions: {
@@ -1996,3 +1972,98 @@ describe("destAlreadyInited / shouldAutoSkipGlobals", () => {
   });
 });
 
+function spawnDest(dest: string, args: string[], env: NodeJS.ProcessEnv = process.env) {
+  return spawnSync(process.execPath, args, {
+    cwd: dest,
+    encoding: "utf8",
+    env,
+  });
+}
+
+const PARENT_IMPORT_RE =
+  /(?:from\s+|import\s*\(\s*)["'`](\.\.[^"'`]*)["'`]/g;
+const RELATIVE_IMPORT_RE =
+  /(?:from\s+|import\s*\(\s*)["'`](\.[^"'`]+)["'`]/g;
+
+function relativeSpecs(text: string, re: RegExp) {
+  const out: string[] = [];
+  const copy = new RegExp(re.source, "g");
+  let m: RegExpExecArray | null;
+  while ((m = copy.exec(text))) out.push(m[1]);
+  return out;
+}
+
+describe("product scripts are consumer-safe", () => {
+  it("package.json files lists every PRODUCT_SCRIPTS entry", () => {
+    const pkg = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf8"));
+    for (const name of PRODUCT_SCRIPTS) {
+      expect(pkg.files).toContain(`scripts/${name}`);
+    }
+  });
+
+  it("do not parent-import (from or import()) — init copies scripts/ only", () => {
+    for (const name of PRODUCT_FILES) {
+      const text = fs.readFileSync(path.join(PKG_ROOT, "scripts", name), "utf8");
+      expect(relativeSpecs(text, PARENT_IMPORT_RE), name).toEqual([]);
+    }
+  });
+
+  it("repro: dest node ./scripts/guarded-roots.mjs generate misses ../cli/init.mjs", () => {
+    const dest = tmp("repro-cli-miss-");
+    fs.mkdirSync(path.join(dest, "scripts"));
+    fs.writeFileSync(
+      path.join(dest, "scripts", "broken.mjs"),
+      'import { snapshotGuardedRoots } from "../cli/init.mjs";\n',
+    );
+    const r = spawnDest(dest, ["./scripts/broken.mjs", "generate"]);
+    expect(r.status).not.toBe(0);
+    expect(r.stderr).toMatch(/ERR_MODULE_NOT_FOUND/);
+    expect(r.stderr).toMatch(/cli\/init\.mjs/);
+  });
+
+  it("after init, copied scripts' relative imports exist and generate loads", () => {
+    const dest = tmp("init-generate-");
+    init(dest, {
+      pkgRoot: PKG_ROOT,
+      execFileSync: vi.fn(),
+      skipGlobals: true,
+      applyGlobals: false,
+    });
+    expect(fs.existsSync(path.join(dest, "cli"))).toBe(false);
+    expect(fs.existsSync(path.join(dest, "scripts", "guarded-roots.mjs"))).toBe(true);
+
+    for (const name of PRODUCT_FILES) {
+      const file = path.join(dest, "scripts", name);
+      expect(fs.existsSync(file), name).toBe(true);
+      const text = fs.readFileSync(file, "utf8");
+      for (const spec of relativeSpecs(text, RELATIVE_IMPORT_RE)) {
+        const resolved = path.resolve(path.dirname(file), spec);
+        expect(fs.existsSync(resolved), `${name} -> ${spec}`).toBe(true);
+      }
+    }
+
+    const loaded = spawnDest(dest, ["./scripts/guarded-roots.mjs"]);
+    expect(loaded.status).toBe(1);
+    expect(loaded.stderr).toBe("usage: guarded-roots.mjs generate|check|watch\n");
+    expect(loaded.stderr).not.toMatch(/ERR_MODULE_NOT_FOUND/);
+
+    const gen = spawnDest(dest, ["./scripts/guarded-roots.mjs", "generate"], {
+      ...process.env,
+      PATH: ["/usr/bin", "/bin"].join(path.delimiter),
+    });
+    expect(gen.stderr).not.toMatch(/ERR_MODULE_NOT_FOUND/);
+    expect(gen.stderr).not.toMatch(/cli\/init\.mjs/);
+    expect(`${gen.stderr}${gen.stdout}`).toMatch(/rulesync|spawn|not found|ENOENT/i);
+
+    for (const name of ["guarded-roots.mjs", "emit-gemini.mjs", "setup.mjs"]) {
+      const r = spawnDest(dest, [
+        "--input-type=module",
+        "-e",
+        `import(${JSON.stringify(`./scripts/${name}`)})`,
+      ]);
+      expect(r.status, `${name} load\n${r.stderr}`).toBe(0);
+      expect(r.stderr, name).not.toMatch(/ERR_MODULE_NOT_FOUND/);
+    }
+  });
+});
+

package/cli/prompt.mjs

@@ -1,44 +1,9 @@
-import * as clack from "@clack/prompts"
-
-export function isInteractive({
-  argv = process.argv.slice(2),
-  env = process.env,
-  stdin = process.stdin,
-  stdout = process.stdout,
-} = {}) {
-  if (!stdin?.isTTY || !stdout?.isTTY) return false
-  const ci = env.CI
-  if (ci != null && ci !== "" && ci !== "0" && ci !== "false") return false
-  for (const a of argv) {
-    if (a === "--yes" || a === "-y" || a === "--non-interactive") return false
-  }
-  return true
-}
-
-export function bailIfCancel(value) {
-  if (clack.isCancel(value)) {
-    clack.cancel("Aborted")
-    process.exit(0)
-  }
-  return value
-}
-
-export async function select(opts) {
-  return bailIfCancel(await clack.select(opts))
-}
-
-export async function confirm(opts) {
-  return bailIfCancel(await clack.confirm(opts))
-}
-
-export async function text(opts) {
-  return bailIfCancel(await clack.text(opts))
-}
-
-export async function password(opts) {
-  return bailIfCancel(await clack.password(opts))
-}
-
-export function spinner() {
-  return clack.spinner()
-}
+export {
+  bailIfCancel,
+  confirm,
+  isInteractive,
+  password,
+  select,
+  spinner,
+  text,
+} from "../scripts/prompt.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovrozagar/grunt",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Multi-agent orchestrator SoT — deep-merge rulesync trees, product scripts, and generate pipeline into a consumer repo",
   "keywords": [
     "agents",
@@ -28,6 +28,7 @@
     "scripts/emit-agent-shell-tools.mjs",
     "scripts/emit-gemini.mjs",
     "scripts/emit-maps.mjs",
+    "scripts/guarded-md.mjs",
     "scripts/guarded-roots.mjs",
     "scripts/emit-mcp-policy.mjs",
     "scripts/gate-fat-tools.mjs",
@@ -47,6 +48,8 @@
     "scripts/speak.mjs",
     "scripts/listen.mjs",
     "scripts/google-workspace.mjs",
+    "scripts/interactive.mjs",
+    "scripts/prompt.mjs",
     "scripts/setup.mjs",
     "scripts/doctor.mjs",
     "scripts/skill-conflicts.mjs",

package/scripts/browser.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /** Session browser rail: nav|snap|click|fill|scroll|wait|hover|select|shot|pdf|stop|doctor|ensure. Lightpanda default. */
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
@@ -137,6 +137,21 @@ function alive(pid) {
 
 function reap(pid) {
   if (!pid) return;
+  if (process.platform === "win32") {
+    try {
+      process.kill(pid);
+    } catch {
+      /* ignore */
+    }
+    if (alive(pid)) {
+      spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], {
+        stdio: "ignore",
+        timeout: 1500,
+        windowsHide: true,
+      });
+    }
+    return;
+  }
   try {
     process.kill(-pid, "SIGTERM");
   } catch {
@@ -480,6 +495,19 @@ function engineBin(engine, bins) {
   return bins.chromium;
 }
 
+function spawnEngine(bin, args, opts) {
+  if (process.platform === "win32" && /\.(cmd|bat)$/i.test(bin)) {
+    const mjs = `${String(bin).replace(/\.(cmd|bat)$/i, "")}.mjs`;
+    try {
+      fs.accessSync(mjs, fs.constants.F_OK);
+      return spawn(process.execPath, [mjs, ...args], opts);
+    } catch {
+      return spawn(bin, args, { ...opts, shell: true });
+    }
+  }
+  return spawn(bin, args, opts);
+}
+
 function spawnArgs(engine, port, profile) {
   if (engine === "lightpanda") return ["serve", "--host", "127.0.0.1", "--port", String(port)];
   return [
@@ -501,7 +529,7 @@ async function launchEngine(engine, ctx) {
   const profile = path.join(dir, "profile");
   fs.mkdirSync(profile, { recursive: true });
   const port = await freePort();
-  const child = spawn(bin, spawnArgs(engine, port, profile), {
+  const child = spawnEngine(bin, spawnArgs(engine, port, profile), {
     detached: true,
     stdio: ["ignore", "pipe", "pipe"],
     env: ctx.env,

package/scripts/check-globals.mjs

@@ -36,7 +36,7 @@ export function checkGlobals({ home, workspaceRoot } = {}) {
   if (!homeDir) {
     return { ok: false, error: `HOME required; ${APPLY_HINT}` };
   }
-  const homeConfig = path.join(homeDir, HOME_REL);
+  const homeConfig = path.resolve(homeDir, HOME_REL);
   const homeParsed = parseTomlFile(homeConfig, "home ~/.grok/config.toml");
   if (!homeParsed.ok) {
     if (homeParsed.missing) {
@@ -54,7 +54,10 @@ export function checkGlobals({ home, workspaceRoot } = {}) {
     };
   }
 
-  const projectConfig = path.join(ws, PROJECT_REL);
+  const projectConfig = path.resolve(ws, PROJECT_REL);
+  if (projectConfig === homeConfig) {
+    return { ok: true };
+  }
   const projectParsed = parseTomlFile(projectConfig, "project .grok/config.toml");
   if (!projectParsed.ok) {
     if (projectParsed.missing) {

package/scripts/doctor.mjs

@@ -42,20 +42,32 @@ export function nodeMajor(version) {
   return m ? Number(m[1]) : 0;
 }
 
+function winShim(bin) {
+  return process.platform === "win32" && /\.(cmd|bat)$/i.test(String(bin || ""));
+}
+
 export function whichBin(name, pathEnv = process.env.PATH, platform = process.platform) {
   if (!name) return "";
+  const hostWin = process.platform === "win32";
   const delim =
-    platform === "win32" && String(pathEnv || "").includes(";") ? ";" : path.delimiter;
+    (platform === "win32" || hostWin) && String(pathEnv || "").includes(";")
+      ? ";"
+      : path.delimiter;
   const dirs = String(pathEnv || "").split(delim);
-  const names = [name];
-  if (platform === "win32" && !path.extname(name)) {
-    const pathext = String(process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM");
-    for (const raw of pathext.split(";")) {
-      if (!raw) continue;
-      names.push(name + raw);
-      names.push(name + raw.toLowerCase());
+  const names = [];
+  if ((hostWin || platform === "win32") && !path.extname(name)) {
+    if (hostWin) {
+      const pathext = String(process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM");
+      for (const raw of pathext.split(";")) {
+        if (!raw) continue;
+        names.push(name + raw.toLowerCase());
+        names.push(name + raw);
+      }
     }
     names.push(`${name}.exe`);
+    names.push(name);
+  } else {
+    names.push(name);
   }
   const uniq = [...new Set(names)];
   for (const dir of dirs) {
@@ -66,7 +78,7 @@ export function whichBin(name, pathEnv = process.env.PATH, platform = process.pl
         fs.accessSync(candidate, fs.constants.X_OK);
         return candidate;
       } catch {
-        if (platform === "win32") {
+        if (hostWin) {
           try {
             fs.accessSync(candidate, fs.constants.F_OK);
             return candidate;
@@ -97,6 +109,7 @@ function readNodeVersion(bin) {
         encoding: "utf8",
         timeout: 8000,
         stdio: ["ignore", "pipe", "pipe"],
+        shell: winShim(bin),
       }),
     ).trim();
   } catch {

package/scripts/emit-gemini.mjs

@@ -3,7 +3,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { guardedMarkdownDrift, writeMergedGuardedFile } from "../cli/init.mjs";
+import { guardedMarkdownDrift, writeMergedGuardedFile } from "./guarded-md.mjs";
 
 export const AGENT_IDS = ["orchestrator", "grunt"];
 const SSOT_REL = ".rulesync/subagents";

package/scripts/emit-mcp-policy.mjs

@@ -175,9 +175,14 @@ function isMcpToolRule(s) {
   return s === "MCPTool" || s.startsWith("MCPTool(");
 }
 
-function desiredGrok(disk, policy) {
+export function isHomeGrokConfig(workspaceRoot, home) {
+  if (!workspaceRoot || !home) return false;
+  return path.resolve(workspaceRoot, GROK_REL) === path.resolve(home, GROK_REL);
+}
+
+function desiredGrok(disk, policy, { keepHomeTables = false } = {}) {
   const obj = isPlainObject(disk) ? { ...disk } : {};
-  delete obj.features;
+  if (!keepHomeTables) delete obj.features;
   delete obj.permissions;
 
   const plugins = isPlainObject(obj.plugins) ? { ...obj.plugins } : {};
@@ -288,9 +293,9 @@ function geminiCheckOk(disk, desired) {
   return deepEqual(disk.mcpServers, desired.mcpServers);
 }
 
-function grokCheckOk(disk, desired, policy) {
+function grokCheckOk(disk, desired, policy, { keepHomeTables = false } = {}) {
   if (!isPlainObject(disk)) return false;
-  if (Object.prototype.hasOwnProperty.call(disk, "features")) return false;
+  if (!keepHomeTables && Object.prototype.hasOwnProperty.call(disk, "features")) return false;
   if (Array.isArray(disk.permissions)) return false;
   if (isPlainObject(disk.plugins) && Object.prototype.hasOwnProperty.call(disk.plugins, "deny_default")) {
     return false;
@@ -336,13 +341,14 @@ function writeOrCheck({ check, abs, nextText, diskRaw }) {
   return true;
 }
 
-export function emitMcpPolicy({ workspaceRoot, check = false } = {}) {
+export function emitMcpPolicy({ workspaceRoot, check = false, home } = {}) {
   const ws = workspaceRoot || process.cwd();
   const policy = loadPolicy(ws);
   const valid = validatePolicy(policy);
   if (!valid.ok) {
     return { ok: false, check, error: valid.error };
   }
+  const keepHomeTables = isHomeGrokConfig(ws, home || process.env.HOME);
 
   const grokAbs = path.join(ws, GROK_REL);
   const claudeAbs = path.join(ws, CLAUDE_SETTINGS_REL);
@@ -365,7 +371,7 @@ export function emitMcpPolicy({ workspaceRoot, check = false } = {}) {
   const agentsDisk = agentsRaw == null ? null : parseJsonFile(agentsRaw, {});
   const geminiDisk = geminiRaw == null ? null : parseJsonFile(geminiRaw, {});
 
-  const grokDesired = desiredGrok(grokDisk, policy);
+  const grokDesired = desiredGrok(grokDisk, policy, { keepHomeTables });
   const claudeDesired = desiredClaudeSettings(claudeDisk, policy);
   const mcpDesired = desiredMcpJson(policy);
   const codexDesired = desiredCodex(codexDisk, policy);
@@ -374,7 +380,7 @@ export function emitMcpPolicy({ workspaceRoot, check = false } = {}) {
 
   if (check) {
     const drift = [];
-    if (grokRaw == null || !grokCheckOk(grokDisk, grokDesired, policy)) drift.push(GROK_REL);
+    if (grokRaw == null || !grokCheckOk(grokDisk, grokDesired, policy, { keepHomeTables })) drift.push(GROK_REL);
     if (claudeRaw == null || !claudeCheckOk(claudeDisk, claudeDesired)) drift.push(CLAUDE_SETTINGS_REL);
     if (mcpDisk == null || !deepEqual(mcpDisk, mcpDesired)) drift.push(MCP_JSON_REL);
     const codexOk =

package/scripts/guarded-md.mjs

@@ -0,0 +1,230 @@
+/** Sentinel merge for AGENTS.md CLAUDE.md GEMINI.md. Copied into consumers. */
+import fs from "node:fs";
+import path from "node:path";
+
+export const GUARDED_ROOT_FILES = ["AGENTS.md", "CLAUDE.md", "GEMINI.md"];
+export const SENTINEL_BEGIN = "<!-- grunt:begin -->";
+export const SENTINEL_END = "<!-- grunt:end -->";
+export const MAX_GUARDED_MARKDOWN_BYTES = 2 * 1024 * 1024;
+const GRUNT_REGION_RE =
+  /(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:begin -->[ \t]*\r?\n?[\s\S]*?(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:end -->[ \t]*\r?\n?/g;
+const GRUNT_INTERIOR_RE =
+  /(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:begin -->[ \t]*\r?\n?([\s\S]*?)(?:^|(?<=\n)|(?<=\r\n))[ \t]*<!-- grunt:end -->/g;
+const ORPHAN_END_RE = /(?:^|\r?\n)[ \t]*<!-- grunt:end -->[ \t]*(?=\r?\n|$)|<!-- grunt:end -->/g;
+const BEGIN_LINE_RE = /^[ \t]*<!-- grunt:begin -->[ \t]*$/;
+const END_LINE_RE = /^[ \t]*<!-- grunt:end -->[ \t]*$/;
+
+function detectNewline(text) {
+  return String(text).includes("\r\n") ? "\r\n" : "\n";
+}
+
+function toNewline(text, nl) {
+  return String(text).replace(/\r\n/g, "\n").replace(/\n/g, nl);
+}
+
+function trimTrailingNewlines(text) {
+  return String(text).replace(/(?:\r?\n)+$/, "");
+}
+
+function normEq(a, b) {
+  return (
+    trimTrailingNewlines(String(a).replace(/\r\n/g, "\n")) ===
+    trimTrailingNewlines(String(b).replace(/\r\n/g, "\n"))
+  );
+}
+
+function cloneRe(re) {
+  return new RegExp(re.source, re.flags);
+}
+
+function inspectGuardedBuffer(buf) {
+  if (buf.length > MAX_GUARDED_MARKDOWN_BYTES) return "huge";
+  if (buf.includes(0)) return "binary";
+  return null;
+}
+
+export function extractUserMarkdown(text) {
+  let user = String(text).replace(cloneRe(GRUNT_REGION_RE), "");
+  const i = user.indexOf(SENTINEL_BEGIN);
+  if (i >= 0) user = user.slice(0, i);
+  user = user.replace(cloneRe(ORPHAN_END_RE), "");
+  return userRemainderIsBlank(user) ? "" : user;
+}
+
+function unwrapStackedMarkers(text) {
+  const lines = String(text).split(/\r?\n/);
+  let start = 0;
+  let end = lines.length;
+  while (start < end && BEGIN_LINE_RE.test(lines[start])) start++;
+  while (end > start && lines[end - 1] === "") end--;
+  while (end > start && END_LINE_RE.test(lines[end - 1])) {
+    end--;
+    while (end > start && lines[end - 1] === "") end--;
+  }
+  return lines.slice(start, end).join("\n");
+}
+
+export function extractGruntBody(text) {
+  const src = String(text);
+  const parts = [];
+  const re = cloneRe(GRUNT_INTERIOR_RE);
+  let m;
+  while ((m = re.exec(src))) {
+    parts.push(trimTrailingNewlines(unwrapStackedMarkers(m[1])));
+  }
+  if (parts.length) return parts.join("\n");
+  const i = src.indexOf(SENTINEL_BEGIN);
+  if (i >= 0) {
+    return trimTrailingNewlines(
+      unwrapStackedMarkers(src.slice(i + SENTINEL_BEGIN.length).replace(/^[ \t]*\r?\n/, "")),
+    );
+  }
+  if (!src.includes(SENTINEL_END)) return null;
+  return trimTrailingNewlines(unwrapStackedMarkers(src));
+}
+
+function userRemainderIsBlank(user) {
+  return String(user).replace(/\r\n/g, "\n").replace(/\n/g, "") === "";
+}
+
+export function composeGuardedMarkdown(gruntBody, userRemainder, nl = "\n") {
+  const raw = extractGruntBody(gruntBody) ?? gruntBody;
+  const body = toNewline(trimTrailingNewlines(raw), nl);
+  const block = `${SENTINEL_BEGIN}${nl}${body}${nl}${SENTINEL_END}${nl}`;
+  const user = extractUserMarkdown(userRemainder == null ? "" : String(userRemainder));
+  if (!user || userRemainderIsBlank(user)) return block;
+  return block + toNewline(user, nl);
+}
+
+export function mergeGuardedContent(existingText, gruntBody) {
+  const existing = existingText == null ? "" : String(existingText);
+  const nl =
+    existing.includes("\r\n") || String(gruntBody).includes("\r\n")
+      ? detectNewline(existing || gruntBody)
+      : "\n";
+  if (!existing) return composeGuardedMarkdown(gruntBody, "", nl);
+  const hadSentinel = existing.includes(SENTINEL_BEGIN) && existing.includes(SENTINEL_END);
+  const user = extractUserMarkdown(existing);
+  if (!hadSentinel && normEq(existing, gruntBody)) {
+    return composeGuardedMarkdown(gruntBody, "", nl);
+  }
+  return composeGuardedMarkdown(gruntBody, user, nl);
+}
+
+export function writeMergedGuardedFile(destPath, gruntBody) {
+  if (!fs.existsSync(destPath)) {
+    fs.writeFileSync(destPath, mergeGuardedContent("", gruntBody));
+    return;
+  }
+  const buf = fs.readFileSync(destPath);
+  if (inspectGuardedBuffer(buf)) return "aborted-unsafe";
+  fs.writeFileSync(destPath, mergeGuardedContent(buf.toString("utf8"), gruntBody));
+}
+
+export function guardedMarkdownDrift(destPath, gruntBody) {
+  if (!fs.existsSync(destPath)) return true;
+  const buf = fs.readFileSync(destPath);
+  if (inspectGuardedBuffer(buf)) return true;
+  const text = buf.toString("utf8");
+  const interior = extractGruntBody(text);
+  if (interior == null) return !normEq(text, gruntBody);
+  return !normEq(interior, gruntBody);
+}
+
+export function snapshotGuardedRoots(root) {
+  const snap = {};
+  for (const file of GUARDED_ROOT_FILES) {
+    const p = path.join(root, file);
+    if (!fs.existsSync(p)) continue;
+    const buf = fs.readFileSync(p);
+    const unsafe = inspectGuardedBuffer(buf);
+    if (unsafe) {
+      snap[file] = { unsafe, rawBuf: buf };
+      continue;
+    }
+    const raw = buf.toString("utf8");
+    snap[file] = { raw, user: extractUserMarkdown(raw) };
+  }
+  return snap;
+}
+
+export function remergeGuardedRoots(root, snap) {
+  for (const file of GUARDED_ROOT_FILES) {
+    const p = path.join(root, file);
+    const rec = snap[file];
+    if (rec?.unsafe) {
+      fs.writeFileSync(p, rec.rawBuf);
+      continue;
+    }
+    if (!fs.existsSync(p)) {
+      if (rec?.raw != null) fs.writeFileSync(p, rec.raw);
+      continue;
+    }
+    const buf = fs.readFileSync(p);
+    if (inspectGuardedBuffer(buf)) {
+      if (rec?.raw != null) fs.writeFileSync(p, rec.raw);
+      continue;
+    }
+    const current = buf.toString("utf8");
+    if (rec && current === rec.raw) continue;
+    const gruntBody = extractGruntBody(current) ?? current;
+    const nl = detectNewline((rec && rec.raw) || current);
+    let user = rec ? rec.user : extractUserMarkdown(current);
+    if (rec && !rec.raw.includes(SENTINEL_BEGIN) && normEq(rec.raw, gruntBody)) user = "";
+    if (!rec && extractGruntBody(current) == null && normEq(current, gruntBody)) user = "";
+    fs.writeFileSync(p, composeGuardedMarkdown(gruntBody, user, nl));
+  }
+}
+
+export function healGuardedRootFile(root, file, snap) {
+  if (!GUARDED_ROOT_FILES.includes(file)) return;
+  const p = path.join(root, file);
+  const rec = snap[file];
+  if (!fs.existsSync(p)) return;
+  if (rec?.unsafe) {
+    fs.writeFileSync(p, rec.rawBuf);
+    return;
+  }
+  const buf = fs.readFileSync(p);
+  if (inspectGuardedBuffer(buf)) {
+    if (rec?.raw != null) fs.writeFileSync(p, rec.raw);
+    return;
+  }
+  const current = buf.toString("utf8");
+  const interior = extractGruntBody(current);
+  if (interior != null) {
+    snap[file] = { raw: current, user: extractUserMarkdown(current) };
+    return;
+  }
+  if (rec && current === rec.raw) return;
+  const gruntBody = current;
+  const nl = detectNewline((rec && rec.raw) || current);
+  let user = rec ? rec.user : extractUserMarkdown(current);
+  if (rec && !rec.raw.includes(SENTINEL_BEGIN) && normEq(rec.raw, gruntBody)) user = "";
+  if (!rec && normEq(current, gruntBody)) user = "";
+  const out = composeGuardedMarkdown(gruntBody, user, nl);
+  fs.writeFileSync(p, out);
+  snap[file] = { raw: out, user };
+}
+
+export function withGuardedCheckInteriors(root, fn) {
+  const snap = snapshotGuardedRoots(root);
+  try {
+    for (const file of GUARDED_ROOT_FILES) {
+      const rec = snap[file];
+      if (!rec || rec.unsafe) continue;
+      const body = extractGruntBody(rec.raw);
+      if (body == null) continue;
+      const nl = detectNewline(rec.raw);
+      fs.writeFileSync(path.join(root, file), `${toNewline(trimTrailingNewlines(body), nl)}${nl}`);
+    }
+    return fn();
+  } finally {
+    for (const file of GUARDED_ROOT_FILES) {
+      const rec = snap[file];
+      if (!rec) continue;
+      if (rec.unsafe) fs.writeFileSync(path.join(root, file), rec.rawBuf);
+      else fs.writeFileSync(path.join(root, file), rec.raw);
+    }
+  }
+}

package/scripts/guarded-roots.mjs

@@ -10,7 +10,7 @@ import {
   remergeGuardedRoots,
   snapshotGuardedRoots,
   withGuardedCheckInteriors,
-} from "../cli/init.mjs";
+} from "./guarded-md.mjs";
 import { runPipeline } from "./pipeline.mjs";
 
 export function attachGuardedRootWatchers(cwd, heal) {

package/scripts/interactive.mjs

@@ -0,0 +1,15 @@
+/** TTY / CI / --yes probe. Copied into consumers; no clack. */
+export function isInteractive({
+  argv = process.argv.slice(2),
+  env = process.env,
+  stdin = process.stdin,
+  stdout = process.stdout,
+} = {}) {
+  if (!stdin?.isTTY || !stdout?.isTTY) return false;
+  const ci = env.CI;
+  if (ci != null && ci !== "" && ci !== "0" && ci !== "false") return false;
+  for (const a of argv) {
+    if (a === "--yes" || a === "-y" || a === "--non-interactive") return false;
+  }
+  return true;
+}

package/scripts/prompt.mjs

@@ -0,0 +1,32 @@
+/** TTY prompts. Copied into consumers. */
+import * as clack from "@clack/prompts";
+
+export { isInteractive } from "./interactive.mjs";
+
+export function bailIfCancel(value) {
+  if (clack.isCancel(value)) {
+    clack.cancel("Aborted");
+    process.exit(0);
+  }
+  return value;
+}
+
+export async function select(opts) {
+  return bailIfCancel(await clack.select(opts));
+}
+
+export async function confirm(opts) {
+  return bailIfCancel(await clack.confirm(opts));
+}
+
+export async function text(opts) {
+  return bailIfCancel(await clack.text(opts));
+}
+
+export async function password(opts) {
+  return bailIfCancel(await clack.password(opts));
+}
+
+export function spinner() {
+  return clack.spinner();
+}

package/scripts/setup.mjs

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { isInteractive as ttyInteractive } from "../cli/prompt.mjs";
+import { isInteractive as ttyInteractive } from "./interactive.mjs";
 import {
   CHROMIUM_BINS,
   installHints,
@@ -343,7 +343,7 @@ function errLine(io, s) {
 }
 
 async function defaultIo() {
-  const { confirm, password, select, text } = await import("../cli/prompt.mjs");
+  const { confirm, password, select, text } = await import("./prompt.mjs");
   return {
     confirm,
     password,