@massu/core 1.15.1 → 1.15.2

package/dist/cli.js

@@ -58,17 +58,136 @@ var init_memory_path = __esm({
   }
 });
 
-// src/config.ts
-import { resolve, dirname } from "path";
-import { existsSync, readFileSync } from "fs";
+// src/credentials.ts
 import { homedir } from "os";
+import { resolve } from "path";
+import {
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  rmSync,
+  chmodSync
+} from "fs";
+function credentialsDir(home = homedir()) {
+  return resolve(home, ".massu");
+}
+function credentialsPath(home = homedir()) {
+  return resolve(credentialsDir(home), "credentials");
+}
+function readUserCredentials(home = homedir()) {
+  try {
+    const p19 = credentialsPath(home);
+    if (!existsSync(p19)) return void 0;
+    const parsed = JSON.parse(readFileSync(p19, "utf-8"));
+    const key = typeof parsed?.apiKey === "string" ? parsed.apiKey.trim() : "";
+    return key.length > 0 ? key : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeUserCredentials(apiKey, home = homedir()) {
+  const dir = credentialsDir(home);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  const p19 = credentialsPath(home);
+  writeFileSync(p19, JSON.stringify({ apiKey: apiKey.trim() }, null, 2) + "\n", {
+    mode: 384
+  });
+  try {
+    chmodSync(p19, 384);
+  } catch {
+  }
+  return p19;
+}
+function removeUserCredentials(home = homedir()) {
+  const p19 = credentialsPath(home);
+  if (!existsSync(p19)) return false;
+  try {
+    rmSync(p19);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isUnresolvedLiteral(v3) {
+  return /^\$\{[^}]+\}$/.test(v3);
+}
+function resolveApiKey(opts = {}) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homedir();
+  const cfg = typeof opts.configApiKey === "string" ? opts.configApiKey.trim() : "";
+  if (cfg.length > 0 && !isUnresolvedLiteral(cfg)) {
+    return { apiKey: cfg, source: "config" };
+  }
+  const envRaw = env[MASSU_ENV_API_KEY];
+  const envKey = typeof envRaw === "string" ? envRaw.trim() : "";
+  if (envKey.length > 0) {
+    return { apiKey: envKey, source: "env" };
+  }
+  const fileKey = readUserCredentials(home);
+  if (fileKey) {
+    return { apiKey: fileKey, source: "user-file" };
+  }
+  return { source: "none" };
+}
+function resolveEndpoint(opts = {}) {
+  const env = opts.env ?? process.env;
+  const cfg = typeof opts.configEndpoint === "string" ? opts.configEndpoint.trim() : "";
+  if (cfg.length > 0) return cfg;
+  const envRaw = env[MASSU_ENV_CLOUD_ENDPOINT];
+  const envEp = typeof envRaw === "string" ? envRaw.trim() : "";
+  if (envEp.length > 0) return envEp;
+  return DEFAULT_CLOUD_ENDPOINT;
+}
+function apiKeySourceLabel(source) {
+  switch (source) {
+    case "config":
+      return "explicit cloud.apiKey";
+    case "env":
+      return "MASSU_API_KEY env";
+    case "user-file":
+      return "~/.massu/credentials";
+    case "none":
+    default:
+      return "no source";
+  }
+}
+var MASSU_ENV_API_KEY, MASSU_ENV_CLOUD_ENDPOINT, DEFAULT_CLOUD_ENDPOINT, API_KEY_PREFIX;
+var init_credentials = __esm({
+  "src/credentials.ts"() {
+    "use strict";
+    MASSU_ENV_API_KEY = "MASSU_API_KEY";
+    MASSU_ENV_CLOUD_ENDPOINT = "MASSU_CLOUD_ENDPOINT";
+    DEFAULT_CLOUD_ENDPOINT = "https://api.massu.ai/v1";
+    API_KEY_PREFIX = "ms_live_";
+  }
+});
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  AdapterLocalPathSchema: () => AdapterLocalPathSchema,
+  LSPConfigSchema: () => LSPConfigSchema,
+  getConfig: () => getConfig,
+  getProjectRoot: () => getProjectRoot,
+  getResolvedApiKeySource: () => getResolvedApiKeySource,
+  getResolvedPaths: () => getResolvedPaths,
+  resetConfig: () => resetConfig
+});
+import { resolve as resolve2, dirname } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
 function findProjectRoot() {
   const cwd = process.cwd();
   let dir = cwd;
   while (true) {
-    if (existsSync(resolve(dir, "massu.config.yaml"))) {
+    if (existsSync2(resolve2(dir, "massu.config.yaml"))) {
       return dir;
     }
     const parent = dirname(dir);
@@ -77,10 +196,10 @@ function findProjectRoot() {
   }
   dir = cwd;
   while (true) {
-    if (existsSync(resolve(dir, "package.json"))) {
+    if (existsSync2(resolve2(dir, "package.json"))) {
       return dir;
     }
-    if (existsSync(resolve(dir, ".git"))) {
+    if (existsSync2(resolve2(dir, ".git"))) {
       return dir;
     }
     const parent = dirname(dir);
@@ -98,10 +217,10 @@ function getProjectRoot() {
 function getConfig() {
   if (_config) return _config;
   const root = getProjectRoot();
-  const configPath = resolve(root, "massu.config.yaml");
+  const configPath = resolve2(root, "massu.config.yaml");
   let rawYaml = {};
-  if (existsSync(configPath)) {
-    const content = readFileSync(configPath, "utf-8");
+  if (existsSync2(configPath)) {
+    const content = readFileSync2(configPath, "utf-8");
     rawYaml = parseYaml(content) ?? {};
   }
   const result = RawConfigSchema.safeParse(rawYaml);
@@ -118,7 +237,7 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     );
   }
   const parsed = result.data;
-  const projectRoot = parsed.project.root === "auto" || !parsed.project.root ? root : resolve(root, parsed.project.root);
+  const projectRoot = parsed.project.root === "auto" || !parsed.project.root ? root : resolve2(root, parsed.project.root);
   const fw = parsed.framework;
   let router = fw.router;
   let orm = fw.orm;
@@ -176,60 +295,72 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     telemetry: parsed.telemetry,
     lsp: parsed.lsp
   };
-  if (!_config.cloud?.apiKey && process.env.MASSU_API_KEY) {
+  const resolvedKey = resolveApiKey({ configApiKey: _config.cloud?.apiKey });
+  _resolvedApiKeySource = resolvedKey.source;
+  const resolvedEndpoint = resolveEndpoint({ configEndpoint: _config.cloud?.endpoint });
+  if (resolvedKey.apiKey) {
     _config.cloud = {
       enabled: true,
       sync: { memory: true, analytics: true, audit: true },
       ..._config.cloud,
-      apiKey: process.env.MASSU_API_KEY
+      apiKey: resolvedKey.apiKey,
+      endpoint: resolvedEndpoint
     };
+  } else if (_config.cloud) {
+    _config.cloud = { ..._config.cloud, endpoint: _config.cloud.endpoint ?? resolvedEndpoint };
   }
   return _config;
 }
+function getResolvedApiKeySource() {
+  getConfig();
+  return _resolvedApiKeySource;
+}
 function getResolvedPaths() {
   const config = getConfig();
   const root = getProjectRoot();
   const claudeDirName = config.conventions?.claudeDirName ?? ".claude";
   return {
-    codegraphDbPath: resolve(root, ".codegraph/codegraph.db"),
-    dataDbPath: resolve(root, ".massu/data.db"),
-    prismaSchemaPath: resolve(root, config.paths.schema ?? "prisma/schema.prisma"),
-    rootRouterPath: resolve(root, config.paths.routerRoot ?? "src/server/api/root.ts"),
-    routersDir: resolve(root, config.paths.routers ?? "src/server/api/routers"),
-    srcDir: resolve(root, config.paths.source),
+    codegraphDbPath: resolve2(root, ".codegraph/codegraph.db"),
+    dataDbPath: resolve2(root, ".massu/data.db"),
+    prismaSchemaPath: resolve2(root, config.paths.schema ?? "prisma/schema.prisma"),
+    rootRouterPath: resolve2(root, config.paths.routerRoot ?? "src/server/api/root.ts"),
+    routersDir: resolve2(root, config.paths.routers ?? "src/server/api/routers"),
+    srcDir: resolve2(root, config.paths.source),
     pathAlias: Object.fromEntries(
       Object.entries(config.paths.aliases).map(([alias, target]) => [
         alias,
-        resolve(root, target)
+        resolve2(root, target)
       ])
     ),
     extensions: [".ts", ".tsx", ".js", ".jsx"],
     indexFiles: ["index.ts", "index.tsx", "index.js", "index.jsx"],
-    patternsDir: resolve(root, claudeDirName, "patterns"),
-    claudeMdPath: resolve(root, claudeDirName, "CLAUDE.md"),
-    docsMapPath: resolve(root, ".massu/docs-map.json"),
-    helpSitePath: resolve(root, "../" + config.project.name + "-help"),
-    memoryDbPath: resolve(root, ".massu/memory.db"),
-    knowledgeDbPath: resolve(root, ".massu/knowledge.db"),
-    plansDir: resolve(root, "docs/plans"),
-    docsDir: resolve(root, "docs"),
-    claudeDir: resolve(root, claudeDirName),
-    memoryDir: resolve(homedir(), claudeDirName, "projects", encodeMemoryDirName(root), "memory"),
-    sessionStatePath: resolve(root, config.conventions?.sessionStatePath ?? `${claudeDirName}/session-state/CURRENT.md`),
-    sessionArchivePath: resolve(root, config.conventions?.sessionArchivePath ?? `${claudeDirName}/session-state/archive`),
-    mcpJsonPath: resolve(root, ".mcp.json"),
-    settingsLocalPath: resolve(root, claudeDirName, "settings.local.json")
+    patternsDir: resolve2(root, claudeDirName, "patterns"),
+    claudeMdPath: resolve2(root, claudeDirName, "CLAUDE.md"),
+    docsMapPath: resolve2(root, ".massu/docs-map.json"),
+    helpSitePath: resolve2(root, "../" + config.project.name + "-help"),
+    memoryDbPath: resolve2(root, ".massu/memory.db"),
+    knowledgeDbPath: resolve2(root, ".massu/knowledge.db"),
+    plansDir: resolve2(root, "docs/plans"),
+    docsDir: resolve2(root, "docs"),
+    claudeDir: resolve2(root, claudeDirName),
+    memoryDir: resolve2(homedir2(), claudeDirName, "projects", encodeMemoryDirName(root), "memory"),
+    sessionStatePath: resolve2(root, config.conventions?.sessionStatePath ?? `${claudeDirName}/session-state/CURRENT.md`),
+    sessionArchivePath: resolve2(root, config.conventions?.sessionArchivePath ?? `${claudeDirName}/session-state/archive`),
+    mcpJsonPath: resolve2(root, ".mcp.json"),
+    settingsLocalPath: resolve2(root, claudeDirName, "settings.local.json")
   };
 }
 function resetConfig() {
   _config = null;
   _projectRoot = null;
+  _resolvedApiKeySource = "none";
 }
-var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _projectRoot;
+var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_memory_path();
+    init_credentials();
     DomainConfigSchema = z.object({
       name: z.string().default("Unknown"),
       routers: z.array(z.string()).default([]),
@@ -611,6 +742,7 @@ var init_config = __esm({
       lsp: LSPConfigSchema.optional()
     }).passthrough();
     _config = null;
+    _resolvedApiKeySource = "none";
     _projectRoot = null;
   }
 });
@@ -673,7 +805,7 @@ __export(memory_db_exports, {
 });
 import Database from "better-sqlite3";
 import { dirname as dirname2, basename } from "path";
-import { existsSync as existsSync2, mkdirSync } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 function sanitizeFts5Query(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return '""';
@@ -683,8 +815,8 @@ function sanitizeFts5Query(raw) {
 function getMemoryDb() {
   const dbPath = getResolvedPaths().memoryDbPath;
   const dir = dirname2(dbPath);
-  if (!existsSync2(dir)) {
-    mkdirSync(dir, { recursive: true });
+  if (!existsSync3(dir)) {
+    mkdirSync2(dir, { recursive: true });
   }
   const db = new Database(dbPath);
   db.pragma("journal_mode = WAL");
@@ -2017,12 +2149,12 @@ var init_memory_db = __esm({
 });
 
 // src/memory-file-ingest.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3, readdirSync } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync4, readdirSync } from "fs";
 import { join } from "path";
 import { parse as parseYaml2 } from "yaml";
 function ingestMemoryFile(db, sessionId, filePath) {
-  if (!existsSync3(filePath)) return "skipped";
-  const content = readFileSync2(filePath, "utf-8");
+  if (!existsSync4(filePath)) return "skipped";
+  const content = readFileSync3(filePath, "utf-8");
   const basename11 = (filePath.split("/").pop() ?? "").replace(".md", "");
   const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
   let name = basename11;
@@ -2060,7 +2192,7 @@ ${body}` : body;
 }
 function backfillMemoryFiles(db, memoryDir, sessionId) {
   const stats = { inserted: 0, updated: 0, skipped: 0, total: 0 };
-  if (!existsSync3(memoryDir)) return stats;
+  if (!existsSync4(memoryDir)) return stats;
   const files = readdirSync(memoryDir).filter(
     (f2) => f2.endsWith(".md") && f2 !== "MEMORY.md"
   );
@@ -2273,16 +2405,16 @@ var init_template_engine = __esm({
 // src/lib/settings-local.ts
 import {
   closeSync,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   fsyncSync,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   openSync,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   renameSync,
-  rmSync,
+  rmSync as rmSync2,
   writeSync
 } from "fs";
-import { dirname as dirname3, resolve as resolve3 } from "path";
+import { dirname as dirname3, resolve as resolve4 } from "path";
 function atomicWriteFile(targetPath, content, mode = 420) {
   const tmpPath = `${targetPath}.${process.pid}.tmp`;
   try {
@@ -2296,9 +2428,9 @@ function atomicWriteFile(targetPath, content, mode = 420) {
     }
     renameSync(tmpPath, targetPath);
   } catch (err) {
-    if (existsSync4(tmpPath)) {
+    if (existsSync5(tmpPath)) {
       try {
-        rmSync(tmpPath, { force: true });
+        rmSync2(tmpPath, { force: true });
       } catch {
       }
     }
@@ -2306,11 +2438,11 @@ function atomicWriteFile(targetPath, content, mode = 420) {
   }
 }
 function readSettingsAtPath(absolutePath) {
-  if (!existsSync4(absolutePath)) {
+  if (!existsSync5(absolutePath)) {
     return {};
   }
   try {
-    const raw = readFileSync3(absolutePath, "utf-8");
+    const raw = readFileSync4(absolutePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return {};
@@ -2321,13 +2453,13 @@ function readSettingsAtPath(absolutePath) {
   }
 }
 function readSettingsLocal(claudeDir) {
-  return readSettingsAtPath(resolve3(claudeDir, "settings.local.json"));
+  return readSettingsAtPath(resolve4(claudeDir, "settings.local.json"));
 }
 function writeSettingsLocalAtomic(claudeDir, settings) {
-  const targetPath = resolve3(claudeDir, "settings.local.json");
+  const targetPath = resolve4(claudeDir, "settings.local.json");
   const dir = dirname3(targetPath);
-  if (!existsSync4(dir)) {
-    mkdirSync2(dir, { recursive: true });
+  if (!existsSync5(dir)) {
+    mkdirSync3(dir, { recursive: true });
   }
   const content = JSON.stringify(settings, null, 2) + "\n";
   atomicWriteFile(targetPath, content);
@@ -2340,7 +2472,7 @@ var init_settings_local = __esm({
 
 // src/permissions.ts
 import { createHash } from "crypto";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 import { join as join2 } from "path";
 function canonicalJson(value) {
   if (value === null || typeof value !== "object") {
@@ -2380,7 +2512,7 @@ function detectInvalidDefaultMode(settings) {
   return { invalid: false };
 }
 function readGlobalSettings() {
-  return readSettingsAtPath(join2(homedir2(), ".claude", "settings.json"));
+  return readSettingsAtPath(join2(homedir3(), ".claude", "settings.json"));
 }
 function mergedPermissionState(global2, local, canonical) {
   const globalPerm = global2.permissions ?? {};
@@ -2564,27 +2696,27 @@ __export(install_commands_exports, {
   syncDirectory: () => syncDirectory
 });
 import {
-  existsSync as existsSync5,
-  readFileSync as readFileSync4,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync6,
+  readFileSync as readFileSync5,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
   statSync
 } from "fs";
-import { resolve as resolve4, dirname as dirname4, join as join3 } from "path";
+import { resolve as resolve5, dirname as dirname4, join as join3 } from "path";
 import { fileURLToPath } from "url";
 import { createHash as createHash2 } from "crypto";
 function resolveAssetDir(assetName) {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve4(cwd, "node_modules/@massu/core", assetName);
-  if (existsSync5(nodeModulesPath)) {
+  const nodeModulesPath = resolve5(cwd, "node_modules/@massu/core", assetName);
+  if (existsSync6(nodeModulesPath)) {
     return nodeModulesPath;
   }
-  const distRelPath = resolve4(__dirname, "..", assetName);
-  if (existsSync5(distRelPath)) {
+  const distRelPath = resolve5(__dirname, "..", assetName);
+  if (existsSync6(distRelPath)) {
     return distRelPath;
   }
-  const srcRelPath = resolve4(__dirname, "../..", assetName);
-  if (existsSync5(srcRelPath)) {
+  const srcRelPath = resolve5(__dirname, "../..", assetName);
+  if (existsSync6(srcRelPath)) {
     return srcRelPath;
   }
   return null;
@@ -2596,12 +2728,12 @@ function hashContent(content) {
   return createHash2("sha256").update(content, "utf-8").digest("hex");
 }
 function loadManifest(claudeDir) {
-  const path = resolve4(claudeDir, MANIFEST_RELPATH);
-  if (!existsSync5(path)) {
+  const path = resolve5(claudeDir, MANIFEST_RELPATH);
+  if (!existsSync6(path)) {
     return emptyManifest();
   }
   try {
-    const raw = readFileSync4(path, "utf-8");
+    const raw = readFileSync5(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.entries) {
       return emptyManifest();
@@ -2612,11 +2744,11 @@ function loadManifest(claudeDir) {
   }
 }
 function saveManifest(claudeDir, manifest) {
-  const dir = resolve4(claudeDir, ".massu");
-  if (!existsSync5(dir)) {
-    mkdirSync3(dir, { recursive: true });
+  const dir = resolve5(claudeDir, ".massu");
+  if (!existsSync6(dir)) {
+    mkdirSync4(dir, { recursive: true });
   }
-  const finalPath = resolve4(dir, "install-manifest.json");
+  const finalPath = resolve5(dir, "install-manifest.json");
   manifest.generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   atomicWriteFile(finalPath, JSON.stringify(manifest, null, 2));
 }
@@ -2678,18 +2810,18 @@ function pickVariant(baseName, sourceDir, framework) {
   }
   for (const cand of candidates) {
     if (cand.subFramework) {
-      const subPath = resolve4(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
-      if (existsSync5(subPath)) {
+      const subPath = resolve5(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
+      if (existsSync6(subPath)) {
         return { kind: "hit", suffix: `.${cand.lang}-${cand.subFramework}` };
       }
     }
-    const langPath = resolve4(sourceDir, `${baseName}.${cand.lang}.md`);
-    if (existsSync5(langPath)) {
+    const langPath = resolve5(sourceDir, `${baseName}.${cand.lang}.md`);
+    if (existsSync6(langPath)) {
       return { kind: "hit", suffix: `.${cand.lang}` };
     }
   }
-  const defaultPath = resolve4(sourceDir, `${baseName}.md`);
-  if (existsSync5(defaultPath)) {
+  const defaultPath = resolve5(sourceDir, `${baseName}.md`);
+  if (existsSync6(defaultPath)) {
     return { kind: "hit", suffix: "" };
   }
   if (framework.type === "multi" && !framework.primary) {
@@ -2705,15 +2837,15 @@ function isVariantFilename(entry) {
 }
 function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPrefix, topLevel = true, templateVars = {}) {
   const stats = { installed: 0, updated: 0, skipped: 0, kept: 0 };
-  if (!existsSync5(targetDir)) {
-    mkdirSync3(targetDir, { recursive: true });
+  if (!existsSync6(targetDir)) {
+    mkdirSync4(targetDir, { recursive: true });
   }
   const entries = readdirSync2(sourceDir);
   for (const entry of entries) {
-    const sourcePath = resolve4(sourceDir, entry);
+    const sourcePath = resolve5(sourceDir, entry);
     const entryStat = statSync(sourcePath);
     if (entryStat.isDirectory()) {
-      const subTargetDir = resolve4(targetDir, entry);
+      const subTargetDir = resolve5(targetDir, entry);
       const subPrefix = manifestKeyPrefix === "" ? entry : `${manifestKeyPrefix}/${entry}`;
       const subStats = syncDirectory(
         sourcePath,
@@ -2742,13 +2874,13 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
       const suffix = choice.kind === "hit" ? choice.suffix : "";
       sourceFilename = suffix === "" ? `${baseName}.md` : `${baseName}${suffix}.md`;
     }
-    const resolvedSourcePath = resolve4(sourceDir, sourceFilename);
-    if (!existsSync5(resolvedSourcePath)) {
+    const resolvedSourcePath = resolve5(sourceDir, sourceFilename);
+    if (!existsSync6(resolvedSourcePath)) {
       continue;
     }
     const targetFilename = topLevel ? `${baseName}.md` : entry;
-    const targetPath = resolve4(targetDir, targetFilename);
-    const rawContent = readFileSync4(resolvedSourcePath, "utf-8");
+    const targetPath = resolve5(targetDir, targetFilename);
+    const rawContent = readFileSync5(resolvedSourcePath, "utf-8");
     let sourceContent;
     try {
       sourceContent = renderTemplate(rawContent, templateVars);
@@ -2766,8 +2898,8 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
     const sourceHash = hashContent(sourceContent);
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
-    if (existsSync5(targetPath)) {
-      const existingContent = readFileSync4(targetPath, "utf-8");
+    if (existsSync6(targetPath)) {
+      const existingContent = readFileSync5(targetPath, "utf-8");
       const existingHash = hashContent(existingContent);
       if (existingHash === sourceHash) {
         manifest.entries[manifestKey] = sourceHash;
@@ -2826,10 +2958,10 @@ function buildTemplateVars() {
 }
 function installCommands(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve4(projectRoot, claudeDirName);
-  const targetDir = resolve4(claudeDir, "commands");
-  if (!existsSync5(targetDir)) {
-    mkdirSync3(targetDir, { recursive: true });
+  const claudeDir = resolve5(projectRoot, claudeDirName);
+  const targetDir = resolve5(claudeDir, "commands");
+  if (!existsSync6(targetDir)) {
+    mkdirSync4(targetDir, { recursive: true });
   }
   const sourceDir = resolveAssetDir("commands");
   if (!sourceDir) {
@@ -2858,7 +2990,7 @@ function installCommands(projectRoot, opts = {}) {
 }
 function installAll(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve4(projectRoot, claudeDirName);
+  const claudeDir = resolve5(projectRoot, claudeDirName);
   const assets = {};
   let totalInstalled = 0;
   let totalUpdated = 0;
@@ -2871,7 +3003,7 @@ function installAll(projectRoot, opts = {}) {
     for (const assetType of ASSET_TYPES) {
       const sourceDir = resolveAssetDir(assetType.name);
       if (!sourceDir) continue;
-      const targetDir = resolve4(claudeDir, assetType.targetSubdir);
+      const targetDir = resolve5(claudeDir, assetType.targetSubdir);
       const stats = syncDirectory(
         sourceDir,
         targetDir,
@@ -3175,17 +3307,17 @@ var init_manifest_registry = __esm({
 });
 
 // src/detect/package-detector.ts
-import { readFileSync as readFileSync5, existsSync as existsSync6, statSync as statSync2, lstatSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync2, lstatSync, readdirSync as readdirSync3 } from "fs";
 import { join as join4, relative as relative2 } from "path";
 import { parse as parseToml } from "smol-toml";
 function safeRead(path) {
   try {
-    if (!existsSync6(path)) return null;
+    if (!existsSync7(path)) return null;
     const ls = lstatSync(path);
     if (ls.isSymbolicLink()) return null;
     const st = statSync2(path);
     if (!st.isFile()) return null;
-    return readFileSync5(path, "utf-8");
+    return readFileSync6(path, "utf-8");
   } catch {
     return null;
   }
@@ -3216,7 +3348,7 @@ function parsePackageJson(path, directory, root, warnings) {
   const peer = Object.keys(
     pkg.peerDependencies ?? {}
   );
-  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync6(join4(directory, "tsconfig.json"));
+  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync7(join4(directory, "tsconfig.json"));
   const language = hasTs ? "typescript" : "javascript";
   const scripts = Object.keys(
     pkg.scripts ?? {}
@@ -3643,7 +3775,7 @@ function detectManifestsInDir(dir, root, warnings) {
   for (const entry of getManifestRegistry2()) {
     if (!entry.pattern.startsWith("*")) {
       const path = join4(dir, entry.pattern);
-      if (!existsSync6(path)) continue;
+      if (!existsSync7(path)) continue;
       const m3 = entry.parse(path, dir, root, warnings);
       if (m3 !== null) out.push(m3);
     } else {
@@ -3657,7 +3789,7 @@ function detectManifestsInDir(dir, root, warnings) {
       for (const fname of dirEntries) {
         if (!matchManifestPattern2(fname, entry.pattern)) continue;
         const path = join4(dir, fname);
-        if (!existsSync6(path)) continue;
+        if (!existsSync7(path)) continue;
         const m3 = entry.parse(path, dir, root, warnings);
         if (m3 !== null) out.push(m3);
       }
@@ -3678,7 +3810,7 @@ function detectPackageManifests(projectRoot) {
   manifests.push(...detectManifestsInDir(projectRoot, projectRoot, warnings));
   for (const ws of WORKSPACE_DIRS) {
     const wsRoot = join4(projectRoot, ws);
-    if (!existsSync6(wsRoot)) continue;
+    if (!existsSync7(wsRoot)) continue;
     for (const sub of listSubdirs(wsRoot)) {
       manifests.push(...detectManifestsInDir(sub, projectRoot, warnings));
       for (const sub2 of listSubdirs(sub)) {
@@ -8449,41 +8581,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p19 = new Promise(function(resolve41, reject) {
+        var p19 = new Promise(function(resolve42, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve41(result);
+            resolve42(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function unshift(value) {
-        var p19 = new Promise(function(resolve41, reject) {
+        var p19 = new Promise(function(resolve42, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve41(result);
+            resolve42(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function drained() {
-        var p19 = new Promise(function(resolve41) {
+        var p19 = new Promise(function(resolve42) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve41();
+              resolve42();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve41();
+                resolve42();
                 queue.drain = previousDrain;
               };
             }
@@ -8969,9 +9101,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve41, reject) => {
+        return new Promise((resolve42, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve41(stats) : reject(error);
+            return error === null ? resolve42(stats) : reject(error);
           });
         });
       }
@@ -8995,10 +9127,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve41, reject) => {
+        return new Promise((resolve42, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve41(entries);
+              resolve42(entries);
             } else {
               reject(error);
             }
@@ -9008,10 +9140,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve41, reject) => {
+        return new Promise((resolve42, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve41(entries));
+          stream.once("end", () => resolve42(entries));
         });
       }
     };
@@ -9670,7 +9802,7 @@ var require_out4 = __commonJS({
 
 // src/detect/source-dir-detector.ts
 import { realpathSync } from "fs";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 function extsFor(language) {
   return EXTENSIONS[language] ?? [];
 }
@@ -9696,7 +9828,7 @@ function topSegment(rel) {
 function isInsideRoot(root, candidate) {
   try {
     const realRoot = realpathSync(root);
-    const realCand = realpathSync(resolve5(root, candidate));
+    const realCand = realpathSync(resolve6(root, candidate));
     return realCand === realRoot || realCand.startsWith(realRoot + "/");
   } catch {
     return false;
@@ -9864,25 +9996,25 @@ var init_source_dir_detector = __esm({
 });
 
 // src/detect/monorepo-detector.ts
-import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync3, lstatSync as lstatSync2, readdirSync as readdirSync4 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync8, statSync as statSync3, lstatSync as lstatSync2, readdirSync as readdirSync4 } from "fs";
 import { join as join5, relative as relative3 } from "path";
 import { parse as parseYaml3 } from "yaml";
 import { parse as parseToml2 } from "smol-toml";
 function safeReadText(path) {
   try {
-    if (!existsSync7(path)) return null;
+    if (!existsSync8(path)) return null;
     const ls = lstatSync2(path);
     if (ls.isSymbolicLink()) return null;
     const st = statSync3(path);
     if (!st.isFile()) return null;
-    return readFileSync6(path, "utf-8");
+    return readFileSync7(path, "utf-8");
   } catch {
     return null;
   }
 }
 function firstManifestIn(dir) {
   for (const m3 of MANIFEST_PRIORITY) {
-    if (existsSync7(join5(dir, m3))) return m3;
+    if (existsSync8(join5(dir, m3))) return m3;
   }
   return null;
 }
@@ -9947,7 +10079,7 @@ function genericWorkspaces(root) {
   const out = [];
   for (const parent of CONVENTIONAL_WORKSPACE_PARENTS) {
     const p19 = join5(root, parent);
-    if (!existsSync7(p19)) continue;
+    if (!existsSync8(p19)) continue;
     for (const sub of listSubdirs2(p19)) {
       const pkg = pkgFromDir(root, sub);
       if (pkg) out.push(pkg);
@@ -9988,7 +10120,7 @@ function expandWorkspaceGlobs(root, globs) {
     const parts = pattern.split("/");
     if (parts.length === 2 && (parts[1] === "*" || parts[1] === "**")) {
       const parent = join5(root, parts[0]);
-      if (!existsSync7(parent)) continue;
+      if (!existsSync8(parent)) continue;
       for (const sub of listSubdirs2(parent)) {
         const pkg = pkgFromDir(root, sub);
         if (pkg && !seen.has(pkg.path)) {
@@ -9999,7 +10131,7 @@ function expandWorkspaceGlobs(root, globs) {
       continue;
     }
     const direct = join5(root, pattern);
-    if (existsSync7(direct)) {
+    if (existsSync8(direct)) {
       const pkg = pkgFromDir(root, direct);
       if (pkg && !seen.has(pkg.path)) {
         seen.add(pkg.path);
@@ -10010,16 +10142,16 @@ function expandWorkspaceGlobs(root, globs) {
   return out;
 }
 function hasTurbo(root) {
-  return existsSync7(join5(root, "turbo.json"));
+  return existsSync8(join5(root, "turbo.json"));
 }
 function hasNx(root) {
-  return existsSync7(join5(root, "nx.json"));
+  return existsSync8(join5(root, "nx.json"));
 }
 function hasLerna(root) {
-  return existsSync7(join5(root, "lerna.json"));
+  return existsSync8(join5(root, "lerna.json"));
 }
 function hasBazel(root) {
-  return existsSync7(join5(root, "WORKSPACE")) || existsSync7(join5(root, "WORKSPACE.bazel")) || existsSync7(join5(root, "MODULE.bazel"));
+  return existsSync8(join5(root, "WORKSPACE")) || existsSync8(join5(root, "WORKSPACE.bazel")) || existsSync8(join5(root, "MODULE.bazel"));
 }
 function detectMonorepo(projectRoot) {
   const nested = [];
@@ -10210,7 +10342,7 @@ var init_vr_command_map = __esm({
 });
 
 // src/detect/domain-inferrer.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync9, readdirSync as readdirSync5 } from "fs";
 import { join as join6 } from "path";
 function titleCase(s) {
   if (!s) return s;
@@ -10232,7 +10364,7 @@ function topLevelSrcSubdirs(root, sourceDirs) {
   const seen = /* @__PURE__ */ new Set();
   for (const rel of effective) {
     const abs = join6(root, rel);
-    if (!existsSync8(abs)) continue;
+    if (!existsSync9(abs)) continue;
     try {
       for (const e2 of readdirSync5(abs, { withFileTypes: true })) {
         if (!e2.isDirectory()) continue;
@@ -10319,8 +10451,8 @@ var init_domain_inferrer = __esm({
 });
 
 // src/detect/regex-fallback.ts
-import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync4 } from "fs";
-import { resolve as resolve6, join as join7, basename as basename2 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
+import { resolve as resolve7, join as join7, basename as basename2 } from "path";
 function introspectPython(detection, projectRoot) {
   const sourceDir = resolveSourceDir(detection, "python", projectRoot);
   if (!sourceDir) return null;
@@ -10486,10 +10618,10 @@ function resolveSourceDir(detection, lang, projectRoot) {
   const list = info?.source_dirs ?? [];
   if (list.length > 0) {
     const first = list[0];
-    const abs = resolve6(projectRoot, first);
-    return existsSync9(abs) ? abs : null;
+    const abs = resolve7(projectRoot, first);
+    return existsSync10(abs) ? abs : null;
   }
-  return existsSync9(projectRoot) ? projectRoot : null;
+  return existsSync10(projectRoot) ? projectRoot : null;
 }
 function sampleFiles(dir, nameRegex, pathFilter) {
   const out = [];
@@ -10534,7 +10666,7 @@ function readSafe(path) {
   try {
     const st = statSync4(path);
     if (st.size > MAX_FILE_BYTES) return null;
-    return readFileSync7(path, "utf-8");
+    return readFileSync8(path, "utf-8");
   } catch {
     return null;
   }
@@ -10615,7 +10747,7 @@ var init_parse_guard = __esm({
 
 // src/detect/adapters/runner.ts
 import { basename as basename3, relative as relative4 } from "path";
-import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync5 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync7, readFileSync as readFileSync9, statSync as statSync5 } from "fs";
 import { join as join8 } from "path";
 async function runAdapters(adapters, rootDir, signals, options = {}) {
   const out = {
@@ -10750,9 +10882,9 @@ function tryReadGradleBuild(rootDir, presentFiles) {
   return void 0;
 }
 function tryReadString(path) {
-  if (!existsSync10(path)) return void 0;
+  if (!existsSync11(path)) return void 0;
   try {
-    return readFileSync8(path, "utf-8");
+    return readFileSync9(path, "utf-8");
   } catch {
     return void 0;
   }
@@ -10869,21 +11001,21 @@ ${querySource}`
 // src/detect/adapters/tree-sitter-loader.ts
 import { createHash as createHash3 } from "crypto";
 import {
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync9,
-  writeFileSync,
+  readFileSync as readFileSync10,
+  writeFileSync as writeFileSync2,
   renameSync as renameSync2,
   unlinkSync,
   lstatSync as lstatSync3,
-  chmodSync,
+  chmodSync as chmodSync2,
   utimesSync
 } from "fs";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { dirname as dirname5, join as join9 } from "path";
 import { Language, Parser } from "web-tree-sitter";
 function getCacheDir() {
-  return process.env.MASSU_WASM_CACHE_DIR ?? join9(homedir3(), ".massu", "wasm-cache");
+  return process.env.MASSU_WASM_CACHE_DIR ?? join9(homedir4(), ".massu", "wasm-cache");
 }
 function getCachedPath(language, sha) {
   return join9(getCacheDir(), `${language}-${sha}.wasm`);
@@ -10971,7 +11103,7 @@ async function loadGrammar(language, options = {}) {
     }
     let bytes;
     try {
-      bytes = readFileSync9(cachePath);
+      bytes = readFileSync10(cachePath);
     } catch (e2) {
       bytes = new Uint8Array(0);
     }
@@ -11011,21 +11143,21 @@ async function loadGrammar(language, options = {}) {
     throw new GrammarSHAMismatchError(language, manifest.sha256, downloadedSha);
   }
   try {
-    mkdirSync4(dirname5(cachePath), { recursive: true, mode: 448 });
+    mkdirSync5(dirname5(cachePath), { recursive: true, mode: 448 });
     try {
-      chmodSync(dirname5(cachePath), 448);
+      chmodSync2(dirname5(cachePath), 448);
     } catch {
     }
     const tmpPath = `${cachePath}.tmp.${process.pid}`;
-    writeFileSync(tmpPath, body, { mode: 384 });
+    writeFileSync2(tmpPath, body, { mode: 384 });
     try {
-      chmodSync(tmpPath, 384);
+      chmodSync2(tmpPath, 384);
     } catch {
     }
     try {
       renameSync2(tmpPath, cachePath);
       try {
-        chmodSync(cachePath, 384);
+        chmodSync2(cachePath, 384);
       } catch {
       }
     } catch (e2) {
@@ -11889,7 +12021,7 @@ __export(file_sampler_exports, {
   SAMPLE_TEST_FILE_PATTERNS: () => SAMPLE_TEST_FILE_PATTERNS,
   sampleFilesForAdapter: () => sampleFilesForAdapter
 });
-import { readdirSync as readdirSync9, readFileSync as readFileSync10, lstatSync as lstatSync4 } from "node:fs";
+import { readdirSync as readdirSync9, readFileSync as readFileSync11, lstatSync as lstatSync4 } from "node:fs";
 import { join as join10, extname } from "node:path";
 function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
@@ -11950,7 +12082,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
     seen.add(fullPath);
     let content;
     try {
-      content = readFileSync10(fullPath, "utf-8");
+      content = readFileSync11(fullPath, "utf-8");
     } catch {
       continue;
     }
@@ -13374,10 +13506,10 @@ __export(init_exports, {
   validateWrittenConfig: () => validateWrittenConfig,
   writeConfigAtomic: () => writeConfigAtomic
 });
-import { closeSync as closeSync2, existsSync as existsSync11, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync2, writeSync as writeSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync10, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync7, chmodSync as chmodSync2 } from "fs";
-import { resolve as resolve7, basename as basename4, dirname as dirname6 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync12, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync3, writeSync as writeSync2, mkdirSync as mkdirSync6, readdirSync as readdirSync10, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync7, chmodSync as chmodSync3 } from "fs";
+import { resolve as resolve8, basename as basename4, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 import { stringify as yamlStringify, parse as yamlParse } from "yaml";
 function detectFramework(projectRoot) {
   const result = {
@@ -13386,10 +13518,10 @@ function detectFramework(projectRoot) {
     orm: "none",
     ui: "none"
   };
-  const pkgPath = resolve7(projectRoot, "package.json");
-  if (!existsSync11(pkgPath)) return result;
+  const pkgPath = resolve8(projectRoot, "package.json");
+  if (!existsSync12(pkgPath)) return result;
   try {
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
     const allDeps = {
       ...pkg.dependencies,
       ...pkg.devDependencies
@@ -13423,7 +13555,7 @@ function detectPython(projectRoot) {
     alembicDir: null
   };
   const markers = ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile"];
-  const hasMarker = markers.some((m3) => existsSync11(resolve7(projectRoot, m3)));
+  const hasMarker = markers.some((m3) => existsSync12(resolve8(projectRoot, m3)));
   if (!hasMarker) return result;
   result.detected = true;
   const depFiles = [
@@ -13433,33 +13565,33 @@ function detectPython(projectRoot) {
     { file: "Pipfile" }
   ];
   for (const { file } of depFiles) {
-    const filePath = resolve7(projectRoot, file);
-    if (existsSync11(filePath)) {
+    const filePath = resolve8(projectRoot, file);
+    if (existsSync12(filePath)) {
       try {
-        const content = readFileSync11(filePath, "utf-8").toLowerCase();
+        const content = readFileSync12(filePath, "utf-8").toLowerCase();
         if (content.includes("fastapi")) result.hasFastapi = true;
         if (content.includes("sqlalchemy")) result.hasSqlalchemy = true;
       } catch {
       }
     }
   }
-  if (existsSync11(resolve7(projectRoot, "alembic.ini"))) {
+  if (existsSync12(resolve8(projectRoot, "alembic.ini"))) {
     result.hasAlembic = true;
-    if (existsSync11(resolve7(projectRoot, "alembic"))) {
+    if (existsSync12(resolve8(projectRoot, "alembic"))) {
       result.alembicDir = "alembic";
     }
-  } else if (existsSync11(resolve7(projectRoot, "alembic"))) {
+  } else if (existsSync12(resolve8(projectRoot, "alembic"))) {
     result.hasAlembic = true;
     result.alembicDir = "alembic";
   }
   const candidateRoots = ["app", "src", "backend", "api"];
   for (const candidate of candidateRoots) {
-    const candidatePath = resolve7(projectRoot, candidate);
-    if (existsSync11(candidatePath) && existsSync11(resolve7(candidatePath, "__init__.py"))) {
+    const candidatePath = resolve8(projectRoot, candidate);
+    if (existsSync12(candidatePath) && existsSync12(resolve8(candidatePath, "__init__.py"))) {
       result.root = candidate;
       break;
     }
-    if (existsSync11(candidatePath)) {
+    if (existsSync12(candidatePath)) {
       try {
         const files = readdirSync10(candidatePath);
         if (files.some((f2) => f2.endsWith(".py"))) {
@@ -13479,8 +13611,8 @@ function generateConfig(projectRoot, framework) {
   console.warn(
     "[@massu/core] generateConfig() is deprecated since 1.2.1 \u2014 use buildConfigFromDetection instead. It cannot produce valid configs for monorepos."
   );
-  const configPath = resolve7(projectRoot, "massu.config.yaml");
-  if (existsSync11(configPath)) {
+  const configPath = resolve8(projectRoot, "massu.config.yaml");
+  if (existsSync12(configPath)) {
     return false;
   }
   const projectName = basename4(projectRoot);
@@ -13526,7 +13658,7 @@ function generateConfig(projectRoot, framework) {
 # Documentation: https://massu.ai/docs/getting-started/configuration
 
 ${yamlStringify(config)}`;
-  writeFileSync2(configPath, yamlContent, "utf-8");
+  writeFileSync3(configPath, yamlContent, "utf-8");
   return true;
 }
 function monorepoCommonRoot(packages) {
@@ -13591,10 +13723,10 @@ function buildConfigFromDetection(opts) {
       pathsSource = monorepoCommonRoot(detection.monorepo.packages);
     }
   }
-  if (pathsSource === "src" && !existsSync11(resolve7(projectRoot, "src"))) {
+  if (pathsSource === "src" && !existsSync12(resolve8(projectRoot, "src"))) {
     const fallbacks = ["app", "pages", "."];
     for (const fallback of fallbacks) {
-      if (fallback === "." || existsSync11(resolve7(projectRoot, fallback))) {
+      if (fallback === "." || existsSync12(resolve8(projectRoot, fallback))) {
         pathsSource = fallback;
         break;
       }
@@ -13678,7 +13810,7 @@ function buildConfigFromDetection(opts) {
     };
     if (pyFw?.framework) pythonBlock.framework = pyFw.framework;
     if (pyFw?.orm) pythonBlock.orm = pyFw.orm;
-    if (existsSync11(resolve7(projectRoot, "alembic.ini")) || existsSync11(resolve7(projectRoot, "alembic"))) {
+    if (existsSync12(resolve8(projectRoot, "alembic.ini")) || existsSync12(resolve8(projectRoot, "alembic"))) {
       pythonBlock.alembic_dir = "alembic";
     }
     config.python = pythonBlock;
@@ -13702,11 +13834,11 @@ function applyVariantTemplate(config, templatesDir) {
     }
   }
   if (templateId === null) return config;
-  const templatePath = resolve7(templatesDir, templateId, "massu.config.yaml");
-  if (!existsSync11(templatePath)) return config;
+  const templatePath = resolve8(templatesDir, templateId, "massu.config.yaml");
+  if (!existsSync12(templatePath)) return config;
   let template;
   try {
-    template = yamlParse(readFileSync11(templatePath, "utf-8"));
+    template = yamlParse(readFileSync12(templatePath, "utf-8"));
   } catch {
     return config;
   }
@@ -13765,7 +13897,7 @@ ${yamlStringify(config)}`;
 function writeConfigAtomic(configPath, content) {
   const tmpPath = `${configPath}.tmp`;
   let existingMode;
-  if (existsSync11(configPath)) {
+  if (existsSync12(configPath)) {
     try {
       existingMode = statSync7(configPath).mode;
     } catch {
@@ -13773,7 +13905,7 @@ function writeConfigAtomic(configPath, content) {
     }
   }
   try {
-    mkdirSync5(dirname6(configPath), { recursive: true });
+    mkdirSync6(dirname6(configPath), { recursive: true });
     const fd = openSync2(tmpPath, "w", 420);
     try {
       const buf = Buffer.from(content, "utf-8");
@@ -13789,15 +13921,15 @@ function writeConfigAtomic(configPath, content) {
     renameSync3(tmpPath, configPath);
     if (existingMode !== void 0) {
       try {
-        chmodSync2(configPath, existingMode);
+        chmodSync3(configPath, existingMode);
       } catch {
       }
     }
     return { validated: true };
   } catch (err) {
-    if (existsSync11(tmpPath)) {
+    if (existsSync12(tmpPath)) {
       try {
-        rmSync2(tmpPath, { force: true });
+        rmSync3(tmpPath, { force: true });
       } catch {
       }
     }
@@ -13806,8 +13938,8 @@ function writeConfigAtomic(configPath, content) {
 }
 function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
   try {
-    if (!existsSync11(configPath)) return "Config file does not exist after write";
-    const content = readFileSync11(configPath, "utf-8");
+    if (!existsSync12(configPath)) return "Config file does not exist after write";
+    const content = readFileSync12(configPath, "utf-8");
     const parsed = yamlParse(content);
     if (parsed === null || typeof parsed !== "object") {
       return "Config is not a valid YAML object";
@@ -13827,8 +13959,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
       if (checkPaths) {
         const src = cfg.paths.source;
         if (src && src !== ".") {
-          const srcAbs = resolve7(projectRoot, src);
-          if (!existsSync11(srcAbs)) {
+          const srcAbs = resolve8(projectRoot, src);
+          if (!existsSync12(srcAbs)) {
             return `paths.source '${src}' does not exist on disk`;
           }
         }
@@ -13838,8 +13970,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
           if (!Array.isArray(rawDirs)) continue;
           for (const d2 of rawDirs) {
             if (typeof d2 !== "string" || d2 === ".") continue;
-            const abs = resolve7(projectRoot, d2);
-            if (!existsSync11(abs)) {
+            const abs = resolve8(projectRoot, d2);
+            if (!existsSync12(abs)) {
               return `framework.languages.${lang}.source_dirs '${d2}' does not exist on disk`;
             }
           }
@@ -13848,7 +13980,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
         if (Array.isArray(mRoots)) {
           for (const r2 of mRoots) {
             if (typeof r2 !== "string" || r2 === ".") continue;
-            if (!existsSync11(resolve7(projectRoot, r2))) {
+            if (!existsSync12(resolve8(projectRoot, r2))) {
               return `paths.monorepo_roots '${r2}' does not exist on disk`;
             }
           }
@@ -13880,21 +14012,21 @@ function resolveTemplatesDir() {
   const cwd = process.cwd();
   const candidates = [
     // Project-local install: `<project>/node_modules/@massu/core/templates`.
-    resolve7(cwd, "node_modules/@massu/core/templates"),
+    resolve8(cwd, "node_modules/@massu/core/templates"),
     // Bundled cli.js layout: cli.js sits at `<package>/dist/cli.js`, so
     // templates live one level up at `<package>/templates`. (Plan 1.5.1
     // bug discovery: pre-existing layout assumed `dist/commands/init.js`
     // depth which never matched the bundled cli, so resolveTemplatesDir
     // returned null in production for both `--template` mode AND the
     // applyVariantTemplate path.)
-    resolve7(__dirname2, "../templates"),
+    resolve8(__dirname2, "../templates"),
     // Legacy nested layouts retained as fallbacks (in case a future
     // build moves cli.js back into a subdirectory).
-    resolve7(__dirname2, "../../templates"),
-    resolve7(__dirname2, "../../../templates")
+    resolve8(__dirname2, "../../templates"),
+    resolve8(__dirname2, "../../../templates")
   ];
   for (const c2 of candidates) {
-    if (existsSync11(c2)) return c2;
+    if (existsSync12(c2)) return c2;
   }
   return null;
 }
@@ -13903,14 +14035,14 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
   if (!templatesDir) {
     return { success: false, error: `Templates directory not found (looked in node_modules and dist/src)` };
   }
-  const srcPath = resolve7(templatesDir, templateName, "massu.config.yaml");
-  if (!existsSync11(srcPath)) {
+  const srcPath = resolve8(templatesDir, templateName, "massu.config.yaml");
+  if (!existsSync12(srcPath)) {
     return { success: false, error: `Template '${templateName}' not found at ${srcPath}` };
   }
   try {
-    let content = readFileSync11(srcPath, "utf-8");
+    let content = readFileSync12(srcPath, "utf-8");
     content = content.replace(/\{\{PROJECT_NAME\}\}/g, projectName);
-    writeFileSync2(targetPath, content, "utf-8");
+    writeFileSync3(targetPath, content, "utf-8");
     return { success: true };
   } catch (err) {
     return { success: false, error: err instanceof Error ? err.message : String(err) };
@@ -13918,13 +14050,13 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
 }
 function getInstallerVersion() {
   const candidates = [
-    resolve7(__dirname2, "../package.json"),
-    resolve7(__dirname2, "../../package.json")
+    resolve8(__dirname2, "../package.json"),
+    resolve8(__dirname2, "../../package.json")
   ];
   for (const candidate of candidates) {
-    if (existsSync11(candidate)) {
+    if (existsSync12(candidate)) {
       try {
-        const pkg = JSON.parse(readFileSync11(candidate, "utf-8"));
+        const pkg = JSON.parse(readFileSync12(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0 && pkg.name === "@massu/core") {
           return pkg.version;
         }
@@ -13937,11 +14069,11 @@ function getInstallerVersion() {
   );
 }
 function registerMcpServer(projectRoot) {
-  const mcpPath = resolve7(projectRoot, ".mcp.json");
+  const mcpPath = resolve8(projectRoot, ".mcp.json");
   let existing = {};
-  if (existsSync11(mcpPath)) {
+  if (existsSync12(mcpPath)) {
     try {
-      existing = JSON.parse(readFileSync11(mcpPath, "utf-8"));
+      existing = JSON.parse(readFileSync12(mcpPath, "utf-8"));
     } catch {
       existing = {};
     }
@@ -13957,17 +14089,17 @@ function registerMcpServer(projectRoot) {
     args: ["-y", `@massu/core@${version}`]
   };
   existing.mcpServers = servers;
-  writeFileSync2(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  writeFileSync3(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
   return true;
 }
 function resolveHooksDir() {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve7(cwd, "node_modules/@massu/core/dist/hooks");
-  if (existsSync11(nodeModulesPath)) {
+  const nodeModulesPath = resolve8(cwd, "node_modules/@massu/core/dist/hooks");
+  if (existsSync12(nodeModulesPath)) {
     return "node_modules/@massu/core/dist/hooks";
   }
-  const localPath = resolve7(__dirname2, "../dist/hooks");
-  if (existsSync11(localPath)) {
+  const localPath = resolve8(__dirname2, "../dist/hooks");
+  if (existsSync12(localPath)) {
     return localPath;
   }
   return "node_modules/@massu/core/dist/hooks";
@@ -14113,9 +14245,9 @@ function installHooks(projectRoot) {
   } catch {
     claudeDirName = ".claude";
   }
-  const claudeDir = resolve7(projectRoot, claudeDirName);
-  if (!existsSync11(claudeDir)) {
-    mkdirSync5(claudeDir, { recursive: true });
+  const claudeDir = resolve8(projectRoot, claudeDirName);
+  if (!existsSync12(claudeDir)) {
+    mkdirSync6(claudeDir, { recursive: true });
   }
   const settings = readSettingsLocal(claudeDir);
   const hooksConfig = buildHooksConfig(resolveHooksDir());
@@ -14133,17 +14265,17 @@ function installHooks(projectRoot) {
 }
 function initMemoryDir(projectRoot) {
   const encodedRoot = encodeMemoryDirName(projectRoot);
-  const memoryDir = resolve7(homedir4(), `.claude/projects/${encodedRoot}/memory`);
+  const memoryDir = resolve8(homedir5(), `.claude/projects/${encodedRoot}/memory`);
   let migratedFromLegacy = false;
-  const legacyDir = resolve7(homedir4(), `.claude/projects/-${encodedRoot}/memory`);
-  if (existsSync11(legacyDir) && !existsSync11(memoryDir)) {
+  const legacyDir = resolve8(homedir5(), `.claude/projects/-${encodedRoot}/memory`);
+  if (existsSync12(legacyDir) && !existsSync12(memoryDir)) {
     try {
-      mkdirSync5(resolve7(memoryDir, ".."), { recursive: true });
+      mkdirSync6(resolve8(memoryDir, ".."), { recursive: true });
       renameSync3(legacyDir, memoryDir);
       try {
-        const legacyParent = resolve7(legacyDir, "..");
-        if (existsSync11(legacyParent) && readdirSync10(legacyParent).length === 0) {
-          rmSync2(legacyParent, { recursive: false });
+        const legacyParent = resolve8(legacyDir, "..");
+        if (existsSync12(legacyParent) && readdirSync10(legacyParent).length === 0) {
+          rmSync3(legacyParent, { recursive: false });
         }
       } catch {
       }
@@ -14152,13 +14284,13 @@ function initMemoryDir(projectRoot) {
     }
   }
   let created = false;
-  if (!existsSync11(memoryDir)) {
-    mkdirSync5(memoryDir, { recursive: true });
+  if (!existsSync12(memoryDir)) {
+    mkdirSync6(memoryDir, { recursive: true });
     created = true;
   }
-  const memoryMdPath = resolve7(memoryDir, "MEMORY.md");
+  const memoryMdPath = resolve8(memoryDir, "MEMORY.md");
   let memoryMdCreated = false;
-  if (!existsSync11(memoryMdPath)) {
+  if (!existsSync12(memoryMdPath)) {
     const projectName = basename4(projectRoot);
     const memoryContent = `# ${projectName} - Massu Memory
 
@@ -14174,7 +14306,7 @@ function initMemoryDir(projectRoot) {
 ## File Index
 <!-- Significant files and directories -->
 `;
-    writeFileSync2(memoryMdPath, memoryContent, "utf-8");
+    writeFileSync3(memoryMdPath, memoryContent, "utf-8");
     memoryMdCreated = true;
   }
   return { created, memoryMdCreated, migratedFromLegacy };
@@ -14272,8 +14404,8 @@ async function runInit(argv, overrides) {
   log("Massu AI - Project Setup");
   log("========================");
   log("");
-  const configPath = resolve7(projectRoot, "massu.config.yaml");
-  if (existsSync11(configPath)) {
+  const configPath = resolve8(projectRoot, "massu.config.yaml");
+  if (existsSync12(configPath)) {
     if (opts.ci && !opts.force) {
       errLog(`error: massu.config.yaml already exists at ${configPath}`);
       errLog("       rerun with --force to overwrite, or remove the file first");
@@ -14301,7 +14433,7 @@ async function runInit(argv, overrides) {
     const validation2 = validateWrittenConfig(configPath, projectRoot, false);
     if (validation2 !== null) {
       try {
-        rmSync2(configPath, { force: true });
+        rmSync3(configPath, { force: true });
       } catch {
       }
       errLog(`error: template config failed validation: ${validation2}`);
@@ -14379,7 +14511,7 @@ async function runInit(argv, overrides) {
   const validation = validateWrittenConfig(configPath, projectRoot, !emptyStack);
   if (validation !== null) {
     try {
-      rmSync2(configPath, { force: true });
+      rmSync3(configPath, { force: true });
     } catch {
     }
     errLog(`error: generated config failed validation: ${validation}`);
@@ -14412,8 +14544,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
       const commandStats = cmdResult.assets.commands;
       const stackResolved = !emptyStack && commandStats && (commandStats.installed > 0 || commandStats.updated > 0 || commandStats.kept > 0);
       if (!stackResolved) {
-        const placeholderPath = resolve7(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (!existsSync11(placeholderPath)) {
+        const placeholderPath = resolve8(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (!existsSync12(placeholderPath)) {
           const placeholderBody = [
             "# Massu \u2014 stack not yet detected",
             "",
@@ -14434,8 +14566,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
             "\u2014 Massu"
           ].join("\n");
           try {
-            mkdirSync5(resolve7(cmdResult.claudeDir, "commands"), { recursive: true });
-            writeFileSync2(placeholderPath, placeholderBody, "utf-8");
+            mkdirSync6(resolve8(cmdResult.claudeDir, "commands"), { recursive: true });
+            writeFileSync3(placeholderPath, placeholderBody, "utf-8");
             log("  Wrote _massu-needs-stack.md placeholder (no stack detected yet)");
           } catch {
           }
@@ -14457,8 +14589,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
   (async () => {
     try {
       const encodedRoot = encodeMemoryDirName(projectRoot);
-      const memoryDir = resolve7(homedir4(), ".claude", "projects", encodedRoot, "memory");
-      const memFiles = existsSync11(memoryDir) ? readdirSync10(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
+      const memoryDir = resolve8(homedir5(), ".claude", "projects", encodedRoot, "memory");
+      const memFiles = existsSync12(memoryDir) ? readdirSync10(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
       if (memFiles.length > 0) {
         const { getMemoryDb: getMemoryDb2 } = await Promise.resolve().then(() => (init_memory_db(), memory_db_exports));
         const db = getMemoryDb2();
@@ -14648,6 +14780,28 @@ var init_license_response_verifier = __esm({
 });
 
 // src/license.ts
+var license_exports = {};
+__export(license_exports, {
+  PLAN_TO_TIER_MAP: () => PLAN_TO_TIER_MAP,
+  TOOL_TIER_MAP: () => TOOL_TIER_MAP,
+  _resetCachedTier: () => _resetCachedTier,
+  _setCachedTierForTest: () => _setCachedTierForTest,
+  annotateToolDefinitions: () => annotateToolDefinitions,
+  daysUntilExpiry: () => daysUntilExpiry,
+  getCachedOrgId: () => getCachedOrgId,
+  getCachedTierReadOnly: () => getCachedTierReadOnly,
+  getCurrentTier: () => getCurrentTier,
+  getLicenseInfo: () => getLicenseInfo,
+  getLicenseToolDefinitions: () => getLicenseToolDefinitions,
+  getToolTier: () => getToolTier,
+  handleLicenseToolCall: () => handleLicenseToolCall,
+  isCloudFeatureAvailable: () => isCloudFeatureAvailable,
+  isLicenseTool: () => isLicenseTool,
+  isToolAllowed: () => isToolAllowed,
+  tierLevel: () => tierLevel,
+  updateLicenseCache: () => updateLicenseCache,
+  validateLicense: () => validateLicense
+});
 import { createHash as createHash5 } from "crypto";
 function warnLicenseSigOnce(reason) {
   if (_warnedLicenseSig) return;
@@ -14713,11 +14867,12 @@ async function validateLicense(apiKey) {
       const lastValidated = new Date(cached.last_validated);
       const hourAgo = new Date(Date.now() - 60 * 60 * 1e3);
       if (lastValidated > hourAgo) {
-        return trusted;
+        return { ...trusted, outcome: "cache_fresh" };
       }
     }
     const config = getConfig();
     const endpoint = config.cloud?.endpoint;
+    let fallbackOutcome = "no_endpoint";
     if (endpoint && /^https?:\/\/.+/.test(endpoint)) {
       try {
         const response = await fetch(`${endpoint}/validate-key`, {
@@ -14749,21 +14904,23 @@ async function validateLicense(apiKey) {
               features,
               sigResult.kind === "valid" ? data : null
             );
-            return { tier, validUntil, features };
+            return { tier, validUntil, features, outcome: "validated" };
           }
-          return { tier: "free", validUntil: "", features: [] };
+          return { tier: "free", validUntil: "", features: [], outcome: "rejected" };
         }
+        fallbackOutcome = "server_error";
       } catch {
+        fallbackOutcome = "network_error";
       }
     }
     if (cached && trusted) {
       const lastValidated = new Date(cached.last_validated);
       const sevenDaysAgo = new Date(Date.now() - GRACE_PERIOD_MS);
       if (lastValidated > sevenDaysAgo) {
-        return trusted;
+        return { ...trusted, outcome: "grace" };
       }
     }
-    return { tier: "free", validUntil: "", features: [] };
+    return { tier: "free", validUntil: "", features: [], outcome: fallbackOutcome };
   } finally {
     memDb.close();
   }
@@ -14819,7 +14976,7 @@ async function getCurrentTier() {
   const config = getConfig();
   const apiKey = config.cloud?.apiKey;
   if (!apiKey) {
-    cachedTier = { tier: "free", validUntil: "", features: [] };
+    cachedTier = { tier: "free", validUntil: "", features: [], outcome: "no_key" };
     cachedTierTimestamp = Date.now();
     return "free";
   }
@@ -14952,6 +15109,14 @@ async function handleLicenseToolCall(name, _args, _memDb) {
   }
   return { content: [{ type: "text", text: `Unknown license tool: ${name}` }] };
 }
+function _resetCachedTier() {
+  cachedTier = null;
+  cachedTierTimestamp = 0;
+}
+function _setCachedTierForTest(tier) {
+  cachedTier = { tier, validUntil: "", features: [] };
+  cachedTierTimestamp = Date.now();
+}
 var _warnedLicenseSig, TIER_LEVELS, TOOL_TIER_MAP, PLAN_TO_TIER_MAP, TIER_LABELS, cachedTier, cachedTierTimestamp, IN_MEMORY_CACHE_TTL_MS, GRACE_PERIOD_MS;
 var init_license = __esm({
   "src/license.ts"() {
@@ -15107,20 +15272,21 @@ var init_hook_registry = __esm({
 // src/commands/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
+  formatLicenseCheck: () => formatLicenseCheck,
   runDoctor: () => runDoctor,
   runValidateConfig: () => runValidateConfig
 });
-import { existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync11 } from "fs";
-import { resolve as resolve8, dirname as dirname7 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync11 } from "fs";
+import { resolve as resolve9, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parse as parseYaml4 } from "yaml";
 function checkConfig(projectRoot) {
-  const configPath = resolve8(projectRoot, "massu.config.yaml");
-  if (!existsSync12(configPath)) {
+  const configPath = resolve9(projectRoot, "massu.config.yaml");
+  if (!existsSync13(configPath)) {
     return { name: "Configuration", status: "fail", detail: "massu.config.yaml not found. Run: npx massu init" };
   }
   try {
-    const content = readFileSync12(configPath, "utf-8");
+    const content = readFileSync13(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       return { name: "Configuration", status: "fail", detail: "massu.config.yaml is empty or invalid YAML" };
@@ -15132,11 +15298,11 @@ function checkConfig(projectRoot) {
 }
 function checkMcpServer(projectRoot) {
   const mcpPath = getResolvedPaths().mcpJsonPath;
-  if (!existsSync12(mcpPath)) {
+  if (!existsSync13(mcpPath)) {
     return { name: "MCP Server", status: "fail", detail: ".mcp.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync12(mcpPath, "utf-8"));
+    const content = JSON.parse(readFileSync13(mcpPath, "utf-8"));
     const servers = content.mcpServers ?? {};
     if (!servers.massu) {
       return { name: "MCP Server", status: "fail", detail: "massu not registered in .mcp.json. Run: npx massu init" };
@@ -15148,7 +15314,7 @@ function checkMcpServer(projectRoot) {
 }
 function checkHooksConfig(projectRoot) {
   const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync12(settingsPath)) {
+  if (!existsSync13(settingsPath)) {
     return { name: "Hooks Config", status: "fail", detail: ".claude/settings.local.json not found. Run: npx massu init" };
   }
   try {
@@ -15176,11 +15342,11 @@ function checkHooksConfig(projectRoot) {
   }
 }
 function checkHookFiles(projectRoot) {
-  const nodeModulesHooksDir = resolve8(projectRoot, "node_modules/@massu/core/dist/hooks");
+  const nodeModulesHooksDir = resolve9(projectRoot, "node_modules/@massu/core/dist/hooks");
   let hooksDir = nodeModulesHooksDir;
-  if (!existsSync12(nodeModulesHooksDir)) {
-    const devHooksDir = resolve8(__dirname3, "../../dist/hooks");
-    if (existsSync12(devHooksDir)) {
+  if (!existsSync13(nodeModulesHooksDir)) {
+    const devHooksDir = resolve9(__dirname3, "../../dist/hooks");
+    if (existsSync13(devHooksDir)) {
       hooksDir = devHooksDir;
     } else {
       return { name: "Hook Files", status: "fail", detail: "Compiled hooks not found. Run: npm install @massu/core" };
@@ -15188,7 +15354,7 @@ function checkHookFiles(projectRoot) {
   }
   const missing = [];
   for (const hookFile of EXPECTED_HOOKS) {
-    if (!existsSync12(resolve8(hooksDir, hookFile))) {
+    if (!existsSync13(resolve9(hooksDir, hookFile))) {
       missing.push(hookFile);
     }
   }
@@ -15214,8 +15380,8 @@ function checkNodeVersion() {
   return { name: "Node.js", status: "fail", detail: `v${version} \u2014 Node.js 18+ is required` };
 }
 async function checkGitRepo(projectRoot) {
-  const gitDir = resolve8(projectRoot, ".git");
-  if (!existsSync12(gitDir)) {
+  const gitDir = resolve9(projectRoot, ".git");
+  if (!existsSync13(gitDir)) {
     return { name: "Git Repository", status: "warn", detail: "Not a git repository (optional but recommended)" };
   }
   try {
@@ -15233,7 +15399,7 @@ async function checkGitRepo(projectRoot) {
 }
 function checkKnowledgeDb(projectRoot) {
   const knowledgeDbPath = getResolvedPaths().memoryDbPath;
-  if (!existsSync12(knowledgeDbPath)) {
+  if (!existsSync13(knowledgeDbPath)) {
     return {
       name: "Knowledge DB",
       status: "warn",
@@ -15244,7 +15410,7 @@ function checkKnowledgeDb(projectRoot) {
 }
 function checkMemoryDir(_projectRoot2) {
   const memoryDir = getResolvedPaths().memoryDir;
-  if (!existsSync12(memoryDir)) {
+  if (!existsSync13(memoryDir)) {
     return {
       name: "Memory Directory",
       status: "warn",
@@ -15255,7 +15421,7 @@ function checkMemoryDir(_projectRoot2) {
 }
 function checkShellHooksWired(_projectRoot2) {
   const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync12(settingsPath)) {
+  if (!existsSync13(settingsPath)) {
     return {
       name: "Shell Hooks",
       status: "fail",
@@ -15283,26 +15449,43 @@ function checkShellHooksWired(_projectRoot2) {
     };
   }
 }
+function formatLicenseCheck(input) {
+  const { source, tier, validUntil, outcome } = input;
+  if (source === "none") {
+    return { name: "License", status: "pass", detail: "Free (no API key configured)" };
+  }
+  const label = apiKeySourceLabel(source);
+  if (tier !== "free") {
+    const cap = tier.charAt(0).toUpperCase() + tier.slice(1);
+    const until = validUntil ? `, valid until ${validUntil}` : "";
+    return { name: "License", status: "pass", detail: `${cap} (via ${label}${until})` };
+  }
+  if (outcome === "server_error") {
+    return {
+      name: "License",
+      status: "warn",
+      detail: `Could not validate \u2014 license server error (tier UNKNOWN; key present via ${label}). Not a Free downgrade; retries automatically.`
+    };
+  }
+  if (outcome === "network_error" || outcome === "no_endpoint") {
+    return {
+      name: "License",
+      status: "warn",
+      detail: `Could not reach license server (tier UNKNOWN; key present via ${label}). Not a Free downgrade; retries automatically.`
+    };
+  }
+  return {
+    name: "License",
+    status: "warn",
+    detail: `Free \u2014 key present via ${label} but validated to Free (check key / subscription)`
+  };
+}
 async function checkLicenseStatus() {
   try {
+    const source = getResolvedApiKeySource();
     const tier = await getCurrentTier();
     const info = await getLicenseInfo();
-    if (tier === "free" && !info.validUntil) {
-      return { name: "License", status: "pass", detail: "Free (no API key configured)" };
-    }
-    const days = await daysUntilExpiry();
-    if (days >= 0 && info.validUntil) {
-      return {
-        name: "License",
-        status: "pass",
-        detail: `${tier.charAt(0).toUpperCase() + tier.slice(1)} (valid until ${info.validUntil})`
-      };
-    }
-    return {
-      name: "License",
-      status: "pass",
-      detail: `${tier.charAt(0).toUpperCase() + tier.slice(1)} (valid)`
-    };
+    return formatLicenseCheck({ source, tier, validUntil: info.validUntil, outcome: info.outcome });
   } catch (err) {
     return {
       name: "License",
@@ -15311,11 +15494,31 @@ async function checkLicenseStatus() {
     };
   }
 }
+async function checkApiKeyHygiene(projectRoot) {
+  if (getResolvedApiKeySource() !== "config") return null;
+  try {
+    const { spawnSync: spawnSync4 } = await import("child_process");
+    const res = spawnSync4("git", ["ls-files", "--error-unmatch", "massu.config.yaml"], {
+      cwd: projectRoot,
+      timeout: 5e3,
+      encoding: "utf-8"
+    });
+    if (res.status === 0) {
+      return {
+        name: "API Key Hygiene",
+        status: "warn",
+        detail: "API key is committed in massu.config.yaml \u2014 move it to the MASSU_API_KEY env var or 'massu login' (~/.massu/credentials)"
+      };
+    }
+  } catch {
+  }
+  return null;
+}
 function checkPythonHealth(projectRoot) {
   const config = getConfig();
   if (!config.python?.root) return null;
-  const pythonRoot = resolve8(projectRoot, config.python.root);
-  if (!existsSync12(pythonRoot)) {
+  const pythonRoot = resolve9(projectRoot, config.python.root);
+  if (!existsSync13(pythonRoot)) {
     return {
       name: "Python",
       status: "fail",
@@ -15334,8 +15537,8 @@ function checkPythonHealth(projectRoot) {
         if (entry.isDirectory()) {
           const excludeDirs = config.python?.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
           if (!excludeDirs.includes(entry.name)) {
-            const subdir = resolve8(dir, entry.name);
-            if (depth <= 2 && !existsSync12(resolve8(subdir, "__init__.py"))) {
+            const subdir = resolve9(dir, entry.name);
+            if (depth <= 2 && !existsSync13(resolve9(subdir, "__init__.py"))) {
               try {
                 const subEntries = readdirSync11(subdir);
                 if (subEntries.some((f2) => f2.endsWith(".py") && f2 !== "__init__.py")) {
@@ -15405,6 +15608,8 @@ async function runDoctor() {
   ];
   const pythonCheck = checkPythonHealth(projectRoot);
   if (pythonCheck) checks.push(pythonCheck);
+  const hygieneCheck = await checkApiKeyHygiene(projectRoot);
+  if (hygieneCheck) checks.push(hygieneCheck);
   let passed = 0;
   let failed = 0;
   let warned = 0;
@@ -15430,15 +15635,15 @@ async function runDoctor() {
 }
 async function runValidateConfig() {
   const projectRoot = process.cwd();
-  const configPath = resolve8(projectRoot, "massu.config.yaml");
-  if (!existsSync12(configPath)) {
+  const configPath = resolve9(projectRoot, "massu.config.yaml");
+  if (!existsSync13(configPath)) {
     console.error("Error: massu.config.yaml not found in current directory");
     console.error("Run: npx massu init");
     process.exit(1);
     return;
   }
   try {
-    const content = readFileSync12(configPath, "utf-8");
+    const content = readFileSync13(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       console.error("Error: massu.config.yaml is empty or not a valid YAML object");
@@ -15476,6 +15681,7 @@ var init_doctor = __esm({
     "use strict";
     init_config();
     init_license();
+    init_credentials();
     init_settings_local();
     init_hook_registry();
     __filename3 = fileURLToPath3(import.meta.url);
@@ -15484,6 +15690,114 @@ var init_doctor = __esm({
   }
 });
 
+// src/commands/login.ts
+var login_exports = {};
+__export(login_exports, {
+  runLogin: () => runLogin,
+  runLogout: () => runLogout
+});
+import { createInterface as createInterface2 } from "readline";
+function maskKey(k3) {
+  return k3.length <= 12 ? "****" : `${k3.slice(0, API_KEY_PREFIX.length)}\u2026${k3.slice(-4)}`;
+}
+function promptHidden(question) {
+  return new Promise((resolvePromise) => {
+    const rl = createInterface2({ input: process.stdin, output: process.stdout });
+    let promptWritten = false;
+    rl._writeToOutput = (chunk) => {
+      if (!promptWritten) {
+        rl.output.write(question);
+        promptWritten = true;
+      }
+      void chunk;
+    };
+    rl.question(question, (answer) => {
+      rl.close();
+      process.stdout.write("\n");
+      resolvePromise(answer);
+    });
+  });
+}
+async function readStdinKey() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function runLogin(argv) {
+  const keyFlagIdx = argv.indexOf("--key");
+  const noVerify = argv.includes("--no-verify");
+  let key;
+  if (keyFlagIdx >= 0 && argv[keyFlagIdx + 1]) {
+    key = argv[keyFlagIdx + 1];
+  } else if (process.stdin.isTTY) {
+    key = await promptHidden("Massu API key: ");
+  } else {
+    key = await readStdinKey();
+  }
+  key = (key ?? "").trim();
+  if (!key.startsWith(API_KEY_PREFIX)) {
+    console.error(`Error: API key must start with "${API_KEY_PREFIX}".`);
+    process.exit(1);
+    return;
+  }
+  const path = writeUserCredentials(key);
+  console.log(`
+Saved API key ${maskKey(key)} to ${path} (permissions 0600).`);
+  console.log("This file lives outside every repository \u2014 your key is never committed to git.");
+  if (!noVerify) {
+    try {
+      const { resetConfig: resetConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      resetConfig2();
+      const { validateLicense: validateLicense2 } = await Promise.resolve().then(() => (init_license(), license_exports));
+      const info = await validateLicense2(key);
+      if (info.tier !== "free") {
+        const cap = info.tier.charAt(0).toUpperCase() + info.tier.slice(1);
+        console.log(
+          `Verified: ${cap} tier${info.validUntil ? `, valid until ${info.validUntil}` : ""}.`
+        );
+      } else {
+        switch (info.outcome) {
+          case "server_error":
+            console.log(
+              "Saved, but could NOT verify your key: the license server returned an error."
+            );
+            console.log(
+              "This is NOT a Free determination \u2014 your tier is unknown. It will re-validate automatically on next use; if this persists, the license server may be down."
+            );
+            break;
+          case "network_error":
+          case "no_endpoint":
+            console.log(
+              "Saved; could not reach the license server right now (offline). Your key will validate automatically on next use."
+            );
+            break;
+          default:
+            console.log(
+              "Verified: this key is on the Free tier (check the key or your subscription at https://massu.ai/dashboard)."
+            );
+        }
+      }
+    } catch {
+      console.log("Saved; could not verify online right now (it will validate on next use).");
+    }
+  }
+  console.log("");
+}
+async function runLogout() {
+  const removed = removeUserCredentials();
+  console.log(
+    removed ? `Removed stored credentials at ${credentialsPath()}.` : "No stored credentials to remove."
+  );
+}
+var init_login = __esm({
+  "src/commands/login.ts"() {
+    "use strict";
+    init_credentials();
+  }
+});
+
 // src/commands/install-hooks.ts
 var install_hooks_exports = {};
 __export(install_hooks_exports, {
@@ -15515,8 +15829,8 @@ __export(hook_runner_exports, {
   resolveHookFile: () => resolveHookFile,
   runHookRunner: () => runHookRunner
 });
-import { existsSync as existsSync13 } from "fs";
-import { resolve as resolve9, dirname as dirname8 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { resolve as resolve10, dirname as dirname8 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { spawn } from "child_process";
 function resolveHookFile(hookName) {
@@ -15528,14 +15842,14 @@ function resolveHookFile(hookName) {
   }
   const candidates = [
     // Bundled compiled layout: dist/cli.js → ./hooks/<file>.js
-    resolve9(__dirname4, "hooks", file),
+    resolve10(__dirname4, "hooks", file),
     // TS-source dev / sibling layout: src/commands/ → ../hooks/<file>
-    resolve9(__dirname4, "../hooks", file),
+    resolve10(__dirname4, "../hooks", file),
     // TS-source dev fallback: src/commands/ → ../../dist/hooks/<file>
-    resolve9(__dirname4, "../../dist/hooks", file)
+    resolve10(__dirname4, "../../dist/hooks", file)
   ];
   for (const candidate of candidates) {
-    if (existsSync13(candidate)) {
+    if (existsSync14(candidate)) {
       return candidate;
     }
   }
@@ -15600,7 +15914,7 @@ __export(permissions_exports, {
   handlePermissionsSubcommand: () => handlePermissionsSubcommand,
   printPermissionsHelp: () => printPermissionsHelp
 });
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 function resolveClaudeDir2() {
   let claudeDirName = ".claude";
   try {
@@ -15608,7 +15922,7 @@ function resolveClaudeDir2() {
   } catch {
     claudeDirName = ".claude";
   }
-  return resolve10(process.cwd(), claudeDirName);
+  return resolve11(process.cwd(), claudeDirName);
 }
 async function handlePermissionsSubcommand(args2) {
   const sub = args2[0];
@@ -15738,8 +16052,8 @@ var init_auto_learning_entitlement = __esm({
 });
 
 // src/commands/license.ts
-var license_exports = {};
-__export(license_exports, {
+var license_exports2 = {};
+__export(license_exports2, {
   handleLicenseSubcommand: () => handleLicenseSubcommand,
   printLicenseHelp: () => printLicenseHelp
 });
@@ -15827,8 +16141,8 @@ var init_license2 = __esm({
 });
 
 // src/changelog-generator.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13, readdirSync as readdirSync12 } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14, readdirSync as readdirSync12 } from "fs";
+import { resolve as resolve12 } from "path";
 function parseCommitsForPlanTokens(subjects) {
   const tokens = /* @__PURE__ */ new Set();
   const maintenance = [];
@@ -15845,7 +16159,7 @@ function parseCommitsForPlanTokens(subjects) {
 function loadPlanSummaries(tokens, planDir) {
   const result = /* @__PURE__ */ new Map();
   if (tokens.size === 0) return result;
-  if (!existsSync14(planDir)) {
+  if (!existsSync15(planDir)) {
     throw new Error(`Plan directory does not exist: ${planDir}`);
   }
   const files = readdirSync12(planDir).filter((f2) => f2.endsWith(".md"));
@@ -15853,8 +16167,8 @@ function loadPlanSummaries(tokens, planDir) {
     let matchedFile = null;
     let content = "";
     for (const file of files) {
-      const path = resolve11(planDir, file);
-      const text18 = readFileSync13(path, "utf-8");
+      const path = resolve12(planDir, file);
+      const text18 = readFileSync14(path, "utf-8");
       const tokenRe = new RegExp(
         `^\\*\\*Plan Token\\*\\*:\\s*\`?${token.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\`?(\\s|$)`,
         "m"
@@ -15935,8 +16249,8 @@ __export(changelog_exports, {
   printChangelogHelp: () => printChangelogHelp
 });
 import { execSync } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { resolve as resolve13 } from "path";
 function resolveRepoRoot() {
   try {
     return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
@@ -15960,25 +16274,25 @@ function getCommitSubjects(range) {
   }
 }
 function getCurrentVersion(repoRoot) {
-  const pkgPath = resolve12(repoRoot, "packages/core/package.json");
-  if (!existsSync15(pkgPath)) return "0.0.0";
-  const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+  const pkgPath = resolve13(repoRoot, "packages/core/package.json");
+  if (!existsSync16(pkgPath)) return "0.0.0";
+  const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
   return pkg.version || "0.0.0";
 }
 function todayDate() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
 function getLatestChangelogEntryBody(repoRoot) {
-  const path = resolve12(repoRoot, "CHANGELOG.md");
-  if (!existsSync15(path)) return "";
-  const content = readFileSync14(path, "utf-8");
+  const path = resolve13(repoRoot, "CHANGELOG.md");
+  if (!existsSync16(path)) return "";
+  const content = readFileSync15(path, "utf-8");
   const m3 = content.match(/^## \[[\d.]+\][^\n]*\n([\s\S]*?)(?=\n## \[|$)/m);
   return m3 ? m3[1] : "";
 }
 async function handleChangelogSubcommand(args2) {
   const sub = args2[0];
   const repoRoot = resolveRepoRoot();
-  const planDir = resolve12(repoRoot, "docs/plans");
+  const planDir = resolve13(repoRoot, "docs/plans");
   switch (sub) {
     case "generate": {
       const lastTag = getLastTag();
@@ -16189,7 +16503,7 @@ var init_rule_pack_schema = __esm({
 });
 
 // src/rule-pack-sync.ts
-import { existsSync as existsSync16, writeFileSync as writeFileSync3, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync17, writeFileSync as writeFileSync4, mkdirSync as mkdirSync7 } from "fs";
 import { join as join11, dirname as dirname9 } from "path";
 async function pullInstalledPackRules(db, opts = {}) {
   const config = getConfig();
@@ -16252,7 +16566,7 @@ async function pullInstalledPackRules(db, opts = {}) {
       result.pulled += 1;
       const promptHash = packRulePromptHash(pack.slug, rule);
       const candidatePath = sidecarPath(projectRoot, promptHash);
-      if (existsSync16(candidatePath) || alreadyApplied(db, promptHash)) {
+      if (existsSync17(candidatePath) || alreadyApplied(db, promptHash)) {
         result.skipped += 1;
         continue;
       }
@@ -16340,8 +16654,8 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     draft_text: draftText
   };
   const dir = dirname9(candidatePath);
-  if (!existsSync16(dir)) mkdirSync6(dir, { recursive: true });
-  writeFileSync3(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
+  if (!existsSync17(dir)) mkdirSync7(dir, { recursive: true });
+  writeFileSync4(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
 }
 function emitDropTelemetry(db, eventType, data) {
   recordTelemetry(db, eventType, data);
@@ -16455,8 +16769,8 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve13 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve14 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
 }
@@ -16484,14 +16798,14 @@ async function runShowTemplate(args2) {
     return;
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
-  const file = suffix === "" ? resolve13(sourceDir, `${baseName}.md`) : resolve13(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync17(file)) {
+  const file = suffix === "" ? resolve14(sourceDir, `${baseName}.md`) : resolve14(sourceDir, `${baseName}${suffix}.md`);
+  if (!existsSync18(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync15(file, "utf-8"));
+  process.stdout.write(readFileSync16(file, "utf-8"));
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
@@ -16544,12 +16858,12 @@ var init_passthrough = __esm({
 });
 
 // src/lib/fileLock.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync16, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname10 } from "path";
 import * as lockfile from "proper-lockfile";
 function readLockHolderPid(lockPath) {
   try {
-    const raw = readFileSync16(`${lockPath}.pid`, "utf-8").trim();
+    const raw = readFileSync17(`${lockPath}.pid`, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
@@ -16568,7 +16882,7 @@ function busyWaitSync(ms) {
   Atomics.wait(view, 0, 0, ms);
 }
 function withFileLockSync(lockPath, fn, opts = {}) {
-  mkdirSync7(dirname10(lockPath), { recursive: true });
+  mkdirSync8(dirname10(lockPath), { recursive: true });
   const staleMs = opts.staleMs ?? 3e4;
   const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 100;
@@ -16585,7 +16899,7 @@ function withFileLockSync(lockPath, fn, opts = {}) {
         realpath: false
       });
       try {
-        writeFileSync4(`${lockPath}.pid`, String(process.pid), "utf-8");
+        writeFileSync5(`${lockPath}.pid`, String(process.pid), "utf-8");
       } catch {
       }
       break;
@@ -16612,7 +16926,7 @@ function withFileLockSync(lockPath, fn, opts = {}) {
     } catch {
     }
     try {
-      rmSync3(`${lockPath}.pid`, { force: true });
+      rmSync4(`${lockPath}.pid`, { force: true });
     } catch {
     }
   }
@@ -16640,9 +16954,9 @@ var init_fileLock = __esm({
 });
 
 // src/lib/installLock.ts
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 function withInstallLock(projectRoot, fn, opts = {}) {
-  const lockPath = resolve14(projectRoot, ".massu", "installAll.lock");
+  const lockPath = resolve15(projectRoot, ".massu", "installAll.lock");
   return withFileLockSync(
     lockPath,
     fn,
@@ -16682,8 +16996,8 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync18, readFileSync as readFileSync17, rmSync as rmSync4 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync18, rmSync as rmSync5 } from "fs";
+import { resolve as resolve16 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
   const out = {};
@@ -16811,17 +17125,17 @@ function renderDiff(diff) {
 }
 async function runConfigRefresh(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve15(cwd, "massu.config.yaml");
+  const configPath = resolve16(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync18(configPath)) {
+  if (!existsSync19(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
   }
   let existing;
   try {
-    const content = readFileSync17(configPath, "utf-8");
+    const content = readFileSync18(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -16894,10 +17208,10 @@ async function runConfigRefresh(opts = {}) {
 `);
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
-        const placeholderPath = resolve15(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync18(placeholderPath)) {
+        const placeholderPath = resolve16(installResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (existsSync19(placeholderPath)) {
           try {
-            rmSync4(placeholderPath, { force: true });
+            rmSync5(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
           } catch {
           }
@@ -17004,12 +17318,12 @@ var init_gitToplevel = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync19, statSync as statSync8 } from "fs";
-import { resolve as resolve16 } from "path";
+import { existsSync as existsSync20, statSync as statSync8 } from "fs";
+import { resolve as resolve17 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
-    const p19 = resolve16(projectRoot, lf);
-    if (!existsSync19(p19)) continue;
+    const p19 = resolve17(projectRoot, lf);
+    if (!existsSync20(p19)) continue;
     try {
       const stat = statSync8(p19);
       const delta = now - stat.mtimeMs;
@@ -17022,7 +17336,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync19(resolve16(projectRoot, ".git", s))) return true;
+    if (existsSync20(resolve17(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -17221,18 +17535,18 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync3, existsSync as existsSync20, fsyncSync as fsyncSync3, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync18, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync5, writeSync as writeSync3 } from "fs";
-import { dirname as dirname11, resolve as resolve17 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync21, fsyncSync as fsyncSync3, mkdirSync as mkdirSync9, openSync as openSync3, readFileSync as readFileSync19, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync6, writeSync as writeSync3 } from "fs";
+import { dirname as dirname11, resolve as resolve18 } from "path";
 function watchStatePath(projectRoot) {
-  return resolve17(projectRoot, ".massu", "watch-state.json");
+  return resolve18(projectRoot, ".massu", "watch-state.json");
 }
 function backupStatePath(projectRoot) {
-  return resolve17(projectRoot, ".massu", "watch-state.v0.bak.json");
+  return resolve18(projectRoot, ".massu", "watch-state.v0.bak.json");
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync20(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync18(path, "utf-8");
+  if (!existsSync21(path)) return { ...DEFAULT_STATE };
+  const content = readFileSync19(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -17274,14 +17588,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync8(dirname11(bak), { recursive: true });
-  writeFileSync5(bak, content, "utf-8");
+  mkdirSync9(dirname11(bak), { recursive: true });
+  writeFileSync6(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync8(dirname11(path), { recursive: true });
+  mkdirSync9(dirname11(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync3(tmp, "w");
@@ -17295,9 +17609,9 @@ function writeStateAtomic(projectRoot, state) {
     renameSync4(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync20(tmp)) {
+    if (!renamed && existsSync21(tmp)) {
       try {
-        rmSync5(tmp, { force: true });
+        rmSync6(tmp, { force: true });
       } catch {
       }
     }
@@ -17577,8 +17891,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename5, dirname as dirname12, resolve as resolve18 } from "path";
-import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync19 } from "fs";
+import { basename as basename5, dirname as dirname12, resolve as resolve19 } from "path";
+import { appendFileSync, existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync20 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -17603,8 +17917,8 @@ function parseFlags(args2) {
 }
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
-  const fixed = home ? resolve18(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync21(fixed)) return fixed;
+  const fixed = home ? resolve19(home, ".claude", "bin", "claude-bg") : null;
+  if (fixed && existsSync22(fixed)) return fixed;
   const which = spawnSync3("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -17665,7 +17979,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync21(path)) {
+  if (!existsSync22(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -17747,7 +18061,7 @@ async function runForeground(root) {
     }
     throw err;
   }
-  return new Promise((resolve41) => {
+  return new Promise((resolve42) => {
     const shutdown = async () => {
       if (stopped) return;
       stopped = true;
@@ -17757,7 +18071,7 @@ async function runForeground(root) {
         process.chdir(priorCwd);
       } catch {
       }
-      resolve41({ exitCode: 0 });
+      resolve42({ exitCode: 0 });
     };
     process.on("SIGINT", () => {
       void shutdown();
@@ -17818,23 +18132,23 @@ async function runOnQuiescent(projectRoot) {
   );
 }
 function refreshLogPath(projectRoot) {
-  return resolve18(projectRoot, ".massu", "refresh-log.jsonl");
+  return resolve19(projectRoot, ".massu", "refresh-log.jsonl");
 }
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync9(dirname12(path), { recursive: true });
+    mkdirSync10(dirname12(path), { recursive: true });
     appendFileSync(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync21(path)) return [];
+  if (!existsSync22(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync19(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync20(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out = [];
   let corrupt = 0;
@@ -17905,14 +18219,14 @@ var init_refresh_log = __esm({
 
 // src/security/atomic-write.ts
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   closeSync as closeSync4,
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   fsyncSync as fsyncSync4,
-  mkdirSync as mkdirSync10,
+  mkdirSync as mkdirSync11,
   openSync as openSync4,
   renameSync as renameSync5,
-  rmSync as rmSync6,
+  rmSync as rmSync7,
   statSync as statSync9,
   writeSync as writeSync4
 } from "node:fs";
@@ -17921,12 +18235,12 @@ function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
   const parentDir = dirname13(path);
   try {
-    if (!existsSync22(parentDir)) {
+    if (!existsSync23(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync10(parentDir, mkdirOpts);
+      mkdirSync11(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -17938,14 +18252,14 @@ function atomicWrite(path, content, opts = {}) {
       closeSync4(fd);
     }
     if (opts.mode !== void 0) {
-      chmodSync3(tmpPath, opts.mode);
+      chmodSync4(tmpPath, opts.mode);
     }
     renameSync5(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync22(tmpPath)) {
+    if (existsSync23(tmpPath)) {
       try {
-        rmSync6(tmpPath, { force: true });
+        rmSync7(tmpPath, { force: true });
       } catch {
       }
     }
@@ -18292,24 +18606,24 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync23, readFileSync as readFileSync20, statSync as statSync10 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { resolve as resolve19 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync21, statSync as statSync10 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { resolve as resolve20 } from "node:path";
 import { z as z4 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve19(homedir5(), ".massu");
+  const dir = resolve20(homedir6(), ".massu");
   return {
-    cachePath: resolve19(dir, "adapter-manifest.json"),
-    lockPath: resolve19(dir, ".adapter-manifest.lock")
+    cachePath: resolve20(dir, "adapter-manifest.json"),
+    lockPath: resolve20(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync23(paths.cachePath)) {
+  if (!existsSync24(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
   try {
-    const content = readFileSync20(paths.cachePath, "utf-8");
+    const content = readFileSync21(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err) {
     return {
@@ -18498,15 +18812,15 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync24, readFileSync as readFileSync21, lstatSync as lstatSync5 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { resolve as resolve20, isAbsolute } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync22, lstatSync as lstatSync5 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { resolve as resolve21, isAbsolute } from "node:path";
 import { createHash as createHash7 } from "node:crypto";
 import { z as z5 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
   for (const p19 of localPaths) {
-    const abs = isAbsolute(p19) ? p19 : resolve20(projectRoot, p19);
+    const abs = isAbsolute(p19) ? p19 : resolve21(projectRoot, p19);
     let contentTag;
     try {
       const lst = lstatSync5(abs);
@@ -18515,7 +18829,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash7("sha256").update(readFileSync21(abs)).digest("hex");
+        contentTag = createHash7("sha256").update(readFileSync22(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -18527,10 +18841,10 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   return createHash7("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync24(path)) return null;
+  if (!existsSync25(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync21(path, "utf-8"));
+    raw = JSON.parse(readFileSync22(path, "utf-8"));
   } catch {
     return null;
   }
@@ -18578,7 +18892,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve20(homedir6(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve21(homedir7(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z5.object({
       fingerprint: z5.string().regex(/^[0-9a-f]{64}$/),
       source: z5.enum(["cli", "cli-resync"]),
@@ -18594,15 +18908,15 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync22, readdirSync as readdirSync13, lstatSync as lstatSync6, existsSync as existsSync25 } from "node:fs";
+import { readFileSync as readFileSync23, readdirSync as readdirSync13, lstatSync as lstatSync6, existsSync as existsSync26 } from "node:fs";
 import { join as join12, relative as relative5, sep } from "node:path";
-import { homedir as homedir7 } from "node:os";
-import { resolve as resolve21 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { resolve as resolve22 } from "node:path";
 import { createHash as createHash8 } from "node:crypto";
 import { z as z6 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync25(`${packageDir}/${hidden}`)) {
+    if (existsSync26(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -18648,7 +18962,7 @@ function sha256OfDir(dir, opts = {}) {
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
   const top = createHash8("sha256");
   for (const f2 of files) {
-    const fileHash = createHash8("sha256").update(readFileSync22(f2.absPath)).digest("hex");
+    const fileHash = createHash8("sha256").update(readFileSync23(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -18657,10 +18971,10 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync25(path)) return {};
+  if (!existsSync26(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync22(path, "utf-8"));
+    raw = JSON.parse(readFileSync23(path, "utf-8"));
   } catch {
     return {};
   }
@@ -18724,7 +19038,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve21(homedir7(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve22(homedir8(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z6.object({
@@ -18747,12 +19061,12 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync23, lstatSync as lstatSync7 } from "node:fs";
-import { resolve as resolve22, isAbsolute as isAbsolute2 } from "node:path";
+import { existsSync as existsSync27, readdirSync as readdirSync14, readFileSync as readFileSync24, lstatSync as lstatSync7 } from "node:fs";
+import { resolve as resolve23, isAbsolute as isAbsolute2 } from "node:path";
 import { z as z7 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
-  const nodeModulesDir = resolve22(projectRoot, "node_modules");
-  if (!existsSync26(nodeModulesDir)) {
+  const nodeModulesDir = resolve23(projectRoot, "node_modules");
+  if (!existsSync27(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
@@ -18765,7 +19079,7 @@ function walkNodeModules(projectRoot, warnings) {
   }
   for (const entry of topLevelEntries) {
     if (entry.startsWith(".")) continue;
-    const entryPath = resolve22(nodeModulesDir, entry);
+    const entryPath = resolve23(nodeModulesDir, entry);
     let entryStat;
     try {
       entryStat = lstatSync7(entryPath);
@@ -18787,7 +19101,7 @@ function walkNodeModules(projectRoot, warnings) {
         continue;
       }
       for (const sub of scopedEntries) {
-        const subPath = resolve22(entryPath, sub);
+        const subPath = resolve23(entryPath, sub);
         let subStat;
         try {
           subStat = lstatSync7(subPath);
@@ -18806,11 +19120,11 @@ function walkNodeModules(projectRoot, warnings) {
   return candidates;
 }
 function tryReadAdapterPackage(packageDir, warnings) {
-  const pkgJsonPath = resolve22(packageDir, "package.json");
-  if (!existsSync26(pkgJsonPath)) return null;
+  const pkgJsonPath = resolve23(packageDir, "package.json");
+  if (!existsSync27(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync23(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync24(pkgJsonPath, "utf-8"));
   } catch (err) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err instanceof Error ? err.message : String(err)})`
@@ -18944,8 +19258,8 @@ function discoverAdapters(opts) {
   const localSet = new Set(opts.configLocalPaths);
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
-    const absPath = isAbsolute2(localPath) ? localPath : resolve22(opts.projectRoot, localPath);
-    if (!existsSync26(absPath)) {
+    const absPath = isAbsolute2(localPath) ? localPath : resolve23(opts.projectRoot, localPath);
+    if (!existsSync27(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -19027,8 +19341,8 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
-import { resolve as resolve23 } from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync25 } from "node:fs";
+import { resolve as resolve24 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
   const sub = args2[0];
@@ -19295,8 +19609,8 @@ function mutateLocalArray(mutator, command) {
     );
     return { exitCode: 2 };
   }
-  const yamlPath = resolve23(projectRoot, "massu.config.yaml");
-  if (!existsSync27(yamlPath)) {
+  const yamlPath = resolve24(projectRoot, "massu.config.yaml");
+  if (!existsSync28(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -19305,7 +19619,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync24(yamlPath, "utf-8");
+    yamlText = readFileSync25(yamlPath, "utf-8");
   } catch (err) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -19326,7 +19640,7 @@ function mutateLocalArray(mutator, command) {
   if (next === null) {
     return { exitCode: 0 };
   }
-  const lockPath = resolve23(projectRoot, ".massu", "adapters-local-mutate.lock");
+  const lockPath = resolve24(projectRoot, ".massu", "adapters-local-mutate.lock");
   return withFileLockSync(lockPath, () => {
     doc.setIn(["adapters", "local"], next);
     const newYaml = doc.toString();
@@ -19395,23 +19709,23 @@ async function runAdaptersInstall(args2) {
 `);
     return { exitCode: 1 };
   }
-  const packageDir = resolve23(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync27(packageDir)) {
+  const packageDir = resolve24(projectRoot, "node_modules", ...packageName.split("/"));
+  if (!existsSync28(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
     );
     return { exitCode: 1 };
   }
-  const pkgJsonPath = resolve23(packageDir, "package.json");
-  if (!existsSync27(pkgJsonPath)) {
+  const pkgJsonPath = resolve24(packageDir, "package.json");
+  if (!existsSync28(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync24(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync25(pkgJsonPath, "utf-8"));
   } catch (err) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -19530,8 +19844,8 @@ async function runAdaptersResign(_args) {
       removeInstalledManifestEntry(name);
       continue;
     }
-    const packageDir = resolve23(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync27(packageDir)) {
+    const packageDir = resolve24(projectRoot, "node_modules", ...name.split("/"));
+    if (!existsSync28(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -19630,10 +19944,10 @@ var init_sql_table_names = __esm({
 // src/db.ts
 import Database2 from "better-sqlite3";
 import { dirname as dirname14, join as join13 } from "path";
-import { existsSync as existsSync28, mkdirSync as mkdirSync11, readdirSync as readdirSync15, statSync as statSync11 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync12, readdirSync as readdirSync15, statSync as statSync11 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
-  if (!existsSync28(dbPath)) {
+  if (!existsSync29(dbPath)) {
     throw new CodegraphDbNotInitializedError(dbPath);
   }
   const db = new Database2(dbPath, { readonly: true });
@@ -19643,8 +19957,8 @@ function getCodeGraphDb() {
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
   const dir = dirname14(dbPath);
-  if (!existsSync28(dir)) {
-    mkdirSync11(dir, { recursive: true });
+  if (!existsSync29(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   const db = new Database2(dbPath);
   db.pragma("journal_mode = WAL");
@@ -19953,12 +20267,12 @@ var init_db = __esm({
 // src/knowledge-db.ts
 import Database3 from "better-sqlite3";
 import { dirname as dirname15 } from "path";
-import { existsSync as existsSync29, mkdirSync as mkdirSync12 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync13 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
   const dir = dirname15(dbPath);
-  if (!existsSync29(dir)) {
-    mkdirSync12(dir, { recursive: true });
+  if (!existsSync30(dir)) {
+    mkdirSync13(dir, { recursive: true });
   }
   const db = new Database3(dbPath);
   db.pragma("journal_mode = WAL");
@@ -20129,10 +20443,10 @@ var init_knowledge_db = __esm({
 });
 
 // src/security-utils.ts
-import { resolve as resolve24, normalize } from "path";
+import { resolve as resolve25, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
-  const resolvedRoot = resolve24(projectRoot);
-  const resolvedPath = resolve24(resolvedRoot, filePath);
+  const resolvedRoot = resolve25(projectRoot);
+  const resolvedPath = resolve25(resolvedRoot, filePath);
   const normalizedPath = normalize(resolvedPath);
   const normalizedRoot = normalize(resolvedRoot);
   if (!normalizedPath.startsWith(normalizedRoot + "/") && normalizedPath !== normalizedRoot) {
@@ -20205,8 +20519,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync25, existsSync as existsSync30, statSync as statSync12 } from "fs";
-import { resolve as resolve25, dirname as dirname16, join as join14 } from "path";
+import { readFileSync as readFileSync26, existsSync as existsSync31, statSync as statSync12 } from "fs";
+import { resolve as resolve26, dirname as dirname16, join as join14 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -20262,23 +20576,23 @@ function resolveImportPath(specifier, fromFile) {
   let basePath;
   if (specifier.startsWith("@/")) {
     const paths = getResolvedPaths();
-    basePath = resolve25(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
+    basePath = resolve26(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve25(dirname16(fromFile), specifier);
+    basePath = resolve26(dirname16(fromFile), specifier);
   }
-  if (existsSync30(basePath) && !isDirectory(basePath)) {
+  if (existsSync31(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync30(withExt)) {
+    if (existsSync31(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join14(basePath, indexFile);
-    if (existsSync30(indexPath)) {
+    if (existsSync31(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -20314,11 +20628,11 @@ function buildImportIndex(dataDb, codegraphDb) {
   const batchSize = 500;
   let batch = [];
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve25(projectRoot, file.path), projectRoot);
-    if (!existsSync30(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve26(projectRoot, file.path), projectRoot);
+    if (!existsSync31(absPath)) continue;
     let source;
     try {
-      source = readFileSync25(absPath, "utf-8");
+      source = readFileSync26(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -20355,15 +20669,15 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync31, readdirSync as readdirSync16 } from "fs";
-import { resolve as resolve26, join as join15 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync32, readdirSync as readdirSync16 } from "fs";
+import { resolve as resolve27, join as join15 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync31(rootPath)) {
+  if (!existsSync32(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync26(rootPath, "utf-8");
+  const source = readFileSync27(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -20371,16 +20685,16 @@ function parseRootRouter() {
   while ((match = importRegex.exec(source)) !== null) {
     const variable = match[1];
     let filePath = match[2];
-    const fullPath = resolve26(paths.routersDir, filePath);
+    const fullPath = resolve27(paths.routersDir, filePath);
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync31(candidate)) {
+      if (existsSync32(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
       const indexCandidate = join15(fullPath, "index.ts");
-      if (existsSync31(indexCandidate)) {
+      if (existsSync32(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -20399,9 +20713,9 @@ function parseRootRouter() {
   return mappings;
 }
 function extractProcedures(routerFilePath) {
-  const absPath = resolve26(getProjectRoot(), routerFilePath);
-  if (!existsSync31(absPath)) return [];
-  const source = readFileSync26(absPath, "utf-8");
+  const absPath = resolve27(getProjectRoot(), routerFilePath);
+  if (!existsSync32(absPath)) return [];
+  const source = readFileSync27(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -20424,13 +20738,13 @@ function findUICallSites(routerKey, procedureName) {
   const root = getProjectRoot();
   const src = config.paths.source;
   const searchDirs = [
-    resolve26(root, config.paths.pages ?? src + "/app"),
-    resolve26(root, config.paths.components ?? src + "/components"),
-    resolve26(root, config.paths.hooks ?? src + "/hooks")
+    resolve27(root, config.paths.pages ?? src + "/app"),
+    resolve27(root, config.paths.components ?? src + "/components"),
+    resolve27(root, config.paths.hooks ?? src + "/hooks")
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync31(dir)) continue;
+    if (!existsSync32(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -20444,7 +20758,7 @@ function searchDirectory(dir, pattern, results) {
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync26(fullPath, "utf-8");
+        const source = readFileSync27(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (lines[i].includes(pattern)) {
@@ -20508,8 +20822,8 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync27, existsSync as existsSync32 } from "fs";
-import { resolve as resolve27 } from "path";
+import { readFileSync as readFileSync28, existsSync as existsSync33 } from "fs";
+import { resolve as resolve28 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
   return route || "/";
@@ -20547,10 +20861,10 @@ function findRouterCalls(files) {
   const routers = /* @__PURE__ */ new Set();
   const projectRoot = getProjectRoot();
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve27(projectRoot, file), projectRoot);
-    if (!existsSync32(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve28(projectRoot, file), projectRoot);
+    if (!existsSync33(absPath)) continue;
     try {
-      const source = readFileSync27(absPath, "utf-8");
+      const source = readFileSync28(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -20568,10 +20882,10 @@ function findTablesFromRouters(routerNames, dataDb) {
       `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ? LIMIT 10000`
     ).all(routerName);
     for (const proc of procs) {
-      const absPath = ensureWithinRoot(resolve27(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync32(absPath)) continue;
+      const absPath = ensureWithinRoot(resolve28(getProjectRoot(), proc.router_file), getProjectRoot());
+      if (!existsSync33(absPath)) continue;
       try {
-        const source = readFileSync27(absPath, "utf-8");
+        const source = readFileSync28(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -20843,14 +21157,14 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync28, existsSync as existsSync33, readdirSync as readdirSync17 } from "fs";
+import { readFileSync as readFileSync29, existsSync as existsSync34, readdirSync as readdirSync17 } from "fs";
 import { join as join16 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync33(schemaPath)) {
+  if (!existsSync34(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync28(schemaPath, "utf-8");
+  const source = readFileSync29(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i = 0;
@@ -20908,7 +21222,7 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync33(routersDir)) return usage;
+  if (!existsSync34(routersDir)) return usage;
   scanDirectory(routersDir, tableName, usage);
   return usage;
 }
@@ -20925,7 +21239,7 @@ function scanDirectory(dir, tableName, usage) {
 }
 function scanFile(absPath, tableName, usage) {
   try {
-    const source = readFileSync28(absPath, "utf-8");
+    const source = readFileSync29(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -20970,7 +21284,7 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync33(dir)) return result;
+  if (!existsSync34(dir)) return result;
   const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join16(dir, entry.name);
@@ -20978,7 +21292,7 @@ function findFilesUsingColumn(dir, column, tableName) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync28(fullPath, "utf-8");
+        const source = readFileSync29(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -21123,12 +21437,12 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync29, existsSync as existsSync34, readdirSync as readdirSync18 } from "fs";
-import { resolve as resolve29, join as join17, relative as relative6, dirname as dirname17 } from "path";
+import { readFileSync as readFileSync30, existsSync as existsSync35, readdirSync as readdirSync18 } from "fs";
+import { resolve as resolve30, join as join17, relative as relative6, dirname as dirname17 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname17(resolve29(projectRoot, fromFile));
+    let baseDir = dirname17(resolve30(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
       baseDir = dirname17(baseDir);
     }
@@ -21140,17 +21454,17 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join17(resolve29(projectRoot, pythonRoot), ...parts);
+  const candidate = join17(resolve30(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync34(basePath + ".py")) {
+  if (existsSync35(basePath + ".py")) {
     return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync34(join17(basePath, "__init__.py"))) {
+  if (existsSync35(join17(basePath, "__init__.py"))) {
     return relative6(projectRoot, join17(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync34(basePath)) {
+  if (basePath.endsWith(".py") && existsSync35(basePath)) {
     return relative6(projectRoot, basePath);
   }
   return null;
@@ -21173,7 +21487,7 @@ function walkPythonFiles(dir, excludeDirs) {
 }
 function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = resolve29(projectRoot, pythonRoot);
+  const absRoot = resolve30(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_imports")}`);
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("py_imports")} (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)`
@@ -21190,7 +21504,7 @@ function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__"
     const relFile = relative6(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync29(absFile, "utf-8");
+      source = readFileSync30(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -21457,7 +21771,7 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync19 } from "fs";
+import { readFileSync as readFileSync31, readdirSync as readdirSync19 } from "fs";
 import { join as join18, relative as relative7 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
@@ -21490,7 +21804,7 @@ function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative7(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync30(absFile, "utf-8");
+        source = readFileSync31(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -21702,7 +22016,7 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync31, readdirSync as readdirSync20 } from "fs";
+import { readFileSync as readFileSync32, readdirSync as readdirSync20 } from "fs";
 import { join as join19, relative as relative8 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
@@ -21738,7 +22052,7 @@ function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative8(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync31(absFile, "utf-8");
+        source = readFileSync32(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -21999,7 +22313,7 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync21 } from "fs";
+import { readFileSync as readFileSync33, readdirSync as readdirSync21 } from "fs";
 import { join as join20, relative as relative9 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
@@ -22025,7 +22339,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync32(absFile, "utf-8");
+      source = readFileSync33(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -22060,7 +22374,7 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync33, readdirSync as readdirSync22 } from "fs";
+import { readFileSync as readFileSync34, readdirSync as readdirSync22 } from "fs";
 import { join as join21, relative as relative10 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
@@ -22097,7 +22411,7 @@ function buildPythonCouplingIndex(dataDb) {
       const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync33(absFile, "utf-8");
+        source = readFileSync34(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -22503,8 +22817,8 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync34, existsSync as existsSync35 } from "fs";
-import { resolve as resolve30, basename as basename6 } from "path";
+import { readFileSync as readFileSync35, existsSync as existsSync36 } from "fs";
+import { resolve as resolve31, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -22559,10 +22873,10 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync35(mapPath)) {
+  if (!existsSync36(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync34(mapPath, "utf-8"));
+  return JSON.parse(readFileSync35(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -22632,13 +22946,13 @@ function extractFrontmatter(content) {
 }
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
-  const absPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync35(absPath)) {
-    const altPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
-    if (!existsSync35(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync34(altPath, "utf-8"));
+  const absPath = ensureWithinRoot(resolve31(getResolvedPaths().srcDir, "..", routerPath), root);
+  if (!existsSync36(absPath)) {
+    const altPath = ensureWithinRoot(resolve31(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
+    if (!existsSync36(altPath)) return [];
+    return extractProcedureNamesFromContent(readFileSync35(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync34(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync35(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -22678,8 +22992,8 @@ function handleDocsAudit(args2) {
   for (const [mappingId, triggeringFiles] of affectedMappings) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
-    const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync35(helpPagePath)) {
+    const helpPagePath = ensureWithinRoot(resolve31(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    if (!existsSync36(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -22691,7 +23005,7 @@ function handleDocsAudit(args2) {
       });
       continue;
     }
-    const content = readFileSync34(helpPagePath, "utf-8");
+    const content = readFileSync35(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
@@ -22731,9 +23045,9 @@ function handleDocsAudit(args2) {
     });
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
-        const guidePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync35(guidePath)) {
-          const guideContent = readFileSync34(guidePath, "utf-8");
+        const guidePath = ensureWithinRoot(resolve31(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
+        if (existsSync36(guidePath)) {
+          const guideContent = readFileSync35(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -22766,14 +23080,14 @@ function handleDocsCoverage(args2) {
   const gaps = [];
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
-    const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync35(helpPagePath);
+    const helpPagePath = ensureWithinRoot(resolve31(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    const exists = existsSync36(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync34(helpPagePath, "utf-8");
+      const content = readFileSync35(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -23114,8 +23428,8 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync36 } from "fs";
-import { resolve as resolve31 } from "path";
+import { existsSync as existsSync37 } from "fs";
+import { resolve as resolve32 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
   try {
@@ -23351,23 +23665,23 @@ function validateFeatures(db, domainFilter) {
     const missingProcedures = [];
     const missingPages = [];
     for (const comp of components) {
-      const absPath = resolve31(PROJECT_ROOT, comp.component_file);
-      if (!existsSync36(absPath)) {
+      const absPath = resolve32(PROJECT_ROOT, comp.component_file);
+      if (!existsSync37(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
-      const routerPath = resolve31(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync36(routerPath)) {
+      const routerPath = resolve32(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
+      if (!existsSync37(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
-      const absPath = resolve31(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync36(absPath)) {
-        const altPath = resolve31(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync36(altPath)) {
+      const absPath = resolve32(PROJECT_ROOT, routeToPath);
+      if (page.page_route.startsWith("/") && !existsSync37(absPath)) {
+        const altPath = resolve32(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
+        if (!existsSync37(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -23893,8 +24207,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync35, existsSync as existsSync37, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
-import { resolve as resolve32, join as join22, basename as basename7, dirname as dirname18, relative as relative11 } from "path";
+import { readFileSync as readFileSync36, existsSync as existsSync38, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
+import { resolve as resolve33, join as join22, basename as basename7, dirname as dirname18, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -24025,8 +24339,8 @@ function scanComponentExports(dataDb) {
   const projectRoot = getProjectRoot();
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
-  const basePath = resolve32(projectRoot, componentsBase);
-  if (existsSync37(basePath)) {
+  const basePath = resolve33(projectRoot, componentsBase);
+  if (existsSync38(basePath)) {
     try {
       const entries = readdirSync23(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -24038,12 +24352,12 @@ function scanComponentExports(dataDb) {
     }
   }
   for (const dir of componentDirs) {
-    const absDir = resolve32(projectRoot, dir);
-    if (!existsSync37(absDir)) continue;
+    const absDir = resolve33(projectRoot, dir);
+    if (!existsSync38(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative11(projectRoot, file);
-      const source = readFileSync35(file, "utf-8");
+      const source = readFileSync36(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -25086,7 +25400,7 @@ var init_audit_trail = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync38, readFileSync as readFileSync36 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync37 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -25117,7 +25431,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync38(absPath)) {
+  if (!existsSync39(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -25126,7 +25440,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync36(absPath, "utf-8");
+  const source = readFileSync37(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -25572,7 +25886,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync39, readFileSync as readFileSync37 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync38 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -25596,12 +25910,12 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync39(absPath)) {
+  if (!existsSync40(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
   try {
-    source = readFileSync37(absPath, "utf-8");
+    source = readFileSync38(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -25891,8 +26205,8 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync40, readFileSync as readFileSync38 } from "fs";
-import { resolve as resolve33 } from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync39 } from "fs";
+import { resolve as resolve34 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -25924,10 +26238,10 @@ function calculateDepRisk(factors) {
   return Math.min(100, risk);
 }
 function getInstalledPackages(projectRoot) {
-  const pkgPath = resolve33(projectRoot, "package.json");
-  if (!existsSync40(pkgPath)) return /* @__PURE__ */ new Map();
+  const pkgPath = resolve34(projectRoot, "package.json");
+  if (!existsSync41(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync38(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync39(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name, version);
@@ -26533,8 +26847,8 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash9 } from "crypto";
-import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync41 } from "fs";
-import { resolve as resolve34, relative as relative12, basename as basename8, extname as extname2 } from "path";
+import { readFileSync as readFileSync40, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync42 } from "fs";
+import { resolve as resolve35, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -26562,7 +26876,7 @@ function discoverMarkdownFiles(baseDir) {
     try {
       const entries = readdirSync24(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = resolve34(dir, entry.name);
+        const fullPath = resolve35(dir, entry.name);
         if (entry.isDirectory()) {
           if (entry.name === "archive" && dir.includes("session-state")) continue;
           if (entry.name === "archive" && dir.includes("status")) continue;
@@ -26841,11 +27155,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync41(paths.plansDir)) {
+  if (existsSync42(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync41(paths.docsDir)) {
+  if (existsSync42(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -26888,8 +27202,8 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync41(filePath)) continue;
-      const content = readFileSync39(filePath, "utf-8");
+      if (!existsSync42(filePath)) continue;
+      const content = readFileSync40(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
       const category = categorizeFile(filePath);
@@ -27024,10 +27338,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync41(paths.plansDir)) {
+  if (existsSync42(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync41(paths.docsDir)) {
+  if (existsSync42(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -27056,8 +27370,8 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync40, writeFileSync as writeFileSync6, appendFileSync as appendFileSync2, readdirSync as readdirSync25 } from "fs";
-import { resolve as resolve35, basename as basename9 } from "path";
+import { readFileSync as readFileSync41, writeFileSync as writeFileSync7, appendFileSync as appendFileSync2, readdirSync as readdirSync25 } from "fs";
+import { resolve as resolve36, basename as basename9 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -27796,7 +28110,7 @@ function handleCorrect(db, args2) {
   if (!wrong || !correction || !rule) {
     return text15("Error: wrong, correction, and rule are all required.");
   }
-  const correctionsPath = resolve35(getResolvedPaths().memoryDir, "corrections.md");
+  const correctionsPath = resolve36(getResolvedPaths().memoryDir, "corrections.md");
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const title = rule.slice(0, 60);
   const entry = `
@@ -27809,14 +28123,14 @@ ${crRule ? `- **CR**: ${crRule}
 `;
   let existing = "";
   try {
-    existing = readFileSync40(correctionsPath, "utf-8");
+    existing = readFileSync41(correctionsPath, "utf-8");
   } catch {
   }
   const archiveIdx = existing.indexOf("## Archived");
   if (archiveIdx > 0) {
     const before = existing.slice(0, archiveIdx);
     const after = existing.slice(archiveIdx);
-    writeFileSync6(correctionsPath, before + entry + after);
+    writeFileSync7(correctionsPath, before + entry + after);
   } else {
     appendFileSync2(correctionsPath, entry);
   }
@@ -28764,8 +29078,8 @@ var init_framework_supports = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync41, existsSync as existsSync43 } from "fs";
-import { resolve as resolve36, basename as basename10 } from "path";
+import { readFileSync as readFileSync42, existsSync as existsSync44 } from "fs";
+import { resolve as resolve37, basename as basename10 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
 }
@@ -28800,7 +29114,7 @@ function ensureIndexes(dataDb, codegraphDb, force = false) {
   if (config.python?.root) {
     const pythonRoot = config.python.root;
     const excludeDirs = config.python.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
-    if (force || isPythonDataStale(dataDb, resolve36(getProjectRoot(), pythonRoot))) {
+    if (force || isPythonDataStale(dataDb, resolve37(getProjectRoot(), pythonRoot))) {
       const pyImports = buildPythonImportIndex(dataDb, pythonRoot, excludeDirs);
       results.push(`Python imports: ${pyImports}`);
       const pyRoutes = buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs);
@@ -29183,9 +29497,9 @@ function handleContext(file, dataDb, codegraphDb) {
         try {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
-          const absFilePath = ensureWithinRoot(resolve36(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync43(absFilePath)) {
-            const fileContent = readFileSync41(absFilePath, "utf-8").slice(0, 3e3);
+          const absFilePath = ensureWithinRoot(resolve37(resolvedPaths.srcDir, "..", file), root);
+          if (existsSync44(absFilePath)) {
+            const fileContent = readFileSync42(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -29622,11 +29936,11 @@ function handleSchema(args2) {
     lines.push("Checking all column references against Prisma schema...");
     lines.push("");
     const projectRoot = getProjectRoot();
-    const absPath = ensureWithinRoot(resolve36(projectRoot, file), projectRoot);
-    if (!existsSync43(absPath)) {
+    const absPath = ensureWithinRoot(resolve37(projectRoot, file), projectRoot);
+    if (!existsSync44(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync41(absPath, "utf-8");
+    const source = readFileSync42(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -30031,8 +30345,8 @@ var init_server_dispatch = __esm({
 
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync42 } from "fs";
-import { resolve as resolve37, dirname as dirname19 } from "path";
+import { readFileSync as readFileSync43 } from "fs";
+import { resolve as resolve38, dirname as dirname19 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -30067,7 +30381,7 @@ var init_server = __esm({
     __dirname5 = dirname19(fileURLToPath5(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync42(resolve37(__dirname5, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync43(resolve38(__dirname5, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -30353,19 +30667,19 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync44, readFileSync as readFileSync43, writeFileSync as writeFileSync7, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
-import { resolve as resolve38 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync44, writeFileSync as writeFileSync8, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
+import { resolve as resolve39 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve38(cwd, "massu.config.yaml");
+  const configPath = resolve39(cwd, "massu.config.yaml");
   const bakPath = `${configPath}.bak`;
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync44(bakPath)) {
+    if (!existsSync45(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
@@ -30381,14 +30695,14 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync44(configPath)) {
+  if (!existsSync45(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
   }
   let existing;
   try {
-    const content = readFileSync43(configPath, "utf-8");
+    const content = readFileSync44(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -30411,8 +30725,8 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync43(configPath, "utf-8");
-    writeFileSync7(bakPath, original, "utf-8");
+    const original = readFileSync44(configPath, "utf-8");
+    writeFileSync8(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
     err(message + "\n");
@@ -30445,8 +30759,8 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync45, readFileSync as readFileSync44 } from "fs";
-import { resolve as resolve39 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync45 } from "fs";
+import { resolve as resolve40 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
   if (changes.length === 0) return "(none)\n";
@@ -30454,12 +30768,12 @@ function renderChanges(changes) {
 }
 async function runConfigCheckDrift(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve39(cwd, "massu.config.yaml");
+  const configPath = resolve40(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync45(configPath)) {
+  if (!existsSync46(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -30473,7 +30787,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync44(configPath, "utf-8");
+    const content = readFileSync45(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -30540,8 +30854,8 @@ var init_config_check_drift = __esm({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync45 } from "fs";
-import { resolve as resolve40, dirname as dirname20 } from "path";
+import { readFileSync as readFileSync46 } from "fs";
+import { resolve as resolve41, dirname as dirname20 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var __filename5 = fileURLToPath6(import.meta.url);
 var __dirname6 = dirname20(__filename5);
@@ -30559,6 +30873,16 @@ async function main() {
       await runDoctor2();
       break;
     }
+    case "login": {
+      const { runLogin: runLogin2 } = await Promise.resolve().then(() => (init_login(), login_exports));
+      await runLogin2(args.slice(1));
+      break;
+    }
+    case "logout": {
+      const { runLogout: runLogout2 } = await Promise.resolve().then(() => (init_login(), login_exports));
+      await runLogout2();
+      break;
+    }
     case "install-hooks": {
       const { runInstallHooks: runInstallHooks2 } = await Promise.resolve().then(() => (init_install_hooks(), install_hooks_exports));
       await runInstallHooks2();
@@ -30582,7 +30906,7 @@ async function main() {
       return;
     }
     case "license": {
-      const { handleLicenseSubcommand: handleLicenseSubcommand2 } = await Promise.resolve().then(() => (init_license2(), license_exports));
+      const { handleLicenseSubcommand: handleLicenseSubcommand2 } = await Promise.resolve().then(() => (init_license2(), license_exports2));
       const result = await handleLicenseSubcommand2(args.slice(1));
       process.exit(result.exitCode);
       return;
@@ -30719,6 +31043,10 @@ Usage:
 Commands:
   init              Set up Massu AI in your project (one command, full setup)
   doctor            Check installation health
+  login             Store your API key user-level in ~/.massu/credentials (git-safe).
+                    Prefer the interactive prompt or MASSU_API_KEY env; --key <k>
+                    exposes the key to shell history. Use --no-verify to skip online check.
+  logout            Remove the stored user-level API key
   install-hooks     Install/update Claude Code hooks
   install-commands  Install/update slash commands (use --skip-permissions to opt out of MCP allowlist seeding)
   show-template     Print the resolved variant of a bundled template (e.g. for diffs)
@@ -30769,7 +31097,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync45(resolve40(__dirname6, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync46(resolve41(__dirname6, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");