npm - @massu/core - Versions diffs - 1.7.0 → 1.8.0 - Mend

@massu/core 1.7.0 → 1.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +72 -0
package/dist/cli.js +991 -582
package/package.json +1 -1
package/src/cli.ts +8 -1
package/src/commands/doctor.ts +4 -3
package/src/commands/init.ts +3 -10
package/src/commands/install-commands.ts +62 -53
package/src/commands/permissions.ts +150 -0
package/src/lib/settings-local.ts +110 -0
package/src/permissions.ts +422 -0
package/src/security/registry-pubkey.generated.ts +1 -1

package/dist/cli.js CHANGED Viewed

@@ -1910,6 +1910,283 @@ var init_template_engine = __esm({
   }
 });
+// src/lib/settings-local.ts
+import {
+  closeSync,
+  existsSync as existsSync4,
+  fsyncSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync3,
+  renameSync,
+  rmSync,
+  writeSync
+} from "fs";
+import { dirname as dirname3, resolve as resolve3 } from "path";
+function atomicWriteFile(targetPath, content, mode = 420) {
+  const tmpPath = `${targetPath}.${process.pid}.tmp`;
+  try {
+    const fd = openSync(tmpPath, "w", mode);
+    try {
+      const buf = Buffer.from(content, "utf-8");
+      writeSync(fd, buf, 0, buf.length, 0);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync(tmpPath, targetPath);
+  } catch (err) {
+    if (existsSync4(tmpPath)) {
+      try {
+        rmSync(tmpPath, { force: true });
+      } catch {
+      }
+    }
+    throw err;
+  }
+}
+function readSettingsAtPath(absolutePath) {
+  if (!existsSync4(absolutePath)) {
+    return {};
+  }
+  try {
+    const raw = readFileSync3(absolutePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {};
+    }
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+function readSettingsLocal(claudeDir) {
+  return readSettingsAtPath(resolve3(claudeDir, "settings.local.json"));
+}
+function writeSettingsLocalAtomic(claudeDir, settings) {
+  const targetPath = resolve3(claudeDir, "settings.local.json");
+  const dir = dirname3(targetPath);
+  if (!existsSync4(dir)) {
+    mkdirSync2(dir, { recursive: true });
+  }
+  const content = JSON.stringify(settings, null, 2) + "\n";
+  atomicWriteFile(targetPath, content);
+}
+var init_settings_local = __esm({
+  "src/lib/settings-local.ts"() {
+    "use strict";
+  }
+});
+// src/permissions.ts
+import { createHash } from "crypto";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(canonicalJson).join(",") + "]";
+  }
+  const keys = Object.keys(value).sort();
+  const parts = keys.map((k3) => {
+    const v3 = value[k3];
+    if (v3 === void 0) return "";
+    return JSON.stringify(k3) + ":" + canonicalJson(v3);
+  }).filter((s) => s !== "");
+  return "{" + parts.join(",") + "}";
+}
+function sha256Hex(input) {
+  return createHash("sha256").update(input, "utf-8").digest("hex");
+}
+function findMissingEntries(allow) {
+  const allowSet = new Set(allow);
+  return MASSU_PERMISSION_ENTRIES.filter((entry) => !allowSet.has(entry));
+}
+function detectInvalidDefaultMode(settings) {
+  const permissions = settings.permissions;
+  const mode = permissions?.defaultMode;
+  if (typeof mode !== "string") {
+    return { invalid: false };
+  }
+  if (LAUNCH_FLAG_REQUIRED_MODES.includes(mode)) {
+    return {
+      invalid: true,
+      mode,
+      reason: `defaultMode "${mode}" requires --permission-mode launch flag per https://code.claude.com/docs/en/permission-modes \u2014 settings-file value alone is inert. Remediation: launch with --permission-mode ${mode} OR change defaultMode to one of {default, acceptEdits, plan}.`
+    };
+  }
+  return { invalid: false };
+}
+function readGlobalSettings() {
+  return readSettingsAtPath(join2(homedir2(), ".claude", "settings.json"));
+}
+function mergedPermissionState(global2, local, canonical) {
+  const globalPerm = global2.permissions ?? {};
+  const localPerm = local.permissions ?? {};
+  const localAllow = Array.isArray(localPerm.allow) ? localPerm.allow.filter((e2) => typeof e2 === "string") : [];
+  const allowSet = new Set(localAllow);
+  const allow = [...localAllow];
+  for (const entry of canonical) {
+    if (!allowSet.has(entry)) {
+      allow.push(entry);
+      allowSet.add(entry);
+    }
+  }
+  const result = { allow };
+  if (typeof localPerm.defaultMode === "string") {
+    result.defaultMode = localPerm.defaultMode;
+  } else if (typeof globalPerm.defaultMode === "string") {
+    result.defaultMode = globalPerm.defaultMode;
+  }
+  if (Array.isArray(localPerm.deny)) {
+    result.deny = localPerm.deny.filter((e2) => typeof e2 === "string");
+  }
+  if (Array.isArray(localPerm.ask)) {
+    result.ask = localPerm.ask.filter((e2) => typeof e2 === "string");
+  }
+  return result;
+}
+function resolveClaudeDir(claudeDir) {
+  return claudeDir;
+}
+function hashOfPermissions(perm) {
+  return sha256Hex(canonicalJson(perm));
+}
+function installPermissions(claudeDir, manifest, opts = {}) {
+  const resolvedDir = resolveClaudeDir(claudeDir);
+  const global2 = opts.global ?? readGlobalSettings();
+  const local = readSettingsLocal(resolvedDir);
+  const merged = mergedPermissionState(global2, local, MASSU_PERMISSION_ENTRIES);
+  const expectedHash = hashOfPermissions(merged);
+  const existingPerm = local.permissions ?? void 0;
+  const existingHash = existingPerm ? hashOfPermissions(existingPerm) : void 0;
+  const lastInstalledHash = manifest.entries[MANIFEST_KEY_PERMISSIONS];
+  if (existingHash === expectedHash) {
+    manifest.entries[MANIFEST_KEY_PERMISSIONS] = expectedHash;
+    if (!opts.silent) {
+      process.stderr.write(
+        `  Permissions: already in sync (allow: ${merged.allow.length} entries; defaultMode: ${merged.defaultMode ?? "omitted"}).
+`
+      );
+    }
+    return { installed: 0, kept: 0, skipped: 1 };
+  }
+  if (lastInstalledHash !== void 0 && existingHash !== lastInstalledHash) {
+    if (!opts.silent) {
+      process.stderr.write(
+        `  Permissions: operator-edited since last install \u2014 preserving. Use \`npx massu permissions check-drift\` to inspect.
+`
+      );
+    }
+    return { installed: 0, kept: 1, skipped: 0 };
+  }
+  const nextSettings = { ...local, permissions: merged };
+  writeSettingsLocalAtomic(resolvedDir, nextSettings);
+  manifest.entries[MANIFEST_KEY_PERMISSIONS] = expectedHash;
+  const onDisk = readSettingsLocal(resolvedDir);
+  const onDiskPerm = onDisk.permissions ?? {};
+  if (merged.defaultMode !== void 0) {
+    const diskDefaultMode = onDiskPerm.defaultMode;
+    if (diskDefaultMode !== merged.defaultMode) {
+      throw new InstallPermissionsAssertionError(
+        `Post-write assertion failed: expected permissions.defaultMode="${merged.defaultMode}" on disk, got ${JSON.stringify(diskDefaultMode)}. This indicates a filesystem race or write failure.`
+      );
+    }
+  }
+  const diskAllow = Array.isArray(onDiskPerm.allow) ? onDiskPerm.allow : [];
+  for (const entry of MASSU_PERMISSION_ENTRIES) {
+    if (!diskAllow.includes(entry)) {
+      throw new InstallPermissionsAssertionError(
+        `Post-write assertion failed: canonical entry "${entry}" missing from permissions.allow on disk.`
+      );
+    }
+  }
+  if (!opts.silent) {
+    process.stderr.write(
+      `  Wrote merged permissions block to .claude/settings.local.json (allow: ${merged.allow.length} entries; defaultMode: ${merged.defaultMode ?? "omitted"}).
+`
+    );
+  }
+  return { installed: 1, kept: 0, skipped: 0 };
+}
+function verifyPermissions(claudeDir) {
+  const local = readSettingsLocal(claudeDir);
+  const permissions = local.permissions ?? {};
+  const allow = Array.isArray(permissions.allow) ? permissions.allow.filter((e2) => typeof e2 === "string") : [];
+  return {
+    missing: findMissingEntries(allow),
+    allowList: allow
+  };
+}
+function checkPermissionsDrift(claudeDir, opts = {}) {
+  const global2 = opts.global ?? readGlobalSettings();
+  const local = readSettingsLocal(claudeDir);
+  const items = [];
+  const localPerm = local.permissions ?? {};
+  const allow = Array.isArray(localPerm.allow) ? localPerm.allow.filter((e2) => typeof e2 === "string") : [];
+  const missing = findMissingEntries(allow);
+  for (const entry of missing) {
+    items.push({
+      kind: "missing-allow",
+      detail: `Canonical massu allowlist entry missing from permissions.allow: "${entry}"`,
+      remediation: "Run `npx massu permissions install` to seed."
+    });
+  }
+  const invalidMode = detectInvalidDefaultMode(local);
+  if (invalidMode.invalid && invalidMode.mode) {
+    items.push({
+      kind: "invalid-default-mode",
+      detail: `defaultMode "${invalidMode.mode}" requires --permission-mode launch flag per code.claude.com/docs/en/permission-modes \u2014 settings-file value alone is inert.`,
+      remediation: `Launch with --permission-mode ${invalidMode.mode} OR change defaultMode to one of {default, acceptEdits, plan}.`
+    });
+  }
+  const globalPerm = global2.permissions ?? {};
+  const localHasPermissions = local.permissions !== void 0 && local.permissions !== null && typeof local.permissions === "object";
+  const localHasDefaultMode = typeof localPerm.defaultMode === "string";
+  const globalHasDefaultMode = typeof globalPerm.defaultMode === "string";
+  if (localHasPermissions && !localHasDefaultMode && globalHasDefaultMode) {
+    items.push({
+      kind: "strips-global-defaultmode",
+      detail: `Project-local permissions object omits defaultMode while global ~/.claude/settings.json has defaultMode="${globalPerm.defaultMode}". Per empirical observation (2026-05-14) the merge unit is the entire permissions object, so the global defaultMode is silently stripped.`,
+      remediation: "Run `npx massu permissions install` to write the full merged permissions block (auto-propagates global defaultMode)."
+    });
+  }
+  for (const key of Object.keys(local)) {
+    if (KNOWN_UNKNOWN_KEYS.has(key)) {
+      items.push({
+        kind: "unknown-key",
+        detail: `Top-level settings key "${key}" is not documented at code.claude.com/docs/en/settings \u2014 silently ignored by Claude Code.`,
+        remediation: `Remove or replace with a documented key (e.g. skipDangerousModePermissionPrompt).`
+      });
+    }
+  }
+  return { driftItems: items };
+}
+var MASSU_PERMISSION_ENTRIES, LAUNCH_FLAG_REQUIRED_MODES, InstallPermissionsAssertionError, MANIFEST_KEY_PERMISSIONS, KNOWN_UNKNOWN_KEYS;
+var init_permissions = __esm({
+  "src/permissions.ts"() {
+    "use strict";
+    init_config();
+    init_settings_local();
+    MASSU_PERMISSION_ENTRIES = ["mcp__massu__*"];
+    LAUNCH_FLAG_REQUIRED_MODES = ["bypassPermissions", "auto", "dontAsk"];
+    InstallPermissionsAssertionError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "InstallPermissionsAssertionError";
+      }
+    };
+    MANIFEST_KEY_PERMISSIONS = "__settings__/permissions";
+    KNOWN_UNKNOWN_KEYS = /* @__PURE__ */ new Set([
+      // From operator's observed ~/.claude/settings.json: top-level key that is
+      // NOT in the docs (looks like a typo/wishful-thinking of skipDangerousModePermissionPrompt).
+      "skipAutoPermissionPrompt"
+    ]);
+  }
+});
 // src/commands/install-commands.ts
 var install_commands_exports = {};
 __export(install_commands_exports, {
@@ -1927,33 +2204,27 @@ __export(install_commands_exports, {
   syncDirectory: () => syncDirectory
 });
 import {
-  closeSync,
-  existsSync as existsSync4,
-  fsyncSync,
-  openSync,
-  readFileSync as readFileSync3,
-  rmSync,
-  writeSync,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync5,
+  readFileSync as readFileSync4,
+  mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
-  statSync,
-  renameSync
+  statSync
 } from "fs";
-import { resolve as resolve3, dirname as dirname3, join as join2 } from "path";
+import { resolve as resolve4, dirname as dirname4, join as join3 } from "path";
 import { fileURLToPath } from "url";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function resolveAssetDir(assetName) {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve3(cwd, "node_modules/@massu/core", assetName);
-  if (existsSync4(nodeModulesPath)) {
+  const nodeModulesPath = resolve4(cwd, "node_modules/@massu/core", assetName);
+  if (existsSync5(nodeModulesPath)) {
     return nodeModulesPath;
   }
-  const distRelPath = resolve3(__dirname, "..", assetName);
-  if (existsSync4(distRelPath)) {
+  const distRelPath = resolve4(__dirname, "..", assetName);
+  if (existsSync5(distRelPath)) {
     return distRelPath;
   }
-  const srcRelPath = resolve3(__dirname, "../..", assetName);
-  if (existsSync4(srcRelPath)) {
+  const srcRelPath = resolve4(__dirname, "../..", assetName);
+  if (existsSync5(srcRelPath)) {
     return srcRelPath;
   }
   return null;
@@ -1962,15 +2233,15 @@ function resolveCommandsDir() {
   return resolveAssetDir("commands");
 }
 function hashContent(content) {
-  return createHash("sha256").update(content, "utf-8").digest("hex");
+  return createHash2("sha256").update(content, "utf-8").digest("hex");
 }
 function loadManifest(claudeDir) {
-  const path = resolve3(claudeDir, MANIFEST_RELPATH);
-  if (!existsSync4(path)) {
+  const path = resolve4(claudeDir, MANIFEST_RELPATH);
+  if (!existsSync5(path)) {
     return emptyManifest();
   }
   try {
-    const raw = readFileSync3(path, "utf-8");
+    const raw = readFileSync4(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.entries) {
       return emptyManifest();
@@ -1980,34 +2251,12 @@ function loadManifest(claudeDir) {
     return emptyManifest();
   }
 }
-function atomicWriteFile(targetPath, content, mode = 420) {
-  const tmpPath = `${targetPath}.${process.pid}.tmp`;
-  try {
-    const fd = openSync(tmpPath, "w", mode);
-    try {
-      const buf = Buffer.from(content, "utf-8");
-      writeSync(fd, buf, 0, buf.length, 0);
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-    renameSync(tmpPath, targetPath);
-  } catch (err) {
-    if (existsSync4(tmpPath)) {
-      try {
-        rmSync(tmpPath, { force: true });
-      } catch {
-      }
-    }
-    throw err;
-  }
-}
 function saveManifest(claudeDir, manifest) {
-  const dir = resolve3(claudeDir, ".massu");
-  if (!existsSync4(dir)) {
-    mkdirSync2(dir, { recursive: true });
+  const dir = resolve4(claudeDir, ".massu");
+  if (!existsSync5(dir)) {
+    mkdirSync3(dir, { recursive: true });
   }
-  const finalPath = resolve3(dir, "install-manifest.json");
+  const finalPath = resolve4(dir, "install-manifest.json");
   manifest.generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   atomicWriteFile(finalPath, JSON.stringify(manifest, null, 2));
 }
@@ -2069,18 +2318,18 @@ function pickVariant(baseName, sourceDir, framework) {
   }
   for (const cand of candidates) {
     if (cand.subFramework) {
-      const subPath = resolve3(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
-      if (existsSync4(subPath)) {
+      const subPath = resolve4(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
+      if (existsSync5(subPath)) {
         return { kind: "hit", suffix: `.${cand.lang}-${cand.subFramework}` };
       }
     }
-    const langPath = resolve3(sourceDir, `${baseName}.${cand.lang}.md`);
-    if (existsSync4(langPath)) {
+    const langPath = resolve4(sourceDir, `${baseName}.${cand.lang}.md`);
+    if (existsSync5(langPath)) {
       return { kind: "hit", suffix: `.${cand.lang}` };
     }
   }
-  const defaultPath = resolve3(sourceDir, `${baseName}.md`);
-  if (existsSync4(defaultPath)) {
+  const defaultPath = resolve4(sourceDir, `${baseName}.md`);
+  if (existsSync5(defaultPath)) {
     return { kind: "hit", suffix: "" };
   }
   if (framework.type === "multi" && !framework.primary) {
@@ -2096,15 +2345,15 @@ function isVariantFilename(entry) {
 }
 function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPrefix, topLevel = true, templateVars = {}) {
   const stats = { installed: 0, updated: 0, skipped: 0, kept: 0 };
-  if (!existsSync4(targetDir)) {
-    mkdirSync2(targetDir, { recursive: true });
+  if (!existsSync5(targetDir)) {
+    mkdirSync3(targetDir, { recursive: true });
   }
   const entries = readdirSync2(sourceDir);
   for (const entry of entries) {
-    const sourcePath = resolve3(sourceDir, entry);
+    const sourcePath = resolve4(sourceDir, entry);
     const entryStat = statSync(sourcePath);
     if (entryStat.isDirectory()) {
-      const subTargetDir = resolve3(targetDir, entry);
+      const subTargetDir = resolve4(targetDir, entry);
       const subPrefix = manifestKeyPrefix === "" ? entry : `${manifestKeyPrefix}/${entry}`;
       const subStats = syncDirectory(
         sourcePath,
@@ -2133,13 +2382,13 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
       const suffix = choice.kind === "hit" ? choice.suffix : "";
       sourceFilename = suffix === "" ? `${baseName}.md` : `${baseName}${suffix}.md`;
     }
-    const resolvedSourcePath = resolve3(sourceDir, sourceFilename);
-    if (!existsSync4(resolvedSourcePath)) {
+    const resolvedSourcePath = resolve4(sourceDir, sourceFilename);
+    if (!existsSync5(resolvedSourcePath)) {
       continue;
     }
     const targetFilename = topLevel ? `${baseName}.md` : entry;
-    const targetPath = resolve3(targetDir, targetFilename);
-    const rawContent = readFileSync3(resolvedSourcePath, "utf-8");
+    const targetPath = resolve4(targetDir, targetFilename);
+    const rawContent = readFileSync4(resolvedSourcePath, "utf-8");
     let sourceContent;
     try {
       sourceContent = renderTemplate(rawContent, templateVars);
@@ -2157,8 +2406,8 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
     const sourceHash = hashContent(sourceContent);
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
-    if (existsSync4(targetPath)) {
-      const existingContent = readFileSync3(targetPath, "utf-8");
+    if (existsSync5(targetPath)) {
+      const existingContent = readFileSync4(targetPath, "utf-8");
       const existingHash = hashContent(existingContent);
       if (existingHash === sourceHash) {
         manifest.entries[manifestKey] = sourceHash;
@@ -2205,12 +2454,12 @@ function buildTemplateVars() {
     config
   };
 }
-function installCommands(projectRoot) {
+function installCommands(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve3(projectRoot, claudeDirName);
-  const targetDir = resolve3(claudeDir, "commands");
-  if (!existsSync4(targetDir)) {
-    mkdirSync2(targetDir, { recursive: true });
+  const claudeDir = resolve4(projectRoot, claudeDirName);
+  const targetDir = resolve4(claudeDir, "commands");
+  if (!existsSync5(targetDir)) {
+    mkdirSync3(targetDir, { recursive: true });
   }
   const sourceDir = resolveAssetDir("commands");
   if (!sourceDir) {
@@ -2220,27 +2469,39 @@ function installCommands(projectRoot) {
   }
   const framework = getConfig().framework;
   const templateVars = buildTemplateVars();
-  const stats = runWithManifest(
-    claudeDir,
-    (manifest) => syncDirectory(sourceDir, targetDir, framework, manifest, "commands", true, templateVars)
-  );
+  const stats = runWithManifest(claudeDir, (manifest) => {
+    const syncStats = syncDirectory(
+      sourceDir,
+      targetDir,
+      framework,
+      manifest,
+      "commands",
+      true,
+      templateVars
+    );
+    if (!opts.skipPermissions) {
+      installPermissions(claudeDir, manifest, { silent: true });
+    }
+    return syncStats;
+  });
   return { ...stats, commandsDir: targetDir };
 }
-function installAll(projectRoot) {
+function installAll(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve3(projectRoot, claudeDirName);
+  const claudeDir = resolve4(projectRoot, claudeDirName);
   const assets = {};
   let totalInstalled = 0;
   let totalUpdated = 0;
   let totalSkipped = 0;
   let totalKept = 0;
+  let permissionsResult;
   const framework = getConfig().framework;
   const templateVars = buildTemplateVars();
   runWithManifest(claudeDir, (manifest) => {
     for (const assetType of ASSET_TYPES) {
       const sourceDir = resolveAssetDir(assetType.name);
       if (!sourceDir) continue;
-      const targetDir = resolve3(claudeDir, assetType.targetSubdir);
+      const targetDir = resolve4(claudeDir, assetType.targetSubdir);
       const stats = syncDirectory(
         sourceDir,
         targetDir,
@@ -2256,6 +2517,9 @@ function installAll(projectRoot) {
       totalSkipped += stats.skipped;
       totalKept += stats.kept;
     }
+    if (!opts.skipPermissions) {
+      permissionsResult = installPermissions(claudeDir, manifest, { silent: true });
+    }
   });
   return {
     assets,
@@ -2263,16 +2527,18 @@ function installAll(projectRoot) {
     totalUpdated,
     totalSkipped,
     totalKept,
-    claudeDir
+    claudeDir,
+    permissions: permissionsResult
   };
 }
 async function runInstallCommands() {
   const projectRoot = process.cwd();
+  const skipPermissions = process.argv.slice(2).includes("--skip-permissions");
   console.log("");
   console.log("Massu AI - Install Project Assets");
   console.log("==================================");
   console.log("");
-  const result = installAll(projectRoot);
+  const result = installAll(projectRoot, { skipPermissions });
   for (const assetType of ASSET_TYPES) {
     const stats = result.assets[assetType.name];
     if (!stats) {
@@ -2296,6 +2562,19 @@ async function runInstallCommands() {
       `  ${result.totalKept} file(s) had local edits and were preserved (see stderr above).`
     );
   }
+  if (skipPermissions) {
+    console.log("  Permission seeding skipped (--skip-permissions).");
+  } else if (result.permissions) {
+    if (result.permissions.installed > 0) {
+      console.log(
+        `  Wrote merged permissions block to .claude/settings.local.json (use --skip-permissions to opt out).`
+      );
+    } else if (result.permissions.kept > 0) {
+      console.log(
+        `  MCP allowlist entry was edited by operator; preserved. Use \`npx massu permissions check-drift\` to inspect.`
+      );
+    }
+  }
   console.log("");
   console.log("  Restart your Claude Code session to use them.");
   console.log("");
@@ -2306,8 +2585,10 @@ var init_install_commands = __esm({
     "use strict";
     init_config();
     init_template_engine();
+    init_settings_local();
+    init_permissions();
     __filename = fileURLToPath(import.meta.url);
-    __dirname = dirname3(__filename);
+    __dirname = dirname4(__filename);
     ASSET_TYPES = [
       { name: "commands", targetSubdir: "commands", description: "slash commands" },
       { name: "agents", targetSubdir: "agents", description: "agent definitions" },
@@ -2316,7 +2597,7 @@ var init_install_commands = __esm({
       { name: "reference", targetSubdir: "reference", description: "reference files" }
     ];
     MANIFEST_VERSION = 1;
-    MANIFEST_RELPATH = join2(".massu", "install-manifest.json");
+    MANIFEST_RELPATH = join3(".massu", "install-manifest.json");
     PASSTHROUGH_LANG_KEYS = [
       "typescript",
       "javascript",
@@ -2490,17 +2771,17 @@ var init_manifest_registry = __esm({
 });
 // src/detect/package-detector.ts
-import { readFileSync as readFileSync4, existsSync as existsSync5, statSync as statSync2, lstatSync, readdirSync as readdirSync3 } from "fs";
-import { join as join3, relative as relative2 } from "path";
+import { readFileSync as readFileSync5, existsSync as existsSync6, statSync as statSync2, lstatSync, readdirSync as readdirSync3 } from "fs";
+import { join as join4, relative as relative2 } from "path";
 import { parse as parseToml } from "smol-toml";
 function safeRead(path) {
   try {
-    if (!existsSync5(path)) return null;
+    if (!existsSync6(path)) return null;
     const ls = lstatSync(path);
     if (ls.isSymbolicLink()) return null;
     const st = statSync2(path);
     if (!st.isFile()) return null;
-    return readFileSync4(path, "utf-8");
+    return readFileSync5(path, "utf-8");
   } catch {
     return null;
   }
@@ -2531,7 +2812,7 @@ function parsePackageJson(path, directory, root, warnings) {
   const peer = Object.keys(
     pkg.peerDependencies ?? {}
   );
-  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync5(join3(directory, "tsconfig.json"));
+  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync6(join4(directory, "tsconfig.json"));
   const language = hasTs ? "typescript" : "javascript";
   const scripts = Object.keys(
     pkg.scripts ?? {}
@@ -2957,8 +3238,8 @@ function detectManifestsInDir(dir, root, warnings) {
   let dirEntries = null;
   for (const entry of getManifestRegistry2()) {
     if (!entry.pattern.startsWith("*")) {
-      const path = join3(dir, entry.pattern);
-      if (!existsSync5(path)) continue;
+      const path = join4(dir, entry.pattern);
+      if (!existsSync6(path)) continue;
       const m3 = entry.parse(path, dir, root, warnings);
       if (m3 !== null) out.push(m3);
     } else {
@@ -2971,8 +3252,8 @@ function detectManifestsInDir(dir, root, warnings) {
       }
       for (const fname of dirEntries) {
         if (!matchManifestPattern2(fname, entry.pattern)) continue;
-        const path = join3(dir, fname);
-        if (!existsSync5(path)) continue;
+        const path = join4(dir, fname);
+        if (!existsSync6(path)) continue;
         const m3 = entry.parse(path, dir, root, warnings);
         if (m3 !== null) out.push(m3);
       }
@@ -2982,7 +3263,7 @@ function detectManifestsInDir(dir, root, warnings) {
 }
 function listSubdirs(dir) {
   try {
-    return readdirSync3(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS.has(e2.name)).map((e2) => join3(dir, e2.name));
+    return readdirSync3(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS.has(e2.name)).map((e2) => join4(dir, e2.name));
   } catch {
     return [];
   }
@@ -2992,8 +3273,8 @@ function detectPackageManifests(projectRoot) {
   const manifests = [];
   manifests.push(...detectManifestsInDir(projectRoot, projectRoot, warnings));
   for (const ws of WORKSPACE_DIRS) {
-    const wsRoot = join3(projectRoot, ws);
-    if (!existsSync5(wsRoot)) continue;
+    const wsRoot = join4(projectRoot, ws);
+    if (!existsSync6(wsRoot)) continue;
     for (const sub of listSubdirs(wsRoot)) {
       manifests.push(...detectManifestsInDir(sub, projectRoot, warnings));
       for (const sub2 of listSubdirs(sub)) {
@@ -7764,41 +8045,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p19 = new Promise(function(resolve36, reject) {
+        var p19 = new Promise(function(resolve38, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve36(result);
+            resolve38(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function unshift(value) {
-        var p19 = new Promise(function(resolve36, reject) {
+        var p19 = new Promise(function(resolve38, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve36(result);
+            resolve38(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function drained() {
-        var p19 = new Promise(function(resolve36) {
+        var p19 = new Promise(function(resolve38) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve36();
+              resolve38();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve36();
+                resolve38();
                 queue.drain = previousDrain;
               };
             }
@@ -8284,9 +8565,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve36, reject) => {
+        return new Promise((resolve38, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve36(stats) : reject(error);
+            return error === null ? resolve38(stats) : reject(error);
           });
         });
       }
@@ -8310,10 +8591,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve36, reject) => {
+        return new Promise((resolve38, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve36(entries);
+              resolve38(entries);
             } else {
               reject(error);
             }
@@ -8323,10 +8604,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve36, reject) => {
+        return new Promise((resolve38, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve36(entries));
+          stream.once("end", () => resolve38(entries));
         });
       }
     };
@@ -8985,7 +9266,7 @@ var require_out4 = __commonJS({
 // src/detect/source-dir-detector.ts
 import { realpathSync } from "fs";
-import { resolve as resolve4 } from "path";
+import { resolve as resolve5 } from "path";
 function extsFor(language) {
   return EXTENSIONS[language] ?? [];
 }
@@ -9011,7 +9292,7 @@ function topSegment(rel) {
 function isInsideRoot(root, candidate) {
   try {
     const realRoot = realpathSync(root);
-    const realCand = realpathSync(resolve4(root, candidate));
+    const realCand = realpathSync(resolve5(root, candidate));
     return realCand === realRoot || realCand.startsWith(realRoot + "/");
   } catch {
     return false;
@@ -9179,38 +9460,38 @@ var init_source_dir_detector = __esm({
 });
 // src/detect/monorepo-detector.ts
-import { readFileSync as readFileSync5, existsSync as existsSync6, statSync as statSync3, lstatSync as lstatSync2, readdirSync as readdirSync4 } from "fs";
-import { join as join4, relative as relative3 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync3, lstatSync as lstatSync2, readdirSync as readdirSync4 } from "fs";
+import { join as join5, relative as relative3 } from "path";
 import { parse as parseYaml3 } from "yaml";
 import { parse as parseToml2 } from "smol-toml";
 function safeReadText(path) {
   try {
-    if (!existsSync6(path)) return null;
+    if (!existsSync7(path)) return null;
     const ls = lstatSync2(path);
     if (ls.isSymbolicLink()) return null;
     const st = statSync3(path);
     if (!st.isFile()) return null;
-    return readFileSync5(path, "utf-8");
+    return readFileSync6(path, "utf-8");
   } catch {
     return null;
   }
 }
 function firstManifestIn(dir) {
   for (const m3 of MANIFEST_PRIORITY) {
-    if (existsSync6(join4(dir, m3))) return m3;
+    if (existsSync7(join5(dir, m3))) return m3;
   }
   return null;
 }
 function manifestName(dir, manifest) {
   try {
     if (manifest === "package.json") {
-      const raw = safeReadText(join4(dir, "package.json"));
+      const raw = safeReadText(join5(dir, "package.json"));
       if (!raw) return null;
       const pkg = JSON.parse(raw);
       return typeof pkg.name === "string" ? pkg.name : null;
     }
     if (manifest === "pyproject.toml") {
-      const raw = safeReadText(join4(dir, "pyproject.toml"));
+      const raw = safeReadText(join5(dir, "pyproject.toml"));
       if (!raw) return null;
       const toml = parseToml2(raw);
       const project = toml.project;
@@ -9221,7 +9502,7 @@ function manifestName(dir, manifest) {
       return null;
     }
     if (manifest === "Cargo.toml") {
-      const raw = safeReadText(join4(dir, "Cargo.toml"));
+      const raw = safeReadText(join5(dir, "Cargo.toml"));
       if (!raw) return null;
       const toml = parseToml2(raw);
       const pkg = toml.package;
@@ -9229,7 +9510,7 @@ function manifestName(dir, manifest) {
       return null;
     }
     if (manifest === "go.mod") {
-      const raw = safeReadText(join4(dir, "go.mod"));
+      const raw = safeReadText(join5(dir, "go.mod"));
       if (!raw) return null;
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
@@ -9253,7 +9534,7 @@ function pkgFromDir(root, dir) {
 }
 function listSubdirs2(dir) {
   try {
-    return readdirSync4(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS2.has(e2.name)).map((e2) => join4(dir, e2.name));
+    return readdirSync4(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS2.has(e2.name)).map((e2) => join5(dir, e2.name));
   } catch {
     return [];
   }
@@ -9261,8 +9542,8 @@ function listSubdirs2(dir) {
 function genericWorkspaces(root) {
   const out = [];
   for (const parent of CONVENTIONAL_WORKSPACE_PARENTS) {
-    const p19 = join4(root, parent);
-    if (!existsSync6(p19)) continue;
+    const p19 = join5(root, parent);
+    if (!existsSync7(p19)) continue;
     for (const sub of listSubdirs2(p19)) {
       const pkg = pkgFromDir(root, sub);
       if (pkg) out.push(pkg);
@@ -9271,7 +9552,7 @@ function genericWorkspaces(root) {
   return out;
 }
 function detectYarnWorkspaces(root) {
-  const raw = safeReadText(join4(root, "package.json"));
+  const raw = safeReadText(join5(root, "package.json"));
   if (!raw) return null;
   let pkg;
   try {
@@ -9286,7 +9567,7 @@ function detectYarnWorkspaces(root) {
   return expandWorkspaceGlobs(root, globs);
 }
 function detectPnpmWorkspaces(root) {
-  const raw = safeReadText(join4(root, "pnpm-workspace.yaml"));
+  const raw = safeReadText(join5(root, "pnpm-workspace.yaml"));
   if (!raw) return null;
   try {
     const parsed = parseYaml3(raw);
@@ -9302,8 +9583,8 @@ function expandWorkspaceGlobs(root, globs) {
   for (const pattern of globs) {
     const parts = pattern.split("/");
     if (parts.length === 2 && (parts[1] === "*" || parts[1] === "**")) {
-      const parent = join4(root, parts[0]);
-      if (!existsSync6(parent)) continue;
+      const parent = join5(root, parts[0]);
+      if (!existsSync7(parent)) continue;
       for (const sub of listSubdirs2(parent)) {
         const pkg = pkgFromDir(root, sub);
         if (pkg && !seen.has(pkg.path)) {
@@ -9313,8 +9594,8 @@ function expandWorkspaceGlobs(root, globs) {
       }
       continue;
     }
-    const direct = join4(root, pattern);
-    if (existsSync6(direct)) {
+    const direct = join5(root, pattern);
+    if (existsSync7(direct)) {
       const pkg = pkgFromDir(root, direct);
       if (pkg && !seen.has(pkg.path)) {
         seen.add(pkg.path);
@@ -9325,16 +9606,16 @@ function expandWorkspaceGlobs(root, globs) {
   return out;
 }
 function hasTurbo(root) {
-  return existsSync6(join4(root, "turbo.json"));
+  return existsSync7(join5(root, "turbo.json"));
 }
 function hasNx(root) {
-  return existsSync6(join4(root, "nx.json"));
+  return existsSync7(join5(root, "nx.json"));
 }
 function hasLerna(root) {
-  return existsSync6(join4(root, "lerna.json"));
+  return existsSync7(join5(root, "lerna.json"));
 }
 function hasBazel(root) {
-  return existsSync6(join4(root, "WORKSPACE")) || existsSync6(join4(root, "WORKSPACE.bazel")) || existsSync6(join4(root, "MODULE.bazel"));
+  return existsSync7(join5(root, "WORKSPACE")) || existsSync7(join5(root, "WORKSPACE.bazel")) || existsSync7(join5(root, "MODULE.bazel"));
 }
 function detectMonorepo(projectRoot) {
   const nested = [];
@@ -9525,8 +9806,8 @@ var init_vr_command_map = __esm({
 });
 // src/detect/domain-inferrer.ts
-import { existsSync as existsSync7, readdirSync as readdirSync5 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync5 } from "fs";
+import { join as join6 } from "path";
 function titleCase(s) {
   if (!s) return s;
   return s.split(/[-_\s]+/).filter(Boolean).map((p19) => p19.charAt(0).toUpperCase() + p19.slice(1)).join(" ");
@@ -9546,8 +9827,8 @@ function topLevelSrcSubdirs(root, sourceDirs) {
   const effective = sourceDirs.length > 0 ? sourceDirs : ["src"];
   const seen = /* @__PURE__ */ new Set();
   for (const rel of effective) {
-    const abs = join5(root, rel);
-    if (!existsSync7(abs)) continue;
+    const abs = join6(root, rel);
+    if (!existsSync8(abs)) continue;
     try {
       for (const e2 of readdirSync5(abs, { withFileTypes: true })) {
         if (!e2.isDirectory()) continue;
@@ -9634,8 +9915,8 @@ var init_domain_inferrer = __esm({
 });
 // src/detect/regex-fallback.ts
-import { existsSync as existsSync8, readdirSync as readdirSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { resolve as resolve5, join as join6, basename as basename2 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync7, statSync as statSync4 } from "fs";
+import { resolve as resolve6, join as join7, basename as basename2 } from "path";
 function introspectPython(detection, projectRoot) {
   const sourceDir = resolveSourceDir(detection, "python", projectRoot);
   if (!sourceDir) return null;
@@ -9801,10 +10082,10 @@ function resolveSourceDir(detection, lang, projectRoot) {
   const list = info?.source_dirs ?? [];
   if (list.length > 0) {
     const first = list[0];
-    const abs = resolve5(projectRoot, first);
-    return existsSync8(abs) ? abs : null;
+    const abs = resolve6(projectRoot, first);
+    return existsSync9(abs) ? abs : null;
   }
-  return existsSync8(projectRoot) ? projectRoot : null;
+  return existsSync9(projectRoot) ? projectRoot : null;
 }
 function sampleFiles(dir, nameRegex, pathFilter) {
   const out = [];
@@ -9824,7 +10105,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
       if (entry === "__pycache__") continue;
       if (entry === "venv" || entry === ".venv") continue;
       if (entry === "dist" || entry === "build") continue;
-      const child = join6(path, entry);
+      const child = join7(path, entry);
       let st;
       try {
         st = statSync4(child);
@@ -9849,7 +10130,7 @@ function readSafe(path) {
   try {
     const st = statSync4(path);
     if (st.size > MAX_FILE_BYTES) return null;
-    return readFileSync6(path, "utf-8");
+    return readFileSync7(path, "utf-8");
   } catch {
     return null;
   }
@@ -9930,8 +10211,8 @@ var init_parse_guard = __esm({
 // src/detect/adapters/runner.ts
 import { basename as basename3, relative as relative4 } from "path";
-import { existsSync as existsSync9, readdirSync as readdirSync7, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync5 } from "fs";
+import { join as join8 } from "path";
 async function runAdapters(adapters, rootDir, signals, options = {}) {
   const out = {
     byAdapter: {},
@@ -10028,7 +10309,7 @@ function buildDetectionSignals(rootDir) {
     for (const entry of readdirSync7(rootDir)) {
       if (entry.startsWith(".")) continue;
       try {
-        const st = statSync5(join7(rootDir, entry));
+        const st = statSync5(join8(rootDir, entry));
         if (st.isDirectory()) presentDirs.add(entry);
         else if (st.isFile()) presentFiles.add(entry);
       } catch {
@@ -10037,14 +10318,14 @@ function buildDetectionSignals(rootDir) {
   } catch {
   }
   return {
-    packageJson: tryReadJson(join7(rootDir, "package.json")),
-    pyprojectToml: tryReadToml(join7(rootDir, "pyproject.toml")),
-    gemfile: tryReadString(join7(rootDir, "Gemfile")),
-    cargoToml: tryReadToml(join7(rootDir, "Cargo.toml")),
-    goMod: tryReadString(join7(rootDir, "go.mod")),
-    mixExs: tryReadString(join7(rootDir, "mix.exs")),
+    packageJson: tryReadJson(join8(rootDir, "package.json")),
+    pyprojectToml: tryReadToml(join8(rootDir, "pyproject.toml")),
+    gemfile: tryReadString(join8(rootDir, "Gemfile")),
+    cargoToml: tryReadToml(join8(rootDir, "Cargo.toml")),
+    goMod: tryReadString(join8(rootDir, "go.mod")),
+    mixExs: tryReadString(join8(rootDir, "mix.exs")),
     csproj: tryReadFirstCsproj(rootDir, presentFiles),
-    pomXml: tryReadString(join7(rootDir, "pom.xml")),
+    pomXml: tryReadString(join8(rootDir, "pom.xml")),
     gradleBuild: tryReadGradleBuild(rootDir, presentFiles),
     presentDirs,
     presentFiles
@@ -10053,21 +10334,21 @@ function buildDetectionSignals(rootDir) {
 function tryReadFirstCsproj(rootDir, presentFiles) {
   const csprojNames = [...presentFiles].filter((f2) => f2.endsWith(".csproj")).sort();
   if (csprojNames.length === 0) return void 0;
-  return tryReadString(join7(rootDir, csprojNames[0]));
+  return tryReadString(join8(rootDir, csprojNames[0]));
 }
 function tryReadGradleBuild(rootDir, presentFiles) {
   if (presentFiles.has("build.gradle.kts")) {
-    return tryReadString(join7(rootDir, "build.gradle.kts"));
+    return tryReadString(join8(rootDir, "build.gradle.kts"));
   }
   if (presentFiles.has("build.gradle")) {
-    return tryReadString(join7(rootDir, "build.gradle"));
+    return tryReadString(join8(rootDir, "build.gradle"));
   }
   return void 0;
 }
 function tryReadString(path) {
-  if (!existsSync9(path)) return void 0;
+  if (!existsSync10(path)) return void 0;
   try {
-    return readFileSync7(path, "utf-8");
+    return readFileSync8(path, "utf-8");
   } catch {
     return void 0;
   }
@@ -10182,11 +10463,11 @@ ${querySource}`
 });
 // src/detect/adapters/tree-sitter-loader.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import {
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   writeFileSync,
   renameSync as renameSync2,
   unlinkSync,
@@ -10194,14 +10475,14 @@ import {
   chmodSync,
   utimesSync
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join8 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname5, join as join9 } from "path";
 import { Language, Parser } from "web-tree-sitter";
 function getCacheDir() {
-  return process.env.MASSU_WASM_CACHE_DIR ?? join8(homedir2(), ".massu", "wasm-cache");
+  return process.env.MASSU_WASM_CACHE_DIR ?? join9(homedir3(), ".massu", "wasm-cache");
 }
 function getCachedPath(language, sha) {
-  return join8(getCacheDir(), `${language}-${sha}.wasm`);
+  return join9(getCacheDir(), `${language}-${sha}.wasm`);
 }
 function getCacheRetainCount() {
   const env = process.env.MASSU_WASM_CACHE_RETAIN;
@@ -10229,7 +10510,7 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
   const candidates = [];
   for (const name of entries) {
     if (!name.endsWith(".wasm")) continue;
-    const path = join8(dir, name);
+    const path = join9(dir, name);
     let stat;
     try {
       stat = lstatSync3(path);
@@ -10254,7 +10535,7 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
   }
 }
 function sha256(bytes) {
-  return createHash2("sha256").update(bytes).digest("hex");
+  return createHash3("sha256").update(bytes).digest("hex");
 }
 async function ensureParserInitialized() {
   if (parserInitPromise) return parserInitPromise;
@@ -10285,7 +10566,7 @@ async function loadGrammar(language, options = {}) {
     }
     let bytes;
     try {
-      bytes = readFileSync8(cachePath);
+      bytes = readFileSync9(cachePath);
     } catch (e2) {
       bytes = new Uint8Array(0);
     }
@@ -10325,9 +10606,9 @@ async function loadGrammar(language, options = {}) {
     throw new GrammarSHAMismatchError(language, manifest.sha256, downloadedSha);
   }
   try {
-    mkdirSync3(dirname4(cachePath), { recursive: true, mode: 448 });
+    mkdirSync4(dirname5(cachePath), { recursive: true, mode: 448 });
     try {
-      chmodSync(dirname4(cachePath), 448);
+      chmodSync(dirname5(cachePath), 448);
     } catch {
     }
     const tmpPath = `${cachePath}.tmp.${process.pid}`;
@@ -11226,8 +11507,8 @@ __export(file_sampler_exports, {
   SAMPLE_TEST_FILE_PATTERNS: () => SAMPLE_TEST_FILE_PATTERNS,
   sampleFilesForAdapter: () => sampleFilesForAdapter
 });
-import { readdirSync as readdirSync9, readFileSync as readFileSync9, lstatSync as lstatSync4 } from "node:fs";
-import { join as join9, extname } from "node:path";
+import { readdirSync as readdirSync9, readFileSync as readFileSync10, lstatSync as lstatSync4 } from "node:fs";
+import { join as join10, extname } from "node:path";
 function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
   const maxFiles = options.maxFilesPerAdapter ?? DEFAULT_MAX_FILES;
@@ -11242,7 +11523,7 @@ function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
     const langDetection = detection.sourceDirs[langKey];
     const candidateDirs = [];
     if (langDetection?.source_dirs && langDetection.source_dirs.length > 0) {
-      candidateDirs.push(...langDetection.source_dirs.map((d2) => join9(projectRoot, d2)));
+      candidateDirs.push(...langDetection.source_dirs.map((d2) => join10(projectRoot, d2)));
     } else {
       candidateDirs.push(projectRoot);
     }
@@ -11266,7 +11547,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
     if (out.length >= maxFiles) return;
     if (entry.startsWith(".")) continue;
     if (IGNORED_DIRS3.has(entry)) continue;
-    const fullPath = join9(dir, entry);
+    const fullPath = join10(dir, entry);
     let st;
     try {
       st = lstatSync4(fullPath);
@@ -11287,7 +11568,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
     seen.add(fullPath);
     let content;
     try {
-      content = readFileSync9(fullPath, "utf-8");
+      content = readFileSync10(fullPath, "utf-8");
     } catch {
       continue;
     }
@@ -11525,7 +11806,7 @@ var init_detect = __esm({
 });
 // src/detect/drift.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function summarizeDetection(det) {
   const languages = Array.from(new Set(det.manifests.map((m3) => m3.language))).sort();
   const frameworks = {};
@@ -11556,7 +11837,7 @@ function summarizeDetection(det) {
 function computeFingerprint(det) {
   const data = summarizeDetection(det);
   const stable = JSON.stringify(data, Object.keys(data).sort());
-  return createHash3("sha256").update(stable).digest("hex");
+  return createHash4("sha256").update(stable).digest("hex");
 }
 function stringOf(v3) {
   if (typeof v3 === "string") return v3;
@@ -12715,10 +12996,10 @@ __export(init_exports, {
   validateWrittenConfig: () => validateWrittenConfig,
   writeConfigAtomic: () => writeConfigAtomic
 });
-import { closeSync as closeSync2, existsSync as existsSync10, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2, writeSync as writeSync2, mkdirSync as mkdirSync4, readdirSync as readdirSync10, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync7, chmodSync as chmodSync2 } from "fs";
-import { resolve as resolve6, basename as basename4, dirname as dirname5 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync11, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync2, writeSync as writeSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync10, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync7, chmodSync as chmodSync2 } from "fs";
+import { resolve as resolve7, basename as basename4, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { stringify as yamlStringify, parse as yamlParse } from "yaml";
 function detectFramework(projectRoot) {
   const result = {
@@ -12727,10 +13008,10 @@ function detectFramework(projectRoot) {
     orm: "none",
     ui: "none"
   };
-  const pkgPath = resolve6(projectRoot, "package.json");
-  if (!existsSync10(pkgPath)) return result;
+  const pkgPath = resolve7(projectRoot, "package.json");
+  if (!existsSync11(pkgPath)) return result;
   try {
-    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
     const allDeps = {
       ...pkg.dependencies,
       ...pkg.devDependencies
@@ -12764,7 +13045,7 @@ function detectPython(projectRoot) {
     alembicDir: null
   };
   const markers = ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile"];
-  const hasMarker = markers.some((m3) => existsSync10(resolve6(projectRoot, m3)));
+  const hasMarker = markers.some((m3) => existsSync11(resolve7(projectRoot, m3)));
   if (!hasMarker) return result;
   result.detected = true;
   const depFiles = [
@@ -12774,33 +13055,33 @@ function detectPython(projectRoot) {
     { file: "Pipfile" }
   ];
   for (const { file } of depFiles) {
-    const filePath = resolve6(projectRoot, file);
-    if (existsSync10(filePath)) {
+    const filePath = resolve7(projectRoot, file);
+    if (existsSync11(filePath)) {
       try {
-        const content = readFileSync10(filePath, "utf-8").toLowerCase();
+        const content = readFileSync11(filePath, "utf-8").toLowerCase();
         if (content.includes("fastapi")) result.hasFastapi = true;
         if (content.includes("sqlalchemy")) result.hasSqlalchemy = true;
       } catch {
       }
     }
   }
-  if (existsSync10(resolve6(projectRoot, "alembic.ini"))) {
+  if (existsSync11(resolve7(projectRoot, "alembic.ini"))) {
     result.hasAlembic = true;
-    if (existsSync10(resolve6(projectRoot, "alembic"))) {
+    if (existsSync11(resolve7(projectRoot, "alembic"))) {
       result.alembicDir = "alembic";
     }
-  } else if (existsSync10(resolve6(projectRoot, "alembic"))) {
+  } else if (existsSync11(resolve7(projectRoot, "alembic"))) {
     result.hasAlembic = true;
     result.alembicDir = "alembic";
   }
   const candidateRoots = ["app", "src", "backend", "api"];
   for (const candidate of candidateRoots) {
-    const candidatePath = resolve6(projectRoot, candidate);
-    if (existsSync10(candidatePath) && existsSync10(resolve6(candidatePath, "__init__.py"))) {
+    const candidatePath = resolve7(projectRoot, candidate);
+    if (existsSync11(candidatePath) && existsSync11(resolve7(candidatePath, "__init__.py"))) {
       result.root = candidate;
       break;
     }
-    if (existsSync10(candidatePath)) {
+    if (existsSync11(candidatePath)) {
       try {
         const files = readdirSync10(candidatePath);
         if (files.some((f2) => f2.endsWith(".py"))) {
@@ -12820,8 +13101,8 @@ function generateConfig(projectRoot, framework) {
   console.warn(
     "[@massu/core] generateConfig() is deprecated since 1.2.1 \u2014 use buildConfigFromDetection instead. It cannot produce valid configs for monorepos."
   );
-  const configPath = resolve6(projectRoot, "massu.config.yaml");
-  if (existsSync10(configPath)) {
+  const configPath = resolve7(projectRoot, "massu.config.yaml");
+  if (existsSync11(configPath)) {
     return false;
   }
   const projectName = basename4(projectRoot);
@@ -13010,7 +13291,7 @@ function buildConfigFromDetection(opts) {
     };
     if (pyFw?.framework) pythonBlock.framework = pyFw.framework;
     if (pyFw?.orm) pythonBlock.orm = pyFw.orm;
-    if (existsSync10(resolve6(projectRoot, "alembic.ini")) || existsSync10(resolve6(projectRoot, "alembic"))) {
+    if (existsSync11(resolve7(projectRoot, "alembic.ini")) || existsSync11(resolve7(projectRoot, "alembic"))) {
       pythonBlock.alembic_dir = "alembic";
     }
     config.python = pythonBlock;
@@ -13034,11 +13315,11 @@ function applyVariantTemplate(config, templatesDir) {
     }
   }
   if (templateId === null) return config;
-  const templatePath = resolve6(templatesDir, templateId, "massu.config.yaml");
-  if (!existsSync10(templatePath)) return config;
+  const templatePath = resolve7(templatesDir, templateId, "massu.config.yaml");
+  if (!existsSync11(templatePath)) return config;
   let template;
   try {
-    template = yamlParse(readFileSync10(templatePath, "utf-8"));
+    template = yamlParse(readFileSync11(templatePath, "utf-8"));
   } catch {
     return config;
   }
@@ -13097,7 +13378,7 @@ ${yamlStringify(config)}`;
 function writeConfigAtomic(configPath, content) {
   const tmpPath = `${configPath}.tmp`;
   let existingMode;
-  if (existsSync10(configPath)) {
+  if (existsSync11(configPath)) {
     try {
       existingMode = statSync7(configPath).mode;
     } catch {
@@ -13105,7 +13386,7 @@ function writeConfigAtomic(configPath, content) {
     }
   }
   try {
-    mkdirSync4(dirname5(configPath), { recursive: true });
+    mkdirSync5(dirname6(configPath), { recursive: true });
     const fd = openSync2(tmpPath, "w", 420);
     try {
       const buf = Buffer.from(content, "utf-8");
@@ -13127,7 +13408,7 @@ function writeConfigAtomic(configPath, content) {
     }
     return { validated: true };
   } catch (err) {
-    if (existsSync10(tmpPath)) {
+    if (existsSync11(tmpPath)) {
       try {
         rmSync2(tmpPath, { force: true });
       } catch {
@@ -13138,8 +13419,8 @@ function writeConfigAtomic(configPath, content) {
 }
 function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
   try {
-    if (!existsSync10(configPath)) return "Config file does not exist after write";
-    const content = readFileSync10(configPath, "utf-8");
+    if (!existsSync11(configPath)) return "Config file does not exist after write";
+    const content = readFileSync11(configPath, "utf-8");
     const parsed = yamlParse(content);
     if (parsed === null || typeof parsed !== "object") {
       return "Config is not a valid YAML object";
@@ -13159,8 +13440,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
       if (checkPaths) {
         const src = cfg.paths.source;
         if (src && src !== ".") {
-          const srcAbs = resolve6(projectRoot, src);
-          if (!existsSync10(srcAbs)) {
+          const srcAbs = resolve7(projectRoot, src);
+          if (!existsSync11(srcAbs)) {
             return `paths.source '${src}' does not exist on disk`;
           }
         }
@@ -13170,8 +13451,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
           if (!Array.isArray(rawDirs)) continue;
           for (const d2 of rawDirs) {
             if (typeof d2 !== "string" || d2 === ".") continue;
-            const abs = resolve6(projectRoot, d2);
-            if (!existsSync10(abs)) {
+            const abs = resolve7(projectRoot, d2);
+            if (!existsSync11(abs)) {
               return `framework.languages.${lang}.source_dirs '${d2}' does not exist on disk`;
             }
           }
@@ -13180,7 +13461,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
         if (Array.isArray(mRoots)) {
           for (const r2 of mRoots) {
             if (typeof r2 !== "string" || r2 === ".") continue;
-            if (!existsSync10(resolve6(projectRoot, r2))) {
+            if (!existsSync11(resolve7(projectRoot, r2))) {
               return `paths.monorepo_roots '${r2}' does not exist on disk`;
             }
           }
@@ -13212,21 +13493,21 @@ function resolveTemplatesDir() {
   const cwd = process.cwd();
   const candidates = [
     // Project-local install: `<project>/node_modules/@massu/core/templates`.
-    resolve6(cwd, "node_modules/@massu/core/templates"),
+    resolve7(cwd, "node_modules/@massu/core/templates"),
     // Bundled cli.js layout: cli.js sits at `<package>/dist/cli.js`, so
     // templates live one level up at `<package>/templates`. (Plan 1.5.1
     // bug discovery: pre-existing layout assumed `dist/commands/init.js`
     // depth which never matched the bundled cli, so resolveTemplatesDir
     // returned null in production for both `--template` mode AND the
     // applyVariantTemplate path.)
-    resolve6(__dirname2, "../templates"),
+    resolve7(__dirname2, "../templates"),
     // Legacy nested layouts retained as fallbacks (in case a future
     // build moves cli.js back into a subdirectory).
-    resolve6(__dirname2, "../../templates"),
-    resolve6(__dirname2, "../../../templates")
+    resolve7(__dirname2, "../../templates"),
+    resolve7(__dirname2, "../../../templates")
   ];
   for (const c2 of candidates) {
-    if (existsSync10(c2)) return c2;
+    if (existsSync11(c2)) return c2;
   }
   return null;
 }
@@ -13235,12 +13516,12 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
   if (!templatesDir) {
     return { success: false, error: `Templates directory not found (looked in node_modules and dist/src)` };
   }
-  const srcPath = resolve6(templatesDir, templateName, "massu.config.yaml");
-  if (!existsSync10(srcPath)) {
+  const srcPath = resolve7(templatesDir, templateName, "massu.config.yaml");
+  if (!existsSync11(srcPath)) {
     return { success: false, error: `Template '${templateName}' not found at ${srcPath}` };
   }
   try {
-    let content = readFileSync10(srcPath, "utf-8");
+    let content = readFileSync11(srcPath, "utf-8");
     content = content.replace(/\{\{PROJECT_NAME\}\}/g, projectName);
     writeFileSync2(targetPath, content, "utf-8");
     return { success: true };
@@ -13249,11 +13530,11 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
   }
 }
 function registerMcpServer(projectRoot) {
-  const mcpPath = resolve6(projectRoot, ".mcp.json");
+  const mcpPath = resolve7(projectRoot, ".mcp.json");
   let existing = {};
-  if (existsSync10(mcpPath)) {
+  if (existsSync11(mcpPath)) {
     try {
-      existing = JSON.parse(readFileSync10(mcpPath, "utf-8"));
+      existing = JSON.parse(readFileSync11(mcpPath, "utf-8"));
     } catch {
       existing = {};
     }
@@ -13273,12 +13554,12 @@ function registerMcpServer(projectRoot) {
 }
 function resolveHooksDir() {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve6(cwd, "node_modules/@massu/core/dist/hooks");
-  if (existsSync10(nodeModulesPath)) {
+  const nodeModulesPath = resolve7(cwd, "node_modules/@massu/core/dist/hooks");
+  if (existsSync11(nodeModulesPath)) {
     return "node_modules/@massu/core/dist/hooks";
   }
-  const localPath = resolve6(__dirname2, "../dist/hooks");
-  if (existsSync10(localPath)) {
+  const localPath = resolve7(__dirname2, "../dist/hooks");
+  if (existsSync11(localPath)) {
     return localPath;
   }
   return "node_modules/@massu/core/dist/hooks";
@@ -13370,19 +13651,11 @@ function installHooks(projectRoot) {
   } catch {
     claudeDirName = ".claude";
   }
-  const claudeDir = resolve6(projectRoot, claudeDirName);
-  const settingsPath = resolve6(claudeDir, "settings.local.json");
-  if (!existsSync10(claudeDir)) {
-    mkdirSync4(claudeDir, { recursive: true });
-  }
-  let settings = {};
-  if (existsSync10(settingsPath)) {
-    try {
-      settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
-    } catch {
-      settings = {};
-    }
+  const claudeDir = resolve7(projectRoot, claudeDirName);
+  if (!existsSync11(claudeDir)) {
+    mkdirSync5(claudeDir, { recursive: true });
   }
+  const settings = readSettingsLocal(claudeDir);
   const hooksDir = resolveHooksDir();
   const hooksConfig = buildHooksConfig(hooksDir);
   let hookCount = 0;
@@ -13392,20 +13665,20 @@ function installHooks(projectRoot) {
     }
   }
   settings.hooks = hooksConfig;
-  writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+  writeSettingsLocalAtomic(claudeDir, settings);
   return { installed: true, count: hookCount };
 }
 function initMemoryDir(projectRoot) {
   const encodedRoot = "-" + projectRoot.replace(/\//g, "-");
-  const memoryDir = resolve6(homedir3(), `.claude/projects/${encodedRoot}/memory`);
+  const memoryDir = resolve7(homedir4(), `.claude/projects/${encodedRoot}/memory`);
   let created = false;
-  if (!existsSync10(memoryDir)) {
-    mkdirSync4(memoryDir, { recursive: true });
+  if (!existsSync11(memoryDir)) {
+    mkdirSync5(memoryDir, { recursive: true });
     created = true;
   }
-  const memoryMdPath = resolve6(memoryDir, "MEMORY.md");
+  const memoryMdPath = resolve7(memoryDir, "MEMORY.md");
   let memoryMdCreated = false;
-  if (!existsSync10(memoryMdPath)) {
+  if (!existsSync11(memoryMdPath)) {
     const projectName = basename4(projectRoot);
     const memoryContent = `# ${projectName} - Massu Memory
@@ -13511,8 +13784,8 @@ async function runInit(argv, overrides) {
   log("Massu AI - Project Setup");
   log("========================");
   log("");
-  const configPath = resolve6(projectRoot, "massu.config.yaml");
-  if (existsSync10(configPath)) {
+  const configPath = resolve7(projectRoot, "massu.config.yaml");
+  if (existsSync11(configPath)) {
     if (opts.ci && !opts.force) {
       errLog(`error: massu.config.yaml already exists at ${configPath}`);
       errLog("       rerun with --force to overwrite, or remove the file first");
@@ -13651,8 +13924,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
       const commandStats = cmdResult.assets.commands;
       const stackResolved = !emptyStack && commandStats && (commandStats.installed > 0 || commandStats.updated > 0 || commandStats.kept > 0);
       if (!stackResolved) {
-        const placeholderPath = resolve6(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (!existsSync10(placeholderPath)) {
+        const placeholderPath = resolve7(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (!existsSync11(placeholderPath)) {
           const placeholderBody = [
             "# Massu \u2014 stack not yet detected",
             "",
@@ -13673,7 +13946,7 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
             "\u2014 Massu"
           ].join("\n");
           try {
-            mkdirSync4(resolve6(cmdResult.claudeDir, "commands"), { recursive: true });
+            mkdirSync5(resolve7(cmdResult.claudeDir, "commands"), { recursive: true });
             writeFileSync2(placeholderPath, placeholderBody, "utf-8");
             log("  Wrote _massu-needs-stack.md placeholder (no stack detected yet)");
           } catch {
@@ -13693,8 +13966,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
   (async () => {
     try {
       const encodedRoot = projectRoot.replace(/\//g, "-");
-      const memoryDir = resolve6(homedir3(), ".claude", "projects", encodedRoot, "memory");
-      const memFiles = existsSync10(memoryDir) ? readdirSync10(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
+      const memoryDir = resolve7(homedir4(), ".claude", "projects", encodedRoot, "memory");
+      const memFiles = existsSync11(memoryDir) ? readdirSync10(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
       if (memFiles.length > 0) {
         const { getMemoryDb: getMemoryDb2 } = await Promise.resolve().then(() => (init_memory_db(), memory_db_exports));
         const db = getMemoryDb2();
@@ -13751,10 +14024,11 @@ var init_init = __esm({
     init_memory_file_ingest();
     init_config();
     init_install_commands();
+    init_settings_local();
     init_detect();
     init_drift();
     __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname5(__filename2);
+    __dirname2 = dirname6(__filename2);
     FRAMEWORK_TO_TEMPLATE_ID = {
       rails: "rails",
       phoenix: "phoenix",
@@ -13776,7 +14050,7 @@ var init_init = __esm({
 });
 // src/license.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function tierLevel(tier) {
   return TIER_LEVELS[tier] ?? 0;
 }
@@ -13804,7 +14078,7 @@ function isCloudFeatureAvailable() {
   return getConfig().cloud?.enabled === true;
 }
 async function validateLicense(apiKey) {
-  const keyHash = createHash4("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash5("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     const cached = memDb.prepare(
@@ -13865,7 +14139,7 @@ async function validateLicense(apiKey) {
   }
 }
 function updateLicenseCache(apiKey, tier, validUntil, features = []) {
-  const keyHash = createHash4("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash5("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     memDb.prepare(`
@@ -14073,17 +14347,17 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   runValidateConfig: () => runValidateConfig
 });
-import { existsSync as existsSync11, readFileSync as readFileSync11, readdirSync as readdirSync11 } from "fs";
-import { resolve as resolve7, dirname as dirname6 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync11 } from "fs";
+import { resolve as resolve8, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parse as parseYaml4 } from "yaml";
 function checkConfig(projectRoot) {
-  const configPath = resolve7(projectRoot, "massu.config.yaml");
-  if (!existsSync11(configPath)) {
+  const configPath = resolve8(projectRoot, "massu.config.yaml");
+  if (!existsSync12(configPath)) {
     return { name: "Configuration", status: "fail", detail: "massu.config.yaml not found. Run: npx massu init" };
   }
   try {
-    const content = readFileSync11(configPath, "utf-8");
+    const content = readFileSync12(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       return { name: "Configuration", status: "fail", detail: "massu.config.yaml is empty or invalid YAML" };
@@ -14095,11 +14369,11 @@ function checkConfig(projectRoot) {
 }
 function checkMcpServer(projectRoot) {
   const mcpPath = getResolvedPaths().mcpJsonPath;
-  if (!existsSync11(mcpPath)) {
+  if (!existsSync12(mcpPath)) {
     return { name: "MCP Server", status: "fail", detail: ".mcp.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync11(mcpPath, "utf-8"));
+    const content = JSON.parse(readFileSync12(mcpPath, "utf-8"));
     const servers = content.mcpServers ?? {};
     if (!servers.massu) {
       return { name: "MCP Server", status: "fail", detail: "massu not registered in .mcp.json. Run: npx massu init" };
@@ -14111,11 +14385,11 @@ function checkMcpServer(projectRoot) {
 }
 function checkHooksConfig(projectRoot) {
   const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync11(settingsPath)) {
+  if (!existsSync12(settingsPath)) {
     return { name: "Hooks Config", status: "fail", detail: ".claude/settings.local.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+    const content = readSettingsAtPath(settingsPath);
     if (!content.hooks) {
       return { name: "Hooks Config", status: "fail", detail: "No hooks configured. Run: npx massu install-hooks" };
     }
@@ -14139,11 +14413,11 @@ function checkHooksConfig(projectRoot) {
   }
 }
 function checkHookFiles(projectRoot) {
-  const nodeModulesHooksDir = resolve7(projectRoot, "node_modules/@massu/core/dist/hooks");
+  const nodeModulesHooksDir = resolve8(projectRoot, "node_modules/@massu/core/dist/hooks");
   let hooksDir = nodeModulesHooksDir;
-  if (!existsSync11(nodeModulesHooksDir)) {
-    const devHooksDir = resolve7(__dirname3, "../../dist/hooks");
-    if (existsSync11(devHooksDir)) {
+  if (!existsSync12(nodeModulesHooksDir)) {
+    const devHooksDir = resolve8(__dirname3, "../../dist/hooks");
+    if (existsSync12(devHooksDir)) {
       hooksDir = devHooksDir;
     } else {
       return { name: "Hook Files", status: "fail", detail: "Compiled hooks not found. Run: npm install @massu/core" };
@@ -14151,7 +14425,7 @@ function checkHookFiles(projectRoot) {
   }
   const missing = [];
   for (const hookFile of EXPECTED_HOOKS) {
-    if (!existsSync11(resolve7(hooksDir, hookFile))) {
+    if (!existsSync12(resolve8(hooksDir, hookFile))) {
       missing.push(hookFile);
     }
   }
@@ -14177,8 +14451,8 @@ function checkNodeVersion() {
   return { name: "Node.js", status: "fail", detail: `v${version} \u2014 Node.js 18+ is required` };
 }
 async function checkGitRepo(projectRoot) {
-  const gitDir = resolve7(projectRoot, ".git");
-  if (!existsSync11(gitDir)) {
+  const gitDir = resolve8(projectRoot, ".git");
+  if (!existsSync12(gitDir)) {
     return { name: "Git Repository", status: "warn", detail: "Not a git repository (optional but recommended)" };
   }
   try {
@@ -14196,7 +14470,7 @@ async function checkGitRepo(projectRoot) {
 }
 function checkKnowledgeDb(projectRoot) {
   const knowledgeDbPath = getResolvedPaths().memoryDbPath;
-  if (!existsSync11(knowledgeDbPath)) {
+  if (!existsSync12(knowledgeDbPath)) {
     return {
       name: "Knowledge DB",
       status: "warn",
@@ -14207,7 +14481,7 @@ function checkKnowledgeDb(projectRoot) {
 }
 function checkMemoryDir(_projectRoot2) {
   const memoryDir = getResolvedPaths().memoryDir;
-  if (!existsSync11(memoryDir)) {
+  if (!existsSync12(memoryDir)) {
     return {
       name: "Memory Directory",
       status: "warn",
@@ -14218,7 +14492,7 @@ function checkMemoryDir(_projectRoot2) {
 }
 function checkShellHooksWired(_projectRoot2) {
   const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync11(settingsPath)) {
+  if (!existsSync12(settingsPath)) {
     return {
       name: "Shell Hooks",
       status: "fail",
@@ -14226,7 +14500,7 @@ function checkShellHooksWired(_projectRoot2) {
     };
   }
   try {
-    const content = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+    const content = readSettingsAtPath(settingsPath);
     const hooks = content.hooks ?? {};
     const hasSessionStart = Array.isArray(hooks.SessionStart) && hooks.SessionStart.length > 0;
     const hasPreToolUse = Array.isArray(hooks.PreToolUse) && hooks.PreToolUse.length > 0;
@@ -14277,8 +14551,8 @@ async function checkLicenseStatus() {
 function checkPythonHealth(projectRoot) {
   const config = getConfig();
   if (!config.python?.root) return null;
-  const pythonRoot = resolve7(projectRoot, config.python.root);
-  if (!existsSync11(pythonRoot)) {
+  const pythonRoot = resolve8(projectRoot, config.python.root);
+  if (!existsSync12(pythonRoot)) {
     return {
       name: "Python",
       status: "fail",
@@ -14297,8 +14571,8 @@ function checkPythonHealth(projectRoot) {
         if (entry.isDirectory()) {
           const excludeDirs = config.python?.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
           if (!excludeDirs.includes(entry.name)) {
-            const subdir = resolve7(dir, entry.name);
-            if (depth <= 2 && !existsSync11(resolve7(subdir, "__init__.py"))) {
+            const subdir = resolve8(dir, entry.name);
+            if (depth <= 2 && !existsSync12(resolve8(subdir, "__init__.py"))) {
               try {
                 const subEntries = readdirSync11(subdir);
                 if (subEntries.some((f2) => f2.endsWith(".py") && f2 !== "__init__.py")) {
@@ -14393,15 +14667,15 @@ async function runDoctor() {
 }
 async function runValidateConfig() {
   const projectRoot = process.cwd();
-  const configPath = resolve7(projectRoot, "massu.config.yaml");
-  if (!existsSync11(configPath)) {
+  const configPath = resolve8(projectRoot, "massu.config.yaml");
+  if (!existsSync12(configPath)) {
     console.error("Error: massu.config.yaml not found in current directory");
     console.error("Run: npx massu init");
     process.exit(1);
     return;
   }
   try {
-    const content = readFileSync11(configPath, "utf-8");
+    const content = readFileSync12(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       console.error("Error: massu.config.yaml is empty or not a valid YAML object");
@@ -14439,8 +14713,9 @@ var init_doctor = __esm({
     "use strict";
     init_config();
     init_license();
+    init_settings_local();
     __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname6(__filename3);
+    __dirname3 = dirname7(__filename3);
     EXPECTED_HOOKS = [
       "session-start.js",
       "session-end.js",
@@ -14481,13 +14756,140 @@ var init_install_hooks = __esm({
   }
 });
+// src/commands/permissions.ts
+var permissions_exports = {};
+__export(permissions_exports, {
+  handlePermissionsSubcommand: () => handlePermissionsSubcommand,
+  printPermissionsHelp: () => printPermissionsHelp
+});
+import { resolve as resolve9 } from "path";
+function resolveClaudeDir2() {
+  let claudeDirName = ".claude";
+  try {
+    claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
+  } catch {
+    claudeDirName = ".claude";
+  }
+  return resolve9(process.cwd(), claudeDirName);
+}
+async function handlePermissionsSubcommand(args2) {
+  const sub = args2[0];
+  switch (sub) {
+    case "install": {
+      const claudeDir = resolveClaudeDir2();
+      const result = runWithManifest(
+        claudeDir,
+        (manifest) => installPermissions(claudeDir, manifest, { silent: false })
+      );
+      if (result.installed > 0) {
+        process.stdout.write(
+          "Wrote merged permissions block to .claude/settings.local.json.\n"
+        );
+      } else if (result.skipped > 0) {
+        process.stdout.write("Permissions already in sync \u2014 no changes.\n");
+      } else if (result.kept > 0) {
+        process.stdout.write(
+          "Operator-edited permissions block preserved. Run `npx massu permissions check-drift` to inspect.\n"
+        );
+      }
+      return { exitCode: 0 };
+    }
+    case "verify": {
+      const claudeDir = resolveClaudeDir2();
+      const { missing } = verifyPermissions(claudeDir);
+      if (missing.length === 0) {
+        process.stdout.write("All MCP allowlist entries present.\n");
+        return { exitCode: 0 };
+      }
+      for (const entry of missing) {
+        process.stderr.write(`missing: ${entry}
+`);
+      }
+      return { exitCode: 1 };
+    }
+    case "check-drift": {
+      const claudeDir = resolveClaudeDir2();
+      const { driftItems } = checkPermissionsDrift(claudeDir);
+      if (driftItems.length === 0) {
+        process.stdout.write("No permission drift detected.\n");
+        return { exitCode: 0 };
+      }
+      let highest = 0;
+      for (const item of driftItems) {
+        const code = DRIFT_KIND_EXIT_CODE[item.kind];
+        if (code > highest) highest = code;
+        process.stderr.write(
+          `drift[${item.kind}]: ${item.detail} \u2014 remediation: ${item.remediation}
+`
+        );
+      }
+      return { exitCode: highest };
+    }
+    case "--help":
+    case "-h":
+    case void 0: {
+      printPermissionsHelp();
+      return { exitCode: 0 };
+    }
+    default: {
+      process.stderr.write(`massu: unknown permissions subcommand: ${sub}
+`);
+      printPermissionsHelp();
+      return { exitCode: 1 };
+    }
+  }
+}
+function printPermissionsHelp() {
+  process.stdout.write(`
+massu permissions <subcommand>
+Subcommands:
+  install       Seed mcp__massu__* into .claude/settings.local.json's permissions.allow.
+                  Also propagates global defaultMode (from ~/.claude/settings.json) into
+                  the project-local file to prevent the merge-replacement trap (see
+                  https://massu.ai/docs/reference/cli-reference#permissions-trap).
+                  Idempotent. Preserves operator-edited values.
+  verify        Read-only check that all canonical MCP allowlist entries are present.
+                  Exit 0 if clean, exit 1 with one diagnostic line per missing entry.
+  check-drift   Extended diagnostic surfacing 4 drift kinds:
+                  - missing-allow             (exit 1) \u2014 canonical entries missing
+                  - invalid-default-mode      (exit 2) \u2014 defaultMode requires launch flag
+                  - unknown-key               (exit 3) \u2014 undocumented top-level setting
+                  - strips-global-defaultmode (exit 4) \u2014 project-local would strip global value
+Examples:
+  npx massu permissions install
+  npx massu permissions verify
+  npx massu permissions check-drift
+Documentation: https://massu.ai/docs/reference/cli-reference#massu-permissions
+`);
+}
+var DRIFT_KIND_EXIT_CODE;
+var init_permissions2 = __esm({
+  "src/commands/permissions.ts"() {
+    "use strict";
+    init_config();
+    init_permissions();
+    init_install_commands();
+    DRIFT_KIND_EXIT_CODE = {
+      "missing-allow": 1,
+      "invalid-default-mode": 2,
+      "unknown-key": 3,
+      "strips-global-defaultmode": 4
+    };
+  }
+});
 // src/commands/show-template.ts
 var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
-import { resolve as resolve8 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
+import { resolve as resolve10 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
 }
@@ -14515,14 +14917,14 @@ async function runShowTemplate(args2) {
     return;
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
-  const file = suffix === "" ? resolve8(sourceDir, `${baseName}.md`) : resolve8(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync12(file)) {
+  const file = suffix === "" ? resolve10(sourceDir, `${baseName}.md`) : resolve10(sourceDir, `${baseName}${suffix}.md`);
+  if (!existsSync13(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync12(file, "utf-8"));
+  process.stdout.write(readFileSync13(file, "utf-8"));
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
@@ -14575,12 +14977,12 @@ var init_passthrough = __esm({
 });
 // src/lib/fileLock.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname7 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync14, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname8 } from "path";
 import * as lockfile from "proper-lockfile";
 function readLockHolderPid(lockPath) {
   try {
-    const raw = readFileSync13(`${lockPath}.pid`, "utf-8").trim();
+    const raw = readFileSync14(`${lockPath}.pid`, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
@@ -14599,7 +15001,7 @@ function busyWaitSync(ms) {
   Atomics.wait(view, 0, 0, ms);
 }
 function withFileLockSync(lockPath, fn, opts = {}) {
-  mkdirSync5(dirname7(lockPath), { recursive: true });
+  mkdirSync6(dirname8(lockPath), { recursive: true });
   const staleMs = opts.staleMs ?? 3e4;
   const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 100;
@@ -14667,9 +15069,9 @@ var init_fileLock = __esm({
 });
 // src/lib/installLock.ts
-import { resolve as resolve9 } from "path";
+import { resolve as resolve11 } from "path";
 function withInstallLock(projectRoot, fn, opts = {}) {
-  const lockPath = resolve9(projectRoot, ".massu", "installAll.lock");
+  const lockPath = resolve11(projectRoot, ".massu", "installAll.lock");
   return withFileLockSync(
     lockPath,
     fn,
@@ -14705,8 +15107,8 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync13, readFileSync as readFileSync14, rmSync as rmSync4 } from "fs";
-import { resolve as resolve10 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync15, rmSync as rmSync4 } from "fs";
+import { resolve as resolve12 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
   const out = {};
@@ -14834,17 +15236,17 @@ function renderDiff(diff) {
 }
 async function runConfigRefresh(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve10(cwd, "massu.config.yaml");
+  const configPath = resolve12(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync13(configPath)) {
+  if (!existsSync14(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
   }
   let existing;
   try {
-    const content = readFileSync14(configPath, "utf-8");
+    const content = readFileSync15(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -14917,8 +15319,8 @@ async function runConfigRefresh(opts = {}) {
 `);
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
-        const placeholderPath = resolve10(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync13(placeholderPath)) {
+        const placeholderPath = resolve12(installResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (existsSync14(placeholderPath)) {
           try {
             rmSync4(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -15027,12 +15429,12 @@ var init_gitToplevel = __esm({
 });
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync14, statSync as statSync8 } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync15, statSync as statSync8 } from "fs";
+import { resolve as resolve13 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
-    const p19 = resolve11(projectRoot, lf);
-    if (!existsSync14(p19)) continue;
+    const p19 = resolve13(projectRoot, lf);
+    if (!existsSync15(p19)) continue;
     try {
       const stat = statSync8(p19);
       const delta = now - stat.mtimeMs;
@@ -15045,7 +15447,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync14(resolve11(projectRoot, ".git", s))) return true;
+    if (existsSync15(resolve13(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -15242,18 +15644,18 @@ var init_paths = __esm({
 });
 // src/watch/state.ts
-import { closeSync as closeSync3, existsSync as existsSync15, fsyncSync as fsyncSync3, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync4, writeSync as writeSync3 } from "fs";
-import { dirname as dirname8, resolve as resolve12 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync16, fsyncSync as fsyncSync3, mkdirSync as mkdirSync7, openSync as openSync3, readFileSync as readFileSync16, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync4, writeSync as writeSync3 } from "fs";
+import { dirname as dirname9, resolve as resolve14 } from "path";
 function watchStatePath(projectRoot) {
-  return resolve12(projectRoot, ".massu", "watch-state.json");
+  return resolve14(projectRoot, ".massu", "watch-state.json");
 }
 function backupStatePath(projectRoot) {
-  return resolve12(projectRoot, ".massu", "watch-state.v0.bak.json");
+  return resolve14(projectRoot, ".massu", "watch-state.v0.bak.json");
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync15(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync15(path, "utf-8");
+  if (!existsSync16(path)) return { ...DEFAULT_STATE };
+  const content = readFileSync16(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -15295,14 +15697,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync6(dirname8(bak), { recursive: true });
+  mkdirSync7(dirname9(bak), { recursive: true });
   writeFileSync4(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync6(dirname8(path), { recursive: true });
+  mkdirSync7(dirname9(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync3(tmp, "w");
@@ -15316,7 +15718,7 @@ function writeStateAtomic(projectRoot, state) {
     renameSync4(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync15(tmp)) {
+    if (!renamed && existsSync16(tmp)) {
       try {
         rmSync5(tmp, { force: true });
       } catch {
@@ -15596,8 +15998,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename5, dirname as dirname9, resolve as resolve13 } from "path";
-import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync16 } from "fs";
+import { basename as basename5, dirname as dirname10, resolve as resolve15 } from "path";
+import { appendFileSync, existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync17 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -15622,8 +16024,8 @@ function parseFlags(args2) {
 }
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
-  const fixed = home ? resolve13(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync16(fixed)) return fixed;
+  const fixed = home ? resolve15(home, ".claude", "bin", "claude-bg") : null;
+  if (fixed && existsSync17(fixed)) return fixed;
   const which = spawnSync3("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -15684,7 +16086,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync16(path)) {
+  if (!existsSync17(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -15766,7 +16168,7 @@ async function runForeground(root) {
     }
     throw err;
   }
-  return new Promise((resolve36) => {
+  return new Promise((resolve38) => {
     const shutdown = async () => {
       if (stopped) return;
       stopped = true;
@@ -15776,7 +16178,7 @@ async function runForeground(root) {
         process.chdir(priorCwd);
       } catch {
       }
-      resolve36({ exitCode: 0 });
+      resolve38({ exitCode: 0 });
     };
     process.on("SIGINT", () => {
       void shutdown();
@@ -15837,23 +16239,23 @@ async function runOnQuiescent(projectRoot) {
   );
 }
 function refreshLogPath(projectRoot) {
-  return resolve13(projectRoot, ".massu", "refresh-log.jsonl");
+  return resolve15(projectRoot, ".massu", "refresh-log.jsonl");
 }
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync7(dirname9(path), { recursive: true });
+    mkdirSync8(dirname10(path), { recursive: true });
     appendFileSync(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync16(path)) return [];
+  if (!existsSync17(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync16(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync17(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out = [];
   let corrupt = 0;
@@ -15926,26 +16328,26 @@ var init_refresh_log = __esm({
 import {
   chmodSync as chmodSync3,
   closeSync as closeSync4,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   fsyncSync as fsyncSync4,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync4,
   renameSync as renameSync5,
   rmSync as rmSync6,
   statSync as statSync9,
   writeSync as writeSync4
 } from "node:fs";
-import { dirname as dirname10 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
-  const parentDir = dirname10(path);
+  const parentDir = dirname11(path);
   try {
-    if (!existsSync17(parentDir)) {
+    if (!existsSync18(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync8(parentDir, mkdirOpts);
+      mkdirSync9(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -15962,7 +16364,7 @@ function atomicWrite(path, content, opts = {}) {
     renameSync5(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync17(tmpPath)) {
+    if (existsSync18(tmpPath)) {
       try {
         rmSync6(tmpPath, { force: true });
       } catch {
@@ -16042,10 +16444,10 @@ var init_registry_pubkey_generated = __esm({
 });
 // src/security/adapter-verifier.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import nacl from "tweetnacl";
-function sha256Hex(bytes) {
-  return createHash5("sha256").update(bytes).digest("hex");
+function sha256Hex2(bytes) {
+  return createHash6("sha256").update(bytes).digest("hex");
 }
 function reviver(key, value) {
   if (key === "__proto__" || key === "constructor" || key === "prototype") {
@@ -16088,7 +16490,7 @@ function verifyManifest(input) {
   if (manifestBytes.length === 0) {
     return { ok: false, reason: "manifest_b64 decoded to zero bytes" };
   }
-  const computedSha = sha256Hex(manifestBytes);
+  const computedSha = sha256Hex2(manifestBytes);
   if (computedSha !== envelope.manifest_sha256) {
     return {
       ok: false,
@@ -16142,10 +16544,10 @@ function verifyManifest(input) {
   if (!sigOk) {
     return {
       ok: false,
-      reason: `Ed25519 signature verification failed against bundled public key (fingerprint ${sha256Hex(publicKey).slice(0, 16)}...). Manifest was either signed by a different key OR the signature is corrupt.`
+      reason: `Ed25519 signature verification failed against bundled public key (fingerprint ${sha256Hex2(publicKey).slice(0, 16)}...). Manifest was either signed by a different key OR the signature is corrupt.`
     };
   }
-  const expectedKeyId = sha256Hex(publicKey);
+  const expectedKeyId = sha256Hex2(publicKey);
   if (envelope.signing_key_id !== expectedKeyId) {
     return {
       ok: false,
@@ -16305,24 +16707,24 @@ var init_fetcher = __esm({
 });
 // src/security/manifest-cache.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { resolve as resolve14 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync18, statSync as statSync10 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { resolve as resolve16 } from "node:path";
 import { z as z4 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve14(homedir4(), ".massu");
+  const dir = resolve16(homedir5(), ".massu");
   return {
-    cachePath: resolve14(dir, "adapter-manifest.json"),
-    lockPath: resolve14(dir, ".adapter-manifest.lock")
+    cachePath: resolve16(dir, "adapter-manifest.json"),
+    lockPath: resolve16(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync18(paths.cachePath)) {
+  if (!existsSync19(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
   try {
-    const content = readFileSync17(paths.cachePath, "utf-8");
+    const content = readFileSync18(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err) {
     return {
@@ -16511,15 +16913,15 @@ var init_adapter_origin = __esm({
 });
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18, lstatSync as lstatSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { resolve as resolve15, isAbsolute } from "node:path";
-import { createHash as createHash6 } from "node:crypto";
+import { existsSync as existsSync20, readFileSync as readFileSync19, lstatSync as lstatSync5 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { resolve as resolve17, isAbsolute } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
 import { z as z5 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
   for (const p19 of localPaths) {
-    const abs = isAbsolute(p19) ? p19 : resolve15(projectRoot, p19);
+    const abs = isAbsolute(p19) ? p19 : resolve17(projectRoot, p19);
     let contentTag;
     try {
       const lst = lstatSync5(abs);
@@ -16528,7 +16930,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash6("sha256").update(readFileSync18(abs)).digest("hex");
+        contentTag = createHash7("sha256").update(readFileSync19(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -16537,13 +16939,13 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   }
   tuples.sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
   const canonical = JSON.stringify(tuples);
-  return createHash6("sha256").update(canonical).digest("hex");
+  return createHash7("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync19(path)) return null;
+  if (!existsSync20(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync18(path, "utf-8"));
+    raw = JSON.parse(readFileSync19(path, "utf-8"));
   } catch {
     return null;
   }
@@ -16591,7 +16993,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve15(homedir5(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve17(homedir6(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z5.object({
       fingerprint: z5.string().regex(/^[0-9a-f]{64}$/),
       source: z5.enum(["cli", "cli-resync"]),
@@ -16607,15 +17009,15 @@ var init_local_fingerprint = __esm({
 });
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync19, readdirSync as readdirSync12, lstatSync as lstatSync6, existsSync as existsSync20 } from "node:fs";
-import { join as join10, relative as relative5, sep } from "node:path";
-import { homedir as homedir6 } from "node:os";
-import { resolve as resolve16 } from "node:path";
-import { createHash as createHash7 } from "node:crypto";
+import { readFileSync as readFileSync20, readdirSync as readdirSync12, lstatSync as lstatSync6, existsSync as existsSync21 } from "node:fs";
+import { join as join11, relative as relative5, sep } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { resolve as resolve18 } from "node:path";
+import { createHash as createHash8 } from "node:crypto";
 import { z as z6 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync20(`${packageDir}/${hidden}`)) {
+    if (existsSync21(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -16632,7 +17034,7 @@ function sha256OfDir(dir, opts = {}) {
       return;
     }
     for (const entry of entries.sort()) {
-      const absPath = join10(currentDir, entry);
+      const absPath = join11(currentDir, entry);
       let lst;
       try {
         lst = lstatSync6(absPath);
@@ -16659,9 +17061,9 @@ function sha256OfDir(dir, opts = {}) {
   }
   walk(dir);
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
-  const top = createHash7("sha256");
+  const top = createHash8("sha256");
   for (const f2 of files) {
-    const fileHash = createHash7("sha256").update(readFileSync19(f2.absPath)).digest("hex");
+    const fileHash = createHash8("sha256").update(readFileSync20(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -16670,10 +17072,10 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync20(path)) return {};
+  if (!existsSync21(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(path, "utf-8"));
+    raw = JSON.parse(readFileSync20(path, "utf-8"));
   } catch {
     return {};
   }
@@ -16737,7 +17139,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve16(homedir6(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve18(homedir7(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z6.object({
@@ -16760,12 +17162,12 @@ var init_install_tracking = __esm({
 });
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync20, lstatSync as lstatSync7 } from "node:fs";
-import { resolve as resolve17, isAbsolute as isAbsolute2 } from "node:path";
+import { existsSync as existsSync22, readdirSync as readdirSync13, readFileSync as readFileSync21, lstatSync as lstatSync7 } from "node:fs";
+import { resolve as resolve19, isAbsolute as isAbsolute2 } from "node:path";
 import { z as z7 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
-  const nodeModulesDir = resolve17(projectRoot, "node_modules");
-  if (!existsSync21(nodeModulesDir)) {
+  const nodeModulesDir = resolve19(projectRoot, "node_modules");
+  if (!existsSync22(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
@@ -16778,7 +17180,7 @@ function walkNodeModules(projectRoot, warnings) {
   }
   for (const entry of topLevelEntries) {
     if (entry.startsWith(".")) continue;
-    const entryPath = resolve17(nodeModulesDir, entry);
+    const entryPath = resolve19(nodeModulesDir, entry);
     let entryStat;
     try {
       entryStat = lstatSync7(entryPath);
@@ -16800,7 +17202,7 @@ function walkNodeModules(projectRoot, warnings) {
         continue;
       }
       for (const sub of scopedEntries) {
-        const subPath = resolve17(entryPath, sub);
+        const subPath = resolve19(entryPath, sub);
         let subStat;
         try {
           subStat = lstatSync7(subPath);
@@ -16819,11 +17221,11 @@ function walkNodeModules(projectRoot, warnings) {
   return candidates;
 }
 function tryReadAdapterPackage(packageDir, warnings) {
-  const pkgJsonPath = resolve17(packageDir, "package.json");
-  if (!existsSync21(pkgJsonPath)) return null;
+  const pkgJsonPath = resolve19(packageDir, "package.json");
+  if (!existsSync22(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync20(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync21(pkgJsonPath, "utf-8"));
   } catch (err) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err instanceof Error ? err.message : String(err)})`
@@ -16957,8 +17359,8 @@ function discoverAdapters(opts) {
   const localSet = new Set(opts.configLocalPaths);
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
-    const absPath = isAbsolute2(localPath) ? localPath : resolve17(opts.projectRoot, localPath);
-    if (!existsSync21(absPath)) {
+    const absPath = isAbsolute2(localPath) ? localPath : resolve19(opts.projectRoot, localPath);
+    if (!existsSync22(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -17039,8 +17441,8 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync22, readFileSync as readFileSync21 } from "node:fs";
-import { resolve as resolve18 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync22 } from "node:fs";
+import { resolve as resolve20 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
   const sub = args2[0];
@@ -17307,8 +17709,8 @@ function mutateLocalArray(mutator, command) {
     );
     return { exitCode: 2 };
   }
-  const yamlPath = resolve18(projectRoot, "massu.config.yaml");
-  if (!existsSync22(yamlPath)) {
+  const yamlPath = resolve20(projectRoot, "massu.config.yaml");
+  if (!existsSync23(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -17317,7 +17719,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync21(yamlPath, "utf-8");
+    yamlText = readFileSync22(yamlPath, "utf-8");
   } catch (err) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -17338,7 +17740,7 @@ function mutateLocalArray(mutator, command) {
   if (next === null) {
     return { exitCode: 0 };
   }
-  const lockPath = resolve18(projectRoot, ".massu", "adapters-local-mutate.lock");
+  const lockPath = resolve20(projectRoot, ".massu", "adapters-local-mutate.lock");
   return withFileLockSync(lockPath, () => {
     doc.setIn(["adapters", "local"], next);
     const newYaml = doc.toString();
@@ -17407,23 +17809,23 @@ async function runAdaptersInstall(args2) {
 `);
     return { exitCode: 1 };
   }
-  const packageDir = resolve18(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync22(packageDir)) {
+  const packageDir = resolve20(projectRoot, "node_modules", ...packageName.split("/"));
+  if (!existsSync23(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
     );
     return { exitCode: 1 };
   }
-  const pkgJsonPath = resolve18(packageDir, "package.json");
-  if (!existsSync22(pkgJsonPath)) {
+  const pkgJsonPath = resolve20(packageDir, "package.json");
+  if (!existsSync23(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync21(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync22(pkgJsonPath, "utf-8"));
   } catch (err) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -17542,8 +17944,8 @@ async function runAdaptersResign(_args) {
       removeInstalledManifestEntry(name);
       continue;
     }
-    const packageDir = resolve18(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync22(packageDir)) {
+    const packageDir = resolve20(projectRoot, "node_modules", ...name.split("/"));
+    if (!existsSync23(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -17630,11 +18032,11 @@ var init_adapters2 = __esm({
 // src/db.ts
 import Database2 from "better-sqlite3";
-import { dirname as dirname11, join as join11 } from "path";
-import { existsSync as existsSync23, mkdirSync as mkdirSync9, readdirSync as readdirSync14, statSync as statSync11 } from "fs";
+import { dirname as dirname12, join as join12 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync10, readdirSync as readdirSync14, statSync as statSync11 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
-  if (!existsSync23(dbPath)) {
+  if (!existsSync24(dbPath)) {
     throw new CodegraphDbNotInitializedError(dbPath);
   }
   const db = new Database2(dbPath, { readonly: true });
@@ -17643,9 +18045,9 @@ function getCodeGraphDb() {
 }
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
-  const dir = dirname11(dbPath);
-  if (!existsSync23(dir)) {
-    mkdirSync9(dir, { recursive: true });
+  const dir = dirname12(dbPath);
+  if (!existsSync24(dir)) {
+    mkdirSync10(dir, { recursive: true });
   }
   const db = new Database2(dbPath);
   db.pragma("journal_mode = WAL");
@@ -17917,7 +18319,7 @@ function isPythonDataStale(dataDb, pythonRoot) {
     try {
       const entries = readdirSync14(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = join11(dir, entry.name);
+        const fullPath = join12(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
@@ -17951,10 +18353,10 @@ var init_db = __esm({
 });
 // src/security-utils.ts
-import { resolve as resolve19, normalize } from "path";
+import { resolve as resolve21, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
-  const resolvedRoot = resolve19(projectRoot);
-  const resolvedPath = resolve19(resolvedRoot, filePath);
+  const resolvedRoot = resolve21(projectRoot);
+  const resolvedPath = resolve21(resolvedRoot, filePath);
   const normalizedPath = normalize(resolvedPath);
   const normalizedRoot = normalize(resolvedRoot);
   if (!normalizedPath.startsWith(normalizedRoot + "/") && normalizedPath !== normalizedRoot) {
@@ -18027,8 +18429,8 @@ var init_rules = __esm({
 });
 // src/import-resolver.ts
-import { readFileSync as readFileSync22, existsSync as existsSync24, statSync as statSync12 } from "fs";
-import { resolve as resolve20, dirname as dirname12, join as join12 } from "path";
+import { readFileSync as readFileSync23, existsSync as existsSync25, statSync as statSync12 } from "fs";
+import { resolve as resolve22, dirname as dirname13, join as join13 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -18084,23 +18486,23 @@ function resolveImportPath(specifier, fromFile) {
   let basePath;
   if (specifier.startsWith("@/")) {
     const paths = getResolvedPaths();
-    basePath = resolve20(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
+    basePath = resolve22(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve20(dirname12(fromFile), specifier);
+    basePath = resolve22(dirname13(fromFile), specifier);
   }
-  if (existsSync24(basePath) && !isDirectory(basePath)) {
+  if (existsSync25(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync24(withExt)) {
+    if (existsSync25(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
-    const indexPath = join12(basePath, indexFile);
-    if (existsSync24(indexPath)) {
+    const indexPath = join13(basePath, indexFile);
+    if (existsSync25(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -18136,11 +18538,11 @@ function buildImportIndex(dataDb, codegraphDb) {
   const batchSize = 500;
   let batch = [];
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve20(projectRoot, file.path), projectRoot);
-    if (!existsSync24(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve22(projectRoot, file.path), projectRoot);
+    if (!existsSync25(absPath)) continue;
     let source;
     try {
-      source = readFileSync22(absPath, "utf-8");
+      source = readFileSync23(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -18176,15 +18578,15 @@ var init_import_resolver = __esm({
 });
 // src/trpc-index.ts
-import { readFileSync as readFileSync23, existsSync as existsSync25, readdirSync as readdirSync15 } from "fs";
-import { resolve as resolve21, join as join13 } from "path";
+import { readFileSync as readFileSync24, existsSync as existsSync26, readdirSync as readdirSync15 } from "fs";
+import { resolve as resolve23, join as join14 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync25(rootPath)) {
+  if (!existsSync26(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync23(rootPath, "utf-8");
+  const source = readFileSync24(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -18192,16 +18594,16 @@ function parseRootRouter() {
   while ((match = importRegex.exec(source)) !== null) {
     const variable = match[1];
     let filePath = match[2];
-    const fullPath = resolve21(paths.routersDir, filePath);
+    const fullPath = resolve23(paths.routersDir, filePath);
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync25(candidate)) {
+      if (existsSync26(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
-      const indexCandidate = join13(fullPath, "index.ts");
-      if (existsSync25(indexCandidate)) {
+      const indexCandidate = join14(fullPath, "index.ts");
+      if (existsSync26(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -18220,9 +18622,9 @@ function parseRootRouter() {
   return mappings;
 }
 function extractProcedures(routerFilePath) {
-  const absPath = resolve21(getProjectRoot(), routerFilePath);
-  if (!existsSync25(absPath)) return [];
-  const source = readFileSync23(absPath, "utf-8");
+  const absPath = resolve23(getProjectRoot(), routerFilePath);
+  if (!existsSync26(absPath)) return [];
+  const source = readFileSync24(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -18245,13 +18647,13 @@ function findUICallSites(routerKey, procedureName) {
   const root = getProjectRoot();
   const src = config.paths.source;
   const searchDirs = [
-    resolve21(root, config.paths.pages ?? src + "/app"),
-    resolve21(root, config.paths.components ?? src + "/components"),
-    resolve21(root, config.paths.hooks ?? src + "/hooks")
+    resolve23(root, config.paths.pages ?? src + "/app"),
+    resolve23(root, config.paths.components ?? src + "/components"),
+    resolve23(root, config.paths.hooks ?? src + "/hooks")
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync25(dir)) continue;
+    if (!existsSync26(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -18259,13 +18661,13 @@ function findUICallSites(routerKey, procedureName) {
 function searchDirectory(dir, pattern, results) {
   const entries = readdirSync15(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join13(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".next") continue;
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync23(fullPath, "utf-8");
+        const source = readFileSync24(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (lines[i].includes(pattern)) {
@@ -18328,8 +18730,8 @@ var init_trpc_index = __esm({
 });
 // src/page-deps.ts
-import { readFileSync as readFileSync24, existsSync as existsSync26 } from "fs";
-import { resolve as resolve22 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync27 } from "fs";
+import { resolve as resolve24 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
   return route || "/";
@@ -18367,10 +18769,10 @@ function findRouterCalls(files) {
   const routers = /* @__PURE__ */ new Set();
   const projectRoot = getProjectRoot();
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve22(projectRoot, file), projectRoot);
-    if (!existsSync26(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve24(projectRoot, file), projectRoot);
+    if (!existsSync27(absPath)) continue;
     try {
-      const source = readFileSync24(absPath, "utf-8");
+      const source = readFileSync25(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -18388,10 +18790,10 @@ function findTablesFromRouters(routerNames, dataDb) {
       "SELECT DISTINCT router_file FROM massu_trpc_procedures WHERE router_name = ?"
     ).all(routerName);
     for (const proc of procs) {
-      const absPath = ensureWithinRoot(resolve22(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync26(absPath)) continue;
+      const absPath = ensureWithinRoot(resolve24(getProjectRoot(), proc.router_file), getProjectRoot());
+      if (!existsSync27(absPath)) continue;
       try {
-        const source = readFileSync24(absPath, "utf-8");
+        const source = readFileSync25(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -18660,14 +19062,14 @@ var init_domains = __esm({
 });
 // src/schema-mapper.ts
-import { readFileSync as readFileSync25, existsSync as existsSync27, readdirSync as readdirSync16 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync26, existsSync as existsSync28, readdirSync as readdirSync16 } from "fs";
+import { join as join15 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync27(schemaPath)) {
+  if (!existsSync28(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync25(schemaPath, "utf-8");
+  const source = readFileSync26(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i = 0;
@@ -18725,14 +19127,14 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync27(routersDir)) return usage;
+  if (!existsSync28(routersDir)) return usage;
   scanDirectory(routersDir, tableName, usage);
   return usage;
 }
 function scanDirectory(dir, tableName, usage) {
   const entries = readdirSync16(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join14(dir, entry.name);
+    const fullPath = join15(dir, entry.name);
     if (entry.isDirectory()) {
       scanDirectory(fullPath, tableName, usage);
     } else if (entry.name.endsWith(".ts")) {
@@ -18742,7 +19144,7 @@ function scanDirectory(dir, tableName, usage) {
 }
 function scanFile(absPath, tableName, usage) {
   try {
-    const source = readFileSync25(absPath, "utf-8");
+    const source = readFileSync26(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -18787,15 +19189,15 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync27(dir)) return result;
+  if (!existsSync28(dir)) return result;
   const entries = readdirSync16(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join14(dir, entry.name);
+    const fullPath = join15(dir, entry.name);
     if (entry.isDirectory()) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync25(fullPath, "utf-8");
+        const source = readFileSync26(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -18940,34 +19342,34 @@ var init_import_parser = __esm({
 });
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync26, existsSync as existsSync28, readdirSync as readdirSync17 } from "fs";
-import { resolve as resolve24, join as join15, relative as relative6, dirname as dirname13 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync29, readdirSync as readdirSync17 } from "fs";
+import { resolve as resolve26, join as join16, relative as relative6, dirname as dirname14 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname13(resolve24(projectRoot, fromFile));
+    let baseDir = dirname14(resolve26(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
-      baseDir = dirname13(baseDir);
+      baseDir = dirname14(baseDir);
     }
     const modulePart = module.replace(/^\.+/, "");
     if (modulePart) {
       const parts2 = modulePart.split(".");
-      return tryResolvePythonPath(join15(baseDir, ...parts2), projectRoot);
+      return tryResolvePythonPath(join16(baseDir, ...parts2), projectRoot);
     }
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join15(resolve24(projectRoot, pythonRoot), ...parts);
+  const candidate = join16(resolve26(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync28(basePath + ".py")) {
+  if (existsSync29(basePath + ".py")) {
     return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync28(join15(basePath, "__init__.py"))) {
-    return relative6(projectRoot, join15(basePath, "__init__.py"));
+  if (existsSync29(join16(basePath, "__init__.py"))) {
+    return relative6(projectRoot, join16(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync28(basePath)) {
+  if (basePath.endsWith(".py") && existsSync29(basePath)) {
     return relative6(projectRoot, basePath);
   }
   return null;
@@ -18979,9 +19381,9 @@ function walkPythonFiles(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPythonFiles(join15(dir, entry.name), excludeDirs));
+        files.push(...walkPythonFiles(join16(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join15(dir, entry.name));
+        files.push(join16(dir, entry.name));
       }
     }
   } catch {
@@ -18990,7 +19392,7 @@ function walkPythonFiles(dir, excludeDirs) {
 }
 function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = resolve24(projectRoot, pythonRoot);
+  const absRoot = resolve26(projectRoot, pythonRoot);
   dataDb.exec("DELETE FROM massu_py_imports");
   const insertStmt = dataDb.prepare(
     "INSERT INTO massu_py_imports (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)"
@@ -19007,7 +19409,7 @@ function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__"
     const relFile = relative6(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync26(absFile, "utf-8");
+      source = readFileSync27(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -19273,8 +19675,8 @@ var init_route_parser = __esm({
 });
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync18 } from "fs";
-import { join as join16, relative as relative7 } from "path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync18 } from "fs";
+import { join as join17, relative as relative7 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
@@ -19282,9 +19684,9 @@ function walkPyFiles(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles(join16(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles(join17(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join16(dir, entry.name));
+        files.push(join17(dir, entry.name));
       }
     }
   } catch {
@@ -19293,7 +19695,7 @@ function walkPyFiles(dir, excludeDirs) {
 }
 function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join16(projectRoot, pythonRoot);
+  const absRoot = join17(projectRoot, pythonRoot);
   dataDb.exec("DELETE FROM massu_py_routes");
   dataDb.exec("DELETE FROM massu_py_route_callers");
   const insertStmt = dataDb.prepare(
@@ -19306,7 +19708,7 @@ function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative7(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync27(absFile, "utf-8");
+        source = readFileSync28(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -19517,8 +19919,8 @@ var init_model_parser = __esm({
 });
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync19 } from "fs";
-import { join as join17, relative as relative8 } from "path";
+import { readFileSync as readFileSync29, readdirSync as readdirSync19 } from "fs";
+import { join as join18, relative as relative8 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
@@ -19526,9 +19928,9 @@ function walkPyFiles2(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles2(join17(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles2(join18(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join17(dir, entry.name));
+        files.push(join18(dir, entry.name));
       }
     }
   } catch {
@@ -19537,7 +19939,7 @@ function walkPyFiles2(dir, excludeDirs) {
 }
 function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join17(projectRoot, pythonRoot);
+  const absRoot = join18(projectRoot, pythonRoot);
   dataDb.exec("DELETE FROM massu_py_models");
   dataDb.exec("DELETE FROM massu_py_fk_edges");
   const insertModel = dataDb.prepare(
@@ -19553,7 +19955,7 @@ function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative8(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync28(absFile, "utf-8");
+        source = readFileSync29(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -19813,19 +20215,19 @@ var init_migration_parser = __esm({
 });
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync29, readdirSync as readdirSync20 } from "fs";
-import { join as join18, relative as relative9 } from "path";
+import { readFileSync as readFileSync30, readdirSync as readdirSync20 } from "fs";
+import { join as join19, relative as relative9 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
-  const absDir = join18(projectRoot, alembicDir);
+  const absDir = join19(projectRoot, alembicDir);
   dataDb.exec("DELETE FROM massu_py_migrations");
-  const versionsDir = join18(absDir, "versions");
+  const versionsDir = join19(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync20(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join18(versionsDir, f2));
+    files = readdirSync20(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join19(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync20(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join18(absDir, f2));
+      files = readdirSync20(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join19(absDir, f2));
     } catch {
     }
   }
@@ -19839,7 +20241,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync29(absFile, "utf-8");
+      source = readFileSync30(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -19873,12 +20275,12 @@ var init_migration_indexer = __esm({
 });
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync21 } from "fs";
-import { join as join19, relative as relative10 } from "path";
+import { readFileSync as readFileSync31, readdirSync as readdirSync21 } from "fs";
+import { join as join20, relative as relative10 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
   const config = getConfig();
-  const srcDir = join19(projectRoot, config.paths.source);
+  const srcDir = join20(projectRoot, config.paths.source);
   const routes = dataDb.prepare("SELECT id, method, path FROM massu_py_routes").all();
   if (routes.length === 0) return 0;
   dataDb.exec("DELETE FROM massu_py_route_callers");
@@ -19910,7 +20312,7 @@ function buildPythonCouplingIndex(dataDb) {
       const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync30(absFile, "utf-8");
+        source = readFileSync31(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -19942,9 +20344,9 @@ function walkFrontendFiles(dir) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
-        files.push(...walkFrontendFiles(join19(dir, entry.name)));
+        files.push(...walkFrontendFiles(join20(dir, entry.name)));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
-        files.push(join19(dir, entry.name));
+        files.push(join20(dir, entry.name));
       }
     }
   } catch {
@@ -20315,8 +20717,8 @@ var init_memory_tools = __esm({
 });
 // src/docs-tools.ts
-import { readFileSync as readFileSync31, existsSync as existsSync29 } from "fs";
-import { resolve as resolve25, basename as basename6 } from "path";
+import { readFileSync as readFileSync32, existsSync as existsSync30 } from "fs";
+import { resolve as resolve27, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -20371,10 +20773,10 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync29(mapPath)) {
+  if (!existsSync30(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync31(mapPath, "utf-8"));
+  return JSON.parse(readFileSync32(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -20444,13 +20846,13 @@ function extractFrontmatter(content) {
 }
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
-  const absPath = ensureWithinRoot(resolve25(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync29(absPath)) {
-    const altPath = ensureWithinRoot(resolve25(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
-    if (!existsSync29(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync31(altPath, "utf-8"));
+  const absPath = ensureWithinRoot(resolve27(getResolvedPaths().srcDir, "..", routerPath), root);
+  if (!existsSync30(absPath)) {
+    const altPath = ensureWithinRoot(resolve27(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
+    if (!existsSync30(altPath)) return [];
+    return extractProcedureNamesFromContent(readFileSync32(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync31(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync32(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -20490,8 +20892,8 @@ function handleDocsAudit(args2) {
   for (const [mappingId, triggeringFiles] of affectedMappings) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
-    const helpPagePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync29(helpPagePath)) {
+    const helpPagePath = ensureWithinRoot(resolve27(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    if (!existsSync30(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -20503,7 +20905,7 @@ function handleDocsAudit(args2) {
       });
       continue;
     }
-    const content = readFileSync31(helpPagePath, "utf-8");
+    const content = readFileSync32(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
@@ -20543,9 +20945,9 @@ function handleDocsAudit(args2) {
     });
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
-        const guidePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync29(guidePath)) {
-          const guideContent = readFileSync31(guidePath, "utf-8");
+        const guidePath = ensureWithinRoot(resolve27(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
+        if (existsSync30(guidePath)) {
+          const guideContent = readFileSync32(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -20578,14 +20980,14 @@ function handleDocsCoverage(args2) {
   const gaps = [];
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
-    const helpPagePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync29(helpPagePath);
+    const helpPagePath = ensureWithinRoot(resolve27(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    const exists = existsSync30(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync31(helpPagePath, "utf-8");
+      const content = readFileSync32(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -20926,8 +21328,8 @@ var init_observability_tools = __esm({
 });
 // src/sentinel-db.ts
-import { existsSync as existsSync30 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync31 } from "fs";
+import { resolve as resolve28 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
   try {
@@ -21163,23 +21565,23 @@ function validateFeatures(db, domainFilter) {
     const missingProcedures = [];
     const missingPages = [];
     for (const comp of components) {
-      const absPath = resolve26(PROJECT_ROOT, comp.component_file);
-      if (!existsSync30(absPath)) {
+      const absPath = resolve28(PROJECT_ROOT, comp.component_file);
+      if (!existsSync31(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
-      const routerPath = resolve26(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync30(routerPath)) {
+      const routerPath = resolve28(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
+      if (!existsSync31(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
-      const absPath = resolve26(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync30(absPath)) {
-        const altPath = resolve26(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync30(altPath)) {
+      const absPath = resolve28(PROJECT_ROOT, routeToPath);
+      if (page.page_route.startsWith("/") && !existsSync31(absPath)) {
+        const altPath = resolve28(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
+        if (!existsSync31(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -21703,8 +22105,8 @@ var init_sentinel_tools = __esm({
 });
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync32, existsSync as existsSync31, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { resolve as resolve27, join as join20, basename as basename7, dirname as dirname14, relative as relative11 } from "path";
+import { readFileSync as readFileSync33, existsSync as existsSync32, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { resolve as resolve29, join as join21, basename as basename7, dirname as dirname15, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -21833,8 +22235,8 @@ function scanComponentExports(dataDb) {
   const projectRoot = getProjectRoot();
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
-  const basePath = resolve27(projectRoot, componentsBase);
-  if (existsSync31(basePath)) {
+  const basePath = resolve29(projectRoot, componentsBase);
+  if (existsSync32(basePath)) {
     try {
       const entries = readdirSync22(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -21846,12 +22248,12 @@ function scanComponentExports(dataDb) {
     }
   }
   for (const dir of componentDirs) {
-    const absDir = resolve27(projectRoot, dir);
-    if (!existsSync31(absDir)) continue;
+    const absDir = resolve29(projectRoot, dir);
+    if (!existsSync32(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative11(projectRoot, file);
-      const source = readFileSync32(file, "utf-8");
+      const source = readFileSync33(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -21877,7 +22279,7 @@ function scanComponentExports(dataDb) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename7(dirname14(relPath));
+        const subdomain = basename7(dirname15(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -21902,7 +22304,7 @@ function walkDir2(dir) {
   try {
     const entries = readdirSync22(dir);
     for (const entry of entries) {
-      const fullPath = join20(dir, entry);
+      const fullPath = join21(dir, entry);
       try {
         const stat = statSync13(fullPath);
         if (stat.isDirectory()) {
@@ -22890,7 +23292,7 @@ var init_audit_trail = __esm({
 });
 // src/validation-engine.ts
-import { existsSync as existsSync32, readFileSync as readFileSync33 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -22921,7 +23323,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync32(absPath)) {
+  if (!existsSync33(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -22930,7 +23332,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync33(absPath, "utf-8");
+  const source = readFileSync34(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -23375,7 +23777,7 @@ var init_adr_generator = __esm({
 });
 // src/security-scorer.ts
-import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync35 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -23399,12 +23801,12 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync33(absPath)) {
+  if (!existsSync34(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
   try {
-    source = readFileSync34(absPath, "utf-8");
+    source = readFileSync35(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -23693,8 +24095,8 @@ var init_security_scorer = __esm({
 });
 // src/dependency-scorer.ts
-import { existsSync as existsSync34, readFileSync as readFileSync35 } from "fs";
-import { resolve as resolve28 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync36 } from "fs";
+import { resolve as resolve30 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -23726,10 +24128,10 @@ function calculateDepRisk(factors) {
   return Math.min(100, risk);
 }
 function getInstalledPackages(projectRoot) {
-  const pkgPath = resolve28(projectRoot, "package.json");
-  if (!existsSync34(pkgPath)) return /* @__PURE__ */ new Map();
+  const pkgPath = resolve30(projectRoot, "package.json");
+  if (!existsSync35(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync35(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync36(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name, version);
@@ -24331,9 +24733,9 @@ var init_regression_detector = __esm({
 });
 // src/knowledge-indexer.ts
-import { createHash as createHash8 } from "crypto";
-import { readFileSync as readFileSync36, readdirSync as readdirSync23, statSync as statSync14, existsSync as existsSync35 } from "fs";
-import { resolve as resolve29, relative as relative12, basename as basename8, extname as extname2 } from "path";
+import { createHash as createHash9 } from "crypto";
+import { readFileSync as readFileSync37, readdirSync as readdirSync23, statSync as statSync14, existsSync as existsSync36 } from "fs";
+import { resolve as resolve31, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -24361,7 +24763,7 @@ function discoverMarkdownFiles(baseDir) {
     try {
       const entries = readdirSync23(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = resolve29(dir, entry.name);
+        const fullPath = resolve31(dir, entry.name);
         if (entry.isDirectory()) {
           if (entry.name === "archive" && dir.includes("session-state")) continue;
           if (entry.name === "archive" && dir.includes("status")) continue;
@@ -24419,7 +24821,7 @@ function categorizeFile(filePath) {
   return "root";
 }
 function hashContent2(content) {
-  return createHash8("sha256").update(content).digest("hex");
+  return createHash9("sha256").update(content).digest("hex");
 }
 function parseCRTable(content) {
   const rules = [];
@@ -24639,11 +25041,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync35(paths.plansDir)) {
+  if (existsSync36(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync35(paths.docsDir)) {
+  if (existsSync36(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -24686,8 +25088,8 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync35(filePath)) continue;
-      const content = readFileSync36(filePath, "utf-8");
+      if (!existsSync36(filePath)) continue;
+      const content = readFileSync37(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
       const category = categorizeFile(filePath);
@@ -24807,10 +25209,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync35(paths.plansDir)) {
+  if (existsSync36(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync35(paths.docsDir)) {
+  if (existsSync36(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -24839,8 +25241,8 @@ var init_knowledge_indexer = __esm({
 });
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync24 } from "fs";
-import { resolve as resolve30, basename as basename9 } from "path";
+import { readFileSync as readFileSync38, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync24 } from "fs";
+import { resolve as resolve32, basename as basename9 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -25577,7 +25979,7 @@ function handleCorrect(db, args2) {
   if (!wrong || !correction || !rule) {
     return text15("Error: wrong, correction, and rule are all required.");
   }
-  const correctionsPath = resolve30(getResolvedPaths().memoryDir, "corrections.md");
+  const correctionsPath = resolve32(getResolvedPaths().memoryDir, "corrections.md");
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const title = rule.slice(0, 60);
   const entry = `
@@ -25590,7 +25992,7 @@ ${crRule ? `- **CR**: ${crRule}
 `;
   let existing = "";
   try {
-    existing = readFileSync37(correctionsPath, "utf-8");
+    existing = readFileSync38(correctionsPath, "utf-8");
   } catch {
   }
   const archiveIdx = existing.indexOf("## Archived");
@@ -25928,13 +26330,13 @@ var init_knowledge_tools = __esm({
 // src/knowledge-db.ts
 import Database3 from "better-sqlite3";
-import { dirname as dirname15 } from "path";
-import { existsSync as existsSync37, mkdirSync as mkdirSync10 } from "fs";
+import { dirname as dirname16 } from "path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync11 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
-  const dir = dirname15(dbPath);
-  if (!existsSync37(dir)) {
-    mkdirSync10(dir, { recursive: true });
+  const dir = dirname16(dbPath);
+  if (!existsSync38(dir)) {
+    mkdirSync11(dir, { recursive: true });
   }
   const db = new Database3(dbPath);
   db.pragma("journal_mode = WAL");
@@ -26667,8 +27069,8 @@ var init_python_tools = __esm({
 });
 // src/tools.ts
-import { readFileSync as readFileSync38, existsSync as existsSync38 } from "fs";
-import { resolve as resolve31, basename as basename10 } from "path";
+import { readFileSync as readFileSync39, existsSync as existsSync39 } from "fs";
+import { resolve as resolve33, basename as basename10 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
 }
@@ -26703,7 +27105,7 @@ function ensureIndexes(dataDb, codegraphDb, force = false) {
   if (config.python?.root) {
     const pythonRoot = config.python.root;
     const excludeDirs = config.python.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
-    if (force || isPythonDataStale(dataDb, resolve31(getProjectRoot(), pythonRoot))) {
+    if (force || isPythonDataStale(dataDb, resolve33(getProjectRoot(), pythonRoot))) {
       const pyImports = buildPythonImportIndex(dataDb, pythonRoot, excludeDirs);
       results.push(`Python imports: ${pyImports}`);
       const pyRoutes = buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs);
@@ -27138,9 +27540,9 @@ function handleContext(file, dataDb, codegraphDb) {
         try {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
-          const absFilePath = ensureWithinRoot(resolve31(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync38(absFilePath)) {
-            const fileContent = readFileSync38(absFilePath, "utf-8").slice(0, 3e3);
+          const absFilePath = ensureWithinRoot(resolve33(resolvedPaths.srcDir, "..", file), root);
+          if (existsSync39(absFilePath)) {
+            const fileContent = readFileSync39(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -27564,11 +27966,11 @@ function handleSchema(args2) {
     lines.push("Checking all column references against Prisma schema...");
     lines.push("");
     const projectRoot = getProjectRoot();
-    const absPath = ensureWithinRoot(resolve31(projectRoot, file), projectRoot);
-    if (!existsSync38(absPath)) {
+    const absPath = ensureWithinRoot(resolve33(projectRoot, file), projectRoot);
+    if (!existsSync39(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync38(absPath, "utf-8");
+    const source = readFileSync39(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -27937,8 +28339,8 @@ var init_server_dispatch = __esm({
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync39 } from "fs";
-import { resolve as resolve32, dirname as dirname16 } from "path";
+import { readFileSync as readFileSync40 } from "fs";
+import { resolve as resolve34, dirname as dirname17 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -27970,10 +28372,10 @@ var init_server = __esm({
     init_memory_db();
     init_license();
     init_server_dispatch();
-    __dirname4 = dirname16(fileURLToPath4(import.meta.url));
+    __dirname4 = dirname17(fileURLToPath4(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync39(resolve32(__dirname4, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync40(resolve34(__dirname4, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -28259,19 +28661,19 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync39, readFileSync as readFileSync40, writeFileSync as writeFileSync6, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
-import { resolve as resolve33 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync41, writeFileSync as writeFileSync6, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
+import { resolve as resolve35 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve33(cwd, "massu.config.yaml");
+  const configPath = resolve35(cwd, "massu.config.yaml");
   const bakPath = `${configPath}.bak`;
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync39(bakPath)) {
+    if (!existsSync40(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
@@ -28287,14 +28689,14 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync39(configPath)) {
+  if (!existsSync40(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
   }
   let existing;
   try {
-    const content = readFileSync40(configPath, "utf-8");
+    const content = readFileSync41(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -28317,7 +28719,7 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync40(configPath, "utf-8");
+    const original = readFileSync41(configPath, "utf-8");
     writeFileSync6(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
@@ -28351,8 +28753,8 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync40, readFileSync as readFileSync41 } from "fs";
-import { resolve as resolve34 } from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync42 } from "fs";
+import { resolve as resolve36 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
   if (changes.length === 0) return "(none)\n";
@@ -28360,12 +28762,12 @@ function renderChanges(changes) {
 }
 async function runConfigCheckDrift(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve34(cwd, "massu.config.yaml");
+  const configPath = resolve36(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync40(configPath)) {
+  if (!existsSync41(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -28379,7 +28781,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync41(configPath, "utf-8");
+    const content = readFileSync42(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -28446,11 +28848,11 @@ var init_config_check_drift = __esm({
 });
 // src/cli.ts
-import { readFileSync as readFileSync42 } from "fs";
-import { resolve as resolve35, dirname as dirname17 } from "path";
+import { readFileSync as readFileSync43 } from "fs";
+import { resolve as resolve37, dirname as dirname18 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var __filename4 = fileURLToPath5(import.meta.url);
-var __dirname5 = dirname17(__filename4);
+var __dirname5 = dirname18(__filename4);
 var args = process.argv.slice(2);
 var subcommand = args[0];
 async function main() {
@@ -28475,6 +28877,12 @@ async function main() {
       await runInstallCommands2();
       break;
     }
+    case "permissions": {
+      const { handlePermissionsSubcommand: handlePermissionsSubcommand2 } = await Promise.resolve().then(() => (init_permissions2(), permissions_exports));
+      const result = await handlePermissionsSubcommand2(args.slice(1));
+      process.exit(result.exitCode);
+      return;
+    }
     case "show-template": {
       const { runShowTemplate: runShowTemplate2 } = await Promise.resolve().then(() => (init_show_template(), show_template_exports));
       await runShowTemplate2(args.slice(1));
@@ -28587,12 +28995,13 @@ Commands:
   init              Set up Massu AI in your project (one command, full setup)
   doctor            Check installation health
   install-hooks     Install/update Claude Code hooks
-  install-commands  Install/update slash commands
+  install-commands  Install/update slash commands (use --skip-permissions to opt out of MCP allowlist seeding)
   show-template     Print the resolved variant of a bundled template (e.g. for diffs)
   watch             Run the file-watcher daemon (auto-refresh on stack changes)
   refresh-log [N]   Show the last N watcher auto-refresh events
   validate-config   Validate massu.config.yaml (alias: config validate)
   config <sub>      Config lifecycle: refresh | validate | upgrade | doctor | check-drift
+  permissions <sub> MCP permission lifecycle: install | verify | check-drift
   adapters <sub>    Third-party adapter registry: list | refresh | search | add-local | remove-local | install | resign
 Options:
@@ -28632,7 +29041,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync42(resolve35(__dirname5, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync43(resolve37(__dirname5, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");