@massu/core 2.0.0 → 2.1.0

package/dist/cli.js

@@ -49,27 +49,52 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/lib/node-floor.ts
+function checkNodeVersion(version = process.version) {
+  const [major, minor] = version.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
+  if (!Number.isFinite(major)) {
+    return { ok: false, major: 0, message: `could not parse Node version "${version}"` };
+  }
+  const meets = major > MIN_NODE_MAJOR || major === MIN_NODE_MAJOR && (minor ?? 0) >= MIN_NODE_MINOR;
+  if (!meets) {
+    return {
+      ok: false,
+      major,
+      message: `Massu requires Node >= ${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}.0 (its built-in node:sqlite engine). You are on ${version}.`
+    };
+  }
+  return { ok: true, major };
+}
+var MIN_NODE_MAJOR, MIN_NODE_MINOR;
+var init_node_floor = __esm({
+  "src/lib/node-floor.ts"() {
+    "use strict";
+    MIN_NODE_MAJOR = 22;
+    MIN_NODE_MINOR = 13;
+  }
+});
+
 // src/credentials.ts
-import { homedir } from "os";
-import { resolve } from "path";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve2 } from "path";
 import {
-  existsSync,
+  existsSync as existsSync2,
   readFileSync,
   writeFileSync,
   mkdirSync,
   rmSync,
   chmodSync
 } from "fs";
-function credentialsDir(home = homedir()) {
-  return resolve(home, ".massu");
+function credentialsDir(home = homedir2()) {
+  return resolve2(home, ".massu");
 }
-function credentialsPath(home = homedir()) {
-  return resolve(credentialsDir(home), "credentials");
+function credentialsPath(home = homedir2()) {
+  return resolve2(credentialsDir(home), "credentials");
 }
-function readUserCredentials(home = homedir()) {
+function readUserCredentials(home = homedir2()) {
   try {
     const p19 = credentialsPath(home);
-    if (!existsSync(p19)) return void 0;
+    if (!existsSync2(p19)) return void 0;
     const parsed = JSON.parse(readFileSync(p19, "utf-8"));
     const key = typeof parsed?.apiKey === "string" ? parsed.apiKey.trim() : "";
     return key.length > 0 ? key : void 0;
@@ -77,7 +102,7 @@ function readUserCredentials(home = homedir()) {
     return void 0;
   }
 }
-function writeUserCredentials(apiKey, home = homedir()) {
+function writeUserCredentials(apiKey, home = homedir2()) {
   const dir = credentialsDir(home);
   mkdirSync(dir, { recursive: true, mode: 448 });
   try {
@@ -94,9 +119,9 @@ function writeUserCredentials(apiKey, home = homedir()) {
   }
   return p19;
 }
-function removeUserCredentials(home = homedir()) {
+function removeUserCredentials(home = homedir2()) {
   const p19 = credentialsPath(home);
-  if (!existsSync(p19)) return false;
+  if (!existsSync2(p19)) return false;
   try {
     rmSync(p19);
     return true;
@@ -109,7 +134,7 @@ function isUnresolvedLiteral(v3) {
 }
 function resolveApiKey(opts = {}) {
   const env = opts.env ?? process.env;
-  const home = opts.home ?? homedir();
+  const home = opts.home ?? homedir2();
   const cfg = typeof opts.configApiKey === "string" ? opts.configApiKey.trim() : "";
   if (cfg.length > 0 && !isUnresolvedLiteral(cfg)) {
     return { apiKey: cfg, source: "config" };
@@ -256,8 +281,8 @@ var init_fileLock = __esm({
 
 // src/lib/sqlite-loader.ts
 import { createRequire } from "module";
-import { spawnSync } from "child_process";
-import { accessSync, appendFileSync, chmodSync as chmodSync2, constants as fsConstants, existsSync as existsSync2, mkdirSync as mkdirSync3 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { accessSync, appendFileSync, chmodSync as chmodSync2, constants as fsConstants, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname2, join } from "path";
 function isNativeAbiError(err) {
   const code = err?.code;
@@ -329,7 +354,7 @@ function probeMemoryDbUsable(opts = {}) {
     };
   }
   const dbPath = opts.dbPath;
-  if (dbPath && dbPath !== ":memory:" && existsSync2(dbPath)) {
+  if (dbPath && dbPath !== ":memory:" && existsSync3(dbPath)) {
     try {
       const rdb = openDatabase(dbPath, { readonly: true, selfHeal: false });
       try {
@@ -396,7 +421,7 @@ function runRebuild(pkgDir, abiFrom, abiTo, start) {
   }
   const prebuildBin = resolveLocalBin(pkgDir, "prebuild-install");
   if (prebuildBin) {
-    const r2 = spawnSync(process.execPath, [prebuildBin], {
+    const r2 = spawnSync2(process.execPath, [prebuildBin], {
       cwd: pkgDir,
       encoding: "utf-8",
       timeout: 12e4
@@ -409,7 +434,7 @@ function runRebuild(pkgDir, abiFrom, abiTo, start) {
   }
   const gypBin = resolveNodeGypBin();
   if (gypBin && hasCompiler()) {
-    const r2 = spawnSync(process.execPath, [gypBin, "rebuild", "--release"], {
+    const r2 = spawnSync2(process.execPath, [gypBin, "rebuild", "--release"], {
       cwd: pkgDir,
       encoding: "utf-8",
       timeout: 3e5
@@ -479,7 +504,7 @@ function resolveLocalBin(pkgDir, name) {
     // workspace hoist
   ];
   for (const c2 of candidates) {
-    if (existsSync2(c2)) return c2;
+    if (existsSync3(c2)) return c2;
   }
   return void 0;
 }
@@ -493,7 +518,7 @@ function resolveNodeGypBin() {
 function hasCompiler() {
   for (const cc of ["cc", "clang", "gcc"]) {
     try {
-      const r2 = spawnSync(cc, ["--version"], { encoding: "utf-8", timeout: 5e3 });
+      const r2 = spawnSync2(cc, ["--version"], { encoding: "utf-8", timeout: 5e3 });
       if (r2.status === 0) return true;
     } catch {
     }
@@ -529,7 +554,7 @@ var init_sqlite_loader = __esm({
 
 // src/db-driver.ts
 import { createRequire as createRequire2 } from "module";
-import { closeSync, existsSync as existsSync3, mkdtempSync, openSync, readFileSync as readFileSync3, rmSync as rmSync3, fsyncSync } from "fs";
+import { closeSync, existsSync as existsSync4, mkdtempSync, openSync, readFileSync as readFileSync3, rmSync as rmSync3, fsyncSync } from "fs";
 import { tmpdir } from "os";
 import { join as join2 } from "path";
 function resolveDbEngine() {
@@ -664,7 +689,7 @@ function probeMemoryDbUsable2(opts = {}) {
     };
   }
   const dbPath = opts.dbPath;
-  if (dbPath && dbPath !== ":memory:" && existsSync3(dbPath)) {
+  if (dbPath && dbPath !== ":memory:" && existsSync4(dbPath)) {
     try {
       const rdb = openDatabase2(dbPath, { readonly: true });
       try {
@@ -882,16 +907,16 @@ __export(config_exports, {
   getResolvedPaths: () => getResolvedPaths,
   resetConfig: () => resetConfig
 });
-import { resolve as resolve2, dirname as dirname3 } from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir2 } from "os";
+import { resolve as resolve3, dirname as dirname3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
 import { parse as parseYaml } from "yaml";
 import { z as z2 } from "zod";
 function findProjectRoot() {
   const cwd = process.cwd();
   let dir = cwd;
   while (true) {
-    if (existsSync4(resolve2(dir, "massu.config.yaml"))) {
+    if (existsSync5(resolve3(dir, "massu.config.yaml"))) {
       return dir;
     }
     const parent = dirname3(dir);
@@ -900,10 +925,10 @@ function findProjectRoot() {
   }
   dir = cwd;
   while (true) {
-    if (existsSync4(resolve2(dir, "package.json"))) {
+    if (existsSync5(resolve3(dir, "package.json"))) {
       return dir;
     }
-    if (existsSync4(resolve2(dir, ".git"))) {
+    if (existsSync5(resolve3(dir, ".git"))) {
       return dir;
     }
     const parent = dirname3(dir);
@@ -921,9 +946,9 @@ function getProjectRoot() {
 function getConfig() {
   if (_config) return _config;
   const root = getProjectRoot();
-  const configPath = resolve2(root, "massu.config.yaml");
+  const configPath = resolve3(root, "massu.config.yaml");
   let rawYaml = {};
-  if (existsSync4(configPath)) {
+  if (existsSync5(configPath)) {
     const content = readFileSync4(configPath, "utf-8");
     rawYaml = parseYaml(content) ?? {};
   }
@@ -941,7 +966,7 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     );
   }
   const parsed = result.data;
-  const projectRoot = parsed.project.root === "auto" || !parsed.project.root ? root : resolve2(root, parsed.project.root);
+  const projectRoot = parsed.project.root === "auto" || !parsed.project.root ? root : resolve3(root, parsed.project.root);
   const fw = parsed.framework;
   let router = fw.router;
   let orm = fw.orm;
@@ -1029,34 +1054,35 @@ function getResolvedPaths() {
   const root = getProjectRoot();
   const claudeDirName = config.conventions?.claudeDirName ?? ".claude";
   return {
-    codegraphDbPath: resolve2(root, ".codegraph/codegraph.db"),
-    dataDbPath: resolve2(root, ".massu/data.db"),
-    prismaSchemaPath: resolve2(root, config.paths.schema ?? "prisma/schema.prisma"),
-    rootRouterPath: resolve2(root, config.paths.routerRoot ?? "src/server/api/root.ts"),
-    routersDir: resolve2(root, config.paths.routers ?? "src/server/api/routers"),
-    srcDir: resolve2(root, config.paths.source),
+    codegraphDbPath: resolve3(root, ".codegraph/codegraph.db"),
+    dataDbPath: resolve3(root, ".massu/data.db"),
+    prismaSchemaPath: resolve3(root, config.paths.schema ?? "prisma/schema.prisma"),
+    rootRouterPath: resolve3(root, config.paths.routerRoot ?? "src/server/api/root.ts"),
+    routersDir: resolve3(root, config.paths.routers ?? "src/server/api/routers"),
+    srcDir: resolve3(root, config.paths.source),
     pathAlias: Object.fromEntries(
       Object.entries(config.paths.aliases).map(([alias, target]) => [
         alias,
-        resolve2(root, target)
+        resolve3(root, target)
       ])
     ),
     extensions: [".ts", ".tsx", ".js", ".jsx"],
     indexFiles: ["index.ts", "index.tsx", "index.js", "index.jsx"],
-    patternsDir: resolve2(root, claudeDirName, "patterns"),
-    claudeMdPath: resolve2(root, claudeDirName, "CLAUDE.md"),
-    docsMapPath: resolve2(root, ".massu/docs-map.json"),
-    helpSitePath: resolve2(root, "../" + config.project.name + "-help"),
-    memoryDbPath: resolve2(root, ".massu/memory.db"),
-    knowledgeDbPath: resolve2(root, ".massu/knowledge.db"),
-    plansDir: resolve2(root, "docs/plans"),
-    docsDir: resolve2(root, "docs"),
-    claudeDir: resolve2(root, claudeDirName),
-    memoryDir: resolve2(homedir2(), claudeDirName, "projects", encodeMemoryDirName(root), "memory"),
-    sessionStatePath: resolve2(root, config.conventions?.sessionStatePath ?? `${claudeDirName}/session-state/CURRENT.md`),
-    sessionArchivePath: resolve2(root, config.conventions?.sessionArchivePath ?? `${claudeDirName}/session-state/archive`),
-    mcpJsonPath: resolve2(root, ".mcp.json"),
-    settingsLocalPath: resolve2(root, claudeDirName, "settings.local.json")
+    patternsDir: resolve3(root, claudeDirName, "patterns"),
+    claudeMdPath: resolve3(root, claudeDirName, "CLAUDE.md"),
+    docsMapPath: resolve3(root, ".massu/docs-map.json"),
+    helpSitePath: resolve3(root, "../" + config.project.name + "-help"),
+    memoryDbPath: resolve3(root, ".massu/memory.db"),
+    knowledgeDbPath: resolve3(root, ".massu/knowledge.db"),
+    plansDir: resolve3(root, "docs/plans"),
+    docsDir: resolve3(root, "docs"),
+    claudeDir: resolve3(root, claudeDirName),
+    memoryDir: resolve3(homedir3(), claudeDirName, "projects", encodeMemoryDirName(root), "memory"),
+    sessionStatePath: resolve3(root, config.conventions?.sessionStatePath ?? `${claudeDirName}/session-state/CURRENT.md`),
+    sessionArchivePath: resolve3(root, config.conventions?.sessionArchivePath ?? `${claudeDirName}/session-state/archive`),
+    mcpJsonPath: resolve3(root, ".mcp.json"),
+    settingsPath: resolve3(root, claudeDirName, "settings.json"),
+    settingsLocalPath: resolve3(root, claudeDirName, "settings.local.json")
   };
 }
 function resetConfig() {
@@ -1512,39 +1538,39 @@ var init_memory_vector = __esm({
 });
 
 // src/db-backup.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
-import { resolve as resolve3, join as join3, basename, dirname as dirname4 } from "path";
-import { homedir as homedir3 } from "os";
-function dbBackupsRoot(home = homedir3()) {
-  return resolve3(home, ".massu", "db-backups");
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync as statSync2, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
+import { resolve as resolve4, join as join3, basename, dirname as dirname4 } from "path";
+import { homedir as homedir4 } from "os";
+function dbBackupsRoot(home = homedir4()) {
+  return resolve4(home, ".massu", "db-backups");
 }
-function projectBackupDir(projectRoot, home = homedir3()) {
+function projectBackupDir(projectRoot, home = homedir4()) {
   const slug = basename(projectRoot).replace(/[^A-Za-z0-9._-]/g, "_") || "project";
   return join3(dbBackupsRoot(home), slug);
 }
 function backupStamp(nowMs) {
   return new Date(nowMs).toISOString().replace(/[:.]/g, "-");
 }
-function listDbBackups(projectRoot, home = homedir3()) {
+function listDbBackups(projectRoot, home = homedir4()) {
   const dir = projectBackupDir(projectRoot, home);
-  if (!existsSync5(dir)) return [];
+  if (!existsSync6(dir)) return [];
   const out = [];
-  for (const f2 of readdirSync(dir)) {
+  for (const f2 of readdirSync2(dir)) {
     if (!f2.endsWith(".db")) continue;
     const p19 = join3(dir, f2);
-    const st = statSync(p19);
+    const st = statSync2(p19);
     const db = f2.replace(/-\d{4}-\d{2}-\d{2}T.*$/, "");
     out.push({ db, path: p19, bytes: st.size, mtimeMs: st.mtimeMs });
   }
   return out.sort((a2, b2) => b2.mtimeMs - a2.mtimeMs);
 }
-function hasFreshDbBackup(projectRoot, dbPath, nowMs = Date.now(), home = homedir3()) {
+function hasFreshDbBackup(projectRoot, dbPath, nowMs = Date.now(), home = homedir4()) {
   const name = basename(dbPath, ".db");
   const backups = listDbBackups(projectRoot, home).filter((b2) => b2.db === name);
   if (backups.length === 0) return false;
   const newest = backups[0];
   if (nowMs - newest.mtimeMs > FRESH_WINDOW_MS) return false;
-  if (existsSync5(dbPath) && statSync(dbPath).mtimeMs > newest.mtimeMs) return false;
+  if (existsSync6(dbPath) && statSync2(dbPath).mtimeMs > newest.mtimeMs) return false;
   return true;
 }
 function integrityOk(dbPath) {
@@ -1562,8 +1588,8 @@ function integrityOk(dbPath) {
     }
   }
 }
-function backupDb(projectRoot, dbPath, nowMs = Date.now(), home = homedir3()) {
-  if (!existsSync5(dbPath)) {
+function backupDb(projectRoot, dbPath, nowMs = Date.now(), home = homedir4()) {
+  if (!existsSync6(dbPath)) {
     throw new DbBackupError(`cannot back up a database that does not exist: ${dbPath}`);
   }
   const dir = projectBackupDir(projectRoot, home);
@@ -1594,10 +1620,10 @@ function backupDb(projectRoot, dbPath, nowMs = Date.now(), home = homedir3()) {
     );
   }
   pruneDbBackups(projectRoot, name, DEFAULT_RETENTION, home);
-  const st = statSync(dest);
+  const st = statSync2(dest);
   return { db: name, path: dest, bytes: st.size, mtimeMs: st.mtimeMs };
 }
-function pruneDbBackups(projectRoot, dbName, keep = DEFAULT_RETENTION, home = homedir3()) {
+function pruneDbBackups(projectRoot, dbName, keep = DEFAULT_RETENTION, home = homedir4()) {
   const mine = listDbBackups(projectRoot, home).filter((b2) => b2.db === dbName);
   let removed = 0;
   for (const old of mine.slice(keep)) {
@@ -1609,8 +1635,8 @@ function pruneDbBackups(projectRoot, dbName, keep = DEFAULT_RETENTION, home = ho
   }
   return removed;
 }
-function restoreDb(backupPath, dbPath, nowMs = Date.now(), home = homedir3()) {
-  if (!existsSync5(backupPath)) {
+function restoreDb(backupPath, dbPath, nowMs = Date.now(), home = homedir4()) {
+  if (!existsSync6(backupPath)) {
     throw new DbBackupError(`backup not found: ${backupPath}`);
   }
   if (!integrityOk(backupPath)) {
@@ -1619,7 +1645,7 @@ function restoreDb(backupPath, dbPath, nowMs = Date.now(), home = homedir3()) {
     );
   }
   let preserved = null;
-  if (existsSync5(dbPath)) {
+  if (existsSync6(dbPath)) {
     const dir = dirname4(backupPath) || projectBackupDir(process.cwd(), home);
     mkdirSync4(dir, { recursive: true });
     preserved = join3(dir, `${basename(dbPath, ".db")}.corrupt-${backupStamp(nowMs)}.db`);
@@ -1627,7 +1653,7 @@ function restoreDb(backupPath, dbPath, nowMs = Date.now(), home = homedir3()) {
   }
   for (const suffix of ["", "-wal", "-shm"]) {
     const p19 = `${dbPath}${suffix}`;
-    if (existsSync5(p19)) rmSync4(p19, { force: true });
+    if (existsSync6(p19)) rmSync4(p19, { force: true });
   }
   copyFileSync(backupPath, dbPath);
   if (!integrityOk(dbPath)) {
@@ -1637,9 +1663,9 @@ function restoreDb(backupPath, dbPath, nowMs = Date.now(), home = homedir3()) {
   }
   return { restoredFrom: backupPath, preservedOriginal: preserved };
 }
-function backupBeforeSchemaChange(projectRoot, dbPath, onError, nowMs = Date.now(), home = homedir3()) {
+function backupBeforeSchemaChange(projectRoot, dbPath, onError, nowMs = Date.now(), home = homedir4()) {
   try {
-    if (!existsSync5(dbPath)) return null;
+    if (!existsSync6(dbPath)) return null;
     if (hasFreshDbBackup(projectRoot, dbPath, nowMs, home)) return null;
     return backupDb(projectRoot, dbPath, nowMs, home);
   } catch (err) {
@@ -1814,14 +1840,14 @@ var init_rule_candidate_store = __esm({
 });
 
 // src/hooks/lib/hook-failure-signal.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, existsSync as existsSync6 } from "fs";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, existsSync as existsSync7 } from "fs";
 import { join as join4, dirname as dirname5 } from "path";
 function resolveFailureLogPath() {
   const explicit = process.env.MASSU_HOOK_FAILURE_LOG;
   if (explicit) return explicit;
   let dir = process.cwd();
   for (let i = 0; i < 12; i++) {
-    if (existsSync6(join4(dir, ".massu")) || existsSync6(join4(dir, "massu.config.yaml"))) {
+    if (existsSync7(join4(dir, ".massu")) || existsSync7(join4(dir, "massu.config.yaml"))) {
       return join4(dir, ".massu", "hook-failures.jsonl");
     }
     const parent = dirname5(dir);
@@ -2008,7 +2034,7 @@ var init_memory_embedder_tokenizer = __esm({
 // src/memory-embedder.ts
 import { fileURLToPath } from "url";
 import { dirname as dirname6, join as join5 } from "path";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { createRequire as createRequire3 } from "module";
 function getActiveEmbedModel() {
   return _activeModel;
@@ -2033,7 +2059,7 @@ function resolveModelDir() {
     let dir = dirname6(fileURLToPath(import.meta.url));
     let root = null;
     for (let i = 0; i < 8; i++) {
-      if (existsSync7(join5(dir, "package.json"))) {
+      if (existsSync8(join5(dir, "package.json"))) {
         root = dir;
         break;
       }
@@ -2044,7 +2070,7 @@ function resolveModelDir() {
     if (!root) return null;
     for (const rel of ["dist/embedder", "assets/embedder"]) {
       const candidate = join5(root, rel);
-      if (existsSync7(join5(candidate, "model_quantized.onnx"))) return candidate;
+      if (existsSync8(join5(candidate, "model_quantized.onnx"))) return candidate;
     }
     return null;
   } catch {
@@ -2430,7 +2456,7 @@ __export(memory_db_exports, {
   usageWarmupElapsed: () => usageWarmupElapsed
 });
 import { dirname as dirname7, basename as basename2 } from "path";
-import { existsSync as existsSync8, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6 } from "fs";
 function sanitizeFts5Query(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return '""';
@@ -2447,10 +2473,10 @@ function sanitizeFts5QueryOr(raw) {
 function getMemoryDb() {
   const dbPath = getResolvedPaths().memoryDbPath;
   const dir = dirname7(dbPath);
-  if (!existsSync8(dir)) {
+  if (!existsSync9(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
-  const preExisting = existsSync8(dbPath);
+  const preExisting = existsSync9(dbPath);
   const db = openDatabase2(dbPath);
   db.pragma("journal_mode = WAL");
   db.pragma("foreign_keys = ON");
@@ -4238,7 +4264,7 @@ var init_memory_db = __esm({
 });
 
 // src/memory-file-ingest.ts
-import { readFileSync as readFileSync6, existsSync as existsSync9, readdirSync as readdirSync2 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync10, readdirSync as readdirSync3 } from "fs";
 import { join as join6 } from "path";
 import { parse as parseYaml2 } from "yaml";
 import { basename as pathBasename } from "path";
@@ -4345,7 +4371,7 @@ function upsertMemoryFileMirror(db, f2) {
   return "inserted";
 }
 function ingestMemoryFile(db, sessionId, filePath) {
-  if (!existsSync9(filePath)) return "skipped";
+  if (!existsSync10(filePath)) return "skipped";
   const content = readFileSync6(filePath, "utf-8");
   if (Buffer.byteLength(content, "utf-8") > MAX_MEMORY_FILE_BYTES) {
     process.stderr.write(
@@ -4416,8 +4442,8 @@ ${body}` : body;
 }
 function backfillMemoryFiles(db, memoryDir, sessionId) {
   const stats = { inserted: 0, updated: 0, skipped: 0, total: 0 };
-  if (!existsSync9(memoryDir)) return stats;
-  const files = readdirSync2(memoryDir).filter(
+  if (!existsSync10(memoryDir)) return stats;
+  const files = readdirSync3(memoryDir).filter(
     (f2) => f2.endsWith(".md") && f2 !== "MEMORY.md"
   );
   stats.total = files.length;
@@ -4632,7 +4658,7 @@ var init_template_engine = __esm({
 // src/lib/settings-local.ts
 import {
   closeSync as closeSync2,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   fsyncSync as fsyncSync2,
   mkdirSync as mkdirSync7,
   openSync as openSync2,
@@ -4641,7 +4667,7 @@ import {
   rmSync as rmSync5,
   writeSync
 } from "fs";
-import { dirname as dirname8, resolve as resolve5 } from "path";
+import { dirname as dirname8, resolve as resolve6 } from "path";
 function atomicWriteFile(targetPath, content, mode = 420) {
   const tmpPath = `${targetPath}.${process.pid}.tmp`;
   try {
@@ -4655,7 +4681,7 @@ function atomicWriteFile(targetPath, content, mode = 420) {
     }
     renameSync(tmpPath, targetPath);
   } catch (err) {
-    if (existsSync10(tmpPath)) {
+    if (existsSync11(tmpPath)) {
       try {
         rmSync5(tmpPath, { force: true });
       } catch {
@@ -4665,7 +4691,7 @@ function atomicWriteFile(targetPath, content, mode = 420) {
   }
 }
 function readSettingsAtPath(absolutePath) {
-  if (!existsSync10(absolutePath)) {
+  if (!existsSync11(absolutePath)) {
     return {};
   }
   try {
@@ -4680,12 +4706,12 @@ function readSettingsAtPath(absolutePath) {
   }
 }
 function readSettingsLocal(claudeDir) {
-  return readSettingsAtPath(resolve5(claudeDir, "settings.local.json"));
+  return readSettingsAtPath(resolve6(claudeDir, "settings.local.json"));
 }
 function writeSettingsLocalAtomic(claudeDir, settings) {
-  const targetPath = resolve5(claudeDir, "settings.local.json");
+  const targetPath = resolve6(claudeDir, "settings.local.json");
   const dir = dirname8(targetPath);
-  if (!existsSync10(dir)) {
+  if (!existsSync11(dir)) {
     mkdirSync7(dir, { recursive: true });
   }
   const content = JSON.stringify(settings, null, 2) + "\n";
@@ -4699,7 +4725,7 @@ var init_settings_local = __esm({
 
 // src/permissions.ts
 import { createHash as createHash2 } from "crypto";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 import { join as join7 } from "path";
 function canonicalJson(value) {
   if (value === null || typeof value !== "object") {
@@ -4739,7 +4765,7 @@ function detectInvalidDefaultMode(settings) {
   return { invalid: false };
 }
 function readGlobalSettings() {
-  return readSettingsAtPath(join7(homedir4(), ".claude", "settings.json"));
+  return readSettingsAtPath(join7(homedir5(), ".claude", "settings.json"));
 }
 function mergedPermissionState(global2, local, canonical2) {
   const globalPerm = global2.permissions ?? {};
@@ -4927,20 +4953,20 @@ __export(install_commands_exports, {
   syncDirectory: () => syncDirectory
 });
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   readFileSync as readFileSync8,
   mkdirSync as mkdirSync8,
-  readdirSync as readdirSync3,
-  statSync as statSync2
+  readdirSync as readdirSync4,
+  statSync as statSync3
 } from "fs";
-import { resolve as resolve6, dirname as dirname9, join as join8 } from "path";
+import { resolve as resolve7, dirname as dirname9, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash as createHash3 } from "crypto";
 function dirHoldsAssets(dir) {
-  if (!existsSync11(dir)) return false;
+  if (!existsSync12(dir)) return false;
   try {
-    return readdirSync3(dir).some(
-      (e2) => e2.endsWith(".md") || statSync2(resolve6(dir, e2)).isDirectory()
+    return readdirSync4(dir).some(
+      (e2) => e2.endsWith(".md") || statSync3(resolve7(dir, e2)).isDirectory()
     );
   } catch {
     return false;
@@ -4950,11 +4976,11 @@ function resolveAssetDir(assetName) {
   const cwd = process.cwd();
   const candidates = [
     // 1. npm-installed: node_modules/@massu/core/{assetName}
-    resolve6(cwd, "node_modules/@massu/core", assetName),
+    resolve7(cwd, "node_modules/@massu/core", assetName),
     // 2. Relative to compiled dist/cli.js → ../{assetName}
-    resolve6(__dirname, "..", assetName),
+    resolve7(__dirname, "..", assetName),
     // 3. Relative to source src/commands/ → ../../{assetName}
-    resolve6(__dirname, "../..", assetName)
+    resolve7(__dirname, "../..", assetName)
   ];
   for (const c2 of candidates) {
     if (dirHoldsAssets(c2)) return c2;
@@ -4972,7 +4998,7 @@ function canonicalizeOwned(content) {
 }
 function massuOwnedSourceIsValid(resolvedSourcePath, content) {
   const sidecar = `${resolvedSourcePath}.sha256`;
-  if (!existsSync11(sidecar)) return false;
+  if (!existsSync12(sidecar)) return false;
   let expected;
   try {
     expected = readFileSync8(sidecar, "utf-8").trim();
@@ -4985,8 +5011,8 @@ function hashContent(content) {
   return createHash3("sha256").update(content, "utf-8").digest("hex");
 }
 function loadManifest(claudeDir) {
-  const path = resolve6(claudeDir, MANIFEST_RELPATH);
-  if (!existsSync11(path)) {
+  const path = resolve7(claudeDir, MANIFEST_RELPATH);
+  if (!existsSync12(path)) {
     return emptyManifest();
   }
   try {
@@ -5001,11 +5027,11 @@ function loadManifest(claudeDir) {
   }
 }
 function saveManifest(claudeDir, manifest) {
-  const dir = resolve6(claudeDir, ".massu");
-  if (!existsSync11(dir)) {
+  const dir = resolve7(claudeDir, ".massu");
+  if (!existsSync12(dir)) {
     mkdirSync8(dir, { recursive: true });
   }
-  const finalPath = resolve6(dir, "install-manifest.json");
+  const finalPath = resolve7(dir, "install-manifest.json");
   manifest.generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   atomicWriteFile(finalPath, JSON.stringify(manifest, null, 2));
 }
@@ -5067,18 +5093,18 @@ function pickVariant(baseName, sourceDir, framework) {
   }
   for (const cand of candidates) {
     if (cand.subFramework) {
-      const subPath = resolve6(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
-      if (existsSync11(subPath)) {
+      const subPath = resolve7(sourceDir, `${baseName}.${cand.lang}-${cand.subFramework}.md`);
+      if (existsSync12(subPath)) {
         return { kind: "hit", suffix: `.${cand.lang}-${cand.subFramework}` };
       }
     }
-    const langPath = resolve6(sourceDir, `${baseName}.${cand.lang}.md`);
-    if (existsSync11(langPath)) {
+    const langPath = resolve7(sourceDir, `${baseName}.${cand.lang}.md`);
+    if (existsSync12(langPath)) {
       return { kind: "hit", suffix: `.${cand.lang}` };
     }
   }
-  const defaultPath = resolve6(sourceDir, `${baseName}.md`);
-  if (existsSync11(defaultPath)) {
+  const defaultPath = resolve7(sourceDir, `${baseName}.md`);
+  if (existsSync12(defaultPath)) {
     return { kind: "hit", suffix: "" };
   }
   if (framework.type === "multi" && !framework.primary) {
@@ -5094,15 +5120,15 @@ function isVariantFilename(entry) {
 }
 function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPrefix, topLevel = true, templateVars = {}) {
   const stats = { installed: 0, updated: 0, skipped: 0, kept: 0 };
-  if (!existsSync11(targetDir)) {
+  if (!existsSync12(targetDir)) {
     mkdirSync8(targetDir, { recursive: true });
   }
-  const entries = readdirSync3(sourceDir);
+  const entries = readdirSync4(sourceDir);
   for (const entry of entries) {
-    const sourcePath = resolve6(sourceDir, entry);
-    const entryStat = statSync2(sourcePath);
+    const sourcePath = resolve7(sourceDir, entry);
+    const entryStat = statSync3(sourcePath);
     if (entryStat.isDirectory()) {
-      const subTargetDir = resolve6(targetDir, entry);
+      const subTargetDir = resolve7(targetDir, entry);
       const subPrefix = manifestKeyPrefix === "" ? entry : `${manifestKeyPrefix}/${entry}`;
       const subStats = syncDirectory(
         sourcePath,
@@ -5131,12 +5157,12 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
       const suffix = choice.kind === "hit" ? choice.suffix : "";
       sourceFilename = suffix === "" ? `${baseName}.md` : `${baseName}${suffix}.md`;
     }
-    const resolvedSourcePath = resolve6(sourceDir, sourceFilename);
-    if (!existsSync11(resolvedSourcePath)) {
+    const resolvedSourcePath = resolve7(sourceDir, sourceFilename);
+    if (!existsSync12(resolvedSourcePath)) {
       continue;
     }
     const targetFilename = topLevel ? `${baseName}.md` : entry;
-    const targetPath = resolve6(targetDir, targetFilename);
+    const targetPath = resolve7(targetDir, targetFilename);
     const rawContent = readFileSync8(resolvedSourcePath, "utf-8");
     let sourceContent;
     try {
@@ -5155,10 +5181,10 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
     const sourceHash = hashContent(sourceContent);
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
-    if (existsSync11(targetPath)) {
+    if (existsSync12(targetPath)) {
       let existingContent;
       try {
-        if (!statSync2(targetPath).isFile()) throw new Error("not a regular file");
+        if (!statSync3(targetPath).isFile()) throw new Error("not a regular file");
         existingContent = readFileSync8(targetPath, "utf-8");
       } catch (err) {
         process.stderr.write(
@@ -5240,9 +5266,9 @@ function buildTemplateVars() {
 }
 function installCommands(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve6(projectRoot, claudeDirName);
-  const targetDir = resolve6(claudeDir, "commands");
-  if (!existsSync11(targetDir)) {
+  const claudeDir = resolve7(projectRoot, claudeDirName);
+  const targetDir = resolve7(claudeDir, "commands");
+  if (!existsSync12(targetDir)) {
     mkdirSync8(targetDir, { recursive: true });
   }
   const sourceDir = resolveAssetDir("commands");
@@ -5272,7 +5298,7 @@ function installCommands(projectRoot, opts = {}) {
 }
 function installAll(projectRoot, opts = {}) {
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
-  const claudeDir = resolve6(projectRoot, claudeDirName);
+  const claudeDir = resolve7(projectRoot, claudeDirName);
   const assets = {};
   let totalInstalled = 0;
   let totalUpdated = 0;
@@ -5285,7 +5311,7 @@ function installAll(projectRoot, opts = {}) {
     for (const assetType of ASSET_TYPES) {
       const sourceDir = resolveAssetDir(assetType.name);
       if (!sourceDir) continue;
-      const targetDir = resolve6(claudeDir, assetType.targetSubdir);
+      const targetDir = resolve7(claudeDir, assetType.targetSubdir);
       const stats = syncDirectory(
         sourceDir,
         targetDir,
@@ -5594,15 +5620,15 @@ var init_manifest_registry = __esm({
 });
 
 // src/detect/package-detector.ts
-import { readFileSync as readFileSync9, existsSync as existsSync12, statSync as statSync3, lstatSync, readdirSync as readdirSync4 } from "fs";
+import { readFileSync as readFileSync9, existsSync as existsSync13, statSync as statSync4, lstatSync, readdirSync as readdirSync5 } from "fs";
 import { join as join9, relative as relative2 } from "path";
 import { parse as parseToml } from "smol-toml";
 function safeRead(path) {
   try {
-    if (!existsSync12(path)) return null;
+    if (!existsSync13(path)) return null;
     const ls = lstatSync(path);
     if (ls.isSymbolicLink()) return null;
-    const st = statSync3(path);
+    const st = statSync4(path);
     if (!st.isFile()) return null;
     return readFileSync9(path, "utf-8");
   } catch {
@@ -5635,7 +5661,7 @@ function parsePackageJson(path, directory, root, warnings) {
   const peer = Object.keys(
     pkg.peerDependencies ?? {}
   );
-  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync12(join9(directory, "tsconfig.json"));
+  const hasTs = deps.includes("typescript") || devDeps.includes("typescript") || existsSync13(join9(directory, "tsconfig.json"));
   const language = hasTs ? "typescript" : "javascript";
   const scripts = Object.keys(
     pkg.scripts ?? {}
@@ -6062,13 +6088,13 @@ function detectManifestsInDir(dir, root, warnings) {
   for (const entry of getManifestRegistry2()) {
     if (!entry.pattern.startsWith("*")) {
       const path = join9(dir, entry.pattern);
-      if (!existsSync12(path)) continue;
+      if (!existsSync13(path)) continue;
       const m3 = entry.parse(path, dir, root, warnings);
       if (m3 !== null) out.push(m3);
     } else {
       if (dirEntries === null) {
         try {
-          dirEntries = readdirSync4(dir);
+          dirEntries = readdirSync5(dir);
         } catch {
           dirEntries = [];
         }
@@ -6076,7 +6102,7 @@ function detectManifestsInDir(dir, root, warnings) {
       for (const fname of dirEntries) {
         if (!matchManifestPattern2(fname, entry.pattern)) continue;
         const path = join9(dir, fname);
-        if (!existsSync12(path)) continue;
+        if (!existsSync13(path)) continue;
         const m3 = entry.parse(path, dir, root, warnings);
         if (m3 !== null) out.push(m3);
       }
@@ -6086,7 +6112,7 @@ function detectManifestsInDir(dir, root, warnings) {
 }
 function listSubdirs(dir) {
   try {
-    return readdirSync4(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS.has(e2.name)).map((e2) => join9(dir, e2.name));
+    return readdirSync5(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS.has(e2.name)).map((e2) => join9(dir, e2.name));
   } catch {
     return [];
   }
@@ -6097,7 +6123,7 @@ function detectPackageManifests(projectRoot) {
   manifests.push(...detectManifestsInDir(projectRoot, projectRoot, warnings));
   for (const ws of WORKSPACE_DIRS) {
     const wsRoot = join9(projectRoot, ws);
-    if (!existsSync12(wsRoot)) continue;
+    if (!existsSync13(wsRoot)) continue;
     for (const sub of listSubdirs(wsRoot)) {
       manifests.push(...detectManifestsInDir(sub, projectRoot, warnings));
       for (const sub2 of listSubdirs(sub)) {
@@ -6349,22 +6375,22 @@ import {
   openSync as openSync3,
   fsyncSync as fsyncSync3,
   closeSync as closeSync3,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   realpathSync,
   unlinkSync as unlinkSync2,
   accessSync as accessSync2,
-  statSync as statSync4,
+  statSync as statSync5,
   chmodSync as chmodSync3,
   constants
 } from "fs";
-import { dirname as dirname10, resolve as resolve7, relative as relative3, isAbsolute, basename as basename3, sep } from "path";
+import { dirname as dirname10, resolve as resolve8, relative as relative3, isAbsolute as isAbsolute2, basename as basename3, sep } from "path";
 import { createHash as createHash4 } from "crypto";
 function assertContainedIn(rootDir, candidate, opts = {}) {
   if (candidate.includes("\0")) {
     throw new PathEscapeError("path contains a NUL byte");
   }
-  const root = resolve7(rootDir);
-  const abs = resolve7(root, candidate);
+  const root = resolve8(rootDir);
+  const abs = resolve8(root, candidate);
   if (!opts.allowNested) {
     const rel = relative3(root, abs);
     if (rel.includes(sep)) {
@@ -6383,13 +6409,13 @@ function assertContainedIn(rootDir, candidate, opts = {}) {
 }
 function isContainedIn(rootDir, candidate, opts = {}) {
   if (candidate.includes("\0")) return false;
-  const root = resolve7(rootDir);
-  const abs = resolve7(root, candidate);
+  const root = resolve8(rootDir);
+  const abs = resolve8(root, candidate);
   const rel = relative3(root, abs);
   if (rel === "" && !opts.allowRoot) return false;
-  if (rel.startsWith("..") || isAbsolute(rel)) return false;
+  if (rel.startsWith("..") || isAbsolute2(rel)) return false;
   let probe = abs;
-  while (!existsSync13(probe) && probe.length > 1) {
+  while (!existsSync14(probe) && probe.length > 1) {
     const parent = dirname10(probe);
     if (parent === probe) break;
     probe = parent;
@@ -6404,15 +6430,15 @@ function isContainedIn(rootDir, candidate, opts = {}) {
   }
   const realRel = relative3(realRoot, realProbe);
   if (realRel === "") return true;
-  return !realRel.startsWith("..") && !isAbsolute(realRel);
+  return !realRel.startsWith("..") && !isAbsolute2(realRel);
 }
 function atomicWriteFileSync(destPath, contents) {
   const dir = dirname10(destPath);
-  const tmp = resolve7(dir, `.${basename3(destPath)}.massu-tmp-${process.pid}`);
+  const tmp = resolve8(dir, `.${basename3(destPath)}.massu-tmp-${process.pid}`);
   let destMode;
-  if (existsSync13(destPath)) {
+  if (existsSync14(destPath)) {
     accessSync2(destPath, constants.W_OK);
-    destMode = statSync4(destPath).mode & 511;
+    destMode = statSync5(destPath).mode & 511;
   }
   let fd;
   try {
@@ -6431,7 +6457,7 @@ function atomicWriteFileSync(destPath, contents) {
       }
     }
     try {
-      if (existsSync13(tmp)) unlinkSync2(tmp);
+      if (existsSync14(tmp)) unlinkSync2(tmp);
     } catch {
     }
     throw err;
@@ -9938,7 +9964,7 @@ var require_pattern = __commonJS({
       const absolute = [];
       const relative15 = [];
       for (const pattern of patterns) {
-        if (isAbsolute5(pattern)) {
+        if (isAbsolute6(pattern)) {
           absolute.push(pattern);
         } else {
           relative15.push(pattern);
@@ -9947,10 +9973,10 @@ var require_pattern = __commonJS({
       return [absolute, relative15];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute5(pattern) {
+    function isAbsolute6(pattern) {
       return path.isAbsolute(pattern);
     }
-    exports.isAbsolute = isAbsolute5;
+    exports.isAbsolute = isAbsolute6;
   }
 });
 
@@ -10365,11 +10391,11 @@ var require_out = __commonJS({
       async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports.stat = stat;
-    function statSync21(path, optionsOrSettings) {
+    function statSync22(path, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path, settings);
     }
-    exports.statSync = statSync21;
+    exports.statSync = statSync22;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -11034,41 +11060,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p19 = new Promise(function(resolve45, reject) {
+        var p19 = new Promise(function(resolve46, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve45(result);
+            resolve46(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function unshift(value) {
-        var p19 = new Promise(function(resolve45, reject) {
+        var p19 = new Promise(function(resolve46, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve45(result);
+            resolve46(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function drained() {
-        var p19 = new Promise(function(resolve45) {
+        var p19 = new Promise(function(resolve46) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve45();
+              resolve46();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve45();
+                resolve46();
                 queue.drain = previousDrain;
               };
             }
@@ -11554,9 +11580,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve45, reject) => {
+        return new Promise((resolve46, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve45(stats) : reject(error);
+            return error === null ? resolve46(stats) : reject(error);
           });
         });
       }
@@ -11580,10 +11606,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve45, reject) => {
+        return new Promise((resolve46, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve45(entries);
+              resolve46(entries);
             } else {
               reject(error);
             }
@@ -11593,10 +11619,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve45, reject) => {
+        return new Promise((resolve46, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve45(entries));
+          stream.once("end", () => resolve46(entries));
         });
       }
     };
@@ -12442,16 +12468,16 @@ var init_source_dir_detector = __esm({
 });
 
 // src/detect/monorepo-detector.ts
-import { readFileSync as readFileSync10, existsSync as existsSync14, statSync as statSync5, lstatSync as lstatSync2, readdirSync as readdirSync5 } from "fs";
+import { readFileSync as readFileSync10, existsSync as existsSync15, statSync as statSync6, lstatSync as lstatSync2, readdirSync as readdirSync6 } from "fs";
 import { join as join10, relative as relative4 } from "path";
 import { parse as parseYaml3 } from "yaml";
 import { parse as parseToml2 } from "smol-toml";
 function safeReadText(path) {
   try {
-    if (!existsSync14(path)) return null;
+    if (!existsSync15(path)) return null;
     const ls = lstatSync2(path);
     if (ls.isSymbolicLink()) return null;
-    const st = statSync5(path);
+    const st = statSync6(path);
     if (!st.isFile()) return null;
     return readFileSync10(path, "utf-8");
   } catch {
@@ -12460,7 +12486,7 @@ function safeReadText(path) {
 }
 function firstManifestIn(dir) {
   for (const m3 of MANIFEST_PRIORITY) {
-    if (existsSync14(join10(dir, m3))) return m3;
+    if (existsSync15(join10(dir, m3))) return m3;
   }
   return null;
 }
@@ -12516,7 +12542,7 @@ function pkgFromDir(root, dir) {
 }
 function listSubdirs2(dir) {
   try {
-    return readdirSync5(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS2.has(e2.name)).map((e2) => join10(dir, e2.name));
+    return readdirSync6(dir, { withFileTypes: true }).filter((e2) => e2.isDirectory() && !IGNORED_DIRS2.has(e2.name)).map((e2) => join10(dir, e2.name));
   } catch {
     return [];
   }
@@ -12525,7 +12551,7 @@ function genericWorkspaces(root) {
   const out = [];
   for (const parent of CONVENTIONAL_WORKSPACE_PARENTS) {
     const p19 = join10(root, parent);
-    if (!existsSync14(p19)) continue;
+    if (!existsSync15(p19)) continue;
     for (const sub of listSubdirs2(p19)) {
       const pkg = pkgFromDir(root, sub);
       if (pkg) out.push(pkg);
@@ -12566,7 +12592,7 @@ function expandWorkspaceGlobs(root, globs) {
     const parts = pattern.split("/");
     if (parts.length === 2 && (parts[1] === "*" || parts[1] === "**")) {
       const parent = join10(root, parts[0]);
-      if (!existsSync14(parent)) continue;
+      if (!existsSync15(parent)) continue;
       for (const sub of listSubdirs2(parent)) {
         const pkg = pkgFromDir(root, sub);
         if (pkg && !seen.has(pkg.path)) {
@@ -12577,7 +12603,7 @@ function expandWorkspaceGlobs(root, globs) {
       continue;
     }
     const direct = join10(root, pattern);
-    if (existsSync14(direct)) {
+    if (existsSync15(direct)) {
       const pkg = pkgFromDir(root, direct);
       if (pkg && !seen.has(pkg.path)) {
         seen.add(pkg.path);
@@ -12588,16 +12614,16 @@ function expandWorkspaceGlobs(root, globs) {
   return out;
 }
 function hasTurbo(root) {
-  return existsSync14(join10(root, "turbo.json"));
+  return existsSync15(join10(root, "turbo.json"));
 }
 function hasNx(root) {
-  return existsSync14(join10(root, "nx.json"));
+  return existsSync15(join10(root, "nx.json"));
 }
 function hasLerna(root) {
-  return existsSync14(join10(root, "lerna.json"));
+  return existsSync15(join10(root, "lerna.json"));
 }
 function hasBazel(root) {
-  return existsSync14(join10(root, "WORKSPACE")) || existsSync14(join10(root, "WORKSPACE.bazel")) || existsSync14(join10(root, "MODULE.bazel"));
+  return existsSync15(join10(root, "WORKSPACE")) || existsSync15(join10(root, "WORKSPACE.bazel")) || existsSync15(join10(root, "MODULE.bazel"));
 }
 function detectMonorepo(projectRoot) {
   const nested = [];
@@ -12788,7 +12814,7 @@ var init_vr_command_map = __esm({
 });
 
 // src/detect/domain-inferrer.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6 } from "fs";
+import { existsSync as existsSync16, readdirSync as readdirSync7 } from "fs";
 import { join as join11 } from "path";
 function titleCase(s) {
   if (!s) return s;
@@ -12810,9 +12836,9 @@ function topLevelSrcSubdirs(root, sourceDirs) {
   const seen = /* @__PURE__ */ new Set();
   for (const rel of effective) {
     const abs = join11(root, rel);
-    if (!existsSync15(abs)) continue;
+    if (!existsSync16(abs)) continue;
     try {
-      for (const e2 of readdirSync6(abs, { withFileTypes: true })) {
+      for (const e2 of readdirSync7(abs, { withFileTypes: true })) {
         if (!e2.isDirectory()) continue;
         if (IGNORED_SUBDIRS.has(e2.name)) continue;
         seen.add(e2.name);
@@ -12897,8 +12923,8 @@ var init_domain_inferrer = __esm({
 });
 
 // src/detect/regex-fallback.ts
-import { existsSync as existsSync16, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
-import { resolve as resolve8, join as join12, basename as basename4 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
+import { resolve as resolve9, join as join12, basename as basename4 } from "path";
 function introspectPython(detection, projectRoot) {
   const sourceDir = resolveSourceDir(detection, "python", projectRoot);
   if (!sourceDir) return null;
@@ -13064,10 +13090,10 @@ function resolveSourceDir(detection, lang, projectRoot) {
   const list = info?.source_dirs ?? [];
   if (list.length > 0) {
     const first = list[0];
-    const abs = resolve8(projectRoot, first);
-    return existsSync16(abs) ? abs : null;
+    const abs = resolve9(projectRoot, first);
+    return existsSync17(abs) ? abs : null;
   }
-  return existsSync16(projectRoot) ? projectRoot : null;
+  return existsSync17(projectRoot) ? projectRoot : null;
 }
 function sampleFiles(dir, nameRegex, pathFilter) {
   const out = [];
@@ -13077,7 +13103,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
     if (depth > MAX_DIR_DEPTH) continue;
     let entries;
     try {
-      entries = readdirSync7(path);
+      entries = readdirSync8(path);
     } catch {
       continue;
     }
@@ -13090,7 +13116,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
       const child = join12(path, entry);
       let st;
       try {
-        st = statSync6(child);
+        st = statSync7(child);
       } catch {
         continue;
       }
@@ -13110,7 +13136,7 @@ function sampleFiles(dir, nameRegex, pathFilter) {
 }
 function readSafe(path) {
   try {
-    const st = statSync6(path);
+    const st = statSync7(path);
     if (st.size > MAX_FILE_BYTES) return null;
     return readFileSync11(path, "utf-8");
   } catch {
@@ -13193,7 +13219,7 @@ var init_parse_guard = __esm({
 
 // src/detect/adapters/runner.ts
 import { basename as basename5, relative as relative5 } from "path";
-import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync12, statSync as statSync7 } from "fs";
+import { existsSync as existsSync18, readdirSync as readdirSync9, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
 import { join as join13 } from "path";
 async function runAdapters(adapters, rootDir, signals, options = {}) {
   const out = {
@@ -13288,10 +13314,10 @@ function buildDetectionSignals(rootDir) {
   const presentDirs = /* @__PURE__ */ new Set();
   const presentFiles = /* @__PURE__ */ new Set();
   try {
-    for (const entry of readdirSync8(rootDir)) {
+    for (const entry of readdirSync9(rootDir)) {
       if (entry.startsWith(".")) continue;
       try {
-        const st = statSync7(join13(rootDir, entry));
+        const st = statSync8(join13(rootDir, entry));
         if (st.isDirectory()) presentDirs.add(entry);
         else if (st.isFile()) presentFiles.add(entry);
       } catch {
@@ -13328,7 +13354,7 @@ function tryReadGradleBuild(rootDir, presentFiles) {
   return void 0;
 }
 function tryReadString(path) {
-  if (!existsSync17(path)) return void 0;
+  if (!existsSync18(path)) return void 0;
   try {
     return readFileSync12(path, "utf-8");
   } catch {
@@ -13448,7 +13474,7 @@ ${querySource}`
 import { createHash as createHash5 } from "crypto";
 import {
   mkdirSync as mkdirSync9,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   readFileSync as readFileSync13,
   writeFileSync as writeFileSync4,
   renameSync as renameSync3,
@@ -13457,11 +13483,11 @@ import {
   chmodSync as chmodSync4,
   utimesSync
 } from "fs";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 import { dirname as dirname11, join as join14 } from "path";
 import { Language, Parser } from "web-tree-sitter";
 function getCacheDir() {
-  return process.env.MASSU_WASM_CACHE_DIR ?? join14(homedir5(), ".massu", "wasm-cache");
+  return process.env.MASSU_WASM_CACHE_DIR ?? join14(homedir6(), ".massu", "wasm-cache");
 }
 function getCachedPath(language, sha) {
   return join14(getCacheDir(), `${language}-${sha}.wasm`);
@@ -13485,7 +13511,7 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
   const dir = getCacheDir();
   let entries;
   try {
-    entries = readdirSync9(dir);
+    entries = readdirSync10(dir);
   } catch {
     return;
   }
@@ -14467,7 +14493,7 @@ __export(file_sampler_exports, {
   SAMPLE_TEST_FILE_PATTERNS: () => SAMPLE_TEST_FILE_PATTERNS,
   sampleFilesForAdapter: () => sampleFilesForAdapter
 });
-import { readdirSync as readdirSync10, readFileSync as readFileSync14, lstatSync as lstatSync4 } from "node:fs";
+import { readdirSync as readdirSync11, readFileSync as readFileSync14, lstatSync as lstatSync4 } from "node:fs";
 import { join as join15, extname } from "node:path";
 function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
@@ -14499,7 +14525,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
   if (out.length >= maxFiles) return;
   let entries;
   try {
-    entries = readdirSync10(dir);
+    entries = readdirSync11(dir);
   } catch {
     return;
   }
@@ -15952,10 +15978,10 @@ __export(init_exports, {
   validateWrittenConfig: () => validateWrittenConfig,
   writeConfigAtomic: () => writeConfigAtomic
 });
-import { closeSync as closeSync4, existsSync as existsSync18, fsyncSync as fsyncSync4, openSync as openSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync5, writeSync as writeSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync11, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync9, chmodSync as chmodSync5 } from "fs";
-import { resolve as resolve9, basename as basename6, dirname as dirname12 } from "path";
+import { closeSync as closeSync4, existsSync as existsSync19, fsyncSync as fsyncSync4, openSync as openSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync5, writeSync as writeSync2, mkdirSync as mkdirSync10, readdirSync as readdirSync12, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync10, chmodSync as chmodSync5 } from "fs";
+import { resolve as resolve10, basename as basename6, dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { stringify as yamlStringify, parse as yamlParse } from "yaml";
 function detectFramework(projectRoot) {
   const result = {
@@ -15964,8 +15990,8 @@ function detectFramework(projectRoot) {
     orm: "none",
     ui: "none"
   };
-  const pkgPath = resolve9(projectRoot, "package.json");
-  if (!existsSync18(pkgPath)) return result;
+  const pkgPath = resolve10(projectRoot, "package.json");
+  if (!existsSync19(pkgPath)) return result;
   try {
     const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
     const allDeps = {
@@ -16001,7 +16027,7 @@ function detectPython(projectRoot) {
     alembicDir: null
   };
   const markers = ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile"];
-  const hasMarker = markers.some((m3) => existsSync18(resolve9(projectRoot, m3)));
+  const hasMarker = markers.some((m3) => existsSync19(resolve10(projectRoot, m3)));
   if (!hasMarker) return result;
   result.detected = true;
   const depFiles = [
@@ -16011,8 +16037,8 @@ function detectPython(projectRoot) {
     { file: "Pipfile" }
   ];
   for (const { file } of depFiles) {
-    const filePath = resolve9(projectRoot, file);
-    if (existsSync18(filePath)) {
+    const filePath = resolve10(projectRoot, file);
+    if (existsSync19(filePath)) {
       try {
         const content = readFileSync15(filePath, "utf-8").toLowerCase();
         if (content.includes("fastapi")) result.hasFastapi = true;
@@ -16021,25 +16047,25 @@ function detectPython(projectRoot) {
       }
     }
   }
-  if (existsSync18(resolve9(projectRoot, "alembic.ini"))) {
+  if (existsSync19(resolve10(projectRoot, "alembic.ini"))) {
     result.hasAlembic = true;
-    if (existsSync18(resolve9(projectRoot, "alembic"))) {
+    if (existsSync19(resolve10(projectRoot, "alembic"))) {
       result.alembicDir = "alembic";
     }
-  } else if (existsSync18(resolve9(projectRoot, "alembic"))) {
+  } else if (existsSync19(resolve10(projectRoot, "alembic"))) {
     result.hasAlembic = true;
     result.alembicDir = "alembic";
   }
   const candidateRoots = ["app", "src", "backend", "api"];
   for (const candidate of candidateRoots) {
-    const candidatePath = resolve9(projectRoot, candidate);
-    if (existsSync18(candidatePath) && existsSync18(resolve9(candidatePath, "__init__.py"))) {
+    const candidatePath = resolve10(projectRoot, candidate);
+    if (existsSync19(candidatePath) && existsSync19(resolve10(candidatePath, "__init__.py"))) {
       result.root = candidate;
       break;
     }
-    if (existsSync18(candidatePath)) {
+    if (existsSync19(candidatePath)) {
       try {
-        const files = readdirSync11(candidatePath);
+        const files = readdirSync12(candidatePath);
         if (files.some((f2) => f2.endsWith(".py"))) {
           result.root = candidate;
           break;
@@ -16057,8 +16083,8 @@ function generateConfig(projectRoot, framework) {
   console.warn(
     "[@massu/core] generateConfig() is deprecated since 1.2.1 \u2014 use buildConfigFromDetection instead. It cannot produce valid configs for monorepos."
   );
-  const configPath = resolve9(projectRoot, "massu.config.yaml");
-  if (existsSync18(configPath)) {
+  const configPath = resolve10(projectRoot, "massu.config.yaml");
+  if (existsSync19(configPath)) {
     return false;
   }
   const projectName = basename6(projectRoot);
@@ -16169,10 +16195,10 @@ function buildConfigFromDetection(opts) {
       pathsSource = monorepoCommonRoot(detection.monorepo.packages);
     }
   }
-  if (pathsSource === "src" && !existsSync18(resolve9(projectRoot, "src"))) {
+  if (pathsSource === "src" && !existsSync19(resolve10(projectRoot, "src"))) {
     const fallbacks = ["app", "pages", "."];
     for (const fallback of fallbacks) {
-      if (fallback === "." || existsSync18(resolve9(projectRoot, fallback))) {
+      if (fallback === "." || existsSync19(resolve10(projectRoot, fallback))) {
         pathsSource = fallback;
         break;
       }
@@ -16256,7 +16282,7 @@ function buildConfigFromDetection(opts) {
     };
     if (pyFw?.framework) pythonBlock.framework = pyFw.framework;
     if (pyFw?.orm) pythonBlock.orm = pyFw.orm;
-    if (existsSync18(resolve9(projectRoot, "alembic.ini")) || existsSync18(resolve9(projectRoot, "alembic"))) {
+    if (existsSync19(resolve10(projectRoot, "alembic.ini")) || existsSync19(resolve10(projectRoot, "alembic"))) {
       pythonBlock.alembic_dir = "alembic";
     }
     config.python = pythonBlock;
@@ -16280,8 +16306,8 @@ function applyVariantTemplate(config, templatesDir) {
     }
   }
   if (templateId === null) return config;
-  const templatePath = resolve9(templatesDir, templateId, "massu.config.yaml");
-  if (!existsSync18(templatePath)) return config;
+  const templatePath = resolve10(templatesDir, templateId, "massu.config.yaml");
+  if (!existsSync19(templatePath)) return config;
   let template;
   try {
     template = yamlParse(readFileSync15(templatePath, "utf-8"));
@@ -16343,9 +16369,9 @@ ${yamlStringify(config)}`;
 function writeConfigAtomic(configPath, content) {
   const tmpPath = `${configPath}.tmp`;
   let existingMode;
-  if (existsSync18(configPath)) {
+  if (existsSync19(configPath)) {
     try {
-      existingMode = statSync9(configPath).mode;
+      existingMode = statSync10(configPath).mode;
     } catch {
       existingMode = void 0;
     }
@@ -16373,7 +16399,7 @@ function writeConfigAtomic(configPath, content) {
     }
     return { validated: true };
   } catch (err) {
-    if (existsSync18(tmpPath)) {
+    if (existsSync19(tmpPath)) {
       try {
         rmSync6(tmpPath, { force: true });
       } catch {
@@ -16384,7 +16410,7 @@ function writeConfigAtomic(configPath, content) {
 }
 function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
   try {
-    if (!existsSync18(configPath)) return "Config file does not exist after write";
+    if (!existsSync19(configPath)) return "Config file does not exist after write";
     const content = readFileSync15(configPath, "utf-8");
     const parsed = yamlParse(content);
     if (parsed === null || typeof parsed !== "object") {
@@ -16405,8 +16431,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
       if (checkPaths) {
         const src = cfg.paths.source;
         if (src && src !== ".") {
-          const srcAbs = resolve9(projectRoot, src);
-          if (!existsSync18(srcAbs)) {
+          const srcAbs = resolve10(projectRoot, src);
+          if (!existsSync19(srcAbs)) {
             return `paths.source '${src}' does not exist on disk`;
           }
         }
@@ -16416,8 +16442,8 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
           if (!Array.isArray(rawDirs)) continue;
           for (const d2 of rawDirs) {
             if (typeof d2 !== "string" || d2 === ".") continue;
-            const abs = resolve9(projectRoot, d2);
-            if (!existsSync18(abs)) {
+            const abs = resolve10(projectRoot, d2);
+            if (!existsSync19(abs)) {
               return `framework.languages.${lang}.source_dirs '${d2}' does not exist on disk`;
             }
           }
@@ -16426,7 +16452,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
         if (Array.isArray(mRoots)) {
           for (const r2 of mRoots) {
             if (typeof r2 !== "string" || r2 === ".") continue;
-            if (!existsSync18(resolve9(projectRoot, r2))) {
+            if (!existsSync19(resolve10(projectRoot, r2))) {
               return `paths.monorepo_roots '${r2}' does not exist on disk`;
             }
           }
@@ -16458,21 +16484,21 @@ function resolveTemplatesDir() {
   const cwd = process.cwd();
   const candidates = [
     // Project-local install: `<project>/node_modules/@massu/core/templates`.
-    resolve9(cwd, "node_modules/@massu/core/templates"),
+    resolve10(cwd, "node_modules/@massu/core/templates"),
     // Bundled cli.js layout: cli.js sits at `<package>/dist/cli.js`, so
     // templates live one level up at `<package>/templates`. (Plan 1.5.1
     // bug discovery: pre-existing layout assumed `dist/commands/init.js`
     // depth which never matched the bundled cli, so resolveTemplatesDir
     // returned null in production for both `--template` mode AND the
     // applyVariantTemplate path.)
-    resolve9(__dirname2, "../templates"),
+    resolve10(__dirname2, "../templates"),
     // Legacy nested layouts retained as fallbacks (in case a future
     // build moves cli.js back into a subdirectory).
-    resolve9(__dirname2, "../../templates"),
-    resolve9(__dirname2, "../../../templates")
+    resolve10(__dirname2, "../../templates"),
+    resolve10(__dirname2, "../../../templates")
   ];
   for (const c2 of candidates) {
-    if (existsSync18(c2)) return c2;
+    if (existsSync19(c2)) return c2;
   }
   return null;
 }
@@ -16481,8 +16507,8 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
   if (!templatesDir) {
     return { success: false, error: `Templates directory not found (looked in node_modules and dist/src)` };
   }
-  const srcPath = resolve9(templatesDir, templateName, "massu.config.yaml");
-  if (!existsSync18(srcPath)) {
+  const srcPath = resolve10(templatesDir, templateName, "massu.config.yaml");
+  if (!existsSync19(srcPath)) {
     return { success: false, error: `Template '${templateName}' not found at ${srcPath}` };
   }
   try {
@@ -16496,11 +16522,11 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
 }
 function getInstallerVersion() {
   const candidates = [
-    resolve9(__dirname2, "../package.json"),
-    resolve9(__dirname2, "../../package.json")
+    resolve10(__dirname2, "../package.json"),
+    resolve10(__dirname2, "../../package.json")
   ];
   for (const candidate of candidates) {
-    if (existsSync18(candidate)) {
+    if (existsSync19(candidate)) {
       try {
         const pkg = JSON.parse(readFileSync15(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0 && pkg.name === "@massu/core") {
@@ -16515,9 +16541,9 @@ function getInstallerVersion() {
   );
 }
 function registerMcpServer(projectRoot) {
-  const mcpPath = resolve9(projectRoot, ".mcp.json");
+  const mcpPath = resolve10(projectRoot, ".mcp.json");
   let existing = {};
-  if (existsSync18(mcpPath)) {
+  if (existsSync19(mcpPath)) {
     try {
       existing = JSON.parse(readFileSync15(mcpPath, "utf-8"));
     } catch {
@@ -16540,12 +16566,12 @@ function registerMcpServer(projectRoot) {
 }
 function resolveHooksDir() {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve9(cwd, "node_modules/@massu/core/dist/hooks");
-  if (existsSync18(nodeModulesPath)) {
+  const nodeModulesPath = resolve10(cwd, "node_modules/@massu/core/dist/hooks");
+  if (existsSync19(nodeModulesPath)) {
     return "node_modules/@massu/core/dist/hooks";
   }
-  const localPath = resolve9(__dirname2, "../dist/hooks");
-  if (existsSync18(localPath)) {
+  const localPath = resolve10(__dirname2, "../dist/hooks");
+  if (existsSync19(localPath)) {
     return localPath;
   }
   return "node_modules/@massu/core/dist/hooks";
@@ -16694,8 +16720,8 @@ function installHooks(projectRoot) {
   } catch {
     claudeDirName = ".claude";
   }
-  const claudeDir = resolve9(projectRoot, claudeDirName);
-  if (!existsSync18(claudeDir)) {
+  const claudeDir = resolve10(projectRoot, claudeDirName);
+  if (!existsSync19(claudeDir)) {
     mkdirSync10(claudeDir, { recursive: true });
   }
   const settings = readSettingsLocal(claudeDir);
@@ -16714,16 +16740,16 @@ function installHooks(projectRoot) {
 }
 function initMemoryDir(projectRoot) {
   const encodedRoot = encodeMemoryDirName(projectRoot);
-  const memoryDir = resolve9(homedir6(), `.claude/projects/${encodedRoot}/memory`);
+  const memoryDir = resolve10(homedir7(), `.claude/projects/${encodedRoot}/memory`);
   let migratedFromLegacy = false;
-  const legacyDir = resolve9(homedir6(), `.claude/projects/-${encodedRoot}/memory`);
-  if (existsSync18(legacyDir) && !existsSync18(memoryDir)) {
+  const legacyDir = resolve10(homedir7(), `.claude/projects/-${encodedRoot}/memory`);
+  if (existsSync19(legacyDir) && !existsSync19(memoryDir)) {
     try {
-      mkdirSync10(resolve9(memoryDir, ".."), { recursive: true });
+      mkdirSync10(resolve10(memoryDir, ".."), { recursive: true });
       renameSync4(legacyDir, memoryDir);
       try {
-        const legacyParent = resolve9(legacyDir, "..");
-        if (existsSync18(legacyParent) && readdirSync11(legacyParent).length === 0) {
+        const legacyParent = resolve10(legacyDir, "..");
+        if (existsSync19(legacyParent) && readdirSync12(legacyParent).length === 0) {
           rmSync6(legacyParent, { recursive: false });
         }
       } catch {
@@ -16733,13 +16759,13 @@ function initMemoryDir(projectRoot) {
     }
   }
   let created = false;
-  if (!existsSync18(memoryDir)) {
+  if (!existsSync19(memoryDir)) {
     mkdirSync10(memoryDir, { recursive: true });
     created = true;
   }
-  const memoryMdPath = resolve9(memoryDir, "MEMORY.md");
+  const memoryMdPath = resolve10(memoryDir, "MEMORY.md");
   let memoryMdCreated = false;
-  if (!existsSync18(memoryMdPath)) {
+  if (!existsSync19(memoryMdPath)) {
     const projectName = basename6(projectRoot);
     const memoryContent = `# ${projectName} - Massu Memory
 
@@ -16853,8 +16879,8 @@ async function runInit(argv, overrides) {
   log("Massu AI - Project Setup");
   log("========================");
   log("");
-  const configPath = resolve9(projectRoot, "massu.config.yaml");
-  if (existsSync18(configPath)) {
+  const configPath = resolve10(projectRoot, "massu.config.yaml");
+  if (existsSync19(configPath)) {
     if (opts.ci && !opts.force) {
       errLog(`error: massu.config.yaml already exists at ${configPath}`);
       errLog("       rerun with --force to overwrite, or remove the file first");
@@ -16993,8 +17019,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
       const commandStats = cmdResult.assets.commands;
       const stackResolved = !emptyStack && commandStats && (commandStats.installed > 0 || commandStats.updated > 0 || commandStats.kept > 0);
       if (!stackResolved) {
-        const placeholderPath = resolve9(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (!existsSync18(placeholderPath)) {
+        const placeholderPath = resolve10(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (!existsSync19(placeholderPath)) {
           const placeholderBody = [
             "# Massu \u2014 stack not yet detected",
             "",
@@ -17015,7 +17041,7 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
             "\u2014 Massu"
           ].join("\n");
           try {
-            mkdirSync10(resolve9(cmdResult.claudeDir, "commands"), { recursive: true });
+            mkdirSync10(resolve10(cmdResult.claudeDir, "commands"), { recursive: true });
             writeFileSync5(placeholderPath, placeholderBody, "utf-8");
             log("  Wrote _massu-needs-stack.md placeholder (no stack detected yet)");
           } catch {
@@ -17038,8 +17064,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
   (async () => {
     try {
       const encodedRoot = encodeMemoryDirName(projectRoot);
-      const memoryDir = resolve9(homedir6(), ".claude", "projects", encodedRoot, "memory");
-      const memFiles = existsSync18(memoryDir) ? readdirSync11(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
+      const memoryDir = resolve10(homedir7(), ".claude", "projects", encodedRoot, "memory");
+      const memFiles = existsSync19(memoryDir) ? readdirSync12(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
       if (memFiles.length > 0) {
         const { getMemoryDb: getMemoryDb2 } = await Promise.resolve().then(() => (init_memory_db(), memory_db_exports));
         const db = getMemoryDb2();
@@ -17720,21 +17746,195 @@ var init_hook_registry = __esm({
   }
 });
 
+// src/preflight.ts
+import { existsSync as existsSync20 } from "fs";
+function assertCodegraphUsable(dbPath) {
+  const path = dbPath ?? getResolvedPaths().codegraphDbPath;
+  if (!existsSync20(path)) {
+    throw new CodegraphDbUnusableError(path, "missing");
+  }
+  let db = null;
+  try {
+    db = openDatabase2(path, { readonly: true });
+    const row = db.prepare("SELECT COUNT(*) AS c FROM files").get();
+    const files = row?.c ?? 0;
+    if (files === 0) {
+      throw new CodegraphDbUnusableError(path, "empty");
+    }
+  } catch (err) {
+    if (err instanceof CodegraphDbUnusableError) throw err;
+    throw new CodegraphDbUnusableError(
+      path,
+      "unreadable",
+      err instanceof Error ? err.message : String(err)
+    );
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+var CodegraphDbNotInitializedError, CodegraphDbUnusableError;
+var init_preflight = __esm({
+  "src/preflight.ts"() {
+    "use strict";
+    init_db_driver();
+    init_config();
+    init_node_floor();
+    CodegraphDbNotInitializedError = class extends Error {
+      dbPath;
+      constructor(dbPath) {
+        super(`CodeGraph database not found at ${dbPath}`);
+        this.name = "CodegraphDbNotInitializedError";
+        this.dbPath = dbPath;
+      }
+    };
+    CodegraphDbUnusableError = class extends CodegraphDbNotInitializedError {
+      reason;
+      constructor(dbPath, reason, detail) {
+        super(dbPath);
+        this.message = reason === "missing" ? `CodeGraph database not found at ${dbPath}` : reason === "empty" ? `CodeGraph database at ${dbPath} exists but is EMPTY (0 files indexed)` : `CodeGraph database at ${dbPath} could not be read: ${detail ?? "unknown"}`;
+        this.name = "CodegraphDbUnusableError";
+        this.reason = reason;
+      }
+      /**
+       * The remedy, per reason. VERIFIED BY EXECUTION — `init` is a no-op on an
+       * already-initialized repo and will NOT populate the graph. `index` is the command
+       * that does. Getting this wrong sends the customer in a circle.
+       */
+      get remedy() {
+        switch (this.reason) {
+          case "missing":
+            return "npx @colbymchenry/codegraph init && npx @colbymchenry/codegraph index";
+          case "empty":
+            return "npx @colbymchenry/codegraph index";
+          case "unreadable":
+            return "npx @colbymchenry/codegraph index   (the database may be corrupt \u2014 re-indexing rebuilds it)";
+        }
+      }
+      /** Plain-English explanation for a human. */
+      get humanExplanation() {
+        switch (this.reason) {
+          case "missing":
+            return "Massu needs a map of your code to answer questions about it. That map has not been built yet.";
+          case "empty":
+            return 'The code map exists but is EMPTY \u2014 nothing was ever indexed into it. Massu would answer "no impact" to every question, which is indistinguishable from a real answer. It is refusing rather than misleading you.';
+          case "unreadable":
+            return "The code map exists but cannot be read. It may be corrupt.";
+        }
+      }
+    };
+  }
+});
+
+// src/commands/hook-runner.ts
+var hook_runner_exports = {};
+__export(hook_runner_exports, {
+  HOOK_NAME_TO_FILE: () => HOOK_NAME_TO_FILE,
+  resolveHookFile: () => resolveHookFile,
+  runHookRunner: () => runHookRunner
+});
+import { existsSync as existsSync21 } from "fs";
+import { resolve as resolve11, dirname as dirname13 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+import { spawn } from "child_process";
+function resolveHookFile(hookName) {
+  const file = HOOK_NAME_TO_FILE[hookName];
+  if (!file) {
+    throw new Error(
+      `Unknown hook: "${hookName}". Recognized: ${Object.keys(HOOK_NAME_TO_FILE).join(", ")}`
+    );
+  }
+  const candidates = [
+    // Bundled compiled layout: dist/cli.js → ./hooks/<file>.js
+    resolve11(__dirname3, "hooks", file),
+    // TS-source dev / sibling layout: src/commands/ → ../hooks/<file>
+    resolve11(__dirname3, "../hooks", file),
+    // TS-source dev fallback: src/commands/ → ../../dist/hooks/<file>
+    resolve11(__dirname3, "../../dist/hooks", file)
+  ];
+  for (const candidate of candidates) {
+    if (existsSync21(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(
+    `Hook file not found for "${hookName}". Searched: ${candidates.join(", ")}. This indicates a broken @massu/core install. Re-run \`npx -y @massu/core init\`.`
+  );
+}
+async function runHookRunner(args2) {
+  const hookName = args2[0];
+  if (!hookName) {
+    process.stderr.write(
+      `massu hook-runner: missing hook name.
+Usage: massu hook-runner <hook-name>
+Recognized: ${Object.keys(HOOK_NAME_TO_FILE).join(", ")}
+`
+    );
+    return { exitCode: 2 };
+  }
+  let hookFile;
+  try {
+    hookFile = resolveHookFile(hookName);
+  } catch (err) {
+    process.stderr.write(`massu hook-runner: ${err instanceof Error ? err.message : String(err)}
+`);
+    return { exitCode: 2 };
+  }
+  return new Promise((resolvePromise) => {
+    const child = spawn(process.execPath, [hookFile], {
+      stdio: ["inherit", "inherit", "inherit"],
+      // MASSU_HOOK_RUNTIME marks the hook process so the SSOT SQLite loader NEVER
+      // self-heals here (5s budget / CR-12, CR-65 P0-003) — even for indirect opens
+      // via getMemoryDb(). The next server/CLI touch performs the rebuild.
+      env: { ...process.env, MASSU_HOOK_RUNTIME: "1" }
+    });
+    child.on("exit", (code, signal) => {
+      if (signal) {
+        resolvePromise({ exitCode: 128 });
+        return;
+      }
+      resolvePromise({ exitCode: code ?? 0 });
+    });
+    child.on("error", (err) => {
+      process.stderr.write(`massu hook-runner: failed to spawn hook "${hookName}": ${err.message}
+`);
+      resolvePromise({ exitCode: 2 });
+    });
+  });
+}
+var __filename3, __dirname3, HOOK_NAME_TO_FILE;
+var init_hook_runner = __esm({
+  "src/commands/hook-runner.ts"() {
+    "use strict";
+    init_hook_registry();
+    __filename3 = fileURLToPath4(import.meta.url);
+    __dirname3 = dirname13(__filename3);
+    HOOK_NAME_TO_FILE = Object.freeze(
+      Object.fromEntries(REGISTERED_HOOKS.map((name) => [name, `${name}.js`]))
+    );
+  }
+});
+
 // src/commands/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
+  checkHookExecution: () => checkHookExecution,
+  checkHooksConfig: () => checkHooksConfig,
   checkNativeModules: () => checkNativeModules,
+  checkShellHooksWired: () => checkShellHooksWired,
   formatLicenseCheck: () => formatLicenseCheck,
   runDoctor: () => runDoctor,
   runValidateConfig: () => runValidateConfig
 });
-import { existsSync as existsSync19, readFileSync as readFileSync16, readdirSync as readdirSync12 } from "fs";
-import { resolve as resolve10, dirname as dirname13 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync22, readFileSync as readFileSync16, readdirSync as readdirSync13 } from "fs";
+import { resolve as resolve12, dirname as dirname14 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 import { parse as parseYaml4 } from "yaml";
 function checkConfig(projectRoot) {
-  const configPath = resolve10(projectRoot, "massu.config.yaml");
-  if (!existsSync19(configPath)) {
+  const configPath = resolve12(projectRoot, "massu.config.yaml");
+  if (!existsSync22(configPath)) {
     return { name: "Configuration", status: "fail", detail: "massu.config.yaml not found. Run: npx massu init" };
   }
   try {
@@ -17750,7 +17950,7 @@ function checkConfig(projectRoot) {
 }
 function checkMcpServer(projectRoot) {
   const mcpPath = getResolvedPaths().mcpJsonPath;
-  if (!existsSync19(mcpPath)) {
+  if (!existsSync22(mcpPath)) {
     return { name: "MCP Server", status: "fail", detail: ".mcp.json not found. Run: npx massu init" };
   }
   try {
@@ -17764,41 +17964,54 @@ function checkMcpServer(projectRoot) {
     return { name: "MCP Server", status: "fail", detail: `.mcp.json parse error: ${err instanceof Error ? err.message : String(err)}` };
   }
 }
-function checkHooksConfig(projectRoot) {
-  const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync19(settingsPath)) {
-    return { name: "Hooks Config", status: "fail", detail: ".claude/settings.local.json not found. Run: npx massu init" };
+function readHookSources() {
+  const { settingsPath, settingsLocalPath } = getResolvedPaths();
+  const out = [];
+  for (const [label, p19] of [["settings.json", settingsPath], ["settings.local.json", settingsLocalPath]]) {
+    if (!existsSync22(p19)) continue;
+    const content = readSettingsAtPath(p19);
+    out.push({ label, hooks: content.hooks });
+  }
+  return out;
+}
+function checkHooksConfig(_projectRoot2) {
+  const sources = readHookSources();
+  if (sources.length === 0) {
+    return { name: "Hooks Config", status: "fail", detail: ".claude/settings.json or settings.local.json not found. Run: npx massu init" };
   }
   try {
-    const content = readSettingsAtPath(settingsPath);
-    if (!content.hooks) {
-      return { name: "Hooks Config", status: "fail", detail: "No hooks configured. Run: npx massu install-hooks" };
-    }
     let hookCount = 0;
-    for (const groups of Object.values(content.hooks)) {
-      if (Array.isArray(groups)) {
-        for (const group of groups) {
-          const g2 = group;
-          if (Array.isArray(g2.hooks)) {
-            hookCount += g2.hooks.length;
+    const from = [];
+    for (const { label, hooks } of sources) {
+      if (!hooks) continue;
+      let n = 0;
+      for (const groups of Object.values(hooks)) {
+        if (Array.isArray(groups)) {
+          for (const group of groups) {
+            const g2 = group;
+            if (Array.isArray(g2.hooks)) n += g2.hooks.length;
           }
         }
       }
+      if (n > 0) {
+        hookCount += n;
+        from.push(label);
+      }
     }
     if (hookCount === 0) {
-      return { name: "Hooks Config", status: "fail", detail: "Hooks section exists but no hooks configured" };
+      return { name: "Hooks Config", status: "fail", detail: "No hooks configured. Run: npx massu install-hooks" };
     }
-    return { name: "Hooks Config", status: "pass", detail: `${hookCount} hooks configured` };
+    return { name: "Hooks Config", status: "pass", detail: `${hookCount} hooks configured (${from.join(" + ")})` };
   } catch (err) {
-    return { name: "Hooks Config", status: "fail", detail: `settings.local.json parse error: ${err instanceof Error ? err.message : String(err)}` };
+    return { name: "Hooks Config", status: "fail", detail: `settings parse error: ${err instanceof Error ? err.message : String(err)}` };
   }
 }
 function checkHookFiles(projectRoot) {
-  const nodeModulesHooksDir = resolve10(projectRoot, "node_modules/@massu/core/dist/hooks");
+  const nodeModulesHooksDir = resolve12(projectRoot, "node_modules/@massu/core/dist/hooks");
   let hooksDir = nodeModulesHooksDir;
-  if (!existsSync19(nodeModulesHooksDir)) {
-    const devHooksDir = resolve10(__dirname3, "../../dist/hooks");
-    if (existsSync19(devHooksDir)) {
+  if (!existsSync22(nodeModulesHooksDir)) {
+    const devHooksDir = resolve12(__dirname4, "../../dist/hooks");
+    if (existsSync22(devHooksDir)) {
       hooksDir = devHooksDir;
     } else {
       return { name: "Hook Files", status: "fail", detail: "Compiled hooks not found. Run: npm install @massu/core" };
@@ -17806,7 +18019,7 @@ function checkHookFiles(projectRoot) {
   }
   const missing = [];
   for (const hookFile of EXPECTED_HOOKS) {
-    if (!existsSync19(resolve10(hooksDir, hookFile))) {
+    if (!existsSync22(resolve12(hooksDir, hookFile))) {
       missing.push(hookFile);
     }
   }
@@ -17815,6 +18028,67 @@ function checkHookFiles(projectRoot) {
   }
   return { name: "Hook Files", status: "pass", detail: `${EXPECTED_HOOKS.length}/${EXPECTED_HOOKS.length} compiled hooks present` };
 }
+async function checkHookExecution(projectRoot, opts = {}) {
+  const { spawnSync: spawnSync6 } = await import("child_process");
+  const { mkdtempSync: mkdtempSync2, copyFileSync: copyFileSync4, rmSync: rmSync12 } = await import("fs");
+  const { tmpdir: tmpdir2 } = await import("os");
+  const node = opts.node ?? process.execPath;
+  const timeoutMs = opts.timeoutMs ?? 1e4;
+  const event = opts.event ?? JSON.stringify({ hook_event_name: "SessionStart", source: "massu-doctor-canary" });
+  let hookFile;
+  try {
+    hookFile = opts.hookFile ?? resolveHookFile("session-start");
+  } catch (err) {
+    return {
+      name: "Hook Runtime",
+      status: "fail",
+      detail: `Canary hook file unresolved: ${err instanceof Error ? err.message : String(err)}. Re-run: npx -y @massu/core init`
+    };
+  }
+  const tmpCwd = mkdtempSync2(resolve12(tmpdir2(), "massu-hook-canary-"));
+  try {
+    const realConfig = resolve12(projectRoot, "massu.config.yaml");
+    if (existsSync22(realConfig)) {
+      try {
+        copyFileSync4(realConfig, resolve12(tmpCwd, "massu.config.yaml"));
+      } catch {
+      }
+    }
+    const res = spawnSync6(node, [hookFile], {
+      input: event,
+      cwd: tmpCwd,
+      timeout: timeoutMs,
+      encoding: "utf-8",
+      env: { ...process.env, MASSU_HOOK_RUNTIME: "1" }
+    });
+    if (res.error) {
+      const killed = res.error.code === "ETIMEDOUT" ? " (timed out)" : "";
+      return {
+        name: "Hook Runtime",
+        status: "fail",
+        detail: `Canary hook did not run under Node ${process.version}${killed}: ${res.error.message}. Hooks would crash at runtime \u2014 upgrade Node to >= ${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}.0.`
+      };
+    }
+    if (res.status !== 0) {
+      const tail = (res.stderr || "").trim().split("\n").slice(-2).join(" ");
+      return {
+        name: "Hook Runtime",
+        status: "fail",
+        detail: `Canary hook exited ${res.status ?? "null"} under Node ${process.version} \u2014 a configured hook FAILS at runtime.${tail ? ` ${tail}` : ""}`
+      };
+    }
+    return {
+      name: "Hook Runtime",
+      status: "pass",
+      detail: `Canary hook executes (exit 0) under Node ${process.version}`
+    };
+  } finally {
+    try {
+      rmSync12(tmpCwd, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
 async function checkNativeModules() {
   const engine = resolveDbEngine();
   const engineLabel = engine === "better-sqlite3" ? "better-sqlite3 (native fallback)" : "node:sqlite (native-free, Node built-in)";
@@ -17830,23 +18104,22 @@ async function checkNativeModules() {
     detail: `${engineLabel} unusable \u2014 ${verdict.reason}${because}. ${verdict.remedy ?? NATIVE_DB_REMEDY}`
   };
 }
-function checkNodeVersion() {
+function checkNodeVersion2() {
   const version = process.versions.node;
-  const [major, minor] = version.split(".").map((n) => parseInt(n, 10));
-  const meets = major > 22 || major === 22 && minor >= 13;
-  if (meets) {
-    return { name: "Node.js", status: "pass", detail: `v${version} (>= 22.13.0 required for node:sqlite)` };
+  const floor = `${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}.0`;
+  if (checkNodeVersion().ok) {
+    return { name: "Node.js", status: "pass", detail: `v${version} (>= ${floor} required for node:sqlite)` };
   }
-  return { name: "Node.js", status: "fail", detail: `v${version} \u2014 Node.js >= 22.13.0 is required (node:sqlite engine)` };
+  return { name: "Node.js", status: "fail", detail: `v${version} \u2014 Node.js >= ${floor} is required (node:sqlite engine)` };
 }
 async function checkGitRepo(projectRoot) {
-  const gitDir = resolve10(projectRoot, ".git");
-  if (!existsSync19(gitDir)) {
+  const gitDir = resolve12(projectRoot, ".git");
+  if (!existsSync22(gitDir)) {
     return { name: "Git Repository", status: "warn", detail: "Not a git repository (optional but recommended)" };
   }
   try {
-    const { spawnSync: spawnSync5 } = await import("child_process");
-    const result = spawnSync5("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    const { spawnSync: spawnSync6 } = await import("child_process");
+    const result = spawnSync6("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       timeout: 5e3,
       cwd: projectRoot
@@ -17859,7 +18132,7 @@ async function checkGitRepo(projectRoot) {
 }
 function checkKnowledgeDb(projectRoot) {
   const knowledgeDbPath = getResolvedPaths().memoryDbPath;
-  if (!existsSync19(knowledgeDbPath)) {
+  if (!existsSync22(knowledgeDbPath)) {
     return {
       name: "Knowledge DB",
       status: "warn",
@@ -17870,7 +18143,7 @@ function checkKnowledgeDb(projectRoot) {
 }
 function checkMemoryDir(_projectRoot2) {
   const memoryDir = getResolvedPaths().memoryDir;
-  if (!existsSync19(memoryDir)) {
+  if (!existsSync22(memoryDir)) {
     return {
       name: "Memory Directory",
       status: "warn",
@@ -17880,19 +18153,22 @@ function checkMemoryDir(_projectRoot2) {
   return { name: "Memory Directory", status: "pass", detail: `Memory directory exists` };
 }
 function checkShellHooksWired(_projectRoot2) {
-  const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync19(settingsPath)) {
+  const sources = readHookSources();
+  if (sources.length === 0) {
     return {
       name: "Shell Hooks",
       status: "fail",
-      detail: "settings.local.json not found. Run: npx massu install-hooks"
+      detail: "settings.json / settings.local.json not found. Run: npx massu install-hooks"
     };
   }
   try {
-    const content = readSettingsAtPath(settingsPath);
-    const hooks = content.hooks ?? {};
-    const hasSessionStart = Array.isArray(hooks.SessionStart) && hooks.SessionStart.length > 0;
-    const hasPreToolUse = Array.isArray(hooks.PreToolUse) && hooks.PreToolUse.length > 0;
+    let hasSessionStart = false;
+    let hasPreToolUse = false;
+    for (const { hooks } of sources) {
+      const h2 = hooks ?? {};
+      if (Array.isArray(h2.SessionStart) && h2.SessionStart.length > 0) hasSessionStart = true;
+      if (Array.isArray(h2.PreToolUse) && h2.PreToolUse.length > 0) hasPreToolUse = true;
+    }
     if (!hasSessionStart && !hasPreToolUse) {
       return {
         name: "Shell Hooks",
@@ -17900,12 +18176,12 @@ function checkShellHooksWired(_projectRoot2) {
         detail: "No lifecycle hooks wired. Run: npx massu install-hooks"
       };
     }
-    return { name: "Shell Hooks", status: "pass", detail: "Lifecycle hooks wired in settings.local.json" };
+    return { name: "Shell Hooks", status: "pass", detail: "Lifecycle hooks wired (settings.json / settings.local.json)" };
   } catch (err) {
     return {
       name: "Shell Hooks",
       status: "fail",
-      detail: `settings.local.json parse error: ${err instanceof Error ? err.message : String(err)}`
+      detail: `settings parse error: ${err instanceof Error ? err.message : String(err)}`
     };
   }
 }
@@ -17957,8 +18233,8 @@ async function checkLicenseStatus() {
 async function checkApiKeyHygiene(projectRoot) {
   if (getResolvedApiKeySource() !== "config") return null;
   try {
-    const { spawnSync: spawnSync5 } = await import("child_process");
-    const res = spawnSync5("git", ["ls-files", "--error-unmatch", "massu.config.yaml"], {
+    const { spawnSync: spawnSync6 } = await import("child_process");
+    const res = spawnSync6("git", ["ls-files", "--error-unmatch", "massu.config.yaml"], {
       cwd: projectRoot,
       timeout: 5e3,
       encoding: "utf-8"
@@ -17977,8 +18253,8 @@ async function checkApiKeyHygiene(projectRoot) {
 function checkPythonHealth(projectRoot) {
   const config = getConfig();
   if (!config.python?.root) return null;
-  const pythonRoot = resolve10(projectRoot, config.python.root);
-  if (!existsSync19(pythonRoot)) {
+  const pythonRoot = resolve12(projectRoot, config.python.root);
+  if (!existsSync22(pythonRoot)) {
     return {
       name: "Python",
       status: "fail",
@@ -17992,15 +18268,15 @@ function checkPythonHealth(projectRoot) {
   function scanDir(dir, depth) {
     if (depth > 5) return;
     try {
-      const entries = readdirSync12(dir, { withFileTypes: true });
+      const entries = readdirSync13(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           const excludeDirs = config.python?.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
           if (!excludeDirs.includes(entry.name)) {
-            const subdir = resolve10(dir, entry.name);
-            if (depth <= 2 && !existsSync19(resolve10(subdir, "__init__.py"))) {
+            const subdir = resolve12(dir, entry.name);
+            if (depth <= 2 && !existsSync22(resolve12(subdir, "__init__.py"))) {
               try {
-                const subEntries = readdirSync12(subdir);
+                const subEntries = readdirSync13(subdir);
                 if (subEntries.some((f2) => f2.endsWith(".py") && f2 !== "__init__.py")) {
                   initPyMissing.push(entry.name);
                 }
@@ -18058,11 +18334,12 @@ async function runDoctor() {
     checkMcpServer(projectRoot),
     checkHooksConfig(projectRoot),
     checkHookFiles(projectRoot),
+    await checkHookExecution(projectRoot),
     checkKnowledgeDb(projectRoot),
     checkMemoryDir(projectRoot),
     checkShellHooksWired(projectRoot),
     await checkNativeModules(),
-    checkNodeVersion(),
+    checkNodeVersion2(),
     await checkGitRepo(projectRoot),
     await checkLicenseStatus()
   ];
@@ -18095,8 +18372,8 @@ async function runDoctor() {
 }
 async function runValidateConfig() {
   const projectRoot = process.cwd();
-  const configPath = resolve10(projectRoot, "massu.config.yaml");
-  if (!existsSync19(configPath)) {
+  const configPath = resolve12(projectRoot, "massu.config.yaml");
+  if (!existsSync22(configPath)) {
     console.error("Error: massu.config.yaml not found in current directory");
     console.error("Run: npx massu init");
     process.exit(1);
@@ -18135,7 +18412,7 @@ async function runValidateConfig() {
     process.exit(1);
   }
 }
-var __filename3, __dirname3, EXPECTED_HOOKS;
+var __filename4, __dirname4, EXPECTED_HOOKS;
 var init_doctor = __esm({
   "src/commands/doctor.ts"() {
     "use strict";
@@ -18145,8 +18422,10 @@ var init_doctor = __esm({
     init_settings_local();
     init_hook_registry();
     init_db_driver();
-    __filename3 = fileURLToPath4(import.meta.url);
-    __dirname3 = dirname13(__filename3);
+    init_preflight();
+    init_hook_runner();
+    __filename4 = fileURLToPath5(import.meta.url);
+    __dirname4 = dirname14(__filename4);
     EXPECTED_HOOKS = getExpectedHookFiles();
   }
 });
@@ -18435,102 +18714,13 @@ var init_install_hooks = __esm({
   }
 });
 
-// src/commands/hook-runner.ts
-var hook_runner_exports = {};
-__export(hook_runner_exports, {
-  HOOK_NAME_TO_FILE: () => HOOK_NAME_TO_FILE,
-  resolveHookFile: () => resolveHookFile,
-  runHookRunner: () => runHookRunner
-});
-import { existsSync as existsSync20 } from "fs";
-import { resolve as resolve11, dirname as dirname14 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
-import { spawn } from "child_process";
-function resolveHookFile(hookName) {
-  const file = HOOK_NAME_TO_FILE[hookName];
-  if (!file) {
-    throw new Error(
-      `Unknown hook: "${hookName}". Recognized: ${Object.keys(HOOK_NAME_TO_FILE).join(", ")}`
-    );
-  }
-  const candidates = [
-    // Bundled compiled layout: dist/cli.js → ./hooks/<file>.js
-    resolve11(__dirname4, "hooks", file),
-    // TS-source dev / sibling layout: src/commands/ → ../hooks/<file>
-    resolve11(__dirname4, "../hooks", file),
-    // TS-source dev fallback: src/commands/ → ../../dist/hooks/<file>
-    resolve11(__dirname4, "../../dist/hooks", file)
-  ];
-  for (const candidate of candidates) {
-    if (existsSync20(candidate)) {
-      return candidate;
-    }
-  }
-  throw new Error(
-    `Hook file not found for "${hookName}". Searched: ${candidates.join(", ")}. This indicates a broken @massu/core install. Re-run \`npx -y @massu/core init\`.`
-  );
-}
-async function runHookRunner(args2) {
-  const hookName = args2[0];
-  if (!hookName) {
-    process.stderr.write(
-      `massu hook-runner: missing hook name.
-Usage: massu hook-runner <hook-name>
-Recognized: ${Object.keys(HOOK_NAME_TO_FILE).join(", ")}
-`
-    );
-    return { exitCode: 2 };
-  }
-  let hookFile;
-  try {
-    hookFile = resolveHookFile(hookName);
-  } catch (err) {
-    process.stderr.write(`massu hook-runner: ${err instanceof Error ? err.message : String(err)}
-`);
-    return { exitCode: 2 };
-  }
-  return new Promise((resolvePromise) => {
-    const child = spawn(process.execPath, [hookFile], {
-      stdio: ["inherit", "inherit", "inherit"],
-      // MASSU_HOOK_RUNTIME marks the hook process so the SSOT SQLite loader NEVER
-      // self-heals here (5s budget / CR-12, CR-65 P0-003) — even for indirect opens
-      // via getMemoryDb(). The next server/CLI touch performs the rebuild.
-      env: { ...process.env, MASSU_HOOK_RUNTIME: "1" }
-    });
-    child.on("exit", (code, signal) => {
-      if (signal) {
-        resolvePromise({ exitCode: 128 });
-        return;
-      }
-      resolvePromise({ exitCode: code ?? 0 });
-    });
-    child.on("error", (err) => {
-      process.stderr.write(`massu hook-runner: failed to spawn hook "${hookName}": ${err.message}
-`);
-      resolvePromise({ exitCode: 2 });
-    });
-  });
-}
-var __filename4, __dirname4, HOOK_NAME_TO_FILE;
-var init_hook_runner = __esm({
-  "src/commands/hook-runner.ts"() {
-    "use strict";
-    init_hook_registry();
-    __filename4 = fileURLToPath5(import.meta.url);
-    __dirname4 = dirname14(__filename4);
-    HOOK_NAME_TO_FILE = Object.freeze(
-      Object.fromEntries(REGISTERED_HOOKS.map((name) => [name, `${name}.js`]))
-    );
-  }
-});
-
 // src/commands/permissions.ts
 var permissions_exports = {};
 __export(permissions_exports, {
   handlePermissionsSubcommand: () => handlePermissionsSubcommand,
   printPermissionsHelp: () => printPermissionsHelp
 });
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
 function resolveClaudeDir2() {
   let claudeDirName = ".claude";
   try {
@@ -18538,7 +18728,7 @@ function resolveClaudeDir2() {
   } catch {
     claudeDirName = ".claude";
   }
-  return resolve12(process.cwd(), claudeDirName);
+  return resolve13(process.cwd(), claudeDirName);
 }
 async function handlePermissionsSubcommand(args2) {
   const sub = args2[0];
@@ -18656,7 +18846,7 @@ var db_exports = {};
 __export(db_exports, {
   handleDbSubcommand: () => handleDbSubcommand
 });
-import { existsSync as existsSync21, statSync as statSync10 } from "fs";
+import { existsSync as existsSync23, statSync as statSync11 } from "fs";
 import { basename as basename7 } from "path";
 function human(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -18701,7 +18891,7 @@ async function handleDbSubcommand(args2) {
 
 `);
     for (const store of allStores()) {
-      if (!existsSync21(store.path)) {
+      if (!existsSync23(store.path)) {
         process.stdout.write(`  ${"\u2014"} ${store.name.padEnd(10)} not present, skipped
 `);
         continue;
@@ -18799,12 +18989,12 @@ Restore with:  massu db restore --latest memory
       target = found.path;
     }
     try {
-      const before = existsSync21(target) ? statSync10(target).size : 0;
+      const before = existsSync23(target) ? statSync11(target).size : 0;
       const res = restoreDb(backupPath, target);
       process.stdout.write(
         `Restored ${basename7(target)}
   from : ${res.restoredFrom}
-  size : ${human(before)} -> ${human(statSync10(target).size)}
+  size : ${human(before)} -> ${human(statSync11(target).size)}
 ` + (res.preservedOriginal ? `  the previous file was NOT destroyed \u2014 kept at:
     ${res.preservedOriginal}
 ` : "") + `  integrity_check: ok (verified before AND after the restore)
@@ -18965,8 +19155,8 @@ var init_license2 = __esm({
 });
 
 // src/changelog-generator.ts
-import { existsSync as existsSync22, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "fs";
-import { resolve as resolve13 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync17, readdirSync as readdirSync14 } from "fs";
+import { resolve as resolve14 } from "path";
 function parseCommitsForPlanTokens(subjects) {
   const tokens = /* @__PURE__ */ new Set();
   const maintenance = [];
@@ -18983,15 +19173,15 @@ function parseCommitsForPlanTokens(subjects) {
 function loadPlanSummaries(tokens, planDir) {
   const result = /* @__PURE__ */ new Map();
   if (tokens.size === 0) return result;
-  if (!existsSync22(planDir)) {
+  if (!existsSync24(planDir)) {
     throw new Error(`Plan directory does not exist: ${planDir}`);
   }
-  const files = readdirSync13(planDir).filter((f2) => f2.endsWith(".md"));
+  const files = readdirSync14(planDir).filter((f2) => f2.endsWith(".md"));
   for (const token of tokens) {
     let matchedFile = null;
     let content = "";
     for (const file of files) {
-      const path = resolve13(planDir, file);
+      const path = resolve14(planDir, file);
       const text18 = readFileSync17(path, "utf-8");
       const tokenRe = new RegExp(
         `^\\*\\*Plan Token\\*\\*:\\s*\`?${token.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\`?(\\s|$)`,
@@ -19073,8 +19263,8 @@ __export(changelog_exports, {
   printChangelogHelp: () => printChangelogHelp
 });
 import { execSync } from "child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync18 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync18 } from "fs";
+import { resolve as resolve15 } from "path";
 function resolveRepoRoot() {
   try {
     return execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
@@ -19098,8 +19288,8 @@ function getCommitSubjects(range) {
   }
 }
 function getCurrentVersion(repoRoot) {
-  const pkgPath = resolve14(repoRoot, "packages/core/package.json");
-  if (!existsSync23(pkgPath)) return "0.0.0";
+  const pkgPath = resolve15(repoRoot, "packages/core/package.json");
+  if (!existsSync25(pkgPath)) return "0.0.0";
   const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
   return pkg.version || "0.0.0";
 }
@@ -19107,8 +19297,8 @@ function todayDate() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
 function getLatestChangelogEntryBody(repoRoot) {
-  const path = resolve14(repoRoot, "CHANGELOG.md");
-  if (!existsSync23(path)) return "";
+  const path = resolve15(repoRoot, "CHANGELOG.md");
+  if (!existsSync25(path)) return "";
   const content = readFileSync18(path, "utf-8");
   const m3 = content.match(/^## \[[\d.]+\][^\n]*\n([\s\S]*?)(?=\n## \[|$)/m);
   return m3 ? m3[1] : "";
@@ -19116,7 +19306,7 @@ function getLatestChangelogEntryBody(repoRoot) {
 async function handleChangelogSubcommand(args2) {
   const sub = args2[0];
   const repoRoot = resolveRepoRoot();
-  const planDir = resolve14(repoRoot, "docs/plans");
+  const planDir = resolve15(repoRoot, "docs/plans");
   switch (sub) {
     case "generate": {
       const lastTag = getLastTag();
@@ -19205,11 +19395,11 @@ var init_changelog = __esm({
 
 // src/knowledge-db.ts
 import { dirname as dirname15 } from "path";
-import { existsSync as existsSync24, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync11 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
   const dir = dirname15(dbPath);
-  if (!existsSync24(dir)) {
+  if (!existsSync26(dir)) {
     mkdirSync11(dir, { recursive: true });
   }
   const db = openDatabase2(dbPath);
@@ -19436,7 +19626,7 @@ var memory_embed_backfill_exports = {};
 __export(memory_embed_backfill_exports, {
   runMemoryEmbedBackfill: () => runMemoryEmbedBackfill
 });
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync27 } from "fs";
 async function runMemoryEmbedBackfill(_args = []) {
   await embed("massu memory embed backfill probe");
   const active = getActiveEmbedModel();
@@ -19463,7 +19653,7 @@ async function runMemoryEmbedBackfill(_args = []) {
   );
   let chunks = { embedded: 0, scanned: 0 };
   const knowledgeDbPath = getResolvedPaths().knowledgeDbPath;
-  if (existsSync25(knowledgeDbPath)) {
+  if (existsSync27(knowledgeDbPath)) {
     const knowledgeDb = getKnowledgeDb();
     try {
       chunks = await embedMissingChunks(knowledgeDb);
@@ -19496,16 +19686,16 @@ var init_memory_embed_backfill = __esm({
 
 // src/memory-authorship.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync6, existsSync as existsSync26, mkdirSync as mkdirSync12, chmodSync as chmodSync6, statSync as statSync11 } from "fs";
-import { homedir as homedir7 } from "os";
-import { resolve as resolve15 } from "path";
-function renderKeyPath(home = homedir7()) {
-  return resolve15(home, ".massu", "render-key");
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync6, existsSync as existsSync28, mkdirSync as mkdirSync12, chmodSync as chmodSync6, statSync as statSync12 } from "fs";
+import { homedir as homedir8 } from "os";
+import { resolve as resolve16 } from "path";
+function renderKeyPath(home = homedir8()) {
+  return resolve16(home, ".massu", "render-key");
 }
-function readRenderKey(home = homedir7()) {
+function readRenderKey(home = homedir8()) {
   const p19 = renderKeyPath(home);
   try {
-    if (!existsSync26(p19)) return void 0;
+    if (!existsSync28(p19)) return void 0;
     const raw = readFileSync19(p19);
     if (raw.length !== 32) return void 0;
     return raw;
@@ -19513,12 +19703,12 @@ function readRenderKey(home = homedir7()) {
     return void 0;
   }
 }
-function ensureRenderKey(home = homedir7()) {
+function ensureRenderKey(home = homedir8()) {
   const existing = readRenderKey(home);
   if (existing) return existing;
   const p19 = renderKeyPath(home);
   try {
-    const dir = resolve15(home, ".massu");
+    const dir = resolve16(home, ".massu");
     mkdirSync12(dir, { recursive: true, mode: 448 });
     try {
       chmodSync6(dir, 448);
@@ -19535,7 +19725,7 @@ function ensureRenderKey(home = homedir7()) {
     return void 0;
   }
 }
-function mintAuthorship(body, home = homedir7()) {
+function mintAuthorship(body, home = homedir8()) {
   try {
     const key = ensureRenderKey(home);
     if (!key) return null;
@@ -19544,7 +19734,7 @@ function mintAuthorship(body, home = homedir7()) {
     return null;
   }
 }
-function verifyAuthorship(body, frontmatter, storeRow, home = homedir7()) {
+function verifyAuthorship(body, frontmatter, storeRow, home = homedir8()) {
   try {
     if (storeRow?.adopted_human_at_epoch != null) return false;
     const key = readRenderKey(home);
@@ -19564,7 +19754,7 @@ function extractRenderMac(frontmatter) {
   const v3 = frontmatter?.[RENDER_MAC_KEY];
   return typeof v3 === "string" && v3.length > 0 ? v3 : null;
 }
-function renderKeyExists(home = homedir7()) {
+function renderKeyExists(home = homedir8()) {
   return readRenderKey(home) !== void 0;
 }
 var RENDER_MAC_KEY;
@@ -19576,11 +19766,11 @@ var init_memory_authorship = __esm({
 });
 
 // src/rule-candidate-snapshot.ts
-import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync20, writeFileSync as writeFileSync7, unlinkSync as unlinkSync4 } from "fs";
 function takeSnapshots(paths) {
   const out = /* @__PURE__ */ new Map();
   for (const p19 of paths) {
-    if (existsSync27(p19)) out.set(p19, readFileSync20(p19, "utf-8"));
+    if (existsSync29(p19)) out.set(p19, readFileSync20(p19, "utf-8"));
     else out.set(p19, null);
   }
   return out;
@@ -19590,7 +19780,7 @@ function restoreSnapshots(snapshot) {
   for (const [path, content] of snapshot) {
     try {
       if (content === null) {
-        if (existsSync27(path)) unlinkSync4(path);
+        if (existsSync29(path)) unlinkSync4(path);
       } else {
         writeFileSync7(path, content, "utf-8");
       }
@@ -19670,7 +19860,7 @@ var init_memory_render_path = __esm({
 });
 
 // src/memory-tombstones.ts
-import { readFileSync as readFileSync21, appendFileSync as appendFileSync3, existsSync as existsSync28 } from "fs";
+import { readFileSync as readFileSync21, appendFileSync as appendFileSync3, existsSync as existsSync30 } from "fs";
 import { join as join16 } from "path";
 function tombstoneLedgerPath(memoryDir) {
   return join16(memoryDir, TOMBSTONE_LEDGER);
@@ -19678,7 +19868,7 @@ function tombstoneLedgerPath(memoryDir) {
 function readTombstones(memoryDir) {
   const out = /* @__PURE__ */ new Map();
   const p19 = tombstoneLedgerPath(memoryDir);
-  if (!existsSync28(p19)) return out;
+  if (!existsSync30(p19)) return out;
   let raw;
   try {
     raw = readFileSync21(p19, "utf8");
@@ -19920,29 +20110,29 @@ var init_memory_llm = __esm({
 
 // src/memory-backup.ts
 import {
-  readdirSync as readdirSync14,
+  readdirSync as readdirSync15,
   mkdirSync as mkdirSync13,
   copyFileSync as copyFileSync2,
-  statSync as statSync12,
-  existsSync as existsSync29,
+  statSync as statSync13,
+  existsSync as existsSync31,
   rmSync as rmSync7,
   readFileSync as readFileSync22
 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join17, resolve as resolve16 } from "path";
-function backupsRoot(home = homedir8()) {
-  return resolve16(home, ".massu", "memory-backups");
+import { homedir as homedir9 } from "os";
+import { join as join17, resolve as resolve17 } from "path";
+function backupsRoot(home = homedir9()) {
+  return resolve17(home, ".massu", "memory-backups");
 }
 function backupStamp2(nowMs) {
   return new Date(nowMs).toISOString().replace(/:/g, "-");
 }
 function newestMtimeMs(dir) {
-  if (!existsSync29(dir)) return 0;
+  if (!existsSync31(dir)) return 0;
   let newest = 0;
-  for (const entry of readdirSync14(dir)) {
+  for (const entry of readdirSync15(dir)) {
     const p19 = join17(dir, entry);
     try {
-      const st = statSync12(p19);
+      const st = statSync13(p19);
       if (st.isFile() && st.mtimeMs > newest) newest = st.mtimeMs;
     } catch {
       continue;
@@ -19950,14 +20140,14 @@ function newestMtimeMs(dir) {
   }
   return newest;
 }
-function listBackups(home = homedir8()) {
+function listBackups(home = homedir9()) {
   const root = backupsRoot(home);
-  if (!existsSync29(root)) return [];
+  if (!existsSync31(root)) return [];
   const out = [];
-  for (const stamp of readdirSync14(root)) {
+  for (const stamp of readdirSync15(root)) {
     const dir = join17(root, stamp);
     try {
-      const st = statSync12(dir);
+      const st = statSync13(dir);
       if (!st.isDirectory()) continue;
       out.push({ stamp, dir, createdMs: st.mtimeMs });
     } catch {
@@ -19966,24 +20156,24 @@ function listBackups(home = homedir8()) {
   }
   return out.sort((a2, b2) => b2.createdMs - a2.createdMs);
 }
-function hasFreshBackup(memoryDir, home = homedir8()) {
+function hasFreshBackup(memoryDir, home = homedir9()) {
   const backups = listBackups(home);
   if (backups.length === 0) return false;
   const newestChange = newestMtimeMs(memoryDir);
   return backups[0].createdMs >= newestChange;
 }
-function takeBackup(memoryDir, nowMs, home = homedir8(), retention = DEFAULT_RETENTION2) {
-  if (!existsSync29(memoryDir)) {
+function takeBackup(memoryDir, nowMs, home = homedir9(), retention = DEFAULT_RETENTION2) {
+  if (!existsSync31(memoryDir)) {
     throw new BackupError(`memory directory does not exist: ${memoryDir}`);
   }
   const stamp = backupStamp2(nowMs);
   const dir = join17(backupsRoot(home), stamp);
   try {
     mkdirSync13(dir, { recursive: true, mode: 448 });
-    for (const entry of readdirSync14(memoryDir)) {
+    for (const entry of readdirSync15(memoryDir)) {
       const srcPath = join17(memoryDir, entry);
       try {
-        if (!statSync12(srcPath).isFile()) continue;
+        if (!statSync13(srcPath).isFile()) continue;
       } catch {
         continue;
       }
@@ -19995,7 +20185,7 @@ function takeBackup(memoryDir, nowMs, home = homedir8(), retention = DEFAULT_RET
   pruneBackups(home, retention);
   return { stamp, dir, createdMs: nowMs };
 }
-function pruneBackups(home = homedir8(), retention = DEFAULT_RETENTION2) {
+function pruneBackups(home = homedir9(), retention = DEFAULT_RETENTION2) {
   const backups = listBackups(home);
   for (const stale of backups.slice(Math.max(retention, 1))) {
     try {
@@ -20005,22 +20195,22 @@ function pruneBackups(home = homedir8(), retention = DEFAULT_RETENTION2) {
   }
 }
 function restoreBackup(memoryDir, opts = {}) {
-  const home = opts.home ?? homedir8();
+  const home = opts.home ?? homedir9();
   const backups = listBackups(home);
   if (backups.length === 0) throw new BackupError("no backups exist");
   const chosen = opts.from ? backups.find((b2) => b2.stamp === opts.from) : backups[0];
   if (!chosen) throw new BackupError(`no backup with stamp: ${opts.from}`);
   const wouldRestore = [];
-  for (const entry of readdirSync14(chosen.dir)) {
+  for (const entry of readdirSync15(chosen.dir)) {
     try {
-      if (statSync12(join17(chosen.dir, entry)).isFile()) wouldRestore.push(entry);
+      if (statSync13(join17(chosen.dir, entry)).isFile()) wouldRestore.push(entry);
     } catch {
       continue;
     }
   }
-  const currentFiles = existsSync29(memoryDir) ? readdirSync14(memoryDir).filter((e2) => {
+  const currentFiles = existsSync31(memoryDir) ? readdirSync15(memoryDir).filter((e2) => {
     try {
-      return statSync12(join17(memoryDir, e2)).isFile();
+      return statSync13(join17(memoryDir, e2)).isFile();
     } catch {
       return false;
     }
@@ -20064,7 +20254,7 @@ var init_memory_backup = __esm({
 });
 
 // src/memory-index-region.ts
-import { readFileSync as readFileSync23, existsSync as existsSync30 } from "fs";
+import { readFileSync as readFileSync23, existsSync as existsSync32 } from "fs";
 import { dirname as dirname16, join as join18 } from "path";
 function parseRegion(content) {
   const begins = countOccurrences(content, BEGIN_SENTINEL);
@@ -20169,7 +20359,7 @@ function withMemoryIndexLock(memoryDir, fn) {
   });
 }
 function readMemoryIndex(indexPath) {
-  if (!existsSync30(indexPath)) return void 0;
+  if (!existsSync32(indexPath)) return void 0;
   try {
     return readFileSync23(indexPath, "utf8");
   } catch {
@@ -20242,9 +20432,9 @@ var init_memory_files_config = __esm({
 });
 
 // src/memory-renderer.ts
-import { existsSync as existsSync31, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync24 } from "fs";
 import { join as join19 } from "path";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 import { createHash as createHash8 } from "crypto";
 function renderMemoryFiles(db, candidates, opts) {
   const config = opts.config ?? resolveMemoryFilesConfig();
@@ -20253,11 +20443,11 @@ function renderMemoryFiles(db, candidates, opts) {
   }
   const dryRun = opts.dryRun === true;
   const now = opts.now ?? Date.now();
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir10();
   const audit = opts.audit ?? (() => {
   });
   const { memoryDir } = opts;
-  if (!existsSync31(memoryDir)) {
+  if (!existsSync33(memoryDir)) {
     return EMPTY("no_memory_dir");
   }
   try {
@@ -20325,7 +20515,7 @@ function renderLocked(db, candidates, o) {
       refusals.push({ name: c2.name, reason: "tombstoned" });
       continue;
     }
-    if (existsSync31(absPath)) {
+    if (existsSync33(absPath)) {
       const existing = readFileSync24(absPath, "utf8");
       const fm = readMemoryFileFrontmatter(existing);
       const storeRow = db.prepare(
@@ -20548,22 +20738,22 @@ var init_memory_renderer = __esm({
 });
 
 // src/commands/memory-render-cli.ts
-import { readdirSync as readdirSync15, readFileSync as readFileSync25, existsSync as existsSync32, rmSync as rmSync8, statSync as statSync13 } from "fs";
+import { readdirSync as readdirSync16, readFileSync as readFileSync25, existsSync as existsSync34, rmSync as rmSync8, statSync as statSync14 } from "fs";
 import { join as join20 } from "path";
-import { homedir as homedir10 } from "os";
+import { homedir as homedir11 } from "os";
 function memoryFiles(memoryDir) {
-  if (!existsSync32(memoryDir)) return [];
-  return readdirSync15(memoryDir).filter((f2) => {
+  if (!existsSync34(memoryDir)) return [];
+  return readdirSync16(memoryDir).filter((f2) => {
     if (!f2.endsWith(".md")) return false;
     if (f2 === "MEMORY.md") return false;
     try {
-      return statSync13(join20(memoryDir, f2)).isFile();
+      return statSync14(join20(memoryDir, f2)).isFile();
     } catch {
       return false;
     }
   });
 }
-function massuAuthoredFiles(db, memoryDir, home = homedir10()) {
+function massuAuthoredFiles(db, memoryDir, home = homedir11()) {
   const out = [];
   for (const f2 of memoryFiles(memoryDir)) {
     let content;
@@ -20583,7 +20773,7 @@ function massuAuthoredFiles(db, memoryDir, home = homedir10()) {
   return out;
 }
 function memoryAdopt(db, memoryDir, opts = {}) {
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir11();
   const now = opts.now ?? Math.floor(Date.now() / 1e3);
   const lines = [];
   if (!renderKeyExists(home)) {
@@ -20649,7 +20839,7 @@ function memoryAdopt(db, memoryDir, opts = {}) {
   return { exitCode: 0, output: lines.join("\n") };
 }
 function memoryUnrender(db, memoryDir, opts = {}) {
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir11();
   const now = opts.now ?? Math.floor(Date.now() / 1e3);
   const lines = [];
   const ours = massuAuthoredFiles(db, memoryDir, home);
@@ -20697,7 +20887,7 @@ function memoryUnrender(db, memoryDir, opts = {}) {
   return { exitCode: 0, output: lines.join("\n") };
 }
 function memoryRestore(memoryDir, opts = {}) {
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir11();
   const backups = listBackups(home);
   if (backups.length === 0) {
     return { exitCode: 1, output: "No backups exist yet. Nothing to restore." };
@@ -20766,16 +20956,16 @@ var init_memory_render_candidates = __esm({
 });
 
 // src/capability-advisor.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync14, readFileSync as readFileSync26, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir11 } from "os";
+import { existsSync as existsSync35, mkdirSync as mkdirSync14, readFileSync as readFileSync26, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir12 } from "os";
 import { dirname as dirname17, join as join21 } from "path";
-function advisorStatePath(home = homedir11()) {
+function advisorStatePath(home = homedir12()) {
   return join21(home, ".massu", "advisor-state.json");
 }
 function readAdvisorState(home) {
   try {
     const p19 = advisorStatePath(home);
-    if (!existsSync33(p19)) return {};
+    if (!existsSync35(p19)) return {};
     return JSON.parse(readFileSync26(p19, "utf-8"));
   } catch {
     return {};
@@ -21011,22 +21201,22 @@ var init_memory_repo_identity = __esm({
 // src/memory-repos-registry.ts
 import {
   chmodSync as chmodSync7,
-  existsSync as existsSync34,
+  existsSync as existsSync36,
   mkdirSync as mkdirSync15,
   readFileSync as readFileSync27,
   writeFileSync as writeFileSync9
 } from "fs";
-import { homedir as homedir12 } from "os";
+import { homedir as homedir13 } from "os";
 import { dirname as dirname18, join as join22 } from "path";
-function reposRegistryPath(home = homedir12()) {
+function reposRegistryPath(home = homedir13()) {
   return join22(home, ".massu", "repos.json");
 }
 function emptyRegistry() {
   return { version: REPOS_REGISTRY_VERSION, repos: [] };
 }
-function readReposRegistry(home = homedir12()) {
+function readReposRegistry(home = homedir13()) {
   const p19 = reposRegistryPath(home);
-  if (!existsSync34(p19)) return emptyRegistry();
+  if (!existsSync36(p19)) return emptyRegistry();
   try {
     const parsed = JSON.parse(readFileSync27(p19, "utf-8"));
     if (!parsed || typeof parsed !== "object") return emptyRegistry();
@@ -21076,12 +21266,12 @@ var init_shared_memory_envelope = __esm({
 // src/security/local-share-signer.ts
 import {
   chmodSync as chmodSync8,
-  existsSync as existsSync35,
+  existsSync as existsSync37,
   mkdirSync as mkdirSync16,
   readFileSync as readFileSync28,
   writeFileSync as writeFileSync10
 } from "fs";
-import { homedir as homedir13 } from "os";
+import { homedir as homedir14 } from "os";
 import { join as join23 } from "path";
 import {
   createHash as createHash10,
@@ -21090,18 +21280,18 @@ import {
   generateKeyPairSync,
   sign as cryptoSign
 } from "crypto";
-function localShareKeyDir(home = homedir13()) {
+function localShareKeyDir(home = homedir14()) {
   return join23(home, ".massu", "keys");
 }
-function localSharePubKeyPath(home = homedir13()) {
+function localSharePubKeyPath(home = homedir14()) {
   return join23(localShareKeyDir(home), "local-share.pub");
 }
-function readLocalSharePublicKeyRaw(home = homedir13()) {
+function readLocalSharePublicKeyRaw(home = homedir14()) {
   const pubPem = readFileSync28(localSharePubKeyPath(home), "utf-8");
   const der = createPublicKey2(pubPem).export({ format: "der", type: "spki" });
   return Uint8Array.from(der.subarray(SPKI_ED25519_PREFIX_LEN));
 }
-function localSharePubkeyFingerprint(home = homedir13()) {
+function localSharePubkeyFingerprint(home = homedir14()) {
   return createHash10("sha256").update(Buffer.from(readLocalSharePublicKeyRaw(home))).digest("hex");
 }
 var SPKI_ED25519_PREFIX_LEN;
@@ -21114,8 +21304,8 @@ var init_local_share_signer = __esm({
 });
 
 // src/security/local-share-verifier.ts
-import { homedir as homedir14 } from "os";
-function verifyLocalShareEnvelope(envelope, pinnedFingerprint, home = homedir14()) {
+import { homedir as homedir15 } from "os";
+function verifyLocalShareEnvelope(envelope, pinnedFingerprint, home = homedir15()) {
   let key;
   try {
     const pubkeyBytes = readLocalSharePublicKeyRaw(home);
@@ -21189,9 +21379,9 @@ var init_shared_memory_audit = __esm({
 });
 
 // src/shared-memory-sync.ts
-import { homedir as homedir15 } from "os";
+import { homedir as homedir16 } from "os";
 function acceptSharedMemory(db, recordHash, opts = {}) {
-  const home = opts.home ?? homedir15();
+  const home = opts.home ?? homedir16();
   const nowEpoch = opts.nowEpoch ?? Math.floor(Date.now() / 1e3);
   const row = loadPending(db, recordHash);
   if (!row) return refuse(db, recordHash, "not_found");
@@ -21296,7 +21486,7 @@ function refuseSharedMemory(db, recordHash, opts = {}) {
   return { ok: true };
 }
 function listPendingSharedMemories(db, opts = {}) {
-  const home = opts.home ?? homedir15();
+  const home = opts.home ?? homedir16();
   const rows = db.prepare(
     `SELECT record_hash, origin_repo_id, origin_repo_label, envelope_raw, record_json, received_at_epoch
          FROM shared_memory_pending
@@ -21401,9 +21591,9 @@ var memory_share_cli_exports = {};
 __export(memory_share_cli_exports, {
   runMemoryShareCli: () => runMemoryShareCli
 });
-import { homedir as homedir16 } from "os";
+import { homedir as homedir17 } from "os";
 async function runMemoryShareCli(sub, args2, opts = {}) {
-  const home = opts.home ?? homedir16();
+  const home = opts.home ?? homedir17();
   const ownDb = !opts.db;
   const db = opts.db ?? getMemoryDb();
   try {
@@ -21996,14 +22186,14 @@ var init_rule_candidate_hardened = __esm({
 
 // src/security/promotion-apply-mac.ts
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { homedir as homedir17 } from "os";
+import { homedir as homedir18 } from "os";
 function canonical(f2) {
   return [DOMAIN, f2.origin, f2.org_id, f2.prompt_hash, f2.destination, f2.draft_text].join("\n");
 }
 function deriveApplyKey(renderKey) {
   return createHmac2("sha256", renderKey).update(DOMAIN, "utf8").digest();
 }
-function computePromotionApplyMac(fields, home = homedir17()) {
+function computePromotionApplyMac(fields, home = homedir18()) {
   try {
     const key = ensureRenderKey(home);
     if (!key) return null;
@@ -22012,7 +22202,7 @@ function computePromotionApplyMac(fields, home = homedir17()) {
     return null;
   }
 }
-function verifyPromotionApplyMac(claimed, fields, home = homedir17()) {
+function verifyPromotionApplyMac(claimed, fields, home = homedir18()) {
   try {
     if (typeof claimed !== "string" || claimed.length === 0) return false;
     const key = readRenderKey(home);
@@ -22036,9 +22226,9 @@ var init_promotion_apply_mac = __esm({
 });
 
 // src/rule-candidate-applier.ts
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync11, existsSync as existsSync36, unlinkSync as unlinkSync5, mkdirSync as mkdirSync17 } from "fs";
-import { join as join24, dirname as dirname19, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir18 } from "os";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync11, existsSync as existsSync38, unlinkSync as unlinkSync5, mkdirSync as mkdirSync17 } from "fs";
+import { join as join24, dirname as dirname19, isAbsolute as isAbsolute3 } from "path";
+import { homedir as homedir19 } from "os";
 import { createHash as createHash11 } from "crypto";
 function isRuleDestination(value) {
   return typeof value === "string" && ALL_RULE_DESTINATIONS.includes(value);
@@ -22046,10 +22236,10 @@ function isRuleDestination(value) {
 function isTeamShareableDestination(destination) {
   return TEAM_SHAREABLE_DESTINATIONS.includes(destination);
 }
-function resolveMemoryDir(projectRoot = getProjectRoot(), home = homedir18()) {
+function resolveMemoryDir(projectRoot = getProjectRoot(), home = homedir19()) {
   return join24(home, ".claude", "projects", encodeMemoryDirName(projectRoot), "memory");
 }
-function resolveMemoryIndexPath(projectRoot = getProjectRoot(), home = homedir18()) {
+function resolveMemoryIndexPath(projectRoot = getProjectRoot(), home = homedir19()) {
   return join24(resolveMemoryDir(projectRoot, home), "MEMORY.md");
 }
 function deriveSlug2(prompt) {
@@ -22079,7 +22269,7 @@ function readCandidate(candidateId, projectRoot = getProjectRoot()) {
     throw new InvalidCandidateIdError(candidateId);
   }
   const path = join24(projectRoot, ".massu", "rule-candidates", `${candidateId}.json`);
-  if (!existsSync36(path)) throw new CandidateNotFoundError(path);
+  if (!existsSync38(path)) throw new CandidateNotFoundError(path);
   const raw = readFileSync29(path, "utf-8");
   let parsed;
   try {
@@ -22172,7 +22362,7 @@ async function applyRuleCandidate(db, opts) {
     throw new InvalidCandidateIdError(opts.candidateId);
   }
   const projectRoot = opts.projectRoot ?? getProjectRoot();
-  const home = opts.home ?? homedir18();
+  const home = opts.home ?? homedir19();
   const candidate = readCandidate(opts.candidateId, projectRoot);
   if (candidate.provenance !== void 0) {
     const provOrigin = candidate.provenance.origin;
@@ -22223,7 +22413,7 @@ async function applyRuleCandidate(db, opts) {
     throw new InvalidSlugError(slug);
   }
   const memoryIndex = resolveMemoryIndexPath(projectRoot, home);
-  if (!existsSync36(memoryIndex)) {
+  if (!existsSync38(memoryIndex)) {
     throw new MemoryIndexMissingError(memoryIndex);
   }
   let destTargets;
@@ -22279,7 +22469,7 @@ async function applyRuleCandidate(db, opts) {
         throw err;
       }
     }
-    if (existsSync36(candidatePath)) unlinkSync5(candidatePath);
+    if (existsSync38(candidatePath)) unlinkSync5(candidatePath);
     let teamShared = false;
     const localOrigin = candidate.provenance === void 0;
     const entitledTeam = entitledForTeamSharedPromotion(ent.currentTier);
@@ -22340,7 +22530,7 @@ function computeDestinationTargets(opts, candidate, slug, projectRoot, home) {
       throw new DestinationConfigError("custom-destination requires customDestination config entry");
     }
     const raw = opts.customDestination.path;
-    const absolute = isAbsolute2(raw) ? raw : join24(projectRoot, raw);
+    const absolute = isAbsolute3(raw) ? raw : join24(projectRoot, raw);
     try {
       assertContainedIn(projectRoot, absolute, { allowNested: true });
     } catch (err) {
@@ -22380,8 +22570,8 @@ function writeCorrectionsMd(opts, candidate, slug, targets, auditRowId) {
       audit_log_id: auditRowId
     }
   });
-  if (!existsSync36(dirname19(correctionsMd))) mkdirSync17(dirname19(correctionsMd), { recursive: true });
-  const correctionsPre = existsSync36(correctionsMd) ? readFileSync29(correctionsMd, "utf-8") : "# Corrections\n";
+  if (!existsSync38(dirname19(correctionsMd))) mkdirSync17(dirname19(correctionsMd), { recursive: true });
+  const correctionsPre = existsSync38(correctionsMd) ? readFileSync29(correctionsMd, "utf-8") : "# Corrections\n";
   writeFileSync11(correctionsMd, correctionsPre + correctionsEntry, "utf-8");
   const body = `${opts.draftText}
 `;
@@ -22407,7 +22597,7 @@ function writeCorrectionsMd(opts, candidate, slug, targets, auditRowId) {
 function writePatternScanner(opts, candidate, slug, targets) {
   const [scannerPath, driftGuardPath] = targets.paths;
   const checkNumber = opts.patternScannerCheckNumber;
-  const scannerPre = existsSync36(scannerPath) ? readFileSync29(scannerPath, "utf-8") : "";
+  const scannerPre = existsSync38(scannerPath) ? readFileSync29(scannerPath, "utf-8") : "";
   if (scannerPre.includes(`${SCANNER_AUTOGEN_MARKER_PREFIX} ${candidate.prompt_hash}`)) {
     throw new DestinationConfigError(
       `scanner already contains a check auto-generated for prompt_hash ${candidate.prompt_hash}`
@@ -22443,13 +22633,13 @@ function writePatternScanner(opts, candidate, slug, targets) {
     `});`,
     ""
   ].join("\n");
-  if (!existsSync36(dirname19(driftGuardPath))) mkdirSync17(dirname19(driftGuardPath), { recursive: true });
+  if (!existsSync38(dirname19(driftGuardPath))) mkdirSync17(dirname19(driftGuardPath), { recursive: true });
   writeFileSync11(driftGuardPath, driftGuard, "utf-8");
 }
 function writeClaudeMdCr(opts, candidate, slug, targets) {
   const [claudePath] = targets.paths;
   const crNumber = opts.claudeMdCrNumber;
-  const pre = existsSync36(claudePath) ? readFileSync29(claudePath, "utf-8") : "";
+  const pre = existsSync38(claudePath) ? readFileSync29(claudePath, "utf-8") : "";
   if (new RegExp(`\\bCR-${crNumber}\\b`).test(pre)) {
     throw new DestinationConfigError(`CLAUDE.md already contains a CR-${crNumber} entry`);
   }
@@ -22491,8 +22681,8 @@ function writeCustomDestination(opts, candidate, slug, targets) {
     destination_name: entry.name
   };
   const rendered = renderTemplate2(entry.template, vars);
-  if (!existsSync36(dirname19(destPath))) mkdirSync17(dirname19(destPath), { recursive: true });
-  const pre = existsSync36(destPath) ? readFileSync29(destPath, "utf-8") : "";
+  if (!existsSync38(dirname19(destPath))) mkdirSync17(dirname19(destPath), { recursive: true });
+  const pre = existsSync38(destPath) ? readFileSync29(destPath, "utf-8") : "";
   const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
   writeFileSync11(destPath, pre + sep3 + rendered + (rendered.endsWith("\n") ? "" : "\n"), "utf-8");
 }
@@ -22545,8 +22735,8 @@ function dismissRuleCandidate(db, opts) {
   }
   try {
     const dismissedLog = join24(projectRoot, ".massu", "rule-candidates", ".dismissed.jsonl");
-    if (!existsSync36(dirname19(dismissedLog))) mkdirSync17(dirname19(dismissedLog), { recursive: true });
-    const pre = existsSync36(dismissedLog) ? readFileSync29(dismissedLog, "utf-8") : "";
+    if (!existsSync38(dirname19(dismissedLog))) mkdirSync17(dirname19(dismissedLog), { recursive: true });
+    const pre = existsSync38(dismissedLog) ? readFileSync29(dismissedLog, "utf-8") : "";
     const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
     writeFileSync11(dismissedLog, pre + sep3 + JSON.stringify({
       id: opts.candidateId,
@@ -22557,7 +22747,7 @@ function dismissRuleCandidate(db, opts) {
       audit_log_id: auditRowId,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }) + "\n", "utf-8");
-    if (existsSync36(candidatePath)) unlinkSync5(candidatePath);
+    if (existsSync38(candidatePath)) unlinkSync5(candidatePath);
   } catch (err) {
     appendFailureLog(projectRoot, {
       candidate_id: opts.candidateId,
@@ -22576,9 +22766,9 @@ function dismissRuleCandidate(db, opts) {
 function appendFailureLog(projectRoot, entry) {
   try {
     const dir = join24(projectRoot, ".massu", "rule-candidates");
-    if (!existsSync36(dir)) mkdirSync17(dir, { recursive: true });
+    if (!existsSync38(dir)) mkdirSync17(dir, { recursive: true });
     const logPath = join24(dir, ".failures.jsonl");
-    const pre = existsSync36(logPath) ? readFileSync29(logPath, "utf-8") : "";
+    const pre = existsSync38(logPath) ? readFileSync29(logPath, "utf-8") : "";
     const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
     writeFileSync11(logPath, pre + sep3 + JSON.stringify(entry) + "\n", "utf-8");
   } catch {
@@ -22663,7 +22853,7 @@ var init_rule_candidate_applier = __esm({
 });
 
 // src/rule-candidate-preview.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync12, existsSync as existsSync37 } from "node:fs";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync12, existsSync as existsSync39 } from "node:fs";
 function renderHardenedPreview(destination, body) {
   const rendered = String(body ?? "");
   const riskFindings = RISK_PATTERNS.filter((p19) => p19.re.test(rendered)).map((p19) => p19.label);
@@ -22691,7 +22881,7 @@ function validateReviewAttestation(att) {
   };
 }
 function recordHardenedReviewAttestation(sidecarPath2, attestation) {
-  if (!existsSync37(sidecarPath2)) {
+  if (!existsSync39(sidecarPath2)) {
     throw new Error(`candidate sidecar not found: ${sidecarPath2}`);
   }
   const validated = validateReviewAttestation(attestation);
@@ -22803,7 +22993,7 @@ var init_rule_candidate_renderer = __esm({
 });
 
 // src/rule-promotion-effectiveness.ts
-import { readFileSync as readFileSync31, existsSync as existsSync38 } from "fs";
+import { readFileSync as readFileSync31, existsSync as existsSync40 } from "fs";
 function evaluateCr53Effectiveness(inputs) {
   const { db, failureLogPath, knownLimitations } = inputs;
   const allowlist = new Set(knownLimitations.map((k3) => k3.promptHash));
@@ -22834,7 +23024,7 @@ function evaluateCr53Effectiveness(inputs) {
     });
   }
   const failureLogViolations = [];
-  if (existsSync38(failureLogPath)) {
+  if (existsSync40(failureLogPath)) {
     try {
       const raw = readFileSync31(failureLogPath, "utf-8");
       const cutoff = Date.now() - SEVEN_DAYS_MS;
@@ -23013,8 +23203,8 @@ var init_rule_pack_schema = __esm({
 });
 
 // src/rule-pack-sync.ts
-import { existsSync as existsSync39, writeFileSync as writeFileSync13, mkdirSync as mkdirSync18 } from "fs";
-import { homedir as homedir19 } from "os";
+import { existsSync as existsSync41, writeFileSync as writeFileSync13, mkdirSync as mkdirSync18 } from "fs";
+import { homedir as homedir20 } from "os";
 import { join as join25, dirname as dirname20 } from "path";
 async function pullInstalledPackRules(db, opts = {}) {
   const config = getConfig();
@@ -23078,11 +23268,11 @@ async function pullInstalledPackRules(db, opts = {}) {
       result.pulled += 1;
       const promptHash = packRulePromptHash(pack.slug, rule);
       const candidatePath = sidecarPath(projectRoot, promptHash);
-      if (existsSync39(candidatePath) || alreadyApplied(db, promptHash)) {
+      if (existsSync41(candidatePath) || alreadyApplied(db, promptHash)) {
         result.skipped += 1;
         continue;
       }
-      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso, opts.home ?? homedir19());
+      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso, opts.home ?? homedir20());
       result.materialized += 1;
     }
   }
@@ -23171,7 +23361,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     draft_text: draftText
   };
   const dir = dirname20(candidatePath);
-  if (!existsSync39(dir)) mkdirSync18(dir, { recursive: true });
+  if (!existsSync41(dir)) mkdirSync18(dir, { recursive: true });
   writeFileSync13(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
 }
 function emitDropTelemetry(db, eventType, data) {
@@ -24043,7 +24233,7 @@ var init_memory_supersede = __esm({
 
 // src/memory-consolidate.ts
 import { createHash as createHash12 } from "crypto";
-import { existsSync as existsSync40, mkdirSync as mkdirSync19, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync19, writeFileSync as writeFileSync14 } from "fs";
 import { join as join27 } from "path";
 function emptyResult() {
   return {
@@ -24220,7 +24410,7 @@ ${representative.detail}` : ""}`;
     const clusterKey = cluster.map((c2) => c2.title.toLowerCase().replace(/\s+/g, " ").trim()).sort().join("|");
     const promptHash = createHash12("sha256").update(clusterKey).digest("hex").slice(0, 16);
     const candidatePath = join27(candidateDir, `${promptHash}.json`);
-    if (existsSync40(candidatePath)) continue;
+    if (existsSync42(candidatePath)) continue;
     if (dryRun) {
       promoted++;
       continue;
@@ -24513,8 +24703,8 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync41, readFileSync as readFileSync32 } from "fs";
-import { resolve as resolve17 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync32 } from "fs";
+import { resolve as resolve18 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
 }
@@ -24542,8 +24732,8 @@ async function runShowTemplate(args2) {
     return;
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
-  const file = suffix === "" ? resolve17(sourceDir, `${baseName}.md`) : resolve17(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync41(file)) {
+  const file = suffix === "" ? resolve18(sourceDir, `${baseName}.md`) : resolve18(sourceDir, `${baseName}${suffix}.md`);
+  if (!existsSync43(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
@@ -24602,9 +24792,9 @@ var init_passthrough = __esm({
 });
 
 // src/lib/installLock.ts
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 function withInstallLock(projectRoot, fn, opts = {}) {
-  const lockPath = resolve18(projectRoot, ".massu", "installAll.lock");
+  const lockPath = resolve19(projectRoot, ".massu", "installAll.lock");
   return withFileLockSync(
     lockPath,
     fn,
@@ -24644,8 +24834,8 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync42, readFileSync as readFileSync33, rmSync as rmSync9 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync33, rmSync as rmSync9 } from "fs";
+import { resolve as resolve20 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
   const out = {};
@@ -24773,10 +24963,10 @@ function renderDiff(diff) {
 }
 async function runConfigRefresh(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve19(cwd, "massu.config.yaml");
+  const configPath = resolve20(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync42(configPath)) {
+  if (!existsSync44(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
@@ -24856,8 +25046,8 @@ async function runConfigRefresh(opts = {}) {
 `);
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
-        const placeholderPath = resolve19(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync42(placeholderPath)) {
+        const placeholderPath = resolve20(installResult.claudeDir, "commands", "_massu-needs-stack.md");
+        if (existsSync44(placeholderPath)) {
           try {
             rmSync9(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -24907,7 +25097,7 @@ var init_config_refresh = __esm({
 });
 
 // src/lib/pidLiveness.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 function isPidAlive(pid, opts = {}) {
   if (!Number.isFinite(pid) || pid <= 0) return false;
   const platform = opts.platformOverride ?? process.platform;
@@ -24932,7 +25122,7 @@ function checkPosix(pid, killOverride) {
 }
 function checkWindows(pid) {
   try {
-    const res = spawnSync2("tasklist", ["/FI", `PID eq ${pid}`, "/NH"], {
+    const res = spawnSync3("tasklist", ["/FI", `PID eq ${pid}`, "/NH"], {
       encoding: "utf-8",
       windowsHide: true
     });
@@ -24950,9 +25140,9 @@ var init_pidLiveness = __esm({
 });
 
 // src/lib/gitToplevel.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 function gitToplevel(cwd) {
-  const res = spawnSync3("git", ["rev-parse", "--show-toplevel"], {
+  const res = spawnSync4("git", ["rev-parse", "--show-toplevel"], {
     cwd,
     encoding: "utf-8"
   });
@@ -24966,14 +25156,14 @@ var init_gitToplevel = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync43, statSync as statSync14 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync45, statSync as statSync15 } from "fs";
+import { resolve as resolve21 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
-    const p19 = resolve20(projectRoot, lf);
-    if (!existsSync43(p19)) continue;
+    const p19 = resolve21(projectRoot, lf);
+    if (!existsSync45(p19)) continue;
     try {
-      const stat = statSync14(p19);
+      const stat = statSync15(p19);
       const delta = now - stat.mtimeMs;
       if (delta >= 0 && delta < windowMs) return true;
     } catch {
@@ -24984,7 +25174,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync43(resolve20(projectRoot, ".git", s))) return true;
+    if (existsSync45(resolve21(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -25183,17 +25373,17 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync5, existsSync as existsSync44, fsyncSync as fsyncSync5, mkdirSync as mkdirSync20, openSync as openSync5, readFileSync as readFileSync34, renameSync as renameSync5, rmSync as rmSync10, writeFileSync as writeFileSync15, writeSync as writeSync3 } from "fs";
-import { dirname as dirname21, resolve as resolve21 } from "path";
+import { closeSync as closeSync5, existsSync as existsSync46, fsyncSync as fsyncSync5, mkdirSync as mkdirSync20, openSync as openSync5, readFileSync as readFileSync34, renameSync as renameSync5, rmSync as rmSync10, writeFileSync as writeFileSync15, writeSync as writeSync3 } from "fs";
+import { dirname as dirname21, resolve as resolve22 } from "path";
 function watchStatePath(projectRoot) {
-  return resolve21(projectRoot, ".massu", "watch-state.json");
+  return resolve22(projectRoot, ".massu", "watch-state.json");
 }
 function backupStatePath(projectRoot) {
-  return resolve21(projectRoot, ".massu", "watch-state.v0.bak.json");
+  return resolve22(projectRoot, ".massu", "watch-state.v0.bak.json");
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync44(path)) return { ...DEFAULT_STATE };
+  if (!existsSync46(path)) return { ...DEFAULT_STATE };
   const content = readFileSync34(path, "utf-8");
   let raw;
   try {
@@ -25257,7 +25447,7 @@ function writeStateAtomic(projectRoot, state) {
     renameSync5(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync44(tmp)) {
+    if (!renamed && existsSync46(tmp)) {
       try {
         rmSync10(tmp, { force: true });
       } catch {
@@ -25538,9 +25728,9 @@ __export(watch_exports, {
   runOnQuiescent: () => runOnQuiescent,
   runWatch: () => runWatch
 });
-import { spawnSync as spawnSync4 } from "child_process";
-import { basename as basename8, dirname as dirname22, resolve as resolve22 } from "path";
-import { appendFileSync as appendFileSync4, existsSync as existsSync45, mkdirSync as mkdirSync21, readFileSync as readFileSync35 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { basename as basename8, dirname as dirname22, resolve as resolve23 } from "path";
+import { appendFileSync as appendFileSync4, existsSync as existsSync47, mkdirSync as mkdirSync21, readFileSync as readFileSync35 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -25565,9 +25755,9 @@ function parseFlags(args2) {
 }
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
-  const fixed = home ? resolve22(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync45(fixed)) return fixed;
-  const which = spawnSync4("which", ["claude-bg"], { encoding: "utf-8" });
+  const fixed = home ? resolve23(home, ".claude", "bin", "claude-bg") : null;
+  if (fixed && existsSync47(fixed)) return fixed;
+  const which = spawnSync5("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
     if (p19) return p19;
@@ -25609,7 +25799,7 @@ async function runWatch(args2) {
     return { exitCode: 1, message: msg };
   }
   const name = watchName(root);
-  const res = spawnSync4(claudeBg, [
+  const res = spawnSync5(claudeBg, [
     "start",
     "--name",
     name,
@@ -25627,7 +25817,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync45(path)) {
+  if (!existsSync47(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -25665,7 +25855,7 @@ function runStop(root) {
     process.stderr.write("massu watch --stop: claude-bg not found; cannot kill registered daemon\n");
     return { exitCode: 1 };
   }
-  const res = spawnSync4(claudeBg, ["kill", watchName(root)], { stdio: "inherit" });
+  const res = spawnSync5(claudeBg, ["kill", watchName(root)], { stdio: "inherit" });
   return { exitCode: (res.status ?? 1) === 0 ? 0 : 1 };
 }
 async function runApplyNow(root) {
@@ -25709,7 +25899,7 @@ async function runForeground(root) {
     }
     throw err;
   }
-  return new Promise((resolve45) => {
+  return new Promise((resolve46) => {
     const shutdown = async () => {
       if (stopped) return;
       stopped = true;
@@ -25719,7 +25909,7 @@ async function runForeground(root) {
         process.chdir(priorCwd);
       } catch {
       }
-      resolve45({ exitCode: 0 });
+      resolve46({ exitCode: 0 });
     };
     process.on("SIGINT", () => {
       void shutdown();
@@ -25780,7 +25970,7 @@ async function runOnQuiescent(projectRoot) {
   );
 }
 function refreshLogPath(projectRoot) {
-  return resolve22(projectRoot, ".massu", "refresh-log.jsonl");
+  return resolve23(projectRoot, ".massu", "refresh-log.jsonl");
 }
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
@@ -25792,7 +25982,7 @@ function appendRefreshLog(projectRoot, event) {
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync45(path)) return [];
+  if (!existsSync47(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
@@ -25869,13 +26059,13 @@ var init_refresh_log = __esm({
 import {
   chmodSync as chmodSync9,
   closeSync as closeSync6,
-  existsSync as existsSync46,
+  existsSync as existsSync48,
   fsyncSync as fsyncSync6,
   mkdirSync as mkdirSync22,
   openSync as openSync6,
   renameSync as renameSync6,
   rmSync as rmSync11,
-  statSync as statSync15,
+  statSync as statSync16,
   writeSync as writeSync4
 } from "node:fs";
 import { dirname as dirname23 } from "node:path";
@@ -25883,7 +26073,7 @@ function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
   const parentDir = dirname23(path);
   try {
-    if (!existsSync46(parentDir)) {
+    if (!existsSync48(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
@@ -25905,7 +26095,7 @@ function atomicWrite(path, content, opts = {}) {
     renameSync6(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync46(tmpPath)) {
+    if (existsSync48(tmpPath)) {
       try {
         rmSync11(tmpPath, { force: true });
       } catch {
@@ -26254,19 +26444,19 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync47, readFileSync as readFileSync36, statSync as statSync16 } from "node:fs";
-import { homedir as homedir20 } from "node:os";
-import { resolve as resolve23 } from "node:path";
+import { existsSync as existsSync49, readFileSync as readFileSync36, statSync as statSync17 } from "node:fs";
+import { homedir as homedir21 } from "node:os";
+import { resolve as resolve24 } from "node:path";
 import { z as z5 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve23(homedir20(), ".massu");
+  const dir = resolve24(homedir21(), ".massu");
   return {
-    cachePath: resolve23(dir, "adapter-manifest.json"),
-    lockPath: resolve23(dir, ".adapter-manifest.lock")
+    cachePath: resolve24(dir, "adapter-manifest.json"),
+    lockPath: resolve24(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync47(paths.cachePath)) {
+  if (!existsSync49(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
@@ -26460,15 +26650,15 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync48, readFileSync as readFileSync37, lstatSync as lstatSync5 } from "node:fs";
-import { homedir as homedir21 } from "node:os";
-import { resolve as resolve24, isAbsolute as isAbsolute3 } from "node:path";
+import { existsSync as existsSync50, readFileSync as readFileSync37, lstatSync as lstatSync5 } from "node:fs";
+import { homedir as homedir22 } from "node:os";
+import { resolve as resolve25, isAbsolute as isAbsolute4 } from "node:path";
 import { createHash as createHash14 } from "node:crypto";
 import { z as z6 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
   for (const p19 of localPaths) {
-    const abs = isAbsolute3(p19) ? p19 : resolve24(projectRoot, p19);
+    const abs = isAbsolute4(p19) ? p19 : resolve25(projectRoot, p19);
     let contentTag;
     try {
       const lst = lstatSync5(abs);
@@ -26489,7 +26679,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   return createHash14("sha256").update(canonical2).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync48(path)) return null;
+  if (!existsSync50(path)) return null;
   let raw;
   try {
     raw = JSON.parse(readFileSync37(path, "utf-8"));
@@ -26540,7 +26730,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve24(homedir21(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve25(homedir22(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z6.object({
       fingerprint: z6.string().regex(/^[0-9a-f]{64}$/),
       source: z6.enum(["cli", "cli-resync"]),
@@ -26556,15 +26746,15 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync38, readdirSync as readdirSync16, lstatSync as lstatSync6, existsSync as existsSync49 } from "node:fs";
+import { readFileSync as readFileSync38, readdirSync as readdirSync17, lstatSync as lstatSync6, existsSync as existsSync51 } from "node:fs";
 import { join as join28, relative as relative7, sep as sep2 } from "node:path";
-import { homedir as homedir22 } from "node:os";
-import { resolve as resolve25 } from "node:path";
+import { homedir as homedir23 } from "node:os";
+import { resolve as resolve26 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 import { z as z7 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync49(`${packageDir}/${hidden}`)) {
+    if (existsSync51(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -26576,7 +26766,7 @@ function sha256OfDir(dir, opts = {}) {
   function walk(currentDir) {
     let entries;
     try {
-      entries = readdirSync16(currentDir);
+      entries = readdirSync17(currentDir);
     } catch {
       return;
     }
@@ -26619,7 +26809,7 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync49(path)) return {};
+  if (!existsSync51(path)) return {};
   let raw;
   try {
     raw = JSON.parse(readFileSync38(path, "utf-8"));
@@ -26686,7 +26876,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve25(homedir22(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve26(homedir23(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z7.object({
@@ -26709,25 +26899,25 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync50, readdirSync as readdirSync17, readFileSync as readFileSync39, lstatSync as lstatSync7 } from "node:fs";
-import { resolve as resolve26, isAbsolute as isAbsolute4 } from "node:path";
+import { existsSync as existsSync52, readdirSync as readdirSync18, readFileSync as readFileSync39, lstatSync as lstatSync7 } from "node:fs";
+import { resolve as resolve27, isAbsolute as isAbsolute5 } from "node:path";
 import { z as z8 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
-  const nodeModulesDir = resolve26(projectRoot, "node_modules");
-  if (!existsSync50(nodeModulesDir)) {
+  const nodeModulesDir = resolve27(projectRoot, "node_modules");
+  if (!existsSync52(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
   let topLevelEntries;
   try {
-    topLevelEntries = readdirSync17(nodeModulesDir);
+    topLevelEntries = readdirSync18(nodeModulesDir);
   } catch (err) {
     warnings.push(`failed to read node_modules: ${err instanceof Error ? err.message : String(err)}`);
     return [];
   }
   for (const entry of topLevelEntries) {
     if (entry.startsWith(".")) continue;
-    const entryPath = resolve26(nodeModulesDir, entry);
+    const entryPath = resolve27(nodeModulesDir, entry);
     let entryStat;
     try {
       entryStat = lstatSync7(entryPath);
@@ -26744,12 +26934,12 @@ function walkNodeModules(projectRoot, warnings) {
     if (entry.startsWith("@")) {
       let scopedEntries;
       try {
-        scopedEntries = readdirSync17(entryPath);
+        scopedEntries = readdirSync18(entryPath);
       } catch {
         continue;
       }
       for (const sub of scopedEntries) {
-        const subPath = resolve26(entryPath, sub);
+        const subPath = resolve27(entryPath, sub);
         let subStat;
         try {
           subStat = lstatSync7(subPath);
@@ -26768,8 +26958,8 @@ function walkNodeModules(projectRoot, warnings) {
   return candidates;
 }
 function tryReadAdapterPackage(packageDir, warnings) {
-  const pkgJsonPath = resolve26(packageDir, "package.json");
-  if (!existsSync50(pkgJsonPath)) return null;
+  const pkgJsonPath = resolve27(packageDir, "package.json");
+  if (!existsSync52(pkgJsonPath)) return null;
   let raw;
   try {
     raw = JSON.parse(readFileSync39(pkgJsonPath, "utf-8"));
@@ -26906,8 +27096,8 @@ function discoverAdapters(opts) {
   const localSet = new Set(opts.configLocalPaths);
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
-    const absPath = isAbsolute4(localPath) ? localPath : resolve26(opts.projectRoot, localPath);
-    if (!existsSync50(absPath)) {
+    const absPath = isAbsolute5(localPath) ? localPath : resolve27(opts.projectRoot, localPath);
+    if (!existsSync52(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -26989,8 +27179,8 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync51, readFileSync as readFileSync40 } from "node:fs";
-import { resolve as resolve27 } from "node:path";
+import { existsSync as existsSync53, readFileSync as readFileSync40 } from "node:fs";
+import { resolve as resolve28 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
   const sub = args2[0];
@@ -27257,8 +27447,8 @@ function mutateLocalArray(mutator, command) {
     );
     return { exitCode: 2 };
   }
-  const yamlPath = resolve27(projectRoot, "massu.config.yaml");
-  if (!existsSync51(yamlPath)) {
+  const yamlPath = resolve28(projectRoot, "massu.config.yaml");
+  if (!existsSync53(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -27288,7 +27478,7 @@ function mutateLocalArray(mutator, command) {
   if (next === null) {
     return { exitCode: 0 };
   }
-  const lockPath = resolve27(projectRoot, ".massu", "adapters-local-mutate.lock");
+  const lockPath = resolve28(projectRoot, ".massu", "adapters-local-mutate.lock");
   return withFileLockSync(lockPath, () => {
     doc.setIn(["adapters", "local"], next);
     const newYaml = doc.toString();
@@ -27357,16 +27547,16 @@ async function runAdaptersInstall(args2) {
 `);
     return { exitCode: 1 };
   }
-  const packageDir = resolve27(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync51(packageDir)) {
+  const packageDir = resolve28(projectRoot, "node_modules", ...packageName.split("/"));
+  if (!existsSync53(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
     );
     return { exitCode: 1 };
   }
-  const pkgJsonPath = resolve27(packageDir, "package.json");
-  if (!existsSync51(pkgJsonPath)) {
+  const pkgJsonPath = resolve28(packageDir, "package.json");
+  if (!existsSync53(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
@@ -27492,8 +27682,8 @@ async function runAdaptersResign(_args) {
       removeInstalledManifestEntry(name);
       continue;
     }
-    const packageDir = resolve27(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync51(packageDir)) {
+    const packageDir = resolve28(projectRoot, "node_modules", ...name.split("/"));
+    if (!existsSync53(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -27578,87 +27768,6 @@ var init_adapters2 = __esm({
   }
 });
 
-// src/preflight.ts
-import { existsSync as existsSync52 } from "fs";
-function assertCodegraphUsable(dbPath) {
-  const path = dbPath ?? getResolvedPaths().codegraphDbPath;
-  if (!existsSync52(path)) {
-    throw new CodegraphDbUnusableError(path, "missing");
-  }
-  let db = null;
-  try {
-    db = openDatabase2(path, { readonly: true });
-    const row = db.prepare("SELECT COUNT(*) AS c FROM files").get();
-    const files = row?.c ?? 0;
-    if (files === 0) {
-      throw new CodegraphDbUnusableError(path, "empty");
-    }
-  } catch (err) {
-    if (err instanceof CodegraphDbUnusableError) throw err;
-    throw new CodegraphDbUnusableError(
-      path,
-      "unreadable",
-      err instanceof Error ? err.message : String(err)
-    );
-  } finally {
-    try {
-      db?.close();
-    } catch {
-    }
-  }
-}
-var CodegraphDbNotInitializedError, CodegraphDbUnusableError;
-var init_preflight = __esm({
-  "src/preflight.ts"() {
-    "use strict";
-    init_db_driver();
-    init_config();
-    CodegraphDbNotInitializedError = class extends Error {
-      dbPath;
-      constructor(dbPath) {
-        super(`CodeGraph database not found at ${dbPath}`);
-        this.name = "CodegraphDbNotInitializedError";
-        this.dbPath = dbPath;
-      }
-    };
-    CodegraphDbUnusableError = class extends CodegraphDbNotInitializedError {
-      reason;
-      constructor(dbPath, reason, detail) {
-        super(dbPath);
-        this.message = reason === "missing" ? `CodeGraph database not found at ${dbPath}` : reason === "empty" ? `CodeGraph database at ${dbPath} exists but is EMPTY (0 files indexed)` : `CodeGraph database at ${dbPath} could not be read: ${detail ?? "unknown"}`;
-        this.name = "CodegraphDbUnusableError";
-        this.reason = reason;
-      }
-      /**
-       * The remedy, per reason. VERIFIED BY EXECUTION — `init` is a no-op on an
-       * already-initialized repo and will NOT populate the graph. `index` is the command
-       * that does. Getting this wrong sends the customer in a circle.
-       */
-      get remedy() {
-        switch (this.reason) {
-          case "missing":
-            return "npx @colbymchenry/codegraph init && npx @colbymchenry/codegraph index";
-          case "empty":
-            return "npx @colbymchenry/codegraph index";
-          case "unreadable":
-            return "npx @colbymchenry/codegraph index   (the database may be corrupt \u2014 re-indexing rebuilds it)";
-        }
-      }
-      /** Plain-English explanation for a human. */
-      get humanExplanation() {
-        switch (this.reason) {
-          case "missing":
-            return "Massu needs a map of your code to answer questions about it. That map has not been built yet.";
-          case "empty":
-            return 'The code map exists but is EMPTY \u2014 nothing was ever indexed into it. Massu would answer "no impact" to every question, which is indistinguishable from a real answer. It is refusing rather than misleading you.';
-          case "unreadable":
-            return "The code map exists but cannot be read. It may be corrupt.";
-        }
-      }
-    };
-  }
-});
-
 // src/lib/sql-table-names.ts
 function t(suffix) {
   return `${getConfig().toolPrefix}_${suffix}`;
@@ -27672,7 +27781,7 @@ var init_sql_table_names = __esm({
 
 // src/db.ts
 import { dirname as dirname24, join as join29 } from "path";
-import { existsSync as existsSync53, mkdirSync as mkdirSync23, readdirSync as readdirSync18, statSync as statSync17 } from "fs";
+import { existsSync as existsSync54, mkdirSync as mkdirSync23, readdirSync as readdirSync19, statSync as statSync18 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
   assertCodegraphUsable(dbPath);
@@ -27683,7 +27792,7 @@ function getCodeGraphDb() {
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
   const dir = dirname24(dbPath);
-  if (!existsSync53(dir)) {
+  if (!existsSync54(dir)) {
     mkdirSync23(dir, { recursive: true });
   }
   const db = openDatabase2(dbPath);
@@ -27954,14 +28063,14 @@ function isPythonDataStale(dataDb, pythonRoot) {
   const lastBuildTime = new Date(lastBuild.value).getTime();
   function checkDir(dir) {
     try {
-      const entries = readdirSync18(dir, { withFileTypes: true });
+      const entries = readdirSync19(dir, { withFileTypes: true });
       for (const entry of entries) {
         const fullPath = join29(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
         } else if (entry.name.endsWith(".py")) {
-          if (statSync17(fullPath).mtimeMs > lastBuildTime) return true;
+          if (statSync18(fullPath).mtimeMs > lastBuildTime) return true;
         }
       }
     } catch {
@@ -27985,10 +28094,10 @@ var init_db2 = __esm({
 });
 
 // src/security-utils.ts
-import { resolve as resolve28, normalize } from "path";
+import { resolve as resolve29, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
-  const resolvedRoot = resolve28(projectRoot);
-  const resolvedPath = resolve28(resolvedRoot, filePath);
+  const resolvedRoot = resolve29(projectRoot);
+  const resolvedPath = resolve29(resolvedRoot, filePath);
   const normalizedPath = normalize(resolvedPath);
   const normalizedRoot = normalize(resolvedRoot);
   if (!normalizedPath.startsWith(normalizedRoot + "/") && normalizedPath !== normalizedRoot) {
@@ -28061,8 +28170,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync41, existsSync as existsSync54, statSync as statSync18 } from "fs";
-import { resolve as resolve29, dirname as dirname25, join as join30 } from "path";
+import { readFileSync as readFileSync41, existsSync as existsSync55, statSync as statSync19 } from "fs";
+import { resolve as resolve30, dirname as dirname25, join as join30 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -28118,23 +28227,23 @@ function resolveImportPath(specifier, fromFile) {
   let basePath;
   if (specifier.startsWith("@/")) {
     const paths = getResolvedPaths();
-    basePath = resolve29(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
+    basePath = resolve30(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve29(dirname25(fromFile), specifier);
+    basePath = resolve30(dirname25(fromFile), specifier);
   }
-  if (existsSync54(basePath) && !isDirectory(basePath)) {
+  if (existsSync55(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync54(withExt)) {
+    if (existsSync55(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join30(basePath, indexFile);
-    if (existsSync54(indexPath)) {
+    if (existsSync55(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -28142,7 +28251,7 @@ function resolveImportPath(specifier, fromFile) {
 }
 function isDirectory(path) {
   try {
-    return statSync18(path).isDirectory();
+    return statSync19(path).isDirectory();
   } catch {
     return false;
   }
@@ -28170,8 +28279,8 @@ function buildImportIndex(dataDb, codegraphDb) {
   const batchSize = 500;
   let batch = [];
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve29(projectRoot, file.path), projectRoot);
-    if (!existsSync54(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve30(projectRoot, file.path), projectRoot);
+    if (!existsSync55(absPath)) continue;
     let source;
     try {
       source = readFileSync41(absPath, "utf-8");
@@ -28211,12 +28320,12 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync42, existsSync as existsSync55, readdirSync as readdirSync19 } from "fs";
-import { resolve as resolve30, join as join31 } from "path";
+import { readFileSync as readFileSync42, existsSync as existsSync56, readdirSync as readdirSync20 } from "fs";
+import { resolve as resolve31, join as join31 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync55(rootPath)) {
+  if (!existsSync56(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
   const source = readFileSync42(rootPath, "utf-8");
@@ -28227,16 +28336,16 @@ function parseRootRouter() {
   while ((match = importRegex.exec(source)) !== null) {
     const variable = match[1];
     let filePath = match[2];
-    const fullPath = resolve30(paths.routersDir, filePath);
+    const fullPath = resolve31(paths.routersDir, filePath);
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync55(candidate)) {
+      if (existsSync56(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
       const indexCandidate = join31(fullPath, "index.ts");
-      if (existsSync55(indexCandidate)) {
+      if (existsSync56(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -28255,8 +28364,8 @@ function parseRootRouter() {
   return mappings;
 }
 function extractProcedures(routerFilePath) {
-  const absPath = resolve30(getProjectRoot(), routerFilePath);
-  if (!existsSync55(absPath)) return [];
+  const absPath = resolve31(getProjectRoot(), routerFilePath);
+  if (!existsSync56(absPath)) return [];
   const source = readFileSync42(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
@@ -28280,19 +28389,19 @@ function findUICallSites(routerKey, procedureName) {
   const root = getProjectRoot();
   const src = config.paths.source;
   const searchDirs = [
-    resolve30(root, config.paths.pages ?? src + "/app"),
-    resolve30(root, config.paths.components ?? src + "/components"),
-    resolve30(root, config.paths.hooks ?? src + "/hooks")
+    resolve31(root, config.paths.pages ?? src + "/app"),
+    resolve31(root, config.paths.components ?? src + "/components"),
+    resolve31(root, config.paths.hooks ?? src + "/hooks")
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync55(dir)) continue;
+    if (!existsSync56(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
 }
 function searchDirectory(dir, pattern, results) {
-  const entries = readdirSync19(dir, { withFileTypes: true });
+  const entries = readdirSync20(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join31(dir, entry.name);
     if (entry.isDirectory()) {
@@ -28364,8 +28473,8 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync43, existsSync as existsSync56 } from "fs";
-import { resolve as resolve31 } from "path";
+import { readFileSync as readFileSync43, existsSync as existsSync57 } from "fs";
+import { resolve as resolve32 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
   return route || "/";
@@ -28403,8 +28512,8 @@ function findRouterCalls(files) {
   const routers = /* @__PURE__ */ new Set();
   const projectRoot = getProjectRoot();
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve31(projectRoot, file), projectRoot);
-    if (!existsSync56(absPath)) continue;
+    const absPath = ensureWithinRoot(resolve32(projectRoot, file), projectRoot);
+    if (!existsSync57(absPath)) continue;
     try {
       const source = readFileSync43(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
@@ -28424,8 +28533,8 @@ function findTablesFromRouters(routerNames, dataDb) {
       `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ? LIMIT 10000`
     ).all(routerName);
     for (const proc of procs) {
-      const absPath = ensureWithinRoot(resolve31(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync56(absPath)) continue;
+      const absPath = ensureWithinRoot(resolve32(getProjectRoot(), proc.router_file), getProjectRoot());
+      if (!existsSync57(absPath)) continue;
       try {
         const source = readFileSync43(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
@@ -28699,11 +28808,11 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync44, existsSync as existsSync57, readdirSync as readdirSync20 } from "fs";
+import { readFileSync as readFileSync44, existsSync as existsSync58, readdirSync as readdirSync21 } from "fs";
 import { join as join32 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync57(schemaPath)) {
+  if (!existsSync58(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
   const source = readFileSync44(schemaPath, "utf-8");
@@ -28764,12 +28873,12 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage2 = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync57(routersDir)) return usage2;
+  if (!existsSync58(routersDir)) return usage2;
   scanDirectory(routersDir, tableName, usage2);
   return usage2;
 }
 function scanDirectory(dir, tableName, usage2) {
-  const entries = readdirSync20(dir, { withFileTypes: true });
+  const entries = readdirSync21(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join32(dir, entry.name);
     if (entry.isDirectory()) {
@@ -28826,8 +28935,8 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync57(dir)) return result;
-  const entries = readdirSync20(dir, { withFileTypes: true });
+  if (!existsSync58(dir)) return result;
+  const entries = readdirSync21(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join32(dir, entry.name);
     if (entry.isDirectory()) {
@@ -28979,12 +29088,12 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync45, existsSync as existsSync58, readdirSync as readdirSync21 } from "fs";
-import { resolve as resolve33, join as join33, relative as relative8, dirname as dirname26 } from "path";
+import { readFileSync as readFileSync45, existsSync as existsSync59, readdirSync as readdirSync22 } from "fs";
+import { resolve as resolve34, join as join33, relative as relative8, dirname as dirname26 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname26(resolve33(projectRoot, fromFile));
+    let baseDir = dirname26(resolve34(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
       baseDir = dirname26(baseDir);
     }
@@ -28996,17 +29105,17 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join33(resolve33(projectRoot, pythonRoot), ...parts);
+  const candidate = join33(resolve34(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync58(basePath + ".py")) {
+  if (existsSync59(basePath + ".py")) {
     return relative8(projectRoot, basePath + ".py");
   }
-  if (existsSync58(join33(basePath, "__init__.py"))) {
+  if (existsSync59(join33(basePath, "__init__.py"))) {
     return relative8(projectRoot, join33(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync58(basePath)) {
+  if (basePath.endsWith(".py") && existsSync59(basePath)) {
     return relative8(projectRoot, basePath);
   }
   return null;
@@ -29014,7 +29123,7 @@ function tryResolvePythonPath(basePath, projectRoot) {
 function walkPythonFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync21(dir, { withFileTypes: true });
+    const entries = readdirSync22(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
@@ -29029,7 +29138,7 @@ function walkPythonFiles(dir, excludeDirs) {
 }
 function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = resolve33(projectRoot, pythonRoot);
+  const absRoot = resolve34(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_imports")}`);
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("py_imports")} (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)`
@@ -29313,12 +29422,12 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync46, readdirSync as readdirSync22 } from "fs";
+import { readFileSync as readFileSync46, readdirSync as readdirSync23 } from "fs";
 import { join as join34, relative as relative9 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync22(dir, { withFileTypes: true });
+    const entries = readdirSync23(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
@@ -29558,12 +29667,12 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync47, readdirSync as readdirSync23 } from "fs";
+import { readFileSync as readFileSync47, readdirSync as readdirSync24 } from "fs";
 import { join as join35, relative as relative10 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync23(dir, { withFileTypes: true });
+    const entries = readdirSync24(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
@@ -29855,7 +29964,7 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync48, readdirSync as readdirSync24 } from "fs";
+import { readFileSync as readFileSync48, readdirSync as readdirSync25 } from "fs";
 import { join as join36, relative as relative11 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
@@ -29864,10 +29973,10 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   const versionsDir = join36(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync24(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join36(versionsDir, f2));
+    files = readdirSync25(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join36(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync24(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join36(absDir, f2));
+      files = readdirSync25(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join36(absDir, f2));
     } catch {
     }
   }
@@ -29916,7 +30025,7 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync49, readdirSync as readdirSync25 } from "fs";
+import { readFileSync as readFileSync49, readdirSync as readdirSync26 } from "fs";
 import { join as join37, relative as relative12 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
@@ -29981,7 +30090,7 @@ function walkFrontendFiles(dir) {
   const files = [];
   const exclude = ["node_modules", ".next", "dist", ".git", "__pycache__", ".venv", "venv"];
   try {
-    const entries = readdirSync25(dir, { withFileTypes: true });
+    const entries = readdirSync26(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
@@ -30359,8 +30468,8 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync50, existsSync as existsSync59 } from "fs";
-import { resolve as resolve34, basename as basename9 } from "path";
+import { readFileSync as readFileSync50, existsSync as existsSync60 } from "fs";
+import { resolve as resolve35, basename as basename9 } from "path";
 function p4(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -30415,7 +30524,7 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync59(mapPath)) {
+  if (!existsSync60(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
   return JSON.parse(readFileSync50(mapPath, "utf-8"));
@@ -30488,10 +30597,10 @@ function extractFrontmatter(content) {
 }
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
-  const absPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync59(absPath)) {
-    const altPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
-    if (!existsSync59(altPath)) return [];
+  const absPath = ensureWithinRoot(resolve35(getResolvedPaths().srcDir, "..", routerPath), root);
+  if (!existsSync60(absPath)) {
+    const altPath = ensureWithinRoot(resolve35(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
+    if (!existsSync60(altPath)) return [];
     return extractProcedureNamesFromContent(readFileSync50(altPath, "utf-8"));
   }
   return extractProcedureNamesFromContent(readFileSync50(absPath, "utf-8"));
@@ -30534,8 +30643,8 @@ function handleDocsAudit(args2) {
   for (const [mappingId, triggeringFiles] of affectedMappings) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
-    const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync59(helpPagePath)) {
+    const helpPagePath = ensureWithinRoot(resolve35(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    if (!existsSync60(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -30587,8 +30696,8 @@ function handleDocsAudit(args2) {
     });
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
-        const guidePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync59(guidePath)) {
+        const guidePath = ensureWithinRoot(resolve35(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
+        if (existsSync60(guidePath)) {
           const guideContent = readFileSync50(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
@@ -30622,8 +30731,8 @@ function handleDocsCoverage(args2) {
   const gaps = [];
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
-    const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync59(helpPagePath);
+    const helpPagePath = ensureWithinRoot(resolve35(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    const exists = existsSync60(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
@@ -30970,8 +31079,8 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync60 } from "fs";
-import { resolve as resolve35 } from "path";
+import { existsSync as existsSync61 } from "fs";
+import { resolve as resolve36 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
   try {
@@ -31207,23 +31316,23 @@ function validateFeatures(db, domainFilter) {
     const missingProcedures = [];
     const missingPages = [];
     for (const comp of components) {
-      const absPath = resolve35(PROJECT_ROOT, comp.component_file);
-      if (!existsSync60(absPath)) {
+      const absPath = resolve36(PROJECT_ROOT, comp.component_file);
+      if (!existsSync61(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
-      const routerPath = resolve35(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync60(routerPath)) {
+      const routerPath = resolve36(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
+      if (!existsSync61(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
-      const absPath = resolve35(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync60(absPath)) {
-        const altPath = resolve35(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync60(altPath)) {
+      const absPath = resolve36(PROJECT_ROOT, routeToPath);
+      if (page.page_route.startsWith("/") && !existsSync61(absPath)) {
+        const altPath = resolve36(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
+        if (!existsSync61(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -31749,8 +31858,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync51, existsSync as existsSync61, readdirSync as readdirSync26, statSync as statSync19 } from "fs";
-import { resolve as resolve36, join as join38, basename as basename10, dirname as dirname27, relative as relative13 } from "path";
+import { readFileSync as readFileSync51, existsSync as existsSync62, readdirSync as readdirSync27, statSync as statSync20 } from "fs";
+import { resolve as resolve37, join as join38, basename as basename10, dirname as dirname27, relative as relative13 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -31881,10 +31990,10 @@ function scanComponentExports(dataDb) {
   const projectRoot = getProjectRoot();
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
-  const basePath = resolve36(projectRoot, componentsBase);
-  if (existsSync61(basePath)) {
+  const basePath = resolve37(projectRoot, componentsBase);
+  if (existsSync62(basePath)) {
     try {
-      const entries = readdirSync26(basePath, { withFileTypes: true });
+      const entries = readdirSync27(basePath, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           componentDirs.push(componentsBase + "/" + entry.name);
@@ -31894,8 +32003,8 @@ function scanComponentExports(dataDb) {
     }
   }
   for (const dir of componentDirs) {
-    const absDir = resolve36(projectRoot, dir);
-    if (!existsSync61(absDir)) continue;
+    const absDir = resolve37(projectRoot, dir);
+    if (!existsSync62(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative13(projectRoot, file);
@@ -31948,11 +32057,11 @@ function scanComponentExports(dataDb) {
 function walkDir2(dir) {
   const results = [];
   try {
-    const entries = readdirSync26(dir);
+    const entries = readdirSync27(dir);
     for (const entry of entries) {
       const fullPath = join38(dir, entry);
       try {
-        const stat = statSync19(fullPath);
+        const stat = statSync20(fullPath);
         if (stat.isDirectory()) {
           results.push(...walkDir2(fullPath));
         } else {
@@ -32660,7 +32769,7 @@ var init_prompt_analyzer = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync62, readFileSync as readFileSync52 } from "fs";
+import { existsSync as existsSync63, readFileSync as readFileSync52 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -32691,7 +32800,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync62(absPath)) {
+  if (!existsSync63(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -33159,7 +33268,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync63, readFileSync as readFileSync53 } from "fs";
+import { existsSync as existsSync64, readFileSync as readFileSync53 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -33183,7 +33292,7 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync63(absPath)) {
+  if (!existsSync64(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
@@ -33478,8 +33587,8 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync64, readFileSync as readFileSync54 } from "fs";
-import { resolve as resolve37 } from "path";
+import { existsSync as existsSync65, readFileSync as readFileSync54 } from "fs";
+import { resolve as resolve38 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -33511,8 +33620,8 @@ function calculateDepRisk(factors) {
   return Math.min(100, risk);
 }
 function getInstalledPackages(projectRoot) {
-  const pkgPath = resolve37(projectRoot, "package.json");
-  if (!existsSync64(pkgPath)) return /* @__PURE__ */ new Map();
+  const pkgPath = resolve38(projectRoot, "package.json");
+  if (!existsSync65(pkgPath)) return /* @__PURE__ */ new Map();
   try {
     const pkg = JSON.parse(readFileSync54(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
@@ -34120,8 +34229,8 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash16 } from "crypto";
-import { readFileSync as readFileSync55, readdirSync as readdirSync27, statSync as statSync20, existsSync as existsSync65 } from "fs";
-import { resolve as resolve38, relative as relative14, basename as basename11, extname as extname2 } from "path";
+import { readFileSync as readFileSync55, readdirSync as readdirSync28, statSync as statSync21, existsSync as existsSync66 } from "fs";
+import { resolve as resolve39, relative as relative14, basename as basename11, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -34147,9 +34256,9 @@ function discoverMarkdownFiles(baseDir) {
   const files = [];
   function walk(dir) {
     try {
-      const entries = readdirSync27(dir, { withFileTypes: true });
+      const entries = readdirSync28(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = resolve38(dir, entry.name);
+        const fullPath = resolve39(dir, entry.name);
         if (entry.isDirectory()) {
           if (entry.name === "archive" && dir.includes("session-state")) continue;
           if (entry.name === "archive" && dir.includes("status")) continue;
@@ -34428,11 +34537,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync65(paths.plansDir)) {
+  if (existsSync66(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync65(paths.docsDir)) {
+  if (existsSync66(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -34475,7 +34584,7 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync65(filePath)) continue;
+      if (!existsSync66(filePath)) continue;
       const content = readFileSync55(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative14(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative14(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative14(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative14(paths.memoryDir, filePath)}` : basename11(filePath);
@@ -34611,17 +34720,17 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync65(paths.plansDir)) {
+  if (existsSync66(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync65(paths.docsDir)) {
+  if (existsSync66(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
   }
   for (const filePath of files) {
     try {
-      const stat = statSync20(filePath);
+      const stat = statSync21(filePath);
       if (stat.mtimeMs > lastIndexTime) return true;
     } catch {
       continue;
@@ -34643,8 +34752,8 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync56, writeFileSync as writeFileSync16, appendFileSync as appendFileSync5, readdirSync as readdirSync28 } from "fs";
-import { resolve as resolve39, basename as basename12 } from "path";
+import { readFileSync as readFileSync56, writeFileSync as writeFileSync16, appendFileSync as appendFileSync5, readdirSync as readdirSync29 } from "fs";
+import { resolve as resolve40, basename as basename12 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -35383,7 +35492,7 @@ function handleCorrect(db, args2) {
   if (!wrong || !correction || !rule) {
     return text15("Error: wrong, correction, and rule are all required.");
   }
-  const correctionsPath = resolve39(getResolvedPaths().memoryDir, "corrections.md");
+  const correctionsPath = resolve40(getResolvedPaths().memoryDir, "corrections.md");
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const title = rule.slice(0, 60);
   const entry = formatCorrectionEntry({
@@ -35578,7 +35687,7 @@ function handleGaps(db, args2) {
   } else if (checkType === "routers") {
     try {
       const routersDir = getResolvedPaths().routersDir;
-      const routerFiles = readdirSync28(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
+      const routerFiles = readdirSync29(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
       lines.push(`| Router | Knowledge Hits | Status |`);
       lines.push(`|--------|----------------|--------|`);
       for (const file of routerFiles) {
@@ -36352,8 +36461,8 @@ var init_framework_supports = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync57, existsSync as existsSync67 } from "fs";
-import { resolve as resolve40, basename as basename13 } from "path";
+import { readFileSync as readFileSync57, existsSync as existsSync68 } from "fs";
+import { resolve as resolve41, basename as basename13 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
 }
@@ -36388,7 +36497,7 @@ function ensureIndexes(dataDb, codegraphDb, force = false) {
   if (config.python?.root) {
     const pythonRoot = config.python.root;
     const excludeDirs = config.python.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
-    if (force || isPythonDataStale(dataDb, resolve40(getProjectRoot(), pythonRoot))) {
+    if (force || isPythonDataStale(dataDb, resolve41(getProjectRoot(), pythonRoot))) {
       const pyImports = buildPythonImportIndex(dataDb, pythonRoot, excludeDirs);
       results.push(`Python imports: ${pyImports}`);
       const pyRoutes = buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs);
@@ -36771,8 +36880,8 @@ function handleContext(file, dataDb, codegraphDb) {
         try {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
-          const absFilePath = ensureWithinRoot(resolve40(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync67(absFilePath)) {
+          const absFilePath = ensureWithinRoot(resolve41(resolvedPaths.srcDir, "..", file), root);
+          if (existsSync68(absFilePath)) {
             const fileContent = readFileSync57(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
@@ -37210,8 +37319,8 @@ function handleSchema(args2) {
     lines.push("Checking all column references against Prisma schema...");
     lines.push("");
     const projectRoot = getProjectRoot();
-    const absPath = ensureWithinRoot(resolve40(projectRoot, file), projectRoot);
-    if (!existsSync67(absPath)) {
+    const absPath = ensureWithinRoot(resolve41(projectRoot, file), projectRoot);
+    if (!existsSync68(absPath)) {
       return text17(`File not found: ${file}`);
     }
     const source = readFileSync57(absPath, "utf-8");
@@ -37647,7 +37756,7 @@ var init_startup_health = __esm({
 // src/server.ts
 var server_exports = {};
 import { readFileSync as readFileSync58 } from "fs";
-import { resolve as resolve41, dirname as dirname28 } from "path";
+import { resolve as resolve42, dirname as dirname28 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -37695,7 +37804,7 @@ var init_server = __esm({
     __dirname5 = dirname28(fileURLToPath6(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync58(resolve41(__dirname5, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync58(resolve42(__dirname5, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -37998,19 +38107,19 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync68, readFileSync as readFileSync59, writeFileSync as writeFileSync17, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
-import { resolve as resolve42 } from "path";
+import { existsSync as existsSync69, readFileSync as readFileSync59, writeFileSync as writeFileSync17, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
+import { resolve as resolve43 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve42(cwd, "massu.config.yaml");
+  const configPath = resolve43(cwd, "massu.config.yaml");
   const bakPath = `${configPath}.bak`;
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync68(bakPath)) {
+    if (!existsSync69(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
@@ -38026,7 +38135,7 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync68(configPath)) {
+  if (!existsSync69(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
@@ -38090,8 +38199,8 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync69, readFileSync as readFileSync60 } from "fs";
-import { resolve as resolve43 } from "path";
+import { existsSync as existsSync70, readFileSync as readFileSync60 } from "fs";
+import { resolve as resolve44 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
   if (changes.length === 0) return "(none)\n";
@@ -38099,12 +38208,12 @@ function renderChanges(changes) {
 }
 async function runConfigCheckDrift(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve43(cwd, "massu.config.yaml");
+  const configPath = resolve44(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync69(configPath)) {
+  if (!existsSync70(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -38186,13 +38295,160 @@ var init_config_check_drift = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync61 } from "fs";
-import { resolve as resolve44, dirname as dirname29 } from "path";
+import { resolve as resolve45, dirname as dirname29 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
+
+// src/lib/node-bootstrap.ts
+init_node_floor();
+import { existsSync, readdirSync, statSync } from "fs";
+import { spawnSync, execFileSync } from "child_process";
+import { homedir } from "os";
+import { isAbsolute, resolve } from "path";
+var REEXEC_SENTINEL_ENV = "MASSU_BOOTSTRAP_REEXEC";
+var OPT_OUT_ENV = "MASSU_NO_NODE_BOOTSTRAP";
+function allowlistPatterns(env) {
+  const patterns = [];
+  const rawHome = env.HOME || homedir();
+  const home = rawHome && isAbsolute(rawHome) ? rawHome : null;
+  const addAbs = (dir, suffix) => {
+    if (dir && isAbsolute(dir)) patterns.push(resolve(dir, suffix));
+  };
+  addAbs(env.NVM_DIR ?? (home && resolve(home, ".nvm")), "versions/node/*/bin/node");
+  addAbs(env.FNM_DIR ?? (home && resolve(home, ".local/share/fnm")), "node-versions/*/installation/bin/node");
+  addAbs(env.VOLTA_HOME ?? (home && resolve(home, ".volta")), "tools/image/node/*/bin/node");
+  addAbs(env.ASDF_DATA_DIR ?? (home && resolve(home, ".asdf")), "installs/nodejs/*/bin/node");
+  addAbs(env.N_PREFIX ?? (home && resolve(home, "n")), "bin/node");
+  patterns.push(
+    "/opt/homebrew/opt/node@*/bin/node",
+    "/usr/local/opt/node@*/bin/node",
+    "/opt/homebrew/bin/node",
+    "/usr/local/bin/node"
+  );
+  return patterns;
+}
+function isOwnershipTrusted(candidate) {
+  const getuid = process.getuid;
+  if (typeof getuid !== "function") return true;
+  try {
+    const uid = statSync(candidate).uid;
+    return uid === 0 || uid === getuid.call(process);
+  } catch {
+    return false;
+  }
+}
+function expandSingleStarGlob(pattern) {
+  const parts = pattern.split("/");
+  const starIdx = parts.findIndex((p19) => p19.includes("*"));
+  if (starIdx === -1) {
+    return existsSync(pattern) ? [pattern] : [];
+  }
+  const parentDir = parts.slice(0, starIdx).join("/") || "/";
+  const seg = parts[starIdx];
+  const rest = parts.slice(starIdx + 1).join("/");
+  const [pre, post] = seg.split("*");
+  let entries;
+  try {
+    entries = readdirSync(parentDir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e2 of entries) {
+    if (!e2.startsWith(pre) || !e2.endsWith(post ?? "")) continue;
+    out.push(rest ? `${parentDir}/${e2}/${rest}` : `${parentDir}/${e2}`);
+  }
+  return out;
+}
+function probeNodeVersion(candidate) {
+  try {
+    const out = execFileSync(candidate, ["-p", "process.versions.node"], {
+      encoding: "utf8",
+      timeout: 5e3
+    });
+    const v3 = out.trim();
+    return /^\d+\.\d+\.\d+/.test(v3) ? v3 : null;
+  } catch {
+    return null;
+  }
+}
+function discoverCompatibleNode(env = process.env) {
+  const seen = /* @__PURE__ */ new Set();
+  let best = null;
+  for (const pattern of allowlistPatterns(env)) {
+    for (const candidate of expandSingleStarGlob(pattern)) {
+      if (!candidate.startsWith("/")) continue;
+      if (seen.has(candidate)) continue;
+      seen.add(candidate);
+      if (!existsSync(candidate)) continue;
+      if (!isOwnershipTrusted(candidate)) continue;
+      const v3 = probeNodeVersion(candidate);
+      if (!v3) continue;
+      if (!checkNodeVersion(`v${v3}`).ok) continue;
+      const [major, minor, patch] = v3.split(".").map((n) => Number.parseInt(n, 10));
+      const lower = best === null || major < best.major || major === best.major && minor < best.minor || major === best.major && minor === best.minor && patch < best.patch;
+      if (lower) best = { path: candidate, major, minor, patch };
+    }
+  }
+  return best?.path ?? null;
+}
+function reexecUnder(nodePath, selfEntry, argv, env) {
+  const result = spawnSync(nodePath, [selfEntry, ...argv], {
+    stdio: "inherit",
+    env: { ...env, [REEXEC_SENTINEL_ENV]: "1" }
+  });
+  return result.status ?? 1;
+}
+function writeLoudRemedy(floorMessage, stderr) {
+  const floor = `${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}.0`;
+  const installLine = process.platform === "win32" ? `    winget install OpenJS.NodeJS   # or download Node >= ${floor} from https://nodejs.org` : `    nvm install ${MIN_NODE_MAJOR}     # or: brew install node@${MIN_NODE_MAJOR}`;
+  stderr(
+    `
+massu: ${floorMessage}
+No compatible Node was found on this machine, so massu will not launch under a Node it cannot run on (that would crash your hooks silently).
+Fix it once: install Node >= ${floor}, e.g.
+${installLine}
+then re-run. (Set ${OPT_OUT_ENV}=1 to skip auto-discovery if you pin your own Node.)
+
+`
+  );
+}
+function bootstrapNodeOrExit(argv, env = process.env, deps = {}) {
+  const nodeVersion = deps.nodeVersion ?? process.version;
+  const stderr = deps.stderr ?? ((m3) => void process.stderr.write(m3));
+  const exit = deps.exit ?? ((c2) => process.exit(c2));
+  const check = checkNodeVersion(nodeVersion);
+  if (env[REEXEC_SENTINEL_ENV] === "1") {
+    if (check.ok) return;
+    writeLoudRemedy(check.message ?? "", stderr);
+    exit(1);
+    return;
+  }
+  if (check.ok) return;
+  if (env[OPT_OUT_ENV] === "1") {
+    writeLoudRemedy(check.message ?? "", stderr);
+    exit(1);
+    return;
+  }
+  const discover = deps.discover ?? discoverCompatibleNode;
+  const nodePath = discover(env);
+  if (!nodePath) {
+    writeLoudRemedy(check.message ?? "", stderr);
+    exit(1);
+    return;
+  }
+  const selfEntry = deps.selfEntry ?? process.argv[1];
+  const reexec = deps.reexec ?? reexecUnder;
+  const status = reexec(nodePath, selfEntry, argv, env);
+  exit(status);
+}
+
+// src/cli.ts
 var __filename5 = fileURLToPath7(import.meta.url);
 var __dirname6 = dirname29(__filename5);
 var args = process.argv.slice(2);
 var subcommand = args[0];
 async function main() {
+  bootstrapNodeOrExit(process.argv.slice(2));
   switch (subcommand) {
     case "init": {
       const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));
@@ -38481,7 +38737,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync61(resolve44(__dirname6, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync61(resolve45(__dirname6, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");