@mnemonik/cli 7.109.3 → 7.110.0

package/dist/project/records.js

@@ -516,8 +516,25 @@ function readIdentity(stdout) {
     throw new Error("acl_identity_unavailable");
   return { name: match[1], sid: match[2] };
 }
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
 function windowsCurrentAccountSync() {
-  return currentIdentity ??= readIdentity(hookExecuteSync(windowsCommand("whoami.exe"), identityArgs));
+  if (currentIdentity)
+    return currentIdentity;
+  const commands = readWindowsIdentity();
+  let step = commands.next();
+  while (!step.done)
+    step = commands.next(hookExecuteSync(...step.value));
+  return currentIdentity = step.value;
 }
 function hookInvocation(file, args2) {
   if (win32.basename(file) === "whoami.exe") {
@@ -537,11 +554,13 @@ function hookExecuteSync(file, args2, input) {
   [file, args2] = hookInvocation(file, args2);
   return execFileSync(file, args2, { ...hookOptions(file, args2), input });
 }
-var identityArgs, currentIdentity, ttl, hookOptions;
+var identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, ttl, hookOptions;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
     identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     ttl = 10 * 6e4;
     hookOptions = (file, args2) => ({
       encoding: args2.includes("/u") ? "utf16le" : "utf8",
@@ -2199,7 +2218,7 @@ var require_proper_lockfile = __commonJS({
 // packages/cli/src/project/records.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { readFile as readFile2, readdir, unlink as unlink2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 
 // packages/shared/dist/instructions.js
 var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
@@ -6555,6 +6574,100 @@ async function withLock(path, waitMs, work) {
   }
 }
 
+// packages/local-setup/dist/automaticUpdate.js
+import { spawn as nodeSpawn } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { stat as nodeStat, utimes } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var DAY_MS = 864e5;
+var statePath = (stateDir) => join4(stateDir, "automatic-update.json");
+function cliLauncherPath(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir2();
+  return platform === "win32" ? join4(options.env?.LOCALAPPDATA || join4(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join4(home, ".local", "bin", "mnemonik");
+}
+async function readState(path) {
+  const bytes = await readBytes(path);
+  if (!bytes)
+    return {};
+  const value = JSON.parse(bytes.toString());
+  if (!value || typeof value !== "object" || value.lastAttempt !== void 0 && (!Number.isFinite(value.lastAttempt) || value.lastAttempt < 0))
+    throw new Error("automatic_update_state_invalid");
+  return value.lastAttempt === void 0 ? {} : { lastAttempt: value.lastAttempt };
+}
+async function maybeStartAutomaticUpdate(options = {}) {
+  const stateDir = options.stateDir ?? stateDirectory(options.platform, options.env, options.home);
+  const path = statePath(stateDir);
+  try {
+    const now = (options.now ?? Date.now)();
+    const stat = options.stat ?? nodeStat;
+    try {
+      if (now - (await stat(path)).mtimeMs < DAY_MS)
+        return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    if (!options.spawn && !(await stat(cliLauncherPath(options))).isFile())
+      return false;
+    return await withLock(path, 0, async (assertOwned) => {
+      const state = await readState(path);
+      if (state.lastAttempt !== void 0 && now - state.lastAttempt < DAY_MS)
+        return false;
+      await atomicWrite(path, Buffer.from(`${JSON.stringify({ lastAttempt: now })}
+`), void 0, assertOwned);
+      await utimes(path, now / 1e3, now / 1e3);
+      const platform = options.platform ?? process.platform;
+      const launcher = cliLauncherPath(options);
+      const command = platform === "win32" ? {
+        file: options.env?.ComSpec || "cmd.exe",
+        args: ["/d", "/s", "/c", `""${launcher}" update --automatic"`],
+        windowsVerbatimArguments: true
+      } : platform === "linux" && (options.env ?? process.env).INVOCATION_ID ? {
+        // detached creates a process group, not a new systemd cgroup. An
+        // updater spawned by the scanner must survive stopping that service.
+        file: "systemd-run",
+        args: [
+          "--user",
+          "--collect",
+          "--quiet",
+          `--setenv=MNEMONIK_STATE_DIR=${stateDir}`,
+          "--",
+          launcher,
+          "update",
+          "--automatic"
+        ]
+      } : { file: launcher, args: ["update", "--automatic"] };
+      const child = (options.spawn ?? nodeSpawn)(command.file, command.args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        ..."windowsVerbatimArguments" in command ? { windowsVerbatimArguments: command.windowsVerbatimArguments } : {}
+      });
+      child.once("error", () => {
+      });
+      child.unref();
+      return true;
+    });
+  } catch {
+    return false;
+  }
+}
+var HELPER_FLAG = "--mnemonik-automatic-update";
+function isHelperInvocation() {
+  if (process.argv[2] !== HELPER_FLAG || !process.argv[3] || !process.argv[1])
+    return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath2(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isHelperInvocation())
+  void maybeStartAutomaticUpdate({ stateDir: process.argv[3] });
+
 // packages/local-setup/dist/index.js
 var MAX_ORIGINAL_BYTES = 64 * 1024;
 
@@ -6562,7 +6675,7 @@ var MAX_ORIGINAL_BYTES = 64 * 1024;
 var digest = (bytes) => `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
 async function identityHash(root) {
   try {
-    return digest(await readFile2(join4(root, ".mnemonik.json")));
+    return digest(await readFile2(join5(root, ".mnemonik.json")));
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -6570,14 +6683,14 @@ async function identityHash(root) {
 }
 var ownerLabel = (owner) => !owner || owner === "personal" ? "personal" : `team:${owner.teamId}`;
 async function saveCommandRecord(record, stateDir = stateDirectory()) {
-  const directory = join4(
+  const directory = join5(
     stateDir,
     "project-commands",
     createHash2("sha256").update(record.resolvedRoot).digest("hex")
   );
-  const lock = join4(directory, ".records");
+  const lock = join5(directory, ".records");
   await withLock(lock, 6e4, async (assertOwned) => {
-    const file = join4(directory, `${Date.now().toString().padStart(16, "0")}-${randomUUID2()}.json`);
+    const file = join5(directory, `${Date.now().toString().padStart(16, "0")}-${randomUUID2()}.json`);
     await atomicWrite(
       file,
       Buffer.from(`${JSON.stringify(record, null, 2)}
@@ -6588,7 +6701,7 @@ async function saveCommandRecord(record, stateDir = stateDirectory()) {
     const files = (await readdir(directory)).filter((name2) => name2.endsWith(".json")).sort();
     for (const stale of files.slice(0, -20)) {
       await assertOwned();
-      await unlink2(join4(directory, stale));
+      await unlink2(join5(directory, stale));
     }
   });
 }

package/dist/project.d.ts

@@ -10,6 +10,19 @@ export interface ProjectExecutor {
     apply(options: EnsureOptions): Promise<SetupResult>;
     rollback(options: EnsureOptions): Promise<SetupResult>;
 }
+/**
+ * The command that gives each offered answer, for an agent that reads JSON.
+ * An action no command can give is left out.
+ */
+export declare function answerCommands(actions: readonly string[], root: string, details?: {
+    candidates?: Array<{
+        projectId: string;
+    }>;
+    projectId?: string;
+}): Array<{
+    action: string;
+    command: string;
+}>;
 export declare function ensureProjectRoot(root: string, executor: ProjectExecutor): Promise<SetupResult>;
 /** Does Mnemonik have plain words for this state? */
 export declare const hasRefusalWords: (reason: string) => boolean;
@@ -118,6 +131,8 @@ export interface ProjectCommandInput {
     apply: boolean;
     confirmMismatch: boolean;
     replace: boolean;
+    /** Answer a waiting setup with cancel: clear the folder's setup notes. */
+    cancel?: boolean;
     owner?: string;
 }
 export declare function runProjectCommand(input: ProjectCommandInput, deps: ProjectCommandDependencies): Promise<number>;

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,KAAK,EACV,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EAEtB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAE3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiB1C,MAAM,WAAW,eAAe;IAC9B,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxE,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACxD;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAEtB;AAwED,qDAAqD;AACrD,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,OAAmC,CAAC;AAErF,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3E;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAChC,MAAM,EAAE,GAAG,SAAS,CActB;AAED,eAAO,MAAM,wBAAwB,UAAW,MAAM,EAAE,KAAG,MAGL,CAAC;AAEvD,eAAO,MAAM,eAAe,iBAAkB,oBAAoB,KAAG,eAOpE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC5B,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;AAE7E,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IAC5D,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC9C,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;CACvC;AAmBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA8B/F;AAED,wBAAsB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsErF;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE;QAAE,sBAAsB,EAAE,OAAO,sBAAsB,CAAA;KAAE,CAAC;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA+bD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAoCD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,uEAAuE;IACvE,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC,CAAC;IACjF,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2ClB;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,KAAK,EACV,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EAEtB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAE3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiB1C,MAAM,WAAW,eAAe;IAC9B,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxE,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACxD;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9E,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB5C;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,CAAC,CAEtB;AAyED,qDAAqD;AACrD,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,OAAmC,CAAC;AAErF,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3E;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAChC,MAAM,EAAE,GAAG,SAAS,CActB;AAED,eAAO,MAAM,wBAAwB,UAAW,MAAM,EAAE,KAAG,MAGL,CAAC;AAEvD,eAAO,MAAM,eAAe,iBAAkB,oBAAoB,KAAG,eAOpE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC5B,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;AAE7E,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC;IAC5D,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,GAC9C,OAAO,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACzD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;CACvC;AAmBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA8B/F;AAED,wBAAsB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsErF;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE;QAAE,sBAAsB,EAAE,OAAO,sBAAsB,CAAA;KAAE,CAAC;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAseD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAoCD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,uEAAuE;IACvE,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC,CAAC;IACjF,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2ClB;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB"}

package/dist/project.js

@@ -516,8 +516,25 @@ function readIdentity(stdout) {
     throw new Error("acl_identity_unavailable");
   return { name: match[1], sid: match[2] };
 }
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
 function windowsCurrentAccountSync() {
-  return currentIdentity ??= readIdentity(hookExecuteSync(windowsCommand("whoami.exe"), identityArgs));
+  if (currentIdentity)
+    return currentIdentity;
+  const commands = readWindowsIdentity();
+  let step2 = commands.next();
+  while (!step2.done)
+    step2 = commands.next(hookExecuteSync(...step2.value));
+  return currentIdentity = step2.value;
 }
 function hookInvocation(file, args2) {
   if (win32.basename(file) === "whoami.exe") {
@@ -537,11 +554,13 @@ function hookExecuteSync(file, args2, input) {
   [file, args2] = hookInvocation(file, args2);
   return execFileSync(file, args2, { ...hookOptions(file, args2), input });
 }
-var identityArgs, currentIdentity, ttl, hookOptions;
+var identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, ttl, hookOptions;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
     identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     ttl = 10 * 6e4;
     hookOptions = (file, args2) => ({
       encoding: args2.includes("/u") ? "utf16le" : "utf8",
@@ -2636,7 +2655,7 @@ import { createCliCredentials } from "./auth/credentials.js";
 import { createInterface } from "node:readline";
 import { execFile as execFile3 } from "node:child_process";
 import { lstat as lstat4 } from "node:fs/promises";
-import { basename as basename3, join as join7 } from "node:path";
+import { basename as basename3, join as join8 } from "node:path";
 
 // packages/local-setup/dist/index.js
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -6833,7 +6852,7 @@ init_repositoryRoot();
 
 // packages/local-setup/dist/index.js
 import { realpath, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname5, join as join6 } from "node:path";
+import { basename as basename2, dirname as dirname5, join as join7 } from "node:path";
 
 // packages/local-setup/dist/contracts.js
 var actionRequired = (state) => ({
@@ -7006,6 +7025,100 @@ async function withLock(path, waitMs, work) {
   }
 }
 
+// packages/local-setup/dist/automaticUpdate.js
+import { spawn as nodeSpawn } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { stat as nodeStat, utimes } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var DAY_MS = 864e5;
+var statePath = (stateDir) => join6(stateDir, "automatic-update.json");
+function cliLauncherPath(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir3();
+  return platform === "win32" ? join6(options.env?.LOCALAPPDATA || join6(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join6(home, ".local", "bin", "mnemonik");
+}
+async function readState(path) {
+  const bytes = await readBytes(path);
+  if (!bytes)
+    return {};
+  const value = JSON.parse(bytes.toString());
+  if (!value || typeof value !== "object" || value.lastAttempt !== void 0 && (!Number.isFinite(value.lastAttempt) || value.lastAttempt < 0))
+    throw new Error("automatic_update_state_invalid");
+  return value.lastAttempt === void 0 ? {} : { lastAttempt: value.lastAttempt };
+}
+async function maybeStartAutomaticUpdate(options = {}) {
+  const stateDir = options.stateDir ?? stateDirectory(options.platform, options.env, options.home);
+  const path = statePath(stateDir);
+  try {
+    const now = (options.now ?? Date.now)();
+    const stat = options.stat ?? nodeStat;
+    try {
+      if (now - (await stat(path)).mtimeMs < DAY_MS)
+        return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    if (!options.spawn && !(await stat(cliLauncherPath(options))).isFile())
+      return false;
+    return await withLock(path, 0, async (assertOwned) => {
+      const state = await readState(path);
+      if (state.lastAttempt !== void 0 && now - state.lastAttempt < DAY_MS)
+        return false;
+      await atomicWrite(path, Buffer.from(`${JSON.stringify({ lastAttempt: now })}
+`), void 0, assertOwned);
+      await utimes(path, now / 1e3, now / 1e3);
+      const platform = options.platform ?? process.platform;
+      const launcher = cliLauncherPath(options);
+      const command = platform === "win32" ? {
+        file: options.env?.ComSpec || "cmd.exe",
+        args: ["/d", "/s", "/c", `""${launcher}" update --automatic"`],
+        windowsVerbatimArguments: true
+      } : platform === "linux" && (options.env ?? process.env).INVOCATION_ID ? {
+        // detached creates a process group, not a new systemd cgroup. An
+        // updater spawned by the scanner must survive stopping that service.
+        file: "systemd-run",
+        args: [
+          "--user",
+          "--collect",
+          "--quiet",
+          `--setenv=MNEMONIK_STATE_DIR=${stateDir}`,
+          "--",
+          launcher,
+          "update",
+          "--automatic"
+        ]
+      } : { file: launcher, args: ["update", "--automatic"] };
+      const child = (options.spawn ?? nodeSpawn)(command.file, command.args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        ..."windowsVerbatimArguments" in command ? { windowsVerbatimArguments: command.windowsVerbatimArguments } : {}
+      });
+      child.once("error", () => {
+      });
+      child.unref();
+      return true;
+    });
+  } catch {
+    return false;
+  }
+}
+var HELPER_FLAG = "--mnemonik-automatic-update";
+function isHelperInvocation() {
+  if (process.argv[2] !== HELPER_FLAG || !process.argv[3] || !process.argv[1])
+    return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath2(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isHelperInvocation())
+  void maybeStartAutomaticUpdate({ stateDir: process.argv[3] });
+
 // packages/local-setup/dist/index.js
 var MAX_ORIGINAL_BYTES = 64 * 1024;
 var validDisplayName = (value) => typeof value === "string" && value.length <= 200 && !/[\p{C}\p{Zl}\p{Zp}@]/u.test(value);
@@ -7016,6 +7129,7 @@ var accessResponseHash = (response) => hash2(JSON.stringify({
   allowedActions: [...response.allowedActions].sort(),
   candidates: response.candidates
 }));
+var pristine = (record, diskHash) => !record.remote && !record.staged && !record.steps.remote.started && !record.steps.identity.started && !record.steps.rollback.started && diskHash === record.before.hash;
 var step = (beforeHash) => ({
   complete: false,
   beforeHash,
@@ -7046,7 +7160,7 @@ function createProjectSetupExecutor(deps) {
       if (await realpath(fresh.root) !== root)
         return actionRequired("identity_changed");
       resolution = fresh;
-      const file = join6(root, ".mnemonik.json");
+      const file = join7(root, ".mnemonik.json");
       const bytes = await readBytes(file);
       const diskHash = digest(bytes);
       const saved = await readBytes(path);
@@ -7075,14 +7189,13 @@ function createProjectSetupExecutor(deps) {
           return actionRequired("record_invalid");
         if (record.before.base64 !== null && record.before.hash !== hash2(Buffer.from(record.before.base64, "base64")) || record.before.base64 !== null && Buffer.from(record.before.base64, "base64").length > MAX_ORIGINAL_BYTES || record.staged && hash2(record.staged.content) !== record.staged.hash || record.remote && hash2(JSON.stringify(record.remote)) !== record.steps.remote.afterHash)
           return actionRequired("record_invalid");
-        if (mode === "stage" && record.scopeKey === hash2(deps.scopeKey) && record.steps.identity.complete && !record.steps.rollback.started && resolution.kind === "ok" && resolution.identity.projectId === record.remote?.projectId && (!options.intent || options.intent.projectId === record.remote.projectId)) {
+        if (mode === "stage" && (record.steps.identity.complete && !record.steps.rollback.started && resolution.kind === "ok" && resolution.identity.projectId === record.remote?.projectId && (!options.intent || options.intent.projectId === record.remote.projectId) || record.steps.rollback.complete && diskHash === record.before.hash)) {
           record = freshRecord();
           recordIsNew = true;
         }
         const settled = record.steps.identity.complete && !record.steps.rollback.started && resolution.kind === "ok" && resolution.identity.projectId === record.remote?.projectId && (!options.intent || options.intent.projectId === record.remote?.projectId);
         if (record.scopeKey !== hash2(deps.scopeKey) || options.owner !== void 0 && JSON.stringify(record.owner) !== JSON.stringify(options.owner) || !settled && JSON.stringify(record.intent) !== JSON.stringify(options.intent)) {
-          const replaceable = !record.remote && !record.staged && !record.steps.remote.started && !record.steps.identity.started && !record.steps.rollback.started && diskHash === record.before.hash;
-          if (replaceable) {
+          if (pristine(record, diskHash)) {
             record = freshRecord();
             recordIsNew = true;
           } else {
@@ -7179,10 +7292,15 @@ function createProjectSetupExecutor(deps) {
       }
       if (!resumingWithoutIdentity && record.steps.identity.complete && diskHash !== record.staged?.hash)
         return actionRequired("identity_changed");
+      if (record.evidence && JSON.stringify(record.evidence) !== JSON.stringify(evidence)) {
+        if (!pristine(record, diskHash))
+          return actionRequired("operation_context_changed");
+        const ignored = record.ignored;
+        record = { ...freshRecord(), ...ignored ? { ignored } : {} };
+        recordIsNew = true;
+      }
       if (recordIsNew)
         await save();
-      if (record.evidence && JSON.stringify(record.evidence) !== JSON.stringify(evidence))
-        return actionRequired("operation_context_changed");
       if (record.steps.identity.complete && mode === "ensure" && record.remote) {
         const validated = await deps.transport.issueSetupRequest({
           ...evidence,
@@ -7288,9 +7406,59 @@ function createProjectSetupExecutor(deps) {
     ensureProject: (options) => execute(options, "ensure"),
     stage: (options) => execute(options, "stage"),
     apply: (options) => execute(options, "apply"),
-    rollback: (options) => execute(options, "rollback")
+    rollback: (options) => execute(options, "rollback"),
+    cancel: async (options) => {
+      const resolution = await deps.resolver.resolveProjectIdentity(options.cwd, options);
+      return cancelProjectSetup("root" in resolution ? resolution.root : options.cwd, deps.stateDir, deps.waitMs);
+    }
   };
 }
+async function cancelProjectSetup(folder, stateDir, waitMs = 6e4) {
+  const root = await realpath(folder);
+  const path = recordPath(root, stateDir);
+  return withLock(path, waitMs, async (assertOwned) => {
+    const saved = await readBytes(path);
+    if (!saved)
+      return { status: "cancelled", root, cleared: false, restored: false };
+    let record = null;
+    try {
+      record = JSON.parse(saved.toString());
+    } catch {
+    }
+    let restored = false;
+    const staged = record?.staged;
+    const before = record?.before;
+    const settled = !!record?.steps?.identity?.complete && !record.steps.rollback?.started;
+    if (!settled && staged && before && typeof staged.hash === "string" && staged.hash !== before.hash) {
+      const file = join7(root, ".mnemonik.json");
+      const earlier = typeof before.base64 === "string" ? Buffer.from(before.base64, "base64") : null;
+      if (digest(await readBytes(file)) === staged.hash && (earlier ? hash2(earlier) === before.hash : before.hash === null)) {
+        await assertOwned();
+        if (earlier)
+          await atomicWrite(file, earlier, void 0, assertOwned);
+        else {
+          await unlink2(file);
+          await syncDirectory(root);
+        }
+        restored = true;
+      }
+    }
+    await assertOwned();
+    await unlink2(path).catch((error) => {
+      if (error.code !== "ENOENT")
+        throw error;
+    });
+    await syncDirectory(dirname5(path));
+    const remote = record?.remote?.projectId;
+    return {
+      status: "cancelled",
+      root,
+      cleared: true,
+      restored,
+      ...typeof remote === "string" ? { retainedRemoteUUID: remote } : {}
+    };
+  });
+}
 
 // packages/cli/src/project.ts
 import {
@@ -7306,6 +7474,27 @@ import {
   readExecutorState,
   saveCommandRecord
 } from "./project/records.js";
+var shellWord = (value) => /^[\w@%+=:,./-]+$/u.test(value) ? value : `"${value.replace(/(["\\$`])/gu, "\\$1")}"`;
+function answerCommands(actions, root, details = {}) {
+  const folder = shellWord(root);
+  const linkFlags = (projectId, extra) => `mnemonik project link ${projectId} ${folder}${extra} --non-interactive --apply`;
+  return actions.flatMap((action) => {
+    if (action === "cancel")
+      return [{ action, command: `mnemonik project setup ${folder} --cancel` }];
+    if (action === "rerun_with_apply")
+      return [{ action, command: `mnemonik project setup ${folder} --non-interactive --apply` }];
+    if (action === "link")
+      return (details.candidates ?? []).map((candidate) => ({
+        action,
+        command: linkFlags(candidate.projectId, "")
+      }));
+    if (action === "confirm_mismatch" && details.projectId)
+      return [{ action, command: linkFlags(details.projectId, " --confirm-mismatch") }];
+    if (action === "replace" && details.projectId)
+      return [{ action, command: linkFlags(details.projectId, " --replace") }];
+    return [];
+  });
+}
 async function ensureProjectRoot(root, executor) {
   return executor.ensureProject({ cwd: root, allowCreate: true, allowNestedInherit: false });
 }
@@ -7315,7 +7504,7 @@ var refusalReasons = {
   temporary_directory: "Mnemonik does not index the temporary folder.",
   mnemonik_state_directory: "That folder holds Mnemonik settings.",
   user_data_directory: "That folder holds program settings.",
-  host_config_directory: "That folder holds editor settings.",
+  host_config_directory: "That folder holds coding tool settings.",
   broad_workspace_parent: "It holds several projects, and Mnemonik would index all of them.",
   not_found: "Its project file names a project this account cannot open.",
   project_access_denied: "Its project file names a project this account cannot open.",
@@ -7366,7 +7555,7 @@ var refusalSteps = {
   nested: "Run mnemonik project setup in that folder and choose which project it belongs to.",
   conflict: "Run mnemonik project setup in that folder and choose which project it belongs to.",
   identity_changed: AGAIN,
-  operation_context_changed: "Run mnemonik project setup in that folder to finish that command.",
+  operation_context_changed: "Run mnemonik project setup --cancel in that folder, then run the command again.",
   rollback_in_progress: "Wait for it to finish, then run the command again.",
   operation_rolled_back: "Run mnemonik project setup in that folder to set it up again.",
   not_staged: AGAIN,
@@ -7570,6 +7759,12 @@ function showResult(output, json, result, root, owner, record) {
       ..."candidates" in result && Array.isArray(result.candidates) ? { candidates: result.candidates } : {},
       ..."manualAction" in result ? { manualAction: result.manualAction } : {},
       ..."used" in result && "limit" in result ? { used: result.used, limit: result.limit } : {},
+      ..."allowedActions" in result ? {
+        commands: answerCommands(result.allowedActions, root, {
+          candidates: "candidates" in result && Array.isArray(result.candidates) ? result.candidates : void 0,
+          projectId: record.projectId ?? void 0
+        })
+      } : {},
       root,
       owner: ownerLabel(owner)
     });
@@ -7671,6 +7866,23 @@ async function statusCommand(input, deps) {
   }
   return 0;
 }
+async function cancelCommand(input, deps) {
+  const cwd = input.path ?? deps.cwd;
+  const resolution = await (deps.executor ?? deps.resolver ?? { resolveProjectIdentity }).resolveProjectIdentity(cwd, { allowNestedInherit: false });
+  const result = await cancelProjectSetup(
+    "root" in resolution ? resolution.root : cwd,
+    deps.stateDir
+  );
+  if (input.json) deps.output.json(result);
+  else {
+    const name2 = basename3(result.root);
+    deps.output.line(
+      result.cleared ? `Setup of ${name2} was cancelled.` : `Nothing was waiting for ${name2}.`
+    );
+    if (result.restored) deps.output.line("Its project file is back as it was.");
+  }
+  return 0;
+}
 async function runProjectCommandInner(input, deps, prompts) {
   if (input.command === "status") return statusCommand(input, deps);
   if (!deps.executor)
@@ -7691,7 +7903,7 @@ async function runProjectCommandInner(input, deps, prompts) {
   const cwd = input.path ?? deps.cwd;
   const resolution = await executor.resolveProjectIdentity(cwd);
   if (resolution.kind === "nested" || resolution.kind === "conflict") {
-    const identityLocation = join7(resolution.root, ".mnemonik.json");
+    const identityLocation = join8(resolution.root, ".mnemonik.json");
     if (!input.json) {
       deps.output.line(`Root: ${resolution.root}`);
       deps.output.line(`Identity: ${identityLocation}`);
@@ -7839,7 +8051,7 @@ async function runProjectCommandInner(input, deps, prompts) {
   if (input.command === "init" && !input.nonInteractive && !input.json) {
     if (result.status === "ignored") {
       deps.output.line(`Root: ${decision.root}`);
-      deps.output.line(`Identity: ${join7(decision.root, ".mnemonik.json")}`);
+      deps.output.line(`Identity: ${join8(decision.root, ".mnemonik.json")}`);
       if (await prompts.confirm("Stop ignoring this folder and continue?"))
         result = await executor.ensureProject({ ...base, clearIgnore: true });
     } else if ("allowedActions" in result && result.allowedActions.includes("ignore") && await prompts.confirm("Ignore this folder on this machine?"))
@@ -7848,6 +8060,7 @@ async function runProjectCommandInner(input, deps, prompts) {
   return finish(deps, input, result, decision.root, decision.reason, owner, beforeHash);
 }
 async function runProjectCommand(input, deps) {
+  if (input.cancel) return cancelCommand(input, deps);
   const prompts = new Prompter(deps.input, deps.output);
   try {
     let effective = deps;
@@ -7961,6 +8174,7 @@ async function rollbackProjectIdentity(options) {
   return result.status === "rolled_back" ? 0 : 3;
 }
 export {
+  answerCommands,
   connectedProjectsMessage,
   createRealProjectRuntime,
   ensureProjectForAgent,