@mnemonik/cli 7.140.1 → 7.140.3

package/dist/router.js

@@ -885,6 +885,116 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+function isConfigurationOnly(text) {
+  try {
+    const value = JSON.parse(text);
+    return !!value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1);
+  } catch {
+    return false;
+  }
+}
+async function readIdentityFile(dir, options = {}) {
+  const path = join(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    const text = await readFile(path, "utf8");
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: "absent" };
+    return parseIdentityFile(text);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+    IDENTITY_KEYS = /* @__PURE__ */ new Set([
+      "schemaVersion",
+      "projectId",
+      "projectName",
+      "repositoryFingerprint"
+    ]);
+    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -893,7 +1003,7 @@ var init_hookTimeouts = __esm({
 });
 
 // packages/shared/dist/runtimeSigners.js
-import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
+import { basename, dirname as dirname2, join as join3, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
 function windowsCommand(file) {
   const root = process.env.SystemRoot;
@@ -982,102 +1092,8 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-import { lstat, readFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
-function parseIdentityFile(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return { kind: "malformed", detail: "identity file must contain a JSON object" };
-  }
-  const record = value;
-  if (record.schemaVersion !== 1) {
-    return { kind: "unknown_version", version: record.schemaVersion };
-  }
-  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
-  if (unknownKey)
-    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
-  if (!isCanonicalUuid(record.projectId)) {
-    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
-  }
-  if ("projectName" in record && typeof record.projectName !== "string") {
-    return { kind: "malformed", detail: '"projectName" must be a string when present' };
-  }
-  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
-    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
-  }
-  const fingerprint = record.repositoryFingerprint;
-  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
-  if (unknownFingerprintKey) {
-    return {
-      kind: "malformed",
-      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
-    };
-  }
-  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
-    return {
-      kind: "malformed",
-      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
-    };
-  }
-  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
-  return {
-    kind: "ok",
-    identity: {
-      schemaVersion: 1,
-      projectId: record.projectId,
-      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
-      ...repositoryFingerprint ? { repositoryFingerprint } : {}
-    }
-  };
-}
-async function readIdentityFile(dir, options = {}) {
-  const path = join3(dir, ".mnemonik.json");
-  try {
-    const stat = await lstat(path);
-    if (stat.isSymbolicLink())
-      return { kind: "malformed", detail: "symlink" };
-    if (!stat.isFile())
-      return { kind: "malformed", detail: "identity path is not a regular file" };
-    const text = await readFile(path, "utf8");
-    if (options.selectedRoot) {
-      try {
-        const value = JSON.parse(text);
-        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1))
-          return { kind: "absent" };
-      } catch {
-      }
-    }
-    return parseIdentityFile(text);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return { kind: "absent" };
-    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
-  }
-}
-var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
-    IDENTITY_KEYS = /* @__PURE__ */ new Set([
-      "schemaVersion",
-      "projectId",
-      "projectName",
-      "repositoryFingerprint"
-    ]);
-    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
-import { lstat as lstat2, readFile as readFile2 } from "node:fs/promises";
+import { lstat as lstat2, readFile as readFile2, realpath } from "node:fs/promises";
 import { execFile as execFile2 } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
@@ -1128,7 +1144,7 @@ async function confirmedBoundaryAt(path) {
 async function boundariesBetween(cwd, root) {
   const boundaries = [];
   let directory = cwd;
-  while (directory !== root) {
+  while (!samePath(directory, root)) {
     const boundary = await confirmedBoundaryAt(directory);
     if (boundary)
       boundaries.push(boundary);
@@ -1151,37 +1167,31 @@ async function containingRepository(root) {
     directory = parent;
   }
 }
-async function canonicalBoundaryRoot(boundary) {
-  if (boundary.kind === "directory")
-    return boundary.path;
-  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile2(join4(boundary.path, ".git"), "utf8"))?.[1];
-  if (!pointer)
-    return boundary.path;
-  const gitDir = resolve2(boundary.path, pointer);
-  try {
-    const commonDir = resolve2(gitDir, (await readFile2(join4(gitDir, "commondir"), "utf8")).trim());
-    return dirname3(commonDir);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return boundary.path;
-    throw error;
-  }
+async function canonicalPath(path) {
+  const absolute = resolve2(path);
+  return realpath(absolute).catch(() => absolute);
+}
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 async function resolveRepositoryRoot(cwd) {
-  const absoluteCwd = resolve2(cwd);
+  const absoluteCwd = await canonicalPath(cwd);
   try {
     const { stdout } = await runGit(absoluteCwd, [
       "rev-parse",
       "--show-toplevel",
+      "--git-dir",
       "--git-common-dir"
     ]);
-    const [rootLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
-    if (!rootLine || !commonLine || extra.length) {
+    const [rootLine, gitDirLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
+    if (!rootLine || !gitDirLine || !commonLine || extra.length) {
       return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
     }
-    const root = resolve2(rootLine);
-    const commonDir = resolve2(root, commonLine);
-    const isLinkedWorktree = commonDir !== join4(root, ".git");
+    const fromGit = (line) => canonicalPath(resolve2(absoluteCwd, line));
+    const root = await fromGit(rootLine);
+    const gitDir = await fromGit(gitDirLine);
+    const commonDir = await fromGit(commonLine);
+    const isLinkedWorktree = !samePath(gitDir, commonDir);
     const nested = await boundariesBetween(absoluteCwd, root);
     if (!isLinkedWorktree && await containingRepository(root)) {
       const boundary = await boundaryAt(root);
@@ -1203,14 +1213,41 @@ async function resolveRepositoryRoot(cwd) {
     return { kind: "git_unavailable", detail: failure.message };
   }
 }
+async function linkedWorktreeCommonDir(dir) {
+  try {
+    if (!(await lstat2(join4(dir, ".git"))).isFile())
+      return void 0;
+    const pointer = /^gitdir:\s*(.+?)\s*$/im.exec(await readFile2(join4(dir, ".git"), "utf8"))?.[1];
+    if (!pointer)
+      return void 0;
+    const gitDir = resolve2(dir, pointer);
+    const common = (await readFile2(join4(gitDir, "commondir"), "utf8")).trim();
+    return common ? await canonicalPath(resolve2(gitDir, common)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function mainCheckout(worktreeTop, commonDir) {
+  try {
+    const { stdout } = await runGit(worktreeTop, ["worktree", "list", "--porcelain"]);
+    const first = stdout.split(/\r?\n\r?\n/)[0] ?? "";
+    const path = /^worktree (.+)$/m.exec(first)?.[1];
+    if (path) {
+      const main = await canonicalPath(resolve2(worktreeTop, path));
+      return /^bare$/m.test(first) ? dirname3(main) : main;
+    }
+  } catch {
+  }
+  return dirname3(commonDir);
+}
 async function readPlainIdentity(start2) {
-  const home = resolve2(homedir());
+  const home = await canonicalPath(homedir());
   let directory = start2;
   while (true) {
-    const result = await readIdentityFile(directory);
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
     if (result.kind !== "absent")
       return { root: directory, result };
-    if (directory === home)
+    if (samePath(directory, home))
       break;
     const parent = dirname3(directory);
     if (parent === directory)
@@ -1219,58 +1256,72 @@ async function readPlainIdentity(start2) {
   }
   return { root: start2, result: { kind: "absent" } };
 }
+async function nearestIdentity(start2) {
+  const home = await canonicalPath(homedir());
+  let directory = start2;
+  while (true) {
+    const commonDir = await linkedWorktreeCommonDir(directory);
+    if (commonDir)
+      return { worktreeTop: directory, commonDir };
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (samePath(directory, home))
+      return void 0;
+    const parent = dirname3(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function resolveNearestProjectIdentity(cwd) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const nested = repository.kind === "git" ? repository.nested : [];
+  let found = await nearestIdentity(start2);
+  if (found && "worktreeTop" in found) {
+    found = await readPlainIdentity(await mainCheckout(found.worktreeTop, found.commonDir));
+  }
+  if (found) {
+    return shapedIdentity(found, await projectFolderRepository(found.root, repository), nested);
+  }
+  return { ...withBase(repository, repository.root, nested), kind: "absent" };
+}
+async function resolveNamedProjectIdentity(cwd, options) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const commonDir = await linkedWorktreeCommonDir(start2);
+  const root = commonDir ? await mainCheckout(start2, commonDir) : start2;
+  return shapedIdentity({ root, result: await readIdentityFile(root, options) }, await projectFolderRepository(root, repository), repository.kind === "git" ? repository.nested : []);
+}
+function shapedIdentity(found, repository, nested) {
+  const base = withBase(repository, found.root, nested);
+  if (found.result.kind === "ok")
+    return { ...base, ...found.result };
+  if (found.result.kind === "unknown_version")
+    return { ...base, ...found.result, path: found.root };
+  if (found.result.kind === "malformed")
+    return { ...base, ...found.result, path: found.root };
+  return { ...base, kind: "absent" };
+}
+async function projectFolderRepository(projectRoot, known) {
+  if (known.kind === "git" && samePath(known.root, projectRoot))
+    return known;
+  const repository = await resolveRepositoryRoot(projectRoot);
+  if (repository.kind === "git" && samePath(repository.root, projectRoot))
+    return repository;
+  return { kind: "plain", root: projectRoot };
+}
 function withBase(repository, root, nested) {
   return { root, repository, nested };
 }
 async function resolveProjectIdentity(cwd, options = {}) {
-  const resolved = await resolveRepositoryRoot(cwd);
-  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: resolve2(cwd) } : resolved;
-  if (repository.kind === "plain") {
-    const { root, result } = options.selectedRoot ? { root: repository.root, result: await readIdentityFile(repository.root, options) } : await readPlainIdentity(repository.root);
-    const base2 = withBase(repository, root, []);
-    if (result.kind === "ok")
-      return { ...base2, ...result };
-    if (result.kind === "unknown_version")
-      return { ...base2, ...result, path: root };
-    if (result.kind === "malformed")
-      return { ...base2, ...result, path: root };
-    return { ...base2, kind: "absent" };
-  }
-  const ownRoot = repository.isLinkedWorktree ? dirname3(repository.commonDir) : repository.root;
-  const outer = repository.isLinkedWorktree ? void 0 : await containingRepository(repository.root);
-  const own = await readIdentityFile(ownRoot, options);
-  if (!outer || options.selectedRoot || own.kind === "ok") {
-    const base2 = withBase(repository, ownRoot, repository.nested);
-    if (own.kind === "ok")
-      return { ...base2, ...own };
-    if (own.kind === "unknown_version")
-      return { ...base2, ...own, path: ownRoot };
-    if (own.kind === "malformed")
-      return { ...base2, ...own, path: ownRoot };
-    return { ...base2, kind: "absent" };
-  }
-  const nested = repository.nested;
-  const parentRoot = await canonicalBoundaryRoot(outer);
-  const parent = await readIdentityFile(parentRoot);
-  const base = withBase(repository, parentRoot, nested);
-  if (own.kind === "unknown_version")
-    return { ...base, ...own, path: ownRoot };
-  if (own.kind === "malformed")
-    return { ...base, ...own, path: ownRoot };
-  if (parent.kind === "unknown_version")
-    return { ...base, ...parent, path: parentRoot };
-  if (parent.kind === "malformed")
-    return { ...base, ...parent, path: parentRoot };
-  if (!options.allowNestedInherit) {
-    return {
-      ...base,
-      kind: "nested",
-      ...parent.kind === "ok" ? { parentIdentity: parent.identity } : {}
-    };
+  if (options.selectedRoot || options.namedRoot) {
+    return resolveNamedProjectIdentity(cwd, { selectedRoot: options.selectedRoot });
   }
-  if (parent.kind === "ok")
-    return { ...base, kind: "ok", identity: parent.identity };
-  return { ...base, kind: "absent" };
+  return resolveNearestProjectIdentity(cwd);
 }
 var GIT_TIMEOUT_MS, GIT_ENV_KEYS;
 var init_repositoryRoot = __esm({
@@ -1291,6 +1342,23 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+function hookTraceEnabled(env = process.env) {
+  const value = env[HOOK_TRACE_ENV]?.trim().toLowerCase();
+  return !value || !["off", "0", "false", "no", "disabled"].includes(value);
+}
+var HOOK_TRACE_MAX_BYTES, HOOK_TRACE_ENV;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+    HOOK_TRACE_ENV = "MNEMONIK_HOOK_TRACE";
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1362,10 +1430,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2953,6 +3023,7 @@ import {
   humanIdentityState,
   INTERRUPTED_INSTALL,
   INTERRUPTED_INSTALL_MESSAGE,
+  REGISTRY_FAILURE,
   approvalMessage,
   knownReason,
   SCANNER_APPROVAL_ACTION,
@@ -2985,7 +3056,7 @@ import {
 } from "./scanner/service.js";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -3022,6 +3093,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -7067,9 +7141,9 @@ var Query = class {
 };
 
 // packages/shared/dist/ast/grammars.js
-import { dirname, extname, join } from "node:path";
+import { dirname, extname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
-var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
+var WASM_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
@@ -7247,6 +7321,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -7262,6 +7337,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/shared/dist/readiness.js
 var READINESS_SCHEMA_VERSION = 1;
@@ -7689,6 +7765,7 @@ public class MnemonikCredential {
 }`.replace(/\n\s*/gu, " ");
 
 // packages/cli/src/router.ts
+init_hookRuntime();
 import {
   runHosts,
   hostSource,
@@ -7697,9 +7774,15 @@ import {
   selectOwned
 } from "./install/hosts.js";
 import { hostOrder, launchHostLabels } from "./install/adapters.js";
+import {
+  hookActivityLines,
+  hooksLog,
+  invocationLine,
+  tracedHosts
+} from "./hooksLog.js";
 import { readInstallVersions } from "./install/ownership.js";
 import { ensureLauncher, removeLauncher, LauncherError } from "./launcher.js";
-import { readFile as readFile4, realpath } from "node:fs/promises";
+import { readFile as readFile4, realpath as realpath2 } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import {
   RuntimeStore,
@@ -7718,6 +7801,8 @@ import {
   createRealProjectRuntime,
   ensureProjectRoot,
   ensureProjectForAgent,
+  insideProjectLine,
+  projectFolderFor,
   folderRefusalMessage,
   projectLimitMessage,
   runProjectCommand
@@ -7928,10 +8013,13 @@ function scannerConsentRequired(output, json, agent) {
   else for (const line of approvalLines("scanner_consent_required", agent)) output.line(line);
   return 3;
 }
+var hostTargetFailed = (target) => target.status !== "READY" && target.reason !== "codex_trust_pending";
 function hostUpdateFailed(result) {
-  return result.results.some(
-    (target) => target.status !== "READY" && target.reason !== "codex_trust_pending"
-  );
+  return result.results.some(hostTargetFailed);
+}
+function registryFailure(hostError, results) {
+  const reasons = hostError !== void 0 ? [hostError] : results.filter(hostTargetFailed).map((target) => target.reason);
+  return reasons.length > 0 && reasons.every((reason) => REGISTRY_FAILURE.test(reason)) ? reasons[0] : void 0;
 }
 var updateFailureMessage = "Mnemonik could not update. It will try again automatically tomorrow.";
 var booleans = /* @__PURE__ */ new Set([
@@ -7955,7 +8043,8 @@ var booleans = /* @__PURE__ */ new Set([
   "automatic",
   "cancel",
   "retry",
-  "skip"
+  "skip",
+  "follow"
 ]);
 var values = /* @__PURE__ */ new Set([
   "components",
@@ -7967,7 +8056,8 @@ var values = /* @__PURE__ */ new Set([
   "rollback",
   "out",
   "project",
-  "exclusions"
+  "exclusions",
+  "last"
 ]);
 var help = helpScreen([]) ?? "";
 function parse(args2) {
@@ -8411,7 +8501,11 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
             output.error(INTERRUPTED_INSTALL_MESSAGE.sentence);
             output.error(INTERRUPTED_INSTALL_MESSAGE.nextStep);
           } else if (hostError === "lock_held") output.error(humanReason(hostError));
-          else output.error("Run mnemonik repair, then start a new session in each coding tool.");
+          else {
+            const registry = registryFailure(hostError, result.results);
+            if (registry) for (const line of humanReport(registry).split("\n")) output.error(line);
+            else output.error("Run mnemonik repair, then start a new session in each coding tool.");
+          }
         }
         if (scanner?.status === "FAILED") {
           output.error(scannerRecovery?.message ?? "The scanner could not update.");
@@ -8614,7 +8708,7 @@ async function enableCommand(parsed, deps, output) {
   if (!present && !roots)
     return actionRequired2(output, json, "Supply --scan-roots with approved roots", "--scan-roots");
   for (const folder of [...roots ?? [], ...exclusions ?? []]) {
-    const failure = await realpath(folder).then(
+    const failure = await realpath2(folder).then(
       () => void 0,
       (error) => folderFailure(error.code, folder)
     );
@@ -8808,6 +8902,12 @@ async function doctorCommand(parsed, deps, output) {
   else {
     renderPreflight(result, output);
     renderStatusSummaries(document, output, { diagnostics: true });
+    for (const line of await hookActivityLines(
+      deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home),
+      deps.hooksLog?.now?.() ?? Date.now(),
+      deps.hooksLog?.alive
+    ).catch(() => []))
+      output.line(line);
     if (document.installation.reasons.some(
       (reason) => reason === "scanner_failing" || reason === "scanner_signed_out"
     ))
@@ -8894,7 +8994,7 @@ async function deleteProjectCommand(parsed, rest, deps, output) {
   const json = parsed.flags.has("json");
   const cwd = deps.cwd ?? process.cwd();
   const resolve3 = deps.projectResolver?.resolveProjectIdentity ?? resolveProjectIdentity;
-  const here = await resolve3(cwd, { allowNestedInherit: false });
+  const here = await resolve3(cwd);
   const hereId = here.kind === "ok" ? here.identity.projectId : void 0;
   const root = "root" in here ? here.root : cwd;
   const target = rest[0] ?? hereId;
@@ -9064,8 +9164,13 @@ async function runCli(args2, deps = {}) {
     if ((action === "add" || action === "remove") && !personPresent(parsed, deps) && !parsed.flags.has("apply"))
       return actionRequired2(output, parsed.flags.has("json"), "Rerun with --apply", "--apply");
     const pathArgument = actionArguments[0] ?? "";
-    const requested = action === "add" ? await realpath(pathArgument) : saved.config.roots.find((root) => root === pathArgument) ?? pathArgument;
+    const named = action === "add" ? await realpath2(pathArgument) : saved.config.roots.find((root) => root === pathArgument) ?? pathArgument;
+    const requested = action === "add" ? await projectFolderFor(named, deps.projectExecutor ?? { resolveProjectIdentity }) : named;
     const name2 = requested.split(/[\\/]/u).filter(Boolean).at(-1) ?? requested;
+    if (requested !== named && !parsed.flags.has("json"))
+      output.line(
+        insideProjectLine(named.split(/[\\/]/u).filter(Boolean).at(-1) ?? named, requested)
+      );
     if (action === "add" && saved.config.roots.includes(requested)) {
       if (parsed.flags.has("json")) output.json(saved.config.roots);
       else output.line(alreadyConnectedFolderLine(name2));
@@ -9088,7 +9193,7 @@ async function runCli(args2, deps = {}) {
           getCliBearer: async () => bearer,
           fetch: deps.grantFetch
         })).executor;
-      const resolution = await executor.resolveProjectIdentity(requested);
+      const resolution = await executor.resolveProjectIdentity(requested, { namedRoot: true });
       const decision = await evaluateRoot(resolution, { cwd: requested, home: deps.home });
       if (!decision.allowed) {
         if (parsed.flags.has("json")) return actionRequired2(output, true, decision.reason);
@@ -9392,6 +9497,59 @@ Preview: ${preview.path}
       return 1;
     }
   }
+  if (command === "hooks") {
+    const invalid = allowed(parsed, ["host", "last", "follow"]);
+    if (invalid) return flagError(output, parsed, invalid);
+    if (subcommand !== "log") return usageError(["hooks"]);
+    if (rest.length) return argumentError(["hooks", "log"], ["hooks", "log"], rest, 0);
+    const host = parsed.flags.get("host");
+    if (host !== void 0 && !tracedHosts.includes(host))
+      return usageFailure(
+        output,
+        parsed,
+        { reason: "invalid_value", path: ["hooks", "log"], detail: String(host) },
+        `Unknown coding tool: ${String(host)}. Use claude-code, codex, cursor or copilot.`
+      );
+    const lastFlag = parsed.flags.get("last");
+    const last = lastFlag === void 0 ? 20 : Number(lastFlag);
+    if (!Number.isInteger(last) || last < 1 || last > 1e4)
+      return usageFailure(
+        output,
+        parsed,
+        { reason: "invalid_value", path: ["hooks", "log"], detail: String(lastFlag) },
+        "--last takes a whole number from 1 to 10000."
+      );
+    const json = parsed.flags.has("json");
+    const follow = parsed.flags.has("follow");
+    const stop2 = new AbortController();
+    const interrupt = () => stop2.abort();
+    if (follow && !deps.hooksLog?.signal) process.once("SIGINT", interrupt);
+    try {
+      const shown = await hooksLog({
+        stateDir: deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home),
+        hosts: host ? [host] : void 0,
+        alive: deps.hooksLog?.alive,
+        now: deps.hooksLog?.now,
+        last,
+        follow: follow && {
+          signal: deps.hooksLog?.signal ?? stop2.signal,
+          pollMs: deps.hooksLog?.pollMs
+        },
+        print: (invocation) => {
+          if (json && follow) output.json(invocation);
+          else if (!json) output.line(invocationLine(invocation));
+        }
+      });
+      if (json && !follow) output.json({ invocations: shown });
+      else if (!json && !shown.length && !follow)
+        output.line(
+          hookTraceEnabled(process.env) ? "No hook runs were found in this machine's Mnemonik state folder." : "No hook runs were found in this machine's Mnemonik state folder. MNEMONIK_HOOK_TRACE=off is set here, so hooks started from this environment record nothing."
+        );
+    } finally {
+      process.removeListener("SIGINT", interrupt);
+    }
+    return 0;
+  }
   if (command === "status") {
     const invalid = allowed(parsed, []);
     if (invalid || subcommand)