@raidiant/notifai 8.0.0 → 9.0.0

package/src/commands.test.ts

@@ -63,17 +63,26 @@ import {
 import {
   applyPlan,
   buildHookConfig,
+  hookCommand,
   codexHookIdentityHash,
   codexTrustKey,
   findInstallations,
+  handlerEvent,
+  settingsFile,
 } from './install-hooks.js'
 import { readSessionState, writeProjectSession, writeSessionState } from './hooks.js'
 import { nativeSkills as realNativeSkills, type NativeSkill, type NativeSkills, type SkillScope } from './native-skills.js'
 import { CONFIG_KEYS, loadConfig, personalProjectConfigPath, stateDir } from './config.js'
-import { createLogger, logsDiskUsage, readLogRecords } from './logging.js'
+import { SETUP_PROOF_STALE_MS, writeSetupProof } from './commands-setup-proof.js'
+import { resetLatestPublishedCliVersionForTest } from './cli-release.js'
+import { activeLogPath, createLogger, logsDiskUsage, readLogRecords } from './logging.js'
 import { hookAdapterPath, inspectHookAdapter } from './hook-adapter.js'
 import type { Tone } from './ui/theme.js'
 
+afterEach(() => {
+  resetLatestPublishedCliVersionForTest()
+})
+
 /**
  * The release tag this build pins the agent skill to.
  *
@@ -328,6 +337,7 @@ function makeDeps(io: CapturedIo, client: ApiClient): CommandDeps {
     hookAdapterHome: path.join(testRoot, 'home'),
     cwd: os.tmpdir(),
     clientFactory: () => withCompatibilityDefaults(client),
+    fetchImpl: async () => new Response('{}', { status: 503 }),
   }
 }
 
@@ -382,6 +392,8 @@ const reply: ReplyView = {
   device_id: 'dev_test',
   device_name: 'iPhone',
   text: 'yes, after the migration',
+  answers: [],
+  source: null,
   created_at: '2026-08-01T18:01:00.000Z',
 }
 
@@ -573,6 +585,108 @@ describe('command contracts', () => {
     expect(io.errLines.join('\n')).toContain('project')
   })
 
+  it('prints the exact idempotency key needed after an ambiguous submit failure', async () => {
+    const io = new CapturedIo()
+    let attemptedKey = ''
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        attemptedKey = body.idempotency_key
+        throw new NetworkError('Connection closed before a response arrived')
+      },
+    } as unknown as ApiClient
+
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-send-attempt-'))
+    const deps = makeDeps(io, client)
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    deps.logger = createLogger({ env: deps.env, cmd: 'send' })
+    expect(
+      await sendCommand(deps, {
+        kind: 'done',
+        title: 'Checks finished',
+        body: 'All checks passed.',
+      }),
+    ).toBe(EXIT.network)
+
+    expect(attemptedKey).toMatch(/^cli-/)
+    expect(io.errLines.join('\n')).toContain(`--idempotency-key ${attemptedKey}`)
+    expect(
+      readLogRecords(deps.env, { event: ['send.attempt'] }).records.at(-1)?.data,
+    ).toMatchObject({
+      idempotency_key: attemptedKey,
+      kind: 'done',
+      title_chars: 'Checks finished'.length,
+      session_id: null,
+    })
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  it('prints the same generated key for an ambiguous server failure', async () => {
+    const io = new CapturedIo()
+    let attemptedKey = ''
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        attemptedKey = body.idempotency_key
+        throw new ApiCallError(503, 'temporarily_unavailable', 'Try again later.')
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'failed',
+        title: 'Validation could not finish',
+        body: 'The service failed while accepting the result.',
+      }),
+    ).toBe(EXIT.network)
+    expect(io.errLines.join('\n')).toContain(`--idempotency-key ${attemptedKey}`)
+  })
+
+  it('routes a send with no active Companion devices into the setup coordinator', async () => {
+    const io = new CapturedIo()
+    let attemptedKey = ''
+    const client = {
+      submit: async (body: SubmitNotificationRequestT) => {
+        attemptedKey = body.idempotency_key
+        throw new ApiCallError(
+          409,
+          'no_active_devices',
+          'No enabled active Device Installation can receive this request.',
+          'Open the Companion App and enable notifications.',
+        )
+      },
+    } as unknown as ApiClient
+
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'done',
+        title: 'Checks finished',
+        body: 'All checks passed.',
+      }),
+    ).toBe(EXIT.failed)
+
+    expect(io.errLines.join('\n')).toMatch(/next:.*`notifai init`.*Companion/i)
+    expect(io.errLines.join('\n')).toContain(`--idempotency-key ${attemptedKey}`)
+    expect(io.errLines.join('\n')).toMatch(/verification request does not replace this Agent Event/i)
+  })
+
+  it('routes a send from an unpaired machine into the same setup coordinator', async () => {
+    const io = new CapturedIo()
+    const deps = makeDeps(io, {} as ApiClient)
+    deps.store.load = () => null
+
+    expect(
+      await sendCommand(deps, {
+        kind: 'done',
+        title: 'Checks finished',
+        body: 'All checks passed.',
+      }),
+    ).toBe(EXIT.auth)
+
+    expect(io.errLines.join('\n')).toMatch(/`notifai init`.*login.*device setup/i)
+  })
+
   it('authors and validates an Android-specific Notification Request', async () => {
     const io = new CapturedIo()
     let submitted: SubmitNotificationRequestT | undefined
@@ -1209,8 +1323,11 @@ describe('command contracts', () => {
       request_id: receipt.request_id,
       sequence: reply.seq,
       device: reply.device_name,
-      text: reply.text,
+      text_chars: reply.text.length,
+      answers_count: reply.answers.length,
     })
+    const raw = readFileSync(activeLogPath(deps.env), 'utf8')
+    expect(raw).not.toContain(reply.text)
   })
 
   it('backs off and retries a transient network error while waiting', async () => {
@@ -1501,6 +1618,10 @@ describe('command contracts', () => {
       'acknowledgement.attempted',
       'acknowledgement.outcome',
     ])
+    const raw = readFileSync(activeLogPath(deps.env), 'utf8')
+    expect(raw).not.toContain('I will deploy staging now.')
+    expect(events[0]?.data).toMatchObject({ characters: 'I will deploy staging now.'.length })
+    expect(events[1]?.data).toMatchObject({ text_chars: 'I will deploy staging now.'.length })
   })
 
   it('clears a matching active-session obligation after acknowledgement success', async () => {
@@ -1719,6 +1840,113 @@ describe('command contracts', () => {
     })
   })
 
+  it('close --pending withdraws an unpushed registration so a later Stop cannot send it', async () => {
+    const io = new CapturedIo()
+    const client = {
+      closeReplies: async () => {
+        throw new Error('unpushed questions must not call the server')
+      },
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-close-unpushed-'))
+    deps.cwd = root
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    writeSessionState('close-unpushed', deps.env, {
+      pending: [{ question: 'Ship it?', question_id: 'q_local' }],
+    })
+    writeProjectSession(root, deps.env, 'close-unpushed', Date.now(), 'codex')
+
+    expect(await closeCommand(deps, undefined, { pending: true, json: true })).toBe(EXIT.ok)
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
+      session_id: 'close-unpushed',
+      withdrawn: [{ question: 'Ship it?', question_id: 'q_local' }],
+      closed: [],
+    })
+    expect(readSessionState('close-unpushed', deps.env).pending).toBeUndefined()
+  })
+
+  it('close withdraws one unpushed question by the ask id', async () => {
+    const io = new CapturedIo()
+    const client = {
+      closeReplies: async () => {
+        throw new Error('unpushed questions must not call the server')
+      },
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-close-one-unpushed-'))
+    deps.cwd = root
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    writeSessionState('close-one', deps.env, {
+      pending: [
+        { question: 'Ship it?', question_id: 'q_local' },
+        { question: 'Keep this?', question_id: 'q_keep' },
+      ],
+    })
+    writeProjectSession(root, deps.env, 'close-one', Date.now(), 'codex')
+
+    expect(await closeCommand(deps, 'q_local', { json: true })).toBe(EXIT.ok)
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toEqual({
+      session_id: 'close-one',
+      withdrawn: [{ question: 'Ship it?', question_id: 'q_local' }],
+      closed: [],
+    })
+    expect(readSessionState('close-one', deps.env).pending?.map((entry) => entry.question_id)).toEqual([
+      'q_keep',
+    ])
+  })
+
+  it('close --pending closes live questions and leaves nothing for a later Stop to push', async () => {
+    const io = new CapturedIo()
+    const closed: string[] = []
+    const client = {
+      closeReplies: async (requestId: string) => {
+        closed.push(requestId)
+        return replyResponse([])
+      },
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-close-pending-mix-'))
+    deps.cwd = root
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    writeSessionState('close-mix', deps.env, {
+      pending: [
+        { question: 'Unpushed?', question_id: 'q_local' },
+        {
+          question: 'Already on a device?',
+          request_id: receipt.request_id,
+          collapse_key: 'question-live',
+          device_ids: ['dev_iphone'],
+        },
+      ],
+    })
+    writeProjectSession(root, deps.env, 'close-mix', Date.now(), 'codex')
+
+    expect(await closeCommand(deps, undefined, { pending: true, json: true })).toBe(EXIT.ok)
+    expect(closed).toEqual([receipt.request_id])
+    expect(JSON.parse(io.outLines[0] ?? '{}')).toMatchObject({
+      session_id: 'close-mix',
+      withdrawn: [{ question: 'Unpushed?', question_id: 'q_local' }],
+      closed: [receipt.request_id],
+    })
+    expect(readSessionState('close-mix', deps.env).pending).toBeUndefined()
+  })
+
+  it('close requires a request id or --pending', async () => {
+    const io = new CapturedIo()
+    const client = {} as unknown as ApiClient
+    expect(await closeCommand(makeDeps(io, client), undefined, {})).toBe(EXIT.usage)
+    expect(io.errLines.join('\n')).toContain('Pass a request id or --pending.')
+  })
+
   it('passes the replies cursor and prints replies for later retrieval', async () => {
     const io = new CapturedIo()
     let requested: { waitSeconds: number; afterSeq: number } | undefined
@@ -1797,8 +2025,9 @@ describe('command contracts', () => {
     writeProjectSession(root, deps.env, 'pending-multi', Date.now(), 'codex')
 
     expect(await repliesCommand(deps, undefined, { pending: true })).toBe(EXIT.ok)
-    expect(io.outLines[0]).toBe('pending request req_first')
-    expect(io.outLines[1]).toContain('yes, after the migration')
+    expect(io.outLines[0]).toBe('unpushed question: Not yet asked?')
+    expect(io.outLines.join('\n')).toContain('pending request req_first')
+    expect(io.outLines.join('\n')).toContain('yes, after the migration')
     expect(io.outLines.join('\n')).toContain('req_second')
   })
 
@@ -1995,13 +2224,188 @@ describe('command contracts', () => {
   })
 })
 
+describe('credential origin pinning', () => {
+  it('never sends the machine bearer to a flag or env origin override', async () => {
+    const io = new CapturedIo()
+    const seen: { baseUrl: string; bearer: string | null }[] = []
+    const client = {
+      submit: async () => receipt,
+    } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    deps.env = { ...deps.env, NOTIFAI_BASE_URL: 'https://attacker.example' }
+    deps.clientFactory = (baseUrl, bearer) => {
+      seen.push({ baseUrl, bearer })
+      return withCompatibilityDefaults(client)
+    }
+
+    expect(
+      await sendCommand(deps, {
+        kind: 'update',
+        title: 'T',
+        body: 'B',
+        baseUrl: 'https://attacker.flag',
+      }),
+    ).toBe(EXIT.ok)
+
+    expect(seen).toEqual([
+      {
+        baseUrl: 'https://test.notifai.invalid',
+        bearer: 'Bearer nfm_mac_test.test-secret',
+      },
+    ])
+    expect(io.errLines.join('\n')).toContain('Ignoring base_url from flag')
+    expect(io.errLines.join('\n')).not.toContain('test-secret')
+    expect(io.errLines.join('\n')).not.toContain('nfm_')
+    expect(io.errLines.join('\n')).not.toContain('https://attacker.example')
+    expect(io.errLines.join('\n')).not.toContain('https://attacker.flag')
+  })
+
+  it('lets unsigned-in login target an origin override', async () => {
+    const io = new CapturedIo()
+    const seen: { baseUrl: string; bearer: string | null }[] = []
+    let beginBody: Parameters<ApiClient['beginPairing']>[0] | null = null
+    let now = 0
+    const client = {
+      beginPairing: async (body: Parameters<ApiClient['beginPairing']>[0]) => {
+        beginBody = body
+        return {
+          pairing_id: 'pair_test',
+          code: 'ABCD-EFGH',
+          approve_url: 'https://selfhost.example/pair/ABCD-EFGH',
+          expires_at: new Date(10_000).toISOString(),
+          poll_interval_seconds: 1,
+        }
+      },
+      pollPairing: async () => ({ status: 'approved', machine_id: 'mac_new' }),
+    } as unknown as ApiClient
+    const saved: { baseUrl?: string } = {}
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      now: () => now,
+      sleep: async (milliseconds: number) => {
+        now += milliseconds
+      },
+      store: {
+        load: () => null,
+        save: (credential) => {
+          saved.baseUrl = credential.baseUrl
+        },
+        clear: () => {},
+        describe: () => 'test credential store',
+      },
+      clientFactory: (baseUrl, bearer) => {
+        seen.push({ baseUrl, bearer })
+        return withCompatibilityDefaults(client)
+      },
+    }
+
+    expect(await loginCommand(deps, { baseUrl: 'https://selfhost.example', open: false })).toBe(
+      EXIT.ok,
+    )
+    expect(seen[0]).toEqual({ baseUrl: 'https://selfhost.example', bearer: null })
+    expect(saved.baseUrl).toBe('https://selfhost.example')
+    expect(beginBody).toMatchObject({
+      machine_name: expect.any(String),
+      credential_hash: expect.stringMatching(/^[a-f0-9]{64}$/),
+      poll_verifier_hash: expect.stringMatching(/^[a-f0-9]{64}$/),
+      confirmation_hash: expect.stringMatching(/^[a-f0-9]{64}$/),
+    })
+    expect(io.outLines[1]).toMatch(
+      /^Approve this machine at: https:\/\/selfhost\.example\/pair\/ABCD-EFGH#confirmation_secret=[A-Za-z0-9_-]{43}$/,
+    )
+  })
+
+  it('stops login when the approving account has no product access', async () => {
+    const io = new CapturedIo()
+    let now = 0
+    const client = {
+      beginPairing: async () => ({
+        pairing_id: 'pair_test',
+        code: 'ABCD-EFGH',
+        approve_url: 'https://app.notifai.sh/pair/ABCD-EFGH',
+        expires_at: new Date(10_000).toISOString(),
+        poll_interval_seconds: 1,
+      }),
+      pollPairing: async () => ({
+        status: 'no_active_plan',
+        next_action: 'Ask the account owner for Alpha access.',
+      }),
+    } as unknown as ApiClient
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      now: () => now,
+      sleep: async (milliseconds: number) => {
+        now += milliseconds
+      },
+    }
+
+    expect(await loginCommand(deps, { open: false })).toBe(EXIT.auth)
+    expect(io.errLines).toEqual([
+      'This account has no active plan or temporary Alpha access.',
+      'next: Ask the account owner for Alpha access.',
+      'After access is granted, run `notifai login` again.',
+    ])
+  })
+
+  it('keeps notification titles out of send logs', async () => {
+    const io = new CapturedIo()
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-send-log-'))
+    const client = { submit: async () => receipt } as unknown as ApiClient
+    const deps = makeDeps(io, client)
+    deps.env = {
+      XDG_CONFIG_HOME: path.join(root, 'config'),
+      XDG_STATE_HOME: path.join(root, 'state'),
+    }
+    deps.logger = createLogger({ env: deps.env, cmd: 'send', settings: { level: 'debug' } })
+
+    expect(
+      await sendCommand(deps, {
+        kind: 'update',
+        title: 'SECRET_SEND_TITLE',
+        body: 'SECRET_SEND_BODY',
+      }),
+    ).toBe(EXIT.ok)
+    const raw = readFileSync(activeLogPath(deps.env), 'utf8')
+    expect(raw).not.toContain('SECRET_SEND_TITLE')
+    expect(raw).not.toContain('SECRET_SEND_BODY')
+    const submitted = readLogRecords(deps.env, { event: ['send.submitted'] }).records
+    expect(submitted[0]?.data).toMatchObject({
+      request_id: receipt.request_id,
+      title_chars: 'SECRET_SEND_TITLE'.length,
+    })
+  })
+
+  it('refuses a shell-escaped backslash-n body unless the literal flag is set', async () => {
+    const io = new CapturedIo()
+    expect(
+      await sendCommand(makeDeps(io, {} as ApiClient), {
+        kind: 'update',
+        title: 'Escaped',
+        body: 'line1\\nline2',
+      }),
+    ).toBe(EXIT.usage)
+    expect(io.errLines.join('\n')).toContain('--body-file -')
+    expect(io.errLines.join('\n')).toContain('--literal-backslash-n')
+
+    io.errLines = []
+    const client = { submit: async () => receipt } as unknown as ApiClient
+    expect(
+      await sendCommand(makeDeps(io, client), {
+        kind: 'update',
+        title: 'Escaped',
+        body: 'line1\\nline2',
+        literalBackslashN: true,
+      }),
+    ).toBe(EXIT.ok)
+  })
+})
+
 describe('delivery evidence status', () => {
   function snapshot(
     companionReceipt: EvidenceSnapshot['deliveries'][number]['companion_receipt'],
   ): EvidenceSnapshot {
     return {
       request_id: 'req_status_test',
-      event: 'tests_passed',
       accepted_at: '2026-08-05T13:05:48.000Z',
       overall: 'provider_accepted_all',
       deliveries: [
@@ -2097,6 +2501,53 @@ describe('delivery evidence status', () => {
     expect(said).toContain('Reply received: yes')
     expect(said).toContain('answers are on the server')
   })
+
+  it('treats an ordinary status Companion Receipt as doctor delivery proof', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-status-proof-'))
+    const evidence = snapshot({
+      state: 'observed',
+      observed_at: '2026-08-05T13:17:17.000Z',
+      latency_ms: 1_000,
+    })
+    const device = {
+      device_id: evidence.deliveries[0]!.device_id,
+      display_name: 'iPhone',
+      platform: 'ios' as const,
+      permission_status: 'authorized',
+      registration_healthy: true,
+      app_version: '0.1.0',
+      app_build: '42',
+      os_version: '19.0',
+      capabilities: ['answer'] as const,
+      support: currentSupport,
+      support_state: 'current' as const,
+      derived_status: 'working' as const,
+      status_message: null,
+      last_seen_at: '2026-08-05T18:00:00.000Z',
+    }
+    const client = {
+      health: async () => true,
+      listDevices: async () => ({ devices: [device] }),
+      accessStatus: async () => ({
+        status: 'active',
+        reason: 'alpha_grant',
+        expires_at: null,
+        email: 'proof@example.com',
+      }),
+      evidence: async () => evidence,
+    } as unknown as ApiClient
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, client), cwd, env: isolatedEnv(cwd) }
+
+    expect(await statusCommand(deps, evidence.request_id, { json: true })).toBe(EXIT.ok)
+
+    const doctorIo = new CapturedIo()
+    expect(await doctorCommand({ ...deps, io: doctorIo }, { json: true })).toBe(EXIT.ok)
+    const report = JSON.parse(doctorIo.outLines.join('\n')) as {
+      states: { id: string; status: string }[]
+    }
+    expect(report.states.find((state) => state.id === 'proof')).toMatchObject({ status: 'ready' })
+  })
 })
 
 describe('Cursor hook commands', () => {
@@ -2122,12 +2573,17 @@ describe('Cursor hook commands', () => {
     expect(Object.keys(installed.hooks).sort()).toEqual([
       'beforeSubmitPrompt',
       'sessionEnd',
+      'sessionStart',
       'stop',
     ])
     expect(installed.hooks['beforeSubmitPrompt']?.[0]?.command).toContain(
       'hook user-prompt-submit --owner notifai --harness cursor',
     )
     expect(installed.hooks['stop']?.[0]).toMatchObject({
+      command: expect.stringContaining('hook activation-stop --owner notifai --harness cursor'),
+      loop_limit: 1,
+    })
+    expect(installed.hooks['stop']?.[1]).toMatchObject({
       command: expect.stringContaining('hook stop --owner notifai --harness cursor'),
       loop_limit: 3,
     })
@@ -2163,7 +2619,7 @@ describe('Cursor hook commands', () => {
     expect(io.outLines).toContain(
       `ok    Question routing: cursor project (${path.join(cwd, '.cursor', 'hooks.json')})`,
     )
-    expect(io.outLines.some((line) => line.includes('Cursor: send one prompt'))).toBe(true)
+    expect(io.outLines.some((line) => line.includes('Cursor: start one fresh conversation'))).toBe(true)
   })
 
   it('uninstalls only Notifai Cursor hooks and preserves foreign hooks', () => {
@@ -2242,13 +2698,7 @@ describe('Codex hook representation', () => {
     expect(io.outLines.join('\n')).toMatch(/Stop and the existing one will both fire/i)
   })
 
-  /**
-   * The foreign `hooks.json` stays byte-identical and Notifai lands inline.
-   * Codex will now warn that the layer uses both representations; the install
-   * output says why, because that warning is Codex reporting a merge, not a
-   * fault, and a silent one would read as Notifai's bug.
-   */
-  it('leaves a foreign hooks.json alone and installs inline instead', () => {
+  it('joins a populated hooks.json without introducing a second representation', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-json-install-'))
     const layer = path.join(cwd, '.codex')
     const json = path.join(layer, 'hooks.json')
@@ -2266,17 +2716,12 @@ describe('Codex hook representation', () => {
 
     expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
 
-    const beforeJson = readFileSync(json, 'utf8')
-    expect(beforeJson).toContain('gdh-stop')
-    expect(beforeJson).not.toContain('--owner notifai')
-    const after = readFileSync(toml, 'utf8')
-    // The user's file arrives back as the file they wrote, plus our hooks.
-    expect(after).toContain(beforeToml.trimEnd())
-    expect(after).toContain('--owner notifai')
-    expect(io.outLines.join('\n')).toContain(toml)
-    expect(io.outLines.join('\n')).toMatch(/Notifai will not modify it/)
-    expect(io.outLines.join('\n')).toMatch(/not a Notifai fault/)
-    expect(io.outLines.join('\n')).not.toMatch(/installed in both/i)
+    const afterJson = readFileSync(json, 'utf8')
+    expect(afterJson).toContain('gdh-stop')
+    expect(afterJson).toContain('--owner notifai')
+    expect(readFileSync(toml, 'utf8')).toBe(beforeToml)
+    expect(io.outLines.join('\n')).toContain(json)
+    expect(io.outLines.join('\n')).not.toMatch(/both representations|not a Notifai fault/i)
   })
 
   it('leaves config.toml byte-identical when uninstall finds no Notifai hooks', () => {
@@ -2293,7 +2738,51 @@ describe('Codex hook representation', () => {
     expect(io.outLines.join('\n')).toContain('No Notifai hooks found')
   })
 
-  /**
+  it('leaves config.toml byte-identical on a no-op reinstall', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-noop-install-'))
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    const toml = path.join(cwd, '.codex', 'config.toml')
+    const before = readFileSync(toml, 'utf8')
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(readFileSync(toml, 'utf8')).toBe(before)
+  })
+
+  it('deletes an emptied hooks.json instead of leaving an empty residue', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-empty-json-'))
+    const layer = path.join(cwd, '.codex')
+    const json = path.join(layer, 'hooks.json')
+    mkdirSync(layer, { recursive: true })
+    applyPlan(json, {
+      hooks: {
+        Stop: [{ hooks: [{ type: 'command', command: hookCommand(scriptPath, 'stop', 'codex') }] }],
+      },
+    })
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksUninstallCommand(deps, { harness: 'codex', scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(json)).toBe(false)
+  })
+
+  it('global install does not leave a dead project .codex after uninstalling that layer', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-global-migrate-'))
+    const io = new CapturedIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.codex'))).toBe(true)
+    expect(hooksInstallCommand(deps, { harness: 'codex', global: true, execPath, scriptPath })).toBe(
+      EXIT.ok,
+    )
+    expect(existsSync(path.join(cwd, '.codex', 'hooks.json'))).toBe(false)
+    const leftover = existsSync(path.join(cwd, '.codex'))
+      ? readdirSync(path.join(cwd, '.codex'))
+      : []
+    expect(leftover.every((name) => name !== 'hooks.json')).toBe(true)
+  })
+
+  /**
    * Notifai in one file, someone else's hooks in the other: every handler
    * fires once, so doctor has nothing to report and the foreign file is not
    * ours to rewrite. Doctor used to fail here — the check read "two files" as
@@ -2386,7 +2875,7 @@ describe('harness activation guidance', () => {
   const execPath = process.execPath
   const scriptPath = fileURLToPath(import.meta.url)
 
-  it('does not require a Claude Code restart for project hook files', () => {
+  it('requires a fresh Claude Code session so SessionStart can activate it', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-claude-activation-'))
     const io = new CapturedIo()
     const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
@@ -2397,11 +2886,11 @@ describe('harness activation guidance', () => {
 
     const output = io.outLines.join('\n')
     expect(output).toContain('Installed claude-code hooks in')
-    expect(output).toContain('Send one Claude Code prompt, then check `notifai doctor`.')
+    expect(output).toContain('Start one fresh Claude Code session, send one prompt, then run `notifai doctor`.')
     expect(output).not.toMatch(/timeout|asynchronous|600s/i)
   })
 
-  it('does not invent a Codex hook trust gate', () => {
+  it('names Codex trust and fresh-session activation in the correct order', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-activation-'))
     const io = new CapturedIo()
     const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
@@ -2411,8 +2900,8 @@ describe('harness activation guidance', () => {
     )
 
     const output = io.outLines.join('\n')
-    expect(output).toContain('Send one Codex prompt, then check `notifai doctor`.')
-    expect(output).not.toMatch(/trust|approve/i)
+    expect(output).toContain('Approve the Notifai handlers in `/hooks` if Codex asks')
+    expect(output).toMatch(/approve[\s\S]*start one fresh Codex session[\s\S]*`notifai doctor`/i)
   })
 
   it('names the installed harness in the close, never a different one', () => {
@@ -2424,7 +2913,7 @@ describe('harness activation guidance', () => {
 
     const output = io.outLines.join('\n')
     expect(output).toContain('Installed cursor hooks in')
-    expect(output).toContain('Send one Cursor prompt, then check `notifai doctor`.')
+    expect(output).toContain('Start one fresh Cursor conversation, send one prompt, finish its first turn, then run `notifai doctor`.')
     expect(output).not.toMatch(/Codex|Claude Code|OpenCode/)
     expect(output).not.toMatch(/timeout|worktree|fails closed/i)
   })
@@ -2487,7 +2976,7 @@ describe('harness activation guidance', () => {
     )
 
     expect(io.outLines.join('\n')).toContain('Installed opencode hooks in')
-    expect(io.outLines.join('\n')).toContain('Send one OpenCode prompt, then check `notifai doctor`.')
+    expect(io.outLines.join('\n')).toContain('Restart OpenCode, start one fresh session, send one prompt, then run `notifai doctor`.')
     expect(io.outLines.join('\n')).not.toMatch(/Permission prompts|exactly-once continuation/)
     const pluginFile = path.join(cwd, '.opencode', 'plugins', 'notifai.js')
     const plugin = readFileSync(pluginFile, 'utf8')
@@ -2632,6 +3121,141 @@ describe('stable hook installation', () => {
       findInstallations(cwd, env, deps.hookAdapterHome).filter((item) => item.harness === 'codex'),
     ).toEqual([expect.objectContaining({ global: true })])
   })
+
+  it('refreshes stale global lifecycle coverage instead of declining a project install', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-stale-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, {
+        harness: 'cursor',
+        global: true,
+        execPath,
+        scriptPath,
+      }),
+    ).toBe(EXIT.ok)
+    const globalFile = settingsFile('cursor', true, cwd, env)
+    const settings = JSON.parse(readFileSync(globalFile, 'utf8')) as {
+      hooks: { stop: Array<{ command?: string }> }
+    }
+    settings.hooks.stop = settings.hooks.stop.filter(
+      (handler) => !handler.command?.includes(' hook activation-stop '),
+    )
+    writeFileSync(globalFile, `${JSON.stringify(settings, null, 2)}\n`)
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'cursor', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.cursor', 'hooks.json'))).toBe(false)
+    const installation = findInstallations(cwd, env, deps.hookAdapterHome).find(
+      (item) => item.harness === 'cursor' && item.global,
+    )
+    expect(installation?.handlers.map((handler) => handlerEvent(handler.command))).toContain(
+      'activation-stop',
+    )
+    expect(io.outLines.join('\n')).toMatch(/Installed cursor hooks/)
+  })
+
+  it('refreshes a stale global Stop shape instead of declining a project install', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-shape-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, {
+        harness: 'cursor',
+        global: true,
+        execPath,
+        scriptPath,
+      }),
+    ).toBe(EXIT.ok)
+    const globalFile = settingsFile('cursor', true, cwd, env)
+    const settings = JSON.parse(readFileSync(globalFile, 'utf8')) as {
+      hooks: { stop: Array<{ command?: string; timeout?: number }> }
+    }
+    const stop = settings.hooks.stop.find((handler) => handler.command?.includes(' hook stop '))
+    expect(stop).toBeDefined()
+    stop!.timeout = 1
+    writeFileSync(globalFile, `${JSON.stringify(settings, null, 2)}\n`)
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'cursor', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.cursor', 'hooks.json'))).toBe(false)
+    const refreshed = JSON.parse(readFileSync(globalFile, 'utf8')) as {
+      hooks: { stop: Array<{ command?: string; timeout?: number }> }
+    }
+    expect(
+      refreshed.hooks.stop.find((handler) => handler.command?.includes(' hook stop '))?.timeout,
+    ).toBeGreaterThan(1)
+    expect(io.outLines.join('\n')).toMatch(/Installed cursor hooks/)
+  })
+
+  it('consolidates duplicate global Codex representations before declining a project install', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-codex-duplicate-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, { harness: 'codex', global: true, execPath, scriptPath }),
+    ).toBe(EXIT.ok)
+    const json = path.join(env.CODEX_HOME!, 'hooks.json')
+    applyPlan(json, {
+      hooks: {
+        ...buildHookConfig({ adapterPath: hookAdapterPath(deps.hookAdapterHome), harness: 'codex' }),
+        PostToolUse: [{ hooks: [{ type: 'command', command: 'foreign-post-tool' }] }],
+      },
+    })
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'codex', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.codex', 'config.toml'))).toBe(false)
+    expect(readFileSync(json, 'utf8')).toContain('foreign-post-tool')
+    expect(readFileSync(json, 'utf8')).not.toContain('--owner notifai')
+    expect(
+      findInstallations(cwd, env, deps.hookAdapterHome).filter(
+        (installation) => installation.harness === 'codex',
+      ),
+    ).toEqual([expect.objectContaining({ global: true })])
+    expect(io.outLines.join('\n')).toMatch(/Installed codex hooks/)
+  })
+
+  it('refreshes an obsolete global OpenCode plugin instead of treating empty event requirements as coverage', () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-hooks-global-opencode-stale-'))
+    const io = new CapturedIo()
+    const env = isolatedEnv(cwd)
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env }
+    const execPath = process.execPath
+    const scriptPath = fileURLToPath(import.meta.url)
+
+    expect(
+      hooksInstallCommand(deps, {
+        harness: 'opencode',
+        global: true,
+        execPath,
+        scriptPath,
+      }),
+    ).toBe(EXIT.ok)
+    const globalFile = settingsFile('opencode', true, cwd, env)
+    const current = readFileSync(globalFile, 'utf8')
+    writeFileSync(globalFile, current.replace('const ADAPTER_VERSION = 10', 'const ADAPTER_VERSION = 8'))
+
+    io.outLines = []
+    expect(hooksInstallCommand(deps, { harness: 'opencode', execPath, scriptPath })).toBe(EXIT.ok)
+    expect(existsSync(path.join(cwd, '.opencode', 'plugins', 'notifai.js'))).toBe(false)
+    const refreshed = readFileSync(globalFile, 'utf8')
+    expect(refreshed).toContain('const ADAPTER_VERSION = 10')
+    expect(refreshed).toContain('experimental.chat.system.transform')
+    expect(io.outLines.join('\n')).toMatch(/Installed opencode hooks/)
+  })
 })
 
 describe('projectSlugFrom', () => {
@@ -2967,7 +3591,7 @@ describe('interactive command UX', () => {
       beginPairing: async () => ({
         pairing_id: 'pair_test',
         code: 'ABCD-EFGH',
-        approve_url: 'https://test.notifai.invalid/pair/ABCD-EFGH',
+        approve_url: 'https://app.notifai.sh/pair/ABCD-EFGH',
         expires_at: new Date(10_000).toISOString(),
         poll_interval_seconds: 1,
       }),
@@ -2997,7 +3621,9 @@ describe('interactive command UX', () => {
     expect(io.notes).toEqual([
       {
         title: 'Approve this machine',
-        message: 'Code: ABCD-EFGH\nhttps://test.notifai.invalid/pair/ABCD-EFGH',
+        message: expect.stringMatching(
+          /^Code: ABCD-EFGH\nhttps:\/\/app\.notifai\.sh\/pair\/ABCD-EFGH#confirmation_secret=[A-Za-z0-9_-]{43}$/,
+        ),
       },
     ])
     expect(io.spinnerEvents).toEqual([
@@ -3016,7 +3642,7 @@ describe('interactive command UX', () => {
       beginPairing: async () => ({
         pairing_id: 'pair_test',
         code: 'ABCD-EFGH',
-        approve_url: 'https://test.notifai.invalid/pair/ABCD-EFGH',
+        approve_url: 'https://app.notifai.sh/pair/ABCD-EFGH',
         expires_at: new Date(10_000).toISOString(),
         poll_interval_seconds: 1,
       }),
@@ -3033,7 +3659,9 @@ describe('interactive command UX', () => {
     expect(await loginCommand(deps, { open: false })).toBe(EXIT.ok)
     expect(io.outLines.slice(0, 3)).toEqual([
       'Pairing code: ABCD-EFGH',
-      'Approve this machine at: https://test.notifai.invalid/pair/ABCD-EFGH',
+      expect.stringMatching(
+        /^Approve this machine at: https:\/\/app\.notifai\.sh\/pair\/ABCD-EFGH#confirmation_secret=[A-Za-z0-9_-]{43}$/,
+      ),
       'Waiting for approval…',
     ])
   })
@@ -3174,6 +3802,26 @@ describe('interactive command UX', () => {
     expect(io.intros).toEqual([])
     expect(io.checks).toEqual([])
   })
+
+  it('consults npm latest from an interactive doctor without failing the run', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-doctor-registry-'))
+    const io = new InteractiveIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+    } as unknown as ApiClient
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      cwd,
+      env: isolatedEnv(cwd),
+      store: { load: () => null, save: () => {}, clear: () => {}, describe: () => 'empty store' },
+      fetchImpl: async () => new Response(JSON.stringify({ latest: '99.0.0' }), { status: 200 }),
+    }
+
+    expect(await doctorCommand(deps, {})).toBe(EXIT.failed)
+    expect(io.outLines).toContain('A newer Notifai is available.')
+    expect(io.outLines).toContain('npm install -g @raidiant/notifai')
+  })
 })
 
 describe('compatibility-first update guidance', () => {
@@ -3421,7 +4069,6 @@ describe('init', () => {
   ): EvidenceSnapshot {
     return {
       request_id: requestId,
-      event: 'setup_verified',
       accepted_at: '2026-08-05T18:00:00.000Z',
       overall: 'provider_accepted_all',
       deliveries: [
@@ -3659,18 +4306,22 @@ describe('init', () => {
     } as unknown as ApiClient
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async (scope) => ({
-        skills: [
-          {
-            name: 'notifai',
-            scope,
-            path: path.join(cwd, '.agents', 'skills', 'notifai'),
-            source: 'Raidiant-io/notifai',
-            sourceType: 'github',
-            sourceUrl: 'https://github.com/Raidiant-io/notifai.git',
-            ref: RELEASE_REF,
-          },
-        ],
+        skills:
+          scope === 'project'
+            ? [
+                {
+                  name: 'notifai',
+                  scope,
+                  path: path.join(cwd, '.agents', 'skills', 'notifai'),
+                  source: 'Raidiant-io/notifai',
+                  sourceType: 'github',
+                  sourceUrl: 'https://github.com/Raidiant-io/notifai.git',
+                  ref: RELEASE_REF,
+                },
+              ]
+            : [],
       }),
     }
     const readiness = await assessReadiness(
@@ -3696,9 +4347,10 @@ describe('init', () => {
       const calls: SkillScope[] = []
       const nativeSkills: NativeSkills = {
         add: async () => 0,
+        remove: async () => 0,
         list: async (selected) => {
           calls.push(selected)
-          return { skills: [managedSkill(selected, cwd)] }
+          return { skills: selected === scope ? [managedSkill(selected, cwd)] : [] }
         },
       }
 
@@ -3710,7 +4362,7 @@ describe('init', () => {
         status: 'ready',
         detail: `installed from ${SKILLS_SOURCE} in the ${scope} scope`,
       })
-      expect(calls).toEqual([scope])
+      expect(calls).toEqual(['project', 'global'])
     },
   )
 
@@ -3726,8 +4378,12 @@ describe('init', () => {
       } as unknown as ApiClient
       const nativeSkills: NativeSkills = {
         add: async () => 0,
+        remove: async () => 0,
         list: async (selected) => ({
-          skills: [{ ...managedSkill(selected, cwd), source: null, sourceType: null, ref: null }],
+          skills:
+            selected === scope
+              ? [{ ...managedSkill(selected, cwd), source: null, sourceType: null, ref: null }]
+              : [],
         }),
       }
 
@@ -3742,6 +4398,192 @@ describe('init', () => {
     },
   )
 
+  it('reports a duplicate notifai skill across project and global scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'assess-skill-duplicate-'))
+    const io = new CapturedIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [] }),
+    } as unknown as ApiClient
+    const nativeSkills: NativeSkills = {
+      add: async () => 0,
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: [
+          {
+            ...managedSkill(scope, cwd),
+            ref: scope === 'project' ? RELEASE_REF : 'v0.2.1',
+            path:
+              scope === 'project'
+                ? path.join(cwd, '.agents', 'skills', 'notifai')
+                : path.join(cwd, 'home', '.agents', 'skills', 'notifai'),
+          },
+        ],
+      }),
+    }
+
+    const readiness = await assessReadiness({ ...makeDeps(io, client), cwd, nativeSkills })
+    const skill = readiness.states.find((state) => state.id === 'skill')
+    expect(skill).toMatchObject({
+      status: 'gap',
+      detail: `project (${RELEASE_REF}) and global (v0.2.1) are both installed, so the harness lists both. Keep either project or global and uninstall the other.`,
+      technical: {
+        project: {
+          ref: RELEASE_REF,
+          path: path.join(cwd, '.agents', 'skills', 'notifai'),
+          current: true,
+        },
+        global: {
+          ref: 'v0.2.1',
+          path: path.join(cwd, 'home', '.agents', 'skills', 'notifai'),
+          current: false,
+        },
+        resolution: 'both-listed',
+      },
+    })
+
+    expect(await doctorCommand({ ...makeDeps(io, client), cwd, nativeSkills }, { json: true })).toBe(
+      EXIT.failed,
+    )
+    const payload = JSON.parse(io.outLines[0] ?? '{}') as {
+      ok: boolean
+      states: Array<{ id: string; status: string; detail: string }>
+    }
+    expect(payload.ok).toBe(false)
+    expect(payload.states.find((state) => state.id === 'skill')).toMatchObject({
+      status: 'gap',
+      detail: expect.stringContaining('harness lists both'),
+    })
+  })
+
+  it('does not treat a current pin as ready when a stale duplicate is also installed', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'assess-skill-shadow-'))
+    const io = new CapturedIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [] }),
+    } as unknown as ApiClient
+    const nativeSkills: NativeSkills = {
+      add: async () => 0,
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: [
+          {
+            ...managedSkill(scope, cwd),
+            ref: scope === 'global' ? RELEASE_REF : 'v0.2.1',
+          },
+        ],
+      }),
+    }
+
+    const readiness = await assessReadiness(
+      { ...makeDeps(io, client), cwd, nativeSkills },
+      { skillScope: 'global' },
+    )
+    expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
+      status: 'gap',
+      detail: `project (v0.2.1) and global (${RELEASE_REF}) are both installed, so the harness lists both. Keep either project or global and uninstall the other.`,
+    })
+  })
+
+  it('uninstalls the other skill scope before installing the chosen one', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-duplicate-prevented-'))
+    const io = new CapturedIo()
+    const removed: SkillScope[] = []
+    const added: Array<SkillScope | undefined> = []
+    let globalPresent = true
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        added.push(options.scope)
+        return 0
+      },
+      remove: async (options) => {
+        removed.push(options.scope)
+        if (options.scope === 'global') globalPresent = false
+        return 0
+      },
+      list: async (scope) => ({
+        skills: scope === 'global' && globalPresent ? [{ ...managedSkill('global', cwd), ref: 'v0.2.1' }] : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        setupScope: 'project',
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(removed).toEqual(['global'])
+    expect(added).toEqual(['project'])
+  })
+
+  it('clears a pre-existing skill duplicate by keeping the chosen setup scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-duplicate-clear-'))
+    const io = new CapturedIo()
+    const removed: SkillScope[] = []
+    const present = new Set<SkillScope>(['project', 'global'])
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        if (options.scope !== undefined) present.add(options.scope)
+        return 0
+      },
+      remove: async (options) => {
+        removed.push(options.scope)
+        present.delete(options.scope)
+        return 0
+      },
+      list: async (scope) => ({
+        skills: present.has(scope)
+          ? [
+              {
+                ...managedSkill(scope, cwd),
+                ref: scope === 'project' ? RELEASE_REF : 'v0.2.1',
+              },
+            ]
+          : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        setupScope: 'project',
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(removed).toEqual(['global'])
+    expect([...present]).toEqual(['project'])
+  })
+
+  it('updates the existing skill scope instead of adding a second copy', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-update-existing-'))
+    const io = new InteractiveIo()
+    const received: Array<SkillScope | undefined> = []
+    const installed = true
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        received.push(options.scope)
+        return 0
+      },
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: installed && scope === 'global' ? [{ ...managedSkill('global', cwd), ref: 'v0.2.1' }] : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(received).toEqual(['global'])
+    expect(io.outLines.join('\n')).toContain('global scope')
+  })
+
   it('requires an explicit skill scope before unattended installation', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-scope-required-'))
     const io = new CapturedIo()
@@ -3751,6 +4593,7 @@ describe('init', () => {
         addCalls += 1
         return 0
       },
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
 
@@ -3758,7 +4601,7 @@ describe('init', () => {
       EXIT.usage,
     )
     expect(addCalls).toBe(0)
-    expect(io.errLines.join('\n')).toContain('--skills-scope project')
+    expect(io.errLines.join('\n')).toContain('--setup-scope project')
   })
 
   it('rejects an invalid unattended skill scope instead of guessing', async () => {
@@ -3786,6 +4629,7 @@ describe('init', () => {
           installed = true
           return 0
         },
+        remove: async () => 0,
         list: async (selected) => ({
           skills: installed && selected === scope ? [managedSkill(scope, cwd)] : [],
         }),
@@ -3802,27 +4646,82 @@ describe('init', () => {
     },
   )
 
-  it('lets the native interactive flow choose scope and resumes after cancellation', async () => {
-    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-cancelled-'))
+  it('asks one setup-scope question and passes that scope to the native installer', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-skill-setup-scope-ask-'))
     const io = new InteractiveIo()
+    io.selectAnswer = 'project'
     const calls: { submit: number } = { submit: 0 }
-    let receivedScope: SkillScope | undefined = 'global'
+    let receivedScope: SkillScope | undefined
     const nativeSkills: NativeSkills = {
       add: async (options) => {
         receivedScope = options.scope
         return 0
       },
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
 
     expect(await initCommand(setupReadyDeps(io, cwd, nativeSkills, calls), { skills: true, hooks: false })).toBe(
       EXIT.ok,
     )
-    expect(receivedScope).toBeUndefined()
+    expect(io.prompts[0]).toContain('this project only, or to every project on this machine')
+    expect(receivedScope).toBe('project')
     expect(calls.submit).toBe(1)
     expect(io.outLines.join('\n')).toContain('All set.')
   })
 
+  it('accepts --setup-scope as the unattended skill, hooks, and config scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-setup-scope-flag-'))
+    const io = new CapturedIo()
+    let receivedScope: SkillScope | undefined
+    const nativeSkills: NativeSkills = {
+      add: async (options) => {
+        receivedScope = options.scope
+        return 0
+      },
+      remove: async () => 0,
+      list: async (scope) => ({
+        skills: receivedScope === scope ? [managedSkill(scope, cwd)] : [],
+      }),
+    }
+
+    expect(
+      await initCommand(setupReadyDeps(io, cwd, nativeSkills, { submit: 0 }), {
+        skills: true,
+        setupScope: 'project',
+        hooks: false,
+      }),
+    ).toBe(EXIT.ok)
+    expect(receivedScope).toBe('project')
+    expect(existsSync(path.join(cwd, '.notifai', 'config.toml'))).toBe(true)
+  })
+
+  it('stamps project identity outside the repo when setup-scope is global', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-setup-scope-global-config-'))
+    const io = new CapturedIo()
+    const deps: CommandDeps = {
+      ...makeDeps(io, {} as ApiClient),
+      cwd,
+      env: isolatedEnv(cwd),
+      store: { load: () => null, save: () => {}, clear: () => {}, describe: () => 'empty store' },
+    }
+
+    expect(await initCommand(deps, { setupScope: 'global', skills: false, hooks: false })).toBe(EXIT.failed)
+    expect(existsSync(path.join(cwd, '.notifai', 'config.toml'))).toBe(false)
+    expect(readFileSync(personalProjectConfigPath(cwd, deps.env), 'utf8')).toMatch(/project = "/)
+  })
+
+  it('rejects disagreeing --setup-scope and --skills-scope', async () => {
+    const io = new CapturedIo()
+    expect(
+      await initCommand(
+        { ...makeDeps(io, {} as ApiClient), cwd: mkdtempSync(path.join(os.tmpdir(), 'init-scope-conflict-')) },
+        { skills: true, setupScope: 'project', skillsScope: 'global' },
+      ),
+    ).toBe(EXIT.usage)
+    expect(io.errLines.join('\n')).toContain('disagree')
+  })
+
   it('installs every detected project harness when --hooks is set', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-hooks-all-detected-'))
     mkdirSync(path.join(cwd, '.claude'))
@@ -3831,6 +4730,7 @@ describe('init', () => {
     const calls = { submit: 0 }
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
     const deps = setupReadyDeps(io, cwd, nativeSkills, calls)
@@ -3855,6 +4755,7 @@ describe('init', () => {
     const calls = { submit: 0 }
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
     const deps = setupReadyDeps(io, cwd, nativeSkills, calls)
@@ -3872,6 +4773,7 @@ describe('init', () => {
     const calls: { submit: number } = { submit: 0 }
     const nativeSkills: NativeSkills = {
       add: async () => 1,
+      remove: async () => 0,
       list: async () => ({ skills: [] }),
     }
 
@@ -4012,6 +4914,7 @@ describe('init', () => {
       nativeSkills: {
         list: async () => ({ skills: [] }),
         add: async () => 0,
+        remove: async () => 0,
       } satisfies NativeSkills,
     }
 
@@ -4109,7 +5012,7 @@ describe('init', () => {
     )
     expect(io.outLines.join('\n')).toContain('All set.')
     expect(submitCalls).toBe(1)
-    expect(submittedDraft?.draft.event).toBe('setup_verified')
+    expect(submittedDraft?.draft).not.toHaveProperty('event')
     expect(submittedDraft?.draft.targets).toEqual({ mode: 'selected', device_ids: ['dev_iphone'] })
 
     io.outLines = []
@@ -4267,6 +5170,52 @@ describe('init', () => {
     expect(io.outLines.join('\n')).toContain('All set.')
   })
 
+  it('replaces a stale unknown setup proof instead of rechecking it forever', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-proof-stale-'))
+    const io = new CapturedIo()
+    let submitCalls = 0
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [readyIphone] }),
+      submit: async () => {
+        submitCalls += 1
+        return setupReceipt('req_fresh')
+      },
+      evidence: async (requestId: string) =>
+        setupEvidence(
+          requestId,
+          requestId === 'req_fresh'
+            ? {
+                state: 'observed',
+                observed_at: '2026-08-25T00:00:02.000Z',
+                latency_ms: 1_000,
+              }
+            : { state: 'unknown', observed_at: null, latency_ms: null },
+        ),
+    } as unknown as ApiClient
+    const now = Date.parse('2026-08-25T00:00:00.000Z')
+    mkdirSync(path.join(cwd, '.notifai'), { recursive: true })
+    writeFileSync(path.join(cwd, '.notifai', 'config.toml'), 'project = "stale-proof"\n')
+    const deps: CommandDeps = {
+      ...makeDeps(io, client),
+      cwd,
+      env: isolatedEnv(cwd),
+      now: () => now,
+    }
+    writeSetupProof(deps, {
+      request_id: 'req_old',
+      device_id: readyIphone.device_id,
+      project: 'stale-proof',
+      started_at: new Date(now - SETUP_PROOF_STALE_MS - 1).toISOString(),
+    })
+
+    expect(await initCommand(deps, { hooks: false, skills: false })).toBe(EXIT.ok)
+    expect(submitCalls).toBe(1)
+    expect(io.outLines.join('\n')).toContain('older than 24h without a Companion Receipt')
+    expect(io.outLines.join('\n')).toContain('All set.')
+  })
+
   it('reports a proof-state write failure instead of crashing or sending twice', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-proof-unwritable-'))
     const io = new CapturedIo()
@@ -4386,42 +5335,6 @@ describe('init', () => {
     )
   })
 
-  it('stops login when the approval page reports no Alpha access', async () => {
-    const io = new CapturedIo()
-    let now = 0
-    let polls = 0
-    const client = {
-      beginPairing: async () => ({
-        pairing_id: 'pair_no_plan',
-        code: 'NOPE-PLAN',
-        approve_url: 'https://test.notifai.invalid/approve?code=NOPE-PLAN',
-        expires_at: new Date(60_000).toISOString(),
-        poll_interval_seconds: 1,
-      }),
-      pollPairing: async () => {
-        polls += 1
-        return {
-          status: 'no_active_plan' as const,
-          next_action: 'Open https://test.notifai.invalid/support to request Alpha access, then retry.',
-        }
-      },
-    } as unknown as ApiClient
-    const deps = {
-      ...makeDeps(io, client),
-      now: () => now,
-      sleep: async (milliseconds: number) => {
-        now += milliseconds
-      },
-    }
-
-    expect(await loginCommand(deps, { open: false })).toBe(EXIT.auth)
-    expect(polls).toBe(1)
-    expect(io.errLines.join('\n')).toContain('no active plan or temporary Alpha access')
-    expect(io.errLines.join('\n')).toContain(
-      'Open https://test.notifai.invalid/support to request Alpha access, then retry.',
-    )
-  })
-
   it('treats a revoked credential as the one blocker and points back to pairing', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'init-revoked-'))
     const io = new CapturedIo()
@@ -4600,6 +5513,54 @@ describe('readiness assessment cost', () => {
       detail: `installed from ${SKILLS_SOURCE} in the project scope`,
     })
   })
+
+  it('detects a lock-file duplicate across project and global scope', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'assess-lock-skill-duplicate-'))
+    const env = { ...isolatedEnv(cwd), PATH: '/nonexistent' }
+    writeFileSync(
+      path.join(cwd, 'skills-lock.json'),
+      `${JSON.stringify({
+        skills: {
+          notifai: {
+            source: 'Raidiant-io/notifai',
+            sourceType: 'github',
+            ref: RELEASE_REF,
+          },
+        },
+      })}\n`,
+    )
+    mkdirSync(path.join(env.XDG_STATE_HOME!, 'skills'), { recursive: true })
+    writeFileSync(
+      path.join(env.XDG_STATE_HOME!, 'skills', '.skill-lock.json'),
+      `${JSON.stringify({
+        skills: {
+          notifai: {
+            source: 'Raidiant-io/notifai',
+            sourceType: 'github',
+            ref: 'v0.2.1',
+          },
+        },
+      })}\n`,
+    )
+    const io = new CapturedIo()
+    const client = {
+      health: async () => true,
+      capabilities: async () => ({ schema_version: 1, platform: 'ios' }),
+      listDevices: async () => ({ devices: [] }),
+    } as unknown as ApiClient
+
+    const readiness = await assessReadiness({
+      ...makeDeps(io, client),
+      cwd,
+      env,
+      nativeSkills: realNativeSkills,
+    })
+    expect(readiness.states.find((state) => state.id === 'skill')).toMatchObject({
+      status: 'gap',
+      detail: `project (${RELEASE_REF}) and global (v0.2.1) are both installed, so the harness lists both. Keep either project or global and uninstall the other.`,
+      technical: { resolution: 'both-listed' },
+    })
+  })
 })
 
 describe('an outage is not an answer', () => {
@@ -4800,9 +5761,7 @@ describe('asking before the hooks have ever run', () => {
     io.outLines = []
 
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.ok)
-    expect(io.outLines).toContain(
-      'Question registered. Ask it in the conversation, state the concrete work you will resume when the answer arrives, then end your turn.',
-    )
+    expect(io.outLines.some((line) => line.startsWith('Question registered (q_'))).toBe(true)
     expect(readSessionState('codex-current-thread', env).pending?.[0]?.source).toMatchObject({
       session_id: 'codex-current-thread',
       harness: 'codex',
@@ -5024,7 +5983,7 @@ describe('asking before the hooks have ever run', () => {
     const fired = readiness.states.find((state) => state.id === 'hooks-fired')
     expect(fired?.status).toBe('optional-gap')
     expect(fired?.detail).toMatch(/Claude Code/)
-    expect(fired?.detail).toMatch(/Codex: send one prompt/)
+    expect(fired?.detail).toMatch(/Codex: approve[\s\S]*start one fresh session/i)
 
     io.errLines = []
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.usage)
@@ -5144,6 +6103,7 @@ describe('asking before the hooks have ever run', () => {
     } as unknown as ApiClient
     const nativeSkills: NativeSkills = {
       add: async () => 0,
+      remove: async () => 0,
       list: async (scope) => ({
         skills:
           scope === 'global'
@@ -5447,6 +6407,28 @@ describe('asking before the hooks have ever run', () => {
     expect(io.outLines.join('\n')).toMatch(/ok\s+Turn\-end hook shape/)
   })
 
+  it('diagnoses an older hook install that lacks proactive lifecycle handlers', async () => {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-doctor-missing-lifecycle-'))
+    const io = new PlainInteractiveIo()
+    const deps = { ...makeDeps(io, {} as ApiClient), cwd, env: isolatedEnv(cwd) }
+    expect(hooksInstallCommand(deps, { harness: 'claude-code', execPath, scriptPath })).toBe(
+      EXIT.ok,
+    )
+    const settingsPath = path.join(cwd, '.claude', 'settings.local.json')
+    const settings = JSON.parse(readFileSync(settingsPath, 'utf8')) as {
+      hooks: Record<string, unknown>
+    }
+    delete settings.hooks.SessionStart
+    delete settings.hooks.SubagentStart
+    writeFileSync(settingsPath, `${JSON.stringify(settings, null, 2)}\n`)
+
+    const readiness = await assessReadiness(deps)
+    const current = readiness.states.find((state) => state.id === 'hooks-stale')
+    expect(current?.status).toBe('gap')
+    expect(current?.detail).toMatch(/missing session-start, subagent-start/i)
+    expect(current?.detail).toMatch(/notifai hooks install/i)
+  })
+
   it('names an old blocking Claude Stop handler as the reason no wake can happen', async () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-doctor-stale-shape-'))
     const io = new PlainInteractiveIo()
@@ -5598,7 +6580,7 @@ describe('asking before the hooks have ever run', () => {
     expect(payload).toMatchObject({ ok: false, exit_code: EXIT.failed })
   })
 
-  it('tells Claude Code to send a prompt without falsely requiring a restart', () => {
+  it('tells Claude Code to start fresh so activation is model-visible', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-firstrun-'))
     mkdirSync(path.join(cwd, '.claude'), { recursive: true })
     applyPlan(path.join(cwd, '.claude', 'settings.local.json'), {
@@ -5612,11 +6594,11 @@ describe('asking before the hooks have ever run', () => {
 
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.usage)
     const said = io.errLines.join(' ')
-    expect(said).toMatch(/project hook files reload without a restart/i)
+    expect(said).toMatch(/Claude Code: start one fresh session, send one prompt/i)
     expect(said).not.toMatch(/Run `notifai hooks install` and send one prompt/)
   })
 
-  it('gives Cursor its prompt-and-doctor activation path', () => {
+  it('gives Cursor its fresh-conversation and first-Stop activation path', () => {
     const cwd = mkdtempSync(path.join(os.tmpdir(), 'notifai-cursor-first-run-'))
     const io = new CapturedIo()
     const deps = {
@@ -5629,7 +6611,7 @@ describe('asking before the hooks have ever run', () => {
     io.outLines = []
 
     expect(askCommand(deps, 'Ship it?', {})).toBe(EXIT.usage)
-    expect(io.errLines.join(' ')).toMatch(/Cursor: send one prompt, then run `notifai doctor`/)
+    expect(io.errLines.join(' ')).toMatch(/Cursor: start one fresh conversation[\s\S]*finish its first turn[\s\S]*`notifai doctor`/)
   })
 
   it('keeps OpenCode activation separate from unsupported answer continuation', () => {