@telora/daemon 0.20.78 → 0.20.95

package/dist/ci-status.js

@@ -54,29 +54,104 @@ export function resolveCiMergeGate(status) {
             return { proceed: false, status: 'unknown', reason: 'CI status unavailable for the merged SHA -- holding (fail-closed: unknown != green)' };
     }
 }
+/** The recognized state a ci-status ref suffix encodes, or null if unrecognized. */
+function ciStateFromRefSuffix(ref) {
+    if (ref.endsWith('/failure') || ref.endsWith('/error') || ref.endsWith('/red'))
+        return 'red';
+    if (ref.endsWith('/success') || ref.endsWith('/green') || ref.endsWith('/passed'))
+        return 'green';
+    if (ref.endsWith('/pending') || ref.endsWith('/running') || ref.endsWith('/queued'))
+        return 'pending';
+    return null;
+}
+/**
+ * The run-ordering token a NEW ref carries, or null for a legacy ref.
+ *
+ * New scheme: `refs/ci-status/<sha>/<runNumber>/<state>` (5 slash-parts) -- the
+ * run number is parts[3]. Legacy scheme: `refs/ci-status/<sha>/<state>` (4
+ * parts) carries no order. Disambiguated by SEGMENT COUNT, not by numeric-ness,
+ * so an all-digit sha in a legacy ref is never mistaken for a run number.
+ */
+function ciRunOrderFromRef(ref) {
+    const parts = ref.split('/');
+    if (parts.length === 5 && parts[1] === 'ci-status') {
+        const token = parts[3];
+        if (token !== undefined && /^[0-9]+$/.test(token)) {
+            const n = Number(token);
+            return Number.isSafeInteger(n) ? n : null;
+        }
+    }
+    return null;
+}
 /**
- * Classify a git-native CI status from the set of `refs/ci-status/<sha>/<state>`
- * ref names published for a SHA. The STATE is encoded in the ref NAME (immutable
- * per-SHA), so no object content read is needed. FAIL-CLOSED: an empty set or an
- * unrecognized suffix is 'unknown' (holds). A failure ref outranks a success ref
- * (a red run must win if both somehow exist). Pure -- the caller supplies the
- * ref names from a scoped `git ls-remote` / fetch.
+ * Classify a git-native CI status from the set of ci-status ref names published
+ * for a SHA. The STATE is encoded in the ref NAME (immutable per-SHA), so no
+ * object content read is needed. Pure -- the caller supplies the ref names from a
+ * scoped `git ls-remote` / fetch.
+ *
+ * MOST-RECENT-RUN-WINS. The publisher encodes run order in the ref PATH
+ * (`refs/ci-status/<sha>/<runNumber>/<state>`), so a later GREEN run's ref
+ * outranks an earlier FAILURE ref for the same sha. This fixes the "a failure
+ * ref outranks a success ref, forever" trap: ref names carried no order, so a
+ * sha that once published a failure (an infra blip, or an evicted run) stayed
+ * red permanently even after a real green run of the same sha. The order comes
+ * from the workflow, never inferred by this reader.
+ *
+ * FAIL-CLOSED throughout: an empty set / unrecognized suffix -> 'unknown'
+ * (holds); among the highest run number, RED wins on a tie (the rare same-run
+ * re-run that published both states resolves to red, never a false green).
+ *
+ * LEGACY refs (`refs/ci-status/<sha>/<state>`, no run number) carry no order; if
+ * ONLY legacy refs exist we fall back to the original fail-closed precedence
+ * (failure outranks success outranks pending), preserving prior behavior for
+ * shas published before the run-ordered scheme deployed.
  */
 export function classifyGitNativeCiStatus(refNames) {
-    let sawGreen = false;
-    let sawPending = false;
+    let bestOrder = -1;
+    const statesAtBest = new Set();
+    let sawLegacyRed = false;
+    let sawLegacyGreen = false;
+    let sawLegacyPending = false;
     for (const raw of refNames) {
         const ref = raw.trim();
-        if (ref.endsWith('/failure') || ref.endsWith('/error') || ref.endsWith('/red'))
+        const state = ciStateFromRefSuffix(ref);
+        if (!state)
+            continue;
+        const order = ciRunOrderFromRef(ref);
+        if (order === null) {
+            if (state === 'red')
+                sawLegacyRed = true;
+            else if (state === 'green')
+                sawLegacyGreen = true;
+            else
+                sawLegacyPending = true;
+            continue;
+        }
+        if (order > bestOrder) {
+            bestOrder = order;
+            statesAtBest.clear();
+            statesAtBest.add(state);
+        }
+        else if (order === bestOrder) {
+            statesAtBest.add(state);
+        }
+    }
+    // Most-recent ordered run decides (red wins a same-run tie, fail-closed).
+    if (bestOrder >= 0) {
+        if (statesAtBest.has('red'))
             return 'red';
-        if (ref.endsWith('/success') || ref.endsWith('/green') || ref.endsWith('/passed'))
-            sawGreen = true;
-        else if (ref.endsWith('/pending') || ref.endsWith('/running') || ref.endsWith('/queued'))
-            sawPending = true;
+        if (statesAtBest.has('green'))
+            return 'green';
+        if (statesAtBest.has('pending'))
+            return 'pending';
+        return 'unknown';
     }
-    if (sawGreen)
+    // Legacy-only fallback: original fail-closed precedence.
+    if (sawLegacyRed)
+        return 'red';
+    if (sawLegacyGreen)
         return 'green';
-    if (sawPending)
+    if (sawLegacyPending)
         return 'pending';
     return 'unknown';
 }

package/dist/ci-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci-status.js","sourceRoot":"","sources":["../src/ci-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyBH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAC1E,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,4EAA4E,EAAE,CAAC;QAC1H,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;QACtI,KAAK,SAAS,CAAC;QACf;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qFAAqF,EAAE,CAAC;IAChJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC9F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;IAC9G,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,UAAU;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,SAAS,CAAC;AACnB,CAAC;AAyCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB,EAAE,oBAA6B;IACrF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,oBAAoB;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,MAAM,KAAK,OAAO,IAAI,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAyB;IACrE,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/B,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ci-status.js","sourceRoot":"","sources":["../src/ci-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyBH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QAC1E,KAAK,SAAS;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,4EAA4E,EAAE,CAAC;QAC1H,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;QACtI,KAAK,SAAS,CAAC;QACf;YACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qFAAqF,EAAE,CAAC;IAChJ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC;IAClG,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACtG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAe,CAAC;IAC5C,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,KAAK,KAAK;gBAAE,YAAY,GAAG,IAAI,CAAC;iBACpC,IAAI,KAAK,KAAK,OAAO;gBAAE,cAAc,GAAG,IAAI,CAAC;;gBAC7C,gBAAgB,GAAG,IAAI,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YACtB,SAAS,GAAG,KAAK,CAAC;YAClB,YAAY,CAAC,KAAK,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QAC9C,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yDAAyD;IACzD,IAAI,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,cAAc;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,gBAAgB;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,SAAS,CAAC;AACnB,CAAC;AAyCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB,EAAE,oBAA6B;IACrF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,oBAAoB;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,MAAM,KAAK,OAAO,IAAI,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAyB;IACrE,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/B,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/connect/agents.d.ts

@@ -1,24 +1,74 @@
 /**
- * Codex/IDE harness config writer: the seeded `AGENTS.md` block. Extracted
- * verbatim from `../connect.ts` and re-exported from there for import
- * stability.
+ * Codex/IDE harness config writer: the seeded `AGENTS.md` block.
+ *
+ * Codex has no SessionStart hook, so its seed cannot ride the harness the way
+ * the Claude seed does -- it needs a FILE carrier, and that file must live off
+ * the repo root so the connector never fights the repo for `<repo>/AGENTS.md`.
+ * There are three carriers, one per consumer:
+ *
+ *  - `writeProductCodexAgentsMd` -> the daemon's ISOLATED PER-PRODUCT CODEX_HOME
+ *    (`~/.telora/codex/<productId>/AGENTS.md`, resolveProductCodexHome). Read by
+ *    daemon-spawned LOCAL-MODEL Codex agents (whose CODEX_HOME is redirected
+ *    there at spawn). Being per-product, it carries the baked per-product
+ *    connection-invariant header correctly.
+ *  - `writeOrMergeGlobalAgentsMd` -> the operator's own `~/.codex/AGENTS.md`
+ *    (globalAgentsMdPath). Read by an INTERACTIVE operator running Codex AND by
+ *    daemon-spawned HOSTED Codex agents (whose ChatGPT-account auth lives in
+ *    `~/.codex/auth.json`, so their CODEX_HOME cannot be redirected without
+ *    breaking auth). Workstation-shared across products, so it carries the
+ *    HEADER-LESS seed (identity resolved on demand via `telora-daemon status`).
+ *  - `writeOrMergeAgentsMd` -> a REPO-ROOT `<repo>/AGENTS.md` for the IDE
+ *    harnesses (Cursor / VS Code) that read it natively and have no off-repo
+ *    carrier. Made SAFE: it never creates or appends where the repo TRACKS
+ *    AGENTS.md -- it reports that state instead, so it cannot dirty tracked
+ *    content and reproduce this focus's original bug.
+ *
+ * `retireAgentsMdSeed` removes a connector-written repo-root AGENTS.md block the
+ * Codex file-writer era left behind.
  */
 import { type AgentsMdConnectionInvariant } from '../../templates/agents-md.js';
 import type { ConnectIO } from './shared.js';
 /**
- * Write or merge a seeded `AGENTS.md` at the repo root (Codex harness).
+ * The workstation-shared operator Codex AGENTS.md path: `$CODEX_HOME/AGENTS.md`,
+ * with CODEX_HOME defaulting to `~/.codex`. This is the location an interactive
+ * Codex session (and a hosted daemon spawn) reads global instructions from.
+ */
+export declare function globalAgentsMdPath(): string;
+/**
+ * Write or merge the PER-PRODUCT Codex seed into the isolated CODEX_HOME
+ * (`~/.telora/codex/<productId>/AGENTS.md`). This is the carrier a daemon-spawned
+ * LOCAL-MODEL Codex agent reads (its CODEX_HOME is redirected there at spawn).
+ * The destination is genuinely per-product, so the baked connection-invariant
+ * header stays correct -- `renderAgentsMd(inv)` is reused unchanged.
+ */
+export declare function writeProductCodexAgentsMd(inv: AgentsMdConnectionInvariant, io: ConnectIO): void;
+/**
+ * Write or merge the workstation-shared operator Codex seed at
+ * `$CODEX_HOME/AGENTS.md` (default `~/.codex/AGENTS.md`).
  *
- * The exact analog of `writeOrMergeClaudeMd` for the Codex operator surface:
- * AGENTS.md is Codex's CLAUDE.md-equivalent. Same merge semantics --
- *  - Fresh repo: writes the seeded block straight in.
- *  - Existing AGENTS.md without the Telora delimiters: appends a delimited
- *    block at the end; user content untouched.
- *  - Existing AGENTS.md WITH the delimiters: replaces only the delimited block.
+ * Read by an interactive operator running Codex AND by daemon-spawned HOSTED
+ * Codex agents (whose auth lives in `~/.codex` and whose CODEX_HOME therefore
+ * cannot be redirected). Header-LESS: one workstation hosts many products, so
+ * this shared file cannot bake a correct per-product header -- the identity is
+ * resolved on demand via `telora-daemon status`.
+ */
+export declare function writeOrMergeGlobalAgentsMd(io: ConnectIO): void;
+/**
+ * Write or merge a seeded `AGENTS.md` at the repo root, SAFELY (IDE harnesses).
  *
- * Idempotent at the filesystem level: when the computed content equals what is
- * already on disk, NO write occurs (no spurious mtime bump, no git churn). The
- * daemon re-invokes this on boot to self-heal the seed block, so the
- * unchanged-common-case must not touch the file.
+ * Cursor / VS Code read a repo-root AGENTS.md natively and have no off-repo
+ * carrier, so those harnesses still seed one -- but never at the cost of dirtying
+ * tracked content. If the repo TRACKS AGENTS.md, this REPORTS that state and
+ * writes nothing (the repo owns its tracked file). Only an absent or untracked
+ * AGENTS.md is created / merged. The Codex harness NO LONGER writes here.
  */
 export declare function writeOrMergeAgentsMd(repoPath: string, inv: AgentsMdConnectionInvariant, io: ConnectIO): void;
+/**
+ * Retire a connector-written repo-root `AGENTS.md` seed block. The Codex path
+ * used to write one; the connector no longer owns `<repo>/AGENTS.md`, so this
+ * removes the block it left behind -- honoring the ownership asymmetry
+ * (connector-created file removed; repo-tracked file reported, never rewritten).
+ * See `retireSeedFile` for the three on-disk states handled.
+ */
+export declare function retireAgentsMdSeed(repoPath: string, io: ConnectIO): void;
 //# sourceMappingURL=agents.d.ts.map

package/dist/cli/connect/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/agents.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,2BAA2B,EAChC,EAAE,EAAE,SAAS,GACZ,IAAI,CA0CN"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,EAKL,KAAK,2BAA2B,EACjC,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAG3C;AAwDD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,2BAA2B,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAG/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAE9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,2BAA2B,EAChC,EAAE,EAAE,SAAS,GACZ,IAAI,CAUN;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAExE"}

package/dist/cli/connect/agents.js

@@ -1,30 +1,61 @@
 /**
- * Codex/IDE harness config writer: the seeded `AGENTS.md` block. Extracted
- * verbatim from `../connect.ts` and re-exported from there for import
- * stability.
+ * Codex/IDE harness config writer: the seeded `AGENTS.md` block.
+ *
+ * Codex has no SessionStart hook, so its seed cannot ride the harness the way
+ * the Claude seed does -- it needs a FILE carrier, and that file must live off
+ * the repo root so the connector never fights the repo for `<repo>/AGENTS.md`.
+ * There are three carriers, one per consumer:
+ *
+ *  - `writeProductCodexAgentsMd` -> the daemon's ISOLATED PER-PRODUCT CODEX_HOME
+ *    (`~/.telora/codex/<productId>/AGENTS.md`, resolveProductCodexHome). Read by
+ *    daemon-spawned LOCAL-MODEL Codex agents (whose CODEX_HOME is redirected
+ *    there at spawn). Being per-product, it carries the baked per-product
+ *    connection-invariant header correctly.
+ *  - `writeOrMergeGlobalAgentsMd` -> the operator's own `~/.codex/AGENTS.md`
+ *    (globalAgentsMdPath). Read by an INTERACTIVE operator running Codex AND by
+ *    daemon-spawned HOSTED Codex agents (whose ChatGPT-account auth lives in
+ *    `~/.codex/auth.json`, so their CODEX_HOME cannot be redirected without
+ *    breaking auth). Workstation-shared across products, so it carries the
+ *    HEADER-LESS seed (identity resolved on demand via `telora-daemon status`).
+ *  - `writeOrMergeAgentsMd` -> a REPO-ROOT `<repo>/AGENTS.md` for the IDE
+ *    harnesses (Cursor / VS Code) that read it natively and have no off-repo
+ *    carrier. Made SAFE: it never creates or appends where the repo TRACKS
+ *    AGENTS.md -- it reports that state instead, so it cannot dirty tracked
+ *    content and reproduce this focus's original bug.
+ *
+ * `retireAgentsMdSeed` removes a connector-written repo-root AGENTS.md block the
+ * Codex file-writer era left behind.
  */
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { TELORA_AGENTS_MD_BEGIN, TELORA_AGENTS_MD_END, renderAgentsMd, } from '../../templates/agents-md.js';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { TELORA_AGENTS_MD_BEGIN, TELORA_AGENTS_MD_END, renderAgentsMd, renderCodexOperatorSeed, } from '../../templates/agents-md.js';
+import { resolveProductCodexHome } from '../codex-provision.js';
+import { isPathTracked, retireSeedFile } from './seed-retirement.js';
 /**
- * Write or merge a seeded `AGENTS.md` at the repo root (Codex harness).
+ * The workstation-shared operator Codex AGENTS.md path: `$CODEX_HOME/AGENTS.md`,
+ * with CODEX_HOME defaulting to `~/.codex`. This is the location an interactive
+ * Codex session (and a hosted daemon spawn) reads global instructions from.
+ */
+export function globalAgentsMdPath() {
+    const codexHome = process.env.CODEX_HOME || join(homedir(), '.codex');
+    return join(codexHome, 'AGENTS.md');
+}
+/**
+ * Core delimited-block merge for an AGENTS.md at an absolute path, given a
+ * pre-rendered seed block.
  *
- * The exact analog of `writeOrMergeClaudeMd` for the Codex operator surface:
- * AGENTS.md is Codex's CLAUDE.md-equivalent. Same merge semantics --
- *  - Fresh repo: writes the seeded block straight in.
- *  - Existing AGENTS.md without the Telora delimiters: appends a delimited
- *    block at the end; user content untouched.
- *  - Existing AGENTS.md WITH the delimiters: replaces only the delimited block.
+ *  - No file: writes the seeded block straight in (creating the parent dir).
+ *  - File without the Telora delimiters: appends a delimited block; user
+ *    content untouched.
+ *  - File WITH the delimiters: replaces only the delimited block.
  *
  * Idempotent at the filesystem level: when the computed content equals what is
- * already on disk, NO write occurs (no spurious mtime bump, no git churn). The
- * daemon re-invokes this on boot to self-heal the seed block, so the
- * unchanged-common-case must not touch the file.
+ * already on disk, NO write occurs (no spurious mtime bump, no git churn).
  */
-export function writeOrMergeAgentsMd(repoPath, inv, io) {
-    const path = resolve(repoPath, 'AGENTS.md');
-    const seedBlock = renderAgentsMd(inv);
+function writeOrMergeAgentsBlockAt(path, seedBlock, io) {
     if (!existsSync(path)) {
+        mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, seedBlock);
         io.out(`Wrote ${path}.\n`);
         return;
@@ -62,4 +93,56 @@ export function writeOrMergeAgentsMd(repoPath, inv, io) {
     writeFileSync(path, newContent);
     io.out(message);
 }
+/**
+ * Write or merge the PER-PRODUCT Codex seed into the isolated CODEX_HOME
+ * (`~/.telora/codex/<productId>/AGENTS.md`). This is the carrier a daemon-spawned
+ * LOCAL-MODEL Codex agent reads (its CODEX_HOME is redirected there at spawn).
+ * The destination is genuinely per-product, so the baked connection-invariant
+ * header stays correct -- `renderAgentsMd(inv)` is reused unchanged.
+ */
+export function writeProductCodexAgentsMd(inv, io) {
+    const path = resolve(resolveProductCodexHome(inv.productId), 'AGENTS.md');
+    writeOrMergeAgentsBlockAt(path, renderAgentsMd(inv), io);
+}
+/**
+ * Write or merge the workstation-shared operator Codex seed at
+ * `$CODEX_HOME/AGENTS.md` (default `~/.codex/AGENTS.md`).
+ *
+ * Read by an interactive operator running Codex AND by daemon-spawned HOSTED
+ * Codex agents (whose auth lives in `~/.codex` and whose CODEX_HOME therefore
+ * cannot be redirected). Header-LESS: one workstation hosts many products, so
+ * this shared file cannot bake a correct per-product header -- the identity is
+ * resolved on demand via `telora-daemon status`.
+ */
+export function writeOrMergeGlobalAgentsMd(io) {
+    writeOrMergeAgentsBlockAt(globalAgentsMdPath(), renderCodexOperatorSeed(), io);
+}
+/**
+ * Write or merge a seeded `AGENTS.md` at the repo root, SAFELY (IDE harnesses).
+ *
+ * Cursor / VS Code read a repo-root AGENTS.md natively and have no off-repo
+ * carrier, so those harnesses still seed one -- but never at the cost of dirtying
+ * tracked content. If the repo TRACKS AGENTS.md, this REPORTS that state and
+ * writes nothing (the repo owns its tracked file). Only an absent or untracked
+ * AGENTS.md is created / merged. The Codex harness NO LONGER writes here.
+ */
+export function writeOrMergeAgentsMd(repoPath, inv, io) {
+    const path = resolve(repoPath, 'AGENTS.md');
+    if (existsSync(path) && isPathTracked(repoPath, 'AGENTS.md')) {
+        io.out(`AGENTS.md at ${path} is repo-tracked; leaving it to the repo (the ` +
+            `connector will not modify tracked content).\n`);
+        return;
+    }
+    writeOrMergeAgentsBlockAt(path, renderAgentsMd(inv), io);
+}
+/**
+ * Retire a connector-written repo-root `AGENTS.md` seed block. The Codex path
+ * used to write one; the connector no longer owns `<repo>/AGENTS.md`, so this
+ * removes the block it left behind -- honoring the ownership asymmetry
+ * (connector-created file removed; repo-tracked file reported, never rewritten).
+ * See `retireSeedFile` for the three on-disk states handled.
+ */
+export function retireAgentsMdSeed(repoPath, io) {
+    retireSeedFile(repoPath, 'AGENTS.md', TELORA_AGENTS_MD_BEGIN, TELORA_AGENTS_MD_END, io);
+}
 //# sourceMappingURL=agents.js.map

package/dist/cli/connect/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../../src/cli/connect/agents.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GAEf,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,GAAgC,EAChC,EAAa;IAEb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1D,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;QACxC,OAAO,GAAG,iCAAiC,IAAI,KAAK,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;YACxC,OAAO,GAAG,iCAAiC,IAAI,iCAAiC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC;YACnD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,UAAU;gBACR,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;oBAC3B,SAAS,CAAC,OAAO,EAAE;oBACnB,IAAI;oBACJ,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;YAC1C,OAAO,GAAG,kCAAkC,IAAI,KAAK,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IAEpC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../../src/cli/connect/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGrE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,SAAiB,EAAE,EAAa;IAC/E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1D,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;QACxC,OAAO,GAAG,iCAAiC,IAAI,KAAK,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;YACxC,OAAO,GAAG,iCAAiC,IAAI,iCAAiC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC;YACnD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,UAAU;gBACR,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;oBAC3B,SAAS,CAAC,OAAO,EAAE;oBACnB,IAAI;oBACJ,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;YAC1C,OAAO,GAAG,kCAAkC,IAAI,KAAK,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IAEpC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAgC,EAAE,EAAa;IACvF,MAAM,IAAI,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1E,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAa;IACtD,yBAAyB,CAAC,kBAAkB,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,GAAgC,EAChC,EAAa;IAEb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7D,EAAE,CAAC,GAAG,CACJ,gBAAgB,IAAI,gDAAgD;YAClE,+CAA+C,CAClD,CAAC;QACF,OAAO;IACT,CAAC;IACD,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAa;IAChE,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/cli/connect/claude.d.ts

@@ -5,27 +5,30 @@
  */
 import type { ConnectIO } from './shared.js';
 /**
- * Write or merge a seeded `CLAUDE.md` at the repo root.
+ * Retire the connector-written `CLAUDE.md` seed block at the repo root.
  *
- * - Fresh repo: writes the seeded block straight in.
- * - Existing CLAUDE.md without the Telora delimiters: appends a delimited
- *   Telora block at the end. The user's content is untouched.
- * - Existing CLAUDE.md WITH the delimiters: replaces only the delimited
- *   block. Re-runs are byte-identical (no churn, no duplication).
- *
- * Idempotent at the filesystem level: when the computed content equals what
- * is already on disk, NO write occurs (no spurious mtime bump, no git churn).
- * The daemon re-invokes this on every boot to self-heal the seed block, so
- * the unchanged-common-case must not touch the file.
+ * The Claude workstation seed is now workstation-scoped context delivered by the
+ * SessionStart hook (`telora-daemon session-state`), not a file the connector
+ * writes to the repo root -- so the connector stops owning `<repo>/CLAUDE.md`.
+ * This pass removes the delimited block it once wrote, honoring the ownership
+ * asymmetry (connector-created file -> removed; repo-tracked file -> reported,
+ * never rewritten). See `retireSeedFile` for the three on-disk states handled.
  */
-export declare function writeOrMergeClaudeMd(repoPath: string, productName: string | null, io: ConnectIO): void;
+export declare function retireClaudeMdSeed(repoPath: string, io: ConnectIO): void;
 /**
  * Write or deep-merge `<repo>/.claude/settings.json`.
  *
- * Fresh: writes the template directly.
- * Existing: deep-merges our `permissions.allow` entries into the user's
- * settings, deduplicating. All other top-level keys are untouched.
- * Re-runs produce no diff.
+ * Fresh: writes the template directly (creating `.claude/`).
+ * Existing: deep-merges our `permissions.allow` + the SessionStart seed hook
+ * into the user's settings, deduplicating. All other top-level keys are
+ * untouched. Re-runs produce no diff.
+ *
+ * Idempotent at the filesystem level: when the merged content equals what is
+ * already on disk, NO write occurs (no spurious mtime bump, no git churn). This
+ * matters because the daemon now re-invokes this on every boot
+ * (`refreshClaudeSettingsForProducts`) to migrate the SessionStart seed hook
+ * into already-connected repos -- the unchanged-common-case must not touch the
+ * file.
  */
 export declare function writeOrMergeClaudeSettings(repoPath: string, io: ConnectIO): void;
 //# sourceMappingURL=claude.d.ts.map

package/dist/cli/connect/claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,EAAE,EAAE,SAAS,GACZ,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CA0BhF"}
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAExE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAiChF"}

package/dist/cli/connect/claude.js

@@ -5,88 +5,47 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { TELORA_CLAUDE_MD_BEGIN, TELORA_CLAUDE_MD_END, renderClaudeMd, } from '../../templates/claude-md.js';
+import { TELORA_CLAUDE_MD_BEGIN, TELORA_CLAUDE_MD_END, } from '../../templates/claude-md.js';
 import { buildClaudeSettings, mergeClaudeSettings, } from '../../templates/claude-settings.js';
+import { retireSeedFile } from './seed-retirement.js';
 /**
- * Write or merge a seeded `CLAUDE.md` at the repo root.
+ * Retire the connector-written `CLAUDE.md` seed block at the repo root.
  *
- * - Fresh repo: writes the seeded block straight in.
- * - Existing CLAUDE.md without the Telora delimiters: appends a delimited
- *   Telora block at the end. The user's content is untouched.
- * - Existing CLAUDE.md WITH the delimiters: replaces only the delimited
- *   block. Re-runs are byte-identical (no churn, no duplication).
- *
- * Idempotent at the filesystem level: when the computed content equals what
- * is already on disk, NO write occurs (no spurious mtime bump, no git churn).
- * The daemon re-invokes this on every boot to self-heal the seed block, so
- * the unchanged-common-case must not touch the file.
+ * The Claude workstation seed is now workstation-scoped context delivered by the
+ * SessionStart hook (`telora-daemon session-state`), not a file the connector
+ * writes to the repo root -- so the connector stops owning `<repo>/CLAUDE.md`.
+ * This pass removes the delimited block it once wrote, honoring the ownership
+ * asymmetry (connector-created file -> removed; repo-tracked file -> reported,
+ * never rewritten). See `retireSeedFile` for the three on-disk states handled.
  */
-export function writeOrMergeClaudeMd(repoPath, productName, io) {
-    const path = resolve(repoPath, 'CLAUDE.md');
-    const seedBlock = renderClaudeMd(productName);
-    if (!existsSync(path)) {
-        writeFileSync(path, seedBlock);
-        io.out(`Wrote ${path}.\n`);
-        return;
-    }
-    const existing = readFileSync(path, 'utf-8');
-    const beginIdx = existing.indexOf(TELORA_CLAUDE_MD_BEGIN);
-    let newContent;
-    let message;
-    if (beginIdx === -1) {
-        // No prior Telora block -- append, preserving user content.
-        const sep = existing.endsWith('\n') ? '\n' : '\n\n';
-        newContent = existing + sep + seedBlock;
-        message = `Appended Telora seed block to ${path}.\n`;
-    }
-    else {
-        const endIdx = existing.indexOf(TELORA_CLAUDE_MD_END, beginIdx);
-        if (endIdx === -1) {
-            // Begin marker without end -- treat as malformed. Append a fresh block
-            // rather than risk corrupting whatever's there.
-            const sep = existing.endsWith('\n') ? '\n' : '\n\n';
-            newContent = existing + sep + seedBlock;
-            message = `Appended Telora seed block to ${path} (prior block was malformed).\n`;
-        }
-        else {
-            // Replace the existing Telora block in place.
-            const after = endIdx + TELORA_CLAUDE_MD_END.length;
-            // Trim a trailing newline after the end marker so we don't accumulate
-            // blank lines on each re-run.
-            const trailingNewline = existing[after] === '\n' ? 1 : 0;
-            newContent =
-                existing.slice(0, beginIdx) +
-                    seedBlock.trimEnd() +
-                    '\n' +
-                    existing.slice(after + trailingNewline);
-            message = `Refreshed Telora seed block in ${path}.\n`;
-        }
-    }
-    // Idempotency guard: skip the write entirely when nothing would change.
-    // This keeps the boot-time self-heal a no-op for already-current repos.
-    if (newContent === existing)
-        return;
-    writeFileSync(path, newContent);
-    io.out(message);
+export function retireClaudeMdSeed(repoPath, io) {
+    retireSeedFile(repoPath, 'CLAUDE.md', TELORA_CLAUDE_MD_BEGIN, TELORA_CLAUDE_MD_END, io);
 }
 /**
  * Write or deep-merge `<repo>/.claude/settings.json`.
  *
- * Fresh: writes the template directly.
- * Existing: deep-merges our `permissions.allow` entries into the user's
- * settings, deduplicating. All other top-level keys are untouched.
- * Re-runs produce no diff.
+ * Fresh: writes the template directly (creating `.claude/`).
+ * Existing: deep-merges our `permissions.allow` + the SessionStart seed hook
+ * into the user's settings, deduplicating. All other top-level keys are
+ * untouched. Re-runs produce no diff.
+ *
+ * Idempotent at the filesystem level: when the merged content equals what is
+ * already on disk, NO write occurs (no spurious mtime bump, no git churn). This
+ * matters because the daemon now re-invokes this on every boot
+ * (`refreshClaudeSettingsForProducts`) to migrate the SessionStart seed hook
+ * into already-connected repos -- the unchanged-common-case must not touch the
+ * file.
  */
 export function writeOrMergeClaudeSettings(repoPath, io) {
     const dir = resolve(repoPath, '.claude');
     const path = resolve(dir, 'settings.json');
     const seed = buildClaudeSettings();
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
     let existing = null;
+    let existingRaw = null;
     if (existsSync(path)) {
         try {
-            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            existingRaw = readFileSync(path, 'utf-8');
+            const parsed = JSON.parse(existingRaw);
             if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
                 existing = parsed;
             }
@@ -98,7 +57,14 @@ export function writeOrMergeClaudeSettings(repoPath, io) {
         }
     }
     const merged = mergeClaudeSettings(existing, seed);
-    writeFileSync(path, JSON.stringify(merged, null, 2) + '\n');
-    io.out(existing ? `Merged Telora entries into ${path}.\n` : `Wrote ${path}.\n`);
+    const nextRaw = JSON.stringify(merged, null, 2) + '\n';
+    // Idempotency guard: skip the write (and the dir mkdir) entirely when nothing
+    // would change, so the boot-cadence refresh is a pure no-op for current repos.
+    if (existingRaw !== null && nextRaw === existingRaw)
+        return;
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    writeFileSync(path, nextRaw);
+    io.out(existingRaw !== null ? `Merged Telora entries into ${path}.\n` : `Wrote ${path}.\n`);
 }
 //# sourceMappingURL=claude.js.map

package/dist/cli/connect/claude.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../src/cli/connect/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAG5C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,WAA0B,EAC1B,EAAa;IAEb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1D,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,4DAA4D;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;QACxC,OAAO,GAAG,iCAAiC,IAAI,KAAK,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACpD,UAAU,GAAG,QAAQ,GAAG,GAAG,GAAG,SAAS,CAAC;YACxC,OAAO,GAAG,iCAAiC,IAAI,iCAAiC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,MAAM,KAAK,GAAG,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC;YACnD,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,UAAU;gBACR,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;oBAC3B,SAAS,CAAC,OAAO,EAAE;oBACnB,IAAI;oBACJ,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;YAC1C,OAAO,GAAG,kCAAkC,IAAI,KAAK,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO;IAEpC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,EAAa;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IAEnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,QAAQ,GAAmC,IAAI,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,QAAQ,GAAG,MAAiC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,GAAG,CACJ,qBAAqB,IAAI,wCAAwC;gBAC/D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAA8B,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;AAClF,CAAC"}
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../src/cli/connect/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAa;IAChE,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,EAAa;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IAEnC,IAAI,QAAQ,GAAmC,IAAI,CAAC;IACpD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,QAAQ,GAAG,MAAiC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,GAAG,CACJ,qBAAqB,IAAI,wCAAwC;gBAC/D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEvD,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO;IAE5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;AAC9F,CAAC"}

package/dist/cli/connect/scaffolding.d.ts

@@ -18,8 +18,9 @@ export declare function harnessGitignoreEntries(harness: OperatorHarness): strin
  * `connect --harness <h>` and the token-free `harness add <h>` verb produce
  * byte-identical output for a given identity.
  *
- *  - claude: CLAUDE.md + .claude/settings.json
- *  - codex:  AGENTS.md + Telora MCP in ~/.codex/config.toml
+ *  - claude: .claude/settings.json (SessionStart seed hook) + retire any repo CLAUDE.md
+ *  - codex:  global $CODEX_HOME/AGENTS.md + Telora MCP in ~/.codex/config.toml
+ *            (repo-root AGENTS.md seed retired)
  *  - cline:  .cline/rules/telora.md + Telora MCP in ~/.cline settings
  *  - cursor: AGENTS.md + .cursor/mcp.json (preload env)
  *  - vscode: AGENTS.md + .vscode/mcp.json (preload env)

package/dist/cli/connect/scaffolding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffolding.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/scaffolding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAE1E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,2BAA2B,EAChC,EAAE,EAAE,SAAS,GACZ,IAAI,CAaN"}
+{"version":3,"file":"scaffolding.d.ts","sourceRoot":"","sources":["../../../src/cli/connect/scaffolding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU9D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,EAAE,CAE1E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,2BAA2B,EAChC,EAAE,EAAE,SAAS,GACZ,IAAI,CAuBN"}