codebyplan 1.11.2 → 1.13.0

package/dist/cli.js

@@ -14,26 +14,163 @@ var VERSION, PACKAGE_NAME;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    VERSION = "1.11.2";
+    VERSION = "1.13.0";
     PACKAGE_NAME = "codebyplan";
   }
 });
 
+// src/lib/gitignore-block.ts
+import { readFile, writeFile } from "node:fs/promises";
+import * as path from "node:path";
+async function ensureManagedGitignoreBlock(projectDir, dryRun = false) {
+  const gitignorePath = path.join(projectDir, ".gitignore");
+  let existing = null;
+  try {
+    existing = await readFile(gitignorePath, "utf-8");
+  } catch {
+  }
+  if (existing === null) {
+    if (!dryRun) {
+      const block = buildBlock("\n");
+      await writeFile(gitignorePath, block, "utf-8");
+    }
+    return "created";
+  }
+  const nl = existing.includes("\r\n") ? "\r\n" : "\n";
+  const lines = existing.split(/\r?\n/);
+  const startIdx = lines.findIndex((l) => l === GITIGNORE_BLOCK_START);
+  const endIdx = lines.findIndex((l) => l === GITIGNORE_BLOCK_END);
+  const hasValidBlock = startIdx !== -1 && endIdx !== -1 && endIdx > startIdx;
+  if (!hasValidBlock) {
+    const hasOrphanMarker = startIdx !== -1 || endIdx !== -1;
+    if (hasOrphanMarker) {
+      const hadTrailingNewline = existing.endsWith("\n");
+      const cleanedLines = lines.filter(
+        (l) => l !== GITIGNORE_BLOCK_START && l !== GITIGNORE_BLOCK_END
+      );
+      if (hadTrailingNewline && cleanedLines.length > 0 && cleanedLines[cleanedLines.length - 1] === "") {
+        cleanedLines.pop();
+      }
+      let content2 = cleanedLines.join(nl);
+      if (content2.length > 0) content2 += nl;
+      const newContent3 = content2 + buildBlock(nl);
+      if (!dryRun) {
+        await writeFile(gitignorePath, newContent3, "utf-8");
+      }
+      return "refreshed";
+    }
+    let content = existing;
+    if (!content.endsWith("\n") && !content.endsWith("\r\n")) {
+      content = content + nl;
+    }
+    const block = buildBlock(nl);
+    const newContent2 = content + block;
+    if (!dryRun) {
+      await writeFile(gitignorePath, newContent2, "utf-8");
+    }
+    return "appended";
+  }
+  const blockBodyLines = lines.slice(startIdx + 1, endIdx);
+  const canonicalBodyLines = [...CANONICAL_GITIGNORE_ENTRIES];
+  const bodyMatches = blockBodyLines.length === canonicalBodyLines.length && blockBodyLines.every((l, i) => l === canonicalBodyLines[i]);
+  if (bodyMatches) {
+    return "unchanged";
+  }
+  const blockLines = [
+    GITIGNORE_BLOCK_START,
+    ...CANONICAL_GITIGNORE_ENTRIES,
+    GITIGNORE_BLOCK_END
+  ];
+  const newLines = [
+    ...lines.slice(0, startIdx),
+    ...blockLines,
+    ...lines.slice(endIdx + 1)
+  ];
+  const newContent = newLines.join(nl);
+  const finalContent = newContent.endsWith(nl) ? newContent : newContent + nl;
+  if (!dryRun) {
+    await writeFile(gitignorePath, finalContent, "utf-8");
+  }
+  return "refreshed";
+}
+async function removeManagedGitignoreBlock(projectDir, dryRun = false) {
+  const gitignorePath = path.join(projectDir, ".gitignore");
+  let existing = null;
+  try {
+    existing = await readFile(gitignorePath, "utf-8");
+  } catch {
+    return "unchanged";
+  }
+  const nl = existing.includes("\r\n") ? "\r\n" : "\n";
+  const hadTrailingNewline = existing.endsWith("\n");
+  const lines = existing.split(/\r?\n/);
+  if (hadTrailingNewline && lines.length > 0 && lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  const startIdx = lines.findIndex((l) => l === GITIGNORE_BLOCK_START);
+  const endIdx = lines.findIndex((l) => l === GITIGNORE_BLOCK_END);
+  const hasValidBlock = startIdx !== -1 && endIdx !== -1 && endIdx > startIdx;
+  if (!hasValidBlock) {
+    const hasOrphanMarker = startIdx !== -1 || endIdx !== -1;
+    if (!hasOrphanMarker) {
+      return "unchanged";
+    }
+    const cleaned = lines.filter(
+      (l) => l !== GITIGNORE_BLOCK_START && l !== GITIGNORE_BLOCK_END
+    );
+    const orphanContent = cleaned.length > 0 ? cleaned.join(nl) + nl : "";
+    if (!dryRun) {
+      await writeFile(gitignorePath, orphanContent, "utf-8");
+    }
+    return "removed";
+  }
+  const before = lines.slice(0, startIdx);
+  const after = lines.slice(endIdx + 1);
+  if (before.length > 0 && after.length > 0 && before[before.length - 1].trim() === "" && after[0].trim() === "") {
+    after.shift();
+  }
+  const merged = [...before, ...after];
+  const newContent = merged.length > 0 ? merged.join(nl) + nl : "";
+  if (!dryRun) {
+    await writeFile(gitignorePath, newContent, "utf-8");
+  }
+  return "removed";
+}
+function buildBlock(nl) {
+  return GITIGNORE_BLOCK_START + nl + CANONICAL_GITIGNORE_ENTRIES.join(nl) + nl + GITIGNORE_BLOCK_END + nl;
+}
+var CANONICAL_GITIGNORE_ENTRIES, GITIGNORE_BLOCK_START, GITIGNORE_BLOCK_END;
+var init_gitignore_block = __esm({
+  "src/lib/gitignore-block.ts"() {
+    "use strict";
+    CANONICAL_GITIGNORE_ENTRIES = [
+      ".claude/settings.local.json",
+      ".claude/scheduled_tasks.lock",
+      ".codebyplan/device.local.json",
+      ".codebyplan/statusline.local.json",
+      ".codebyplan.local.json",
+      ".mcp.json"
+    ];
+    GITIGNORE_BLOCK_START = "# >>> codebyplan (managed) >>>";
+    GITIGNORE_BLOCK_END = "# <<< codebyplan <<<";
+  }
+});
+
 // src/lib/local-config.ts
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile as readFile2, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join as join2 } from "node:path";
 function localConfigPath(projectPath) {
-  return join(projectPath, ".codebyplan", "device.local.json");
+  return join2(projectPath, ".codebyplan", "device.local.json");
 }
 function legacyLocalConfigPath(projectPath) {
-  return join(projectPath, ".codebyplan.local.json");
+  return join2(projectPath, ".codebyplan.local.json");
 }
 async function readLocalConfig(projectPath, onMigrationNotice) {
   try {
-    const raw = await readFile(localConfigPath(projectPath), "utf-8");
+    const raw = await readFile2(localConfigPath(projectPath), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && typeof parsed.device_id === "string") {
       return parsed;
@@ -68,7 +205,7 @@ async function readLocalConfig(projectPath, onMigrationNotice) {
     }
   }
   try {
-    const raw = await readFile(legacyLocalConfigPath(projectPath), "utf-8");
+    const raw = await readFile2(legacyLocalConfigPath(projectPath), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && typeof parsed.device_id === "string") {
       onMigrationNotice?.(
@@ -88,8 +225,8 @@ async function readLocalConfig(projectPath, onMigrationNotice) {
 }
 async function writeLocalConfig(projectPath, config) {
   const content = { device_id: config.device_id };
-  const path6 = localConfigPath(projectPath);
-  const dirPath = dirname(path6);
+  const path7 = localConfigPath(projectPath);
+  const dirPath = dirname(path7);
   let phase = "stat config directory";
   try {
     try {
@@ -109,7 +246,7 @@ async function writeLocalConfig(projectPath, config) {
     phase = "create config directory";
     await mkdir(dirPath, { recursive: true });
     phase = "write local config";
-    await writeFile(path6, JSON.stringify(content, null, 2) + "\n", "utf-8");
+    await writeFile2(path7, JSON.stringify(content, null, 2) + "\n", "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "LEGACY_FILE_BLOCKS_DIR") {
@@ -121,7 +258,7 @@ async function writeLocalConfig(projectPath, config) {
 }
 async function resolveMachineSeed() {
   try {
-    const raw = await readFile("/etc/machine-id", "utf-8");
+    const raw = await readFile2("/etc/machine-id", "utf-8");
     const trimmed = raw.trim();
     if (trimmed) return trimmed;
   } catch {
@@ -153,13 +290,13 @@ var init_local_config = __esm({
 
 // src/lib/statusline-config.ts
 import { spawnSync } from "node:child_process";
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 function statuslineConfigPath(projectPath) {
-  return join2(projectPath, ".codebyplan", "statusline.json");
+  return join3(projectPath, ".codebyplan", "statusline.json");
 }
 function statuslineLocalConfigPath(projectPath) {
-  return join2(projectPath, ".codebyplan", "statusline.local.json");
+  return join3(projectPath, ".codebyplan", "statusline.local.json");
 }
 function isValidRenderer(value) {
   return typeof value === "string" && VALID_RENDERERS.has(value);
@@ -188,7 +325,7 @@ function mergeOverDefaults(raw) {
 }
 async function readStatuslineConfig(projectPath) {
   try {
-    const raw = await readFile2(statuslineConfigPath(projectPath), "utf-8");
+    const raw = await readFile3(statuslineConfigPath(projectPath), "utf-8");
     const parsed = JSON.parse(raw);
     return mergeOverDefaults(parsed);
   } catch {
@@ -197,7 +334,7 @@ async function readStatuslineConfig(projectPath) {
 }
 async function readStatuslineLocalConfig(projectPath) {
   try {
-    const raw = await readFile2(statuslineLocalConfigPath(projectPath), "utf-8");
+    const raw = await readFile3(statuslineLocalConfigPath(projectPath), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       const obj = parsed;
@@ -217,8 +354,8 @@ async function writeStatuslineLocalConfig(projectPath, localConfig) {
     );
   }
   const filePath = statuslineLocalConfigPath(projectPath);
-  await mkdir2(join2(projectPath, ".codebyplan"), { recursive: true });
-  await writeFile2(
+  await mkdir2(join3(projectPath, ".codebyplan"), { recursive: true });
+  await writeFile3(
     filePath,
     JSON.stringify(localConfig, null, 2) + "\n",
     "utf-8"
@@ -258,7 +395,8 @@ var init_statusline_config = __esm({
         cost: true,
         rate_limits: true,
         repo_pr: true,
-        worktree: true
+        worktree: true,
+        infra_drift: true
       },
       no_color: false
     };
@@ -297,9 +435,9 @@ var init_jwt_decode = __esm({
 });
 
 // src/oauth/keychain.ts
-import { chmod, mkdir as mkdir3, readFile as readFile3, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { chmod, mkdir as mkdir3, readFile as readFile4, unlink, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname2, join as join4 } from "node:path";
 async function loadKeyring() {
   if (keyringOverride !== void 0) return keyringOverride;
   try {
@@ -311,30 +449,30 @@ async function loadKeyring() {
 }
 function fallbackDir() {
   if (platform() === "win32") {
-    const appData = process.env.APPDATA ?? join3(homedir(), "AppData", "Roaming");
-    return join3(appData, "codebyplan");
+    const appData = process.env.APPDATA ?? join4(homedir(), "AppData", "Roaming");
+    return join4(appData, "codebyplan");
   }
-  const xdg = process.env.XDG_CONFIG_HOME ?? join3(homedir(), ".config");
-  return join3(xdg, "codebyplan");
+  const xdg = process.env.XDG_CONFIG_HOME ?? join4(homedir(), ".config");
+  return join4(xdg, "codebyplan");
 }
 function fallbackFile(filename) {
-  return join3(fallbackDir(), filename);
+  return join4(fallbackDir(), filename);
 }
 async function readFallback(filename) {
   try {
-    const raw = await readFile3(fallbackFile(filename), "utf-8");
+    const raw = await readFile4(fallbackFile(filename), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 async function writeFallback(filename, data) {
-  const path6 = fallbackFile(filename);
-  await mkdir3(dirname2(path6), { recursive: true });
-  await writeFile3(path6, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  const path7 = fallbackFile(filename);
+  await mkdir3(dirname2(path7), { recursive: true });
+  await writeFile4(path7, JSON.stringify(data, null, 2) + "\n", "utf-8");
   if (platform() !== "win32") {
     try {
-      await chmod(path6, 384);
+      await chmod(path7, 384);
     } catch {
     }
   }
@@ -541,8 +679,8 @@ async function getAuthHeaders() {
     return { headers: { "x-api-key": key }, via: "api_key" };
   }
 }
-function buildUrl(path6, params) {
-  const url = new URL(`${baseUrl()}/api${path6}`);
+function buildUrl(path7, params) {
+  const url = new URL(`${baseUrl()}/api${path7}`);
   if (params) {
     for (const [key, value] of Object.entries(params)) {
       if (value !== void 0) {
@@ -561,8 +699,8 @@ function isRetryable(err) {
 function delay(ms) {
   return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
-async function request(method, path6, options) {
-  const url = buildUrl(path6, options?.params);
+async function request(method, path7, options) {
+  const url = buildUrl(path7, options?.params);
   const auth = await getAuthHeaders();
   let lastError;
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
@@ -582,7 +720,7 @@ async function request(method, path6, options) {
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
       });
       if (!res.ok) {
-        let message = `API ${method} ${path6} failed with status ${res.status}`;
+        let message = `API ${method} ${path7} failed with status ${res.status}`;
         let code;
         try {
           const body = await res.json();
@@ -616,14 +754,14 @@ async function request(method, path6, options) {
   }
   throw lastError;
 }
-async function apiGet(path6, params) {
-  return request("GET", path6, { params });
+async function apiGet(path7, params) {
+  return request("GET", path7, { params });
 }
-async function apiPost(path6, body) {
-  return request("POST", path6, { body });
+async function apiPost(path7, body) {
+  return request("POST", path7, { body });
 }
-async function apiPut(path6, body) {
-  return request("PUT", path6, { body });
+async function apiPut(path7, body) {
+  return request("PUT", path7, { body });
 }
 async function callMcpTool(toolName, params) {
   const url = mcpEndpoint();
@@ -682,8 +820,8 @@ var init_api = __esm({
 });
 
 // src/lib/resolve-worktree.ts
-import { readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 async function resolveAndCacheWorktreeId(repoId, projectPath, options) {
   let worktreeId;
   try {
@@ -705,10 +843,10 @@ async function resolveAndCacheWorktreeId(repoId, projectPath, options) {
   if (options?.skipWrite) {
     return worktreeId;
   }
-  const codebyplanPath = join4(projectPath, ".codebyplan.json");
+  const codebyplanPath = join5(projectPath, ".codebyplan.json");
   let currentConfig = {};
   try {
-    const raw = await readFile4(codebyplanPath, "utf-8");
+    const raw = await readFile5(codebyplanPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       currentConfig = parsed;
@@ -723,7 +861,7 @@ async function resolveAndCacheWorktreeId(repoId, projectPath, options) {
     worktree_id: worktreeId
   };
   try {
-    await writeFile4(
+    await writeFile5(
       codebyplanPath,
       JSON.stringify(merged, null, 2) + "\n",
       "utf-8"
@@ -840,28 +978,36 @@ var init_browser = __esm({
 });
 
 // src/oauth/device-flow.ts
-async function initiateDeviceCode(clientId) {
+async function initiateDeviceCode(clientId, scope, resource = "https://mcp.codebyplan.com/") {
+  const body = { client_id: clientId, resource };
+  if (scope !== void 0) {
+    body.scope = scope;
+  }
   const res = await fetch(deviceEndpoint(), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ client_id: clientId }),
+    body: JSON.stringify(body),
     signal: AbortSignal.timeout(1e4)
   });
   if (!res.ok) {
-    const body = await res.json().catch(() => ({}));
-    if (body.error === "invalid_client") {
+    const body2 = await res.json().catch(() => ({}));
+    if (body2.error === "invalid_client") {
       throw new OAuthInvalidClientError();
     }
-    const msg = body.error_description ?? body.error ?? `HTTP ${res.status}`;
+    const msg = body2.error_description ?? body2.error ?? `HTTP ${res.status}`;
     throw new Error(`Failed to initiate device flow: ${msg}`);
   }
-  return await res.json();
+  const dcResponse = await res.json();
+  return { ...dcResponse, resource };
 }
-async function pollOnce(deviceCode, clientId) {
+async function pollOnce(deviceCode, clientId, resource) {
   const params = new URLSearchParams();
   params.set("grant_type", "urn:ietf:params:oauth:grant-type:device_code");
   params.set("device_code", deviceCode);
   params.set("client_id", clientId);
+  if (resource !== void 0) {
+    params.set("resource", resource);
+  }
   const res = await fetch(tokenEndpoint(), {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -880,15 +1026,19 @@ async function pollOnce(deviceCode, clientId) {
   return { kind: "error", message: description };
 }
 async function pollUntilSettled(opts) {
-  const sleep = opts.sleep ?? defaultSleep;
+  const sleep2 = opts.sleep ?? defaultSleep;
   const now = opts.now ?? Date.now;
   const startMs = now();
   const expiresAtMs = startMs + opts.expiresInSec * 1e3;
   while (now() < expiresAtMs) {
-    const outcome = await pollOnce(opts.deviceCode, opts.clientId);
+    const outcome = await pollOnce(
+      opts.deviceCode,
+      opts.clientId,
+      opts.resource
+    );
     if (outcome.kind !== "pending") return outcome;
     if (opts.onTick) opts.onTick(Math.floor((now() - startMs) / 1e3));
-    await sleep(opts.intervalSec * 1e3);
+    await sleep2(opts.intervalSec * 1e3);
   }
   return { kind: "expired" };
 }
@@ -988,10 +1138,11 @@ async function fetchEmail(accessToken) {
     return null;
   }
 }
-async function runLogin() {
+async function runLogin(options = {}) {
+  const scope = options.admin ? "mcp:read mcp:write mcp:admin" : "mcp:read mcp:write";
   console.log("\n  CodeByPlan login\n");
   const { clientId, result: dc } = await ensureClientFor(
-    (id) => initiateDeviceCode(id)
+    (id) => initiateDeviceCode(id, scope)
   );
   const verificationUri = dc.verification_uri_complete ?? dc.verification_uri;
   console.log(`  Visit: ${verificationUri}`);
@@ -1005,7 +1156,8 @@ async function runLogin() {
     deviceCode: dc.device_code,
     clientId,
     intervalSec: dc.interval,
-    expiresInSec: dc.expires_in
+    expiresInSec: dc.expires_in,
+    resource: dc.resource
   });
   if (outcome.kind === "denied") {
     console.log("  Denied. Authorization request was rejected.\n");
@@ -1057,21 +1209,21 @@ var setup_exports = {};
 __export(setup_exports, {
   runSetup: () => runSetup
 });
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import { stdin, stdout as stdout2 } from "node:process";
 import { createInterface } from "node:readline/promises";
 function getConfigPath(scope) {
-  return scope === "user" ? join5(homedir2(), ".claude.json") : join5(process.cwd(), ".mcp.json");
+  return scope === "user" ? join6(homedir2(), ".claude.json") : join6(process.cwd(), ".mcp.json");
 }
 function legacyMcpUrl() {
   const baseUrl2 = process.env.CODEBYPLAN_API_URL ?? "https://www.codebyplan.com";
   return `${baseUrl2.replace(/\/$/, "")}/mcp`;
 }
-async function readConfig(path6) {
+async function readConfig(path7) {
   try {
-    const raw = await readFile5(path6, "utf-8");
+    const raw = await readFile6(path7, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       return parsed;
@@ -1094,7 +1246,7 @@ async function writeMcpConfig(scope, auth) {
     config.mcpServers = {};
   }
   config.mcpServers.codebyplan = buildMcpEntry(auth);
-  await writeFile5(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  await writeFile6(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
   return configPath;
 }
 async function fetchRepos(auth) {
@@ -1149,7 +1301,7 @@ async function chooseAuthMode(rl) {
   return { kind: "legacy", apiKey };
 }
 async function writeCodebyplanDirectory(projectPath, selectedRepo, deviceId) {
-  const codebyplanDir = join5(projectPath, ".codebyplan");
+  const codebyplanDir = join6(projectPath, ".codebyplan");
   await mkdir4(codebyplanDir, { recursive: true });
   const repoJson = {
     repo_id: selectedRepo.id
@@ -1161,13 +1313,13 @@ async function writeCodebyplanDirectory(projectPath, selectedRepo, deviceId) {
   if (typeof repoAny.project_id === "string") {
     repoJson.project_id = repoAny.project_id;
   }
-  await writeFile5(
-    join5(codebyplanDir, "repo.json"),
+  await writeFile6(
+    join6(codebyplanDir, "repo.json"),
     JSON.stringify(repoJson, null, 2) + "\n",
     "utf-8"
   );
-  await writeFile5(
-    join5(codebyplanDir, "server.json"),
+  await writeFile6(
+    join6(codebyplanDir, "server.json"),
     JSON.stringify(
       {
         server_port: null,
@@ -1180,35 +1332,40 @@ async function writeCodebyplanDirectory(projectPath, selectedRepo, deviceId) {
     ) + "\n",
     "utf-8"
   );
-  await writeFile5(
-    join5(codebyplanDir, "git.json"),
+  await writeFile6(
+    join6(codebyplanDir, "git.json"),
     JSON.stringify({ git_branch: null, branch_config: null }, null, 2) + "\n",
     "utf-8"
   );
-  await writeFile5(
-    join5(codebyplanDir, "shipment.json"),
+  await writeFile6(
+    join6(codebyplanDir, "shipment.json"),
     JSON.stringify({ shipment: null }, null, 2) + "\n",
     "utf-8"
   );
-  await writeFile5(
-    join5(codebyplanDir, "vendor.json"),
+  await writeFile6(
+    join6(codebyplanDir, "vendor.json"),
+    JSON.stringify({}, null, 2) + "\n",
+    "utf-8"
+  );
+  await writeFile6(
+    join6(codebyplanDir, "e2e.json"),
     JSON.stringify({}, null, 2) + "\n",
     "utf-8"
   );
-  await writeFile5(
-    join5(codebyplanDir, "e2e.json"),
+  await writeFile6(
+    join6(codebyplanDir, "eslint.json"),
     JSON.stringify({}, null, 2) + "\n",
     "utf-8"
   );
-  const statuslinePath = join5(codebyplanDir, "statusline.json");
+  const statuslinePath = join6(codebyplanDir, "statusline.json");
   let statuslineExists = false;
   try {
-    await readFile5(statuslinePath, "utf-8");
+    await readFile6(statuslinePath, "utf-8");
     statuslineExists = true;
   } catch {
   }
   if (!statuslineExists) {
-    await writeFile5(
+    await writeFile6(
       statuslinePath,
       JSON.stringify(STATUSLINE_DEFAULTS, null, 2) + "\n",
       "utf-8"
@@ -1217,36 +1374,12 @@ async function writeCodebyplanDirectory(projectPath, selectedRepo, deviceId) {
   await writeLocalConfig(projectPath, { device_id: deviceId });
   console.log(`  Created ${codebyplanDir}/`);
   console.log(
-    `    repo.json, server.json, git.json, shipment.json, vendor.json, e2e.json, statusline.json`
+    `    repo.json, server.json, git.json, shipment.json, vendor.json, e2e.json, eslint.json, statusline.json`
   );
   console.log(`    device.local.json (gitignored)`);
-  const gitignorePath = join5(projectPath, ".gitignore");
-  const gitignoreEntry = ".codebyplan/device.local.json";
-  const statuslineLocalEntry = ".codebyplan/statusline.local.json";
-  try {
-    const existing = await readFile5(gitignorePath, "utf-8");
-    const lines = existing.split("\n");
-    let content = existing;
-    if (!lines.some((l) => l.trimEnd() === gitignoreEntry)) {
-      content = (content.endsWith("\n") ? content : content + "\n") + gitignoreEntry + "\n";
-      console.log(`  Added '${gitignoreEntry}' to .gitignore`);
-    }
-    if (!lines.some((l) => l.trimEnd() === statuslineLocalEntry)) {
-      content = (content.endsWith("\n") ? content : content + "\n") + statuslineLocalEntry + "\n";
-      console.log(`  Added '${statuslineLocalEntry}' to .gitignore`);
-    }
-    if (content !== existing) {
-      await writeFile5(gitignorePath, content, "utf-8");
-    }
-  } catch {
-    await writeFile5(
-      gitignorePath,
-      gitignoreEntry + "\n" + statuslineLocalEntry + "\n",
-      "utf-8"
-    );
-    console.log(
-      `  Created .gitignore with '${gitignoreEntry}' and '${statuslineLocalEntry}'`
-    );
+  const gitignoreAction = await ensureManagedGitignoreBlock(projectPath);
+  if (gitignoreAction !== "unchanged") {
+    console.log("  Updated .gitignore (codebyplan managed block)");
   }
 }
 async function runSetup() {
@@ -1377,6 +1510,7 @@ async function runSetup() {
 var init_setup = __esm({
   "src/cli/setup.ts"() {
     "use strict";
+    init_gitignore_block();
     init_local_config();
     init_statusline_config();
     init_resolve_worktree();
@@ -1387,21 +1521,21 @@ var init_setup = __esm({
 });
 
 // src/lib/flags.ts
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join6, resolve } from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join7, resolve } from "node:path";
 async function findCodebyplanConfig(startDir, maxDepth = 20) {
   let cursor = resolve(startDir);
   for (let depth = 0; depth < maxDepth; depth++) {
-    const sentinelPath2 = join6(cursor, ".codebyplan", "repo.json");
+    const sentinelPath2 = join7(cursor, ".codebyplan", "repo.json");
     try {
-      const raw = await readFile6(sentinelPath2, "utf-8");
+      const raw = await readFile7(sentinelPath2, "utf-8");
       const parsed = JSON.parse(raw);
       return { path: sentinelPath2, contents: parsed };
     } catch {
     }
-    const legacyPath = join6(cursor, ".codebyplan.json");
+    const legacyPath = join7(cursor, ".codebyplan.json");
     try {
-      const raw = await readFile6(legacyPath, "utf-8");
+      const raw = await readFile7(legacyPath, "utf-8");
       const parsed = JSON.parse(raw);
       return { path: legacyPath, contents: parsed };
     } catch {
@@ -1628,15 +1762,15 @@ var upgrade_auth_exports = {};
 __export(upgrade_auth_exports, {
   runUpgradeAuth: () => runUpgradeAuth
 });
-import { readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function configPaths() {
-  return [join7(homedir3(), ".claude.json"), join7(process.cwd(), ".mcp.json")];
+  return [join8(homedir3(), ".claude.json"), join8(process.cwd(), ".mcp.json")];
 }
-async function readConfig2(path6) {
+async function readConfig2(path7) {
   try {
-    const raw = await readFile7(path6, "utf-8");
+    const raw = await readFile8(path7, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       return parsed;
@@ -1650,14 +1784,14 @@ function entryHasLegacyApiKey(entry) {
   if (!entry || !entry.headers) return false;
   return "x-api-key" in entry.headers;
 }
-async function rewriteConfig(path6, config, newUrl) {
+async function rewriteConfig(path7, config, newUrl) {
   const servers = config.mcpServers;
   if (!servers) return false;
   const entry = servers.codebyplan;
   if (!entry) return false;
   if (!entryHasLegacyApiKey(entry) && entry.url === newUrl) return false;
   servers.codebyplan = { url: newUrl };
-  await writeFile6(path6, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  await writeFile7(path7, JSON.stringify(config, null, 2) + "\n", "utf-8");
   return true;
 }
 async function runUpgradeAuth() {
@@ -1665,12 +1799,12 @@ async function runUpgradeAuth() {
   await runLogin();
   const newUrl = mcpEndpoint();
   let migrated = 0;
-  for (const path6 of configPaths()) {
-    const config = await readConfig2(path6);
+  for (const path7 of configPaths()) {
+    const config = await readConfig2(path7);
     if (!config) continue;
-    const changed = await rewriteConfig(path6, config, newUrl);
+    const changed = await rewriteConfig(path7, config, newUrl);
     if (changed) {
-      console.log(`  Updated ${path6}`);
+      console.log(`  Updated ${path7}`);
       migrated++;
     }
   }
@@ -1738,8 +1872,8 @@ var init_confirm = __esm({
 });
 
 // src/lib/tech-detect.ts
-import { readFile as readFile8, access, readdir } from "node:fs/promises";
-import { join as join8, relative } from "node:path";
+import { readFile as readFile9, access, readdir } from "node:fs/promises";
+import { join as join9, relative } from "node:path";
 async function fileExists(filePath) {
   try {
     await access(filePath);
@@ -1752,8 +1886,8 @@ async function discoverMonorepoApps(projectPath) {
   const apps = [];
   const patterns = [];
   try {
-    const raw = await readFile8(
-      join8(projectPath, "pnpm-workspace.yaml"),
+    const raw = await readFile9(
+      join9(projectPath, "pnpm-workspace.yaml"),
       "utf-8"
     );
     const matches = raw.match(/^\s*-\s*['"]?([^'"#\n]+)['"]?/gm);
@@ -1767,7 +1901,7 @@ async function discoverMonorepoApps(projectPath) {
   }
   if (patterns.length === 0) {
     try {
-      const raw = await readFile8(join8(projectPath, "package.json"), "utf-8");
+      const raw = await readFile9(join9(projectPath, "package.json"), "utf-8");
       const pkg = JSON.parse(raw);
       const ws = Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces?.packages;
       if (ws) patterns.push(...ws);
@@ -1777,14 +1911,14 @@ async function discoverMonorepoApps(projectPath) {
   for (const pattern of patterns) {
     if (pattern.endsWith("/*")) {
       const dir = pattern.slice(0, -2);
-      const absDir = join8(projectPath, dir);
+      const absDir = join9(projectPath, dir);
       try {
         const entries = await readdir(absDir, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isDirectory()) {
-            const relPath = join8(dir, entry.name);
-            const absPath = join8(absDir, entry.name);
-            if (await fileExists(join8(absPath, "package.json"))) {
+            const relPath = join9(dir, entry.name);
+            const absPath = join9(absDir, entry.name);
+            if (await fileExists(join9(absPath, "package.json"))) {
               apps.push({ name: entry.name, path: relPath, absPath });
             }
           }
@@ -1803,7 +1937,7 @@ async function hasJsxFile(dir, depth = 0) {
       const name = entry.name;
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(name) || JSX_SKIP_DIRS.has(name)) continue;
-        if (await hasJsxFile(join8(dir, name), depth + 1)) return true;
+        if (await hasJsxFile(join9(dir, name), depth + 1)) return true;
       } else if (entry.isFile()) {
         if (JSX_TEST_PATTERN.test(name)) continue;
         if (name.endsWith(".tsx") || name.endsWith(".jsx")) return true;
@@ -1822,7 +1956,7 @@ async function hasJsxFile(dir, depth = 0) {
 async function detectCapabilities(dirPath, pkgJson) {
   const caps = /* @__PURE__ */ new Set();
   for (const sub of JSX_SCAN_DIRS) {
-    if (await hasJsxFile(join8(dirPath, sub))) {
+    if (await hasJsxFile(join9(dirPath, sub))) {
       caps.add("jsx");
       break;
     }
@@ -1844,7 +1978,7 @@ async function detectCapabilities(dirPath, pkgJson) {
       }
     }
   }
-  if (!caps.has("node-server") && await fileExists(join8(dirPath, "src", "main.ts"))) {
+  if (!caps.has("node-server") && await fileExists(join9(dirPath, "src", "main.ts"))) {
     caps.add("node-server");
   }
   if (pkgJson && pkgJson.bin) {
@@ -1860,7 +1994,7 @@ async function detectFromDirectory(dirPath) {
   const seen = /* @__PURE__ */ new Map();
   let pkgJson = null;
   try {
-    const raw = await readFile8(join8(dirPath, "package.json"), "utf-8");
+    const raw = await readFile9(join9(dirPath, "package.json"), "utf-8");
     pkgJson = JSON.parse(raw);
     const allDeps = {
       ...pkgJson.dependencies ?? {},
@@ -1892,7 +2026,7 @@ async function detectFromDirectory(dirPath) {
   }
   for (const { file, rule } of CONFIG_FILE_MAP) {
     const key = rule.name.toLowerCase();
-    if (!seen.has(key) && await fileExists(join8(dirPath, file))) {
+    if (!seen.has(key) && await fileExists(join9(dirPath, file))) {
       seen.set(key, { name: rule.name, category: rule.category });
     }
   }
@@ -2070,7 +2204,7 @@ function categorizeDependency(depName) {
 async function findPackageJsonFiles(dir, projectPath, depth = 0) {
   if (depth > 4) return [];
   const results = [];
-  const pkgPath = join8(dir, "package.json");
+  const pkgPath = join9(dir, "package.json");
   if (await fileExists(pkgPath)) {
     results.push(pkgPath);
   }
@@ -2079,7 +2213,7 @@ async function findPackageJsonFiles(dir, projectPath, depth = 0) {
     for (const entry of entries) {
       if (!entry.isDirectory() || SKIP_DIRS.has(entry.name)) continue;
       const subResults = await findPackageJsonFiles(
-        join8(dir, entry.name),
+        join9(dir, entry.name),
         projectPath,
         depth + 1
       );
@@ -2094,7 +2228,7 @@ async function scanAllDependencies(projectPath) {
   const dependencies = [];
   for (const pkgPath of packageJsonPaths) {
     try {
-      const raw = await readFile8(pkgPath, "utf-8");
+      const raw = await readFile9(pkgPath, "utf-8");
       const pkg = JSON.parse(raw);
       const sourcePath = relative(projectPath, pkgPath);
       const depSections = [
@@ -2718,8 +2852,8 @@ __export(eslint_exports, {
   eslintInit: () => eslintInit,
   runEslint: () => runEslint
 });
-import { readFile as readFile9, writeFile as writeFile7, access as access2, readdir as readdir2 } from "node:fs/promises";
-import { join as join9, relative as relative2 } from "node:path";
+import { readFile as readFile10, writeFile as writeFile8, access as access2, readdir as readdir2 } from "node:fs/promises";
+import { join as join10, relative as relative2 } from "node:path";
 async function fileExists2(filePath) {
   try {
     await access2(filePath);
@@ -2730,7 +2864,7 @@ async function fileExists2(filePath) {
 }
 async function autoDetectIgnorePatterns(absPath) {
   const patterns = [];
-  if (await fileExists2(join9(absPath, "esbuild.js"))) {
+  if (await fileExists2(join10(absPath, "esbuild.js"))) {
     patterns.push("esbuild.js");
   }
   let entries = [];
@@ -2750,19 +2884,19 @@ async function autoDetectIgnorePatterns(absPath) {
   }
   for (const ext of ["ts", "mts", "js", "mjs"]) {
     const candidate = `vitest.config.${ext}`;
-    if (await fileExists2(join9(absPath, candidate))) {
+    if (await fileExists2(join10(absPath, candidate))) {
       patterns.push(candidate);
       break;
     }
   }
   for (const ext of ["ts", "mts", "js", "mjs"]) {
     const candidate = `vite.config.${ext}`;
-    if (await fileExists2(join9(absPath, candidate))) {
+    if (await fileExists2(join10(absPath, candidate))) {
       patterns.push(candidate);
       break;
     }
   }
-  if (await fileExists2(join9(absPath, "tauri.conf.json"))) {
+  if (await fileExists2(join10(absPath, "tauri.conf.json"))) {
     patterns.push("src-tauri/**");
     patterns.push("**/*.d.ts");
   }
@@ -2770,14 +2904,14 @@ async function autoDetectIgnorePatterns(absPath) {
 }
 function detectPackageManager(projectPath) {
   return (async () => {
-    if (await fileExists2(join9(projectPath, "pnpm-lock.yaml"))) return "pnpm";
-    if (await fileExists2(join9(projectPath, "yarn.lock"))) return "yarn";
+    if (await fileExists2(join10(projectPath, "pnpm-lock.yaml"))) return "pnpm";
+    if (await fileExists2(join10(projectPath, "yarn.lock"))) return "yarn";
     return "npm";
   })();
 }
 async function getInstalledDeps(pkgJsonPath) {
   try {
-    const raw = await readFile9(pkgJsonPath, "utf-8");
+    const raw = await readFile10(pkgJsonPath, "utf-8");
     const pkg = JSON.parse(raw);
     const all = /* @__PURE__ */ new Set();
     for (const name of Object.keys(pkg.dependencies ?? {})) all.add(name);
@@ -2890,7 +3024,7 @@ async function eslintInit(repoId, projectPath) {
       ignorePatterns: detectedIgnores
     });
     const hash = hashConfig(content);
-    const configPath = join9(target.absPath, "eslint.config.mjs");
+    const configPath = join10(target.absPath, "eslint.config.mjs");
     configsToWrite.push({
       target,
       presets,
@@ -2912,11 +3046,11 @@ async function eslintInit(repoId, projectPath) {
     return;
   }
   const pm = await detectPackageManager(projectPath);
-  const rootPkgJsonPath = join9(projectPath, "package.json");
+  const rootPkgJsonPath = join10(projectPath, "package.json");
   const installed = await getInstalledDeps(rootPkgJsonPath);
   if (isMonorepo) {
     for (const { target } of configsToWrite) {
-      const appPkgJson = join9(target.absPath, "package.json");
+      const appPkgJson = join10(target.absPath, "package.json");
       const appDeps = await getInstalledDeps(appPkgJson);
       for (const dep of appDeps) {
         installed.add(dep);
@@ -2968,7 +3102,7 @@ async function eslintInit(repoId, projectPath) {
   } of configsToWrite) {
     if (await fileExists2(configPath)) {
       try {
-        const existing = await readFile9(configPath, "utf-8");
+        const existing = await readFile10(configPath, "utf-8");
         const existingHash = hashConfig(existing);
         if (existingHash === hash) {
           console.log(
@@ -2988,7 +3122,7 @@ async function eslintInit(repoId, projectPath) {
       }
     }
     try {
-      await writeFile7(configPath, content, "utf-8");
+      await writeFile8(configPath, content, "utf-8");
     } catch (err) {
       console.error(
         `  ${target.name}: Failed to write config: ${err instanceof Error ? err.message : String(err)}`
@@ -3292,12 +3426,48 @@ var init_sync_approvals = __esm({
 // src/cli/round.ts
 var round_exports = {};
 __export(round_exports, {
+  RETRY_DELAY_MS: () => RETRY_DELAY_MS,
+  fetchRoundsWithRetry: () => fetchRoundsWithRetry,
+  isTransientMcpError: () => isTransientMcpError,
   runRoundCommand: () => runRoundCommand,
-  runRoundSyncApprovals: () => runRoundSyncApprovals
+  runRoundSyncApprovals: () => runRoundSyncApprovals,
+  setRetryDelayMs: () => setRetryDelayMs
 });
 import { access as access3 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
+function setRetryDelayMs(ms) {
+  RETRY_DELAY_MS = ms;
+}
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+function isTransientMcpError(err) {
+  if (!(err instanceof McpError)) return false;
+  if (err.status !== void 0) {
+    return err.status >= 500 && err.status <= 599;
+  }
+  return err.message.toLowerCase().includes("network error");
+}
+async function fetchRoundsWithRetry(taskId, options = {}) {
+  const maxRetries = options.retries ?? 2;
+  const delayMs = options.delayMs ?? RETRY_DELAY_MS;
+  let lastErr;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      return await mcpCall("get_rounds", { task_id: taskId });
+    } catch (err) {
+      if (!isTransientMcpError(err)) {
+        throw err;
+      }
+      lastErr = err;
+      if (attempt < maxRetries) {
+        await sleep(delayMs);
+      }
+    }
+  }
+  throw lastErr;
+}
 async function runRoundCommand(args) {
   const subcommand = args[0];
   if (subcommand === "sync-approvals") {
@@ -3321,7 +3491,7 @@ Run 'codebyplan round help' for usage.
 }
 function printRoundHelp() {
   process.stdout.write(
-    "\n  codebyplan round <subcommand>\n\n  Subcommands:\n    sync-approvals   Sync git diff and approvals with round/task state\n\n  sync-approvals flags:\n    --round-id <uuid>     Round UUID (required)\n    --task-id <uuid>      Task UUID (required)\n    --worktree-id <uuid>  Worktree UUID (optional; auto-resolved if absent)\n    --dry-run             Print merged payload to stdout without writing\n\n"
+    "\n  codebyplan round <subcommand>\n\n  Subcommands:\n    sync-approvals   Sync git diff and approvals with round/task state\n\n  sync-approvals flags:\n    --round-id <uuid>     Round UUID (required)\n    --task-id <uuid>      Task UUID (required)\n    --dry-run             Print merged payload to stdout without writing\n\n"
   );
 }
 function parseFlagsFromArgs(args) {
@@ -3359,95 +3529,95 @@ async function runRoundSyncApprovals(args) {
     );
     process.exit(1);
   }
+  let skipReason = null;
   let stdoutPayload = null;
   try {
-    let callerWorktreeId = flags["worktree-id"];
-    if (!callerWorktreeId) {
-      callerWorktreeId = await autoResolveWorktreeId();
-    }
     const found = await findCodebyplanConfig(process.cwd());
     const repoRoot = found ? (
       // Walk up to the directory containing .codebyplan/ or .codebyplan.json
       found.path.replace(/\/.codebyplan(\.json|\/repo\.json)$/, "")
     ) : process.cwd();
-    const rounds = await mcpCall("get_rounds", {
-      task_id: taskId
-    });
-    const currentRound = rounds.find((r) => r.id === roundId);
-    if (!currentRound) {
-      throw new Error(`Round ${roundId} not found for task ${taskId}`);
-    }
-    const taskResponse = await apiGet(`/tasks/${taskId}`);
-    const currentTask = taskResponse.data;
-    let gitStatusOutput = "";
-    try {
-      gitStatusOutput = execSync2("git status --short --porcelain -z", {
-        cwd: repoRoot,
-        encoding: "utf-8"
-      });
-    } catch {
-      process.stderr.write(
-        "sync-approvals: git status failed; proceeding with empty diff\n"
-      );
-    }
-    const hookPath = join10(
-      repoRoot,
-      ".claude",
-      "hooks",
-      "lint-format-on-edit.sh"
-    );
-    let lintFormatHookExists = false;
+    let rounds;
     try {
-      await access3(hookPath);
-      lintFormatHookExists = true;
-    } catch {
+      rounds = await fetchRoundsWithRetry(taskId);
+    } catch (err) {
+      if (isTransientMcpError(err)) {
+        const reason = err instanceof McpError ? err.message : err instanceof Error ? err.message : String(err);
+        skipReason = reason;
+        rounds = [];
+      } else {
+        throw err;
+      }
     }
-    const result = runSyncApprovals({
-      currentRound,
-      currentTask,
-      gitStatusOutput,
-      lintFormatHookExists
-    });
-    if (dryRun) {
-      stdoutPayload = JSON.stringify(
-        {
-          added: result.added,
-          stale_marked: result.stale_marked,
-          reactivated: result.reactivated,
-          total_files: result.total_files,
-          merged_files_changed: result.merged_files_changed
-        },
-        null,
-        2
-      );
-    } else {
-      const roundArgs = {
-        round_id: roundId,
-        files_changed: result.merged_files_changed
-      };
-      if (callerWorktreeId) {
-        roundArgs["caller_worktree_id"] = callerWorktreeId;
+    if (!skipReason) {
+      const currentRound = rounds.find((r) => r.id === roundId);
+      if (!currentRound) {
+        throw new Error(`Round ${roundId} not found for task ${taskId}`);
       }
-      await mcpCall("update_round", roundArgs);
-      const taskArgs = {
-        task_id: taskId,
-        files_changed: result.merged_files_changed,
-        app_file_approval_by_user: false
-      };
-      if (callerWorktreeId) {
-        taskArgs["caller_worktree_id"] = callerWorktreeId;
+      const taskResponse = await apiGet(`/tasks/${taskId}`);
+      const currentTask = taskResponse.data;
+      let gitStatusOutput = "";
+      try {
+        gitStatusOutput = execSync2("git status --short --porcelain -z", {
+          cwd: repoRoot,
+          encoding: "utf-8"
+        });
+      } catch {
+        process.stderr.write(
+          "sync-approvals: git status failed; proceeding with empty diff\n"
+        );
       }
-      await mcpCall("update_task", taskArgs);
-      stdoutPayload = JSON.stringify(
-        {
-          added: result.added,
-          stale_marked: result.stale_marked,
-          reactivated: result.reactivated,
-          total_files: result.total_files
-        },
-        null,
-        2
+      const hookPath = join11(
+        repoRoot,
+        ".claude",
+        "hooks",
+        "lint-format-on-edit.sh"
       );
+      let lintFormatHookExists = false;
+      try {
+        await access3(hookPath);
+        lintFormatHookExists = true;
+      } catch {
+      }
+      const result = runSyncApprovals({
+        currentRound,
+        currentTask,
+        gitStatusOutput,
+        lintFormatHookExists
+      });
+      if (dryRun) {
+        stdoutPayload = JSON.stringify(
+          {
+            added: result.added,
+            stale_marked: result.stale_marked,
+            reactivated: result.reactivated,
+            total_files: result.total_files,
+            merged_files_changed: result.merged_files_changed
+          },
+          null,
+          2
+        );
+      } else {
+        await mcpCall("update_round", {
+          round_id: roundId,
+          files_changed: result.merged_files_changed
+        });
+        await mcpCall("update_task", {
+          task_id: taskId,
+          files_changed: result.merged_files_changed,
+          app_file_approval_by_user: false
+        });
+        stdoutPayload = JSON.stringify(
+          {
+            added: result.added,
+            stale_marked: result.stale_marked,
+            reactivated: result.reactivated,
+            total_files: result.total_files
+          },
+          null,
+          2
+        );
+      }
     }
   } catch (err) {
     process.stderr.write(
@@ -3456,6 +3626,13 @@ async function runRoundSyncApprovals(args) {
     );
     process.exit(1);
   }
+  if (skipReason !== null) {
+    process.stderr.write(
+      `sync-approvals: MCP temporarily unavailable (${skipReason}); skipping approval sync. Re-run /cbp-round-update when the service recovers.
+`
+    );
+    process.exit(0);
+  }
   if (stdoutPayload === null) {
     process.stderr.write("sync-approvals: internal error \u2014 payload not set\n");
     process.exit(1);
@@ -3463,57 +3640,21 @@ async function runRoundSyncApprovals(args) {
   process.stdout.write(stdoutPayload + "\n");
   process.exit(0);
 }
-async function autoResolveWorktreeId() {
-  try {
-    const projectPath = process.cwd();
-    const found = await findCodebyplanConfig(projectPath);
-    if (!found?.contents.repo_id) return void 0;
-    const repoId = found.contents.repo_id;
-    const deviceId = await getOrCreateDeviceId(projectPath);
-    let branch = "";
-    try {
-      branch = execSync2("git symbolic-ref --short HEAD", {
-        cwd: projectPath,
-        encoding: "utf-8"
-      }).trim();
-    } catch {
-    }
-    const worktreeId = await resolveWorktreeId({
-      repoId,
-      repoPath: projectPath,
-      branch,
-      deviceId
-    });
-    if (worktreeId) return worktreeId;
-    const fallbackId = await resolveWorktreeByBranch({
-      repoId,
-      deviceId,
-      branch
-    });
-    if (fallbackId) return fallbackId;
-    process.stderr.write(
-      "sync-approvals: could not resolve worktree id; proceeding without caller_worktree_id\n"
-    );
-    return void 0;
-  } catch {
-    return void 0;
-  }
-}
+var RETRY_DELAY_MS;
 var init_round = __esm({
   "src/cli/round.ts"() {
     "use strict";
     init_api();
     init_mcp_client();
     init_flags();
-    init_resolve_worktree();
-    init_local_config();
     init_sync_approvals();
+    RETRY_DELAY_MS = 1e3;
   }
 });
 
 // src/lib/migrate-branch-model.ts
-import { readFile as readFile10, writeFile as writeFile8 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { readFile as readFile11, writeFile as writeFile9 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 import { execSync as execSync3 } from "node:child_process";
 function assertValidBranchName(branch) {
   if (!/^[a-zA-Z0-9/_.-]+$/.test(branch)) {
@@ -3523,7 +3664,7 @@ function assertValidBranchName(branch) {
   }
 }
 async function readJsonFile(filePath) {
-  const raw = await readFile10(filePath, "utf-8");
+  const raw = await readFile11(filePath, "utf-8");
   const parsed = JSON.parse(raw);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     throw new Error(`${filePath} does not contain a JSON object`);
@@ -3592,12 +3733,12 @@ async function runBranchMigration(opts) {
   if (found) {
     if (found.path.endsWith("/repo.json")) {
       const dir = found.path.slice(0, found.path.lastIndexOf("/"));
-      configPath = join11(dir, "git.json");
+      configPath = join12(dir, "git.json");
     } else {
       configPath = found.path;
     }
   } else {
-    configPath = join11(cwd, ".codebyplan", "git.json");
+    configPath = join12(cwd, ".codebyplan", "git.json");
   }
   let fileRaw;
   let fileParsed;
@@ -3671,7 +3812,7 @@ async function runBranchMigration(opts) {
     const updatedParsed = { ...fileParsed, branch_config: after };
     const newJson = JSON.stringify(updatedParsed, null, 2) + "\n";
     if (newJson !== fileRaw) {
-      await writeFile8(configPath, newJson, "utf-8");
+      await writeFile9(configPath, newJson, "utf-8");
     }
   }
   return {
@@ -3777,8 +3918,8 @@ var init_branch = __esm({
 });
 
 // src/lib/ship.ts
-import { readFile as readFile11 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 import { execSync as execSync4, spawnSync as spawnSync2 } from "node:child_process";
 function assertValidBranchName2(branch, label) {
   if (!/^[a-zA-Z0-9/_.-]+$/.test(branch)) {
@@ -3793,15 +3934,15 @@ async function readBaseBranch(cwd) {
   if (found) {
     if (found.path.endsWith("/repo.json")) {
       const dir = found.path.slice(0, found.path.lastIndexOf("/"));
-      gitJsonPath = join12(dir, "git.json");
+      gitJsonPath = join13(dir, "git.json");
     } else {
       gitJsonPath = found.path;
     }
   } else {
-    gitJsonPath = join12(cwd, ".codebyplan", "git.json");
+    gitJsonPath = join13(cwd, ".codebyplan", "git.json");
   }
   try {
-    const raw = await readFile11(gitJsonPath, "utf-8");
+    const raw = await readFile12(gitJsonPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return "main";
@@ -4333,19 +4474,19 @@ var init_resolve_worktree2 = __esm({
 });
 
 // src/lib/migrate-local-config.ts
-import { mkdir as mkdir5, readFile as readFile12, unlink as unlink2, writeFile as writeFile9 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile13, unlink as unlink2, writeFile as writeFile10 } from "node:fs/promises";
+import { join as join14 } from "node:path";
 function legacySharedPath(projectPath) {
-  return join13(projectPath, ".codebyplan.json");
+  return join14(projectPath, ".codebyplan.json");
 }
 function legacyLocalPath(projectPath) {
-  return join13(projectPath, ".codebyplan.local.json");
+  return join14(projectPath, ".codebyplan.local.json");
 }
 function newDirPath(projectPath) {
-  return join13(projectPath, ".codebyplan");
+  return join14(projectPath, ".codebyplan");
 }
 function sentinelPath(projectPath) {
-  return join13(projectPath, ".codebyplan", "repo.json");
+  return join14(projectPath, ".codebyplan", "repo.json");
 }
 async function statSafe(p) {
   const { stat: stat2 } = await import("node:fs/promises");
@@ -4384,7 +4525,7 @@ async function runLocalMigration(projectPath) {
   }
   let legacyRaw;
   try {
-    legacyRaw = await readFile12(legacySharedPath(projectPath), "utf-8");
+    legacyRaw = await readFile13(legacySharedPath(projectPath), "utf-8");
   } catch {
     return {
       migrated: true,
@@ -4411,7 +4552,7 @@ async function runLocalMigration(projectPath) {
   let deviceId;
   let deviceWrittenByHelper = false;
   try {
-    const localRaw = await readFile12(legacyLocalPath(projectPath), "utf-8");
+    const localRaw = await readFile13(legacyLocalPath(projectPath), "utf-8");
     const localParsed = JSON.parse(localRaw);
     if (typeof localParsed.device_id === "string") {
       deviceId = localParsed.device_id;
@@ -4438,8 +4579,8 @@ async function runLocalMigration(projectPath) {
   if ("repo_id" in cfg) repoJson.repo_id = cfg.repo_id;
   if ("organization_id" in cfg) repoJson.organization_id = cfg.organization_id;
   if ("project_id" in cfg) repoJson.project_id = cfg.project_id;
-  await writeFile9(
-    join13(projectPath, ".codebyplan", "repo.json"),
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "repo.json"),
     JSON.stringify(repoJson, null, 2) + "\n",
     "utf-8"
   );
@@ -4451,8 +4592,8 @@ async function runLocalMigration(projectPath) {
     serverJson.auto_push_enabled = cfg.auto_push_enabled;
   if ("port_allocations" in cfg)
     serverJson.port_allocations = cfg.port_allocations;
-  await writeFile9(
-    join13(projectPath, ".codebyplan", "server.json"),
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "server.json"),
     JSON.stringify(serverJson, null, 2) + "\n",
     "utf-8"
   );
@@ -4460,37 +4601,44 @@ async function runLocalMigration(projectPath) {
   const gitJson = {};
   if ("git_branch" in cfg) gitJson.git_branch = cfg.git_branch;
   if ("branch_config" in cfg) gitJson.branch_config = cfg.branch_config;
-  await writeFile9(
-    join13(projectPath, ".codebyplan", "git.json"),
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "git.json"),
     JSON.stringify(gitJson, null, 2) + "\n",
     "utf-8"
   );
   filesChanged.push(".codebyplan/git.json");
   const shipmentJson = {};
   if ("shipment" in cfg) shipmentJson.shipment = cfg.shipment;
-  await writeFile9(
-    join13(projectPath, ".codebyplan", "shipment.json"),
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "shipment.json"),
     JSON.stringify(shipmentJson, null, 2) + "\n",
     "utf-8"
   );
   filesChanged.push(".codebyplan/shipment.json");
   const vendorJson = {};
-  await writeFile9(
-    join13(projectPath, ".codebyplan", "vendor.json"),
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "vendor.json"),
     JSON.stringify(vendorJson, null, 2) + "\n",
     "utf-8"
   );
   filesChanged.push(".codebyplan/vendor.json");
   const e2eJson = {};
-  await writeFile9(
-    join13(projectPath, ".codebyplan", "e2e.json"),
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "e2e.json"),
     JSON.stringify(e2eJson, null, 2) + "\n",
     "utf-8"
   );
   filesChanged.push(".codebyplan/e2e.json");
+  const eslintJson = {};
+  await writeFile10(
+    join14(projectPath, ".codebyplan", "eslint.json"),
+    JSON.stringify(eslintJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/eslint.json");
   if (!deviceWrittenByHelper) {
-    await writeFile9(
-      join13(projectPath, ".codebyplan", "device.local.json"),
+    await writeFile10(
+      join14(projectPath, ".codebyplan", "device.local.json"),
       JSON.stringify({ device_id: deviceId }, null, 2) + "\n",
       "utf-8"
     );
@@ -4502,9 +4650,9 @@ async function runLocalMigration(projectPath) {
       "Migration write incomplete: .codebyplan/repo.json was not persisted. Re-run migration to retry from a clean state."
     );
   }
-  const gitignorePath = join13(projectPath, ".gitignore");
+  const gitignorePath = join14(projectPath, ".gitignore");
   try {
-    const gitignoreContent = await readFile12(gitignorePath, "utf-8");
+    const gitignoreContent = await readFile13(gitignorePath, "utf-8");
     const legacyLine = ".codebyplan.local.json";
     const newLine = ".codebyplan/device.local.json";
     const hasLegacy = gitignoreContent.split("\n").some((l) => l.trimEnd() === legacyLine);
@@ -4523,7 +4671,7 @@ async function runLocalMigration(projectPath) {
       updated = gitignoreContent;
     }
     if (updated !== gitignoreContent) {
-      await writeFile9(gitignorePath, updated, "utf-8");
+      await writeFile10(gitignorePath, updated, "utf-8");
       filesChanged.push(".gitignore");
     }
   } catch {
@@ -4563,8 +4711,8 @@ __export(config_exports, {
   readVendorConfig: () => readVendorConfig,
   runConfig: () => runConfig
 });
-import { mkdir as mkdir6, readFile as readFile13, writeFile as writeFile10 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile14, writeFile as writeFile11 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 async function runConfig() {
   const flags = parseFlags(3);
   const dryRun = hasFlag("dry-run", 3);
@@ -4597,7 +4745,7 @@ async function runConfig() {
   console.log("\n  Config complete.\n");
 }
 async function syncConfigToFile(repoId, projectPath, dryRun) {
-  const codebyplanDir = join14(projectPath, ".codebyplan");
+  const codebyplanDir = join15(projectPath, ".codebyplan");
   let resolvedWorktreeId;
   try {
     const deviceId = await getOrCreateDeviceId(projectPath);
@@ -4723,6 +4871,7 @@ async function syncConfigToFile(repoId, projectPath, dryRun) {
   }
   const vendorPayload = {};
   const e2ePayload = {};
+  const eslintPayload = {};
   if (dryRun) {
     console.log("  Config would be updated (dry-run).");
     return;
@@ -4734,20 +4883,21 @@ async function syncConfigToFile(repoId, projectPath, dryRun) {
     { name: "git.json", payload: gitPayload },
     { name: "shipment.json", payload: shipmentPayload },
     { name: "vendor.json", payload: vendorPayload },
-    { name: "e2e.json", payload: e2ePayload, createOnly: true }
+    { name: "e2e.json", payload: e2ePayload, createOnly: true },
+    { name: "eslint.json", payload: eslintPayload, createOnly: true }
   ];
   let anyUpdated = false;
   for (const { name, payload, createOnly } of files) {
-    const filePath = join14(codebyplanDir, name);
+    const filePath = join15(codebyplanDir, name);
     const newJson = JSON.stringify(payload, null, 2) + "\n";
     let currentJson = "";
     try {
-      currentJson = await readFile13(filePath, "utf-8");
+      currentJson = await readFile14(filePath, "utf-8");
     } catch {
     }
     if (createOnly && currentJson !== "") continue;
     if (currentJson === newJson) continue;
-    await writeFile10(filePath, newJson, "utf-8");
+    await writeFile11(filePath, newJson, "utf-8");
     console.log(`  Updated .codebyplan/${name}`);
     anyUpdated = true;
   }
@@ -4757,8 +4907,8 @@ async function syncConfigToFile(repoId, projectPath, dryRun) {
 }
 async function readRepoConfig(projectPath) {
   try {
-    const raw = await readFile13(
-      join14(projectPath, ".codebyplan", "repo.json"),
+    const raw = await readFile14(
+      join15(projectPath, ".codebyplan", "repo.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -4768,8 +4918,8 @@ async function readRepoConfig(projectPath) {
 }
 async function readServerConfig(projectPath) {
   try {
-    const raw = await readFile13(
-      join14(projectPath, ".codebyplan", "server.json"),
+    const raw = await readFile14(
+      join15(projectPath, ".codebyplan", "server.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -4779,8 +4929,8 @@ async function readServerConfig(projectPath) {
 }
 async function readGitConfig(projectPath) {
   try {
-    const raw = await readFile13(
-      join14(projectPath, ".codebyplan", "git.json"),
+    const raw = await readFile14(
+      join15(projectPath, ".codebyplan", "git.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -4790,8 +4940,8 @@ async function readGitConfig(projectPath) {
 }
 async function readShipmentConfig(projectPath) {
   try {
-    const raw = await readFile13(
-      join14(projectPath, ".codebyplan", "shipment.json"),
+    const raw = await readFile14(
+      join15(projectPath, ".codebyplan", "shipment.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -4801,8 +4951,8 @@ async function readShipmentConfig(projectPath) {
 }
 async function readVendorConfig(projectPath) {
   try {
-    const raw = await readFile13(
-      join14(projectPath, ".codebyplan", "vendor.json"),
+    const raw = await readFile14(
+      join15(projectPath, ".codebyplan", "vendor.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -4812,8 +4962,8 @@ async function readVendorConfig(projectPath) {
 }
 async function readE2eConfig(projectPath) {
   try {
-    const raw = await readFile13(
-      join14(projectPath, ".codebyplan", "e2e.json"),
+    const raw = await readFile14(
+      join15(projectPath, ".codebyplan", "e2e.json"),
       "utf-8"
     );
     return JSON.parse(raw);
@@ -4869,14 +5019,14 @@ var init_server_detect = __esm({
 });
 
 // src/lib/port-verify.ts
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 async function verifyPorts(projectPath, portAllocations) {
   const mismatches = [];
   const allocatedPorts = new Set(portAllocations.map((a) => a.port));
   const packageJsonPaths = await findPackageJsonFiles(projectPath, projectPath);
   for (const pkgPath of packageJsonPaths) {
     try {
-      const raw = await readFile14(pkgPath, "utf-8");
+      const raw = await readFile15(pkgPath, "utf-8");
       const pkg = JSON.parse(raw);
       const scriptPort = detectPortFromScripts(pkg);
       if (scriptPort !== null && !allocatedPorts.has(scriptPort)) {
@@ -4939,7 +5089,7 @@ async function findUnallocatedApps(projectPath, portAllocations) {
     }
     let pkg;
     try {
-      const raw = await readFile14(`${app.absPath}/package.json`, "utf-8");
+      const raw = await readFile15(`${app.absPath}/package.json`, "utf-8");
       pkg = JSON.parse(raw);
     } catch {
       continue;
@@ -5309,7 +5459,7 @@ var init_hash = __esm({
 
 // src/lib/template-walker.ts
 import * as fs from "node:fs";
-import * as path from "node:path";
+import * as path2 from "node:path";
 function walkTemplates(templatesDir) {
   const absRoot = fs.realpathSync(templatesDir);
   const visited = /* @__PURE__ */ new Set();
@@ -5322,7 +5472,7 @@ function walkTemplates(templatesDir) {
     visited.add(realDir);
     const entries = fs.readdirSync(absDir, { withFileTypes: true });
     for (const entry of entries) {
-      const absPath = path.join(absDir, entry.name);
+      const absPath = path2.join(absDir, entry.name);
       if (entry.isDirectory()) {
         recurse(absPath);
         continue;
@@ -5331,7 +5481,7 @@ function walkTemplates(templatesDir) {
         continue;
       }
       if (entry.name === ".gitkeep") continue;
-      const relPosix = path.relative(absRoot, absPath).split(path.sep).join("/");
+      const relPosix = path2.relative(absRoot, absPath).split(path2.sep).join("/");
       if (EXCLUDED_RELATIVE_PATHS.has(relPosix)) {
         continue;
       }
@@ -5359,6 +5509,10 @@ var init_template_walker = __esm({
       "rules/README.md",
       "settings.project.base.json",
       "settings.user.base.json",
+      // .gitignore — managed by ensureManagedGitignoreBlock; never copied into
+      // consuming projects' .claude/ tree (it would overwrite the project root
+      // .gitignore with a stale single-entry file).
+      ".gitignore",
       // CBP-internal hooks — see templates/hooks/README.md "Hooks NOT included and why"
       "hooks/validate-structure.sh",
       "hooks/validate-structure-lib.sh",
@@ -5376,15 +5530,15 @@ var init_template_walker = __esm({
 // src/lib/manifest.ts
 import * as fs2 from "node:fs";
 import * as os from "node:os";
-import * as path2 from "node:path";
+import * as path3 from "node:path";
 function manifestPath(projectDir) {
-  return path2.join(projectDir, ".claude", NEW_MANIFEST_FILENAME);
+  return path3.join(projectDir, ".claude", NEW_MANIFEST_FILENAME);
 }
 function midManifestPath(projectDir) {
-  return path2.join(projectDir, ".claude", MID_MANIFEST_FILENAME);
+  return path3.join(projectDir, ".claude", MID_MANIFEST_FILENAME);
 }
 function oldManifestPath(projectDir) {
-  return path2.join(projectDir, ".claude", OLD_MANIFEST_FILENAME);
+  return path3.join(projectDir, ".claude", OLD_MANIFEST_FILENAME);
 }
 function readManifest(projectDir) {
   const newFile = manifestPath(projectDir);
@@ -5406,7 +5560,7 @@ function readManifest(projectDir) {
 }
 function writeManifest(projectDir, manifest) {
   const file = manifestPath(projectDir);
-  fs2.mkdirSync(path2.dirname(file), { recursive: true });
+  fs2.mkdirSync(path3.dirname(file), { recursive: true });
   fs2.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf8");
   const mid = midManifestPath(projectDir);
   if (fs2.existsSync(mid)) {
@@ -5425,16 +5579,16 @@ function defaultManifest() {
   };
 }
 function userManifestPath(userDir) {
-  const dir = userDir ?? path2.join(os.homedir(), ".claude");
-  return path2.join(dir, NEW_MANIFEST_FILENAME);
+  const dir = userDir ?? path3.join(os.homedir(), ".claude");
+  return path3.join(dir, NEW_MANIFEST_FILENAME);
 }
 function userMidManifestPath(userDir) {
-  const dir = userDir ?? path2.join(os.homedir(), ".claude");
-  return path2.join(dir, MID_MANIFEST_FILENAME);
+  const dir = userDir ?? path3.join(os.homedir(), ".claude");
+  return path3.join(dir, MID_MANIFEST_FILENAME);
 }
 function userOldManifestPath(userDir) {
-  const dir = userDir ?? path2.join(os.homedir(), ".claude");
-  return path2.join(dir, OLD_MANIFEST_FILENAME);
+  const dir = userDir ?? path3.join(os.homedir(), ".claude");
+  return path3.join(dir, OLD_MANIFEST_FILENAME);
 }
 function readManifestForScope(scope, arg2) {
   if (scope === "user") {
@@ -5460,7 +5614,7 @@ function readManifestForScope(scope, arg2) {
 function writeManifestForScope(scope, manifest, arg3) {
   if (scope === "user") {
     const file = userManifestPath(arg3);
-    fs2.mkdirSync(path2.dirname(file), { recursive: true });
+    fs2.mkdirSync(path3.dirname(file), { recursive: true });
     fs2.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf8");
     const mid = userMidManifestPath(arg3);
     if (fs2.existsSync(mid)) {
@@ -5716,14 +5870,14 @@ __export(install_exports, {
 });
 import * as fs3 from "node:fs";
 import * as os2 from "node:os";
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveTemplatesDir() {
-  const here = path3.dirname(fileURLToPath(import.meta.url));
+  const here = path4.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path3.resolve(here, "..", "templates"),
-    path3.resolve(here, "..", "..", "templates"),
-    path3.resolve(here, "..", "..", "..", "templates")
+    path4.resolve(here, "..", "templates"),
+    path4.resolve(here, "..", "..", "templates"),
+    path4.resolve(here, "..", "..", "..", "templates")
   ];
   for (const c of candidates) {
     if (fs3.existsSync(c) && fs3.statSync(c).isDirectory()) {
@@ -5764,14 +5918,14 @@ async function runInstall(opts, deps = {}) {
     const files = walkTemplates(templatesDir);
     const manifestEntries = [];
     for (const f of files) {
-      const absDest = path3.join(projectDir, ".claude", f.dest);
-      const absSrc = path3.join(templatesDir, f.src);
+      const absDest = path4.join(projectDir, ".claude", f.dest);
+      const absSrc = path4.join(templatesDir, f.src);
       if (opts.dryRun) {
         if (opts.verbose) {
           console.log(`[dry-run] would copy ${f.src} \u2192 .claude/${f.dest}`);
         }
       } else {
-        fs3.mkdirSync(path3.dirname(absDest), { recursive: true });
+        fs3.mkdirSync(path4.dirname(absDest), { recursive: true });
         fs3.copyFileSync(absSrc, absDest);
         if (opts.verbose) {
           console.log(`copied ${f.src} \u2192 .claude/${f.dest}`);
@@ -5779,15 +5933,15 @@ async function runInstall(opts, deps = {}) {
       }
       manifestEntries.push({ src: f.src, dest: f.dest, hash: f.hash });
     }
-    const hooksJsonPath = path3.join(templatesDir, "hooks", "hooks.json");
-    const baseSettingsPath = path3.join(
+    const hooksJsonPath = path4.join(templatesDir, "hooks", "hooks.json");
+    const baseSettingsPath = path4.join(
       templatesDir,
       "settings.project.base.json"
     );
     const hasHooks = fs3.existsSync(hooksJsonPath);
     const hasBase = fs3.existsSync(baseSettingsPath);
     if (hasHooks || hasBase) {
-      const settingsPath = path3.join(projectDir, ".claude", "settings.json");
+      const settingsPath = path4.join(projectDir, ".claude", "settings.json");
       const existingSettings = fs3.existsSync(settingsPath) ? JSON.parse(fs3.readFileSync(settingsPath, "utf8")) : {};
       if (hasBase) {
         const base = JSON.parse(
@@ -5802,7 +5956,7 @@ async function runInstall(opts, deps = {}) {
         mergeHooksIntoSettings(existingSettings, hooksJson);
       }
       if (!opts.dryRun) {
-        fs3.mkdirSync(path3.dirname(settingsPath), { recursive: true });
+        fs3.mkdirSync(path4.dirname(settingsPath), { recursive: true });
         fs3.writeFileSync(
           settingsPath,
           JSON.stringify(existingSettings, null, 2) + "\n",
@@ -5810,10 +5964,19 @@ async function runInstall(opts, deps = {}) {
         );
       } else if (opts.verbose) {
         console.log(
-          `[dry-run] would merge settings into ${path3.relative(projectDir, settingsPath)}`
+          `[dry-run] would merge settings into ${path4.relative(projectDir, settingsPath)}`
         );
       }
     }
+    const gitignoreAction = await ensureManagedGitignoreBlock(
+      projectDir,
+      opts.dryRun
+    );
+    if (opts.verbose && gitignoreAction !== "unchanged") {
+      console.log(
+        `${opts.dryRun ? "[dry-run] would " : ""}${gitignoreAction} managed .gitignore block in ${path4.relative(projectDir, path4.join(projectDir, ".gitignore"))}`
+      );
+    }
     if (!opts.dryRun) {
       const manifest = defaultManifest();
       manifest.files = manifestEntries;
@@ -5844,9 +6007,9 @@ function runInstallUser(opts, deps) {
     return;
   }
   try {
-    const userDir = deps.userDir ?? path3.join(os2.homedir(), ".claude");
-    const settingsPath = path3.join(userDir, "settings.json");
-    const userBaseSettingsPath = path3.join(
+    const userDir = deps.userDir ?? path4.join(os2.homedir(), ".claude");
+    const settingsPath = path4.join(userDir, "settings.json");
+    const userBaseSettingsPath = path4.join(
       templatesDir,
       "settings.user.base.json"
     );
@@ -5888,7 +6051,7 @@ function runInstallUser(opts, deps) {
   }
 }
 function countHookEntries(templatesDir) {
-  const p = path3.join(templatesDir, "hooks", "hooks.json");
+  const p = path4.join(templatesDir, "hooks", "hooks.json");
   if (!fs3.existsSync(p)) return 0;
   try {
     const j = JSON.parse(fs3.readFileSync(p, "utf8"));
@@ -5908,6 +6071,7 @@ var init_install = __esm({
   "src/cli/claude/install.ts"() {
     "use strict";
     init_template_walker();
+    init_gitignore_block();
     init_manifest();
     init_settings_merge();
     init_statusline_config();
@@ -6032,7 +6196,7 @@ __export(update_exports, {
 });
 import * as fs4 from "node:fs";
 import * as os3 from "node:os";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 async function runUpdate(opts, deps = {}) {
   await Promise.resolve();
@@ -6072,9 +6236,9 @@ async function runUpdate(opts, deps = {}) {
       finalManifestEntries.push(e);
     }
     for (const { packaged, absSrc } of plan.overwriteSafe) {
-      const absDest = path4.join(projectDir, ".claude", packaged.dest);
+      const absDest = path5.join(projectDir, ".claude", packaged.dest);
       if (!opts.dryRun) {
-        fs4.mkdirSync(path4.dirname(absDest), { recursive: true });
+        fs4.mkdirSync(path5.dirname(absDest), { recursive: true });
         fs4.copyFileSync(absSrc, absDest);
         if (opts.verbose) console.log(`updated ${packaged.dest}`);
       } else if (opts.verbose) {
@@ -6087,7 +6251,7 @@ async function runUpdate(opts, deps = {}) {
       absSrc,
       onDiskContent
     } of plan.overwriteHandEdited) {
-      const absDest = path4.join(projectDir, ".claude", packaged.dest);
+      const absDest = path5.join(projectDir, ".claude", packaged.dest);
       const newContent = fs4.readFileSync(absSrc);
       const showDiff = () => {
         console.log(
@@ -6100,7 +6264,7 @@ async function runUpdate(opts, deps = {}) {
       const answer = await promptOverwrite(packaged.dest, opts, showDiff);
       if (answer === "overwrite") {
         if (!opts.dryRun) {
-          fs4.mkdirSync(path4.dirname(absDest), { recursive: true });
+          fs4.mkdirSync(path5.dirname(absDest), { recursive: true });
           fs4.copyFileSync(absSrc, absDest);
         }
         finalManifestEntries.push(packaged);
@@ -6116,9 +6280,9 @@ async function runUpdate(opts, deps = {}) {
     for (const { packaged, absSrc } of plan.newOptIn) {
       const answer = await promptOptIn(packaged.dest, opts);
       if (answer === "opt-in") {
-        const absDest = path4.join(projectDir, ".claude", packaged.dest);
+        const absDest = path5.join(projectDir, ".claude", packaged.dest);
         if (!opts.dryRun) {
-          fs4.mkdirSync(path4.dirname(absDest), { recursive: true });
+          fs4.mkdirSync(path5.dirname(absDest), { recursive: true });
           fs4.copyFileSync(absSrc, absDest);
         }
         finalManifestEntries.push(packaged);
@@ -6130,25 +6294,25 @@ async function runUpdate(opts, deps = {}) {
     for (const e of plan.removedFromPackage) {
       const answer = await promptRemove(e.dest, opts);
       if (answer === "remove") {
-        const absDest = path4.join(projectDir, ".claude", e.dest);
+        const absDest = path5.join(projectDir, ".claude", e.dest);
         if (!opts.dryRun && fs4.existsSync(absDest)) {
           fs4.rmSync(absDest);
-          const claudeDir = path4.join(projectDir, ".claude");
-          let cur = path4.dirname(absDest);
-          while (cur !== claudeDir && cur !== path4.dirname(cur)) {
-            if (path4.dirname(cur) === claudeDir) break;
+          const claudeDir = path5.join(projectDir, ".claude");
+          let cur = path5.dirname(absDest);
+          while (cur !== claudeDir && cur !== path5.dirname(cur)) {
+            if (path5.dirname(cur) === claudeDir) break;
             try {
               fs4.rmdirSync(cur);
               if (opts.verbose)
                 console.log(
-                  `pruned empty dir ${path4.relative(claudeDir, cur)}`
+                  `pruned empty dir ${path5.relative(claudeDir, cur)}`
                 );
-              cur = path4.dirname(cur);
+              cur = path5.dirname(cur);
             } catch (err) {
               const code = err.code;
               if (code !== "ENOTEMPTY" && code !== "ENOENT") {
                 console.warn(
-                  `codebyplan claude: could not prune empty dir ${path4.relative(claudeDir, cur)}: ${err.message}`
+                  `codebyplan claude: could not prune empty dir ${path5.relative(claudeDir, cur)}: ${err.message}`
                 );
               }
               break;
@@ -6160,16 +6324,16 @@ async function runUpdate(opts, deps = {}) {
         if (opts.verbose) console.log(`kept (untracked) ${e.dest}`);
       }
     }
-    const hooksJsonPath = path4.join(templatesDir, "hooks", "hooks.json");
+    const hooksJsonPath = path5.join(templatesDir, "hooks", "hooks.json");
     if (fs4.existsSync(hooksJsonPath)) {
       const hooksJson = JSON.parse(
         fs4.readFileSync(hooksJsonPath, "utf8")
       );
-      const settingsPath = path4.join(projectDir, ".claude", "settings.json");
+      const settingsPath = path5.join(projectDir, ".claude", "settings.json");
       const existingSettings = fs4.existsSync(settingsPath) ? JSON.parse(fs4.readFileSync(settingsPath, "utf8")) : {};
       mergeHooksIntoSettings(existingSettings, hooksJson);
       if (!opts.dryRun) {
-        fs4.mkdirSync(path4.dirname(settingsPath), { recursive: true });
+        fs4.mkdirSync(path5.dirname(settingsPath), { recursive: true });
         fs4.writeFileSync(
           settingsPath,
           JSON.stringify(existingSettings, null, 2) + "\n",
@@ -6177,6 +6341,15 @@ async function runUpdate(opts, deps = {}) {
         );
       }
     }
+    const gitignoreAction = await ensureManagedGitignoreBlock(
+      projectDir,
+      opts.dryRun
+    );
+    if (opts.verbose && gitignoreAction !== "unchanged") {
+      console.log(
+        `${opts.dryRun ? "[dry-run] would " : ""}${gitignoreAction} managed .gitignore block in ${path5.relative(projectDir, path5.join(projectDir, ".gitignore"))}`
+      );
+    }
     if (!opts.dryRun) {
       const manifest = defaultManifest();
       manifest.files = finalManifestEntries.sort(
@@ -6209,9 +6382,9 @@ function runUpdateUser(opts, deps) {
     return;
   }
   try {
-    const userDir = deps.userDir ?? path4.join(os3.homedir(), ".claude");
-    const settingsPath = path4.join(userDir, "settings.json");
-    const userBaseSettingsPath = path4.join(
+    const userDir = deps.userDir ?? path5.join(os3.homedir(), ".claude");
+    const settingsPath = path5.join(userDir, "settings.json");
+    const userBaseSettingsPath = path5.join(
       templatesDir,
       "settings.user.base.json"
     );
@@ -6273,8 +6446,8 @@ function buildPlan(projectDir, templatesDir, manifest) {
   };
   for (const pkg of packaged) {
     const inManifest = manifestBySrc.get(pkg.src);
-    const absDest = path4.join(projectDir, ".claude", pkg.dest);
-    const absSrc = path4.join(templatesDir, pkg.src);
+    const absDest = path5.join(projectDir, ".claude", pkg.dest);
+    const absSrc = path5.join(templatesDir, pkg.src);
     if (!inManifest) {
       plan.newOptIn.push({
         packaged: { src: pkg.src, dest: pkg.dest, hash: pkg.hash },
@@ -6310,11 +6483,11 @@ function buildPlan(projectDir, templatesDir, manifest) {
   return plan;
 }
 function resolveTemplatesDirFromInstall() {
-  const here = path4.dirname(fileURLToPath2(import.meta.url));
+  const here = path5.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path4.resolve(here, "..", "templates"),
-    path4.resolve(here, "..", "..", "templates"),
-    path4.resolve(here, "..", "..", "..", "templates")
+    path5.resolve(here, "..", "templates"),
+    path5.resolve(here, "..", "..", "templates"),
+    path5.resolve(here, "..", "..", "..", "templates")
   ];
   for (const c of candidates) {
     if (fs4.existsSync(c) && fs4.statSync(c).isDirectory()) {
@@ -6332,6 +6505,7 @@ var init_update = __esm({
   "src/cli/claude/update.ts"() {
     "use strict";
     init_template_walker();
+    init_gitignore_block();
     init_hash();
     init_manifest();
     init_settings_merge();
@@ -6347,7 +6521,7 @@ __export(uninstall_exports, {
 });
 import * as fs5 from "node:fs";
 import * as os4 from "node:os";
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 async function runUninstall(opts, deps = {}) {
   await Promise.resolve();
   const scope = opts.scope ?? "project";
@@ -6376,7 +6550,7 @@ async function runUninstall(opts, deps = {}) {
     let removed = 0;
     let warnings = 0;
     for (const entry of manifest.files) {
-      const abs = path5.join(projectDir, ".claude", entry.dest);
+      const abs = path6.join(projectDir, ".claude", entry.dest);
       if (!fs5.existsSync(abs)) {
         console.warn(
           `codebyplan claude uninstall: ${entry.dest} already absent (skipping).`
@@ -6400,12 +6574,12 @@ async function runUninstall(opts, deps = {}) {
     if (!opts.dryRun) {
       pruneEmptyManagedDirs(projectDir);
     }
-    const settingsPath = path5.join(projectDir, ".claude", "settings.json");
+    const settingsPath = path6.join(projectDir, ".claude", "settings.json");
     if (fs5.existsSync(settingsPath)) {
       const settings = JSON.parse(
         fs5.readFileSync(settingsPath, "utf8")
       );
-      const baseSettingsPath = templatesDir ? path5.join(templatesDir, "settings.project.base.json") : null;
+      const baseSettingsPath = templatesDir ? path6.join(templatesDir, "settings.project.base.json") : null;
       if (baseSettingsPath && fs5.existsSync(baseSettingsPath)) {
         const base = JSON.parse(
           fs5.readFileSync(baseSettingsPath, "utf8")
@@ -6426,6 +6600,15 @@ async function runUninstall(opts, deps = {}) {
         }
       }
     }
+    const gitignoreAction = await removeManagedGitignoreBlock(
+      projectDir,
+      opts.dryRun
+    );
+    if (opts.verbose) {
+      console.log(
+        gitignoreAction === "removed" ? `${opts.dryRun ? "[dry-run] would remove" : "removed"} managed .gitignore block` : "managed .gitignore block already absent (no change)"
+      );
+    }
     if (!opts.dryRun) {
       const m = manifestPath(projectDir);
       if (fs5.existsSync(m)) fs5.rmSync(m);
@@ -6454,7 +6637,7 @@ function runUninstallUser(opts, deps) {
     }
   }
   try {
-    const userDir = deps.userDir ?? path5.join(os4.homedir(), ".claude");
+    const userDir = deps.userDir ?? path6.join(os4.homedir(), ".claude");
     const existingManifest = readManifestForScope("user", userDir);
     if (!existingManifest) {
       console.error(
@@ -6463,12 +6646,12 @@ function runUninstallUser(opts, deps) {
       process.exitCode = 1;
       return;
     }
-    const settingsPath = path5.join(userDir, "settings.json");
+    const settingsPath = path6.join(userDir, "settings.json");
     if (fs5.existsSync(settingsPath)) {
       const settings = JSON.parse(
         fs5.readFileSync(settingsPath, "utf8")
       );
-      const userBaseSettingsPath = templatesDir != null ? path5.join(templatesDir, "settings.user.base.json") : null;
+      const userBaseSettingsPath = templatesDir != null ? path6.join(templatesDir, "settings.user.base.json") : null;
       if (userBaseSettingsPath && fs5.existsSync(userBaseSettingsPath)) {
         const userBase = JSON.parse(
           fs5.readFileSync(userBaseSettingsPath, "utf8")
@@ -6509,7 +6692,7 @@ function runUninstallUser(opts, deps) {
 function pruneEmptyManagedDirs(projectDir) {
   const managedRoots = ["skills", "agents", "hooks", "rules"];
   for (const root of managedRoots) {
-    const abs = path5.join(projectDir, ".claude", root);
+    const abs = path6.join(projectDir, ".claude", root);
     if (!fs5.existsSync(abs)) continue;
     pruneLeafFirst(abs);
   }
@@ -6520,7 +6703,7 @@ function pruneLeafFirst(dir) {
   if (!stat2.isDirectory()) return;
   for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      pruneLeafFirst(path5.join(dir, entry.name));
+      pruneLeafFirst(path6.join(dir, entry.name));
     }
   }
   const remaining = fs5.readdirSync(dir);
@@ -6532,6 +6715,7 @@ var init_uninstall = __esm({
   "src/cli/claude/uninstall.ts"() {
     "use strict";
     init_hash();
+    init_gitignore_block();
     init_manifest();
     init_settings_merge();
     init_install();
@@ -6582,8 +6766,9 @@ void (async () => {
   }
   if (arg === "login") {
     const { runLogin: runLogin2 } = await Promise.resolve().then(() => (init_login(), login_exports));
+    const admin = process.argv.includes("--admin");
     try {
-      await runLogin2();
+      await runLogin2({ admin });
       process.exit(0);
     } catch {
       process.exit(1);
@@ -6727,7 +6912,7 @@ void (async () => {
 
   Usage:
     codebyplan setup                 Interactive setup (OAuth + project init)
-    codebyplan login                 Authenticate via OAuth device-code flow
+    codebyplan login [--admin]        Authenticate via OAuth device-code flow
     codebyplan logout                Clear cached OAuth tokens
     codebyplan whoami                Show currently authenticated identity
     codebyplan upgrade-auth          Migrate legacy x-api-key MCP config to OAuth