codebyplan 1.13.0 → 1.13.4

package/dist/cli.js

@@ -14,7 +14,7 @@ var VERSION, PACKAGE_NAME;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    VERSION = "1.13.0";
+    VERSION = "1.13.4";
     PACKAGE_NAME = "codebyplan";
   }
 });
@@ -225,8 +225,8 @@ async function readLocalConfig(projectPath, onMigrationNotice) {
 }
 async function writeLocalConfig(projectPath, config) {
   const content = { device_id: config.device_id };
-  const path7 = localConfigPath(projectPath);
-  const dirPath = dirname(path7);
+  const path8 = localConfigPath(projectPath);
+  const dirPath = dirname(path8);
   let phase = "stat config directory";
   try {
     try {
@@ -246,7 +246,7 @@ async function writeLocalConfig(projectPath, config) {
     phase = "create config directory";
     await mkdir(dirPath, { recursive: true });
     phase = "write local config";
-    await writeFile2(path7, JSON.stringify(content, null, 2) + "\n", "utf-8");
+    await writeFile2(path8, JSON.stringify(content, null, 2) + "\n", "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "LEGACY_FILE_BLOCKS_DIR") {
@@ -467,12 +467,12 @@ async function readFallback(filename) {
   }
 }
 async function writeFallback(filename, data) {
-  const path7 = fallbackFile(filename);
-  await mkdir3(dirname2(path7), { recursive: true });
-  await writeFile4(path7, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  const path8 = fallbackFile(filename);
+  await mkdir3(dirname2(path8), { recursive: true });
+  await writeFile4(path8, JSON.stringify(data, null, 2) + "\n", "utf-8");
   if (platform() !== "win32") {
     try {
-      await chmod(path7, 384);
+      await chmod(path8, 384);
     } catch {
     }
   }
@@ -679,8 +679,8 @@ async function getAuthHeaders() {
     return { headers: { "x-api-key": key }, via: "api_key" };
   }
 }
-function buildUrl(path7, params) {
-  const url = new URL(`${baseUrl()}/api${path7}`);
+function buildUrl(path8, params) {
+  const url = new URL(`${baseUrl()}/api${path8}`);
   if (params) {
     for (const [key, value] of Object.entries(params)) {
       if (value !== void 0) {
@@ -697,10 +697,10 @@ function isRetryable(err) {
   return false;
 }
 function delay(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
-async function request(method, path7, options) {
-  const url = buildUrl(path7, options?.params);
+async function request(method, path8, options) {
+  const url = buildUrl(path8, options?.params);
   const auth = await getAuthHeaders();
   let lastError;
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
@@ -720,7 +720,7 @@ async function request(method, path7, options) {
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
       });
       if (!res.ok) {
-        let message = `API ${method} ${path7} failed with status ${res.status}`;
+        let message = `API ${method} ${path8} failed with status ${res.status}`;
         let code;
         try {
           const body = await res.json();
@@ -754,14 +754,14 @@ async function request(method, path7, options) {
   }
   throw lastError;
 }
-async function apiGet(path7, params) {
-  return request("GET", path7, { params });
+async function apiGet(path8, params) {
+  return request("GET", path8, { params });
 }
-async function apiPost(path7, body) {
-  return request("POST", path7, { body });
+async function apiPost(path8, body) {
+  return request("POST", path8, { body });
 }
-async function apiPut(path7, body) {
-  return request("PUT", path7, { body });
+async function apiPut(path8, body) {
+  return request("PUT", path8, { body });
 }
 async function callMcpTool(toolName, params) {
   const url = mcpEndpoint();
@@ -1055,7 +1055,7 @@ var init_device_flow = __esm({
         this.name = "OAuthInvalidClientError";
       }
     };
-    defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+    defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
   }
 });
 
@@ -1217,13 +1217,9 @@ import { createInterface } from "node:readline/promises";
 function getConfigPath(scope) {
   return scope === "user" ? join6(homedir2(), ".claude.json") : join6(process.cwd(), ".mcp.json");
 }
-function legacyMcpUrl() {
-  const baseUrl2 = process.env.CODEBYPLAN_API_URL ?? "https://www.codebyplan.com";
-  return `${baseUrl2.replace(/\/$/, "")}/mcp`;
-}
-async function readConfig(path7) {
+async function readConfig(path8) {
   try {
-    const raw = await readFile6(path7, "utf-8");
+    const raw = await readFile6(path8, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       return parsed;
@@ -1233,19 +1229,16 @@ async function readConfig(path7) {
     return {};
   }
 }
-function buildMcpEntry(auth) {
-  if (auth.kind === "oauth") {
-    return { url: mcpEndpoint() };
-  }
-  return { url: legacyMcpUrl(), headers: { "x-api-key": auth.apiKey } };
+function buildMcpEntry() {
+  return { url: mcpEndpoint() };
 }
-async function writeMcpConfig(scope, auth) {
+async function writeMcpConfig(scope) {
   const configPath = getConfigPath(scope);
   const config = await readConfig(configPath);
   if (typeof config.mcpServers !== "object" || config.mcpServers === null || Array.isArray(config.mcpServers)) {
     config.mcpServers = {};
   }
-  config.mcpServers.codebyplan = buildMcpEntry(auth);
+  config.mcpServers.codebyplan = buildMcpEntry();
   await writeFile6(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
   return configPath;
 }
@@ -1395,7 +1388,7 @@ async function runSetup() {
     const scopeInput = (await rl.question("  Select (1/2, default: 1): ")).trim();
     const scope = scopeInput === "2" ? "project" : "user";
     console.log("\n  Configuring MCP server...");
-    const configPath = await writeMcpConfig(scope, auth);
+    const configPath = await writeMcpConfig(scope);
     console.log(`  Done! Config written to ${configPath}
 `);
     if (auth.kind === "legacy" && scope === "project") {
@@ -1768,9 +1761,9 @@ import { join as join8 } from "node:path";
 function configPaths() {
   return [join8(homedir3(), ".claude.json"), join8(process.cwd(), ".mcp.json")];
 }
-async function readConfig2(path7) {
+async function readConfig2(path8) {
   try {
-    const raw = await readFile8(path7, "utf-8");
+    const raw = await readFile8(path8, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
       return parsed;
@@ -1784,14 +1777,14 @@ function entryHasLegacyApiKey(entry) {
   if (!entry || !entry.headers) return false;
   return "x-api-key" in entry.headers;
 }
-async function rewriteConfig(path7, config, newUrl) {
+async function rewriteConfig(path8, config, newUrl) {
   const servers = config.mcpServers;
   if (!servers) return false;
   const entry = servers.codebyplan;
   if (!entry) return false;
   if (!entryHasLegacyApiKey(entry) && entry.url === newUrl) return false;
   servers.codebyplan = { url: newUrl };
-  await writeFile7(path7, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  await writeFile7(path8, JSON.stringify(config, null, 2) + "\n", "utf-8");
   return true;
 }
 async function runUpgradeAuth() {
@@ -1799,12 +1792,12 @@ async function runUpgradeAuth() {
   await runLogin();
   const newUrl = mcpEndpoint();
   let migrated = 0;
-  for (const path7 of configPaths()) {
-    const config = await readConfig2(path7);
+  for (const path8 of configPaths()) {
+    const config = await readConfig2(path8);
     if (!config) continue;
-    const changed = await rewriteConfig(path7, config, newUrl);
+    const changed = await rewriteConfig(path8, config, newUrl);
     if (changed) {
-      console.log(`  Updated ${path7}`);
+      console.log(`  Updated ${path8}`);
       migrated++;
     }
   }
@@ -3176,17 +3169,16 @@ var init_eslint = __esm({
 
 // src/lib/mcp-client.ts
 async function mcpCall(toolName, args) {
-  if (!API_KEY) {
-    throw new McpError(
-      `Missing CODEBYPLAN_API_KEY environment variable.
-
-Quick setup:
-  npx ${PACKAGE_NAME} setup
-
-Or manually:
-  1. Get your API key at https://codebyplan.com/settings/api-keys/
-  2. claude mcp add codebyplan -e CODEBYPLAN_API_KEY=<key> -- npx -y ${PACKAGE_NAME}`
-    );
+  let accessToken;
+  try {
+    accessToken = await getAccessToken();
+  } catch (err) {
+    if (err instanceof NoTokenError) {
+      throw new McpError(
+        "Not logged in. Run `codebyplan login` to authenticate."
+      );
+    }
+    throw err;
   }
   const body = {
     jsonrpc: "2.0",
@@ -3196,12 +3188,12 @@ Or manually:
   };
   let res;
   try {
-    res = await fetch(`${BASE_URL}/mcp`, {
+    res = await fetch(mcpEndpoint(), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json, text/event-stream",
-        "x-api-key": API_KEY
+        Authorization: `Bearer ${accessToken}`
       },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
@@ -3212,7 +3204,7 @@ Or manually:
   }
   if (res.status === 401) {
     throw new McpError(
-      "Invalid API key. Generate a new one at https://codebyplan.com/settings/api-keys/",
+      "Authentication failed. Run `codebyplan login` to refresh your session.",
       401
     );
   }
@@ -3271,13 +3263,12 @@ function parseSseEnvelope(text, toolName) {
   }
   throw new McpError(`mcp ${toolName} returned unparseable SSE body`);
 }
-var API_KEY, BASE_URL, REQUEST_TIMEOUT_MS2, McpError;
+var REQUEST_TIMEOUT_MS2, McpError;
 var init_mcp_client = __esm({
   "src/lib/mcp-client.ts"() {
     "use strict";
-    init_version();
-    API_KEY = process.env.CODEBYPLAN_API_KEY ?? "";
-    BASE_URL = (process.env.CODEBYPLAN_API_URL ?? "https://www.codebyplan.com").replace(/\/$/, "");
+    init_token_refresh();
+    init_urls();
     REQUEST_TIMEOUT_MS2 = 12e4;
     McpError = class extends Error {
       status;
@@ -3440,7 +3431,7 @@ function setRetryDelayMs(ms) {
   RETRY_DELAY_MS = ms;
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function isTransientMcpError(err) {
   if (!(err instanceof McpError)) return false;
@@ -3917,17 +3908,10 @@ var init_branch = __esm({
   }
 });
 
-// src/lib/ship.ts
+// src/lib/git-utils.ts
 import { readFile as readFile12 } from "node:fs/promises";
 import { join as join13 } from "node:path";
-import { execSync as execSync4, spawnSync as spawnSync2 } from "node:child_process";
-function assertValidBranchName2(branch, label) {
-  if (!/^[a-zA-Z0-9/_.-]+$/.test(branch)) {
-    throw new Error(
-      `Invalid branch name for ${label}: '${branch}' (refusing to pass shell metacharacters to git/gh)`
-    );
-  }
-}
+import { spawnSync as spawnSync2 } from "node:child_process";
 async function readBaseBranch(cwd) {
   const found = await findCodebyplanConfig(cwd);
   let gitJsonPath;
@@ -3959,6 +3943,442 @@ async function readBaseBranch(cwd) {
     return "main";
   }
 }
+function resolveBaseRef(cwd, baseBranch) {
+  if (baseBranch.startsWith("origin/")) return baseBranch;
+  const remoteRef = `origin/${baseBranch}`;
+  const check = spawnSync2(
+    "git",
+    ["rev-parse", "--verify", "--quiet", `${remoteRef}^{commit}`],
+    { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+  );
+  if (check.status === 0 && (check.stdout ?? "").trim().length > 0) {
+    return remoteRef;
+  }
+  return baseBranch;
+}
+var init_git_utils = __esm({
+  "src/lib/git-utils.ts"() {
+    "use strict";
+    init_flags();
+  }
+});
+
+// src/lib/bump.ts
+import { readFile as readFile13, writeFile as writeFile10, access as access4, readdir as readdir3 } from "node:fs/promises";
+import { join as join14, relative as relative3, resolve as resolve2 } from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+function parsePnpmWorkspaceGlobs(raw) {
+  const lines = raw.split("\n");
+  const globs = [];
+  let inPackages = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "packages:") {
+      inPackages = true;
+      continue;
+    }
+    if (inPackages) {
+      if (trimmed.length > 0 && !trimmed.startsWith("-")) {
+        inPackages = false;
+        continue;
+      }
+      if (trimmed.startsWith("-")) {
+        const glob = trimmed.slice(1).trim().replace(/^['"]|['"]$/g, "");
+        if (glob) globs.push(glob);
+      }
+    }
+  }
+  return globs;
+}
+async function expandGlob(cwd, glob) {
+  const parts = glob.split("/");
+  if (parts.length !== 2 || parts[1] !== "*") {
+    return [];
+  }
+  const parentDir = join14(cwd, parts[0]);
+  let dirs;
+  try {
+    const entries = await readdir3(parentDir, { withFileTypes: true });
+    dirs = entries.filter((e) => e.isDirectory()).map((e) => join14(parentDir, e.name));
+  } catch {
+    return [];
+  }
+  const results = [];
+  for (const dir of dirs) {
+    try {
+      await access4(join14(dir, "package.json"));
+      results.push(dir);
+    } catch {
+    }
+  }
+  return results;
+}
+async function buildPackageMap(cwd) {
+  const map = /* @__PURE__ */ new Map();
+  let globs = [];
+  try {
+    const raw = await readFile13(join14(cwd, "pnpm-workspace.yaml"), "utf-8");
+    globs = parsePnpmWorkspaceGlobs(raw);
+  } catch {
+  }
+  for (const glob of globs) {
+    const dirs = await expandGlob(cwd, glob);
+    for (const dir of dirs) {
+      try {
+        const pkgRaw = await readFile13(join14(dir, "package.json"), "utf-8");
+        const pkg = JSON.parse(pkgRaw);
+        const name = pkg.name ?? relative3(cwd, dir);
+        map.set(dir, { name, dir });
+      } catch {
+      }
+    }
+  }
+  return map;
+}
+function findOwningPackage(filePath, packageDirs) {
+  const sorted = [...packageDirs].sort((a, b) => b.length - a.length);
+  for (const dir of sorted) {
+    if (filePath.startsWith(dir + "/") || filePath === dir) {
+      return dir;
+    }
+  }
+  return null;
+}
+function patchBump(version) {
+  const hasV = version.startsWith("v");
+  const stripped = hasV ? version.slice(1) : version;
+  const coreMatch = stripped.match(/^(\d+)\.(\d+)\.(\d+)/);
+  if (!coreMatch) {
+    return version;
+  }
+  const major = coreMatch[1];
+  const minor = coreMatch[2];
+  const patch = parseInt(coreMatch[3], 10);
+  return `${hasV ? "v" : ""}${major}.${minor}.${patch + 1}`;
+}
+function compareSemver(a, b) {
+  const parseCore = (v) => {
+    const stripped = v.startsWith("v") ? v.slice(1) : v;
+    const m = stripped.match(/^(\d+)\.(\d+)\.(\d+)/);
+    if (!m) return [-1, -1, -1];
+    return [parseInt(m[1], 10), parseInt(m[2], 10), parseInt(m[3], 10)];
+  };
+  const hasPre = (v) => /^v?\d+\.\d+\.\d+-/.test(v);
+  const [aMaj, aMin, aPat] = parseCore(a);
+  const [bMaj, bMin, bPat] = parseCore(b);
+  if (aMaj !== bMaj) return aMaj - bMaj;
+  if (aMin !== bMin) return aMin - bMin;
+  if (aPat !== bPat) return aPat - bPat;
+  if (hasPre(a) && !hasPre(b)) return -1;
+  if (!hasPre(a) && hasPre(b)) return 1;
+  return 0;
+}
+function gitShowFile(cwd, ref, relPath) {
+  const result = spawnSync3("git", ["show", `${ref}:${relPath}`], {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (result.status !== 0 || result.error) return null;
+  return result.stdout ?? null;
+}
+function extractVersion(raw, filePath) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const obj = parsed;
+    if (filePath.endsWith("app.json") || filePath.endsWith("app.config.json")) {
+      const expo = obj["expo"];
+      if (typeof expo === "object" && expo !== null) {
+        const expoObj = expo;
+        if (typeof expoObj["version"] === "string") return expoObj["version"];
+      }
+    }
+    if (typeof obj["version"] === "string") return obj["version"];
+    return null;
+  } catch {
+    return null;
+  }
+}
+function injectVersion(raw, nextVersion, filePath) {
+  const parsed = JSON.parse(raw);
+  if (filePath.endsWith("app.json") || filePath.endsWith("app.config.json")) {
+    const expo = parsed["expo"];
+    if (typeof expo === "object" && expo !== null) {
+      expo["version"] = nextVersion;
+      return JSON.stringify(parsed, null, 2) + "\n";
+    }
+  }
+  parsed["version"] = nextVersion;
+  return JSON.stringify(parsed, null, 2) + "\n";
+}
+async function prependChangelog(changelogPath, packageName, nextVersion, now, dryRun) {
+  let existing;
+  try {
+    existing = await readFile13(changelogPath, "utf-8");
+  } catch {
+    return false;
+  }
+  const entry = `## [${nextVersion}] - ${now}
+
+### Changed
+
+- Version bump for ${packageName}
+
+`;
+  const updated = entry + existing;
+  if (!dryRun) {
+    await writeFile10(changelogPath, updated, "utf-8");
+  }
+  return true;
+}
+async function runBump(opts) {
+  const cwd = resolve2(opts?.cwd ?? process.cwd());
+  const dryRun = opts?.dryRun ?? false;
+  const now = opts?.now ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const baseBranch = await readBaseBranch(cwd);
+  const baseRef = resolveBaseRef(cwd, baseBranch);
+  const diffResult = spawnSync3(
+    "git",
+    ["diff", "--name-only", `${baseRef}...HEAD`],
+    {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }
+  );
+  if (diffResult.status !== 0 || diffResult.error) {
+    const errMsg = diffResult.stderr?.trim() || diffResult.error?.message || "git diff failed";
+    throw new Error(`runBump: git diff failed: ${errMsg}`);
+  }
+  const changedFiles = (diffResult.stdout ?? "").trim().split("\n").filter(Boolean).map((f) => resolve2(cwd, f));
+  const packageMap = await buildPackageMap(cwd);
+  const packageDirs = Array.from(packageMap.keys());
+  const rootPkgPath = join14(cwd, "package.json");
+  const changedPackageDirs = /* @__PURE__ */ new Set();
+  for (const absFile of changedFiles) {
+    const owner = findOwningPackage(absFile, packageDirs);
+    if (owner != null) {
+      changedPackageDirs.add(owner);
+    }
+  }
+  const entries = [];
+  for (const pkgDir of changedPackageDirs) {
+    const pkgInfo = packageMap.get(pkgDir);
+    const pkgJsonPath = join14(pkgDir, "package.json");
+    if (pkgJsonPath === rootPkgPath) continue;
+    const versionFileCandidates = [
+      { abs: pkgJsonPath, rel: relative3(cwd, pkgJsonPath).replace(/\\/g, "/") }
+    ];
+    const tauriConfPath = join14(pkgDir, "src-tauri", "tauri.conf.json");
+    const tauriRelPath = relative3(cwd, tauriConfPath).replace(/\\/g, "/");
+    try {
+      await access4(tauriConfPath);
+      versionFileCandidates.push({ abs: tauriConfPath, rel: tauriRelPath });
+    } catch {
+    }
+    const appJsonPath = join14(pkgDir, "app.json");
+    const appJsonRelPath = relative3(cwd, appJsonPath).replace(/\\/g, "/");
+    try {
+      await access4(appJsonPath);
+      versionFileCandidates.push({ abs: appJsonPath, rel: appJsonRelPath });
+    } catch {
+    }
+    let currentPkgJsonRaw;
+    try {
+      currentPkgJsonRaw = await readFile13(pkgJsonPath, "utf-8");
+    } catch (err) {
+      console.warn(
+        `runBump: could not read ${pkgJsonPath}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      continue;
+    }
+    const currentVersion = extractVersion(currentPkgJsonRaw, pkgJsonPath);
+    if (currentVersion == null) {
+      entries.push({
+        name: pkgInfo.name,
+        packageDir: pkgDir,
+        currentVersion: "(none)",
+        nextVersion: "(none)",
+        versionFiles: [],
+        changelogUpdated: false,
+        skipped: true,
+        skipReason: "No version field in package.json"
+      });
+      continue;
+    }
+    const pkgJsonRelPath = relative3(cwd, pkgJsonPath).replace(/\\/g, "/");
+    const baseRaw = gitShowFile(cwd, baseRef, pkgJsonRelPath);
+    if (baseRaw !== null) {
+      const baseVersion = extractVersion(baseRaw, pkgJsonPath);
+      if (baseVersion !== null && compareSemver(currentVersion, baseVersion) > 0) {
+        entries.push({
+          name: pkgInfo.name,
+          packageDir: pkgDir,
+          currentVersion,
+          nextVersion: currentVersion,
+          versionFiles: [],
+          changelogUpdated: false,
+          skipped: true,
+          skipReason: `Already at ${currentVersion} > base ${baseVersion}`
+        });
+        continue;
+      }
+    }
+    const nextVersion = patchBump(currentVersion);
+    const updatedVersionFiles = [];
+    const skippedVersionFiles = [];
+    for (const { abs, rel } of versionFileCandidates) {
+      let raw;
+      try {
+        raw = await readFile13(abs, "utf-8");
+      } catch {
+        continue;
+      }
+      const ver = abs === pkgJsonPath ? currentVersion : extractVersion(raw, abs);
+      if (ver == null) {
+        console.warn(
+          `runBump: ${pkgInfo.name}: no version field in ${abs} \u2014 skipping update`
+        );
+        skippedVersionFiles.push(rel);
+        continue;
+      }
+      const updated = injectVersion(raw, nextVersion, abs);
+      if (!dryRun) {
+        await writeFile10(abs, updated, "utf-8");
+      }
+      updatedVersionFiles.push(rel);
+    }
+    const changelogPath = join14(pkgDir, "CHANGELOG.md");
+    const changelogUpdated = await prependChangelog(
+      changelogPath,
+      pkgInfo.name,
+      nextVersion,
+      now,
+      dryRun
+    );
+    entries.push({
+      name: pkgInfo.name,
+      packageDir: pkgDir,
+      currentVersion,
+      nextVersion,
+      versionFiles: updatedVersionFiles,
+      ...skippedVersionFiles.length > 0 ? { skippedVersionFiles } : {},
+      changelogUpdated,
+      skipped: false
+    });
+  }
+  return { baseBranch, baseRef, entries, dryRun };
+}
+var init_bump = __esm({
+  "src/lib/bump.ts"() {
+    "use strict";
+    init_git_utils();
+  }
+});
+
+// src/cli/bump.ts
+var bump_exports = {};
+__export(bump_exports, {
+  runBumpCommand: () => runBumpCommand
+});
+function parseFlagsFromArgs2(args) {
+  const flags = {};
+  const booleans = /* @__PURE__ */ new Set();
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      const next = args[i + 1];
+      if (next !== void 0 && !next.startsWith("--")) {
+        flags[key] = next;
+        i++;
+      } else {
+        booleans.add(key);
+      }
+    }
+  }
+  return { flags, booleans };
+}
+function printBumpHelp() {
+  process.stdout.write(
+    "\n  codebyplan bump\n\n  Detect changed workspace packages and patch-bump their versions.\n  Does NOT commit or push \u2014 pure version-file + changelog edits.\n\n  Flags:\n    --dry-run   Preview planned bumps without writing any files\n    --json      Write structured JSON output to stdout\n\n"
+  );
+}
+function printHumanResult(result) {
+  const lines = [];
+  const baseLabel = result.baseRef === result.baseBranch ? result.baseBranch : `${result.baseBranch} (compared against ${result.baseRef})`;
+  if (result.dryRun) {
+    lines.push(`[dry-run] Base: ${baseLabel}`);
+  } else {
+    lines.push(`Base: ${baseLabel}`);
+  }
+  const active = result.entries.filter((e) => !e.skipped);
+  const skipped = result.entries.filter((e) => e.skipped);
+  if (active.length === 0 && skipped.length === 0) {
+    lines.push("No changed packages detected.");
+  }
+  for (const entry of active) {
+    const action = result.dryRun ? "Would bump" : "Bumped";
+    lines.push(
+      `  ${action}: ${entry.name}  ${entry.currentVersion} \u2192 ${entry.nextVersion}`
+    );
+    for (const f of entry.versionFiles) {
+      lines.push(`    - ${f}`);
+    }
+    if (entry.changelogUpdated) {
+      lines.push(`    - CHANGELOG.md`);
+    }
+  }
+  for (const entry of skipped) {
+    lines.push(
+      `  Skipped: ${entry.name}  (${entry.skipReason ?? "already bumped"})`
+    );
+  }
+  process.stdout.write(lines.join("\n") + "\n");
+}
+async function runBumpCommand(args) {
+  const firstArg = args[0];
+  if (firstArg === "help" || firstArg === "--help" || firstArg === "-h") {
+    printBumpHelp();
+    process.exit(0);
+  }
+  const { booleans } = parseFlagsFromArgs2(args);
+  const dryRun = booleans.has("dry-run");
+  const jsonOutput = booleans.has("json");
+  let result;
+  try {
+    result = await runBump({ dryRun });
+  } catch (err) {
+    process.stderr.write(
+      `bump: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process.exit(1);
+  }
+  if (jsonOutput) {
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return;
+  }
+  printHumanResult(result);
+}
+var init_bump2 = __esm({
+  "src/cli/bump.ts"() {
+    "use strict";
+    init_bump();
+  }
+});
+
+// src/lib/ship.ts
+import { execSync as execSync4, spawnSync as spawnSync4 } from "node:child_process";
+import { relative as relative4 } from "node:path";
+function assertValidBranchName2(branch, label) {
+  if (!/^[a-zA-Z0-9/_.-]+$/.test(branch)) {
+    throw new Error(
+      `Invalid branch name for ${label}: '${branch}' (refusing to pass shell metacharacters to git/gh)`
+    );
+  }
+}
 function defaultPrBody(feat, base) {
   return `## Summary
 
@@ -3975,7 +4395,7 @@ async function pollChecks(feat, timeoutSeconds, cwd, _sleepMs = (ms) => new Prom
   let totalGhErrors = 0;
   let iteration = 0;
   while (Date.now() < deadline) {
-    const ghResult = spawnSync2(
+    const ghResult = spawnSync4(
       "gh",
       ["pr", "checks", feat, "--json", "name,state,conclusion"],
       {
@@ -4041,7 +4461,9 @@ async function runShip(opts) {
   const keepFeat = opts?.keepFeat ?? false;
   const bodyFile = opts?.bodyFile ?? null;
   const timeoutSeconds = opts?.timeoutSeconds ?? 600;
+  const bump = opts?.bump ?? true;
   const sleepMs = opts?._sleepMs ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let bumpEntries;
   let feat;
   try {
     feat = execSync4("git rev-parse --abbrev-ref HEAD", {
@@ -4102,15 +4524,66 @@ ${statusOut.trim()}`
       }
     } catch {
     }
+    if (bump) {
+      const bumpResult = await runBump({ cwd, dryRun: true });
+      bumpEntries = bumpResult.entries;
+    }
     return {
       pr_url: prUrl2,
       merge_commit: null,
       branch_deleted: false,
       dry_run: true,
       feat_branch: feat,
-      base_branch: base
+      base_branch: base,
+      ...bumpEntries !== void 0 ? { bumps: bumpEntries } : {}
     };
   }
+  if (bump) {
+    let bumpResult;
+    try {
+      bumpResult = await runBump({ cwd });
+    } catch (err) {
+      throw new Error(
+        `Version bump failed before push (working tree may have been partially modified \u2014 run 'git status'): ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    bumpEntries = bumpResult.entries;
+    const toStage = bumpResult.entries.filter((e) => !e.skipped).flatMap((e) => [
+      ...e.versionFiles,
+      ...e.changelogUpdated ? [relative4(cwd, e.packageDir).replace(/\\/g, "/") + "/CHANGELOG.md"] : []
+    ]);
+    if (toStage.length > 0) {
+      const addResult = spawnSync4("git", ["add", "--", ...toStage], {
+        cwd,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      if (addResult.status !== 0 || addResult.error) {
+        throw new Error(
+          `Failed to stage bump files: ${addResult.stderr?.trim() ?? addResult.error?.message}`
+        );
+      }
+      const commitResult = spawnSync4(
+        "git",
+        ["commit", "-m", "chore(release): bump versions"],
+        { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+      );
+      if (commitResult.status !== 0 || commitResult.error) {
+        spawnSync4(
+          "git",
+          ["restore", "--staged", "--worktree", "--", ...toStage],
+          {
+            cwd,
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"]
+          }
+        );
+        throw new Error(
+          `Failed to commit version bump: ${commitResult.stderr?.trim() ?? commitResult.error?.message}`
+        );
+      }
+    }
+  }
   execSync4(`git push -u origin HEAD`, {
     cwd,
     encoding: "utf-8",
@@ -4141,7 +4614,7 @@ ${statusOut.trim()}`
     } else {
       createArgs.push("--body", defaultPrBody(feat, base));
     }
-    const createResult = spawnSync2("gh", createArgs, {
+    const createResult = spawnSync4("gh", createArgs, {
       cwd,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -4161,7 +4634,8 @@ ${statusOut.trim()}`
       checks_failed: true,
       checks_failure_reason: checksResult.reason,
       feat_branch: feat,
-      base_branch: base
+      base_branch: base,
+      ...bumpEntries !== void 0 ? { bumps: bumpEntries } : {}
     };
   }
   execSync4(`gh pr merge --merge ${feat}`, {
@@ -4171,7 +4645,7 @@ ${statusOut.trim()}`
   });
   let mergeCommit = null;
   try {
-    const prViewResult = spawnSync2(
+    const prViewResult = spawnSync4(
       "gh",
       ["pr", "view", feat, "--json", "state,mergeCommit"],
       {
@@ -4215,13 +4689,15 @@ ${statusOut.trim()}`
     merge_commit: mergeCommit,
     branch_deleted: branchDeleted,
     feat_branch: feat,
-    base_branch: base
+    base_branch: base,
+    ...bumpEntries !== void 0 ? { bumps: bumpEntries } : {}
   };
 }
 var init_ship = __esm({
   "src/lib/ship.ts"() {
     "use strict";
-    init_flags();
+    init_git_utils();
+    init_bump();
   }
 });
 
@@ -4230,7 +4706,7 @@ var ship_exports = {};
 __export(ship_exports, {
   runShipCommand: () => runShipCommand
 });
-function parseFlagsFromArgs2(args) {
+function parseFlagsFromArgs3(args) {
   const flags = {};
   const booleans = /* @__PURE__ */ new Set();
   for (let i = 0; i < args.length; i++) {
@@ -4250,7 +4726,7 @@ function parseFlagsFromArgs2(args) {
 }
 function printShipHelp() {
   process.stdout.write(
-    "\n  codebyplan ship\n\n  Ship the current feat branch to production via PR.\n\n  Flags:\n    --dry-run             Preview without pushing, creating, or merging\n    --json                Write JSON result to stdout\n    --keep-feat           Keep the feat branch after merge (no auto-delete)\n    --body-file <path>    Path to a markdown file used as the PR body\n    --timeout <seconds>   Max seconds to poll required checks (default: 600)\n\n"
+    "\n  codebyplan ship\n\n  Ship the current feat branch to production via PR.\n\n  Flags:\n    --dry-run             Preview without pushing, creating, or merging\n    --json                Write JSON result to stdout\n    --keep-feat           Keep the feat branch after merge (no auto-delete)\n    --body-file <path>    Path to a markdown file used as the PR body\n    --timeout <seconds>   Max seconds to poll required checks (default: 600)\n    --no-bump             Skip automatic patch-version bump before push\n\n"
   );
 }
 async function runShipCommand(args) {
@@ -4262,10 +4738,11 @@ async function runShipCommand(args) {
   await runShipDefault(args);
 }
 async function runShipDefault(args) {
-  const { flags, booleans } = parseFlagsFromArgs2(args);
+  const { flags, booleans } = parseFlagsFromArgs3(args);
   const dryRun = booleans.has("dry-run");
   const jsonOutput = booleans.has("json");
   const keepFeat = booleans.has("keep-feat");
+  const noBump = booleans.has("no-bump");
   const bodyFile = flags["body-file"] ?? void 0;
   const timeoutRaw = flags["timeout"];
   let timeoutSeconds;
@@ -4282,7 +4759,13 @@ async function runShipDefault(args) {
   }
   let result;
   try {
-    result = await runShip({ dryRun, keepFeat, bodyFile, timeoutSeconds });
+    result = await runShip({
+      dryRun,
+      keepFeat,
+      bodyFile,
+      timeoutSeconds,
+      bump: !noBump
+    });
   } catch (err) {
     process.stderr.write(
       `ship: ${err instanceof Error ? err.message : String(err)}
@@ -4319,6 +4802,13 @@ async function runShipDefault(args) {
       lines.push(`Branch deleted: ${result.feat_branch ?? ""}`);
     }
   }
+  const bumpedEntries = result.bumps?.filter((e) => !e.skipped) ?? [];
+  if (bumpedEntries.length > 0) {
+    lines.push("Bumped:");
+    for (const e of bumpedEntries) {
+      lines.push(`  ${e.name}  ${e.currentVersion} \u2192 ${e.nextVersion}`);
+    }
+  }
   process.stdout.write(lines.join("\n") + "\n");
 }
 var init_ship2 = __esm({
@@ -4328,1753 +4818,1888 @@ var init_ship2 = __esm({
   }
 });
 
-// src/cli/resolve-worktree.ts
-var resolve_worktree_exports = {};
-__export(resolve_worktree_exports, {
-  ProcessExitSignal: () => ProcessExitSignal,
-  runResolveWorktree: () => runResolveWorktree
-});
-import { execSync as execSync5 } from "node:child_process";
-function distress(kind, message, jsonMode) {
-  if (jsonMode) return;
-  process.stderr.write(`resolve-worktree: ${kind}: ${message}
-`);
+// src/lib/hash.ts
+import { createHash as createHash3 } from "node:crypto";
+function sha256(input) {
+  const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+  return `sha256:${createHash3("sha256").update(buf).digest("hex")}`;
 }
-async function runResolveWorktree() {
-  const jsonMode = hasFlag("json", 3);
-  let errorContext = null;
-  const migrationNoticeCallback = (legacyPath, primaryPath) => {
-    if (!jsonMode) {
-      process.stderr.write(
-        `resolve-worktree: local_config_migration: ${legacyPath} is the legacy flat config; move device_id to ${primaryPath}
-`
-      );
-    }
-  };
-  try {
-    const projectPath = process.cwd();
-    const found = await findCodebyplanConfig(projectPath);
-    if (!found?.contents.repo_id) {
-      emitAndExit(null, null, jsonMode);
-    }
-    const repoId = found.contents.repo_id;
-    try {
-      await readLocalConfig(projectPath);
-    } catch (readErr) {
-      const readErrCode = readErr.code;
-      errorContext = {
-        kind: readErrCode === "LEGACY_FILE_BLOCKS_DIR" ? "legacy_file_blocks_dir" : "local_config_read_failed",
-        message: readErr instanceof Error ? readErr.message : String(readErr)
-      };
+var init_hash = __esm({
+  "src/lib/hash.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/template-walker.ts
+import * as fs from "node:fs";
+import * as path2 from "node:path";
+function walkTemplates(templatesDir) {
+  const absRoot = fs.realpathSync(templatesDir);
+  const visited = /* @__PURE__ */ new Set();
+  const out = [];
+  const recurse = (absDir) => {
+    const realDir = fs.realpathSync(absDir);
+    if (visited.has(realDir)) {
+      return;
     }
-    let deviceId;
-    try {
-      deviceId = await getOrCreateDeviceId(
-        projectPath,
-        migrationNoticeCallback
-      );
-    } catch (deviceErr) {
-      const code = deviceErr.code;
-      if (code === "LEGACY_FILE_BLOCKS_DIR") {
-        errorContext = {
-          kind: "legacy_file_blocks_dir",
-          message: deviceErr instanceof Error ? deviceErr.message : String(deviceErr)
-        };
-      } else if (errorContext === null || errorContext.kind !== "local_config_read_failed" && errorContext.kind !== "legacy_file_blocks_dir") {
-        errorContext = {
-          kind: "local_config_write_failed",
-          message: deviceErr instanceof Error ? deviceErr.message : String(deviceErr)
-        };
+    visited.add(realDir);
+    const entries = fs.readdirSync(absDir, { withFileTypes: true });
+    for (const entry of entries) {
+      const absPath = path2.join(absDir, entry.name);
+      if (entry.isDirectory()) {
+        recurse(absPath);
+        continue;
       }
-      emitAndExit(null, errorContext, jsonMode);
-    }
-    let branch = "";
-    try {
-      branch = execSync5("git symbolic-ref --short HEAD", {
-        cwd: projectPath,
-        encoding: "utf-8"
-      }).trim();
-    } catch (gitErr) {
-      if (errorContext === null) {
-        errorContext = {
-          kind: "git_failed",
-          message: gitErr instanceof Error ? gitErr.message : String(gitErr)
-        };
+      if (!entry.isFile()) {
+        continue;
       }
-    }
-    const onResolverError = (kind, err) => {
-      if (errorContext === null) {
-        errorContext = { kind, message: err.message };
+      if (entry.name === ".gitkeep") continue;
+      const relPosix = path2.relative(absRoot, absPath).split(path2.sep).join("/");
+      if (EXCLUDED_RELATIVE_PATHS.has(relPosix)) {
+        continue;
       }
-    };
-    const worktreeId = await resolveWorktreeId({
-      repoId,
-      repoPath: projectPath,
-      branch,
-      deviceId,
-      onError: onResolverError
-    });
-    if (worktreeId) {
-      emitAndExit(worktreeId, errorContext, jsonMode);
-    }
-    const useFallback = hasFlag("fallback-from-branch", 3);
-    if (useFallback) {
-      const fallbackId = await resolveWorktreeByBranch({
-        repoId,
-        deviceId,
-        branch,
-        onError: onResolverError
+      const content = fs.readFileSync(absPath);
+      out.push({
+        src: relPosix,
+        dest: relPosix,
+        hash: sha256(content)
       });
-      if (fallbackId) {
-        emitAndExit(fallbackId, errorContext, jsonMode);
-      }
-    }
-    emitAndExit(null, errorContext, jsonMode);
-  } catch (err) {
-    if (err instanceof ProcessExitSignal) throw err;
-    const msg = err instanceof Error ? err.message : String(err);
-    errorContext = { kind: "unhandled", message: msg };
-    emitAndExit(null, errorContext, jsonMode);
-  }
-}
-function emitAndExit(worktreeId, errorContext, jsonMode) {
-  if (jsonMode) {
-    const errorKind = errorContext?.kind ?? (worktreeId === null ? "tuple_miss" : null);
-    process.stdout.write(
-      JSON.stringify({ worktree_id: worktreeId, error_kind: errorKind }) + "\n"
-    );
-  } else {
-    if (worktreeId !== null) {
-      process.stdout.write(worktreeId);
-    }
-    if (errorContext !== null) {
-      if (errorContext.kind !== "unhandled" || process.env.CODEBYPLAN_DEBUG === "1") {
-        distress(errorContext.kind, errorContext.message, jsonMode);
-      }
     }
-  }
-  process.exit(0);
+  };
+  recurse(absRoot);
+  out.sort((a, b) => a.src.localeCompare(b.src));
+  return out;
 }
-var ProcessExitSignal;
-var init_resolve_worktree2 = __esm({
-  "src/cli/resolve-worktree.ts"() {
+var EXCLUDED_RELATIVE_PATHS;
+var init_template_walker = __esm({
+  "src/lib/template-walker.ts"() {
     "use strict";
-    init_flags();
-    init_local_config();
-    init_resolve_worktree();
-    ProcessExitSignal = class extends Error {
-      code;
-      constructor(code) {
-        super(`process.exit(${code})`);
-        this.name = "ProcessExitSignal";
-        this.code = code;
-      }
-    };
+    init_hash();
+    EXCLUDED_RELATIVE_PATHS = /* @__PURE__ */ new Set([
+      // Meta files
+      "hooks/hooks.json",
+      "hooks/README.md",
+      "rules/README.md",
+      "settings.project.base.json",
+      "settings.user.base.json",
+      // .gitignore — managed by ensureManagedGitignoreBlock; never copied into
+      // consuming projects' .claude/ tree (it would overwrite the project root
+      // .gitignore with a stale single-entry file).
+      ".gitignore",
+      // CBP-internal hooks — see templates/hooks/README.md "Hooks NOT included and why"
+      "hooks/validate-structure.sh",
+      "hooks/validate-structure-lib.sh",
+      "hooks/validate-structure-patterns.sh",
+      "hooks/validate-structure-templates.sh",
+      "hooks/validate-structure-scope.sh",
+      "hooks/validate-structure-lengths.sh",
+      "hooks/validate-structure-smoke.sh",
+      "hooks/validate-context-usage.sh",
+      "hooks/validate-git-commit.sh"
+    ]);
   }
 });
 
-// src/lib/migrate-local-config.ts
-import { mkdir as mkdir5, readFile as readFile13, unlink as unlink2, writeFile as writeFile10 } from "node:fs/promises";
-import { join as join14 } from "node:path";
-function legacySharedPath(projectPath) {
-  return join14(projectPath, ".codebyplan.json");
-}
-function legacyLocalPath(projectPath) {
-  return join14(projectPath, ".codebyplan.local.json");
+// src/lib/manifest.ts
+import * as fs2 from "node:fs";
+import * as os from "node:os";
+import * as path3 from "node:path";
+function manifestPath(projectDir) {
+  return path3.join(projectDir, ".claude", NEW_MANIFEST_FILENAME);
 }
-function newDirPath(projectPath) {
-  return join14(projectPath, ".codebyplan");
+function midManifestPath(projectDir) {
+  return path3.join(projectDir, ".claude", MID_MANIFEST_FILENAME);
 }
-function sentinelPath(projectPath) {
-  return join14(projectPath, ".codebyplan", "repo.json");
+function oldManifestPath(projectDir) {
+  return path3.join(projectDir, ".claude", OLD_MANIFEST_FILENAME);
 }
-async function statSafe(p) {
-  const { stat: stat2 } = await import("node:fs/promises");
-  try {
-    return await stat2(p);
-  } catch {
-    return null;
+function readManifest(projectDir) {
+  const newFile = manifestPath(projectDir);
+  if (fs2.existsSync(newFile)) {
+    const raw = fs2.readFileSync(newFile, "utf8");
+    return JSON.parse(raw);
   }
-}
-async function needsLocalMigration(projectPath) {
-  try {
-    const legacyStat = await statSafe(legacySharedPath(projectPath));
-    if (!legacyStat) return false;
-    const sentinelStat = await statSafe(sentinelPath(projectPath));
-    if (sentinelStat) return false;
-    return true;
-  } catch {
-    return false;
+  const midFile = midManifestPath(projectDir);
+  if (fs2.existsSync(midFile)) {
+    const raw = fs2.readFileSync(midFile, "utf8");
+    return JSON.parse(raw);
   }
-}
-async function runLocalMigration(projectPath) {
-  const dirStat = await statSafe(newDirPath(projectPath));
-  if (dirStat && !dirStat.isDirectory()) {
-    throw new Error(
-      ".codebyplan exists as a file; remove or rename it before migrating."
-    );
+  const oldFile = oldManifestPath(projectDir);
+  if (fs2.existsSync(oldFile)) {
+    const raw = fs2.readFileSync(oldFile, "utf8");
+    return JSON.parse(raw);
   }
-  const sentinel = await statSafe(sentinelPath(projectPath));
-  if (sentinel) {
-    return {
-      migrated: true,
-      was_dirty: false,
-      files_changed: [],
-      summary: "already on new layout"
-    };
+  return null;
+}
+function writeManifest(projectDir, manifest) {
+  const file = manifestPath(projectDir);
+  fs2.mkdirSync(path3.dirname(file), { recursive: true });
+  fs2.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+  const mid = midManifestPath(projectDir);
+  if (fs2.existsSync(mid)) {
+    fs2.rmSync(mid);
   }
-  let legacyRaw;
-  try {
-    legacyRaw = await readFile13(legacySharedPath(projectPath), "utf-8");
-  } catch {
-    return {
-      migrated: true,
-      was_dirty: false,
-      files_changed: [],
-      summary: "legacy .codebyplan.json absent; nothing to migrate"
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(legacyRaw);
-  } catch (err) {
-    const inner = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `.codebyplan.json contains invalid JSON \u2014 cannot migrate: ${inner}`
-    );
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(
-      ".codebyplan.json does not contain a JSON object \u2014 cannot migrate"
-    );
+  const legacy = oldManifestPath(projectDir);
+  if (fs2.existsSync(legacy)) {
+    fs2.rmSync(legacy);
   }
-  const cfg = parsed;
-  let deviceId;
-  let deviceWrittenByHelper = false;
-  try {
-    const localRaw = await readFile13(legacyLocalPath(projectPath), "utf-8");
-    const localParsed = JSON.parse(localRaw);
-    if (typeof localParsed.device_id === "string") {
-      deviceId = localParsed.device_id;
+}
+function defaultManifest() {
+  return {
+    version: VERSION,
+    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    files: []
+  };
+}
+function userManifestPath(userDir) {
+  const dir = userDir ?? path3.join(os.homedir(), ".claude");
+  return path3.join(dir, NEW_MANIFEST_FILENAME);
+}
+function userMidManifestPath(userDir) {
+  const dir = userDir ?? path3.join(os.homedir(), ".claude");
+  return path3.join(dir, MID_MANIFEST_FILENAME);
+}
+function userOldManifestPath(userDir) {
+  const dir = userDir ?? path3.join(os.homedir(), ".claude");
+  return path3.join(dir, OLD_MANIFEST_FILENAME);
+}
+function readManifestForScope(scope, arg2) {
+  if (scope === "user") {
+    const newFile = userManifestPath(arg2);
+    if (fs2.existsSync(newFile)) {
+      const raw = fs2.readFileSync(newFile, "utf8");
+      return JSON.parse(raw);
     }
-  } catch {
-  }
-  try {
-    await mkdir5(newDirPath(projectPath), { recursive: true });
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOTDIR" || code === "EEXIST") {
-      throw new Error(
-        ".codebyplan exists as a file; remove or rename it before migrating."
-      );
+    const midFile = userMidManifestPath(arg2);
+    if (fs2.existsSync(midFile)) {
+      const raw = fs2.readFileSync(midFile, "utf8");
+      return JSON.parse(raw);
     }
-    throw err;
-  }
-  if (!deviceId) {
-    deviceId = await getOrCreateDeviceId(projectPath);
-    deviceWrittenByHelper = true;
-  }
-  const filesChanged = [];
-  const repoJson = {};
-  if ("repo_id" in cfg) repoJson.repo_id = cfg.repo_id;
-  if ("organization_id" in cfg) repoJson.organization_id = cfg.organization_id;
-  if ("project_id" in cfg) repoJson.project_id = cfg.project_id;
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "repo.json"),
-    JSON.stringify(repoJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/repo.json");
-  const serverJson = {};
-  if ("server_port" in cfg) serverJson.server_port = cfg.server_port;
-  if ("server_type" in cfg) serverJson.server_type = cfg.server_type;
-  if ("auto_push_enabled" in cfg)
-    serverJson.auto_push_enabled = cfg.auto_push_enabled;
-  if ("port_allocations" in cfg)
-    serverJson.port_allocations = cfg.port_allocations;
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "server.json"),
-    JSON.stringify(serverJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/server.json");
-  const gitJson = {};
-  if ("git_branch" in cfg) gitJson.git_branch = cfg.git_branch;
-  if ("branch_config" in cfg) gitJson.branch_config = cfg.branch_config;
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "git.json"),
-    JSON.stringify(gitJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/git.json");
-  const shipmentJson = {};
-  if ("shipment" in cfg) shipmentJson.shipment = cfg.shipment;
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "shipment.json"),
-    JSON.stringify(shipmentJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/shipment.json");
-  const vendorJson = {};
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "vendor.json"),
-    JSON.stringify(vendorJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/vendor.json");
-  const e2eJson = {};
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "e2e.json"),
-    JSON.stringify(e2eJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/e2e.json");
-  const eslintJson = {};
-  await writeFile10(
-    join14(projectPath, ".codebyplan", "eslint.json"),
-    JSON.stringify(eslintJson, null, 2) + "\n",
-    "utf-8"
-  );
-  filesChanged.push(".codebyplan/eslint.json");
-  if (!deviceWrittenByHelper) {
-    await writeFile10(
-      join14(projectPath, ".codebyplan", "device.local.json"),
-      JSON.stringify({ device_id: deviceId }, null, 2) + "\n",
-      "utf-8"
-    );
-  }
-  filesChanged.push(".codebyplan/device.local.json");
-  const writtenSentinel = await statSafe(sentinelPath(projectPath));
-  if (!writtenSentinel) {
-    throw new Error(
-      "Migration write incomplete: .codebyplan/repo.json was not persisted. Re-run migration to retry from a clean state."
-    );
+    const oldFile = userOldManifestPath(arg2);
+    if (fs2.existsSync(oldFile)) {
+      const raw = fs2.readFileSync(oldFile, "utf8");
+      return JSON.parse(raw);
+    }
+    return null;
   }
-  const gitignorePath = join14(projectPath, ".gitignore");
-  try {
-    const gitignoreContent = await readFile13(gitignorePath, "utf-8");
-    const legacyLine = ".codebyplan.local.json";
-    const newLine = ".codebyplan/device.local.json";
-    const hasLegacy = gitignoreContent.split("\n").some((l) => l.trimEnd() === legacyLine);
-    const hasNew = gitignoreContent.split("\n").some((l) => l.trimEnd() === newLine);
-    let updated;
-    if (hasLegacy && !hasNew) {
-      updated = gitignoreContent.split("\n").map((l) => {
-        const stripped = l.trimEnd();
-        return stripped === legacyLine ? newLine + (l.endsWith("\r") ? "\r" : "") : l;
-      }).join("\n");
-    } else if (hasLegacy && hasNew) {
-      updated = gitignoreContent.split("\n").filter((l) => l.trimEnd() !== legacyLine).join("\n");
-    } else if (!hasLegacy && !hasNew) {
-      updated = gitignoreContent.endsWith("\n") ? gitignoreContent + newLine + "\n" : gitignoreContent + "\n" + newLine + "\n";
-    } else {
-      updated = gitignoreContent;
+  return readManifest(arg2);
+}
+function writeManifestForScope(scope, manifest, arg3) {
+  if (scope === "user") {
+    const file = userManifestPath(arg3);
+    fs2.mkdirSync(path3.dirname(file), { recursive: true });
+    fs2.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+    const mid = userMidManifestPath(arg3);
+    if (fs2.existsSync(mid)) {
+      fs2.rmSync(mid);
     }
-    if (updated !== gitignoreContent) {
-      await writeFile10(gitignorePath, updated, "utf-8");
-      filesChanged.push(".gitignore");
+    const legacy = userOldManifestPath(arg3);
+    if (fs2.existsSync(legacy)) {
+      fs2.rmSync(legacy);
     }
-  } catch {
-  }
-  try {
-    await unlink2(legacySharedPath(projectPath));
-    filesChanged.push(".codebyplan.json (deleted)");
-  } catch {
-  }
-  try {
-    await unlink2(legacyLocalPath(projectPath));
-    filesChanged.push(".codebyplan.local.json (deleted)");
-  } catch {
+    return;
   }
-  return {
-    migrated: true,
-    was_dirty: true,
-    files_changed: filesChanged,
-    summary: `migrated legacy .codebyplan.json to .codebyplan/ layout (device_id=${deviceId.slice(0, 8)})`
-  };
+  writeManifest(arg3, manifest);
 }
-var init_migrate_local_config = __esm({
-  "src/lib/migrate-local-config.ts"() {
+var NEW_MANIFEST_FILENAME, MID_MANIFEST_FILENAME, OLD_MANIFEST_FILENAME;
+var init_manifest = __esm({
+  "src/lib/manifest.ts"() {
     "use strict";
-    init_local_config();
+    init_version();
+    NEW_MANIFEST_FILENAME = ".cbp.manifest.json";
+    MID_MANIFEST_FILENAME = ".cbp-claude.manifest.json";
+    OLD_MANIFEST_FILENAME = ".codebyplan-claude.manifest.json";
   }
 });
 
-// src/cli/config.ts
-var config_exports = {};
-__export(config_exports, {
-  readE2eConfig: () => readE2eConfig,
-  readGitConfig: () => readGitConfig,
-  readRepoConfig: () => readRepoConfig,
-  readServerConfig: () => readServerConfig,
-  readShipmentConfig: () => readShipmentConfig,
-  readVendorConfig: () => readVendorConfig,
-  runConfig: () => runConfig
-});
-import { mkdir as mkdir6, readFile as readFile14, writeFile as writeFile11 } from "node:fs/promises";
-import { join as join15 } from "node:path";
-async function runConfig() {
-  const flags = parseFlags(3);
-  const dryRun = hasFlag("dry-run", 3);
-  validateApiKey();
-  const config = await resolveConfig(flags);
-  const { repoId, projectPath } = config;
-  console.log(`
-  CodeByPlan Config`);
-  console.log(`  Repo: ${repoId}`);
-  console.log(`  Path: ${projectPath}`);
-  if (dryRun) console.log(`  Mode: dry-run`);
-  console.log();
-  if (!dryRun && await needsLocalMigration(projectPath)) {
-    console.log(
-      "  Migrating legacy .codebyplan.json to .codebyplan/ layout..."
+// src/lib/settings-merge.ts
+function extractHookId(command) {
+  const match = /([^\s/]+\.sh)(?:\s|$)/.exec(command);
+  const id = match?.[1];
+  if (!id) {
+    throw new Error(
+      `Cannot derive _hook_id from command (no .sh script segment): ${command}`
     );
-    try {
-      const result = await runLocalMigration(projectPath);
-      if (result.was_dirty) {
-        console.log("  Migration complete.");
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.warn(
-        `  Warning: migration failed (${msg}); continuing with config sync.`
-      );
-    }
   }
-  await syncConfigToFile(repoId, projectPath, dryRun);
-  console.log("\n  Config complete.\n");
+  return id;
 }
-async function syncConfigToFile(repoId, projectPath, dryRun) {
-  const codebyplanDir = join15(projectPath, ".codebyplan");
-  let resolvedWorktreeId;
-  try {
-    const deviceId = await getOrCreateDeviceId(projectPath);
-    let branch = "main";
-    try {
-      const { execSync: execSync6 } = await import("node:child_process");
-      branch = execSync6("git symbolic-ref --short HEAD", {
-        cwd: projectPath,
-        encoding: "utf-8"
-      }).trim();
-    } catch {
-    }
-    const tupleId = await resolveWorktreeId({
-      repoId,
-      repoPath: projectPath,
-      branch,
-      deviceId
-    });
-    if (tupleId) {
-      resolvedWorktreeId = tupleId;
-    } else {
-      resolvedWorktreeId = await resolveAndCacheWorktreeId(repoId, projectPath) ?? void 0;
-    }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.warn(
-      `  Warning: failed to cache worktree_id (self-heal skipped): ${msg}`
-    );
+function rewriteCommand(command) {
+  return command.replace(PLACEHOLDER_RE, REPLACEMENT);
+}
+function mergeHooksIntoSettings(settings, hooksJson) {
+  if (!settings.hooks) {
+    settings.hooks = {};
   }
-  let repoRes;
-  try {
-    repoRes = await apiGet(`/repos/${repoId}`);
-  } catch (err) {
-    let message;
-    if (err instanceof ApiError) {
-      if (err.status === 401) {
-        message = "Session expired. Run `codebyplan login` and try again.";
-      } else if (err.status === 403 || err.status === 404) {
-        message = "Repo not found or not accessible to your account. Confirm the repo_id in .codebyplan/repo.json and that you are logged in as the right user.";
-      } else if (err.status >= 500) {
-        message = `CodeByPlan server error (status ${err.status}). Please try again shortly.`;
-      } else {
-        message = `Unexpected API error (status ${err.status}). Please try again.`;
-      }
-    } else {
-      message = "Failed to reach the CodeByPlan API. Check your network connection and try again.";
+  const target = settings.hooks;
+  for (const [event, sourceMatchers] of Object.entries(hooksJson.hooks)) {
+    if (!target[event]) {
+      target[event] = [];
     }
-    process.stderr.write(message + "\n");
-    process.exit(1);
-  }
-  const repo = repoRes.data;
-  let portAllocations = [];
-  try {
-    const portsRes = await apiGet(
-      `/port-allocations`,
-      { repo_id: repoId }
-    );
-    const allAllocations = portsRes.data ?? [];
-    const filtered = resolvedWorktreeId ? allAllocations.filter((a) => a.worktree_id === resolvedWorktreeId) : allAllocations.filter((a) => !a.worktree_id);
-    const ALLOWED_FIELDS = [
-      "id",
-      "repo_id",
-      "port",
-      "label",
-      "server_type",
-      "auto_start",
-      "command",
-      "working_dir",
-      "env_vars",
-      "external_refs",
-      "worktree_id",
-      "created_at",
-      "updated_at"
-    ];
-    portAllocations = filtered.map((a) => {
-      const clean = {};
-      for (const key of ALLOWED_FIELDS) {
-        if (key in a) clean[key] = a[key];
+    const eventBlocks = target[event];
+    for (const sourceBlock of sourceMatchers) {
+      let destBlock = eventBlocks.find(
+        (b) => b.matcher === sourceBlock.matcher
+      );
+      if (!destBlock) {
+        destBlock = { matcher: sourceBlock.matcher, hooks: [] };
+        eventBlocks.push(destBlock);
       }
-      return clean;
-    });
-  } catch (err) {
-    console.warn(
-      `  Warning: failed to fetch port allocations: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  const matchingAlloc = portAllocations[0];
-  const defaultBranchConfig = {
-    protected: ["main"],
-    integration: null,
-    production: "main",
-    staging: null
-  };
-  const branchConfig = repo.branch_config ?? defaultBranchConfig;
-  if (!legacyBranchConfigWarned && typeof branchConfig["integration"] === "string") {
-    legacyBranchConfigWarned = true;
-    process.stderr.write(
-      `warning: legacy 3-branch branch_config detected (integration: '${String(branchConfig["integration"])}'). Run 'npx codebyplan branch migrate' to consolidate to main-only.
-`
-    );
+      for (const sourceCmd of sourceBlock.hooks) {
+        const taggedEntry = {
+          _owner: OWNER,
+          _hook_id: extractHookId(sourceCmd.command),
+          type: sourceCmd.type,
+          command: rewriteCommand(sourceCmd.command)
+        };
+        const existingIdx = destBlock.hooks.findIndex(
+          (e) => e._owner === OWNER && e._hook_id === taggedEntry._hook_id
+        );
+        if (existingIdx >= 0) {
+          destBlock.hooks[existingIdx] = taggedEntry;
+        } else {
+          destBlock.hooks.push(taggedEntry);
+        }
+      }
+    }
   }
-  const repoPayload = { repo_id: repoId };
-  const repoAny = repo;
-  if (typeof repoAny.organization_id === "string") {
-    repoPayload.organization_id = repoAny.organization_id;
+  return settings;
+}
+function mergeBaseSettingsIntoSettings(settings, base) {
+  for (const key of SCALAR_BASE_KEYS) {
+    if (base[key] !== void 0 && settings[key] === void 0) {
+      settings[key] = base[key];
+    }
   }
-  if (typeof repoAny.project_id === "string") {
-    repoPayload.project_id = repoAny.project_id;
+  if (base.statusLine !== void 0 && settings.statusLine === void 0) {
+    settings.statusLine = { ...base.statusLine };
   }
-  const serverPayload = {
-    server_port: resolvedWorktreeId && matchingAlloc ? matchingAlloc.port : repo.server_port,
-    server_type: resolvedWorktreeId && matchingAlloc ? matchingAlloc.server_type : repo.server_type,
-    auto_push_enabled: repo.auto_push_enabled,
-    port_allocations: portAllocations
-  };
-  const gitPayload = {
-    git_branch: repo.git_branch ?? "main",
-    branch_config: branchConfig
-  };
-  const shipmentPayload = {};
-  if (typeof repoAny.shipment !== "undefined") {
-    shipmentPayload.shipment = repoAny.shipment;
+  if (base.subagentStatusLine !== void 0 && settings.subagentStatusLine === void 0) {
+    settings.subagentStatusLine = { ...base.subagentStatusLine };
   }
-  const vendorPayload = {};
-  const e2ePayload = {};
-  const eslintPayload = {};
-  if (dryRun) {
-    console.log("  Config would be updated (dry-run).");
-    return;
+  if (base.attribution !== void 0 && settings.attribution === void 0) {
+    settings.attribution = { ...base.attribution };
   }
-  await mkdir6(codebyplanDir, { recursive: true });
-  const files = [
-    { name: "repo.json", payload: repoPayload },
-    { name: "server.json", payload: serverPayload },
-    { name: "git.json", payload: gitPayload },
-    { name: "shipment.json", payload: shipmentPayload },
-    { name: "vendor.json", payload: vendorPayload },
-    { name: "e2e.json", payload: e2ePayload, createOnly: true },
-    { name: "eslint.json", payload: eslintPayload, createOnly: true }
-  ];
-  let anyUpdated = false;
-  for (const { name, payload, createOnly } of files) {
-    const filePath = join15(codebyplanDir, name);
-    const newJson = JSON.stringify(payload, null, 2) + "\n";
-    let currentJson = "";
-    try {
-      currentJson = await readFile14(filePath, "utf-8");
-    } catch {
+  if (base.worktree !== void 0) {
+    if (settings.worktree === void 0) {
+      settings.worktree = { ...base.worktree };
+    } else {
+      const sw = settings.worktree;
+      for (const [k, v] of Object.entries(base.worktree)) {
+        if (sw[k] === void 0) {
+          sw[k] = v;
+        }
+      }
     }
-    if (createOnly && currentJson !== "") continue;
-    if (currentJson === newJson) continue;
-    await writeFile11(filePath, newJson, "utf-8");
-    console.log(`  Updated .codebyplan/${name}`);
-    anyUpdated = true;
   }
-  if (!anyUpdated) {
-    console.log("  Config up to date.");
+  if (base.permissions !== void 0) {
+    const existing = settings.permissions ?? {};
+    if (base.permissions.defaultMode !== void 0 && existing.defaultMode === void 0) {
+      existing.defaultMode = base.permissions.defaultMode;
+    }
+    if (base.permissions.skipDangerousModePermissionPrompt !== void 0 && existing.skipDangerousModePermissionPrompt === void 0) {
+      existing.skipDangerousModePermissionPrompt = base.permissions.skipDangerousModePermissionPrompt;
+    }
+    for (const key of ["deny", "ask", "allow"]) {
+      const incoming = base.permissions[key];
+      if (!incoming || incoming.length === 0) continue;
+      const current = existing[key] ?? [];
+      const seen = new Set(current);
+      const merged = [...current];
+      for (const item of incoming) {
+        if (!seen.has(item)) {
+          merged.push(item);
+          seen.add(item);
+        }
+      }
+      existing[key] = merged;
+    }
+    if (settings.permissions !== void 0 || Object.keys(existing).length > 0) {
+      settings.permissions = existing;
+    }
   }
+  return settings;
 }
-async function readRepoConfig(projectPath) {
-  try {
-    const raw = await readFile14(
-      join15(projectPath, ".codebyplan", "repo.json"),
-      "utf-8"
-    );
-    return JSON.parse(raw);
-  } catch {
-    return null;
+function stripBaseSettingsFromSettings(settings, base) {
+  for (const key of SCALAR_BASE_KEYS) {
+    if (base[key] !== void 0 && settings[key] === base[key]) {
+      delete settings[key];
+    }
   }
-}
-async function readServerConfig(projectPath) {
-  try {
-    const raw = await readFile14(
-      join15(projectPath, ".codebyplan", "server.json"),
-      "utf-8"
-    );
-    return JSON.parse(raw);
-  } catch {
-    return null;
+  if (base.statusLine !== void 0 && settings.statusLine !== void 0 && JSON.stringify(settings.statusLine) === JSON.stringify(base.statusLine)) {
+    delete settings.statusLine;
   }
-}
-async function readGitConfig(projectPath) {
-  try {
-    const raw = await readFile14(
-      join15(projectPath, ".codebyplan", "git.json"),
-      "utf-8"
-    );
-    return JSON.parse(raw);
-  } catch {
-    return null;
+  if (base.subagentStatusLine !== void 0 && settings.subagentStatusLine !== void 0 && JSON.stringify(settings.subagentStatusLine) === JSON.stringify(base.subagentStatusLine)) {
+    delete settings.subagentStatusLine;
   }
-}
-async function readShipmentConfig(projectPath) {
-  try {
-    const raw = await readFile14(
-      join15(projectPath, ".codebyplan", "shipment.json"),
-      "utf-8"
-    );
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function readVendorConfig(projectPath) {
-  try {
-    const raw = await readFile14(
-      join15(projectPath, ".codebyplan", "vendor.json"),
-      "utf-8"
-    );
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function readE2eConfig(projectPath) {
-  try {
-    const raw = await readFile14(
-      join15(projectPath, ".codebyplan", "e2e.json"),
-      "utf-8"
-    );
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-var legacyBranchConfigWarned;
-var init_config = __esm({
-  "src/cli/config.ts"() {
-    "use strict";
-    init_flags();
-    init_api();
-    init_resolve_worktree();
-    init_local_config();
-    init_migrate_local_config();
-    legacyBranchConfigWarned = false;
+  if (base.attribution !== void 0 && settings.attribution !== void 0 && JSON.stringify(settings.attribution) === JSON.stringify(base.attribution)) {
+    delete settings.attribution;
   }
-});
-
-// src/lib/server-detect.ts
-function detectFramework(pkg) {
-  const deps = pkg.dependencies ?? {};
-  const devDeps = pkg.devDependencies ?? {};
-  const hasDep = (name) => name in deps || name in devDeps;
-  if (hasDep("next")) return "nextjs";
-  if (hasDep("@tauri-apps/api") || hasDep("@tauri-apps/cli")) return "tauri";
-  if (hasDep("expo")) return "expo";
-  if (hasDep("vite")) return "vite";
-  if (hasDep("express")) return "express";
-  if (hasDep("@nestjs/core")) return "nestjs";
-  return "custom";
-}
-function detectPortFromScripts(pkg) {
-  const scripts = pkg.scripts;
-  if (!scripts?.dev) return null;
-  const parts = scripts.dev.split(/\s+/);
-  for (let i = 0; i < parts.length - 1; i++) {
-    if (parts[i] === "--port" || parts[i] === "-p") {
-      const next = parts[i + 1];
-      if (next) {
-        const port = parseInt(next, 10);
-        if (!isNaN(port)) return port;
+  if (base.worktree !== void 0 && settings.worktree !== void 0) {
+    const sw = settings.worktree;
+    for (const [k, v] of Object.entries(base.worktree)) {
+      if (sw[k] === v) {
+        delete sw[k];
       }
     }
+    if (Object.keys(sw).length === 0) {
+      delete settings.worktree;
+    }
   }
-  return null;
-}
-var init_server_detect = __esm({
-  "src/lib/server-detect.ts"() {
-    "use strict";
-  }
-});
-
-// src/lib/port-verify.ts
-import { readFile as readFile15 } from "node:fs/promises";
-async function verifyPorts(projectPath, portAllocations) {
-  const mismatches = [];
-  const allocatedPorts = new Set(portAllocations.map((a) => a.port));
-  const packageJsonPaths = await findPackageJsonFiles(projectPath, projectPath);
-  for (const pkgPath of packageJsonPaths) {
-    try {
-      const raw = await readFile15(pkgPath, "utf-8");
-      const pkg = JSON.parse(raw);
-      const scriptPort = detectPortFromScripts(pkg);
-      if (scriptPort !== null && !allocatedPorts.has(scriptPort)) {
-        const relativePath = pkgPath.replace(projectPath + "/", "");
-        const matchingAlloc = portAllocations.find(
-          (a) => a.label === getAppLabel(relativePath)
-        );
-        mismatches.push({
-          packageJsonPath: relativePath,
-          scriptPort,
-          allocation: matchingAlloc ?? null,
-          reason: matchingAlloc ? `Script uses port ${scriptPort} but allocation has port ${matchingAlloc.port}` : `Port ${scriptPort} in scripts is not in any allocation`
-        });
+  if (base.permissions !== void 0 && settings.permissions !== void 0) {
+    const perms = settings.permissions;
+    if (base.permissions.defaultMode !== void 0 && perms.defaultMode === base.permissions.defaultMode) {
+      delete perms.defaultMode;
+    }
+    if (base.permissions.skipDangerousModePermissionPrompt !== void 0 && perms.skipDangerousModePermissionPrompt === base.permissions.skipDangerousModePermissionPrompt) {
+      delete perms.skipDangerousModePermissionPrompt;
+    }
+    for (const key of ["deny", "ask", "allow"]) {
+      const baseList = base.permissions[key];
+      if (!baseList || baseList.length === 0) continue;
+      const current = perms[key];
+      if (!current) continue;
+      const baseSet = new Set(baseList);
+      const filtered = current.filter((x) => !baseSet.has(x));
+      if (filtered.length === 0) {
+        delete perms[key];
+      } else {
+        perms[key] = filtered;
       }
-    } catch {
+    }
+    if (Object.keys(perms).length === 0) {
+      delete settings.permissions;
     }
   }
-  return mismatches;
-}
-function isDevServerScript(pkg) {
-  const scripts = pkg.scripts;
-  const raw = scripts?.dev;
-  if (!raw || typeof raw !== "string") return false;
-  const script = raw.trim().toLowerCase();
-  if (!script) return false;
-  for (const pattern of DEV_SERVER_BIN_PATTERNS) {
-    if (pattern.test(script)) return true;
-  }
-  const tokens = script.split(/\s+/);
-  for (const token of tokens) {
-    if (token === "--port" || token === "-p") return true;
-    if (token.startsWith("--port=")) return true;
-  }
-  return false;
-}
-function labelMatchesAppName(label, appName) {
-  if (!label || !appName) return false;
-  const normalize = (s) => s.toLowerCase().replace(/-/g, " ").replace(/[()]/g, " ").replace(/\s+/g, " ").trim();
-  const labelTokens = normalize(label).split(" ").filter(Boolean);
-  const appToken = normalize(appName);
-  if (!appToken) return false;
-  const appTokens = appToken.split(" ").filter(Boolean);
-  if (appTokens.length === 1) {
-    return labelTokens.includes(appTokens[0]);
-  }
-  for (let i = 0; i <= labelTokens.length - appTokens.length; i++) {
-    if (appTokens.every((t, j) => labelTokens[i + j] === t)) return true;
-  }
-  return false;
+  return settings;
 }
-async function findUnallocatedApps(projectPath, portAllocations) {
-  const apps = await discoverMonorepoApps(projectPath);
-  if (apps.length === 0) {
-    return [];
+function stripOwnedHooksFromSettings(settings) {
+  if (!settings.hooks) {
+    return settings;
   }
-  const unallocated = [];
-  for (const app of apps) {
-    if (portAllocations.some((a) => labelMatchesAppName(a.label ?? "", app.name))) {
+  for (const event of Object.keys(settings.hooks)) {
+    const eventBlocks = settings.hooks[event];
+    if (!eventBlocks) {
       continue;
     }
-    let pkg;
-    try {
-      const raw = await readFile15(`${app.absPath}/package.json`, "utf-8");
-      pkg = JSON.parse(raw);
-    } catch {
-      continue;
+    const survivingBlocks = [];
+    for (const block of eventBlocks) {
+      block.hooks = block.hooks.filter((e) => e._owner !== OWNER);
+      if (block.hooks.length > 0) {
+        survivingBlocks.push(block);
+      }
+    }
+    if (survivingBlocks.length > 0) {
+      settings.hooks[event] = survivingBlocks;
+    } else {
+      delete settings.hooks[event];
     }
-    if (!isDevServerScript(pkg)) continue;
-    const framework = detectFramework(pkg);
-    const detectedPort = detectPortFromScripts(pkg);
-    const command = `pnpm --filter ${app.name} dev`;
-    unallocated.push({
-      name: app.name,
-      path: app.path,
-      framework,
-      detectedPort,
-      command
-    });
   }
-  return unallocated;
-}
-function getAppLabel(relativePath) {
-  const parts = relativePath.split("/");
-  if (parts.length >= 3 && parts[0] === "apps") {
-    return parts[1];
+  if (Object.keys(settings.hooks).length === 0) {
+    delete settings.hooks;
   }
-  return "root";
+  return settings;
 }
-var DEV_SERVER_BIN_PATTERNS;
-var init_port_verify = __esm({
-  "src/lib/port-verify.ts"() {
+var OWNER, PLACEHOLDER_RE, REPLACEMENT, SCALAR_BASE_KEYS;
+var init_settings_merge = __esm({
+  "src/lib/settings-merge.ts"() {
     "use strict";
-    init_tech_detect();
-    init_server_detect();
-    DEV_SERVER_BIN_PATTERNS = [
-      /\bnext\s+dev\b/,
-      /\bnest\s+start\b/,
-      /\bvite\s+(?:dev|serve)\b/,
-      /\bvite\s+preview\b/,
-      /\bnuxt\s+dev\b/,
-      /\b(?:svelte-kit|sveltekit)\s+dev\b/,
-      /\bexpo\s+start\b/
+    OWNER = "codebyplan-claude";
+    PLACEHOLDER_RE = /\$\{CLAUDE_PLUGIN_ROOT\}\/hooks\//g;
+    REPLACEMENT = "./.claude/hooks/";
+    SCALAR_BASE_KEYS = [
+      "alwaysThinkingEnabled",
+      "autoUpdatesChannel",
+      "awaySummaryEnabled",
+      "disableAgentView",
+      "disableRemoteControl",
+      "editorMode",
+      "outputStyle",
+      "preferredNotifChannel",
+      "prefersReducedMotion",
+      "respectGitignore",
+      "showTurnDuration",
+      "spinnerTipsEnabled",
+      "terminalProgressBarEnabled",
+      "viewMode",
+      "autoScrollEnabled",
+      "cleanupPeriodDays",
+      "includeGitInstructions",
+      "showThinkingSummaries",
+      "disableSkillShellExecution",
+      "skipWebFetchPreflight",
+      "fastModePerSessionOptIn",
+      "effortLevel",
+      "showClearContextOnPlanAccept",
+      "syntaxHighlightingDisabled"
     ];
   }
 });
 
-// src/cli/ports.ts
-var ports_exports = {};
-__export(ports_exports, {
-  runPorts: () => runPorts
-});
-async function runPorts() {
-  const flags = parseFlags(3);
-  const dryRun = hasFlag("dry-run", 3);
-  const fix = hasFlag("fix", 3);
-  validateApiKey();
-  const config = await resolveConfig(flags);
-  const { repoId, projectPath } = config;
-  console.log(`
-  CodeByPlan Ports`);
-  console.log(`  Repo: ${repoId}`);
-  console.log(`  Path: ${projectPath}`);
-  if (dryRun) console.log(`  Mode: dry-run`);
-  if (fix) console.log(`  Mode: fix`);
-  console.log();
-  try {
-    const portsRes = await apiGet(
-      `/port-allocations`,
-      { repo_id: repoId }
-    );
-    const allocations = portsRes.data ?? [];
-    if (allocations.length === 0) {
-      console.log("  No port allocations found \u2014 skipping verification.");
-      console.log("\n  Ports complete.\n");
-      return;
+// src/cli/claude/install.ts
+var install_exports = {};
+__export(install_exports, {
+  resolveTemplatesDir: () => resolveTemplatesDir,
+  runInstall: () => runInstall
+});
+import * as fs3 from "node:fs";
+import * as os2 from "node:os";
+import * as path4 from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveTemplatesDir() {
+  const here = path4.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path4.resolve(here, "..", "templates"),
+    path4.resolve(here, "..", "..", "templates"),
+    path4.resolve(here, "..", "..", "..", "templates")
+  ];
+  for (const c of candidates) {
+    if (fs3.existsSync(c) && fs3.statSync(c).isDirectory()) {
+      return c;
     }
-    const mismatches = await verifyPorts(projectPath, allocations);
-    if (mismatches.length > 0) {
-      console.log(`  Port mismatches: ${mismatches.length}`);
-      for (const m of mismatches) {
-        console.log(`    ! ${m.packageJsonPath}: ${m.reason}`);
-      }
+  }
+  throw new Error(
+    `codebyplan: could not locate templates/ directory. Probed:
+  ${candidates.join(
+      "\n  "
+    )}`
+  );
+}
+async function runInstall(opts, deps = {}) {
+  await Promise.resolve();
+  const scope = opts.scope ?? "project";
+  if (scope === "user") {
+    if (opts.renderer) {
+      console.warn(
+        "codebyplan claude install: --bash/--node/--python is ignored for --scope user (no project root for statusline.local.json)."
+      );
     }
-    const unallocated = await findUnallocatedApps(projectPath, allocations);
-    if (unallocated.length > 0) {
-      console.log(`  Unallocated apps: ${unallocated.length}`);
-      for (const app of unallocated) {
-        console.log(
-          `    + ${app.name} (${app.framework}${app.detectedPort ? `, port ${app.detectedPort}` : ""})`
-        );
-      }
-      if (fix && !dryRun) {
-        const maxPort = Math.max(...allocations.map((a) => a.port), 2999);
-        let nextPort = maxPort + 1;
-        for (const app of unallocated) {
-          const port = app.detectedPort ?? nextPort++;
-          try {
-            await apiPost("/port-allocations", {
-              repo_id: repoId,
-              port,
-              label: app.name,
-              server_type: app.framework,
-              auto_start: "manual",
-              command: app.command,
-              working_dir: app.path
-            });
-            console.log(`    Created allocation: ${app.name} \u2192 port ${port}`);
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.log(
-              `    Failed to create allocation for ${app.name}: ${msg}`
-            );
-          }
-          if (app.detectedPort && app.detectedPort >= nextPort) {
-            nextPort = app.detectedPort + 1;
-          }
+    runInstallUser(opts, deps);
+    return;
+  }
+  const projectDir = deps.projectDir ?? process.cwd();
+  let templatesDir;
+  try {
+    templatesDir = deps.templatesDir ?? resolveTemplatesDir();
+  } catch (err) {
+    console.error(
+      err instanceof Error ? err.message : `codebyplan claude install: ${String(err)}`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const files = walkTemplates(templatesDir);
+    const manifestEntries = [];
+    for (const f of files) {
+      const absDest = path4.join(projectDir, ".claude", f.dest);
+      const absSrc = path4.join(templatesDir, f.src);
+      if (opts.dryRun) {
+        if (opts.verbose) {
+          console.log(`[dry-run] would copy ${f.src} \u2192 .claude/${f.dest}`);
         }
-      } else if (fix && dryRun) {
-        console.log("  (dry-run \u2014 would create allocations with --fix)");
       } else {
-        console.log("  Run with --fix to auto-create allocations.");
+        fs3.mkdirSync(path4.dirname(absDest), { recursive: true });
+        fs3.copyFileSync(absSrc, absDest);
+        if (opts.verbose) {
+          console.log(`copied ${f.src} \u2192 .claude/${f.dest}`);
+        }
       }
+      manifestEntries.push({ src: f.src, dest: f.dest, hash: f.hash });
     }
-    if (mismatches.length === 0 && unallocated.length === 0) {
-      console.log("  Ports verified.");
-    }
-  } catch (err) {
-    console.warn(
-      `  Port verification skipped: ${err instanceof Error ? err.message : String(err)}`
+    const hooksJsonPath = path4.join(templatesDir, "hooks", "hooks.json");
+    const baseSettingsPath = path4.join(
+      templatesDir,
+      "settings.project.base.json"
     );
-  }
-  console.log("\n  Ports complete.\n");
-}
-var init_ports = __esm({
-  "src/cli/ports.ts"() {
-    "use strict";
-    init_flags();
-    init_api();
-    init_port_verify();
-  }
-});
-
-// src/cli/tech-stack.ts
-var tech_stack_exports = {};
-__export(tech_stack_exports, {
-  runFullTechStack: () => runFullTechStack,
-  runTechStack: () => runTechStack
-});
-import { existsSync } from "node:fs";
-async function runTechStack() {
-  const flags = parseFlags(3);
-  const dryRun = hasFlag("dry-run", 3);
-  if (hasFlag("full-tech-stack", 3)) {
-    await runFullTechStack(dryRun);
-    return;
-  }
-  validateApiKey();
-  const config = await resolveConfig(flags);
-  const { repoId, projectPath } = config;
-  console.log(`
-  CodeByPlan Tech Stack`);
-  console.log(`  Repo: ${repoId}`);
-  console.log(`  Path: ${projectPath}`);
-  if (dryRun) console.log(`  Mode: dry-run`);
-  console.log();
-  if (dryRun) {
-    try {
-      if (await needsLocalMigration(projectPath)) {
-        console.log(
-          `  Would migrate .codebyplan.json -> worktree_id to .codebyplan.local.json (dry-run, skipping actual write).`
+    const hasHooks = fs3.existsSync(hooksJsonPath);
+    const hasBase = fs3.existsSync(baseSettingsPath);
+    if (hasHooks || hasBase) {
+      const settingsPath = path4.join(projectDir, ".claude", "settings.json");
+      const existingSettings = fs3.existsSync(settingsPath) ? JSON.parse(fs3.readFileSync(settingsPath, "utf8")) : {};
+      if (hasBase) {
+        const base = JSON.parse(
+          fs3.readFileSync(baseSettingsPath, "utf8")
         );
+        mergeBaseSettingsIntoSettings(existingSettings, base);
       }
-    } catch {
-    }
-  } else {
-    try {
-      if (await needsLocalMigration(projectPath)) {
-        const result = await runLocalMigration(projectPath);
-        console.log(
-          `  Migrated .codebyplan.json to .codebyplan/ layout: ${result.summary}`
+      if (hasHooks) {
+        const hooksJson = JSON.parse(
+          fs3.readFileSync(hooksJsonPath, "utf8")
+        );
+        mergeHooksIntoSettings(existingSettings, hooksJson);
+      }
+      if (!opts.dryRun) {
+        fs3.mkdirSync(path4.dirname(settingsPath), { recursive: true });
+        fs3.writeFileSync(
+          settingsPath,
+          JSON.stringify(existingSettings, null, 2) + "\n",
+          "utf8"
         );
+      } else if (opts.verbose) {
         console.log(
-          `  Suggest /cbp-git-commit to stage the cleaned shared file.`
+          `[dry-run] would merge settings into ${path4.relative(projectDir, settingsPath)}`
         );
       }
-    } catch (err) {
-      console.warn(
-        `  Warning: local migration failed (continuing): ${err instanceof Error ? err.message : String(err)}`
+    }
+    const gitignoreAction = await ensureManagedGitignoreBlock(
+      projectDir,
+      opts.dryRun
+    );
+    if (opts.verbose && gitignoreAction !== "unchanged") {
+      console.log(
+        `${opts.dryRun ? "[dry-run] would " : ""}${gitignoreAction} managed .gitignore block in ${path4.relative(projectDir, path4.join(projectDir, ".gitignore"))}`
       );
     }
-  }
-  try {
-    const { dependencies } = await scanAllDependencies(projectPath);
-    if (dependencies.length === 0) {
-      console.log("  No dependencies found.");
-      console.log("\n  Tech stack complete.\n");
-      return;
+    if (!opts.dryRun) {
+      const manifest = defaultManifest();
+      manifest.files = manifestEntries;
+      writeManifest(projectDir, manifest);
     }
-    const sourcePaths = new Set(dependencies.map((d) => d.source_path));
     console.log(
-      `  ${dependencies.length} dependencies from ${sourcePaths.size} package.json file${sourcePaths.size !== 1 ? "s" : ""}`
+      `codebyplan claude install${opts.dryRun ? " (dry-run)" : ""}: ${manifestEntries.length} files, ${countHookEntries(templatesDir)} hook entries.`
     );
-    if (!dryRun) {
-      const result = await apiPost(`/repos/${repoId}/tech-stack`, { dependencies });
-      if (result.data.stale_removed > 0) {
-        console.log(
-          `  ${result.data.stale_removed} stale dependencies removed`
-        );
-      }
-      try {
-        const { execSync: execSync6 } = await import("node:child_process");
-        let branch = "main";
-        try {
-          branch = execSync6("git symbolic-ref --short HEAD", {
-            cwd: projectPath,
-            encoding: "utf-8"
-          }).trim();
-        } catch {
-        }
-        const deviceId = await getOrCreateDeviceId(projectPath);
-        const tupleId = await resolveWorktreeId({
-          repoId,
-          repoPath: projectPath,
-          branch,
-          deviceId
-        });
-        await callMcpTool("enqueue_todo_job", {
-          repo_id: repoId,
-          ...tupleId ? { worktree_id: tupleId } : {},
-          reason: "CLI_SYNC"
-        });
-      } catch {
-      }
-    }
-    const detected = await detectTechStack(projectPath);
-    if (detected.flat.length > 0) {
-      const repoRes = await apiGet(`/repos/${repoId}`);
-      const remote = parseTechStackResult(repoRes.data.tech_stack);
-      const { merged, added } = mergeTechStack(remote, detected);
-      if (added.length > 0) {
-        console.log(`  ${added.length} new tech entries`);
-        if (!dryRun) {
-          await apiPut(`/repos/${repoId}`, { tech_stack: merged });
-        }
-      }
+    if (opts.renderer && !opts.dryRun) {
+      await writeStatuslineLocalConfig(projectDir, { renderer: opts.renderer });
     }
   } catch (err) {
-    console.warn(
-      `  Tech stack detection skipped: ${err instanceof Error ? err.message : String(err)}`
+    console.error(
+      `codebyplan claude install failed: ${err instanceof Error ? err.message : String(err)}`
     );
+    process.exitCode = 1;
   }
-  console.log("\n  Tech stack complete.\n");
 }
-async function syncTechStackForPath(repoId, projectPath, dryRun) {
+function runInstallUser(opts, deps) {
+  let templatesDir;
   try {
-    const { dependencies } = await scanAllDependencies(projectPath);
-    if (dependencies.length === 0) {
-      console.log("    No dependencies found.");
+    templatesDir = deps.templatesDir ?? resolveTemplatesDir();
+  } catch (err) {
+    console.error(
+      err instanceof Error ? err.message : `codebyplan claude install: ${String(err)}`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const userDir = deps.userDir ?? path4.join(os2.homedir(), ".claude");
+    const settingsPath = path4.join(userDir, "settings.json");
+    const userBaseSettingsPath = path4.join(
+      templatesDir,
+      "settings.user.base.json"
+    );
+    if (!fs3.existsSync(userBaseSettingsPath)) {
+      console.error(
+        "codebyplan claude install: settings.user.base.json not found in templates."
+      );
+      process.exitCode = 1;
       return;
     }
-    const sourcePaths = new Set(dependencies.map((d) => d.source_path));
-    console.log(
-      `    ${dependencies.length} dependencies from ${sourcePaths.size} package.json file${sourcePaths.size !== 1 ? "s" : ""}`
+    const userBase = JSON.parse(
+      fs3.readFileSync(userBaseSettingsPath, "utf8")
     );
-    if (!dryRun) {
-      const result = await apiPost(`/repos/${repoId}/tech-stack`, { dependencies });
-      if (result.data.stale_removed > 0) {
-        console.log(
-          `    ${result.data.stale_removed} stale dependencies removed`
-        );
-      }
-    }
-    const detected = await detectTechStack(projectPath);
-    if (detected.flat.length > 0) {
-      const repoRes = await apiGet(`/repos/${repoId}`);
-      const remote = parseTechStackResult(repoRes.data.tech_stack);
-      const { merged, added } = mergeTechStack(remote, detected);
-      if (added.length > 0) {
-        console.log(`    ${added.length} new tech entries`);
-        if (!dryRun) {
-          await apiPut(`/repos/${repoId}`, { tech_stack: merged });
-        }
-      }
+    const existingSettings = fs3.existsSync(settingsPath) ? JSON.parse(fs3.readFileSync(settingsPath, "utf8")) : {};
+    mergeBaseSettingsIntoSettings(existingSettings, userBase);
+    if (!opts.dryRun) {
+      fs3.mkdirSync(userDir, { recursive: true });
+      fs3.writeFileSync(
+        settingsPath,
+        JSON.stringify(existingSettings, null, 2) + "\n",
+        "utf8"
+      );
+      const manifest = defaultManifest();
+      manifest.files = [];
+      writeManifestForScope("user", manifest, userDir);
+    } else if (opts.verbose) {
+      console.log(
+        `[dry-run] would merge user base settings into ${settingsPath}`
+      );
     }
+    console.log(
+      `codebyplan claude install --scope user${opts.dryRun ? " (dry-run)" : ""}: settings.json updated, 0 template files copied.`
+    );
   } catch (err) {
-    console.warn(
-      `    Tech stack detection skipped: ${err instanceof Error ? err.message : String(err)}`
+    console.error(
+      `codebyplan claude install failed: ${err instanceof Error ? err.message : String(err)}`
     );
+    process.exitCode = 1;
   }
 }
-async function runFullTechStack(dryRun) {
-  validateApiKey();
-  const localConfig = await readLocalConfig(process.cwd());
-  if (!localConfig?.device_id) {
+function countHookEntries(templatesDir) {
+  const p = path4.join(templatesDir, "hooks", "hooks.json");
+  if (!fs3.existsSync(p)) return 0;
+  try {
+    const j = JSON.parse(fs3.readFileSync(p, "utf8"));
+    let n = 0;
+    for (const blocks of Object.values(j.hooks)) {
+      for (const b of blocks) n += b.hooks.length;
+    }
+    return n;
+  } catch (err) {
     console.error(
-      "  --full-tech-stack requires a device_id in .codebyplan/device.local.json.\n  Run `npx codebyplan setup` in this directory first to register the device."
+      `codebyplan: could not count hook entries in hooks.json: ${err instanceof Error ? err.message : String(err)}`
     );
-    process.exitCode = 1;
-    return;
+    return 0;
   }
-  console.log("\n  CodeByPlan Tech Stack \u2014 Full (all local worktrees)");
-  if (dryRun) console.log("  Mode: dry-run");
-  console.log();
-  const reposRes = await apiGet("/repos");
-  const repos = reposRes.data ?? [];
-  let synced = 0;
-  let skipped = 0;
-  for (const repo of repos) {
-    let worktrees = [];
-    try {
-      const wtRes = await apiGet(
-        `/worktrees?repo_id=${repo.id}`
-      );
-      worktrees = wtRes.data ?? [];
-    } catch (err) {
-      console.warn(
-        `  Warning: failed to fetch worktrees for ${repo.name}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      continue;
-    }
-    const localWorktrees = worktrees.filter(
-      (wt) => wt.path ? existsSync(wt.path) : false
+}
+var init_install = __esm({
+  "src/cli/claude/install.ts"() {
+    "use strict";
+    init_template_walker();
+    init_gitignore_block();
+    init_manifest();
+    init_settings_merge();
+    init_statusline_config();
+  }
+});
+
+// src/lib/scaffold-publish-workflow.ts
+import * as fs4 from "node:fs";
+import * as path5 from "node:path";
+async function runScaffoldPublishWorkflow(opts) {
+  await Promise.resolve();
+  const dryRun = opts?.dryRun ?? false;
+  const force = opts?.force ?? false;
+  const projectDir = path5.resolve(opts?.projectDir ?? process.cwd());
+  const templatesDir = opts?.templatesDir ?? resolveTemplatesDir();
+  const templatePath = path5.join(
+    templatesDir,
+    "github-workflows",
+    "publish.yml"
+  );
+  if (!fs4.existsSync(templatePath)) {
+    throw new Error(
+      `scaffold-publish-workflow: template not found at ${templatePath}`
     );
-    if (localWorktrees.length === 0) {
-      console.log(`  skipping ${repo.name} \u2014 no local worktree on this device`);
-      skipped++;
-      continue;
+  }
+  const templateContent = fs4.readFileSync(templatePath, "utf-8");
+  const targetPath = path5.join(
+    projectDir,
+    ".github",
+    "workflows",
+    "publish.yml"
+  );
+  if (dryRun) {
+    return { status: "dry_run", path: targetPath };
+  }
+  if (fs4.existsSync(targetPath)) {
+    const existingContent = fs4.readFileSync(targetPath, "utf-8");
+    if (existingContent === templateContent) {
+      return {
+        status: "skipped",
+        path: targetPath,
+        reason: "already up to date"
+      };
     }
-    for (const wt of localWorktrees) {
-      console.log(`  ==> Syncing ${repo.name} @ ${wt.path}`);
-      try {
-        await syncTechStackForPath(repo.id, wt.path, dryRun);
-        synced++;
-      } catch (err) {
-        console.error(
-          `  Error syncing tech stack for ${repo.name} @ ${wt.path}: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
+    if (!force) {
+      throw new Error(
+        `scaffold-publish-workflow: ${targetPath} already exists and differs from the template. Pass --force to overwrite.`
+      );
     }
   }
-  console.log(
-    `
-  Walked ${repos.length} repos, synced ${synced} local worktrees, skipped ${skipped} remote.
-`
-  );
+  const targetDir = path5.dirname(targetPath);
+  fs4.mkdirSync(targetDir, { recursive: true });
+  fs4.writeFileSync(targetPath, templateContent, "utf-8");
+  return { status: "written", path: targetPath };
 }
-var init_tech_stack = __esm({
-  "src/cli/tech-stack.ts"() {
+var init_scaffold_publish_workflow = __esm({
+  "src/lib/scaffold-publish-workflow.ts"() {
     "use strict";
-    init_flags();
-    init_api();
-    init_tech_detect();
-    init_migrate_local_config();
-    init_local_config();
-    init_resolve_worktree();
+    init_install();
   }
 });
 
-// src/lib/hash.ts
-import { createHash as createHash3 } from "node:crypto";
-function sha256(input) {
-  const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
-  return `sha256:${createHash3("sha256").update(buf).digest("hex")}`;
+// src/cli/scaffold-publish-workflow.ts
+var scaffold_publish_workflow_exports = {};
+__export(scaffold_publish_workflow_exports, {
+  runScaffoldPublishWorkflowCommand: () => runScaffoldPublishWorkflowCommand
+});
+function parseFlagsFromArgs4(args) {
+  const flags = {};
+  const booleans = /* @__PURE__ */ new Set();
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      const next = args[i + 1];
+      if (next !== void 0 && !next.startsWith("--")) {
+        flags[key] = next;
+        i++;
+      } else {
+        booleans.add(key);
+      }
+    }
+  }
+  return { flags, booleans };
 }
-var init_hash = __esm({
-  "src/lib/hash.ts"() {
+function printHelp() {
+  process.stdout.write(
+    "\n  codebyplan scaffold-publish-workflow\n\n  Write the publish-on-main GitHub Actions workflow into\n  ./.github/workflows/publish.yml. Idempotent \u2014 safe to re-run.\n\n  Flags:\n    --dry-run           Preview the operation without writing any files\n    --force             Overwrite an existing file that differs from the template\n    --project-dir <p>   Target project root (default: current directory)\n    --json              Write structured JSON to stdout\n\n"
+  );
+}
+function printHumanResult2(result) {
+  switch (result.status) {
+    case "written":
+      process.stdout.write(`Written: ${result.path}
+`);
+      break;
+    case "skipped":
+      process.stdout.write(`Skipped: ${result.path} (${result.reason})
+`);
+      break;
+    case "dry_run":
+      process.stdout.write(`[dry-run] Would write: ${result.path}
+`);
+      break;
+  }
+}
+async function runScaffoldPublishWorkflowCommand(args) {
+  const firstArg = args[0];
+  if (firstArg === "help" || firstArg === "--help" || firstArg === "-h") {
+    printHelp();
+    process.exit(0);
+  }
+  const { flags, booleans } = parseFlagsFromArgs4(args);
+  const dryRun = booleans.has("dry-run");
+  const force = booleans.has("force");
+  const jsonOutput = booleans.has("json");
+  const projectDir = flags["project-dir"];
+  let result;
+  try {
+    result = await runScaffoldPublishWorkflow({ dryRun, force, projectDir });
+  } catch (err) {
+    process.stderr.write(
+      `scaffold-publish-workflow: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (jsonOutput) {
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return;
+  }
+  printHumanResult2(result);
+}
+var init_scaffold_publish_workflow2 = __esm({
+  "src/cli/scaffold-publish-workflow.ts"() {
     "use strict";
+    init_scaffold_publish_workflow();
   }
 });
 
-// src/lib/template-walker.ts
-import * as fs from "node:fs";
-import * as path2 from "node:path";
-function walkTemplates(templatesDir) {
-  const absRoot = fs.realpathSync(templatesDir);
-  const visited = /* @__PURE__ */ new Set();
-  const out = [];
-  const recurse = (absDir) => {
-    const realDir = fs.realpathSync(absDir);
-    if (visited.has(realDir)) {
-      return;
+// src/cli/resolve-worktree.ts
+var resolve_worktree_exports = {};
+__export(resolve_worktree_exports, {
+  ProcessExitSignal: () => ProcessExitSignal,
+  runResolveWorktree: () => runResolveWorktree
+});
+import { execSync as execSync5 } from "node:child_process";
+function distress(kind, message, jsonMode) {
+  if (jsonMode) return;
+  process.stderr.write(`resolve-worktree: ${kind}: ${message}
+`);
+}
+async function runResolveWorktree() {
+  const jsonMode = hasFlag("json", 3);
+  let errorContext = null;
+  const migrationNoticeCallback = (legacyPath, primaryPath) => {
+    if (!jsonMode) {
+      process.stderr.write(
+        `resolve-worktree: local_config_migration: ${legacyPath} is the legacy flat config; move device_id to ${primaryPath}
+`
+      );
     }
-    visited.add(realDir);
-    const entries = fs.readdirSync(absDir, { withFileTypes: true });
-    for (const entry of entries) {
-      const absPath = path2.join(absDir, entry.name);
-      if (entry.isDirectory()) {
-        recurse(absPath);
-        continue;
+  };
+  try {
+    const projectPath = process.cwd();
+    const found = await findCodebyplanConfig(projectPath);
+    if (!found?.contents.repo_id) {
+      emitAndExit(null, null, jsonMode);
+    }
+    const repoId = found.contents.repo_id;
+    try {
+      await readLocalConfig(projectPath);
+    } catch (readErr) {
+      const readErrCode = readErr.code;
+      errorContext = {
+        kind: readErrCode === "LEGACY_FILE_BLOCKS_DIR" ? "legacy_file_blocks_dir" : "local_config_read_failed",
+        message: readErr instanceof Error ? readErr.message : String(readErr)
+      };
+    }
+    let deviceId;
+    try {
+      deviceId = await getOrCreateDeviceId(
+        projectPath,
+        migrationNoticeCallback
+      );
+    } catch (deviceErr) {
+      const code = deviceErr.code;
+      if (code === "LEGACY_FILE_BLOCKS_DIR") {
+        errorContext = {
+          kind: "legacy_file_blocks_dir",
+          message: deviceErr instanceof Error ? deviceErr.message : String(deviceErr)
+        };
+      } else if (errorContext === null || errorContext.kind !== "local_config_read_failed" && errorContext.kind !== "legacy_file_blocks_dir") {
+        errorContext = {
+          kind: "local_config_write_failed",
+          message: deviceErr instanceof Error ? deviceErr.message : String(deviceErr)
+        };
       }
-      if (!entry.isFile()) {
-        continue;
+      emitAndExit(null, errorContext, jsonMode);
+    }
+    let branch = "";
+    try {
+      branch = execSync5("git symbolic-ref --short HEAD", {
+        cwd: projectPath,
+        encoding: "utf-8"
+      }).trim();
+    } catch (gitErr) {
+      if (errorContext === null) {
+        errorContext = {
+          kind: "git_failed",
+          message: gitErr instanceof Error ? gitErr.message : String(gitErr)
+        };
       }
-      if (entry.name === ".gitkeep") continue;
-      const relPosix = path2.relative(absRoot, absPath).split(path2.sep).join("/");
-      if (EXCLUDED_RELATIVE_PATHS.has(relPosix)) {
-        continue;
+    }
+    const onResolverError = (kind, err) => {
+      if (errorContext === null) {
+        errorContext = { kind, message: err.message };
       }
-      const content = fs.readFileSync(absPath);
-      out.push({
-        src: relPosix,
-        dest: relPosix,
-        hash: sha256(content)
+    };
+    const worktreeId = await resolveWorktreeId({
+      repoId,
+      repoPath: projectPath,
+      branch,
+      deviceId,
+      onError: onResolverError
+    });
+    if (worktreeId) {
+      emitAndExit(worktreeId, errorContext, jsonMode);
+    }
+    const useFallback = hasFlag("fallback-from-branch", 3);
+    if (useFallback) {
+      const fallbackId = await resolveWorktreeByBranch({
+        repoId,
+        deviceId,
+        branch,
+        onError: onResolverError
       });
+      if (fallbackId) {
+        emitAndExit(fallbackId, errorContext, jsonMode);
+      }
     }
-  };
-  recurse(absRoot);
-  out.sort((a, b) => a.src.localeCompare(b.src));
-  return out;
+    emitAndExit(null, errorContext, jsonMode);
+  } catch (err) {
+    if (err instanceof ProcessExitSignal) throw err;
+    const msg = err instanceof Error ? err.message : String(err);
+    errorContext = { kind: "unhandled", message: msg };
+    emitAndExit(null, errorContext, jsonMode);
+  }
 }
-var EXCLUDED_RELATIVE_PATHS;
-var init_template_walker = __esm({
-  "src/lib/template-walker.ts"() {
+function emitAndExit(worktreeId, errorContext, jsonMode) {
+  if (jsonMode) {
+    const errorKind = errorContext?.kind ?? (worktreeId === null ? "tuple_miss" : null);
+    process.stdout.write(
+      JSON.stringify({ worktree_id: worktreeId, error_kind: errorKind }) + "\n"
+    );
+  } else {
+    if (worktreeId !== null) {
+      process.stdout.write(worktreeId);
+    }
+    if (errorContext !== null) {
+      if (errorContext.kind !== "unhandled" || process.env.CODEBYPLAN_DEBUG === "1") {
+        distress(errorContext.kind, errorContext.message, jsonMode);
+      }
+    }
+  }
+  process.exit(0);
+}
+var ProcessExitSignal;
+var init_resolve_worktree2 = __esm({
+  "src/cli/resolve-worktree.ts"() {
     "use strict";
-    init_hash();
-    EXCLUDED_RELATIVE_PATHS = /* @__PURE__ */ new Set([
-      // Meta files
-      "hooks/hooks.json",
-      "hooks/README.md",
-      "rules/README.md",
-      "settings.project.base.json",
-      "settings.user.base.json",
-      // .gitignore — managed by ensureManagedGitignoreBlock; never copied into
-      // consuming projects' .claude/ tree (it would overwrite the project root
-      // .gitignore with a stale single-entry file).
-      ".gitignore",
-      // CBP-internal hooks — see templates/hooks/README.md "Hooks NOT included and why"
-      "hooks/validate-structure.sh",
-      "hooks/validate-structure-lib.sh",
-      "hooks/validate-structure-patterns.sh",
-      "hooks/validate-structure-templates.sh",
-      "hooks/validate-structure-scope.sh",
-      "hooks/validate-structure-lengths.sh",
-      "hooks/validate-structure-smoke.sh",
-      "hooks/validate-context-usage.sh",
-      "hooks/validate-git-commit.sh"
-    ]);
+    init_flags();
+    init_local_config();
+    init_resolve_worktree();
+    ProcessExitSignal = class extends Error {
+      code;
+      constructor(code) {
+        super(`process.exit(${code})`);
+        this.name = "ProcessExitSignal";
+        this.code = code;
+      }
+    };
   }
 });
 
-// src/lib/manifest.ts
-import * as fs2 from "node:fs";
-import * as os from "node:os";
-import * as path3 from "node:path";
-function manifestPath(projectDir) {
-  return path3.join(projectDir, ".claude", NEW_MANIFEST_FILENAME);
+// src/lib/migrate-local-config.ts
+import { mkdir as mkdir5, readFile as readFile14, unlink as unlink2, writeFile as writeFile11 } from "node:fs/promises";
+import { join as join19 } from "node:path";
+function legacySharedPath(projectPath) {
+  return join19(projectPath, ".codebyplan.json");
 }
-function midManifestPath(projectDir) {
-  return path3.join(projectDir, ".claude", MID_MANIFEST_FILENAME);
+function legacyLocalPath(projectPath) {
+  return join19(projectPath, ".codebyplan.local.json");
 }
-function oldManifestPath(projectDir) {
-  return path3.join(projectDir, ".claude", OLD_MANIFEST_FILENAME);
+function newDirPath(projectPath) {
+  return join19(projectPath, ".codebyplan");
 }
-function readManifest(projectDir) {
-  const newFile = manifestPath(projectDir);
-  if (fs2.existsSync(newFile)) {
-    const raw = fs2.readFileSync(newFile, "utf8");
-    return JSON.parse(raw);
-  }
-  const midFile = midManifestPath(projectDir);
-  if (fs2.existsSync(midFile)) {
-    const raw = fs2.readFileSync(midFile, "utf8");
-    return JSON.parse(raw);
-  }
-  const oldFile = oldManifestPath(projectDir);
-  if (fs2.existsSync(oldFile)) {
-    const raw = fs2.readFileSync(oldFile, "utf8");
-    return JSON.parse(raw);
-  }
-  return null;
+function sentinelPath(projectPath) {
+  return join19(projectPath, ".codebyplan", "repo.json");
 }
-function writeManifest(projectDir, manifest) {
-  const file = manifestPath(projectDir);
-  fs2.mkdirSync(path3.dirname(file), { recursive: true });
-  fs2.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-  const mid = midManifestPath(projectDir);
-  if (fs2.existsSync(mid)) {
-    fs2.rmSync(mid);
+async function statSafe(p) {
+  const { stat: stat2 } = await import("node:fs/promises");
+  try {
+    return await stat2(p);
+  } catch {
+    return null;
   }
-  const legacy = oldManifestPath(projectDir);
-  if (fs2.existsSync(legacy)) {
-    fs2.rmSync(legacy);
+}
+async function needsLocalMigration(projectPath) {
+  try {
+    const legacyStat = await statSafe(legacySharedPath(projectPath));
+    if (!legacyStat) return false;
+    const sentinelStat = await statSafe(sentinelPath(projectPath));
+    if (sentinelStat) return false;
+    return true;
+  } catch {
+    return false;
   }
 }
-function defaultManifest() {
-  return {
-    version: VERSION,
-    installed_at: (/* @__PURE__ */ new Date()).toISOString(),
-    files: []
-  };
-}
-function userManifestPath(userDir) {
-  const dir = userDir ?? path3.join(os.homedir(), ".claude");
-  return path3.join(dir, NEW_MANIFEST_FILENAME);
-}
-function userMidManifestPath(userDir) {
-  const dir = userDir ?? path3.join(os.homedir(), ".claude");
-  return path3.join(dir, MID_MANIFEST_FILENAME);
-}
-function userOldManifestPath(userDir) {
-  const dir = userDir ?? path3.join(os.homedir(), ".claude");
-  return path3.join(dir, OLD_MANIFEST_FILENAME);
-}
-function readManifestForScope(scope, arg2) {
-  if (scope === "user") {
-    const newFile = userManifestPath(arg2);
-    if (fs2.existsSync(newFile)) {
-      const raw = fs2.readFileSync(newFile, "utf8");
-      return JSON.parse(raw);
-    }
-    const midFile = userMidManifestPath(arg2);
-    if (fs2.existsSync(midFile)) {
-      const raw = fs2.readFileSync(midFile, "utf8");
-      return JSON.parse(raw);
+async function runLocalMigration(projectPath) {
+  const dirStat = await statSafe(newDirPath(projectPath));
+  if (dirStat && !dirStat.isDirectory()) {
+    throw new Error(
+      ".codebyplan exists as a file; remove or rename it before migrating."
+    );
+  }
+  const sentinel = await statSafe(sentinelPath(projectPath));
+  if (sentinel) {
+    return {
+      migrated: true,
+      was_dirty: false,
+      files_changed: [],
+      summary: "already on new layout"
+    };
+  }
+  let legacyRaw;
+  try {
+    legacyRaw = await readFile14(legacySharedPath(projectPath), "utf-8");
+  } catch {
+    return {
+      migrated: true,
+      was_dirty: false,
+      files_changed: [],
+      summary: "legacy .codebyplan.json absent; nothing to migrate"
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(legacyRaw);
+  } catch (err) {
+    const inner = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `.codebyplan.json contains invalid JSON \u2014 cannot migrate: ${inner}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(
+      ".codebyplan.json does not contain a JSON object \u2014 cannot migrate"
+    );
+  }
+  const cfg = parsed;
+  let deviceId;
+  let deviceWrittenByHelper = false;
+  try {
+    const localRaw = await readFile14(legacyLocalPath(projectPath), "utf-8");
+    const localParsed = JSON.parse(localRaw);
+    if (typeof localParsed.device_id === "string") {
+      deviceId = localParsed.device_id;
     }
-    const oldFile = userOldManifestPath(arg2);
-    if (fs2.existsSync(oldFile)) {
-      const raw = fs2.readFileSync(oldFile, "utf8");
-      return JSON.parse(raw);
+  } catch {
+  }
+  try {
+    await mkdir5(newDirPath(projectPath), { recursive: true });
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOTDIR" || code === "EEXIST") {
+      throw new Error(
+        ".codebyplan exists as a file; remove or rename it before migrating."
+      );
     }
-    return null;
+    throw err;
   }
-  return readManifest(arg2);
-}
-function writeManifestForScope(scope, manifest, arg3) {
-  if (scope === "user") {
-    const file = userManifestPath(arg3);
-    fs2.mkdirSync(path3.dirname(file), { recursive: true });
-    fs2.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-    const mid = userMidManifestPath(arg3);
-    if (fs2.existsSync(mid)) {
-      fs2.rmSync(mid);
+  if (!deviceId) {
+    deviceId = await getOrCreateDeviceId(projectPath);
+    deviceWrittenByHelper = true;
+  }
+  const filesChanged = [];
+  const repoJson = {};
+  if ("repo_id" in cfg) repoJson.repo_id = cfg.repo_id;
+  if ("organization_id" in cfg) repoJson.organization_id = cfg.organization_id;
+  if ("project_id" in cfg) repoJson.project_id = cfg.project_id;
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "repo.json"),
+    JSON.stringify(repoJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/repo.json");
+  const serverJson = {};
+  if ("server_port" in cfg) serverJson.server_port = cfg.server_port;
+  if ("server_type" in cfg) serverJson.server_type = cfg.server_type;
+  if ("auto_push_enabled" in cfg)
+    serverJson.auto_push_enabled = cfg.auto_push_enabled;
+  if ("port_allocations" in cfg)
+    serverJson.port_allocations = cfg.port_allocations;
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "server.json"),
+    JSON.stringify(serverJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/server.json");
+  const gitJson = {};
+  if ("git_branch" in cfg) gitJson.git_branch = cfg.git_branch;
+  if ("branch_config" in cfg) gitJson.branch_config = cfg.branch_config;
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "git.json"),
+    JSON.stringify(gitJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/git.json");
+  const shipmentJson = {};
+  if ("shipment" in cfg) shipmentJson.shipment = cfg.shipment;
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "shipment.json"),
+    JSON.stringify(shipmentJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/shipment.json");
+  const vendorJson = {};
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "vendor.json"),
+    JSON.stringify(vendorJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/vendor.json");
+  const e2eJson = {};
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "e2e.json"),
+    JSON.stringify(e2eJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/e2e.json");
+  const eslintJson = {};
+  await writeFile11(
+    join19(projectPath, ".codebyplan", "eslint.json"),
+    JSON.stringify(eslintJson, null, 2) + "\n",
+    "utf-8"
+  );
+  filesChanged.push(".codebyplan/eslint.json");
+  if (!deviceWrittenByHelper) {
+    await writeFile11(
+      join19(projectPath, ".codebyplan", "device.local.json"),
+      JSON.stringify({ device_id: deviceId }, null, 2) + "\n",
+      "utf-8"
+    );
+  }
+  filesChanged.push(".codebyplan/device.local.json");
+  const writtenSentinel = await statSafe(sentinelPath(projectPath));
+  if (!writtenSentinel) {
+    throw new Error(
+      "Migration write incomplete: .codebyplan/repo.json was not persisted. Re-run migration to retry from a clean state."
+    );
+  }
+  const gitignorePath = join19(projectPath, ".gitignore");
+  try {
+    const gitignoreContent = await readFile14(gitignorePath, "utf-8");
+    const legacyLine = ".codebyplan.local.json";
+    const newLine = ".codebyplan/device.local.json";
+    const hasLegacy = gitignoreContent.split("\n").some((l) => l.trimEnd() === legacyLine);
+    const hasNew = gitignoreContent.split("\n").some((l) => l.trimEnd() === newLine);
+    let updated;
+    if (hasLegacy && !hasNew) {
+      updated = gitignoreContent.split("\n").map((l) => {
+        const stripped = l.trimEnd();
+        return stripped === legacyLine ? newLine + (l.endsWith("\r") ? "\r" : "") : l;
+      }).join("\n");
+    } else if (hasLegacy && hasNew) {
+      updated = gitignoreContent.split("\n").filter((l) => l.trimEnd() !== legacyLine).join("\n");
+    } else if (!hasLegacy && !hasNew) {
+      updated = gitignoreContent.endsWith("\n") ? gitignoreContent + newLine + "\n" : gitignoreContent + "\n" + newLine + "\n";
+    } else {
+      updated = gitignoreContent;
     }
-    const legacy = userOldManifestPath(arg3);
-    if (fs2.existsSync(legacy)) {
-      fs2.rmSync(legacy);
+    if (updated !== gitignoreContent) {
+      await writeFile11(gitignorePath, updated, "utf-8");
+      filesChanged.push(".gitignore");
     }
-    return;
+  } catch {
   }
-  writeManifest(arg3, manifest);
+  try {
+    await unlink2(legacySharedPath(projectPath));
+    filesChanged.push(".codebyplan.json (deleted)");
+  } catch {
+  }
+  try {
+    await unlink2(legacyLocalPath(projectPath));
+    filesChanged.push(".codebyplan.local.json (deleted)");
+  } catch {
+  }
+  return {
+    migrated: true,
+    was_dirty: true,
+    files_changed: filesChanged,
+    summary: `migrated legacy .codebyplan.json to .codebyplan/ layout (device_id=${deviceId.slice(0, 8)})`
+  };
 }
-var NEW_MANIFEST_FILENAME, MID_MANIFEST_FILENAME, OLD_MANIFEST_FILENAME;
-var init_manifest = __esm({
-  "src/lib/manifest.ts"() {
+var init_migrate_local_config = __esm({
+  "src/lib/migrate-local-config.ts"() {
     "use strict";
-    init_version();
-    NEW_MANIFEST_FILENAME = ".cbp.manifest.json";
-    MID_MANIFEST_FILENAME = ".cbp-claude.manifest.json";
-    OLD_MANIFEST_FILENAME = ".codebyplan-claude.manifest.json";
+    init_local_config();
   }
 });
 
-// src/lib/settings-merge.ts
-function extractHookId(command) {
-  const match = /([^\s/]+\.sh)(?:\s|$)/.exec(command);
-  const id = match?.[1];
-  if (!id) {
-    throw new Error(
-      `Cannot derive _hook_id from command (no .sh script segment): ${command}`
+// src/cli/config.ts
+var config_exports = {};
+__export(config_exports, {
+  readE2eConfig: () => readE2eConfig,
+  readGitConfig: () => readGitConfig,
+  readRepoConfig: () => readRepoConfig,
+  readServerConfig: () => readServerConfig,
+  readShipmentConfig: () => readShipmentConfig,
+  readVendorConfig: () => readVendorConfig,
+  runConfig: () => runConfig
+});
+import { mkdir as mkdir6, readFile as readFile15, writeFile as writeFile12 } from "node:fs/promises";
+import { join as join20 } from "node:path";
+async function runConfig() {
+  const flags = parseFlags(3);
+  const dryRun = hasFlag("dry-run", 3);
+  validateApiKey();
+  const config = await resolveConfig(flags);
+  const { repoId, projectPath } = config;
+  console.log(`
+  CodeByPlan Config`);
+  console.log(`  Repo: ${repoId}`);
+  console.log(`  Path: ${projectPath}`);
+  if (dryRun) console.log(`  Mode: dry-run`);
+  console.log();
+  if (!dryRun && await needsLocalMigration(projectPath)) {
+    console.log(
+      "  Migrating legacy .codebyplan.json to .codebyplan/ layout..."
     );
+    try {
+      const result = await runLocalMigration(projectPath);
+      if (result.was_dirty) {
+        console.log("  Migration complete.");
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(
+        `  Warning: migration failed (${msg}); continuing with config sync.`
+      );
+    }
   }
-  return id;
-}
-function rewriteCommand(command) {
-  return command.replace(PLACEHOLDER_RE, REPLACEMENT);
+  await syncConfigToFile(repoId, projectPath, dryRun);
+  console.log("\n  Config complete.\n");
 }
-function mergeHooksIntoSettings(settings, hooksJson) {
-  if (!settings.hooks) {
-    settings.hooks = {};
-  }
-  const target = settings.hooks;
-  for (const [event, sourceMatchers] of Object.entries(hooksJson.hooks)) {
-    if (!target[event]) {
-      target[event] = [];
+async function syncConfigToFile(repoId, projectPath, dryRun) {
+  const codebyplanDir = join20(projectPath, ".codebyplan");
+  let resolvedWorktreeId;
+  try {
+    const deviceId = await getOrCreateDeviceId(projectPath);
+    let branch = "main";
+    try {
+      const { execSync: execSync6 } = await import("node:child_process");
+      branch = execSync6("git symbolic-ref --short HEAD", {
+        cwd: projectPath,
+        encoding: "utf-8"
+      }).trim();
+    } catch {
     }
-    const eventBlocks = target[event];
-    for (const sourceBlock of sourceMatchers) {
-      let destBlock = eventBlocks.find(
-        (b) => b.matcher === sourceBlock.matcher
-      );
-      if (!destBlock) {
-        destBlock = { matcher: sourceBlock.matcher, hooks: [] };
-        eventBlocks.push(destBlock);
+    const tupleId = await resolveWorktreeId({
+      repoId,
+      repoPath: projectPath,
+      branch,
+      deviceId
+    });
+    if (tupleId) {
+      resolvedWorktreeId = tupleId;
+    } else {
+      resolvedWorktreeId = await resolveAndCacheWorktreeId(repoId, projectPath) ?? void 0;
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `  Warning: failed to cache worktree_id (self-heal skipped): ${msg}`
+    );
+  }
+  let repoRes;
+  try {
+    repoRes = await apiGet(`/repos/${repoId}`);
+  } catch (err) {
+    let message;
+    if (err instanceof ApiError) {
+      if (err.status === 401) {
+        message = "Session expired. Run `codebyplan login` and try again.";
+      } else if (err.status === 403 || err.status === 404) {
+        message = "Repo not found or not accessible to your account. Confirm the repo_id in .codebyplan/repo.json and that you are logged in as the right user.";
+      } else if (err.status >= 500) {
+        message = `CodeByPlan server error (status ${err.status}). Please try again shortly.`;
+      } else {
+        message = `Unexpected API error (status ${err.status}). Please try again.`;
       }
-      for (const sourceCmd of sourceBlock.hooks) {
-        const taggedEntry = {
-          _owner: OWNER,
-          _hook_id: extractHookId(sourceCmd.command),
-          type: sourceCmd.type,
-          command: rewriteCommand(sourceCmd.command)
-        };
-        const existingIdx = destBlock.hooks.findIndex(
-          (e) => e._owner === OWNER && e._hook_id === taggedEntry._hook_id
-        );
-        if (existingIdx >= 0) {
-          destBlock.hooks[existingIdx] = taggedEntry;
-        } else {
-          destBlock.hooks.push(taggedEntry);
-        }
+    } else {
+      message = "Failed to reach the CodeByPlan API. Check your network connection and try again.";
+    }
+    process.stderr.write(message + "\n");
+    process.exit(1);
+  }
+  const repo = repoRes.data;
+  let portAllocations = [];
+  try {
+    const portsRes = await apiGet(
+      `/port-allocations`,
+      { repo_id: repoId }
+    );
+    const allAllocations = portsRes.data ?? [];
+    const filtered = resolvedWorktreeId ? allAllocations.filter((a) => a.worktree_id === resolvedWorktreeId) : allAllocations.filter((a) => !a.worktree_id);
+    const ALLOWED_FIELDS = [
+      "id",
+      "repo_id",
+      "port",
+      "label",
+      "server_type",
+      "auto_start",
+      "command",
+      "working_dir",
+      "env_vars",
+      "external_refs",
+      "worktree_id",
+      "created_at",
+      "updated_at"
+    ];
+    portAllocations = filtered.map((a) => {
+      const clean = {};
+      for (const key of ALLOWED_FIELDS) {
+        if (key in a) clean[key] = a[key];
       }
+      return clean;
+    });
+  } catch (err) {
+    console.warn(
+      `  Warning: failed to fetch port allocations: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const matchingAlloc = portAllocations[0];
+  const defaultBranchConfig = {
+    protected: ["main"],
+    integration: null,
+    production: "main",
+    staging: null
+  };
+  const branchConfig = repo.branch_config ?? defaultBranchConfig;
+  if (!legacyBranchConfigWarned && typeof branchConfig["integration"] === "string") {
+    legacyBranchConfigWarned = true;
+    process.stderr.write(
+      `warning: legacy 3-branch branch_config detected (integration: '${String(branchConfig["integration"])}'). Run 'npx codebyplan branch migrate' to consolidate to main-only.
+`
+    );
+  }
+  const repoPayload = { repo_id: repoId };
+  const repoAny = repo;
+  if (typeof repoAny.organization_id === "string") {
+    repoPayload.organization_id = repoAny.organization_id;
+  }
+  if (typeof repoAny.project_id === "string") {
+    repoPayload.project_id = repoAny.project_id;
+  }
+  const serverPayload = {
+    server_port: resolvedWorktreeId && matchingAlloc ? matchingAlloc.port : repo.server_port,
+    server_type: resolvedWorktreeId && matchingAlloc ? matchingAlloc.server_type : repo.server_type,
+    auto_push_enabled: repo.auto_push_enabled,
+    port_allocations: portAllocations
+  };
+  const gitPayload = {
+    git_branch: repo.git_branch ?? "main",
+    branch_config: branchConfig
+  };
+  const shipmentPayload = {};
+  if (typeof repoAny.shipment !== "undefined") {
+    shipmentPayload.shipment = repoAny.shipment;
+  }
+  const vendorPayload = {};
+  const e2ePayload = {};
+  const eslintPayload = {};
+  if (dryRun) {
+    console.log("  Config would be updated (dry-run).");
+    return;
+  }
+  await mkdir6(codebyplanDir, { recursive: true });
+  const files = [
+    { name: "repo.json", payload: repoPayload },
+    { name: "server.json", payload: serverPayload },
+    { name: "git.json", payload: gitPayload },
+    { name: "shipment.json", payload: shipmentPayload },
+    { name: "vendor.json", payload: vendorPayload },
+    { name: "e2e.json", payload: e2ePayload, createOnly: true },
+    { name: "eslint.json", payload: eslintPayload, createOnly: true }
+  ];
+  let anyUpdated = false;
+  for (const { name, payload, createOnly } of files) {
+    const filePath = join20(codebyplanDir, name);
+    const newJson = JSON.stringify(payload, null, 2) + "\n";
+    let currentJson = "";
+    try {
+      currentJson = await readFile15(filePath, "utf-8");
+    } catch {
     }
+    if (createOnly && currentJson !== "") continue;
+    if (currentJson === newJson) continue;
+    await writeFile12(filePath, newJson, "utf-8");
+    console.log(`  Updated .codebyplan/${name}`);
+    anyUpdated = true;
+  }
+  if (!anyUpdated) {
+    console.log("  Config up to date.");
+  }
+}
+async function readRepoConfig(projectPath) {
+  try {
+    const raw = await readFile15(
+      join20(projectPath, ".codebyplan", "repo.json"),
+      "utf-8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readServerConfig(projectPath) {
+  try {
+    const raw = await readFile15(
+      join20(projectPath, ".codebyplan", "server.json"),
+      "utf-8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readGitConfig(projectPath) {
+  try {
+    const raw = await readFile15(
+      join20(projectPath, ".codebyplan", "git.json"),
+      "utf-8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
-  return settings;
 }
-function mergeBaseSettingsIntoSettings(settings, base) {
-  for (const key of SCALAR_BASE_KEYS) {
-    if (base[key] !== void 0 && settings[key] === void 0) {
-      settings[key] = base[key];
-    }
+async function readShipmentConfig(projectPath) {
+  try {
+    const raw = await readFile15(
+      join20(projectPath, ".codebyplan", "shipment.json"),
+      "utf-8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
-  if (base.statusLine !== void 0 && settings.statusLine === void 0) {
-    settings.statusLine = { ...base.statusLine };
+}
+async function readVendorConfig(projectPath) {
+  try {
+    const raw = await readFile15(
+      join20(projectPath, ".codebyplan", "vendor.json"),
+      "utf-8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
-  if (base.subagentStatusLine !== void 0 && settings.subagentStatusLine === void 0) {
-    settings.subagentStatusLine = { ...base.subagentStatusLine };
+}
+async function readE2eConfig(projectPath) {
+  try {
+    const raw = await readFile15(
+      join20(projectPath, ".codebyplan", "e2e.json"),
+      "utf-8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
-  if (base.attribution !== void 0 && settings.attribution === void 0) {
-    settings.attribution = { ...base.attribution };
+}
+var legacyBranchConfigWarned;
+var init_config = __esm({
+  "src/cli/config.ts"() {
+    "use strict";
+    init_flags();
+    init_api();
+    init_resolve_worktree();
+    init_local_config();
+    init_migrate_local_config();
+    legacyBranchConfigWarned = false;
   }
-  if (base.worktree !== void 0) {
-    if (settings.worktree === void 0) {
-      settings.worktree = { ...base.worktree };
-    } else {
-      const sw = settings.worktree;
-      for (const [k, v] of Object.entries(base.worktree)) {
-        if (sw[k] === void 0) {
-          sw[k] = v;
-        }
+});
+
+// src/lib/server-detect.ts
+function detectFramework(pkg) {
+  const deps = pkg.dependencies ?? {};
+  const devDeps = pkg.devDependencies ?? {};
+  const hasDep = (name) => name in deps || name in devDeps;
+  if (hasDep("next")) return "nextjs";
+  if (hasDep("@tauri-apps/api") || hasDep("@tauri-apps/cli")) return "tauri";
+  if (hasDep("expo")) return "expo";
+  if (hasDep("vite")) return "vite";
+  if (hasDep("express")) return "express";
+  if (hasDep("@nestjs/core")) return "nestjs";
+  return "custom";
+}
+function detectPortFromScripts(pkg) {
+  const scripts = pkg.scripts;
+  if (!scripts?.dev) return null;
+  const parts = scripts.dev.split(/\s+/);
+  for (let i = 0; i < parts.length - 1; i++) {
+    if (parts[i] === "--port" || parts[i] === "-p") {
+      const next = parts[i + 1];
+      if (next) {
+        const port = parseInt(next, 10);
+        if (!isNaN(port)) return port;
       }
     }
   }
-  if (base.permissions !== void 0) {
-    const existing = settings.permissions ?? {};
-    if (base.permissions.defaultMode !== void 0 && existing.defaultMode === void 0) {
-      existing.defaultMode = base.permissions.defaultMode;
-    }
-    if (base.permissions.skipDangerousModePermissionPrompt !== void 0 && existing.skipDangerousModePermissionPrompt === void 0) {
-      existing.skipDangerousModePermissionPrompt = base.permissions.skipDangerousModePermissionPrompt;
-    }
-    for (const key of ["deny", "ask", "allow"]) {
-      const incoming = base.permissions[key];
-      if (!incoming || incoming.length === 0) continue;
-      const current = existing[key] ?? [];
-      const seen = new Set(current);
-      const merged = [...current];
-      for (const item of incoming) {
-        if (!seen.has(item)) {
-          merged.push(item);
-          seen.add(item);
-        }
+  return null;
+}
+var init_server_detect = __esm({
+  "src/lib/server-detect.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/port-verify.ts
+import { readFile as readFile16 } from "node:fs/promises";
+async function verifyPorts(projectPath, portAllocations) {
+  const mismatches = [];
+  const allocatedPorts = new Set(portAllocations.map((a) => a.port));
+  const packageJsonPaths = await findPackageJsonFiles(projectPath, projectPath);
+  for (const pkgPath of packageJsonPaths) {
+    try {
+      const raw = await readFile16(pkgPath, "utf-8");
+      const pkg = JSON.parse(raw);
+      const scriptPort = detectPortFromScripts(pkg);
+      if (scriptPort !== null && !allocatedPorts.has(scriptPort)) {
+        const relativePath = pkgPath.replace(projectPath + "/", "");
+        const matchingAlloc = portAllocations.find(
+          (a) => a.label === getAppLabel(relativePath)
+        );
+        mismatches.push({
+          packageJsonPath: relativePath,
+          scriptPort,
+          allocation: matchingAlloc ?? null,
+          reason: matchingAlloc ? `Script uses port ${scriptPort} but allocation has port ${matchingAlloc.port}` : `Port ${scriptPort} in scripts is not in any allocation`
+        });
       }
-      existing[key] = merged;
-    }
-    if (settings.permissions !== void 0 || Object.keys(existing).length > 0) {
-      settings.permissions = existing;
+    } catch {
     }
   }
-  return settings;
+  return mismatches;
 }
-function stripBaseSettingsFromSettings(settings, base) {
-  for (const key of SCALAR_BASE_KEYS) {
-    if (base[key] !== void 0 && settings[key] === base[key]) {
-      delete settings[key];
-    }
-  }
-  if (base.statusLine !== void 0 && settings.statusLine !== void 0 && JSON.stringify(settings.statusLine) === JSON.stringify(base.statusLine)) {
-    delete settings.statusLine;
-  }
-  if (base.subagentStatusLine !== void 0 && settings.subagentStatusLine !== void 0 && JSON.stringify(settings.subagentStatusLine) === JSON.stringify(base.subagentStatusLine)) {
-    delete settings.subagentStatusLine;
+function isDevServerScript(pkg) {
+  const scripts = pkg.scripts;
+  const raw = scripts?.dev;
+  if (!raw || typeof raw !== "string") return false;
+  const script = raw.trim().toLowerCase();
+  if (!script) return false;
+  for (const pattern of DEV_SERVER_BIN_PATTERNS) {
+    if (pattern.test(script)) return true;
   }
-  if (base.attribution !== void 0 && settings.attribution !== void 0 && JSON.stringify(settings.attribution) === JSON.stringify(base.attribution)) {
-    delete settings.attribution;
+  const tokens = script.split(/\s+/);
+  for (const token of tokens) {
+    if (token === "--port" || token === "-p") return true;
+    if (token.startsWith("--port=")) return true;
   }
-  if (base.worktree !== void 0 && settings.worktree !== void 0) {
-    const sw = settings.worktree;
-    for (const [k, v] of Object.entries(base.worktree)) {
-      if (sw[k] === v) {
-        delete sw[k];
-      }
-    }
-    if (Object.keys(sw).length === 0) {
-      delete settings.worktree;
-    }
+  return false;
+}
+function labelMatchesAppName(label, appName) {
+  if (!label || !appName) return false;
+  const normalize = (s) => s.toLowerCase().replace(/-/g, " ").replace(/[()]/g, " ").replace(/\s+/g, " ").trim();
+  const labelTokens = normalize(label).split(" ").filter(Boolean);
+  const appToken = normalize(appName);
+  if (!appToken) return false;
+  const appTokens = appToken.split(" ").filter(Boolean);
+  if (appTokens.length === 1) {
+    return labelTokens.includes(appTokens[0]);
   }
-  if (base.permissions !== void 0 && settings.permissions !== void 0) {
-    const perms = settings.permissions;
-    if (base.permissions.defaultMode !== void 0 && perms.defaultMode === base.permissions.defaultMode) {
-      delete perms.defaultMode;
-    }
-    if (base.permissions.skipDangerousModePermissionPrompt !== void 0 && perms.skipDangerousModePermissionPrompt === base.permissions.skipDangerousModePermissionPrompt) {
-      delete perms.skipDangerousModePermissionPrompt;
-    }
-    for (const key of ["deny", "ask", "allow"]) {
-      const baseList = base.permissions[key];
-      if (!baseList || baseList.length === 0) continue;
-      const current = perms[key];
-      if (!current) continue;
-      const baseSet = new Set(baseList);
-      const filtered = current.filter((x) => !baseSet.has(x));
-      if (filtered.length === 0) {
-        delete perms[key];
-      } else {
-        perms[key] = filtered;
-      }
-    }
-    if (Object.keys(perms).length === 0) {
-      delete settings.permissions;
-    }
+  for (let i = 0; i <= labelTokens.length - appTokens.length; i++) {
+    if (appTokens.every((t, j) => labelTokens[i + j] === t)) return true;
   }
-  return settings;
+  return false;
 }
-function stripOwnedHooksFromSettings(settings) {
-  if (!settings.hooks) {
-    return settings;
+async function findUnallocatedApps(projectPath, portAllocations) {
+  const apps = await discoverMonorepoApps(projectPath);
+  if (apps.length === 0) {
+    return [];
   }
-  for (const event of Object.keys(settings.hooks)) {
-    const eventBlocks = settings.hooks[event];
-    if (!eventBlocks) {
+  const unallocated = [];
+  for (const app of apps) {
+    if (portAllocations.some((a) => labelMatchesAppName(a.label ?? "", app.name))) {
       continue;
     }
-    const survivingBlocks = [];
-    for (const block of eventBlocks) {
-      block.hooks = block.hooks.filter((e) => e._owner !== OWNER);
-      if (block.hooks.length > 0) {
-        survivingBlocks.push(block);
-      }
-    }
-    if (survivingBlocks.length > 0) {
-      settings.hooks[event] = survivingBlocks;
-    } else {
-      delete settings.hooks[event];
+    let pkg;
+    try {
+      const raw = await readFile16(`${app.absPath}/package.json`, "utf-8");
+      pkg = JSON.parse(raw);
+    } catch {
+      continue;
     }
+    if (!isDevServerScript(pkg)) continue;
+    const framework = detectFramework(pkg);
+    const detectedPort = detectPortFromScripts(pkg);
+    const command = `pnpm --filter ${app.name} dev`;
+    unallocated.push({
+      name: app.name,
+      path: app.path,
+      framework,
+      detectedPort,
+      command
+    });
   }
-  if (Object.keys(settings.hooks).length === 0) {
-    delete settings.hooks;
+  return unallocated;
+}
+function getAppLabel(relativePath) {
+  const parts = relativePath.split("/");
+  if (parts.length >= 3 && parts[0] === "apps") {
+    return parts[1];
   }
-  return settings;
+  return "root";
 }
-var OWNER, PLACEHOLDER_RE, REPLACEMENT, SCALAR_BASE_KEYS;
-var init_settings_merge = __esm({
-  "src/lib/settings-merge.ts"() {
+var DEV_SERVER_BIN_PATTERNS;
+var init_port_verify = __esm({
+  "src/lib/port-verify.ts"() {
     "use strict";
-    OWNER = "codebyplan-claude";
-    PLACEHOLDER_RE = /\$\{CLAUDE_PLUGIN_ROOT\}\/hooks\//g;
-    REPLACEMENT = "./.claude/hooks/";
-    SCALAR_BASE_KEYS = [
-      "alwaysThinkingEnabled",
-      "autoUpdatesChannel",
-      "awaySummaryEnabled",
-      "disableAgentView",
-      "disableRemoteControl",
-      "editorMode",
-      "outputStyle",
-      "preferredNotifChannel",
-      "prefersReducedMotion",
-      "respectGitignore",
-      "showTurnDuration",
-      "spinnerTipsEnabled",
-      "terminalProgressBarEnabled",
-      "viewMode",
-      "autoScrollEnabled",
-      "cleanupPeriodDays",
-      "includeGitInstructions",
-      "showThinkingSummaries",
-      "disableSkillShellExecution",
-      "skipWebFetchPreflight",
-      "fastModePerSessionOptIn",
-      "effortLevel",
-      "showClearContextOnPlanAccept",
-      "syntaxHighlightingDisabled"
+    init_tech_detect();
+    init_server_detect();
+    DEV_SERVER_BIN_PATTERNS = [
+      /\bnext\s+dev\b/,
+      /\bnest\s+start\b/,
+      /\bvite\s+(?:dev|serve)\b/,
+      /\bvite\s+preview\b/,
+      /\bnuxt\s+dev\b/,
+      /\b(?:svelte-kit|sveltekit)\s+dev\b/,
+      /\bexpo\s+start\b/
     ];
   }
 });
 
-// src/cli/claude/install.ts
-var install_exports = {};
-__export(install_exports, {
-  resolveTemplatesDir: () => resolveTemplatesDir,
-  runInstall: () => runInstall
+// src/cli/ports.ts
+var ports_exports = {};
+__export(ports_exports, {
+  runPorts: () => runPorts
 });
-import * as fs3 from "node:fs";
-import * as os2 from "node:os";
-import * as path4 from "node:path";
-import { fileURLToPath } from "node:url";
-function resolveTemplatesDir() {
-  const here = path4.dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    path4.resolve(here, "..", "templates"),
-    path4.resolve(here, "..", "..", "templates"),
-    path4.resolve(here, "..", "..", "..", "templates")
-  ];
-  for (const c of candidates) {
-    if (fs3.existsSync(c) && fs3.statSync(c).isDirectory()) {
-      return c;
-    }
-  }
-  throw new Error(
-    `codebyplan: could not locate templates/ directory. Probed:
-  ${candidates.join(
-      "\n  "
-    )}`
-  );
-}
-async function runInstall(opts, deps = {}) {
-  await Promise.resolve();
-  const scope = opts.scope ?? "project";
-  if (scope === "user") {
-    if (opts.renderer) {
-      console.warn(
-        "codebyplan claude install: --bash/--node/--python is ignored for --scope user (no project root for statusline.local.json)."
-      );
-    }
-    runInstallUser(opts, deps);
-    return;
-  }
-  const projectDir = deps.projectDir ?? process.cwd();
-  let templatesDir;
+async function runPorts() {
+  const flags = parseFlags(3);
+  const dryRun = hasFlag("dry-run", 3);
+  const fix = hasFlag("fix", 3);
+  validateApiKey();
+  const config = await resolveConfig(flags);
+  const { repoId, projectPath } = config;
+  console.log(`
+  CodeByPlan Ports`);
+  console.log(`  Repo: ${repoId}`);
+  console.log(`  Path: ${projectPath}`);
+  if (dryRun) console.log(`  Mode: dry-run`);
+  if (fix) console.log(`  Mode: fix`);
+  console.log();
   try {
-    templatesDir = deps.templatesDir ?? resolveTemplatesDir();
-  } catch (err) {
-    console.error(
-      err instanceof Error ? err.message : `codebyplan claude install: ${String(err)}`
+    const portsRes = await apiGet(
+      `/port-allocations`,
+      { repo_id: repoId }
     );
-    process.exitCode = 1;
-    return;
-  }
-  try {
-    const files = walkTemplates(templatesDir);
-    const manifestEntries = [];
-    for (const f of files) {
-      const absDest = path4.join(projectDir, ".claude", f.dest);
-      const absSrc = path4.join(templatesDir, f.src);
-      if (opts.dryRun) {
-        if (opts.verbose) {
-          console.log(`[dry-run] would copy ${f.src} \u2192 .claude/${f.dest}`);
-        }
-      } else {
-        fs3.mkdirSync(path4.dirname(absDest), { recursive: true });
-        fs3.copyFileSync(absSrc, absDest);
-        if (opts.verbose) {
-          console.log(`copied ${f.src} \u2192 .claude/${f.dest}`);
-        }
+    const allocations = portsRes.data ?? [];
+    if (allocations.length === 0) {
+      console.log("  No port allocations found \u2014 skipping verification.");
+      console.log("\n  Ports complete.\n");
+      return;
+    }
+    const mismatches = await verifyPorts(projectPath, allocations);
+    if (mismatches.length > 0) {
+      console.log(`  Port mismatches: ${mismatches.length}`);
+      for (const m of mismatches) {
+        console.log(`    ! ${m.packageJsonPath}: ${m.reason}`);
       }
-      manifestEntries.push({ src: f.src, dest: f.dest, hash: f.hash });
     }
-    const hooksJsonPath = path4.join(templatesDir, "hooks", "hooks.json");
-    const baseSettingsPath = path4.join(
-      templatesDir,
-      "settings.project.base.json"
-    );
-    const hasHooks = fs3.existsSync(hooksJsonPath);
-    const hasBase = fs3.existsSync(baseSettingsPath);
-    if (hasHooks || hasBase) {
-      const settingsPath = path4.join(projectDir, ".claude", "settings.json");
-      const existingSettings = fs3.existsSync(settingsPath) ? JSON.parse(fs3.readFileSync(settingsPath, "utf8")) : {};
-      if (hasBase) {
-        const base = JSON.parse(
-          fs3.readFileSync(baseSettingsPath, "utf8")
+    const unallocated = await findUnallocatedApps(projectPath, allocations);
+    if (unallocated.length > 0) {
+      console.log(`  Unallocated apps: ${unallocated.length}`);
+      for (const app of unallocated) {
+        console.log(
+          `    + ${app.name} (${app.framework}${app.detectedPort ? `, port ${app.detectedPort}` : ""})`
         );
-        mergeBaseSettingsIntoSettings(existingSettings, base);
       }
-      if (hasHooks) {
-        const hooksJson = JSON.parse(
-          fs3.readFileSync(hooksJsonPath, "utf8")
-        );
-        mergeHooksIntoSettings(existingSettings, hooksJson);
+      if (fix && !dryRun) {
+        const maxPort = Math.max(...allocations.map((a) => a.port), 2999);
+        let nextPort = maxPort + 1;
+        for (const app of unallocated) {
+          const port = app.detectedPort ?? nextPort++;
+          try {
+            await apiPost("/port-allocations", {
+              repo_id: repoId,
+              port,
+              label: app.name,
+              server_type: app.framework,
+              auto_start: "manual",
+              command: app.command,
+              working_dir: app.path
+            });
+            console.log(`    Created allocation: ${app.name} \u2192 port ${port}`);
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.log(
+              `    Failed to create allocation for ${app.name}: ${msg}`
+            );
+          }
+          if (app.detectedPort && app.detectedPort >= nextPort) {
+            nextPort = app.detectedPort + 1;
+          }
+        }
+      } else if (fix && dryRun) {
+        console.log("  (dry-run \u2014 would create allocations with --fix)");
+      } else {
+        console.log("  Run with --fix to auto-create allocations.");
       }
-      if (!opts.dryRun) {
-        fs3.mkdirSync(path4.dirname(settingsPath), { recursive: true });
-        fs3.writeFileSync(
-          settingsPath,
-          JSON.stringify(existingSettings, null, 2) + "\n",
-          "utf8"
-        );
-      } else if (opts.verbose) {
+    }
+    if (mismatches.length === 0 && unallocated.length === 0) {
+      console.log("  Ports verified.");
+    }
+  } catch (err) {
+    console.warn(
+      `  Port verification skipped: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  console.log("\n  Ports complete.\n");
+}
+var init_ports = __esm({
+  "src/cli/ports.ts"() {
+    "use strict";
+    init_flags();
+    init_api();
+    init_port_verify();
+  }
+});
+
+// src/cli/tech-stack.ts
+var tech_stack_exports = {};
+__export(tech_stack_exports, {
+  runFullTechStack: () => runFullTechStack,
+  runTechStack: () => runTechStack
+});
+import { existsSync as existsSync4 } from "node:fs";
+async function runTechStack() {
+  const flags = parseFlags(3);
+  const dryRun = hasFlag("dry-run", 3);
+  if (hasFlag("full-tech-stack", 3)) {
+    await runFullTechStack(dryRun);
+    return;
+  }
+  validateApiKey();
+  const config = await resolveConfig(flags);
+  const { repoId, projectPath } = config;
+  console.log(`
+  CodeByPlan Tech Stack`);
+  console.log(`  Repo: ${repoId}`);
+  console.log(`  Path: ${projectPath}`);
+  if (dryRun) console.log(`  Mode: dry-run`);
+  console.log();
+  if (dryRun) {
+    try {
+      if (await needsLocalMigration(projectPath)) {
         console.log(
-          `[dry-run] would merge settings into ${path4.relative(projectDir, settingsPath)}`
+          `  Would migrate .codebyplan.json -> worktree_id to .codebyplan.local.json (dry-run, skipping actual write).`
         );
       }
+    } catch {
     }
-    const gitignoreAction = await ensureManagedGitignoreBlock(
-      projectDir,
-      opts.dryRun
-    );
-    if (opts.verbose && gitignoreAction !== "unchanged") {
-      console.log(
-        `${opts.dryRun ? "[dry-run] would " : ""}${gitignoreAction} managed .gitignore block in ${path4.relative(projectDir, path4.join(projectDir, ".gitignore"))}`
+  } else {
+    try {
+      if (await needsLocalMigration(projectPath)) {
+        const result = await runLocalMigration(projectPath);
+        console.log(
+          `  Migrated .codebyplan.json to .codebyplan/ layout: ${result.summary}`
+        );
+        console.log(
+          `  Suggest /cbp-git-commit to stage the cleaned shared file.`
+        );
+      }
+    } catch (err) {
+      console.warn(
+        `  Warning: local migration failed (continuing): ${err instanceof Error ? err.message : String(err)}`
       );
     }
-    if (!opts.dryRun) {
-      const manifest = defaultManifest();
-      manifest.files = manifestEntries;
-      writeManifest(projectDir, manifest);
+  }
+  try {
+    const { dependencies } = await scanAllDependencies(projectPath);
+    if (dependencies.length === 0) {
+      console.log("  No dependencies found.");
+      console.log("\n  Tech stack complete.\n");
+      return;
     }
+    const sourcePaths = new Set(dependencies.map((d) => d.source_path));
     console.log(
-      `codebyplan claude install${opts.dryRun ? " (dry-run)" : ""}: ${manifestEntries.length} files, ${countHookEntries(templatesDir)} hook entries.`
+      `  ${dependencies.length} dependencies from ${sourcePaths.size} package.json file${sourcePaths.size !== 1 ? "s" : ""}`
     );
-    if (opts.renderer && !opts.dryRun) {
-      await writeStatuslineLocalConfig(projectDir, { renderer: opts.renderer });
+    if (!dryRun) {
+      const result = await apiPost(`/repos/${repoId}/tech-stack`, { dependencies });
+      if (result.data.stale_removed > 0) {
+        console.log(
+          `  ${result.data.stale_removed} stale dependencies removed`
+        );
+      }
+      try {
+        const { execSync: execSync6 } = await import("node:child_process");
+        let branch = "main";
+        try {
+          branch = execSync6("git symbolic-ref --short HEAD", {
+            cwd: projectPath,
+            encoding: "utf-8"
+          }).trim();
+        } catch {
+        }
+        const deviceId = await getOrCreateDeviceId(projectPath);
+        const tupleId = await resolveWorktreeId({
+          repoId,
+          repoPath: projectPath,
+          branch,
+          deviceId
+        });
+        await callMcpTool("enqueue_todo_job", {
+          repo_id: repoId,
+          ...tupleId ? { worktree_id: tupleId } : {},
+          reason: "CLI_SYNC"
+        });
+      } catch {
+      }
+    }
+    const detected = await detectTechStack(projectPath);
+    if (detected.flat.length > 0) {
+      const repoRes = await apiGet(`/repos/${repoId}`);
+      const remote = parseTechStackResult(repoRes.data.tech_stack);
+      const { merged, added } = mergeTechStack(remote, detected);
+      if (added.length > 0) {
+        console.log(`  ${added.length} new tech entries`);
+        if (!dryRun) {
+          await apiPut(`/repos/${repoId}`, { tech_stack: merged });
+        }
+      }
     }
   } catch (err) {
-    console.error(
-      `codebyplan claude install failed: ${err instanceof Error ? err.message : String(err)}`
+    console.warn(
+      `  Tech stack detection skipped: ${err instanceof Error ? err.message : String(err)}`
     );
-    process.exitCode = 1;
   }
+  console.log("\n  Tech stack complete.\n");
 }
-function runInstallUser(opts, deps) {
-  let templatesDir;
-  try {
-    templatesDir = deps.templatesDir ?? resolveTemplatesDir();
-  } catch (err) {
-    console.error(
-      err instanceof Error ? err.message : `codebyplan claude install: ${String(err)}`
-    );
-    process.exitCode = 1;
-    return;
-  }
+async function syncTechStackForPath(repoId, projectPath, dryRun) {
   try {
-    const userDir = deps.userDir ?? path4.join(os2.homedir(), ".claude");
-    const settingsPath = path4.join(userDir, "settings.json");
-    const userBaseSettingsPath = path4.join(
-      templatesDir,
-      "settings.user.base.json"
-    );
-    if (!fs3.existsSync(userBaseSettingsPath)) {
-      console.error(
-        "codebyplan claude install: settings.user.base.json not found in templates."
-      );
-      process.exitCode = 1;
+    const { dependencies } = await scanAllDependencies(projectPath);
+    if (dependencies.length === 0) {
+      console.log("    No dependencies found.");
       return;
     }
-    const userBase = JSON.parse(
-      fs3.readFileSync(userBaseSettingsPath, "utf8")
-    );
-    const existingSettings = fs3.existsSync(settingsPath) ? JSON.parse(fs3.readFileSync(settingsPath, "utf8")) : {};
-    mergeBaseSettingsIntoSettings(existingSettings, userBase);
-    if (!opts.dryRun) {
-      fs3.mkdirSync(userDir, { recursive: true });
-      fs3.writeFileSync(
-        settingsPath,
-        JSON.stringify(existingSettings, null, 2) + "\n",
-        "utf8"
-      );
-      const manifest = defaultManifest();
-      manifest.files = [];
-      writeManifestForScope("user", manifest, userDir);
-    } else if (opts.verbose) {
-      console.log(
-        `[dry-run] would merge user base settings into ${settingsPath}`
-      );
-    }
+    const sourcePaths = new Set(dependencies.map((d) => d.source_path));
     console.log(
-      `codebyplan claude install --scope user${opts.dryRun ? " (dry-run)" : ""}: settings.json updated, 0 template files copied.`
+      `    ${dependencies.length} dependencies from ${sourcePaths.size} package.json file${sourcePaths.size !== 1 ? "s" : ""}`
     );
+    if (!dryRun) {
+      const result = await apiPost(`/repos/${repoId}/tech-stack`, { dependencies });
+      if (result.data.stale_removed > 0) {
+        console.log(
+          `    ${result.data.stale_removed} stale dependencies removed`
+        );
+      }
+    }
+    const detected = await detectTechStack(projectPath);
+    if (detected.flat.length > 0) {
+      const repoRes = await apiGet(`/repos/${repoId}`);
+      const remote = parseTechStackResult(repoRes.data.tech_stack);
+      const { merged, added } = mergeTechStack(remote, detected);
+      if (added.length > 0) {
+        console.log(`    ${added.length} new tech entries`);
+        if (!dryRun) {
+          await apiPut(`/repos/${repoId}`, { tech_stack: merged });
+        }
+      }
+    }
   } catch (err) {
+    console.warn(
+      `    Tech stack detection skipped: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function runFullTechStack(dryRun) {
+  validateApiKey();
+  const localConfig = await readLocalConfig(process.cwd());
+  if (!localConfig?.device_id) {
     console.error(
-      `codebyplan claude install failed: ${err instanceof Error ? err.message : String(err)}`
+      "  --full-tech-stack requires a device_id in .codebyplan/device.local.json.\n  Run `npx codebyplan setup` in this directory first to register the device."
     );
     process.exitCode = 1;
+    return;
   }
-}
-function countHookEntries(templatesDir) {
-  const p = path4.join(templatesDir, "hooks", "hooks.json");
-  if (!fs3.existsSync(p)) return 0;
-  try {
-    const j = JSON.parse(fs3.readFileSync(p, "utf8"));
-    let n = 0;
-    for (const blocks of Object.values(j.hooks)) {
-      for (const b of blocks) n += b.hooks.length;
+  console.log("\n  CodeByPlan Tech Stack \u2014 Full (all local worktrees)");
+  if (dryRun) console.log("  Mode: dry-run");
+  console.log();
+  const reposRes = await apiGet("/repos");
+  const repos = reposRes.data ?? [];
+  let synced = 0;
+  let skipped = 0;
+  for (const repo of repos) {
+    let worktrees = [];
+    try {
+      const wtRes = await apiGet(
+        `/worktrees?repo_id=${repo.id}`
+      );
+      worktrees = wtRes.data ?? [];
+    } catch (err) {
+      console.warn(
+        `  Warning: failed to fetch worktrees for ${repo.name}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      continue;
     }
-    return n;
-  } catch (err) {
-    console.error(
-      `codebyplan: could not count hook entries in hooks.json: ${err instanceof Error ? err.message : String(err)}`
+    const localWorktrees = worktrees.filter(
+      (wt) => wt.path ? existsSync4(wt.path) : false
     );
-    return 0;
+    if (localWorktrees.length === 0) {
+      console.log(`  skipping ${repo.name} \u2014 no local worktree on this device`);
+      skipped++;
+      continue;
+    }
+    for (const wt of localWorktrees) {
+      console.log(`  ==> Syncing ${repo.name} @ ${wt.path}`);
+      try {
+        await syncTechStackForPath(repo.id, wt.path, dryRun);
+        synced++;
+      } catch (err) {
+        console.error(
+          `  Error syncing tech stack for ${repo.name} @ ${wt.path}: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
   }
+  console.log(
+    `
+  Walked ${repos.length} repos, synced ${synced} local worktrees, skipped ${skipped} remote.
+`
+  );
 }
-var init_install = __esm({
-  "src/cli/claude/install.ts"() {
+var init_tech_stack = __esm({
+  "src/cli/tech-stack.ts"() {
     "use strict";
-    init_template_walker();
-    init_gitignore_block();
-    init_manifest();
-    init_settings_merge();
-    init_statusline_config();
+    init_flags();
+    init_api();
+    init_tech_detect();
+    init_migrate_local_config();
+    init_local_config();
+    init_resolve_worktree();
   }
 });
 
@@ -6096,11 +6721,11 @@ async function ask(q, opts) {
   try {
     while (true) {
       const choices = q.choices.map((c) => `[${c.key}] ${c.label}`).join("  ");
-      const answer = await new Promise((resolve5) => {
+      const answer = await new Promise((resolve7) => {
         rl.question(`${q.message}
   ${choices}
 > `, (input) => {
-          resolve5(input.trim().toLowerCase());
+          resolve7(input.trim().toLowerCase());
         });
       });
       const match = q.choices.find(
@@ -6194,9 +6819,9 @@ var update_exports = {};
 __export(update_exports, {
   runUpdate: () => runUpdate
 });
-import * as fs4 from "node:fs";
+import * as fs5 from "node:fs";
 import * as os3 from "node:os";
-import * as path5 from "node:path";
+import * as path6 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 async function runUpdate(opts, deps = {}) {
   await Promise.resolve();
@@ -6236,10 +6861,10 @@ async function runUpdate(opts, deps = {}) {
       finalManifestEntries.push(e);
     }
     for (const { packaged, absSrc } of plan.overwriteSafe) {
-      const absDest = path5.join(projectDir, ".claude", packaged.dest);
+      const absDest = path6.join(projectDir, ".claude", packaged.dest);
       if (!opts.dryRun) {
-        fs4.mkdirSync(path5.dirname(absDest), { recursive: true });
-        fs4.copyFileSync(absSrc, absDest);
+        fs5.mkdirSync(path6.dirname(absDest), { recursive: true });
+        fs5.copyFileSync(absSrc, absDest);
         if (opts.verbose) console.log(`updated ${packaged.dest}`);
       } else if (opts.verbose) {
         console.log(`[dry-run] would update ${packaged.dest}`);
@@ -6251,8 +6876,8 @@ async function runUpdate(opts, deps = {}) {
       absSrc,
       onDiskContent
     } of plan.overwriteHandEdited) {
-      const absDest = path5.join(projectDir, ".claude", packaged.dest);
-      const newContent = fs4.readFileSync(absSrc);
+      const absDest = path6.join(projectDir, ".claude", packaged.dest);
+      const newContent = fs5.readFileSync(absSrc);
       const showDiff = () => {
         console.log(
           renderDiff(
@@ -6264,8 +6889,8 @@ async function runUpdate(opts, deps = {}) {
       const answer = await promptOverwrite(packaged.dest, opts, showDiff);
       if (answer === "overwrite") {
         if (!opts.dryRun) {
-          fs4.mkdirSync(path5.dirname(absDest), { recursive: true });
-          fs4.copyFileSync(absSrc, absDest);
+          fs5.mkdirSync(path6.dirname(absDest), { recursive: true });
+          fs5.copyFileSync(absSrc, absDest);
         }
         finalManifestEntries.push(packaged);
       } else {
@@ -6280,10 +6905,10 @@ async function runUpdate(opts, deps = {}) {
     for (const { packaged, absSrc } of plan.newOptIn) {
       const answer = await promptOptIn(packaged.dest, opts);
       if (answer === "opt-in") {
-        const absDest = path5.join(projectDir, ".claude", packaged.dest);
+        const absDest = path6.join(projectDir, ".claude", packaged.dest);
         if (!opts.dryRun) {
-          fs4.mkdirSync(path5.dirname(absDest), { recursive: true });
-          fs4.copyFileSync(absSrc, absDest);
+          fs5.mkdirSync(path6.dirname(absDest), { recursive: true });
+          fs5.copyFileSync(absSrc, absDest);
         }
         finalManifestEntries.push(packaged);
         if (opts.verbose) console.log(`installed new file ${packaged.dest}`);
@@ -6294,25 +6919,25 @@ async function runUpdate(opts, deps = {}) {
     for (const e of plan.removedFromPackage) {
       const answer = await promptRemove(e.dest, opts);
       if (answer === "remove") {
-        const absDest = path5.join(projectDir, ".claude", e.dest);
-        if (!opts.dryRun && fs4.existsSync(absDest)) {
-          fs4.rmSync(absDest);
-          const claudeDir = path5.join(projectDir, ".claude");
-          let cur = path5.dirname(absDest);
-          while (cur !== claudeDir && cur !== path5.dirname(cur)) {
-            if (path5.dirname(cur) === claudeDir) break;
+        const absDest = path6.join(projectDir, ".claude", e.dest);
+        if (!opts.dryRun && fs5.existsSync(absDest)) {
+          fs5.rmSync(absDest);
+          const claudeDir = path6.join(projectDir, ".claude");
+          let cur = path6.dirname(absDest);
+          while (cur !== claudeDir && cur !== path6.dirname(cur)) {
+            if (path6.dirname(cur) === claudeDir) break;
             try {
-              fs4.rmdirSync(cur);
+              fs5.rmdirSync(cur);
               if (opts.verbose)
                 console.log(
-                  `pruned empty dir ${path5.relative(claudeDir, cur)}`
+                  `pruned empty dir ${path6.relative(claudeDir, cur)}`
                 );
-              cur = path5.dirname(cur);
+              cur = path6.dirname(cur);
             } catch (err) {
               const code = err.code;
               if (code !== "ENOTEMPTY" && code !== "ENOENT") {
                 console.warn(
-                  `codebyplan claude: could not prune empty dir ${path5.relative(claudeDir, cur)}: ${err.message}`
+                  `codebyplan claude: could not prune empty dir ${path6.relative(claudeDir, cur)}: ${err.message}`
                 );
               }
               break;
@@ -6324,17 +6949,17 @@ async function runUpdate(opts, deps = {}) {
         if (opts.verbose) console.log(`kept (untracked) ${e.dest}`);
       }
     }
-    const hooksJsonPath = path5.join(templatesDir, "hooks", "hooks.json");
-    if (fs4.existsSync(hooksJsonPath)) {
+    const hooksJsonPath = path6.join(templatesDir, "hooks", "hooks.json");
+    if (fs5.existsSync(hooksJsonPath)) {
       const hooksJson = JSON.parse(
-        fs4.readFileSync(hooksJsonPath, "utf8")
+        fs5.readFileSync(hooksJsonPath, "utf8")
       );
-      const settingsPath = path5.join(projectDir, ".claude", "settings.json");
-      const existingSettings = fs4.existsSync(settingsPath) ? JSON.parse(fs4.readFileSync(settingsPath, "utf8")) : {};
+      const settingsPath = path6.join(projectDir, ".claude", "settings.json");
+      const existingSettings = fs5.existsSync(settingsPath) ? JSON.parse(fs5.readFileSync(settingsPath, "utf8")) : {};
       mergeHooksIntoSettings(existingSettings, hooksJson);
       if (!opts.dryRun) {
-        fs4.mkdirSync(path5.dirname(settingsPath), { recursive: true });
-        fs4.writeFileSync(
+        fs5.mkdirSync(path6.dirname(settingsPath), { recursive: true });
+        fs5.writeFileSync(
           settingsPath,
           JSON.stringify(existingSettings, null, 2) + "\n",
           "utf8"
@@ -6347,7 +6972,7 @@ async function runUpdate(opts, deps = {}) {
     );
     if (opts.verbose && gitignoreAction !== "unchanged") {
       console.log(
-        `${opts.dryRun ? "[dry-run] would " : ""}${gitignoreAction} managed .gitignore block in ${path5.relative(projectDir, path5.join(projectDir, ".gitignore"))}`
+        `${opts.dryRun ? "[dry-run] would " : ""}${gitignoreAction} managed .gitignore block in ${path6.relative(projectDir, path6.join(projectDir, ".gitignore"))}`
       );
     }
     if (!opts.dryRun) {
@@ -6382,9 +7007,9 @@ function runUpdateUser(opts, deps) {
     return;
   }
   try {
-    const userDir = deps.userDir ?? path5.join(os3.homedir(), ".claude");
-    const settingsPath = path5.join(userDir, "settings.json");
-    const userBaseSettingsPath = path5.join(
+    const userDir = deps.userDir ?? path6.join(os3.homedir(), ".claude");
+    const settingsPath = path6.join(userDir, "settings.json");
+    const userBaseSettingsPath = path6.join(
       templatesDir,
       "settings.user.base.json"
     );
@@ -6396,7 +7021,7 @@ function runUpdateUser(opts, deps) {
       process.exitCode = 1;
       return;
     }
-    if (!fs4.existsSync(userBaseSettingsPath)) {
+    if (!fs5.existsSync(userBaseSettingsPath)) {
       console.error(
         "codebyplan claude update: settings.user.base.json not found in templates."
       );
@@ -6404,13 +7029,13 @@ function runUpdateUser(opts, deps) {
       return;
     }
     const userBase = JSON.parse(
-      fs4.readFileSync(userBaseSettingsPath, "utf8")
+      fs5.readFileSync(userBaseSettingsPath, "utf8")
     );
-    const existingSettings = fs4.existsSync(settingsPath) ? JSON.parse(fs4.readFileSync(settingsPath, "utf8")) : {};
+    const existingSettings = fs5.existsSync(settingsPath) ? JSON.parse(fs5.readFileSync(settingsPath, "utf8")) : {};
     mergeBaseSettingsIntoSettings(existingSettings, userBase);
     if (!opts.dryRun) {
-      fs4.mkdirSync(userDir, { recursive: true });
-      fs4.writeFileSync(
+      fs5.mkdirSync(userDir, { recursive: true });
+      fs5.writeFileSync(
         settingsPath,
         JSON.stringify(existingSettings, null, 2) + "\n",
         "utf8"
@@ -6446,8 +7071,8 @@ function buildPlan(projectDir, templatesDir, manifest) {
   };
   for (const pkg of packaged) {
     const inManifest = manifestBySrc.get(pkg.src);
-    const absDest = path5.join(projectDir, ".claude", pkg.dest);
-    const absSrc = path5.join(templatesDir, pkg.src);
+    const absDest = path6.join(projectDir, ".claude", pkg.dest);
+    const absSrc = path6.join(templatesDir, pkg.src);
     if (!inManifest) {
       plan.newOptIn.push({
         packaged: { src: pkg.src, dest: pkg.dest, hash: pkg.hash },
@@ -6455,8 +7080,8 @@ function buildPlan(projectDir, templatesDir, manifest) {
       });
       continue;
     }
-    const onDiskExists = fs4.existsSync(absDest);
-    const onDiskContent = onDiskExists ? fs4.readFileSync(absDest) : Buffer.alloc(0);
+    const onDiskExists = fs5.existsSync(absDest);
+    const onDiskContent = onDiskExists ? fs5.readFileSync(absDest) : Buffer.alloc(0);
     const onDiskHash = onDiskExists ? sha256(onDiskContent) : null;
     if (pkg.hash === inManifest.hash && onDiskHash === inManifest.hash) {
       plan.unchanged.push(inManifest);
@@ -6483,14 +7108,14 @@ function buildPlan(projectDir, templatesDir, manifest) {
   return plan;
 }
 function resolveTemplatesDirFromInstall() {
-  const here = path5.dirname(fileURLToPath2(import.meta.url));
+  const here = path6.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path5.resolve(here, "..", "templates"),
-    path5.resolve(here, "..", "..", "templates"),
-    path5.resolve(here, "..", "..", "..", "templates")
+    path6.resolve(here, "..", "templates"),
+    path6.resolve(here, "..", "..", "templates"),
+    path6.resolve(here, "..", "..", "..", "templates")
   ];
   for (const c of candidates) {
-    if (fs4.existsSync(c) && fs4.statSync(c).isDirectory()) {
+    if (fs5.existsSync(c) && fs5.statSync(c).isDirectory()) {
       return c;
     }
   }
@@ -6519,9 +7144,9 @@ var uninstall_exports = {};
 __export(uninstall_exports, {
   runUninstall: () => runUninstall
 });
-import * as fs5 from "node:fs";
+import * as fs6 from "node:fs";
 import * as os4 from "node:os";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 async function runUninstall(opts, deps = {}) {
   await Promise.resolve();
   const scope = opts.scope ?? "project";
@@ -6550,15 +7175,15 @@ async function runUninstall(opts, deps = {}) {
     let removed = 0;
     let warnings = 0;
     for (const entry of manifest.files) {
-      const abs = path6.join(projectDir, ".claude", entry.dest);
-      if (!fs5.existsSync(abs)) {
+      const abs = path7.join(projectDir, ".claude", entry.dest);
+      if (!fs6.existsSync(abs)) {
         console.warn(
           `codebyplan claude uninstall: ${entry.dest} already absent (skipping).`
         );
         warnings += 1;
         continue;
       }
-      const onDiskHash = sha256(fs5.readFileSync(abs));
+      const onDiskHash = sha256(fs6.readFileSync(abs));
       if (onDiskHash !== entry.hash) {
         console.warn(
           `codebyplan claude uninstall: ${entry.dest} has been modified locally; removing anyway.`
@@ -6566,7 +7191,7 @@ async function runUninstall(opts, deps = {}) {
         warnings += 1;
       }
       if (!opts.dryRun) {
-        fs5.rmSync(abs);
+        fs6.rmSync(abs);
       }
       removed += 1;
       if (opts.verbose) console.log(`removed ${entry.dest}`);
@@ -6574,15 +7199,15 @@ async function runUninstall(opts, deps = {}) {
     if (!opts.dryRun) {
       pruneEmptyManagedDirs(projectDir);
     }
-    const settingsPath = path6.join(projectDir, ".claude", "settings.json");
-    if (fs5.existsSync(settingsPath)) {
+    const settingsPath = path7.join(projectDir, ".claude", "settings.json");
+    if (fs6.existsSync(settingsPath)) {
       const settings = JSON.parse(
-        fs5.readFileSync(settingsPath, "utf8")
+        fs6.readFileSync(settingsPath, "utf8")
       );
-      const baseSettingsPath = templatesDir ? path6.join(templatesDir, "settings.project.base.json") : null;
-      if (baseSettingsPath && fs5.existsSync(baseSettingsPath)) {
+      const baseSettingsPath = templatesDir ? path7.join(templatesDir, "settings.project.base.json") : null;
+      if (baseSettingsPath && fs6.existsSync(baseSettingsPath)) {
         const base = JSON.parse(
-          fs5.readFileSync(baseSettingsPath, "utf8")
+          fs6.readFileSync(baseSettingsPath, "utf8")
         );
         stripBaseSettingsFromSettings(settings, base);
       }
@@ -6590,9 +7215,9 @@ async function runUninstall(opts, deps = {}) {
       if (!opts.dryRun) {
         const isEmpty = Object.keys(settings).length === 0;
         if (isEmpty) {
-          fs5.rmSync(settingsPath);
+          fs6.rmSync(settingsPath);
         } else {
-          fs5.writeFileSync(
+          fs6.writeFileSync(
             settingsPath,
             JSON.stringify(settings, null, 2) + "\n",
             "utf8"
@@ -6611,11 +7236,11 @@ async function runUninstall(opts, deps = {}) {
     }
     if (!opts.dryRun) {
       const m = manifestPath(projectDir);
-      if (fs5.existsSync(m)) fs5.rmSync(m);
+      if (fs6.existsSync(m)) fs6.rmSync(m);
       const mid = midManifestPath(projectDir);
-      if (fs5.existsSync(mid)) fs5.rmSync(mid);
+      if (fs6.existsSync(mid)) fs6.rmSync(mid);
       const legacy = oldManifestPath(projectDir);
-      if (fs5.existsSync(legacy)) fs5.rmSync(legacy);
+      if (fs6.existsSync(legacy)) fs6.rmSync(legacy);
     }
     console.log(
       `codebyplan claude uninstall${opts.dryRun ? " (dry-run)" : ""}: removed ${removed} files${warnings > 0 ? ` (${warnings} warnings)` : ""}.`
@@ -6637,7 +7262,7 @@ function runUninstallUser(opts, deps) {
     }
   }
   try {
-    const userDir = deps.userDir ?? path6.join(os4.homedir(), ".claude");
+    const userDir = deps.userDir ?? path7.join(os4.homedir(), ".claude");
     const existingManifest = readManifestForScope("user", userDir);
     if (!existingManifest) {
       console.error(
@@ -6646,24 +7271,24 @@ function runUninstallUser(opts, deps) {
       process.exitCode = 1;
       return;
     }
-    const settingsPath = path6.join(userDir, "settings.json");
-    if (fs5.existsSync(settingsPath)) {
+    const settingsPath = path7.join(userDir, "settings.json");
+    if (fs6.existsSync(settingsPath)) {
       const settings = JSON.parse(
-        fs5.readFileSync(settingsPath, "utf8")
+        fs6.readFileSync(settingsPath, "utf8")
       );
-      const userBaseSettingsPath = templatesDir != null ? path6.join(templatesDir, "settings.user.base.json") : null;
-      if (userBaseSettingsPath && fs5.existsSync(userBaseSettingsPath)) {
+      const userBaseSettingsPath = templatesDir != null ? path7.join(templatesDir, "settings.user.base.json") : null;
+      if (userBaseSettingsPath && fs6.existsSync(userBaseSettingsPath)) {
         const userBase = JSON.parse(
-          fs5.readFileSync(userBaseSettingsPath, "utf8")
+          fs6.readFileSync(userBaseSettingsPath, "utf8")
         );
         stripBaseSettingsFromSettings(settings, userBase);
       }
       if (!opts.dryRun) {
         const isEmpty = Object.keys(settings).length === 0;
         if (isEmpty) {
-          fs5.rmSync(settingsPath);
+          fs6.rmSync(settingsPath);
         } else {
-          fs5.writeFileSync(
+          fs6.writeFileSync(
             settingsPath,
             JSON.stringify(settings, null, 2) + "\n",
             "utf8"
@@ -6673,11 +7298,11 @@ function runUninstallUser(opts, deps) {
     }
     if (!opts.dryRun) {
       const m = userManifestPath(userDir);
-      if (fs5.existsSync(m)) fs5.rmSync(m);
+      if (fs6.existsSync(m)) fs6.rmSync(m);
       const midUser = userMidManifestPath(userDir);
-      if (fs5.existsSync(midUser)) fs5.rmSync(midUser);
+      if (fs6.existsSync(midUser)) fs6.rmSync(midUser);
       const oldUser = userOldManifestPath(userDir);
-      if (fs5.existsSync(oldUser)) fs5.rmSync(oldUser);
+      if (fs6.existsSync(oldUser)) fs6.rmSync(oldUser);
     }
     console.log(
       `codebyplan claude uninstall --scope user${opts.dryRun ? " (dry-run)" : ""}: user base settings stripped.`
@@ -6692,23 +7317,23 @@ function runUninstallUser(opts, deps) {
 function pruneEmptyManagedDirs(projectDir) {
   const managedRoots = ["skills", "agents", "hooks", "rules"];
   for (const root of managedRoots) {
-    const abs = path6.join(projectDir, ".claude", root);
-    if (!fs5.existsSync(abs)) continue;
+    const abs = path7.join(projectDir, ".claude", root);
+    if (!fs6.existsSync(abs)) continue;
     pruneLeafFirst(abs);
   }
 }
 function pruneLeafFirst(dir) {
-  if (!fs5.existsSync(dir)) return;
-  const stat2 = fs5.statSync(dir);
+  if (!fs6.existsSync(dir)) return;
+  const stat2 = fs6.statSync(dir);
   if (!stat2.isDirectory()) return;
-  for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      pruneLeafFirst(path6.join(dir, entry.name));
+      pruneLeafFirst(path7.join(dir, entry.name));
     }
   }
-  const remaining = fs5.readdirSync(dir);
+  const remaining = fs6.readdirSync(dir);
   if (remaining.length === 0) {
-    fs5.rmdirSync(dir);
+    fs6.rmdirSync(dir);
   }
 }
 var init_uninstall = __esm({
@@ -6724,13 +7349,13 @@ var init_uninstall = __esm({
 
 // src/index.ts
 init_version();
-import { readFileSync as readFileSync6 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
 void (async () => {
   if (!process.env.CODEBYPLAN_API_KEY) {
     try {
-      const envPath = resolve4(process.cwd(), ".env.local");
-      const content = readFileSync6(envPath, "utf-8");
+      const envPath = resolve6(process.cwd(), ".env.local");
+      const content = readFileSync7(envPath, "utf-8");
       for (const line of content.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -6820,12 +7445,23 @@ void (async () => {
     await runBranchCommand2(rest);
     process.exit(0);
   }
+  if (arg === "bump") {
+    const { runBumpCommand: runBumpCommand2 } = await Promise.resolve().then(() => (init_bump2(), bump_exports));
+    const rest = process.argv.slice(3);
+    await runBumpCommand2(rest);
+    process.exit(0);
+  }
   if (arg === "ship") {
     const { runShipCommand: runShipCommand2 } = await Promise.resolve().then(() => (init_ship2(), ship_exports));
     const rest = process.argv.slice(3);
     await runShipCommand2(rest);
     process.exit(0);
   }
+  if (arg === "scaffold-publish-workflow") {
+    const { runScaffoldPublishWorkflowCommand: runScaffoldPublishWorkflowCommand2 } = await Promise.resolve().then(() => (init_scaffold_publish_workflow2(), scaffold_publish_workflow_exports));
+    await runScaffoldPublishWorkflowCommand2(process.argv.slice(3));
+    process.exit(process.exitCode ?? 0);
+  }
   if (arg === "resolve-worktree") {
     const { runResolveWorktree: runResolveWorktree2 } = await Promise.resolve().then(() => (init_resolve_worktree2(), resolve_worktree_exports));
     await runResolveWorktree2();
@@ -6922,7 +7558,9 @@ void (async () => {
                                      (--full-tech-stack: sync every local worktree on this device)
     codebyplan eslint                ESLint config management (init)
     codebyplan round sync-approvals  Sync git diff and approvals with round/task state
+    codebyplan bump                  Detect changed packages and patch-bump versions
     codebyplan ship                  Ship current feat branch to production via PR
+    codebyplan scaffold-publish-workflow   Write the publish-on-main GitHub workflow into ./.github/workflows/
     codebyplan branch migrate        Rewrite branch_config from 3-branch to 2-tier model
     codebyplan claude                Claude asset management (install/update/uninstall)
     codebyplan statusline            Show or set the statusline renderer (bash/node/python)
@@ -6969,8 +7607,6 @@ void (async () => {
       URL: https://mcp.codebyplan.com/mcp
       Auth: OAuth 2.1 (configure via \`codebyplan login\`)
 
-    Legacy x-api-key at https://www.codebyplan.com/mcp is supported until 2026-06-30.
-
   Learn more: https://codebyplan.com
 `);
     process.exit(0);