create-snipara 2.1.0 → 2.2.0

package/dist/index.js

@@ -5,16 +5,16 @@ import { Command, Option } from "commander";
 import prompts from "prompts";
 import chalk from "chalk";
 import ora from "ora";
-import { randomUUID } from "crypto";
-import fs from "fs";
-import path from "path";
-import { execSync, spawn } from "child_process";
-import { homedir } from "os";
+import { randomUUID as randomUUID3 } from "crypto";
+import fs4 from "fs";
+import path4 from "path";
+import { execFileSync as execFileSync3, execSync, spawn as spawn2 } from "child_process";
+import { homedir as homedir2 } from "os";
 
 // package.json
 var package_default = {
   name: "create-snipara",
-  version: "2.1.0",
+  version: "2.2.0",
   description: "Onboard Snipara Cloud or self-hosted MCP with an automatic project-grounded proof of value",
   main: "dist/index.js",
   type: "module",
@@ -22,8 +22,8 @@ var package_default = {
     "create-snipara": "dist/index.js"
   },
   scripts: {
-    build: "tsup src/index.ts --format esm --dts --clean",
-    dev: "tsup src/index.ts --format esm --watch",
+    build: "tsup --config tsup.config.ts",
+    dev: "tsup --config tsup.config.ts --watch",
     prepack: "npm run build",
     pretest: "pnpm build",
     test: "node --test test/*.test.cjs",
@@ -74,6 +74,7 @@ var package_default = {
   },
   devDependencies: {
     "@eslint/js": "^9.39.3",
+    "@snipara/project-intelligence-contracts": "workspace:*",
     "@types/node": "^20.17.12",
     "@types/prompts": "^2.4.9",
     "@typescript-eslint/eslint-plugin": "^8.56.0",
@@ -90,6 +91,781 @@ var package_default = {
   ]
 };
 
+// src/managed-toolchain.ts
+import fs from "fs";
+import path from "path";
+import { homedir } from "os";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import { spawn } from "child_process";
+
+// ../project-intelligence-contracts/src/worker-profile.ts
+import { createHash } from "crypto";
+
+// ../project-intelligence-contracts/src/producer-loop.ts
+import { createHash as createHash2 } from "crypto";
+
+// ../project-intelligence-contracts/src/decision-request.ts
+import { createHash as createHash3 } from "crypto";
+
+// ../project-intelligence-contracts/src/why-capture-confidence-v1.json
+var why_capture_confidence_v1_default = {
+  version: "why-capture-confidence-v1",
+  base: 0.72,
+  decisionRationaleBonus: 0.1,
+  nonManualSourceBonus: 0.04,
+  maximum: 0.9,
+  decimalPlaces: 2,
+  validatedExecutionOutcomes: ["completed"],
+  vectors: [
+    {
+      candidateType: "CONTEXT",
+      hasDecision: false,
+      hasRationale: false,
+      sourceKind: "manual",
+      executionOutcome: "completed",
+      expected: 0.72
+    },
+    {
+      candidateType: "DECISION",
+      hasDecision: true,
+      hasRationale: true,
+      sourceKind: "manual",
+      executionOutcome: "completed",
+      expected: 0.82
+    },
+    {
+      candidateType: "DECISION",
+      hasDecision: true,
+      hasRationale: true,
+      sourceKind: "phase_commit",
+      executionOutcome: "completed",
+      expected: 0.86
+    },
+    {
+      candidateType: "DECISION",
+      hasDecision: true,
+      hasRationale: true,
+      sourceKind: "phase_commit",
+      executionOutcome: "partial",
+      expected: 0.76
+    },
+    {
+      candidateType: "DECISION",
+      hasDecision: true,
+      hasRationale: true,
+      sourceKind: "phase_commit",
+      executionOutcome: "blocked",
+      expected: 0.76
+    },
+    {
+      candidateType: "DECISION",
+      hasDecision: true,
+      hasRationale: true,
+      sourceKind: "phase_commit",
+      executionOutcome: "abandoned",
+      expected: 0.76
+    },
+    {
+      candidateType: "DECISION",
+      hasDecision: true,
+      hasRationale: false,
+      sourceKind: "final_commit",
+      executionOutcome: "completed",
+      expected: 0.76
+    }
+  ]
+};
+
+// ../project-intelligence-contracts/src/why-capture-confidence.ts
+var WHY_CAPTURE_CONFIDENCE_VERSION = why_capture_confidence_v1_default.version;
+var WHY_CAPTURE_CONFIDENCE_TEST_VECTORS = why_capture_confidence_v1_default.vectors;
+
+// ../project-intelligence-contracts/src/judgment-integrity.ts
+import { randomUUID } from "crypto";
+
+// ../project-intelligence-contracts/src/agent-memory-pilot.ts
+import { createHash as createHash4 } from "crypto";
+
+// ../project-intelligence-contracts/src/managed-toolchain.ts
+var MANAGED_TOOLCHAIN_VERSION = "snipara.toolchain.v1";
+var MANAGED_TOOLCHAIN_COMPONENTS = ["companion", "orchestrator", "sandbox"];
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var bounded = (value, max) => typeof value === "string" && value.length > 0 && value.length <= max && !Array.from(value).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127);
+function canonicalAbsolute(value) {
+  return bounded(value, 4096) && value.startsWith("/") && value !== "/" && !value.endsWith("/") && !value.split("/").some((part, index) => index > 0 && ["", ".", ".."].includes(part));
+}
+function parseManagedToolchainManifest(value) {
+  if (!object(value) || value.schemaVersion !== MANAGED_TOOLCHAIN_VERSION || !bounded(value.bundleId, 128) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value.bundleId) || !canonicalAbsolute(value.root) || !object(value.components) || !object(value.contracts) || value.contracts.taskReference !== 1 || value.contracts.validation !== 1 || !Array.isArray(value.capabilities) || value.capabilities.length > 32 || !value.capabilities.every((item) => bounded(item, 64) && /^[a-z][a-z0-9_-]*$/.test(item)) || new Set(value.capabilities).size !== value.capabilities.length) {
+    throw new Error("Unsupported or invalid managed toolchain manifest");
+  }
+  const root = value.root;
+  const components = {};
+  for (const name of MANAGED_TOOLCHAIN_COMPONENTS) {
+    const component = value.components[name];
+    if (!object(component) || !bounded(component.version, 64) || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(component.version) || !canonicalAbsolute(component.command) || !component.command.startsWith(root + "/") || typeof component.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(component.sha256)) {
+      throw new Error("Invalid managed component identity");
+    }
+    components[name] = { version: component.version, command: component.command, sha256: component.sha256 };
+  }
+  return {
+    schemaVersion: MANAGED_TOOLCHAIN_VERSION,
+    bundleId: value.bundleId,
+    root,
+    components,
+    contracts: { taskReference: 1, validation: 1 },
+    capabilities: [...value.capabilities]
+  };
+}
+
+// src/managed-versions.json
+var managed_versions_default = {
+  companion: "4.2.0",
+  orchestrator: "1.16.0",
+  sandbox: "3.0.0"
+};
+
+// src/managed-toolchain.ts
+var MANAGED_VERSIONS = Object.freeze(managed_versions_default);
+function assertManagedRuntimeVersions(nodeVersion, pythonVersion) {
+  const node = /^v?(\d+)\.\d+\.\d+(?:[-+].*)?$/.exec(nodeVersion);
+  const python = /^Python (\d+)\.(\d+)\.\d+(?:[a-z0-9.+-]*)?$/i.exec(pythonVersion.trim());
+  if (!node || Number(node[1]) < 18 || !python || Number(python[1]) !== 3 || Number(python[2]) < 10)
+    throw new Error("Local work requires existing Node.js 18+ and Python 3.10+. Update your system runtimes and retry; no operating-system runtime was installed");
+}
+var ManagedInstallerCleanupError = class extends Error {
+};
+var sha = (bytes2) => createHash5("sha256").update(bytes2).digest("hex");
+var uid = () => {
+  if (!process.getuid || process.platform === "win32") throw new Error("Managed local work requires macOS or Linux");
+  return process.getuid();
+};
+function exists(file) {
+  try {
+    fs.lstatSync(file);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function owned(file, directory, privateMode = false) {
+  const info = fs.lstatSync(file);
+  if (info.uid !== uid() || info.isSymbolicLink() || (directory ? !info.isDirectory() : !info.isFile()) || !directory && info.nlink !== 1 || (info.mode & 18) !== 0 || privateMode && (info.mode & 63) !== 0)
+    throw new Error("Managed installation path is not owned and protected");
+  return info;
+}
+function privateDirectory(directory) {
+  if (!exists(directory)) {
+    privateDirectory(path.dirname(directory));
+    fs.mkdirSync(directory, { mode: 448 });
+  }
+  owned(directory, true);
+}
+function location(options) {
+  const home = fs.realpathSync(options.home ?? homedir());
+  owned(home, true);
+  return path.join(home, ".local/share/snipara/toolchains");
+}
+function bytes(file, limit = 65536) {
+  owned(file, false);
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  try {
+    const info = fs.fstatSync(fd);
+    if (!info.isFile() || info.uid !== uid() || info.size > limit || info.mode & 18)
+      throw new Error("Managed installation artifact is invalid");
+    const value = fs.readFileSync(fd);
+    if (value.length > limit) throw new Error("Managed installation artifact exceeds its bound");
+    return value;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function writePrivate(file, value) {
+  fs.writeFileSync(file, JSON.stringify(value, null, 2) + "\n", { mode: 384, flag: "wx" });
+}
+function protectedCommand(root, command) {
+  const real = fs.realpathSync(command);
+  if (!real.startsWith(root + path.sep)) throw new Error("Managed command escapes its bundle");
+  for (let current = path.dirname(real); current !== root; current = path.dirname(current)) owned(current, true);
+  const info = owned(real, false);
+  if (!(info.mode & 73)) throw new Error("Managed command is not executable");
+  return real;
+}
+function readManagedManifest(file, options = {}) {
+  const base = location(options);
+  owned(base, true, true);
+  const link = fs.lstatSync(file);
+  let target = file;
+  if (link.isSymbolicLink()) {
+    if (link.uid !== uid()) throw new Error("Managed pointer has a foreign owner");
+    target = path.resolve(path.dirname(file), fs.readlinkSync(file));
+  }
+  if (path.basename(target) !== "toolchain.json" || path.dirname(path.dirname(target)) !== base)
+    throw new Error("Managed manifest is outside the private installation");
+  const root = path.dirname(target);
+  owned(root, true, true);
+  if (fs.realpathSync(root) !== root) throw new Error("Managed bundle cannot use linked directories");
+  owned(target, false, true);
+  const manifest = parseManagedToolchainManifest(JSON.parse(bytes(target).toString("utf8")));
+  if (manifest.root !== root || manifest.bundleId !== path.basename(root) || !manifest.capabilities.includes("validation") || !manifest.capabilities.includes("coordination"))
+    throw new Error("Managed bundle identity or required capabilities differ");
+  for (const component of Object.values(manifest.components)) {
+    if (protectedCommand(root, component.command) !== component.command || sha(bytes(component.command, 8e6)) !== component.sha256)
+      throw new Error("Managed command identity changed; prepare a replacement bundle");
+  }
+  return manifest;
+}
+function verifyRetainedCompanionBootstrap(command, active, options = {}) {
+  try {
+    const current = readManagedManifest(path.join(active.root, "toolchain.json"), options);
+    const base = location(options);
+    if (!path.isAbsolute(command) || !command.startsWith(base + path.sep)) return false;
+    const bundleId = command.slice(base.length + 1).split(path.sep)[0], root = path.join(base, bundleId);
+    owned(root, true, true);
+    if (fs.realpathSync(root) !== root || protectedCommand(root, command) !== command) return false;
+    const manifestFile = path.join(root, "toolchain.json");
+    owned(manifestFile, false, true);
+    const body = bytes(manifestFile), observedHash = sha(bytes(command, 8e6));
+    let previous;
+    try {
+      previous = parseManagedToolchainManifest(JSON.parse(body.toString("utf8")));
+    } catch {
+      return command === path.join(root, path.relative(current.root, current.components.companion.command)) && observedHash === current.components.companion.sha256;
+    }
+    return previous.root === root && previous.bundleId === bundleId && previous.components.companion.command === command && previous.components.companion.sha256 === observedHash;
+  } catch {
+    return false;
+  }
+}
+function managedToolchainStatus(options = {}) {
+  const active = path.join(location(options), "active.json");
+  if (!exists(active)) return { status: "absent", manifest: null, manifestPath: null };
+  return { status: "ready", manifest: readManagedManifest(active, options), manifestPath: fs.realpathSync(active) };
+}
+function program(name) {
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory || !path.isAbsolute(directory)) continue;
+    const candidate = path.join(directory, name);
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      if (fs.statSync(candidate).isFile()) return fs.realpathSync(candidate);
+    } catch {
+    }
+  }
+  throw new Error(`${name} is required; no operating-system runtime will be installed`);
+}
+function cleanEnvironment(root) {
+  return {
+    PATH: [path.dirname(process.execPath), "/usr/local/bin", "/opt/homebrew/bin", "/usr/bin", "/bin"].join(path.delimiter),
+    HOME: path.join(root, "home"),
+    TMPDIR: path.join(root, "tmp"),
+    LANG: "C.UTF-8",
+    LC_ALL: "C.UTF-8",
+    PYTHONNOUSERSITE: "1",
+    PYTHONDONTWRITEBYTECODE: "1",
+    PIP_DISABLE_PIP_VERSION_CHECK: "1",
+    PIP_NO_INPUT: "1",
+    PIP_CONFIG_FILE: "/dev/null",
+    NPM_CONFIG_USERCONFIG: "/dev/null",
+    NPM_CONFIG_GLOBALCONFIG: "/dev/null",
+    NPM_CONFIG_IGNORE_SCRIPTS: "true",
+    NPM_CONFIG_AUDIT: "false",
+    NPM_CONFIG_FUND: "false",
+    NO_COLOR: "1"
+  };
+}
+var runManagedInstaller = async (input) => new Promise((resolve2, reject) => {
+  const child = spawn(input.command, input.args, {
+    cwd: input.cwd,
+    env: input.env,
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: process.platform !== "win32"
+  });
+  let output = "", size = 0, stopped = false, stopReason = null;
+  let reapTimer;
+  const kill = () => {
+    try {
+      if (child.pid) process.kill(-child.pid, "SIGKILL");
+    } catch {
+      child.kill("SIGKILL");
+    }
+  };
+  const interrupted = () => stop("Managed preparation interrupted; the prior selection was preserved");
+  const exiting = () => kill();
+  const cleanup = () => {
+    clearTimeout(timer);
+    if (reapTimer) clearTimeout(reapTimer);
+    process.removeListener("SIGINT", interrupted);
+    process.removeListener("SIGTERM", interrupted);
+    process.removeListener("exit", exiting);
+  };
+  const stop = (message) => {
+    if (stopped || stopReason) return;
+    stopReason = message;
+    kill();
+    reapTimer = setTimeout(() => {
+      if (!stopped) {
+        stopped = true;
+        cleanup();
+        reject(new ManagedInstallerCleanupError("Managed installer cleanup could not be observed within its deadline; installation lock retained"));
+      }
+    }, 2e3);
+  };
+  const timer = setTimeout(() => stop("Managed preparation exceeded its bounded deadline"), input.timeoutMs);
+  process.on("SIGINT", interrupted);
+  process.on("SIGTERM", interrupted);
+  process.on("exit", exiting);
+  child.stdout.on("data", (value) => {
+    size += value.length;
+    if (size > 1e6) stop("Managed preparation output exceeded its bound");
+    else output += value.toString("utf8");
+  });
+  child.stderr.on("data", (value) => {
+    size += value.length;
+    if (size > 1e6) stop("Managed preparation output exceeded its bound");
+  });
+  child.on("error", () => {
+    cleanup();
+    if (!stopped) {
+      stopped = true;
+      reject(new Error("Managed preparation executable was unavailable"));
+    }
+  });
+  child.on("close", (code) => {
+    cleanup();
+    if (stopped) return;
+    stopped = true;
+    if (stopReason) reject(new Error(stopReason));
+    else if (code !== 0) reject(new Error("Managed preparation step failed; the previous active bundle was preserved"));
+    else resolve2({ stdout: output });
+  });
+});
+function switchPointer(base, name, target) {
+  const current = path.join(base, name);
+  if (exists(current)) {
+    const stat = fs.lstatSync(current);
+    if (!stat.isSymbolicLink() || stat.uid !== uid()) throw new Error("Managed active pointer must be an owned symlink");
+  }
+  const temporary = path.join(base, `.pointer-${randomUUID2()}`);
+  fs.symlinkSync(target, temporary);
+  try {
+    fs.renameSync(temporary, current);
+  } finally {
+    if (exists(temporary)) fs.unlinkSync(temporary);
+  }
+}
+async function locked(options, action) {
+  const base = location(options);
+  privateDirectory(base);
+  owned(base, true, true);
+  const lock = path.join(base, ".install.lock");
+  const fd = fs.openSync(lock, "wx", 384);
+  let release = true;
+  try {
+    fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+    return await action(base);
+  } catch (error) {
+    if (error instanceof ManagedInstallerCleanupError) release = false;
+    throw error;
+  } finally {
+    fs.closeSync(fd);
+    if (release) fs.unlinkSync(lock);
+  }
+}
+async function prepareManagedToolchain(options = {}) {
+  if (Number(process.versions.node.split(".")[0]) < 18)
+    throw new Error("Local work requires Node.js 18+; update your system runtime and retry");
+  return locked(options, async (base) => {
+    const active = path.join(base, "active.json");
+    let prior = null;
+    let recovery = null;
+    const preserveInvalidSelection = () => {
+      const pointer = fs.lstatSync(active);
+      if (!pointer.isSymbolicLink() || pointer.uid !== uid()) throw new Error("Repair refuses a foreign or non-symlink active pointer");
+      const target = path.resolve(base, fs.readlinkSync(active));
+      if (path.basename(target) !== "toolchain.json" || path.dirname(path.dirname(target)) !== base)
+        throw new Error("Repair refuses an active pointer outside the owned installation");
+      const root2 = path.dirname(target);
+      owned(root2, true, true);
+      if (fs.realpathSync(root2) !== root2) throw new Error("Repair refuses a linked bundle directory");
+      let previousHash = null;
+      if (exists(target)) {
+        owned(target, false, true);
+        previousHash = sha(bytes(target));
+      }
+      return { priorManifestPath: target, priorManifestSha256: previousHash, priorSelection: "invalid_owned_bundle" };
+    };
+    if (exists(active)) {
+      try {
+        prior = readManagedManifest(active, options);
+      } catch (error) {
+        if (!options.repair) throw error;
+        recovery = preserveInvalidSelection();
+        prior = null;
+      }
+    }
+    const runner = options.runner ?? runManagedInstaller;
+    async function handshake(manifest) {
+      for (const [name, component] of Object.entries(manifest.components)) {
+        const command = name === "companion" ? process.execPath : component.command;
+        const args = name === "companion" ? [component.command, "--version"] : ["--version"];
+        const observed = await runner({ command, args, cwd: manifest.root, env: cleanEnvironment(manifest.root), timeoutMs: 15e3 });
+        if (!new RegExp(`^(?:snipara-${name}[ ,]+)?${component.version.replaceAll(".", "\\.")}$`, "i").test(observed.stdout.trim()))
+          throw new Error("Managed component version handshake did not match the pinned bundle");
+      }
+    }
+    const selectedPrior = prior;
+    if (selectedPrior && Object.entries(MANAGED_VERSIONS).every(([name, version]) => selectedPrior.components[name].version === version)) {
+      try {
+        await handshake(selectedPrior);
+        readManagedManifest(active, options);
+        return selectedPrior;
+      } catch (error) {
+        if (!options.repair) throw error;
+        recovery = preserveInvalidSelection();
+        prior = null;
+      }
+    }
+    const bundleId = `bundle-${MANAGED_VERSIONS.companion}-${MANAGED_VERSIONS.orchestrator}-${MANAGED_VERSIONS.sandbox}-${randomUUID2()}`;
+    const root = path.join(base, bundleId);
+    fs.mkdirSync(root, { mode: 448 });
+    for (const directory of ["home", "tmp"]) fs.mkdirSync(path.join(root, directory), { mode: 448 });
+    const env = cleanEnvironment(root);
+    const run = (command, args, timeoutMs = 3e5) => runner({ command, args, cwd: root, env, timeoutMs });
+    try {
+      if (recovery) writePrivate(path.join(root, "recovery.json"), { schemaVersion: "snipara.toolchain_recovery.v1", ...recovery, originalBundlePreserved: true });
+      const python = options.python ?? program("python3"), npm = options.npm ?? program("npm");
+      if (![python, npm].every((value) => path.isAbsolute(value))) throw new Error("Managed package managers need absolute executable paths");
+      const runtime = await run(python, ["--version"], 1e4);
+      assertManagedRuntimeVersions(process.versions.node, runtime.stdout);
+      const venv = path.join(root, "python"), prefix = path.join(root, "node");
+      await run(python, ["-I", "-m", "venv", venv], 6e4);
+      await run(path.join(venv, "bin/python"), ["-I", "-m", "pip", "install", "--no-input", "--disable-pip-version-check", "snipara-sandbox[validation,mcp]==" + MANAGED_VERSIONS.sandbox, "snipara-orchestrator==" + MANAGED_VERSIONS.orchestrator]);
+      await run(npm, ["install", "--prefix", prefix, "--ignore-scripts", "--no-audit", "--no-fund", "--save-exact", "snipara-companion@" + MANAGED_VERSIONS.companion]);
+      const manifest = {
+        schemaVersion: "snipara.toolchain.v1",
+        bundleId,
+        root,
+        components: {
+          companion: { version: MANAGED_VERSIONS.companion, command: fs.realpathSync(path.join(prefix, "node_modules/.bin/snipara-companion")), sha256: "" },
+          orchestrator: { version: MANAGED_VERSIONS.orchestrator, command: path.join(venv, "bin/snipara-orchestrator"), sha256: "" },
+          sandbox: { version: MANAGED_VERSIONS.sandbox, command: path.join(venv, "bin/snipara-sandbox"), sha256: "" }
+        },
+        contracts: { taskReference: 1, validation: 1 },
+        capabilities: ["validation", "coordination"]
+      };
+      for (const component of Object.values(manifest.components)) {
+        component.command = protectedCommand(root, component.command);
+        component.sha256 = sha(bytes(component.command, 8e6));
+      }
+      const manifestFile = path.join(root, "toolchain.json");
+      writePrivate(manifestFile, parseManagedToolchainManifest(manifest));
+      await handshake(manifest);
+      readManagedManifest(manifestFile, options);
+      writePrivate(path.join(root, "prepared.json"), { schemaVersion: "snipara.toolchain_preparation.v1", status: "prepared", manifestSha256: sha(bytes(manifestFile)), observedAt: (/* @__PURE__ */ new Date()).toISOString(), activationObserved: false });
+      if (prior) switchPointer(base, "previous.json", path.join(prior.root, "toolchain.json"));
+      switchPointer(base, "active.json", manifestFile);
+      return manifest;
+    } catch (error) {
+      writePrivate(path.join(root, "failed.json"), { schemaVersion: "snipara.toolchain_preparation.v1", status: "failed", observedAt: (/* @__PURE__ */ new Date()).toISOString(), reason: "preparation_or_identity_check_failed", priorActivePreserved: true });
+      throw error;
+    }
+  });
+}
+async function rollbackManagedToolchain(options = {}) {
+  return locked(options, async (base) => {
+    const previous = readManagedManifest(path.join(base, "previous.json"), options);
+    let active = null;
+    try {
+      active = readManagedManifest(path.join(base, "active.json"), options);
+    } catch {
+    }
+    switchPointer(base, "active.json", path.join(previous.root, "toolchain.json"));
+    if (active) switchPointer(base, "previous.json", path.join(active.root, "toolchain.json"));
+    return previous;
+  });
+}
+
+// src/managed-config.ts
+import fs2 from "fs";
+import path2 from "path";
+import { execFileSync } from "child_process";
+import { TextDecoder } from "util";
+function mergeManagedMcpServers(existing, native, hosted, sourceBound = false) {
+  return { ...existing, ...sourceBound || existing["snipara-repository"] ? {} : { snipara: hosted }, "snipara-local": native };
+}
+var PARSE = "import json,sys\ntry:\n import tomllib\nexcept ImportError:\n import tomli as tomllib\nvalue=tomllib.loads(sys.stdin.read())\nservers=value.get('mcp_servers',{})\nif not isinstance(servers,dict): raise ValueError('invalid MCP table')\nprint(json.dumps(servers.get('snipara-local'),ensure_ascii=True))";
+function parse(content, options) {
+  try {
+    return JSON.parse(execFileSync(options.python, ["-I", "-B", "-c", PARSE], {
+      input: content,
+      env: options.env,
+      encoding: "utf8",
+      timeout: 5e3,
+      maxBuffer: 1e6,
+      stdio: ["pipe", "pipe", "pipe"]
+    }));
+  } catch {
+    throw new Error("Existing Codex configuration is malformed or its parser is unavailable; file preserved");
+  }
+}
+function object2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function managedCodexSnippet(server) {
+  const env = server.env && Object.keys(server.env).length ? `
+env = { ${Object.entries(server.env).map(([key, value]) => `${JSON.stringify(key)} = ${JSON.stringify(value)}`).join(", ")} }` : "";
+  return `[mcp_servers.snipara-local]
+command = ${JSON.stringify(server.command)}
+args = ${JSON.stringify(server.args)}${env}
+`;
+}
+function mergeManagedCodexConfig(options) {
+  const directory = path2.dirname(options.file);
+  if (!fs2.existsSync(directory)) fs2.mkdirSync(directory, { mode: 448 });
+  const parent = fs2.lstatSync(directory);
+  if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid?.() || parent.mode & 18)
+    throw new Error("Codex configuration directory is not safely owned; preserved");
+  let previous = null;
+  try {
+    const fd2 = fs2.openSync(options.file, fs2.constants.O_RDONLY | fs2.constants.O_NOFOLLOW | fs2.constants.O_NONBLOCK);
+    try {
+      const info = fs2.fstatSync(fd2);
+      if (!info.isFile() || info.uid !== process.getuid?.() || info.nlink !== 1 || info.size > 1e6 || info.mode & 18)
+        throw new Error("Existing Codex configuration is not safely owned; preserved");
+      previous = fs2.readFileSync(fd2);
+      if (previous.length > 1e6) throw new Error("Existing Codex configuration exceeds its bound; preserved");
+    } finally {
+      fs2.closeSync(fd2);
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const content = previous ? new TextDecoder("utf8", { fatal: true }).decode(previous) : options.initialContent ?? "";
+  const selected = parse(content, options);
+  if (selected !== null) {
+    if (!object2(selected) || Object.keys(selected).some((key) => !["command", "args", "env"].includes(key)) || typeof selected.command !== "string" || !Array.isArray(selected.args) || !selected.args.every((value) => typeof value === "string") || selected.env !== void 0 && (!object2(selected.env) || !Object.values(selected.env).every((value) => typeof value === "string")) || !options.validateExisting(selected))
+      throw new Error("Existing managed Codex connection conflicts with setup; file preserved and activation incomplete");
+    return "unchanged";
+  }
+  const result = content + (content ? content.endsWith("\n") ? "\n" : "\n\n" : "") + managedCodexSnippet(options.server);
+  parse(result, options);
+  if (previous && !fs2.readFileSync(options.file).equals(previous))
+    throw new Error("Codex configuration changed during setup; file preserved");
+  if (!previous) {
+    fs2.writeFileSync(options.file, result, { flag: "wx", mode: 384 });
+    return "created";
+  }
+  const fd = fs2.openSync(options.file, fs2.constants.O_WRONLY | fs2.constants.O_APPEND | fs2.constants.O_NOFOLLOW);
+  try {
+    const current = fs2.fstatSync(fd), named = fs2.lstatSync(options.file);
+    if (current.ino !== named.ino || current.dev !== named.dev || current.size !== previous.length || !current.isFile())
+      throw new Error("Codex configuration changed during setup; file preserved");
+    fs2.writeFileSync(fd, result.slice(content.length), "utf8");
+  } finally {
+    fs2.closeSync(fd);
+  }
+  return "appended";
+}
+
+// src/source-connection.ts
+import fs3 from "fs";
+import path3 from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import { TextDecoder as TextDecoder2 } from "util";
+
+// src/source-binding.mjs
+import { createHash as createHash6 } from "crypto";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync
+} from "fs";
+import { spawnSync } from "child_process";
+import { dirname, isAbsolute, join, resolve } from "path";
+var fingerprint = (value) => createHash6("sha256").update(value).digest("hex");
+var SourceBindingError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "SourceBindingError";
+    this.code = code;
+  }
+};
+function fail(code, message) {
+  throw new SourceBindingError(code, message);
+}
+function normalizeRepositoryRemote(remote) {
+  if (typeof remote !== "string" || !remote || remote.length > 2048 || /[\\%\s\x00-\x1f\x7f]/.test(remote) || /\/\.{1,2}(?:\/|$)/.test(remote))
+    fail("unsafe_remote", "Repository remote is unsupported or contains unsafe credentials.");
+  let hostname, port = "", repositoryPath;
+  try {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(remote)) {
+      const url = new URL(remote);
+      if (!["https:", "http:", "ssh:"].includes(url.protocol) || url.password || url.search || url.hash || url.protocol !== "ssh:" && url.username) throw new Error();
+      if (url.username && !/^[A-Za-z0-9_.-]+$/.test(url.username)) throw new Error();
+      hostname = url.hostname.toLowerCase();
+      port = url.port && !(url.protocol === "ssh:" && url.port === "22") ? `:${url.port}` : "";
+      repositoryPath = url.pathname;
+    } else {
+      const match = remote.match(/^(?:([A-Za-z0-9_.-]+)@)?([A-Za-z0-9.-]+):([^:]+)$/);
+      if (!match) throw new Error();
+      hostname = match[2].toLowerCase();
+      repositoryPath = match[3];
+    }
+    repositoryPath = repositoryPath.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (!hostname || !/^[A-Za-z0-9.-]+$/.test(hostname) || !repositoryPath || !/^[A-Za-z0-9_./~-]+$/.test(repositoryPath) || repositoryPath.split("/").some((part) => !part || part === "." || part === "..")) throw new Error();
+  } catch {
+    fail("unsafe_remote", "Repository remote is unsupported or contains unsafe credentials.");
+  }
+  if (["github.com", "gitlab.com", "bitbucket.org"].includes(hostname)) repositoryPath = repositoryPath.toLowerCase();
+  return `${hostname}${port}/${repositoryPath}`;
+}
+function git(cwd, args) {
+  const names = ["PATH", "HOME", "USERPROFILE", "SystemRoot", "WINDIR", "TMPDIR", "TMP", "TEMP"];
+  const env = Object.fromEntries(names.filter((key) => typeof process.env[key] === "string").map((key) => [key, process.env[key]]));
+  const result = spawnSync("git", ["--no-optional-locks", "-C", cwd, ...args], {
+    encoding: "utf8",
+    timeout: 5e3,
+    maxBuffer: 16384,
+    shell: false,
+    env: { ...env, LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" }
+  });
+  if (result.error || result.signal) fail("source_unavailable", "Cannot verify the current repository. Reconnect before using Snipara.");
+  return result;
+}
+function observeSource(workspacePath) {
+  if (typeof workspacePath !== "string" || !workspacePath || !isAbsolute(workspacePath))
+    fail("source_unavailable", "Choose an explicit absolute workspace folder.");
+  let folder;
+  try {
+    folder = realpathSync(workspacePath);
+    if (!lstatSync(folder).isDirectory()) throw new Error();
+  } catch {
+    fail("source_unavailable", "Workspace folder is unavailable.");
+  }
+  const rootResult = git(folder, ["rev-parse", "--show-toplevel"]);
+  if (rootResult.status !== 0) {
+    if (rootResult.status !== 128 || !rootResult.stderr.includes("not a git repository"))
+      fail("source_unavailable", "Cannot verify the current repository. Reconnect before using Snipara.");
+    return { root: folder, kind: "folder", fingerprint: fingerprint(`folder:${folder}`) };
+  }
+  let root;
+  try {
+    root = realpathSync(rootResult.stdout.trim());
+  } catch {
+    fail("source_unavailable", "Repository root is unavailable.");
+  }
+  const remote = git(root, ["config", "--includes", "--get", "remote.origin.url"]);
+  if (remote.status === 0) {
+    const repository = normalizeRepositoryRemote(remote.stdout.replace(/\r?\n$/, ""));
+    return { root, kind: "repository", fingerprint: fingerprint(`repository:${repository}`), repository };
+  }
+  if (remote.status !== 1) fail("source_unavailable", "Cannot verify the repository remote.");
+  const commonResult = git(root, ["rev-parse", "--git-common-dir"]);
+  if (commonResult.status !== 0) fail("source_unavailable", "Cannot verify the local repository identity.");
+  let common;
+  try {
+    common = realpathSync(resolve(root, commonResult.stdout.trim()));
+  } catch {
+    fail("source_unavailable", "Cannot verify the local repository identity.");
+  }
+  return { root, kind: "local-repository", fingerprint: fingerprint(`local-repository:${common}`) };
+}
+
+// src/source-connection.ts
+var object3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function boundedConfiguration(file) {
+  try {
+    const parent = fs3.lstatSync(path3.dirname(file));
+    if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid?.())
+      throw new Error("Native configuration directory is not safely owned; preserve and repair it first");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  let fd;
+  try {
+    fd = fs3.openSync(file, fs3.constants.O_RDONLY | fs3.constants.O_NOFOLLOW | fs3.constants.O_NONBLOCK);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error("Existing native configuration is not a readable regular file; preserve and repair it first");
+  }
+  try {
+    const info = fs3.fstatSync(fd);
+    if (!info.isFile() || info.uid !== process.getuid?.() || info.size > 1e6 || info.mode & 18)
+      throw new Error("Existing native configuration is not safely owned; preserve and repair it first");
+    const value = fs3.readFileSync(fd);
+    if (value.length > 1e6) throw new Error("Native configuration exceeds its read bound");
+    return new TextDecoder2("utf8", { fatal: true }).decode(value);
+  } finally {
+    fs3.closeSync(fd);
+  }
+}
+function operatorPython() {
+  for (const directory of (process.env.PATH ?? "").split(path3.delimiter)) {
+    if (!directory || !path3.isAbsolute(directory)) continue;
+    const candidate = path3.join(directory, "python3");
+    try {
+      fs3.accessSync(candidate, fs3.constants.X_OK);
+      if (fs3.statSync(candidate).isFile()) return fs3.realpathSync(candidate);
+    } catch {
+    }
+  }
+  throw new Error("Reading existing Codex configuration requires Python 3.11+, or Python 3.10 with tomli; no configuration was changed");
+}
+function sourceServer(value, observed) {
+  if (!object3(value) || Object.keys(value).some((key) => !["command", "args"].includes(key)) || typeof value.command !== "string" || !path3.isAbsolute(value.command) || !Array.isArray(value.args) || value.args.length !== 5 || !value.args.every((item) => typeof item === "string") || value.args[1] !== "--source-fingerprint" || value.args[3] !== "--source-kind" || value.args[2] !== observed.fingerprint || value.args[4] !== observed.kind || !path3.isAbsolute(value.args[0]) || path3.basename(value.args[0]) !== "native-mcp.mjs")
+    throw new Error("Existing Snipara repository connection differs from this workspace; reconnect it explicitly before local-work setup");
+  try {
+    const script = value.args[0], info = fs3.lstatSync(script);
+    if (!info.isFile() || info.isSymbolicLink() || info.uid !== process.getuid?.() || info.mode & 18 || fs3.realpathSync(script) !== script || info.size > 256e3 || !fs3.statSync(value.command).isFile()) throw new Error();
+  } catch {
+    throw new Error("Existing Snipara repository launcher is unavailable or unsafe; preserve and repair its connection");
+  }
+}
+function detectSourceConnection(workspace, options = {}) {
+  const observed = observeSource(fs3.realpathSync(workspace));
+  const servers = [];
+  const json = boundedConfiguration(path3.join(observed.root, ".mcp.json"));
+  if (json !== null) {
+    let document;
+    try {
+      document = JSON.parse(json);
+    } catch {
+      throw new Error("Existing MCP JSON is malformed; preserve and repair it before setup");
+    }
+    if (!object3(document) || document.mcpServers !== void 0 && !object3(document.mcpServers))
+      throw new Error("Existing MCP server configuration is invalid; preserve and repair it before setup");
+    servers.push(document.mcpServers ?? {});
+  }
+  const toml = boundedConfiguration(path3.join(observed.root, ".codex/config.toml"));
+  if (toml !== null) {
+    const script = "import json,sys\ntry:\n import tomllib\nexcept ImportError:\n import tomli as tomllib\nvalue=tomllib.loads(sys.stdin.read()).get('mcp_servers',{})\nif not isinstance(value,dict): raise ValueError('invalid servers')\nprint(json.dumps({key:value[key] for key in ['snipara-repository','snipara','snipara-plugin'] if key in value},ensure_ascii=True))";
+    try {
+      servers.push(JSON.parse(execFileSync2(options.python ?? operatorPython(), ["-I", "-B", "-c", script], {
+        input: toml,
+        encoding: "utf8",
+        timeout: 5e3,
+        maxBuffer: 1e6,
+        stdio: ["pipe", "pipe", "pipe"],
+        env: { PATH: process.env.PATH, HOME: process.env.HOME, PYTHONNOUSERSITE: "1" }
+      })));
+    } catch {
+      throw new Error("Existing Codex configuration could not be parsed. Use Python 3.11+, or Python 3.10 with tomli, and repair malformed TOML before retrying; configuration was preserved");
+    }
+  }
+  const selected = servers.filter((entries) => entries["snipara-repository"] !== void 0);
+  if (!selected.length) return null;
+  if (servers.some((entries) => entries.snipara !== void 0 || entries["snipara-plugin"] !== void 0))
+    throw new Error("An existing direct Snipara connection conflicts with the repository connection; preserve and review it before setup");
+  for (const entries of selected) sourceServer(entries["snipara-repository"], observed);
+  return observed;
+}
+
 // src/index.ts
 var VERSION = package_default.version;
 var BASE_URL = "https://www.snipara.com";
@@ -98,7 +874,7 @@ var COMPANION_PACKAGE_NAME = "snipara-companion";
 var COMPANION_COMMAND_NAME = "snipara-companion";
 var COMPANION_NPX_COMMAND = "npx -y snipara-companion@latest";
 var CREATE_SNIPARA_NPX_COMMAND = "npx -y create-snipara@latest";
-var MIN_COMPANION_VERSION = "3.0.0";
+var MIN_COMPANION_VERSION = "3.8.0";
 var GITHUB_ANSWER_PACKS_LABEL = "GitHub PR Answer Packs";
 var MCP_PACKAGE_NAME = "snipara-mcp";
 var SANDBOX_PACKAGE_NAME = "snipara-sandbox[all]";
@@ -139,37 +915,37 @@ var DECISION_COMMIT_TERMS = [
   "switch"
 ];
 function buildActivationId() {
-  return `act_${Date.now().toString(36)}_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+  return `act_${Date.now().toString(36)}_${randomUUID3().replace(/-/g, "").slice(0, 12)}`;
 }
 function getActivationDir() {
-  return path.join(process.cwd(), ".snipara", "activation");
+  return path4.join(process.cwd(), ".snipara", "activation");
 }
 function getActivationManifestPath() {
-  return path.join(getActivationDir(), "manifest.json");
+  return path4.join(getActivationDir(), "manifest.json");
 }
 function getStableActivationManifestPath() {
-  return path.join(getActivationDir(), "activation-manifest.json");
+  return path4.join(getActivationDir(), "activation-manifest.json");
 }
 function getActivationHandoffPath() {
-  return path.join(getActivationDir(), "handoff.md");
+  return path4.join(getActivationDir(), "handoff.md");
 }
 function getFirstWorkBriefPath() {
-  return path.join(getActivationDir(), "first-brief.md");
+  return path4.join(getActivationDir(), "first-brief.md");
 }
 function getMemoryCandidatesPath() {
-  return path.join(getActivationDir(), "memory-candidates.json");
+  return path4.join(getActivationDir(), "memory-candidates.json");
 }
 function getProjectBootstrapJsonPath() {
-  return path.join(getActivationDir(), "project-bootstrap.json");
+  return path4.join(getActivationDir(), "project-bootstrap.json");
 }
 function getProjectBootstrapMarkdownPath() {
-  return path.join(getActivationDir(), "project-bootstrap.md");
+  return path4.join(getActivationDir(), "project-bootstrap.md");
 }
 function writeActivationManifest(manifest) {
-  fs.mkdirSync(getActivationDir(), { recursive: true });
+  fs4.mkdirSync(getActivationDir(), { recursive: true });
   const payload = JSON.stringify(manifest, null, 2) + "\n";
-  fs.writeFileSync(getActivationManifestPath(), payload, "utf8");
-  fs.writeFileSync(getStableActivationManifestPath(), payload, "utf8");
+  fs4.writeFileSync(getActivationManifestPath(), payload, "utf8");
+  fs4.writeFileSync(getStableActivationManifestPath(), payload, "utf8");
 }
 function updateActivationManifest(manifest) {
   manifest.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -188,12 +964,12 @@ function failActivationLane(detail, command, error) {
   };
 }
 function readPackageJsonScripts() {
-  const packageJsonPath = path.join(process.cwd(), "package.json");
-  if (!fs.existsSync(packageJsonPath)) {
+  const packageJsonPath = path4.join(process.cwd(), "package.json");
+  if (!fs4.existsSync(packageJsonPath)) {
     return [];
   }
   try {
-    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(fs4.readFileSync(packageJsonPath, "utf8"));
     return Object.keys(parsed.scripts ?? {}).sort();
   } catch {
     return [];
@@ -254,11 +1030,11 @@ function readDecisionCommitSubjectLines() {
   }
 }
 function readMemoryCandidateLines(relativePath) {
-  const absolutePath = path.join(process.cwd(), relativePath);
-  if (!fs.existsSync(absolutePath) || fs.statSync(absolutePath).isDirectory()) {
+  const absolutePath = path4.join(process.cwd(), relativePath);
+  if (!fs4.existsSync(absolutePath) || fs4.statSync(absolutePath).isDirectory()) {
     return [];
   }
-  const content = fs.readFileSync(absolutePath, "utf8").slice(0, 24e3);
+  const content = fs4.readFileSync(absolutePath, "utf8").slice(0, 24e3);
   return content.split(/\r?\n/).map((line) => line.trim()).filter((line) => /decision|decided|must|should|always|never|convention|rule/i.test(line)).slice(0, 4).map((line) => ({
     source: relativePath,
     text: line.slice(0, 280),
@@ -268,12 +1044,12 @@ function readMemoryCandidateLines(relativePath) {
   }));
 }
 function estimateFileTokens(relativePath) {
-  const absolutePath = path.join(process.cwd(), relativePath);
-  if (!fs.existsSync(absolutePath) || fs.statSync(absolutePath).isDirectory()) {
+  const absolutePath = path4.join(process.cwd(), relativePath);
+  if (!fs4.existsSync(absolutePath) || fs4.statSync(absolutePath).isDirectory()) {
     return 0;
   }
   try {
-    const content = fs.readFileSync(absolutePath, "utf8");
+    const content = fs4.readFileSync(absolutePath, "utf8");
     return Math.ceil(content.length / 4);
   } catch {
     return 0;
@@ -302,12 +1078,12 @@ function buildMemoryCandidatePreviews(scan) {
   }).slice(0, 20);
 }
 function readTextFileSnippet(relativePath, maxChars = 24e3) {
-  const absolutePath = path.join(process.cwd(), relativePath);
-  if (!fs.existsSync(absolutePath) || fs.statSync(absolutePath).isDirectory()) {
+  const absolutePath = path4.join(process.cwd(), relativePath);
+  if (!fs4.existsSync(absolutePath) || fs4.statSync(absolutePath).isDirectory()) {
     return "";
   }
   try {
-    return fs.readFileSync(absolutePath, "utf8").slice(0, maxChars);
+    return fs4.readFileSync(absolutePath, "utf8").slice(0, maxChars);
   } catch {
     return "";
   }
@@ -316,7 +1092,7 @@ function collectDayZeroCorpusDocuments(scan) {
   const documents = [];
   let totalChars = 0;
   const cwd = process.cwd();
-  const rootReadmes = fs.existsSync(cwd) ? fs.readdirSync(cwd).filter((entry) => /^readme(?:\.[a-z0-9_-]+)?\.mdx?$/i.test(entry)).sort() : [];
+  const rootReadmes = fs4.existsSync(cwd) ? fs4.readdirSync(cwd).filter((entry) => /^readme(?:\.[a-z0-9_-]+)?\.mdx?$/i.test(entry)).sort() : [];
   const sources = [
     ...rootReadmes,
     ...listFilesUnder("docs", DAY_ZERO_CORPUS_MAX_FILES * 8),
@@ -429,15 +1205,15 @@ function buildAgentReadinessReport(scan) {
   };
 }
 function writeMemoryCandidates(candidates) {
-  fs.mkdirSync(getActivationDir(), { recursive: true });
-  fs.writeFileSync(
+  fs4.mkdirSync(getActivationDir(), { recursive: true });
+  fs4.writeFileSync(
     getMemoryCandidatesPath(),
     JSON.stringify({ candidates, note: "Review required before durable memory import." }, null, 2) + "\n",
     "utf8"
   );
 }
 function writeInitialHandoff(answers, manifest) {
-  fs.mkdirSync(getActivationDir(), { recursive: true });
+  fs4.mkdirSync(getActivationDir(), { recursive: true });
   const statusLines = readGitStatusPorcelain();
   const recentCommits = readRecentCommitSubjects();
   const lines = [
@@ -470,10 +1246,10 @@ function writeInitialHandoff(answers, manifest) {
     "- Connect GitHub later for PRs, reviews, team sync, and continuous sync.",
     ""
   ];
-  fs.writeFileSync(getActivationHandoffPath(), lines.join("\n"), "utf8");
+  fs4.writeFileSync(getActivationHandoffPath(), lines.join("\n"), "utf8");
 }
 function writeFirstWorkBrief(manifest) {
-  fs.mkdirSync(getActivationDir(), { recursive: true });
+  fs4.mkdirSync(getActivationDir(), { recursive: true });
   const lines = [
     `# ${manifest.firstBrief.title}`,
     "",
@@ -488,40 +1264,40 @@ function writeFirstWorkBrief(manifest) {
       ""
     ])
   ];
-  fs.writeFileSync(getFirstWorkBriefPath(), lines.join("\n"), "utf8");
+  fs4.writeFileSync(getFirstWorkBriefPath(), lines.join("\n"), "utf8");
 }
 function detectLocalActivationScan(detection) {
   const cwd = process.cwd();
-  const exists = (relativePath) => fs.existsSync(path.join(cwd, relativePath));
+  const exists2 = (relativePath) => fs4.existsSync(path4.join(cwd, relativePath));
   const candidateDocs = findDecisionArchaeologySources(cwd);
   const lockfiles = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lockb"].filter(
-    exists
+    exists2
   );
   const packageManagers = [
-    exists("pnpm-lock.yaml") ? "pnpm" : null,
-    exists("package-lock.json") ? "npm" : null,
-    exists("yarn.lock") ? "yarn" : null,
-    exists("bun.lockb") ? "bun" : null
+    exists2("pnpm-lock.yaml") ? "pnpm" : null,
+    exists2("package-lock.json") ? "npm" : null,
+    exists2("yarn.lock") ? "yarn" : null,
+    exists2("bun.lockb") ? "bun" : null
   ].filter((value) => Boolean(value));
-  const rootEntries = fs.existsSync(cwd) ? fs.readdirSync(cwd).slice(0, 250) : [];
+  const rootEntries = fs4.existsSync(cwd) ? fs4.readdirSync(cwd).slice(0, 250) : [];
   const rootExtensions = new Set(
-    rootEntries.map((entry) => path.extname(entry).replace(/^\./, "")).filter(Boolean)
+    rootEntries.map((entry) => path4.extname(entry).replace(/^\./, "")).filter(Boolean)
   );
   const languages = [
-    exists("package.json") || rootExtensions.has("ts") || rootExtensions.has("tsx") ? "typescript" : null,
-    exists("package.json") || rootExtensions.has("js") || rootExtensions.has("jsx") ? "javascript" : null,
-    exists("pyproject.toml") || exists("requirements.txt") || rootExtensions.has("py") ? "python" : null,
-    exists("go.mod") || rootExtensions.has("go") ? "go" : null,
-    exists("Cargo.toml") || rootExtensions.has("rs") ? "rust" : null
+    exists2("package.json") || rootExtensions.has("ts") || rootExtensions.has("tsx") ? "typescript" : null,
+    exists2("package.json") || rootExtensions.has("js") || rootExtensions.has("jsx") ? "javascript" : null,
+    exists2("pyproject.toml") || exists2("requirements.txt") || rootExtensions.has("py") ? "python" : null,
+    exists2("go.mod") || rootExtensions.has("go") ? "go" : null,
+    exists2("Cargo.toml") || rootExtensions.has("rs") ? "rust" : null
   ].filter((value) => Boolean(value));
   return {
     files: {
       candidateDocs,
       lockfiles,
-      hasPackageJson: exists("package.json"),
-      hasPyproject: exists("pyproject.toml"),
-      hasRequirements: exists("requirements.txt"),
-      hasDockerfile: exists("Dockerfile")
+      hasPackageJson: exists2("package.json"),
+      hasPyproject: exists2("pyproject.toml"),
+      hasRequirements: exists2("requirements.txt"),
+      hasDockerfile: exists2("Dockerfile")
     },
     packageManagers,
     languages: [...new Set(languages)],
@@ -547,8 +1323,8 @@ function classifyDecisionSource(relativePath) {
   return "project_document";
 }
 function listFilesUnder(relativeDir, maxFiles) {
-  const root = path.join(process.cwd(), relativeDir);
-  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+  const root = path4.join(process.cwd(), relativeDir);
+  if (!fs4.existsSync(root) || !fs4.statSync(root).isDirectory()) {
     return [];
   }
   const results = [];
@@ -556,13 +1332,13 @@ function listFilesUnder(relativeDir, maxFiles) {
     if (results.length >= maxFiles) {
       return;
     }
-    for (const entry of fs.readdirSync(dir).sort()) {
-      const absolutePath = path.join(dir, entry);
-      const stat = fs.statSync(absolutePath);
+    for (const entry of fs4.readdirSync(dir).sort()) {
+      const absolutePath = path4.join(dir, entry);
+      const stat = fs4.statSync(absolutePath);
       if (stat.isDirectory()) {
         visit(absolutePath);
       } else if (/\.(md|mdx|txt|mdc)$/i.test(entry)) {
-        results.push(path.relative(process.cwd(), absolutePath));
+        results.push(path4.relative(process.cwd(), absolutePath));
       }
       if (results.length >= maxFiles) {
         return;
@@ -577,7 +1353,7 @@ function isCreateSniparaGeneratedInstructionSource(relativePath) {
     return false;
   }
   try {
-    const prefix = fs.readFileSync(path.join(process.cwd(), relativePath), "utf8").slice(0, 4096);
+    const prefix = fs4.readFileSync(path4.join(process.cwd(), relativePath), "utf8").slice(0, 4096);
     return prefix.includes(
       "## Snipara Context Workflow\n\nThis project uses Snipara Hosted MCP for project context and reviewed memory."
     ) || prefix.includes(
@@ -590,15 +1366,15 @@ function isCreateSniparaGeneratedInstructionSource(relativePath) {
   }
 }
 function findDecisionArchaeologySources(cwd) {
-  const exists = (relativePath) => fs.existsSync(path.join(cwd, relativePath));
+  const exists2 = (relativePath) => fs4.existsSync(path4.join(cwd, relativePath));
   const directSources = [
     "README.md",
     "CHANGELOG.md",
     "MEMORY.md",
     ...["AGENTS.md", "CLAUDE.md", ".github/copilot-instructions.md"].filter(
-      (source) => exists(source)
+      (source) => exists2(source)
     )
-  ].filter(exists);
+  ].filter(exists2);
   const archaeologySources = [
     ...listFilesUnder("docs/adr", 20),
     ...listFilesUnder("docs/adrs", 20),
@@ -630,7 +1406,7 @@ function findBoundedProjectFiles(predicate, maxMatches = PROJECT_BOOTSTRAP_MAX_M
     }
     let entries;
     try {
-      entries = fs.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+      entries = fs4.readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
     } catch {
       return;
     }
@@ -638,14 +1414,14 @@ function findBoundedProjectFiles(predicate, maxMatches = PROJECT_BOOTSTRAP_MAX_M
       if (entry.isSymbolicLink()) {
         continue;
       }
-      const absolutePath = path.join(directory, entry.name);
+      const absolutePath = path4.join(directory, entry.name);
       if (entry.isDirectory()) {
         if (!ignoredDirectories.has(entry.name)) {
           visit(absolutePath);
         }
       } else if (entry.isFile()) {
         walkedFiles += 1;
-        const relativePath = path.relative(process.cwd(), absolutePath).replace(/\\/g, "/");
+        const relativePath = path4.relative(process.cwd(), absolutePath).replace(/\\/g, "/");
         if (predicate(relativePath)) {
           results.push(relativePath);
         }
@@ -659,12 +1435,12 @@ function findBoundedProjectFiles(predicate, maxMatches = PROJECT_BOOTSTRAP_MAX_M
   return results;
 }
 function readProjectPackageMetadata() {
-  const packageJsonPath = path.join(process.cwd(), "package.json");
-  if (!fs.existsSync(packageJsonPath)) {
+  const packageJsonPath = path4.join(process.cwd(), "package.json");
+  if (!fs4.existsSync(packageJsonPath)) {
     return { scripts: {}, dependencies: [], workspaces: false };
   }
   try {
-    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(fs4.readFileSync(packageJsonPath, "utf8"));
     const scripts = Object.fromEntries(
       Object.entries(parsed.scripts ?? {}).filter(
         (entry) => typeof entry[1] === "string"
@@ -722,7 +1498,7 @@ function createBootstrapItem(section, title, status, detail, evidence) {
 }
 function buildProjectBootstrap(scan) {
   const cwd = process.cwd();
-  const exists = (relativePath) => fs.existsSync(path.join(cwd, relativePath));
+  const exists2 = (relativePath) => fs4.existsSync(path4.join(cwd, relativePath));
   const packageMetadata = readProjectPackageMetadata();
   const allDetectedFiles = findBoundedProjectFiles(() => true, PROJECT_BOOTSTRAP_MAX_WALKED_FILES);
   const testFiles = allDetectedFiles.filter(
@@ -738,14 +1514,14 @@ function buildProjectBootstrap(scan) {
       (relativePath) => /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(relativePath)
     ),
     ...[".gitlab-ci.yml", "azure-pipelines.yml", "Jenkinsfile", ".circleci/config.yml"].filter(
-      exists
+      exists2
     )
   ].filter((value, index, values) => values.indexOf(value) === index);
   const instructionSources = scan.files.candidateDocs.filter(
     (source) => classifyDecisionSource(source) === "agent_instruction"
   );
   const documentationSources = [
-    ...["README.md", "CHANGELOG.md", "MEMORY.md"].filter(exists),
+    ...["README.md", "CHANGELOG.md", "MEMORY.md"].filter(exists2),
     ...listFilesUnder("docs", 40)
   ].filter((value, index, values) => values.indexOf(value) === index);
   const releaseTags = scan.git.detected ? readBootstrapReleaseTags() : [];
@@ -774,7 +1550,7 @@ function buildProjectBootstrap(scan) {
     );
   }
   const workspaceEvidence = ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json"].filter(
-    exists
+    exists2
   );
   if (packageMetadata.workspaces || workspaceEvidence.length > 0) {
     architecture.push(
@@ -790,7 +1566,7 @@ function buildProjectBootstrap(scan) {
       )
     );
   }
-  for (const directory of ["apps", "packages", "services", "libs"].filter(exists)) {
+  for (const directory of ["apps", "packages", "services", "libs"].filter(exists2)) {
     architecture.push(
       createBootstrapItem(
         "architecture",
@@ -871,7 +1647,7 @@ function buildProjectBootstrap(scan) {
     procedures.push(
       createBootstrapItem(
         "procedures",
-        `CI workflow: ${path.basename(source)}`,
+        `CI workflow: ${path4.basename(source)}`,
         "observed",
         "Automation configuration detected; individual jobs were not interpreted during the bounded scan.",
         [{ source, kind: "ci_workflow" }]
@@ -881,7 +1657,7 @@ function buildProjectBootstrap(scan) {
   const skills = skillFiles.slice(0, 12).map(
     (source) => createBootstrapItem(
       "skills",
-      `Existing skill: ${path.basename(path.dirname(source)) || "root"}`,
+      `Existing skill: ${path4.basename(path4.dirname(source)) || "root"}`,
       "observed",
       "An explicit SKILL.md workflow was found.",
       [{ source, kind: "skill_definition" }]
@@ -1048,11 +1824,11 @@ function buildProjectBootstrap(scan) {
       testFiles.slice(0, 20)
     ),
     releaseHistory: createBootstrapCoverage(
-      releaseTags.length > 0 || exists("CHANGELOG.md") ? "partial" : "unavailable",
-      releaseTags.length > 0 || exists("CHANGELOG.md") ? `Detected ${releaseTags.length} recent tag(s)${exists("CHANGELOG.md") ? " and CHANGELOG.md" : ""}.` : "No Git tags or root CHANGELOG.md were detected.",
+      releaseTags.length > 0 || exists2("CHANGELOG.md") ? "partial" : "unavailable",
+      releaseTags.length > 0 || exists2("CHANGELOG.md") ? `Detected ${releaseTags.length} recent tag(s)${exists2("CHANGELOG.md") ? " and CHANGELOG.md" : ""}.` : "No Git tags or root CHANGELOG.md were detected.",
       [
         ...releaseTags.map((tag) => `git tag ${tag}`),
-        ...exists("CHANGELOG.md") ? ["CHANGELOG.md"] : []
+        ...exists2("CHANGELOG.md") ? ["CHANGELOG.md"] : []
       ]
     ),
     codeGraph: createBootstrapCoverage(
@@ -1079,8 +1855,8 @@ function createBootstrapCoverage(status, detail, sources) {
   return { status, detail, sources };
 }
 function writeProjectBootstrap(report) {
-  fs.mkdirSync(getActivationDir(), { recursive: true });
-  fs.writeFileSync(getProjectBootstrapJsonPath(), JSON.stringify(report, null, 2) + "\n", "utf8");
+  fs4.mkdirSync(getActivationDir(), { recursive: true });
+  fs4.writeFileSync(getProjectBootstrapJsonPath(), JSON.stringify(report, null, 2) + "\n", "utf8");
   const lines = [
     "# PROJECT BOOTSTRAP",
     "",
@@ -1110,7 +1886,7 @@ function writeProjectBootstrap(report) {
     `**${report.reviewPrompt}**`,
     ""
   ];
-  fs.writeFileSync(getProjectBootstrapMarkdownPath(), lines.join("\n"), "utf8");
+  fs4.writeFileSync(getProjectBootstrapMarkdownPath(), lines.join("\n"), "utf8");
 }
 function addProjectBootstrapToFirstWorkBrief(manifest, report) {
   manifest.firstBrief.sections.splice(1, 0, {
@@ -1200,6 +1976,7 @@ function createActivationManifest(answers, detection, mode = "default", scan) {
   const surfaceContract = buildActivationSurfaceContract(answers.aiClient);
   return {
     activationId: buildActivationId(),
+    profile: answers.profile,
     mode,
     deployment: answers.deployment,
     serverUrl: answers.serverUrl,
@@ -1283,8 +2060,8 @@ function createActivationManifest(answers, detection, mode = "default", scan) {
       )
     },
     artifacts: {
-      activationManifestPath: path.relative(process.cwd(), getStableActivationManifestPath()),
-      legacyManifestPath: path.relative(process.cwd(), getActivationManifestPath()),
+      activationManifestPath: path4.relative(process.cwd(), getStableActivationManifestPath()),
+      legacyManifestPath: path4.relative(process.cwd(), getActivationManifestPath()),
       firstBriefPath: null,
       handoffPath: null,
       memoryCandidatesPath: null,
@@ -1302,7 +2079,8 @@ function runLocalSourceActivation(answers, manifest) {
     updateActivationManifest(manifest);
     return;
   }
-  const companionCommand = detectCompanionCommand();
+  const managed = answers.profile === "local-work" ? answers.managedToolchain ?? managedToolchainStatus().manifest : null;
+  const companionCommand = managed?.components.companion.command ?? detectCompanionCommand();
   if (!companionCommand) {
     const detail = `${COMPANION_COMMAND_NAME} ${MIN_COMPANION_VERSION}+ is not on PATH after setup.`;
     manifest.lanes.localSnapshot = createActivationLane("skipped", detail);
@@ -1315,12 +2093,14 @@ function runLocalSourceActivation(answers, manifest) {
   const syncCommand = `${companionCommand} source sync --json`;
   const spinner = ora("Activating local Project Intelligence").start();
   try {
-    execSync(initCommand, {
+    const runOptions = {
       cwd: process.cwd(),
-      encoding: "utf-8",
+      encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 3e4
-    });
+    };
+    if (managed) execFileSync3(process.execPath, [companionCommand, "source", "init", "."], runOptions);
+    else execSync(initCommand, runOptions);
     manifest.lanes.localSnapshot = createActivationLane(
       "ready",
       "Local source snapshot created.",
@@ -1337,12 +2117,14 @@ function runLocalSourceActivation(answers, manifest) {
     return;
   }
   try {
-    execSync(syncCommand, {
+    const runOptions = {
       cwd: process.cwd(),
-      encoding: "utf-8",
+      encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 45e3
-    });
+    };
+    if (managed) execFileSync3(process.execPath, [companionCommand, "source", "sync", "--json"], runOptions);
+    else execSync(syncCommand, runOptions);
     manifest.lanes.contextIndex = createActivationLane(
       "indexing",
       "Local documents submitted for context indexing.",
@@ -1564,11 +2346,11 @@ function extractMcpText(data) {
 function createActivationArtifacts(answers, manifest) {
   const projectBootstrap = buildProjectBootstrap(manifest.localScan);
   writeProjectBootstrap(projectBootstrap);
-  manifest.artifacts.projectBootstrapJsonPath = path.relative(
+  manifest.artifacts.projectBootstrapJsonPath = path4.relative(
     process.cwd(),
     getProjectBootstrapJsonPath()
   );
-  manifest.artifacts.projectBootstrapMarkdownPath = path.relative(
+  manifest.artifacts.projectBootstrapMarkdownPath = path4.relative(
     process.cwd(),
     getProjectBootstrapMarkdownPath()
   );
@@ -1580,21 +2362,21 @@ function createActivationArtifacts(answers, manifest) {
   addProjectBootstrapToFirstWorkBrief(manifest, projectBootstrap);
   const candidates = buildMemoryCandidatePreviews(manifest.localScan);
   writeMemoryCandidates(candidates);
-  manifest.artifacts.memoryCandidatesPath = path.relative(process.cwd(), getMemoryCandidatesPath());
+  manifest.artifacts.memoryCandidatesPath = path4.relative(process.cwd(), getMemoryCandidatesPath());
   manifest.lanes.memoryCandidates = createActivationLane(
     candidates.length > 0 ? "needs_review" : "skipped",
     candidates.length > 0 ? `${candidates.length} memory candidates prepared for review; none were imported.` : "No memory candidates found in local docs.",
     manifest.artifacts.memoryCandidatesPath
   );
   writeInitialHandoff(answers, manifest);
-  manifest.artifacts.handoffPath = path.relative(process.cwd(), getActivationHandoffPath());
+  manifest.artifacts.handoffPath = path4.relative(process.cwd(), getActivationHandoffPath());
   manifest.lanes.handoff = createActivationLane(
     "ready",
     "Initial local handoff created.",
     manifest.artifacts.handoffPath
   );
   writeFirstWorkBrief(manifest);
-  manifest.artifacts.firstBriefPath = path.relative(process.cwd(), getFirstWorkBriefPath());
+  manifest.artifacts.firstBriefPath = path4.relative(process.cwd(), getFirstWorkBriefPath());
   manifest.lanes.firstBrief = createActivationLane(
     "ready",
     "First Work Brief generated from local setup and scan signals.",
@@ -1683,61 +2465,71 @@ function shouldInstallDefaultHooks(aiClient) {
   return aiClient === "claude-code" || aiClient === "codex";
 }
 function buildProgram() {
-  const program = new Command();
-  program.name("create-snipara").description("Connect Snipara Cloud or a self-hosted Snipara Server with a fast proof of value").version(VERSION);
-  program.command("init").description("Install and configure Snipara for this project").option("--api-key <key>", "Snipara API key").option("--slug <slug>", "Project slug").option("--project-id <id>", "Project ID").option(
+  const program2 = new Command();
+  program2.name("create-snipara").description("Connect Snipara Cloud or a self-hosted Snipara Server with a fast proof of value").version(VERSION);
+  const toolchain = program2.command("toolchain").description("Prepare or inspect private local-work components");
+  toolchain.command("prepare").description("Prepare the compatible local-work bundle and switch only after checks").action(async () => {
+    console.log(JSON.stringify(await prepareManagedToolchain(), null, 2));
+  });
+  toolchain.command("status").description("Inspect the active bundle without installing or activating").action(() => {
+    console.log(JSON.stringify(managedToolchainStatus(), null, 2));
+  });
+  toolchain.command("rollback").description("Select the previous valid bundle; retain task state and evidence").action(async () => {
+    console.log(JSON.stringify(await rollbackManagedToolchain(), null, 2));
+  });
+  program2.command("init").description("Install and configure Snipara for this project").option("--api-key <key>", "Snipara API key").option("--slug <slug>", "Project slug").option("--project-id <id>", "Project ID").option(
     "--client <client>",
     "AI client: claude-code, cursor, kimi, codex, gemini, mistral, chatgpt, vscode, continue, claude-desktop, other"
-  ).option("--advanced", "Show advanced profile, project id, hooks, GitHub, and sandbox prompts").option(
+  ).option("--advanced", "Show advanced profile, project id, hooks, GitHub, and sandbox prompts").option("--connect-context", "Optionally connect project context during local-work setup").option(
     "--profile <profile>",
-    "Install profile: hosted-only, hosted-companion, full-stack, runtime-only"
+    "Install profile: hosted-only (Context), local-work, hosted-companion, full-stack, runtime-only"
   ).option("--deployment <deployment>", "Deployment: hosted or self-hosted").option("--self-hosted", "Use an existing self-hosted Snipara MCP server").option("--server-url <url>", "Self-hosted MCP endpoint URL").option("--skip-companion", "Skip local companion CLI installation").option("--skip-mcp", "Skip local snipara-mcp package installation").option("--skip-runtime", "Skip snipara-sandbox installation").option("--skip-hooks", "Skip hook generation").option("--skip-test", "Skip MCP connection and value-proof checks").option("--with-orchestrator", "Install optional snipara-orchestrator package").option("--github", "Open GitHub repository automation setup when a git remote is detected").option("--skip-github", "Skip the GitHub automation prompt").option("--github-path <path>", "Optional GitHub path filter for the initial repository sync").option("--starter", "Mark this run as a starter activation and print dashboard-first guidance").option("--json", "Print a machine-readable activation summary after setup").option("--runtime-only", "Install only Snipara Sandbox").addOption(new Option("--full", "Legacy alias for --profile full-stack").hideHelp()).option("-y, --yes", "Accept defaults without prompting").action(async (options) => {
     printBanner();
     await runInit(options);
   });
-  program.command("doctor").description("Inspect the current project and write a validation report").option(
+  program2.command("doctor").description("Inspect the current project and write a validation report").option(
     "--client <client>",
     "Run client-specific diagnostics: claude, claude-code, claude-desktop, cursor, codex, etc."
   ).option("--skip-npm-check", "Skip npm latest-version freshness check").option("--json", "Print the report as JSON").action(async (options) => {
     printBanner();
     await runDoctor(options);
   });
-  program.command("repair").description("Rebuild local Snipara config and re-run validation").option("--api-key <key>", "Snipara API key override").option("--slug <slug>", "Project slug override").option("--project-id <id>", "Project ID override").option("--profile <profile>", "Target install profile").option("--deployment <deployment>", "Deployment: hosted or self-hosted").option("--self-hosted", "Use an existing self-hosted Snipara MCP server").option("--server-url <url>", "Self-hosted MCP endpoint URL").option("--with-hooks", "Force hook generation").option("--with-runtime", "Force Snipara Sandbox server/config").option("--with-mcp", "Force MCP config").option("--with-companion", "Force companion pack generation").option("--with-orchestrator", "Install optional snipara-orchestrator package").action(async (options) => {
+  program2.command("repair").description("Rebuild local Snipara config and re-run validation").option("--api-key <key>", "Snipara API key override").option("--slug <slug>", "Project slug override").option("--project-id <id>", "Project ID override").option("--profile <profile>", "Target install profile").option("--deployment <deployment>", "Deployment: hosted or self-hosted").option("--self-hosted", "Use an existing self-hosted Snipara MCP server").option("--server-url <url>", "Self-hosted MCP endpoint URL").option("--with-hooks", "Force hook generation").option("--with-runtime", "Force Snipara Sandbox server/config").option("--with-mcp", "Force MCP config").option("--with-companion", "Force companion pack generation").option("--with-orchestrator", "Install optional snipara-orchestrator package").action(async (options) => {
     printBanner();
     await runRepair(options);
   });
-  program.command("demo").description("Open the guided Snipara activation demo without changing this repository").option("--no-open", "Print demo links without opening a browser").action((options) => {
+  program2.command("demo").description("Open the guided Snipara activation demo without changing this repository").option("--no-open", "Print demo links without opening a browser").action((options) => {
     printBanner();
     runDemo(options);
   });
-  program.command("upgrade").description("Upgrade installed Snipara local components").option("--slug <slug>", "Project slug override").option("--with-hooks", "Refresh hooks after upgrade").option("--with-runtime", "Upgrade Snipara Sandbox even if not detected").option("--with-mcp", "Upgrade snipara-mcp even if not detected").option("--with-companion", "Upgrade companion even if not detected").option("--with-orchestrator", "Upgrade snipara-orchestrator even if not detected").action(async (options) => {
+  program2.command("upgrade").description("Upgrade installed Snipara local components").option("--slug <slug>", "Project slug override").option("--with-hooks", "Refresh hooks after upgrade").option("--with-runtime", "Upgrade Snipara Sandbox even if not detected").option("--with-mcp", "Upgrade snipara-mcp even if not detected").option("--with-companion", "Upgrade companion even if not detected").option("--with-orchestrator", "Upgrade snipara-orchestrator even if not detected").action(async (options) => {
     printBanner();
     await runUpgrade(options);
   });
-  program.command("print-config").description("Print detected local setup and inferred install profile").option("--json", "Print JSON instead of a formatted summary").action(async (options) => {
+  program2.command("print-config").description("Print detected local setup and inferred install profile").option("--json", "Print JSON instead of a formatted summary").action(async (options) => {
     printBanner();
     await runPrintConfig(options);
   });
-  addSharedRootOptions(program);
-  program.action(async (options) => {
+  addSharedRootOptions(program2);
+  program2.action(async (options) => {
     printBanner();
     await runInit(options);
   });
-  return program;
+  return program2;
 }
-function addSharedRootOptions(program) {
-  program.option("--api-key <key>", "Snipara API key").option("--slug <slug>", "Project slug").option("--project-id <id>", "Project ID").option(
+function addSharedRootOptions(program2) {
+  program2.option("--api-key <key>", "Snipara API key").option("--slug <slug>", "Project slug").option("--project-id <id>", "Project ID").option(
     "--client <client>",
     "AI client: claude-code, cursor, kimi, codex, gemini, mistral, chatgpt, vscode, continue, claude-desktop, other"
-  ).option("--advanced", "Show advanced profile, project id, hooks, GitHub, and sandbox prompts").option(
+  ).option("--advanced", "Show advanced profile, project id, hooks, GitHub, and sandbox prompts").option("--connect-context", "Optionally connect project context during local-work setup").option(
     "--profile <profile>",
-    "Install profile: hosted-only, hosted-companion, full-stack, runtime-only"
+    "Install profile: hosted-only (Context), local-work, hosted-companion, full-stack, runtime-only"
   ).option("--deployment <deployment>", "Deployment: hosted or self-hosted").option("--self-hosted", "Use an existing self-hosted Snipara MCP server").option("--server-url <url>", "Self-hosted MCP endpoint URL").option("--skip-companion", "Skip local companion CLI installation").option("--skip-mcp", "Skip local snipara-mcp package installation").option("--skip-runtime", "Skip snipara-sandbox installation").option("--skip-hooks", "Skip hook generation").option("--skip-test", "Skip MCP connection and value-proof checks").option("--with-orchestrator", "Install optional snipara-orchestrator package").option("--github", "Open GitHub repository automation setup when a git remote is detected").option("--skip-github", "Skip the GitHub automation prompt").option("--github-path <path>", "Optional GitHub path filter for the initial repository sync").option("--starter", "Mark this run as a starter activation and print dashboard-first guidance").option("--json", "Print a machine-readable activation summary after setup").option("--runtime-only", "Install only Snipara Sandbox").addOption(new Option("--full", "Legacy alias for --profile full-stack").hideHelp()).option("-y, --yes", "Accept defaults without prompting");
 }
 async function main() {
-  const program = buildProgram();
+  const program2 = buildProgram();
   normalizeLegacyArgAliases(process.argv);
-  await program.parseAsync(process.argv);
+  await program2.parseAsync(process.argv);
 }
 function normalizeLegacyArgAliases(argv) {
   for (let index = 2; index < argv.length; index += 1) {
@@ -1822,6 +2614,7 @@ function parseInitOptionsFromArgv(args) {
   };
   const booleanFlags = {
     "--advanced": "advanced",
+    "--connect-context": "connectContext",
     "--skip-companion": "skipCompanion",
     "--skip-mcp": "skipMcp",
     "--skip-runtime": "skipRuntime",
@@ -1864,12 +2657,15 @@ function parseInitOptionsFromArgv(args) {
 async function runInit(options) {
   const normalizedOptions = normalizeInitOptions(options);
   const answers = await gatherConfiguration(normalizedOptions);
-  const activationDetection = detectEnvironment();
-  const activationScan = detectLocalActivationScan(activationDetection);
-  if (answers.installMcp || answers.installRuntime || answers.installOrchestrator) {
+  const activationDetection = detectEnvironment(answers.profile === "local-work");
+  const activationScan = managedSetupOnly(answers) ? void 0 : detectLocalActivationScan(activationDetection);
+  if (answers.profile === "local-work") {
+    assertManagedMcpConfig();
+    answers.managedToolchain = await prepareManagedToolchain();
+  } else if (answers.installMcp || answers.installRuntime || answers.installOrchestrator) {
     await installPythonPackages(answers, false);
   }
-  if (answers.installCompanion) {
+  if (answers.installCompanion && answers.profile !== "local-work") {
     await installNodeCompanion(false);
   }
   if (answers.profile !== "runtime-only" || answers.installRuntime) {
@@ -1878,6 +2674,10 @@ async function runInit(options) {
   if (answers.aiClient === "claude-code" && answers.profile !== "runtime-only") {
     await createClaudeCodeConfig(answers);
   }
+  if (managedSetupOnly(answers)) {
+    await finishManagedLocalWork(answers, normalizedOptions.json);
+    return;
+  }
   await createProjectBinding(answers);
   await createAgentTemplates(answers);
   if (answers.installHooks && answers.aiClient === "claude-code") {
@@ -1965,16 +2765,23 @@ async function runDoctor(options) {
 async function runRepair(options) {
   const answers = loadExistingAnswers(options);
   console.log(chalk.bold("\n\u{1F6E0}\uFE0F  Repairing Local Setup\n"));
-  if (answers.installMcp || answers.installRuntime || answers.installOrchestrator) {
+  if (answers.profile === "local-work") {
+    assertManagedMcpConfig();
+    answers.managedToolchain = await prepareManagedToolchain({ repair: true });
+  } else if (answers.installMcp || answers.installRuntime || answers.installOrchestrator) {
     await installPythonPackages(answers, true);
   }
-  if (answers.installCompanion) {
+  if (answers.installCompanion && answers.profile !== "local-work") {
     await installNodeCompanion(true);
   }
   await createMcpConfig(answers);
   if (answers.aiClient === "claude-code" && answers.profile !== "runtime-only") {
     await createClaudeCodeConfig(answers);
   }
+  if (managedSetupOnly(answers)) {
+    await finishManagedLocalWork(answers);
+    return;
+  }
   await createProjectBinding(answers);
   await createAgentTemplates(answers);
   await updateEnvFiles(answers);
@@ -1989,7 +2796,7 @@ async function runRepair(options) {
   printDoctorReport(detectEnvironment(), report);
 }
 async function runUpgrade(options) {
-  const detection = detectEnvironment();
+  const detection = detectEnvironment(hasLocalWorkSelection());
   const answers = loadExistingAnswers(options);
   const upgradedAnswers = {
     ...answers,
@@ -1998,18 +2805,25 @@ async function runUpgrade(options) {
     installOrchestrator: options.withOrchestrator || answers.installOrchestrator
   };
   console.log(chalk.bold("\n\u2B06\uFE0F  Upgrading Local Components\n"));
-  if (options.withMcp || options.withRuntime || options.withOrchestrator || detection.existingConfig.hasRuntimeServer || detection.tooling.orchestratorCli) {
+  if (answers.profile === "local-work") {
+    assertManagedMcpConfig();
+    upgradedAnswers.managedToolchain = await prepareManagedToolchain();
+  } else if (options.withMcp || options.withRuntime || options.withOrchestrator || detection.existingConfig.hasRuntimeServer || detection.tooling.orchestratorCli) {
     await installPythonPackages(upgradedAnswers, true);
   }
-  if (options.withCompanion || detection.tooling.companionCli || answers.installCompanion) {
+  if (answers.profile !== "local-work" && (options.withCompanion || detection.tooling.companionCli || answers.installCompanion)) {
     await installNodeCompanion(true);
   }
-  if (options.withMcp || options.withRuntime || detection.files.mcpConfig) {
+  if (answers.profile === "local-work" || options.withMcp || options.withRuntime || detection.files.mcpConfig) {
     await createMcpConfig(upgradedAnswers);
   }
   if (upgradedAnswers.aiClient === "claude-code" && upgradedAnswers.profile !== "runtime-only") {
     await createClaudeCodeConfig(upgradedAnswers);
   }
+  if (managedSetupOnly(upgradedAnswers)) {
+    await finishManagedLocalWork(upgradedAnswers);
+    return;
+  }
   await createProjectBinding(upgradedAnswers);
   await createAgentTemplates(upgradedAnswers);
   await createCompanionConfig(upgradedAnswers);
@@ -2119,13 +2933,13 @@ async function gatherConfiguration(options) {
   }
   const initialProfile = resolveRequestedProfile(options);
   const initialDeployment = resolveRequestedDeployment(options);
-  const initialServerUrl = normalizeMcpEndpoint(
+  const initialServerUrl = initialProfile === "local-work" && (!options.connectContext || hasBoundLocalWorkSource("local-work")) ? "http://localhost:8000/mcp/local" : normalizeMcpEndpoint(
     options.serverUrl || process.env.SNIPARA_MCP_URL || getExistingConfig()?.serverUrl || "http://localhost:8000/mcp/local"
   );
   const defaultProjectSlug = options.slug || detectedSlug || (initialDeployment === "self-hosted" ? extractSlugFromMcpEndpoint(initialServerUrl) || "local" : "");
   const optionApiKey = options.apiKey?.trim();
   const environmentApiKey = options.yes ? initialDeployment === "self-hosted" ? process.env.SNIPARA_LOCAL_API_KEY?.trim() || process.env.SNIPARA_API_KEY?.trim() : process.env.SNIPARA_API_KEY?.trim() : void 0;
-  const providedApiKey = optionApiKey || environmentApiKey;
+  const providedApiKey = initialProfile === "local-work" && (!options.connectContext || hasBoundLocalWorkSource("local-work")) ? void 0 : optionApiKey || environmentApiKey;
   if (providedApiKey && !isValidApiKey(providedApiKey, initialDeployment)) {
     throw new Error(manualApiKeyValidationMessage(initialDeployment));
   }
@@ -2141,6 +2955,7 @@ async function gatherConfiguration(options) {
       apiKey: providedApiKey || "YOUR_API_KEY_HERE",
       apiKeyType: providedApiKey ? "api" : "none",
       profile: initialProfile,
+      connectContext: options.connectContext,
       aiClient: requestedClient || detectedClient,
       skipCompanion: !!options.skipCompanion,
       skipMcp: !!options.skipMcp,
@@ -2188,27 +3003,27 @@ async function gatherConfiguration(options) {
       }
     },
     {
-      type: showAdvancedPrompts ? "select" : null,
+      type: options.profile ? null : "select",
       name: "profile",
-      message: "Choose an install profile:",
-      initial: installProfileChoices().findIndex((choice) => choice.value === initialProfile),
-      choices: installProfileChoices()
+      message: "How will you use Snipara?",
+      initial: Math.max(0, installProfileChoices(showAdvancedPrompts).findIndex((choice) => choice.value === initialProfile)),
+      choices: installProfileChoices(showAdvancedPrompts)
     },
     {
-      type: "text",
+      type: (_, values) => (values.profile || initialProfile) === "local-work" && (!options.connectContext || hasBoundLocalWorkSource("local-work")) ? null : "text",
       name: "projectSlug",
       message: "Project slug:",
       initial: defaultProjectSlug,
       validate: (value) => value.length > 0 ? true : "Project slug is required (for example my-project)"
     },
     {
-      type: showAdvancedPrompts ? "text" : null,
+      type: showAdvancedPrompts && (initialProfile !== "local-work" || options.connectContext) ? "text" : null,
       name: "projectId",
       message: "Project ID (optional, press Enter to skip):",
       initial: options.projectId || detectedProjectId || ""
     },
     {
-      type: (_, values) => values.profile === "runtime-only" || providedApiKey ? null : "select",
+      type: (_, values) => values.profile === "runtime-only" || providedApiKey || (values.profile || initialProfile) === "local-work" && (!options.connectContext || hasBoundLocalWorkSource("local-work")) ? null : "select",
       name: "apiKeyType",
       message: (_, values) => values.deployment === "self-hosted" || initialDeployment === "self-hosted" ? "How do you want to add the self-hosted operator API key?" : "How do you want to add your Snipara API key?",
       choices: (_, values) => values.deployment === "self-hosted" || initialDeployment === "self-hosted" ? [
@@ -2308,13 +3123,14 @@ async function gatherConfiguration(options) {
     }
   }
   const answers = buildAnswersFromProfile({
-    projectSlug: signupResult?.projectSlug || response.projectSlug,
+    projectSlug: signupResult?.projectSlug || response.projectSlug || defaultProjectSlug || "existing-source",
     projectId: signupResult?.projectId || response.projectId || options.projectId || "",
     deployment: selectedDeployment,
     serverUrl: selectedServerUrl,
     apiKey: apiKey || "",
     apiKeyType,
     profile: response.profile || initialProfile,
+    connectContext: options.connectContext,
     aiClient: requestedClient || response.aiClient || detectedClient,
     skipCompanion: !!options.skipCompanion,
     skipMcp: !!options.skipMcp,
@@ -2327,7 +3143,7 @@ async function gatherConfiguration(options) {
     githubRepo: detectedGitRepo || void 0,
     githubPath: response.githubPath || options.githubPath
   });
-  if (answers.installRuntime) {
+  if (answers.installRuntime && answers.profile !== "local-work") {
     const runtimeResponse = await prompts([
       {
         type: "select",
@@ -2418,7 +3234,7 @@ function getDeploymentLabel(deployment) {
   return deployment === "self-hosted" ? "self-hosted Snipara Server" : "Snipara Cloud";
 }
 function isInstallProfile(value) {
-  return ["hosted-only", "hosted-companion", "full-stack", "runtime-only"].includes(value);
+  return ["hosted-only", "local-work", "hosted-companion", "full-stack", "runtime-only"].includes(value);
 }
 function normalizeClientOption(value) {
   if (!value) {
@@ -2457,13 +3273,21 @@ function normalizeClientOption(value) {
   }
   return client;
 }
-function installProfileChoices() {
-  return [
+function installProfileChoices(advanced = true) {
+  const normal = [
     {
-      title: "Hosted only",
+      title: "Context",
       value: "hosted-only",
-      description: "Default: hosted MCP config, no local companion, hooks, or sandbox"
+      description: "Connect hosted project knowledge to your agent"
     },
+    {
+      title: "Local work",
+      value: "local-work",
+      description: "Work locally; automatically reuse a connected repository's optional context"
+    }
+  ];
+  return advanced ? [
+    ...normal,
     {
       title: "Hosted + Companion",
       value: "hosted-companion",
@@ -2479,9 +3303,11 @@ function installProfileChoices() {
       value: "runtime-only",
       description: "Snipara Sandbox execution only, no hosted API key required"
     }
-  ];
+  ] : normal;
 }
 function buildAnswersFromProfile(input) {
+  if (input.profile === "local-work" && (input.skipCompanion || input.skipRuntime))
+    throw new Error("local-work requires the complete managed bundle; choose hosted-only to skip local components");
   const defaults = {
     "hosted-only": {
       installCompanion: false,
@@ -2489,6 +3315,12 @@ function buildAnswersFromProfile(input) {
       installRuntime: false,
       installHooks: false
     },
+    "local-work": {
+      installCompanion: true,
+      installMcp: false,
+      installRuntime: true,
+      installHooks: false
+    },
     "hosted-companion": {
       installCompanion: true,
       installMcp: false,
@@ -2513,14 +3345,15 @@ function buildAnswersFromProfile(input) {
     projectSlug: input.projectSlug,
     projectId: input.projectId,
     deployment: input.deployment,
-    serverUrl: input.deployment === "hosted" ? `${API_URL}/mcp/${encodeURIComponent(input.projectSlug)}` : normalizeMcpEndpoint(input.serverUrl),
+    serverUrl: input.profile === "local-work" && (!input.connectContext || hasBoundLocalWorkSource("local-work")) ? "" : input.deployment === "hosted" ? `${API_URL}/mcp/${encodeURIComponent(input.projectSlug)}` : normalizeMcpEndpoint(input.serverUrl),
     apiKey: input.apiKey || "YOUR_API_KEY_HERE",
     apiKeyType: input.profile === "runtime-only" ? "none" : input.apiKeyType,
     profile: input.profile,
+    connectContext: input.profile === "local-work" ? Boolean(input.connectContext) : true,
     installCompanion: selected.installCompanion && !input.skipCompanion,
     installMcp: selected.installMcp && !input.skipMcp,
     installRuntime: selected.installRuntime && !input.skipRuntime,
-    installOrchestrator: input.withOrchestrator,
+    installOrchestrator: input.profile === "local-work" || input.withOrchestrator,
     installHooks: selected.installHooks && !input.skipHooks,
     aiClient: input.aiClient,
     configureGitHub: Boolean(input.configureGitHub && input.githubRepo),
@@ -2686,7 +3519,7 @@ function runDemo(options) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function isValidApiKey(value, deployment) {
   const trimmed = value.trim();
@@ -2890,36 +3723,126 @@ async function installNodeCompanion(upgrade) {
   console.log(chalk.gray(`   npm install -g ${COMPANION_PACKAGE_NAME}@latest
 `));
 }
+function assertManagedMcpConfig(file = path4.join(process.cwd(), ".mcp.json")) {
+  sourceConnectionObservation = { workspace: fs4.realpathSync(process.cwd()), source: detectSourceConnection(process.cwd()) };
+  if (!fs4.existsSync(file)) {
+    try {
+      fs4.lstatSync(file);
+      throw new Error("Managed configuration cannot replace a linked path");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    return;
+  }
+  const info = fs4.lstatSync(file);
+  if (!info.isFile() || info.isSymbolicLink() || info.size > 1e6)
+    throw new Error("Existing .mcp.json is not a bounded regular configuration; preserve and repair it first");
+  const value = JSON.parse(fs4.readFileSync(file, "utf8"));
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Existing .mcp.json is invalid");
+  const servers = value.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) throw new Error("Existing MCP servers are invalid");
+  const native = servers["snipara-local"];
+  if (native !== void 0 && !isManagedNativeServer(native))
+    throw new Error("Existing snipara-local connection was preserved; choose another name before managed setup");
+}
+function isManagedNativeServer(value) {
+  const server = asObjectRecord(value);
+  return typeof server.command === "string" && Array.isArray(server.args) && server.args[1] === "toolchain" && server.args[2] === "mcp" && server.args[3] === "--workspace-root" && server.args.length === 5 && typeof server.args[0] === "string" && typeof server.args[4] === "string";
+}
+function validManagedBootstrap(server, manifest) {
+  if (!isManagedNativeServer(server) || server.command !== process.execPath || server.args[4] !== observeSource(fs4.realpathSync(process.cwd())).root || Object.keys(server.env ?? {}).length > 0)
+    return false;
+  const command = server.args[0], base = path4.dirname(manifest.root);
+  if (!path4.isAbsolute(command) || !command.startsWith(base + path4.sep)) return false;
+  return verifyRetainedCompanionBootstrap(command, manifest);
+}
+function managedNativeServer(answers) {
+  const manifest = answers.managedToolchain ?? managedToolchainStatus().manifest;
+  if (!manifest) throw new Error("Prepare the local-work toolchain before configuring this workspace");
+  const existing = asObjectRecord(asObjectRecord(readJsonFile(path4.join(process.cwd(), ".mcp.json"))).mcpServers)["snipara-local"];
+  if (isManagedNativeServer(existing)) {
+    const selected = existing;
+    if (!validManagedBootstrap(selected, manifest)) throw new Error("Existing managed bootstrap differs from its retained bundle; configuration was preserved");
+    return selected;
+  }
+  return {
+    type: "stdio",
+    command: process.execPath,
+    args: [manifest.components.companion.command, "toolchain", "mcp", "--workspace-root", observeSource(fs4.realpathSync(process.cwd())).root]
+  };
+}
+function hasLocalWorkSelection() {
+  const native = asObjectRecord(asObjectRecord(readJsonFile(path4.join(process.cwd(), ".mcp.json"))).mcpServers)["snipara-local"];
+  const activation = asObjectRecord(readJsonFile(getStableActivationManifestPath()));
+  return isManagedNativeServer(native) || activation.profile === "local-work";
+}
+function hasBoundLocalWorkSource(profile) {
+  if (profile !== "local-work") return false;
+  const workspace = fs4.realpathSync(process.cwd());
+  if (!sourceConnectionObservation || sourceConnectionObservation.workspace !== workspace)
+    sourceConnectionObservation = { workspace, source: detectSourceConnection(workspace) };
+  return sourceConnectionObservation.source !== null;
+}
+var sourceConnectionObservation = null;
+function managedSetupOnly(answers) {
+  return answers.profile === "local-work" && (!answers.connectContext || hasBoundLocalWorkSource(answers.profile));
+}
+async function finishManagedLocalWork(answers, json = false) {
+  sourceConnectionObservation = { workspace: fs4.realpathSync(process.cwd()), source: detectSourceConnection(process.cwd()) };
+  await createAgentTemplates(answers);
+  const report = await runValidation({ ...answers, apiKeyType: "none" }, false);
+  writeDoctorReport(report);
+  printDoctorReport(detectEnvironment(), report);
+  const existingSource = hasBoundLocalWorkSource(answers.profile);
+  console.log(chalk.green(existingSource ? "Local work prepared. Existing repository context is reused automatically when its connection is authorized." : "Local work prepared. An account or hosted context connection is optional."));
+  if (json) console.log(JSON.stringify({
+    ok: true,
+    profile: "local-work",
+    localWork: { prepared: true },
+    context: { configured: existingSource, authorized: null, mode: existingSource ? "existing_source" : "local_only" },
+    activationObserved: false,
+    validation: report
+  }, null, 2));
+}
 async function createMcpConfig(answers) {
   console.log(chalk.bold("\n\u2699\uFE0F  Creating Configuration\n"));
-  const mcpConfigPath = path.join(process.cwd(), ".mcp.json");
+  const mcpConfigPath = path4.join(process.cwd(), ".mcp.json");
   let mcpConfig = { mcpServers: {} };
-  if (fs.existsSync(mcpConfigPath)) {
+  if (answers.profile === "local-work") assertManagedMcpConfig();
+  if (fs4.existsSync(mcpConfigPath)) {
     try {
-      mcpConfig = JSON.parse(fs.readFileSync(mcpConfigPath, "utf-8"));
+      mcpConfig = JSON.parse(fs4.readFileSync(mcpConfigPath, "utf-8"));
       console.log(chalk.dim("   Found existing .mcp.json, merging..."));
     } catch {
+      if (answers.profile === "local-work") throw new Error("Existing .mcp.json changed or became invalid; configuration preserved");
       console.log(chalk.yellow("   Could not parse existing .mcp.json, creating new..."));
     }
   }
-  if (answers.profile !== "runtime-only") {
+  if (answers.profile !== "runtime-only" && answers.profile !== "local-work") {
     mcpConfig.mcpServers.snipara = buildHostedMcpServer(answers);
   }
-  if (answers.installRuntime) {
+  if (answers.profile === "local-work") {
+    mcpConfig.mcpServers = mergeManagedMcpServers(
+      mcpConfig.mcpServers,
+      managedNativeServer(answers),
+      managedSetupOnly(answers) ? { type: "http" } : buildHostedMcpServer(answers),
+      managedSetupOnly(answers)
+    );
+  } else if (answers.installRuntime) {
     mcpConfig.mcpServers[SANDBOX_SERVER_NAME] = {
       type: "http",
       url: "http://localhost:8765/mcp",
       headers: {}
     };
   }
-  fs.writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2) + "\n", { mode: 384 });
+  fs4.writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2) + "\n", { mode: 384 });
   try {
-    fs.chmodSync(mcpConfigPath, 384);
+    fs4.chmodSync(mcpConfigPath, 384);
   } catch {
   }
   console.log(chalk.green("   \u2713 Created .mcp.json"));
   ensureGitignoreEntry(".mcp.json", "# Snipara MCP config (contains API key)");
-  if (answers.aiClient === "kimi" && answers.profile !== "runtime-only") {
+  if (answers.aiClient === "kimi" && answers.profile !== "runtime-only" && !managedSetupOnly(answers)) {
     createKimiMcpConfig(answers);
   }
   if (answers.aiClient === "claude-desktop") {
@@ -2927,8 +3850,8 @@ async function createMcpConfig(answers) {
   }
 }
 function createKimiMcpConfig(answers) {
-  const kimiDir = path.join(process.cwd(), ".kimi-code");
-  const configPath = path.join(kimiDir, "mcp.json");
+  const kimiDir = path4.join(process.cwd(), ".kimi-code");
+  const configPath = path4.join(kimiDir, "mcp.json");
   const existing = asObjectRecord(readJsonFile(configPath));
   const existingServers = asObjectRecord(existing.mcpServers);
   const config = {
@@ -2944,8 +3867,8 @@ function createKimiMcpConfig(answers) {
       }
     }
   };
-  fs.mkdirSync(kimiDir, { recursive: true });
-  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  fs4.mkdirSync(kimiDir, { recursive: true });
+  fs4.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
   console.log(
     chalk.green("   \u2713 Created .kimi-code/mcp.json") + chalk.dim(" - SNIPARA_API_KEY stays in the launch environment")
   );
@@ -2970,13 +3893,13 @@ function normalizeCorrelationSessionId(value) {
 }
 function readExistingCorrelationSessionId() {
   const companionConfig = readCompanionConfigFile(
-    path.join(process.cwd(), ".snipara", "companion", "config.json")
+    path4.join(process.cwd(), ".snipara", "companion", "config.json")
   );
-  const projectMcpConfig = asObjectRecord(readJsonFile(path.join(process.cwd(), ".mcp.json")));
+  const projectMcpConfig = asObjectRecord(readJsonFile(path4.join(process.cwd(), ".mcp.json")));
   const projectMcpServer = asObjectRecord(asObjectRecord(projectMcpConfig.mcpServers).snipara);
   const projectMcpHeaders = asObjectRecord(projectMcpServer.headers);
   const kimiConfig = asObjectRecord(
-    readJsonFile(path.join(process.cwd(), ".kimi-code", "mcp.json"))
+    readJsonFile(path4.join(process.cwd(), ".kimi-code", "mcp.json"))
   );
   const kimiServer = asObjectRecord(asObjectRecord(kimiConfig.mcpServers).snipara);
   const kimiHeaders = asObjectRecord(kimiServer.headers);
@@ -2984,7 +3907,7 @@ function readExistingCorrelationSessionId() {
 }
 function getCorrelationSessionId(answers) {
   const existing = normalizeCorrelationSessionId(answers.correlationSessionId) || readExistingCorrelationSessionId();
-  const sessionId = existing || `sess_${Date.now()}_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
+  const sessionId = existing || `sess_${Date.now()}_${randomUUID3().replace(/-/g, "").slice(0, 12)}`;
   answers.correlationSessionId = sessionId;
   return sessionId;
 }
@@ -2995,6 +3918,10 @@ async function createClaudeCodeConfig(answers) {
   if (answers.profile === "runtime-only") {
     return;
   }
+  if (managedSetupOnly(answers)) {
+    console.log(chalk.green("   Local connection prepared in .mcp.json; reload and approve it in Claude Code."));
+    return;
+  }
   console.log(chalk.bold("\n\u{1F916} Claude Code MCP\n"));
   console.log(
     chalk.green(
@@ -3013,112 +3940,163 @@ async function createProjectBinding(answers) {
   if (answers.profile === "runtime-only") {
     return;
   }
-  const sniparaDir = path.join(process.cwd(), ".snipara");
-  const projectBindingPath = path.join(sniparaDir, "project");
+  const sniparaDir = path4.join(process.cwd(), ".snipara");
+  const projectBindingPath = path4.join(sniparaDir, "project");
   const projectBinding = `${answers.projectSlug}
 `;
-  const action = fs.existsSync(projectBindingPath) ? "Updated" : "Created";
-  fs.mkdirSync(sniparaDir, { recursive: true });
-  fs.writeFileSync(projectBindingPath, projectBinding);
+  const action = fs4.existsSync(projectBindingPath) ? "Updated" : "Created";
+  fs4.mkdirSync(sniparaDir, { recursive: true });
+  fs4.writeFileSync(projectBindingPath, projectBinding);
   console.log(chalk.green(`   \u2713 ${action} .snipara/project`));
 }
 async function createAgentTemplates(answers) {
   if (answers.profile === "runtime-only") {
     return;
   }
+  if (managedSetupOnly(answers)) {
+    createManagedLocalTemplates(answers);
+    return;
+  }
   console.log(chalk.bold("\nGenerating Agent Templates\n"));
-  const templatesDir = path.join(process.cwd(), ".snipara", "templates");
-  fs.mkdirSync(templatesDir, { recursive: true });
+  const templatesDir = path4.join(process.cwd(), ".snipara", "templates");
+  fs4.mkdirSync(templatesDir, { recursive: true });
   const templates = [
-    { path: path.join(templatesDir, "AGENTS.md"), content: buildAgentsMdTemplate(answers) },
-    { path: path.join(templatesDir, "CLAUDE.md"), content: buildClaudeMdTemplate(answers) },
+    { path: path4.join(templatesDir, "AGENTS.md"), content: buildAgentsMdTemplate(answers) },
+    { path: path4.join(templatesDir, "CLAUDE.md"), content: buildClaudeMdTemplate(answers) },
     {
-      path: path.join(templatesDir, "cursor-snipara.mdc"),
+      path: path4.join(templatesDir, "cursor-snipara.mdc"),
       content: buildCursorRuleTemplate(answers)
     },
     {
-      path: path.join(templatesDir, "codex-config.toml"),
+      path: path4.join(templatesDir, "codex-config.toml"),
       content: buildCodexConfigTemplate(answers)
     },
     {
-      path: path.join(templatesDir, "chatgpt-openai-mcp.json"),
+      path: path4.join(templatesDir, "chatgpt-openai-mcp.json"),
       content: buildChatGptMcpTemplate(answers)
     },
     {
-      path: path.join(templatesDir, "gemini-mcp-reference.json"),
+      path: path4.join(templatesDir, "gemini-mcp-reference.json"),
       content: buildGenericMcpReferenceTemplate(answers, "gemini")
     },
     {
-      path: path.join(templatesDir, "mistral-vibe-config.toml"),
+      path: path4.join(templatesDir, "mistral-vibe-config.toml"),
       content: buildMistralVibeConfigTemplate(answers)
     },
     {
-      path: path.join(templatesDir, "mistral-le-chat-mcp.json"),
+      path: path4.join(templatesDir, "mistral-le-chat-mcp.json"),
       content: buildMistralLeChatTemplate(answers)
     },
     {
-      path: path.join(templatesDir, "mistral-langchain-tools.ts"),
+      path: path4.join(templatesDir, "mistral-langchain-tools.ts"),
       content: buildMistralLangChainToolsTemplate(answers)
     },
     {
-      path: path.join(templatesDir, "vscode-mcp-reference.json"),
+      path: path4.join(templatesDir, "vscode-mcp-reference.json"),
       content: buildGenericMcpReferenceTemplate(answers, "vscode")
     },
     {
-      path: path.join(templatesDir, "continue-mcp-reference.json"),
+      path: path4.join(templatesDir, "continue-mcp-reference.json"),
       content: buildGenericMcpReferenceTemplate(answers, "continue")
     },
     {
-      path: path.join(templatesDir, "custom-mcp-reference.json"),
+      path: path4.join(templatesDir, "custom-mcp-reference.json"),
       content: buildGenericMcpReferenceTemplate(answers, "custom")
     }
   ];
   for (const template of templates) {
-    fs.writeFileSync(template.path, template.content);
+    fs4.writeFileSync(template.path, template.content);
   }
   console.log(chalk.green("   Created .snipara/templates agent snippets"));
-  writeAgentSkillPackTemplates(path.join(templatesDir, "skills"), answers);
+  writeAgentSkillPackTemplates(path4.join(templatesDir, "skills"), answers);
   writeIfMissing(
-    path.join(process.cwd(), "AGENTS.md"),
+    path4.join(process.cwd(), "AGENTS.md"),
     buildAgentsMdTemplate(answers),
     "AGENTS.md"
   );
   writeIfMissing(
-    path.join(process.cwd(), "CLAUDE.md"),
+    path4.join(process.cwd(), "CLAUDE.md"),
     buildClaudeMdTemplate(answers),
     "CLAUDE.md"
   );
-  const cursorRulesDir = path.join(process.cwd(), ".cursor", "rules");
-  fs.mkdirSync(cursorRulesDir, { recursive: true });
+  const cursorRulesDir = path4.join(process.cwd(), ".cursor", "rules");
+  fs4.mkdirSync(cursorRulesDir, { recursive: true });
   writeIfMissing(
-    path.join(cursorRulesDir, "snipara.mdc"),
+    path4.join(cursorRulesDir, "snipara.mdc"),
     buildCursorRuleTemplate(answers),
     ".cursor/rules/snipara.mdc"
   );
-  const codexDir = path.join(process.cwd(), ".codex");
-  fs.mkdirSync(codexDir, { recursive: true });
-  writeIfMissing(
-    path.join(codexDir, "config.toml"),
-    buildCodexConfigTemplate(answers),
-    ".codex/config.toml"
-  );
+  const codexDir = path4.join(process.cwd(), ".codex");
+  if (answers.profile === "local-work") {
+    configureManagedCodex(answers);
+  } else {
+    fs4.mkdirSync(codexDir, { recursive: true });
+    writeIfMissing(path4.join(codexDir, "config.toml"), buildCodexConfigTemplate(answers), ".codex/config.toml");
+  }
   if (answers.aiClient === "mistral") {
-    const vibeDir = path.join(process.cwd(), ".vibe");
-    fs.mkdirSync(vibeDir, { recursive: true });
+    const vibeDir = path4.join(process.cwd(), ".vibe");
+    fs4.mkdirSync(vibeDir, { recursive: true });
     writeIfMissing(
-      path.join(vibeDir, "config.toml"),
+      path4.join(vibeDir, "config.toml"),
       buildMistralVibeConfigTemplate(answers),
       ".vibe/config.toml"
     );
   }
   ensureGitignoreEntry(".snipara/companion/doctor.json", "# Snipara generated validation output");
 }
+function configureManagedCodex(answers) {
+  const manifest = answers.managedToolchain ?? managedToolchainStatus().manifest;
+  if (!manifest) throw new Error("The managed local-work bundle must be prepared before configuring Codex");
+  const native = managedNativeServer(answers);
+  mergeManagedCodexConfig({
+    file: path4.join(process.cwd(), ".codex/config.toml"),
+    python: path4.join(manifest.root, "python/bin/python"),
+    server: { command: native.command, args: native.args, ...native.env ? { env: native.env } : {} },
+    initialContent: buildCodexHostedConfigTemplate(answers),
+    env: { PATH: path4.dirname(process.execPath) + path4.delimiter + "/usr/bin:/bin", HOME: path4.join(manifest.root, "home"), PYTHONNOUSERSITE: "1" },
+    validateExisting: (server) => validManagedBootstrap({ type: "stdio", ...server }, manifest)
+  });
+}
+function createManagedLocalTemplates(answers) {
+  const manifest = answers.managedToolchain ?? managedToolchainStatus().manifest;
+  if (!manifest) throw new Error("Prepare local work before generating its agent instructions");
+  const guide = `# Snipara local work
+
+Use the user's existing agent and the local Snipara task workflow. No account or
+cloud subscription is required for local tasks and deterministic validation.
+Local CLI argv prefix: ${JSON.stringify([process.execPath, manifest.components.companion.command])}.
+
+Bind each task to the current repository/worktree, explicit acceptance criteria
+and scope. Reuse its existing task and recorded progress rather than creating
+duplicate work. Run relevant authorized checks through the native local
+validation connection. Saved running markers, declarations and historical
+closure do not establish observed execution or verified completion.
+
+Context is optional. If an existing repository connection reports connected,
+automatically use its authorized project context. A configured or pending
+connection alone does not establish authorization. Otherwise continue with local
+files and local work. Offer context setup when requested; never infer a hosted
+project from a directory name or a global API key. Do not read credential stores,
+copy provider/API secrets or automatically upload repository documents during setup.
+`;
+  const templates = path4.join(process.cwd(), ".snipara/templates");
+  fs4.mkdirSync(templates, { recursive: true });
+  for (const name of ["AGENTS.md", "CLAUDE.md"]) {
+    fs4.writeFileSync(path4.join(templates, name), guide);
+    writeIfMissing(path4.join(process.cwd(), name), guide, name);
+  }
+  const cursor = path4.join(process.cwd(), ".cursor/rules");
+  fs4.mkdirSync(cursor, { recursive: true });
+  writeIfMissing(path4.join(cursor, "snipara.mdc"), guide, ".cursor/rules/snipara.mdc");
+  fs4.writeFileSync(path4.join(templates, "codex-config.toml"), buildCodexConfigTemplate(answers));
+  configureManagedCodex(answers);
+}
 function writeIfMissing(filePath, content, label) {
-  if (fs.existsSync(filePath)) {
+  if (fs4.existsSync(filePath)) {
     console.log(chalk.dim(`   ${label} already exists; merge from .snipara/templates if needed`));
     return;
   }
-  fs.writeFileSync(filePath, content);
+  fs4.writeFileSync(filePath, content);
   console.log(chalk.green(`   Created ${label}`));
 }
 function buildMcpEndpoint(answers) {
@@ -3133,11 +4111,11 @@ function buildHostedMcpEndpoint(answers) {
 function writeAgentSkillPackTemplates(skillsDir, answers) {
   const skills = buildSniparaSkillPackTemplates(answers);
   for (const skill of skills) {
-    const skillDir = path.join(skillsDir, skill.name);
-    const agentsDir = path.join(skillDir, "agents");
-    fs.mkdirSync(agentsDir, { recursive: true });
-    fs.writeFileSync(path.join(skillDir, "SKILL.md"), skill.skillMd);
-    fs.writeFileSync(path.join(agentsDir, "openai.yaml"), buildSkillOpenAiYaml(skill, answers));
+    const skillDir = path4.join(skillsDir, skill.name);
+    const agentsDir = path4.join(skillDir, "agents");
+    fs4.mkdirSync(agentsDir, { recursive: true });
+    fs4.writeFileSync(path4.join(skillDir, "SKILL.md"), skill.skillMd);
+    fs4.writeFileSync(path4.join(agentsDir, "openai.yaml"), buildSkillOpenAiYaml(skill, answers));
   }
   console.log(chalk.green("   Created .snipara/templates/skills Snipara skill pack"));
 }
@@ -3510,8 +4488,7 @@ Agent task lifecycle:
     commit SHA, indexing time, included file sample, coverage, freshness warnings,
     and sync guidance before relying on it. If \`git status --short\` is dirty,
     warn that the indexed graph may not include local edits.
-12. Use Snipara Sandbox only when sandboxed execution, repeatable validation, or
-    isolated transformations materially help.
+12. Before executable repository tests, probe the required Snipara Sandbox capabilities using \`validation gate\` with an explicit request and workflow/lot scope. If absent, inaccessible or incompatible, ask the user to choose another test environment, install/configure Sandbox, or continue without Sandbox (local tests versus no tests). Never fall back silently or treat no response as approval; preserve the scoped choice and proof limits across resume. Static reads and documentation do not require a container.
 13. If a broad query is slow, retry once with a narrow keyword query before
     falling back to local search.
 14. When generated hooks are enabled, \`snipara-companion pre-tool\`, \`post-tool\`,
@@ -3562,7 +4539,7 @@ ${EXPERIENCE_GOAL_SECTION}
 - If a broad query is slow, retry once with a narrow keyword query before falling back to local search.
 - When the plan is visible and \`snipara-companion\` is installed, keep the machine plan in JSON, use \`snipara-companion workflow start\`, \`phase-start\`, and \`phase-commit\` per phase, and after \`workflow resume\` rerun \`workflow phase-start\` before editing again.
 - If generated hooks are enabled, \`snipara-companion pre-tool\`, \`post-tool\`, and \`stuck-guard status\` provide runtime Rescue Pack checks when the agent loops on failures or empty searches.
-- Use Snipara Sandbox only when sandboxed execution or repeatable validation materially helps. For runtime-bound phases, capture compact rehydratable state with \`workflow runtime-checkpoint <phase_id> --summary "<state>" --rehydrate-file <state.json>\`. Then \`workflow resume\` restores workflow and memory continuity plus the recorded Sandbox binding and prints a reattach or rehydrate plan. It does not snapshot or exactly restore a live Snipara Sandbox or REPL process.
+- Before executable repository tests, run \`validation gate\` with an explicit request and workflow/lot scope. If unavailable or incompatible, ask the user to choose another environment, install/configure Sandbox, or continue without Sandbox (local tests versus no tests). Never fall back silently or infer approval. Preserve the scoped choice and proof requirements across resume. For runtime-bound phases, capture compact rehydratable state with \`workflow runtime-checkpoint <phase_id> --summary "<state>" --rehydrate-file <state.json>\`. Then \`workflow resume\` restores workflow and memory continuity plus the recorded Sandbox binding and prints a reattach or rehydrate plan. It does not snapshot or exactly restore a live Snipara Sandbox or REPL process.
 - End substantial work with \`snipara_end_of_task_commit\` when available; for managed workflows, end every phase with \`snipara-companion workflow phase-commit\` and the task with \`snipara-companion final-commit\`.
 - Use \`snipara_remember_if_novel\` or \`snipara_remember\` only for narrow durable memories.
 - When remembered knowledge is obsolete or replaced and \`snipara-companion\` is installed, use \`snipara-companion memory invalidate <memory-id>\` or \`snipara-companion memory supersede <old-memory-id> <new-memory-id>\`; otherwise use hosted \`snipara_memory_invalidate\` or \`snipara_memory_supersede\`.
@@ -3603,18 +4580,24 @@ ${EXPERIENCE_GOAL_SECTION}
 - If a broad query is slow, retry once with a narrow keyword query before falling back to local search.
 - When \`snipara-companion\` is installed and the LLM has a visible multi-phase plan, keep the machine plan in JSON, use \`snipara-companion workflow start\`, \`phase-start\`, and \`phase-commit\` per phase, and after \`workflow resume\` rerun \`workflow phase-start\` before editing again.
 - Generated hooks can call \`snipara-companion pre-tool\`, \`post-tool\`, and \`stuck-guard status\` so Rescue Packs are runtime-triggered rather than relying only on instructions.
-- Use Snipara Sandbox only when sandboxed execution or repeatable validation materially helps. For runtime-bound phases, capture compact rehydratable state with \`workflow runtime-checkpoint <phase_id> --summary "<state>" --rehydrate-file <state.json>\`. Then \`workflow resume\` restores workflow and memory continuity plus the recorded Sandbox binding and prints a reattach or rehydrate plan. It does not snapshot or exactly restore a live Snipara Sandbox or REPL process.
+- Before executable repository tests, run \`validation gate\` with an explicit request and workflow/lot scope. If unavailable or incompatible, ask the user to choose another environment, install/configure Sandbox, or continue without Sandbox (local tests versus no tests). Never fall back silently or infer approval. Preserve the scoped choice and proof requirements across resume. For runtime-bound phases, capture compact rehydratable state with \`workflow runtime-checkpoint <phase_id> --summary "<state>" --rehydrate-file <state.json>\`. Then \`workflow resume\` restores workflow and memory continuity plus the recorded Sandbox binding and prints a reattach or rehydrate plan. It does not snapshot or exactly restore a live Snipara Sandbox or REPL process.
 - End substantial work with \`snipara_end_of_task_commit\` when available; for managed workflows, end every phase with \`snipara-companion workflow phase-commit\` and the task with \`snipara-companion final-commit\`. Use \`snipara_remember_if_novel\` or \`snipara_remember\` only for narrow durable memories. When remembered knowledge is obsolete or replaced, use \`snipara-companion memory invalidate <memory-id>\` or \`snipara-companion memory supersede <old-memory-id> <new-memory-id>\` when companion is installed; otherwise use hosted \`snipara_memory_invalidate\` or \`snipara_memory_supersede\`. Never store secrets.
 `;
 }
-function buildCodexConfigTemplate(answers) {
-  return `[mcp_servers.snipara]
+function buildCodexHostedConfigTemplate(answers) {
+  return managedSetupOnly(answers) ? "" : `[mcp_servers.snipara]
 type = "streamable_http"
 url = "${buildHostedMcpEndpoint(answers)}"
 bearer_token_env_var = "SNIPARA_API_KEY"
 http_headers = { "X-Snipara-Session-Id" = "${getCorrelationSessionId(answers)}" }
 `;
 }
+function buildCodexConfigTemplate(answers) {
+  const hosted = buildCodexHostedConfigTemplate(answers);
+  if (answers.profile !== "local-work") return hosted;
+  const native = managedNativeServer(answers);
+  return hosted + "\n" + managedCodexSnippet({ command: native.command, args: native.args });
+}
 function buildChatGptMcpTemplate(answers) {
   return `${JSON.stringify(
     {
@@ -3782,11 +4765,11 @@ function buildGenericMcpReferenceTemplate(answers, client) {
 `;
 }
 function ensureGitignoreEntry(entry, comment) {
-  const gitignorePath = path.join(process.cwd(), ".gitignore");
-  if (fs.existsSync(gitignorePath)) {
-    const gitignore = fs.readFileSync(gitignorePath, "utf-8");
+  const gitignorePath = path4.join(process.cwd(), ".gitignore");
+  if (fs4.existsSync(gitignorePath)) {
+    const gitignore = fs4.readFileSync(gitignorePath, "utf-8");
     if (!gitignore.includes(entry)) {
-      fs.appendFileSync(gitignorePath, `
+      fs4.appendFileSync(gitignorePath, `
 ${comment}
 ${entry}
 `);
@@ -3794,27 +4777,31 @@ ${entry}
     }
     return;
   }
-  fs.writeFileSync(gitignorePath, `${comment}
+  fs4.writeFileSync(gitignorePath, `${comment}
 ${entry}
 `);
   console.log(chalk.green(`   \u2713 Created .gitignore with ${entry}`));
 }
 async function createClaudeDesktopConfig(answers) {
-  const configDir = process.platform === "darwin" ? path.join(homedir(), "Library", "Application Support", "Claude") : process.platform === "win32" ? path.join(homedir(), "AppData", "Roaming", "Claude") : path.join(homedir(), ".config", "claude");
-  const configPath = path.join(configDir, "claude_desktop_config.json");
+  const configDir = process.platform === "darwin" ? path4.join(homedir2(), "Library", "Application Support", "Claude") : process.platform === "win32" ? path4.join(homedir2(), "AppData", "Roaming", "Claude") : path4.join(homedir2(), ".config", "claude");
+  const configPath = path4.join(configDir, "claude_desktop_config.json");
   console.log(chalk.dim(`
    Claude Desktop config: ${configPath}`));
   try {
-    if (!fs.existsSync(configDir)) {
-      fs.mkdirSync(configDir, { recursive: true });
+    if (answers.profile === "local-work") assertManagedMcpConfig(configPath);
+    if (!fs4.existsSync(configDir)) {
+      fs4.mkdirSync(configDir, { recursive: true });
     }
     let config = {};
-    if (fs.existsSync(configPath)) {
-      config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    if (fs4.existsSync(configPath)) {
+      config = JSON.parse(fs4.readFileSync(configPath, "utf-8"));
     }
     config.mcpServers = config.mcpServers || {};
-    config.mcpServers.snipara = buildHostedMcpServer(answers);
-    if (answers.installRuntime) {
+    if (!(answers.profile === "local-work" && (managedSetupOnly(answers) || config.mcpServers["snipara-repository"] || asObjectRecord(asObjectRecord(readJsonFile(path4.join(process.cwd(), ".mcp.json"))).mcpServers)["snipara-repository"])))
+      config.mcpServers.snipara = buildHostedMcpServer(answers);
+    if (answers.profile === "local-work") {
+      config.mcpServers["snipara-local"] = managedNativeServer(answers);
+    } else if (answers.installRuntime) {
       config.mcpServers[SANDBOX_SERVER_NAME] = {
         command: detectSandboxCommand() || SANDBOX_COMMAND_NAME,
         args: ["mcp-serve"],
@@ -3824,18 +4811,19 @@ async function createClaudeDesktopConfig(answers) {
         }
       };
     }
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    fs4.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
     console.log(chalk.green("   \u2713 Updated Claude Desktop config"));
   } catch (error) {
+    if (answers.profile === "local-work") throw error;
     console.log(chalk.yellow(`   \u26A0\uFE0F  Could not update Claude Desktop config: ${error}`));
   }
 }
 async function installClaudeCodeHooks(answers) {
   console.log(chalk.bold("\n\u{1FA9D} Installing Claude Code Hooks\n"));
-  const claudeDir = path.join(process.cwd(), ".claude");
-  const hooksDir = path.join(claudeDir, "hooks");
-  if (!fs.existsSync(hooksDir)) {
-    fs.mkdirSync(hooksDir, { recursive: true });
+  const claudeDir = path4.join(process.cwd(), ".claude");
+  const hooksDir = path4.join(claudeDir, "hooks");
+  if (!fs4.existsSync(hooksDir)) {
+    fs4.mkdirSync(hooksDir, { recursive: true });
   }
   const hooks = [
     {
@@ -3856,16 +4844,16 @@ async function installClaudeCodeHooks(answers) {
     }
   ];
   for (const hook of hooks) {
-    const hookPath = path.join(hooksDir, hook.name);
-    fs.writeFileSync(hookPath, hook.content);
-    fs.chmodSync(hookPath, "755");
+    const hookPath = path4.join(hooksDir, hook.name);
+    fs4.writeFileSync(hookPath, hook.content);
+    fs4.chmodSync(hookPath, "755");
     console.log(chalk.green(`   \u2713 Created ${hook.name}`));
   }
-  const settingsPath = path.join(claudeDir, "settings.json");
+  const settingsPath = path4.join(claudeDir, "settings.json");
   let settings = {};
-  if (fs.existsSync(settingsPath)) {
+  if (fs4.existsSync(settingsPath)) {
     try {
-      settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+      settings = JSON.parse(fs4.readFileSync(settingsPath, "utf-8"));
     } catch {
       settings = {};
     }
@@ -3929,13 +4917,13 @@ async function installClaudeCodeHooks(answers) {
   for (const { event, entry } of hookEntries) {
     const eventHooks = Array.isArray(hooksConfig[event]) ? hooksConfig[event] : [];
     const expectedCommand = entry.hooks[0].command;
-    const exists = eventHooks.some((hook) => hookConfigEntryHasCommand(hook, expectedCommand));
-    if (!exists) {
+    const exists2 = eventHooks.some((hook) => hookConfigEntryHasCommand(hook, expectedCommand));
+    if (!exists2) {
       eventHooks.push(entry);
       hooksConfig[event] = eventHooks;
     }
   }
-  fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs4.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   console.log(chalk.green("   \u2713 Updated .claude/settings.json hooks"));
 }
 function createClaudeProjectHookCommand(scriptName) {
@@ -4075,9 +5063,9 @@ fi
 }
 async function updateEnvFiles(answers) {
   console.log(chalk.bold("\n\u{1F4DD} Updating Environment Files\n"));
-  const envExamplePath = path.join(process.cwd(), ".env.example");
-  const envLocalPath = path.join(process.cwd(), ".env.local");
-  const envPath = path.join(process.cwd(), ".env");
+  const envExamplePath = path4.join(process.cwd(), ".env.example");
+  const envLocalPath = path4.join(process.cwd(), ".env.local");
+  const envPath = path4.join(process.cwd(), ".env");
   let envVars = "";
   let envExampleVars = "";
   if (answers.profile !== "runtime-only") {
@@ -4115,26 +5103,26 @@ ${llmVarName}=your_${answers.llmProvider}_api_key_here`;
     console.log(chalk.dim("   No environment variables to save"));
     return;
   }
-  if (envExampleVars && fs.existsSync(envExamplePath)) {
-    const content = fs.readFileSync(envExamplePath, "utf-8");
+  if (envExampleVars && fs4.existsSync(envExamplePath)) {
+    const content = fs4.readFileSync(envExamplePath, "utf-8");
     const missingLines = envExampleVars.split("\n").filter((line) => {
       const match = line.match(/^([A-Z0-9_]+)=/);
       return Boolean(match && !content.includes(`${match[1]}=`));
     });
     if (missingLines.length > 0) {
-      fs.appendFileSync(envExamplePath, `
+      fs4.appendFileSync(envExamplePath, `
 
 ${missingLines.join("\n")}
 `);
       console.log(chalk.green("   \u2713 Updated .env.example"));
     }
   } else if (envExampleVars) {
-    fs.writeFileSync(envExamplePath, envExampleVars + "\n");
+    fs4.writeFileSync(envExamplePath, envExampleVars + "\n");
     console.log(chalk.green("   \u2713 Created .env.example"));
   }
-  const targetEnvPath = fs.existsSync(envLocalPath) ? envLocalPath : envPath;
-  if (fs.existsSync(targetEnvPath)) {
-    const content = fs.readFileSync(targetEnvPath, "utf-8");
+  const targetEnvPath = fs4.existsSync(envLocalPath) ? envLocalPath : envPath;
+  if (fs4.existsSync(targetEnvPath)) {
+    const content = fs4.readFileSync(targetEnvPath, "utf-8");
     const missingLines = envVars.split("\n").filter((line) => {
       const match = line.match(/^([A-Z0-9_]+)=/);
       if (!match) {
@@ -4146,26 +5134,26 @@ ${missingLines.join("\n")}
       return !content.includes(`${match[1]}=`);
     });
     if (missingLines.length > 0) {
-      fs.appendFileSync(targetEnvPath, `
+      fs4.appendFileSync(targetEnvPath, `
 
 ${missingLines.join("\n")}
 `);
-      console.log(chalk.green(`   \u2713 Updated ${path.basename(targetEnvPath)}`));
+      console.log(chalk.green(`   \u2713 Updated ${path4.basename(targetEnvPath)}`));
     }
     return;
   }
   if (!answers.apiKey.includes("YOUR_") && answers.profile !== "runtime-only" || answers.llmApiKey) {
-    fs.writeFileSync(targetEnvPath, envVars + "\n");
-    console.log(chalk.green(`   \u2713 Created ${path.basename(targetEnvPath)}`));
+    fs4.writeFileSync(targetEnvPath, envVars + "\n");
+    console.log(chalk.green(`   \u2713 Created ${path4.basename(targetEnvPath)}`));
   }
 }
 async function createCompanionConfig(answers) {
   if (!answers.installCompanion || answers.apiKeyType === "none" || !answers.apiKey || answers.apiKey.includes("YOUR_")) {
     return;
   }
-  const configDir = path.join(process.cwd(), ".snipara", "companion");
-  const configPath = path.join(configDir, "config.json");
-  fs.mkdirSync(configDir, { recursive: true });
+  const configDir = path4.join(process.cwd(), ".snipara", "companion");
+  const configPath = path4.join(configDir, "config.json");
+  fs4.mkdirSync(configDir, { recursive: true });
   const existingWorkspaceConfig = readCompanionConfigFile(configPath);
   const workspaceConfig = {
     ...existingWorkspaceConfig,
@@ -4175,7 +5163,7 @@ async function createCompanionConfig(answers) {
     sessionId: getCorrelationSessionId(answers),
     client: getAutomationClientId(answers.aiClient)
   };
-  fs.writeFileSync(configPath, JSON.stringify(workspaceConfig, null, 2) + "\n");
+  fs4.writeFileSync(configPath, JSON.stringify(workspaceConfig, null, 2) + "\n");
   ensureGitignoreEntry(".snipara/companion/config.json", "# Snipara local companion config");
   console.log(chalk.green("   \u2713 Configured local companion config"));
 }
@@ -4245,11 +5233,11 @@ async function syncRemoteAutomationClient(answers, options) {
   }
 }
 function readCompanionConfigFile(filePath) {
-  if (!fs.existsSync(filePath)) {
+  if (!fs4.existsSync(filePath)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    const parsed = JSON.parse(fs4.readFileSync(filePath, "utf-8"));
     return typeof parsed === "object" && parsed !== null ? parsed : {};
   } catch {
     return {};
@@ -4763,13 +5751,13 @@ ${guidance.map((line) => `- ${line}`).join("\n")}
 }
 async function createCompanionPack(answers) {
   console.log(chalk.bold("\n\u{1F5C2}\uFE0F  Generating Companion Pack\n"));
-  const packDir = path.join(process.cwd(), ".snipara", "companion");
+  const packDir = path4.join(process.cwd(), ".snipara", "companion");
   const commands = getCompanionCommands(answers);
   const guidance = [UNIVERSAL_CLIENT_GUIDANCE, ...getClientGuidance(answers.aiClient)];
   const detection = detectEnvironment();
   const clientPackFilename = getClientPackFilename(answers.aiClient);
   const deploymentLabel = getDeploymentLabel(answers.deployment);
-  fs.mkdirSync(packDir, { recursive: true });
+  fs4.mkdirSync(packDir, { recursive: true });
   const readme = `# Snipara Companion Pack
 
 This project uses ${deploymentLabel} as a project intelligence layer with source-backed context, reviewed memory, and local companion workflow helpers.
@@ -4916,12 +5904,12 @@ ${item.purpose}`
     guidance,
     detection
   };
-  fs.writeFileSync(path.join(packDir, "README.md"), readme + "\n");
-  fs.writeFileSync(
-    path.join(packDir, clientPackFilename),
+  fs4.writeFileSync(path4.join(packDir, "README.md"), readme + "\n");
+  fs4.writeFileSync(
+    path4.join(packDir, clientPackFilename),
     buildClientPackMarkdown(answers, commands, guidance) + "\n"
   );
-  fs.writeFileSync(path.join(packDir, "commands.json"), JSON.stringify(pack, null, 2) + "\n");
+  fs4.writeFileSync(path4.join(packDir, "commands.json"), JSON.stringify(pack, null, 2) + "\n");
   console.log(chalk.green("   \u2713 Created .snipara/companion/README.md"));
   console.log(chalk.green(`   \u2713 Created .snipara/companion/${clientPackFilename}`));
   console.log(chalk.green("   \u2713 Created .snipara/companion/commands.json"));
@@ -4935,8 +5923,8 @@ async function runSandboxInit() {
 `
     )
   );
-  return new Promise((resolve) => {
-    const child = spawn(sandboxCommand, ["init"], {
+  return new Promise((resolve2) => {
+    const child = spawn2(sandboxCommand, ["init"], {
       stdio: "inherit",
       shell: true
     });
@@ -4948,7 +5936,7 @@ async function runSandboxInit() {
    \u26A0\uFE0F  ${sandboxCommand} init exited with code ${code}`));
         console.log(chalk.dim(`   You can run '${sandboxCommand} init' manually later.`));
       }
-      resolve();
+      resolve2();
     });
     child.on("error", (error) => {
       console.log(chalk.yellow(`
@@ -4956,7 +5944,7 @@ async function runSandboxInit() {
       console.log(
         chalk.dim(`   Run '${SANDBOX_COMMAND_NAME} init' manually after installation completes.`)
       );
-      resolve();
+      resolve2();
     });
   });
 }
@@ -4993,8 +5981,8 @@ function buildGitHubAutomationUrl(answers) {
 function getClaudeClientChecks(answers, detection) {
   const checks = [];
   const claudePaths = getClaudeConfigPaths();
-  const projectConfig = readJsonFile(path.join(process.cwd(), ".mcp.json"));
-  const projectSettings = readJsonFile(path.join(process.cwd(), ".claude", "settings.json"));
+  const projectConfig = readJsonFile(path4.join(process.cwd(), ".mcp.json"));
+  const projectSettings = readJsonFile(path4.join(process.cwd(), ".claude", "settings.json"));
   const codeSettings = readJsonFile(claudePaths.codeSettingsPath);
   const desktopConfig = readJsonFile(claudePaths.desktopConfigPath);
   const projectHasSnipara = containsSniparaMcpReference(projectConfig);
@@ -5048,11 +6036,11 @@ function getClaudeClientChecks(answers, detection) {
   return checks;
 }
 function readJsonFile(filePath) {
-  if (!fs.existsSync(filePath)) {
+  if (!fs4.existsSync(filePath)) {
     return null;
   }
   try {
-    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs4.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -5145,13 +6133,35 @@ function compareSemver(left, right) {
 async function runValidation(answers, includeHostedCheck, options = {}) {
   console.log(chalk.bold("\n\u{1FA7A} Running Validation\n"));
   const checks = [];
-  const detection = detectEnvironment();
+  const detection = detectEnvironment(answers.profile === "local-work");
+  if (answers.profile === "local-work") {
+    try {
+      const managed = managedToolchainStatus();
+      if (!managed.manifest) throw new Error("Managed local-work bundle is absent");
+      answers.managedToolchain = managed.manifest;
+      detection.tooling.companionCli = true;
+      detection.tooling.runtimeCli = true;
+      detection.tooling.orchestratorCli = true;
+      checks.push({ name: "managed_toolchain", status: "pass", detail: `Private compatible bundle ${managed.manifest.bundleId}; installation is not project activation` });
+      const native = asObjectRecord(asObjectRecord(readJsonFile(path4.join(process.cwd(), ".mcp.json"))).mcpServers)["snipara-local"];
+      checks.push({
+        name: "managed_native_config",
+        status: isManagedNativeServer(native) && validManagedBootstrap(native, managed.manifest) ? "pass" : "fail",
+        detail: "Native launcher configuration is checked against retained owned bundles; live client connectivity is separate"
+      });
+    } catch {
+      detection.tooling.companionCli = false;
+      detection.tooling.runtimeCli = false;
+      detection.tooling.orchestratorCli = false;
+      checks.push({ name: "managed_toolchain", status: "fail", detail: "Managed bundle is absent, changed or incompatible; existing state was preserved" });
+    }
+  }
   const targetClient = options.client || answers.aiClient;
   const effectiveAnswers = { ...answers, aiClient: targetClient };
   checks.push({
     name: "project_slug",
-    status: answers.projectSlug ? "pass" : "fail",
-    detail: answers.projectSlug || "Project slug missing"
+    status: managedSetupOnly(answers) || answers.projectSlug ? "pass" : "fail",
+    detail: managedSetupOnly(answers) ? "A hosted project slug is optional for local work" : answers.projectSlug || "Project slug missing"
   });
   const configuredSlugSignals = collectConfiguredProjectSlugSignals(detection.existingConfig);
   const presentSlugSignals = configuredSlugSignals.filter((signal) => signal.slug);
@@ -5176,7 +6186,7 @@ async function runValidation(answers, includeHostedCheck, options = {}) {
   checks.push({
     name: "companion_cli",
     status: answers.installCompanion ? detection.tooling.companionCli ? "pass" : "fail" : "pass",
-    detail: answers.installCompanion && !detection.tooling.companionCli ? getCompanionRequirementMessage() : "Companion CLI ready or not requested"
+    detail: answers.installCompanion && !detection.tooling.companionCli ? answers.profile === "local-work" ? "Managed Companion unavailable; repair local-work" : getCompanionRequirementMessage() : "Companion CLI ready or not requested"
   });
   checks.push({
     name: "sandbox_cli",
@@ -5219,10 +6229,12 @@ async function runValidation(answers, includeHostedCheck, options = {}) {
     status: answers.installHooks && targetClient === "claude-code" ? detection.files.claudeProjectSettings ? "pass" : "warn" : "pass",
     detail: answers.installHooks && targetClient === "claude-code" ? detection.files.claudeProjectSettings ? "Project .claude/settings.json hooks present" : "Project .claude/settings.json hooks missing" : "Hooks not requested"
   });
-  if (targetClient === "claude-code" || targetClient === "claude-desktop") {
+  if (managedSetupOnly(answers)) {
+    checks.push({ name: "repository_context", status: "pass", detail: hasBoundLocalWorkSource(answers.profile) ? "Existing source connection preserved; authorization is observed by its native broker" : "Optional project context is not configured; local work needs no account" });
+  } else if (targetClient === "claude-code" || targetClient === "claude-desktop") {
     checks.push(...getClaudeClientChecks(effectiveAnswers, detection));
   }
-  if (options.includeNpmFreshness) {
+  if (options.includeNpmFreshness && !managedSetupOnly(answers)) {
     checks.push(getCreateSniparaPackageFreshnessCheck());
   }
   const githubRepo = answers.githubRepo || detectGitRepository();
@@ -5231,7 +6243,9 @@ async function runValidation(answers, includeHostedCheck, options = {}) {
     status: answers.configureGitHub ? "pass" : githubRepo ? "warn" : "pass",
     detail: answers.configureGitHub ? `GitHub App setup link generated for ${githubRepo?.fullName || "detected repo"}; PR Answer Packs are enabled after browser approval` : githubRepo ? `GitHub repo ${githubRepo.fullName} detected; run ${CREATE_SNIPARA_NPX_COMMAND} --github to connect PR Answer Packs` : "No GitHub repo detected; PR Answer Packs require the GitHub App setup path"
   });
-  if (includeHostedCheck && answers.apiKeyType !== "none" && !answers.apiKey.includes("YOUR_")) {
+  if (includeHostedCheck && managedSetupOnly(answers)) {
+    checks.push({ name: "hosted_connection", status: "pass", detail: hasBoundLocalWorkSource(answers.profile) ? "Existing native broker automatically reuses authorized project context; authorization was not probed by setup" : "No hosted connection is required for local work" });
+  } else if (includeHostedCheck && answers.apiKeyType !== "none" && !answers.apiKey.includes("YOUR_")) {
     checks.push(...await testHostedConnection(answers));
   } else if (includeHostedCheck) {
     checks.push({
@@ -5251,29 +6265,34 @@ async function runValidation(answers, includeHostedCheck, options = {}) {
   };
 }
 function writeDoctorReport(report) {
-  const reportDir = path.join(process.cwd(), ".snipara", "companion");
-  fs.mkdirSync(reportDir, { recursive: true });
-  fs.writeFileSync(path.join(reportDir, "doctor.json"), JSON.stringify(report, null, 2) + "\n");
+  const reportDir = path4.join(process.cwd(), ".snipara", "companion");
+  fs4.mkdirSync(reportDir, { recursive: true });
+  fs4.writeFileSync(path4.join(reportDir, "doctor.json"), JSON.stringify(report, null, 2) + "\n");
   console.log(chalk.green("   \u2713 Wrote .snipara/companion/doctor.json"));
 }
 function getCodexConfigCheck(answers) {
+  if (managedSetupOnly(answers)) return {
+    name: "codex_config",
+    status: "warn",
+    detail: "Managed local launcher is configured; restart Codex and observe connection status. Optional context authorization remains separate"
+  };
   const candidates = [
     {
       label: ".codex/config.toml",
-      filePath: path.join(process.cwd(), ".codex", "config.toml")
+      filePath: path4.join(process.cwd(), ".codex", "config.toml")
     },
     {
       label: ".snipara/templates/codex-config.toml",
-      filePath: path.join(process.cwd(), ".snipara", "templates", "codex-config.toml")
+      filePath: path4.join(process.cwd(), ".snipara", "templates", "codex-config.toml")
     },
     {
       label: "~/.codex/config.toml",
-      filePath: path.join(homedir(), ".codex", "config.toml")
+      filePath: path4.join(homedir2(), ".codex", "config.toml")
     }
   ];
-  const present = candidates.filter((candidate) => fs.existsSync(candidate.filePath)).map((candidate) => ({
+  const present = candidates.filter((candidate) => fs4.existsSync(candidate.filePath)).map((candidate) => ({
     label: candidate.label,
-    content: fs.readFileSync(candidate.filePath, "utf-8")
+    content: fs4.readFileSync(candidate.filePath, "utf-8")
   }));
   if (present.length === 0) {
     return {
@@ -5325,20 +6344,20 @@ function getMistralConfigCheck(answers) {
   const candidates = [
     {
       label: ".vibe/config.toml",
-      filePath: path.join(process.cwd(), ".vibe", "config.toml")
+      filePath: path4.join(process.cwd(), ".vibe", "config.toml")
     },
     {
       label: ".snipara/templates/mistral-vibe-config.toml",
-      filePath: path.join(process.cwd(), ".snipara", "templates", "mistral-vibe-config.toml")
+      filePath: path4.join(process.cwd(), ".snipara", "templates", "mistral-vibe-config.toml")
     },
     {
       label: "~/.vibe/config.toml",
-      filePath: path.join(homedir(), ".vibe", "config.toml")
+      filePath: path4.join(homedir2(), ".vibe", "config.toml")
     }
   ];
-  const present = candidates.filter((candidate) => fs.existsSync(candidate.filePath)).map((candidate) => ({
+  const present = candidates.filter((candidate) => fs4.existsSync(candidate.filePath)).map((candidate) => ({
     label: candidate.label,
-    content: fs.readFileSync(candidate.filePath, "utf-8")
+    content: fs4.readFileSync(candidate.filePath, "utf-8")
   }));
   if (present.length === 0) {
     return {
@@ -5602,7 +6621,7 @@ function printActivationSummary(manifest) {
   console.log(
     chalk.dim(
       `
-   Activation manifest: ${path.relative(process.cwd(), getActivationManifestPath())}`
+   Activation manifest: ${path4.relative(process.cwd(), getActivationManifestPath())}`
     )
   );
   if (manifest.artifacts.handoffPath) {
@@ -5668,13 +6687,25 @@ function commandExists(command) {
   }
 }
 function getClaudeConfigPaths() {
-  const desktopDir = process.platform === "darwin" ? path.join(homedir(), "Library", "Application Support", "Claude") : process.platform === "win32" ? path.join(homedir(), "AppData", "Roaming", "Claude") : path.join(homedir(), ".config", "claude");
+  const desktopDir = process.platform === "darwin" ? path4.join(homedir2(), "Library", "Application Support", "Claude") : process.platform === "win32" ? path4.join(homedir2(), "AppData", "Roaming", "Claude") : path4.join(homedir2(), ".config", "claude");
   return {
-    codeSettingsPath: path.join(homedir(), ".claude", "settings.json"),
-    desktopConfigPath: path.join(desktopDir, "claude_desktop_config.json")
+    codeSettingsPath: path4.join(homedir2(), ".claude", "settings.json"),
+    desktopConfigPath: path4.join(desktopDir, "claude_desktop_config.json")
   };
 }
-function detectEnvironment() {
+function executableOnPath(command) {
+  return (process.env.PATH ?? "").split(path4.delimiter).some((directory) => {
+    if (!directory || !path4.isAbsolute(directory)) return false;
+    try {
+      const file = path4.join(directory, command);
+      fs4.accessSync(file, fs4.constants.X_OK);
+      return fs4.statSync(file).isFile();
+    } catch {
+      return false;
+    }
+  });
+}
+function detectEnvironment(managed = hasLocalWorkSelection()) {
   const existingConfig = getExistingConfig();
   const projectSlugResolution = resolveProjectSlug(existingConfig);
   const claudePaths = getClaudeConfigPaths();
@@ -5686,38 +6717,38 @@ function detectEnvironment() {
     aiClient: detectAiClient(),
     inGitRepo: isGitRepo(),
     files: {
-      mcpConfig: fs.existsSync(path.join(process.cwd(), ".mcp.json")),
-      env: fs.existsSync(path.join(process.cwd(), ".env")),
-      envLocal: fs.existsSync(path.join(process.cwd(), ".env.local")),
-      envExample: fs.existsSync(path.join(process.cwd(), ".env.example")),
-      agentsMd: fs.existsSync(path.join(process.cwd(), "AGENTS.md")),
-      claudeMd: fs.existsSync(path.join(process.cwd(), "CLAUDE.md")),
-      codexConfig: fs.existsSync(path.join(process.cwd(), ".codex", "config.toml")),
-      cursorRule: fs.existsSync(path.join(process.cwd(), ".cursor", "rules", "snipara.mdc")),
-      sniparaProject: fs.existsSync(path.join(process.cwd(), ".snipara", "project")),
-      claudeDir: fs.existsSync(path.join(homedir(), ".claude")),
-      claudeSettings: fs.existsSync(claudePaths.codeSettingsPath),
-      claudeProjectDir: fs.existsSync(path.join(process.cwd(), ".claude")),
-      claudeProjectSettings: fs.existsSync(path.join(process.cwd(), ".claude", "settings.json")),
-      claudeDesktopConfig: fs.existsSync(claudePaths.desktopConfigPath),
-      cursorDir: fs.existsSync(path.join(homedir(), ".cursor")),
-      mistralVibeConfig: fs.existsSync(path.join(process.cwd(), ".vibe", "config.toml")) || fs.existsSync(path.join(homedir(), ".vibe", "config.toml")),
-      sniparaCompanionPack: fs.existsSync(path.join(process.cwd(), ".snipara", "companion")),
-      sniparaTemplates: fs.existsSync(path.join(process.cwd(), ".snipara", "templates")),
-      sniparaSkillPack: fs.existsSync(path.join(process.cwd(), ".snipara", "templates", "skills"))
+      mcpConfig: fs4.existsSync(path4.join(process.cwd(), ".mcp.json")),
+      env: fs4.existsSync(path4.join(process.cwd(), ".env")),
+      envLocal: fs4.existsSync(path4.join(process.cwd(), ".env.local")),
+      envExample: fs4.existsSync(path4.join(process.cwd(), ".env.example")),
+      agentsMd: fs4.existsSync(path4.join(process.cwd(), "AGENTS.md")),
+      claudeMd: fs4.existsSync(path4.join(process.cwd(), "CLAUDE.md")),
+      codexConfig: fs4.existsSync(path4.join(process.cwd(), ".codex", "config.toml")),
+      cursorRule: fs4.existsSync(path4.join(process.cwd(), ".cursor", "rules", "snipara.mdc")),
+      sniparaProject: fs4.existsSync(path4.join(process.cwd(), ".snipara", "project")),
+      claudeDir: fs4.existsSync(path4.join(homedir2(), ".claude")),
+      claudeSettings: fs4.existsSync(claudePaths.codeSettingsPath),
+      claudeProjectDir: fs4.existsSync(path4.join(process.cwd(), ".claude")),
+      claudeProjectSettings: fs4.existsSync(path4.join(process.cwd(), ".claude", "settings.json")),
+      claudeDesktopConfig: fs4.existsSync(claudePaths.desktopConfigPath),
+      cursorDir: fs4.existsSync(path4.join(homedir2(), ".cursor")),
+      mistralVibeConfig: fs4.existsSync(path4.join(process.cwd(), ".vibe", "config.toml")) || fs4.existsSync(path4.join(homedir2(), ".vibe", "config.toml")),
+      sniparaCompanionPack: fs4.existsSync(path4.join(process.cwd(), ".snipara", "companion")),
+      sniparaTemplates: fs4.existsSync(path4.join(process.cwd(), ".snipara", "templates")),
+      sniparaSkillPack: fs4.existsSync(path4.join(process.cwd(), ".snipara", "templates", "skills"))
     },
     tooling: {
-      node: commandExists("node"),
-      npm: commandExists("npm"),
-      pnpm: commandExists("pnpm"),
-      python: commandExists("python3") || commandExists("python"),
-      pip: commandExists("pip3") || commandExists("pip"),
-      uv: commandExists("uv"),
-      docker: commandExists("docker"),
-      git: commandExists("git"),
-      companionCli: Boolean(detectCompanionCommand()),
-      runtimeCli: Boolean(detectSandboxCommand()),
-      orchestratorCli: Boolean(detectOrchestratorCommand())
+      node: managed ? true : commandExists("node"),
+      npm: (managed ? executableOnPath : commandExists)("npm"),
+      pnpm: (managed ? executableOnPath : commandExists)("pnpm"),
+      python: (managed ? executableOnPath : commandExists)("python3") || (managed ? executableOnPath : commandExists)("python"),
+      pip: (managed ? executableOnPath : commandExists)("pip3") || (managed ? executableOnPath : commandExists)("pip"),
+      uv: (managed ? executableOnPath : commandExists)("uv"),
+      docker: (managed ? executableOnPath : commandExists)("docker"),
+      git: (managed ? executableOnPath : commandExists)("git"),
+      companionCli: managed ? false : Boolean(detectCompanionCommand()),
+      runtimeCli: managed ? false : Boolean(detectSandboxCommand()),
+      orchestratorCli: managed ? false : Boolean(detectOrchestratorCommand())
     },
     existingConfig: {
       slug: existingConfig?.slug,
@@ -5729,7 +6760,7 @@ function detectEnvironment() {
   };
 }
 function loadExistingAnswers(options) {
-  const detection = detectEnvironment();
+  const detection = detectEnvironment(options.profile === "local-work" || hasLocalWorkSelection());
   const effectiveProfile = resolveMaintenanceProfile(detection, options.profile);
   const deployment = resolveRequestedDeployment(options);
   const providedApiKey = options.apiKey?.trim();
@@ -5751,9 +6782,9 @@ function loadExistingAnswers(options) {
     apiKeyType,
     profile: effectiveProfile,
     aiClient: detection.aiClient,
-    skipCompanion: options.withCompanion === true ? false : !detection.tooling.companionCli && effectiveProfile !== "hosted-companion" && effectiveProfile !== "full-stack",
+    skipCompanion: effectiveProfile === "local-work" ? false : options.withCompanion === true ? false : !detection.tooling.companionCli && effectiveProfile !== "hosted-companion" && effectiveProfile !== "full-stack",
     skipMcp: options.withMcp === true ? false : !detection.existingConfig.hasSniparaServer && effectiveProfile === "runtime-only",
-    skipRuntime: options.withRuntime === true ? false : !detection.existingConfig.hasRuntimeServer && effectiveProfile !== "full-stack" && effectiveProfile !== "runtime-only",
+    skipRuntime: effectiveProfile === "local-work" ? false : options.withRuntime === true ? false : !detection.existingConfig.hasRuntimeServer && effectiveProfile !== "full-stack" && effectiveProfile !== "runtime-only",
     withOrchestrator: Boolean(options.withOrchestrator || detection.tooling.orchestratorCli),
     skipHooks: options.withHooks ? false : !shouldInstallDefaultHooks(detection.aiClient)
   });
@@ -5762,6 +6793,7 @@ function resolveMaintenanceProfile(detection, explicitProfile) {
   if (explicitProfile && isInstallProfile(explicitProfile)) {
     return explicitProfile;
   }
+  if (hasLocalWorkSelection()) return "local-work";
   if (detection.existingConfig.hasRuntimeServer && detection.existingConfig.hasSniparaServer) {
     return detection.tooling.companionCli ? "full-stack" : "full-stack";
   }
@@ -5806,22 +6838,22 @@ function collectConfiguredProjectSlugSignals(existingConfig = getExistingConfig(
     { source: ".snipara/project", slug: readProjectSlugFromProjectBinding() },
     {
       source: ".codex/config.toml",
-      slug: readProjectSlugFromTextFile(path.join(process.cwd(), ".codex", "config.toml"))
+      slug: readProjectSlugFromTextFile(path4.join(process.cwd(), ".codex", "config.toml"))
     },
     {
       source: ".snipara/templates/codex-config.toml",
       slug: readProjectSlugFromTextFile(
-        path.join(process.cwd(), ".snipara", "templates", "codex-config.toml")
+        path4.join(process.cwd(), ".snipara", "templates", "codex-config.toml")
       )
     },
     {
       source: ".vibe/config.toml",
-      slug: readProjectSlugFromTextFile(path.join(process.cwd(), ".vibe", "config.toml"))
+      slug: readProjectSlugFromTextFile(path4.join(process.cwd(), ".vibe", "config.toml"))
     },
     {
       source: ".snipara/templates/mistral-vibe-config.toml",
       slug: readProjectSlugFromTextFile(
-        path.join(process.cwd(), ".snipara", "templates", "mistral-vibe-config.toml")
+        path4.join(process.cwd(), ".snipara", "templates", "mistral-vibe-config.toml")
       )
     },
     { source: ".env.local", slug: readProjectSlugFromEnvFile(".env.local") },
@@ -5859,22 +6891,22 @@ function extractSlugFromText(content) {
   return normalizeSlugCandidate(match?.[1] ? decodeURIComponent(match[1]) : null);
 }
 function readProjectSlugFromTextFile(filePath) {
-  if (!fs.existsSync(filePath)) {
+  if (!fs4.existsSync(filePath)) {
     return null;
   }
   try {
-    return extractSlugFromText(fs.readFileSync(filePath, "utf-8"));
+    return extractSlugFromText(fs4.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function readProjectSlugFromProjectBinding() {
-  const filePath = path.join(process.cwd(), ".snipara", "project");
-  if (!fs.existsSync(filePath)) {
+  const filePath = path4.join(process.cwd(), ".snipara", "project");
+  if (!fs4.existsSync(filePath)) {
     return null;
   }
   try {
-    const content = fs.readFileSync(filePath, "utf-8").trim();
+    const content = fs4.readFileSync(filePath, "utf-8").trim();
     if (!content) {
       return null;
     }
@@ -5910,12 +6942,12 @@ function readProjectSlugFromEnvFile(file) {
   return null;
 }
 function readEnvValueFromFile(file, names) {
-  const filePath = path.join(process.cwd(), file);
-  if (!fs.existsSync(filePath)) {
+  const filePath = path4.join(process.cwd(), file);
+  if (!fs4.existsSync(filePath)) {
     return null;
   }
   try {
-    const content = fs.readFileSync(filePath, "utf-8");
+    const content = fs4.readFileSync(filePath, "utf-8");
     for (const line of content.split(/\r?\n/)) {
       const match = line.trim().match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
       if (!match || !names.includes(match[1])) {
@@ -5955,7 +6987,7 @@ function detectRepoProjectSlug() {
   return null;
 }
 function detectDirectoryProjectSlug() {
-  return slugifyFallback(path.basename(process.cwd()));
+  return slugifyFallback(path4.basename(process.cwd()));
 }
 function detectGitRepository() {
   try {
@@ -6017,50 +7049,50 @@ function isGitRepo() {
   }
 }
 function detectAiClient() {
-  if (fs.existsSync(path.join(process.cwd(), ".codex"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".codex"))) {
     return "codex";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".cursor"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".cursor"))) {
     return "cursor";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".kimi-code"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".kimi-code"))) {
     return "kimi";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".gemini"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".gemini"))) {
     return "gemini";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".vibe"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".vibe"))) {
     return "mistral";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".continue"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".continue"))) {
     return "continue";
   }
-  if (fs.existsSync(path.join(process.cwd(), ".vscode"))) {
+  if (fs4.existsSync(path4.join(process.cwd(), ".vscode"))) {
     return "vscode";
   }
-  if (fs.existsSync(path.join(homedir(), ".claude")) || process.env.CLAUDE_CODE) {
+  if (fs4.existsSync(path4.join(homedir2(), ".claude")) || process.env.CLAUDE_CODE) {
     return "claude-code";
   }
-  if (fs.existsSync(path.join(homedir(), ".cursor")) || process.env.CURSOR_EDITOR) {
+  if (fs4.existsSync(path4.join(homedir2(), ".cursor")) || process.env.CURSOR_EDITOR) {
     return "cursor";
   }
-  if (fs.existsSync(path.join(homedir(), ".kimi-code")) || process.env.KIMI_CODE_HOME) {
+  if (fs4.existsSync(path4.join(homedir2(), ".kimi-code")) || process.env.KIMI_CODE_HOME) {
     return "kimi";
   }
-  if (fs.existsSync(path.join(homedir(), ".gemini")) || process.env.GEMINI_CLI) {
+  if (fs4.existsSync(path4.join(homedir2(), ".gemini")) || process.env.GEMINI_CLI) {
     return "gemini";
   }
-  if (fs.existsSync(path.join(homedir(), ".vibe")) || process.env.MISTRAL_VIBE) {
+  if (fs4.existsSync(path4.join(homedir2(), ".vibe")) || process.env.MISTRAL_VIBE) {
     return "mistral";
   }
-  if (fs.existsSync(path.join(homedir(), ".continue")) || process.env.CONTINUE_GLOBAL_DIR) {
+  if (fs4.existsSync(path4.join(homedir2(), ".continue")) || process.env.CONTINUE_GLOBAL_DIR) {
     return "continue";
   }
-  const claudeDesktopPath = process.platform === "darwin" ? path.join(homedir(), "Library", "Application Support", "Claude") : process.platform === "win32" ? path.join(homedir(), "AppData", "Roaming", "Claude") : path.join(homedir(), ".config", "claude");
-  if (fs.existsSync(claudeDesktopPath)) {
+  const claudeDesktopPath = process.platform === "darwin" ? path4.join(homedir2(), "Library", "Application Support", "Claude") : process.platform === "win32" ? path4.join(homedir2(), "AppData", "Roaming", "Claude") : path4.join(homedir2(), ".config", "claude");
+  if (fs4.existsSync(claudeDesktopPath)) {
     return "claude-desktop";
   }
-  if (fs.existsSync(path.join(homedir(), ".codex"))) {
+  if (fs4.existsSync(path4.join(homedir2(), ".codex"))) {
     return "codex";
   }
   return "other";
@@ -6075,12 +7107,12 @@ function detectPipCommand() {
   return null;
 }
 function getExistingConfig() {
-  const mcpConfigPath = path.join(process.cwd(), ".mcp.json");
-  if (!fs.existsSync(mcpConfigPath)) {
+  const mcpConfigPath = path4.join(process.cwd(), ".mcp.json");
+  if (!fs4.existsSync(mcpConfigPath)) {
     return null;
   }
   try {
-    const config = JSON.parse(fs.readFileSync(mcpConfigPath, "utf-8"));
+    const config = JSON.parse(fs4.readFileSync(mcpConfigPath, "utf-8"));
     const sniparaServer = config.mcpServers?.snipara;
     const runtimeServer = config.mcpServers?.[SANDBOX_SERVER_NAME] || config.mcpServers?.[LEGACY_RUNTIME_SERVER_NAME];
     return {
@@ -6100,12 +7132,12 @@ function getExistingConfig() {
   }
 }
 function readExistingCompanionProjectId() {
-  const configPath = path.join(process.cwd(), ".snipara", "companion", "config.json");
-  if (!fs.existsSync(configPath)) {
+  const configPath = path4.join(process.cwd(), ".snipara", "companion", "config.json");
+  if (!fs4.existsSync(configPath)) {
     return void 0;
   }
   try {
-    const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const parsed = JSON.parse(fs4.readFileSync(configPath, "utf-8"));
     return typeof parsed.projectId === "string" && parsed.projectId ? parsed.projectId : void 0;
   } catch {
     return void 0;