halfcycle 0.11.0 → 0.12.0-rc.1

package/bin/bin.bundle.mjs

@@ -14804,12 +14804,34 @@ function looksLikeSecret(text) {
 var MCP_REGISTRATION_REL = ".mcp.json";
 var MCP_SERVER_KEY = "halfcycle";
 
+// ../core/dist/release-version.js
+var RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+
+// ../core/dist/release-tag.js
+var PRE_RELEASE_VERSION_PATTERN = /^(\d+\.\d+\.\d+)-rc\.\d+$/;
+var PACKAGE_COMMAND = "npx halfcycle";
+function isPreReleaseVersion(value) {
+  return typeof value === "string" && PRE_RELEASE_VERSION_PATTERN.test(value);
+}
+function releaseTagOfVersion(version2) {
+  return isPreReleaseVersion(version2) ? "next" : "latest";
+}
+function halfcycleCommand(version2) {
+  return `${PACKAGE_COMMAND}@${releaseTagOfVersion(version2)}`;
+}
+function bareHalfcycleCommand(version2) {
+  return releaseTagOfVersion(version2) === "next" ? `${PACKAGE_COMMAND}@next` : PACKAGE_COMMAND;
+}
+
 // ../core/dist/shell-quote.js
 function quoteForShell(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-var HALFCYCLE_COMMAND = "npx halfcycle@latest";
-var DOCTOR_LINE = "Run `npx halfcycle doctor` to check set up, sign-in, connection, checks and version.";
+var HALFCYCLE_COMMAND = halfcycleCommand();
+function doctorLine(version2) {
+  return `Run \`${bareHalfcycleCommand(version2)} doctor\` to check set up, sign-in, connection, checks and version.`;
+}
+var DOCTOR_LINE = doctorLine();
 
 // ../core/dist/folder-trust.js
 var CLAUDE_STATE_FILENAME = ".claude.json";
@@ -15107,9 +15129,6 @@ function typedPhaseReference(phase, number4) {
   return phase.includes(":") && number4 !== null ? String(number4) : phase;
 }
 
-// ../core/dist/release-version.js
-var RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
-
 // ../core/dist/github-address.js
 var GITHUB_REPOSITORY_ADDRESS = /^https:\/\/github\.com\/[A-Za-z0-9][A-Za-z0-9-]{0,38}\/(?!\.{1,2}$)[A-Za-z0-9._-]{1,100}$/;
 var HOST = "[Gg][Ii][Tt][Hh][Uu][Bb]\\.[Cc][Oo][Mm]";
@@ -15148,8 +15167,14 @@ function githubRepositoryAddress(remote) {
 }
 
 // ../core/dist/sign-in.js
-var SIGN_IN_COMMAND = '"npx halfcycle"';
-var HOOK_REMEDY = `Run ${SIGN_IN_COMMAND} in the project folder to sign in.`;
+function signInCommand(version2) {
+  return `"${bareHalfcycleCommand(version2)}"`;
+}
+var SIGN_IN_COMMAND = signInCommand();
+function hookRemedy(version2) {
+  return `Run ${signInCommand(version2)} in the project folder to sign in.`;
+}
+var HOOK_REMEDY = hookRemedy();
 
 // ../core/dist/task-plan.js
 var TASK_PLAN_FILE = "docs/build-records/task-plan.json";
@@ -15261,7 +15286,7 @@ function codexHookCommand(script, args2) {
   const invocation = `cd "$(git rev-parse --show-toplevel)" && bash ./${script}`;
   return args2 === void 0 ? invocation : `${invocation} ${args2}`;
 }
-var CODEX_WINDOWS_NOT_SET_UP = "Halfcycle checks did not run because Halfcycle is not set up in this folder or any folder above it; run npx halfcycle in the project folder.";
+var CODEX_WINDOWS_NOT_SET_UP = `Halfcycle checks did not run because Halfcycle is not set up in this folder or any folder above it; run ${bareHalfcycleCommand()} in the project folder.`;
 var CODEX_WINDOWS_NO_GIT_BASH = "Halfcycle checks did not run because Git for Windows was not found; install Git for Windows, then open a new session.";
 function codexHookCommandWindows(script, args2) {
   const tick = (text) => "`" + text + "`";
@@ -18925,6 +18950,10 @@ function paceClockOf(at, now) {
   return `${day} ${clock}`;
 }
 var PACE_P5 = "This build may use all of your allowance. It will not slow down to leave room for you.";
+function paceP8Of(version2) {
+  return `For these to work, run "${bareHalfcycleCommand(version2)}" once more in this project.`;
+}
+var PACE_P8 = paceP8Of();
 function paceS1Of(window, k, until, now, keepFreePercent) {
   return `Halfcycle is slowing this build so you keep about ${paceShareWordsOf(keepFreePercent)} of this ${paceWindowWordsOf(window)} for your own work. It will run at most ${paceAgentsOf(k)} at once until ${paceClockOf(until, now)}.`;
 }
@@ -19170,7 +19199,10 @@ var CLIENT_VERSION_HEADER = "x-halfcycle-client";
 var TYPED_APPROVAL_OFF_SENTENCE = "Approving by typing is switched off for now.";
 var HEADLESS_CANNOT_APPROVE = "(a headless session cannot approve, by design)";
 var TYPED_REVIEW_OFF_SENTENCE = "Reviewing by typing is switched off for now.";
-var CLIENT_UPDATE_SENTENCE = `To approve by typing in a session, Halfcycle needs updating: run \`${HALFCYCLE_COMMAND}\` in this project's folder, then reopen your session and ask again.`;
+function clientUpdateSentence(version2) {
+  return `To approve by typing in a session, Halfcycle needs updating: run \`${halfcycleCommand(version2)}\` in this project's folder, then reopen your session and ask again.`;
+}
+var CLIENT_UPDATE_SENTENCE = clientUpdateSentence();
 
 // ../events/dist/device-auth.js
 var utcIso86012 = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
@@ -19385,15 +19417,15 @@ var reviewNoticesSchema = external_exports.object({
 function phaseCalled(phase) {
   return `phase "${phase}"`;
 }
-function questionNotice(entry) {
-  const answer = `${HALFCYCLE_COMMAND} review ${quoteForShell(entry.phase)} --answer ${quoteForShell(entry.part)} "<your answer>"`;
+function questionNotice(entry, version2) {
+  const answer = `${halfcycleCommand(version2)} review ${quoteForShell(entry.phase)} --answer ${quoteForShell(entry.part)} "<your answer>"`;
   return `Before anything else: the project's owner asked about "${entry.partName}" in the review of ${phaseCalled(entry.phase)}: ${entry.question} Answer it with ${answer}.`;
 }
 function sentBackNotice2(entry) {
   return `Before anything else: the project's owner sent "${entry.partName}" in ${phaseCalled(entry.phase)} back to building: ${entry.note} Rebuild it: add or reopen the tasks that build it. For each task that rebuilds it, add a task that reviews the rebuild, held by a different agent from the one that built it. When each review has passed, report the build with the time each task finished, then run the close step again.`;
 }
-function reviewNoticeText(review) {
-  return [...review.questions.map(questionNotice), ...review.sentBack.map(sentBackNotice2)];
+function reviewNoticeText(review, version2) {
+  return [...review.questions.map((entry) => questionNotice(entry, version2)), ...review.sentBack.map(sentBackNotice2)];
 }
 
 // ../events/dist/credential-wire.js
@@ -19420,8 +19452,14 @@ var CREDENTIAL_PLACEHOLDERS = [
   UPDATE_CLAUDE_CODE_PLACEHOLDER
 ];
 var SWITCH_ACCOUNT_ANSWER = 'answer "s" when asked';
-var NO_CREDENTIAL_SENTENCE = 'Halfcycle is not connected: this machine has no working Halfcycle credential for this project. Run "npx halfcycle" in the project folder to sign in again.';
-var NOT_THIS_ACCOUNT_SENTENCE = `Halfcycle is not connected: this project belongs to another Halfcycle account. To switch, run "npx halfcycle" in this project and ${SWITCH_ACCOUNT_ANSWER}.`;
+function noCredentialSentence(version2) {
+  return `Halfcycle is not connected: this machine has no working Halfcycle credential for this project. Run "${bareHalfcycleCommand(version2)}" in the project folder to sign in again.`;
+}
+var NO_CREDENTIAL_SENTENCE = noCredentialSentence();
+function notThisAccountSentence(version2) {
+  return `Halfcycle is not connected: this project belongs to another Halfcycle account. To switch, run "${bareHalfcycleCommand(version2)}" in this project and ${SWITCH_ACCOUNT_ANSWER}.`;
+}
+var NOT_THIS_ACCOUNT_SENTENCE = notThisAccountSentence();
 var UPDATE_CLAUDE_CODE_SENTENCE = "Halfcycle is not connected: this Claude Code version does not name the server it connects to, so no credential was sent. Update Claude Code, then reopen.";
 var CANNOT_REACH_SENTENCE = "Halfcycle is not connected: its server could not be reached, so its tools are unavailable in this session. Check your network, then reopen the project.";
 var SERVICE_PROBLEM_SENTENCE = "Halfcycle is not connected: its service had a problem just now, so nothing in this session is being checked. Reopen the project to try again.";
@@ -19432,6 +19470,13 @@ var PLACEHOLDER_SENTENCES = Object.freeze({
   [NOT_THIS_ACCOUNT_PLACEHOLDER]: NOT_THIS_ACCOUNT_SENTENCE,
   [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
 });
+function placeholderSentencesOf(version2) {
+  return Object.freeze({
+    [NO_CREDENTIAL_PLACEHOLDER]: noCredentialSentence(version2),
+    [NOT_THIS_ACCOUNT_PLACEHOLDER]: notThisAccountSentence(version2),
+    [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
+  });
+}
 
 // ../events/dist/scope-chat.js
 var chatScopeApproveRequestSchema = external_exports.object({
@@ -19862,8 +19907,8 @@ var AUTONOMY_A5 = "Builds in this project wait for you again.";
 function withoutFinalStop(text) {
   return text.endsWith(".") ? text.slice(0, -1) : text;
 }
-function autonomyA9(what, id) {
-  return `Halfcycle saved a copy before this: ${withoutFinalStop(what)}. To bring it back, run: ${HALFCYCLE_COMMAND} restore ${id} (kept for 7 days).`;
+function autonomyA9(what, id, version2) {
+  return `Halfcycle saved a copy before this: ${withoutFinalStop(what)}. To bring it back, run: ${halfcycleCommand(version2)} restore ${id} (kept for 7 days).`;
 }
 function autonomyA10(typeSentence, item) {
   return `${typeSentence} Builds run on their own here, but this still waits for the owner. Declare it with halfcycle_declare_owner_wait, item ${String(item)}, and carry on with other work.`;
@@ -19929,6 +19974,53 @@ function checksReportOfInstructions(text) {
 // dist/hook-protocol.js
 import { writeSync } from "node:fs";
 
+// dist/pinned-engagement.js
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+function readPinnedId(root) {
+  let raw;
+  try {
+    raw = readFileSync(resolve(root, BUNDLE_PIN_REL), "utf-8");
+  } catch {
+    return { problem: "no-pin" };
+  }
+  let pin;
+  try {
+    pin = JSON.parse(raw);
+  } catch {
+    return { problem: "no-id" };
+  }
+  const id = typeof pin === "object" && pin !== null ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
+  return typeof id === "string" && id !== "" ? { id } : { problem: "no-id" };
+}
+function pinnedEngagementId(root) {
+  const pinned = readPinnedId(root);
+  return "id" in pinned && isEngagementId(pinned.id) ? pinned.id : void 0;
+}
+function projectFolder(env = process.env) {
+  const dir = env["CLAUDE_PROJECT_DIR"];
+  return dir !== void 0 && dir !== "" ? dir : process.cwd();
+}
+function readPinnedVersion(root) {
+  let raw;
+  try {
+    raw = readFileSync(resolve(root, BUNDLE_PIN_REL), "utf-8");
+  } catch {
+    return void 0;
+  }
+  let pin;
+  try {
+    pin = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const version2 = typeof pin === "object" && pin !== null ? pin["version"] : void 0;
+  return typeof version2 === "string" && version2 !== "" ? version2 : void 0;
+}
+function installedVersion(env = process.env) {
+  return readPinnedVersion(projectFolder(env));
+}
+
 // dist/agent-argument.js
 var AGENT_FLAG = "--agent";
 function agentFromArguments(rest) {
@@ -19996,9 +20088,10 @@ function hookReply(event, profile = AGENT_PROFILES["claude-code"]) {
     if (!owesDoctorLine || doctorLineSaid)
       return;
     doctorLineSaid = true;
-    queued.push(DOCTOR_LINE);
+    const doctor = doctorLine(installedVersion());
+    queued.push(doctor);
     if (personOwedDoctorLine)
-      forPerson.push(DOCTOR_LINE);
+      forPerson.push(doctor);
   };
   return {
     notice(text) {
@@ -20020,7 +20113,7 @@ function hookReply(event, profile = AGENT_PROFILES["claude-code"]) {
     },
     loud(text, exitCode, notAFailure) {
       const said = notAFailure !== void 0 || doctorLineSaid ? text : `${text.trimEnd()}
-${DOCTOR_LINE}
+${doctorLine(installedVersion())}
 `;
       if (notAFailure === void 0)
         doctorLineSaid = true;
@@ -20112,7 +20205,7 @@ function lastResortReply(argv, text) {
 function answerUnexpectedError(argv, err, out) {
   const text = `halfcycle-runner: unexpected error: ${err instanceof Error ? err.message : String(err)}
 Contact hello@halfcycle.ai if this keeps happening.
-${DOCTOR_LINE}
+${doctorLine(installedVersion())}
 `;
   const reply = lastResortReply(argv, text);
   if (reply !== null) {
@@ -20150,7 +20243,7 @@ function noRepositoryText(failure) {
 }
 function contractFaultText(message) {
   return `[Halfcycle] WARNING: Guard response could not be understood \u2014 ${message}
-This is not a service outage: the guard service answered. The suspect is this repository's own installed halfcycle runner, which is out of date with what the service now sends. Update it: run "npx halfcycle" in this repository, then retry. Session continues (fail-open).`;
+This is not a service outage: the guard service answered. The suspect is this repository's own installed halfcycle runner, which is out of date with what the service now sends. Update it: run ${signInCommand(installedVersion())} in this repository, then retry. Session continues (fail-open).`;
 }
 var UNCONFIGURED_EXIT_TOOL_USE = 2;
 var UNCONFIGURED_EXIT_STOP_FAMILY = 1;
@@ -20166,8 +20259,8 @@ function emitNeverConfigured(exitCode, reason, engagementId, reply) {
   writeSync(2, text);
   process.exitCode = exitCode;
 }
-function namesTheSignInCommand(text) {
-  return text.includes(SIGN_IN_COMMAND);
+function namesTheSignInCommand(text, version2) {
+  return text.includes(signInCommand(version2 ?? installedVersion()));
 }
 var PERMISSIONS_BLOCK = "\n    permissions:\n      contents: read\n      id-token: write\n\n";
 var BOTH_LINES_SENTENCE = "BOTH LINES. Declaring any permission replaces the defaults rather than adding to them, so a block naming only the identity token takes read access away from the checkout step and a private repository stops checking out before this check is reached.";
@@ -20192,13 +20285,13 @@ ${CI_OLDER_SETUP}
 `;
 }
 function notThisAccountReport(label, engagementId) {
-  return `${label} This project belongs to another Halfcycle account. Halfcycle is Solo today \u2014 one person works on a project at a time \u2014 so no credential exists for this machine and none will be issued. Nothing here needs fixing; this copy simply is not checked. ${requestAccessSentence(engagementId)} If this account is wrong, sign in as the one that owns the project and run "npx halfcycle" again.
+  return `${label} This project belongs to another Halfcycle account. Halfcycle is Solo today \u2014 one person works on a project at a time \u2014 so no credential exists for this machine and none will be issued. Nothing here needs fixing; this copy simply is not checked. ${requestAccessSentence(engagementId)} If this account is wrong, sign in as the one that owns the project and run ${signInCommand(installedVersion())} again.
 `;
 }
 function neverConfiguredReport(reason, label = "[Halfcycle]", engagementId) {
   switch (reason) {
     case "no-credential-yet":
-      return neverConfiguredMessage(HOOK_REMEDY, label);
+      return neverConfiguredMessage(hookRemedy(installedVersion()), label);
     case "not-this-account":
       return notThisAccountReport(label, engagementId);
   }
@@ -20242,7 +20335,7 @@ This is not a service outage. The guard service is up and replying; ${cause}, so
 ${remedy}
 `;
 }
-function emitCredentialRejected(statusCode, serviceMessage, exitCode, remedy = HOOK_REMEDY, reply) {
+function emitCredentialRejected(statusCode, serviceMessage, exitCode, remedy = hookRemedy(installedVersion()), reply) {
   const text = credentialRejectedMessage(statusCode, serviceMessage, remedy);
   if (reply !== void 0) {
     reply.loud(text, exitCode);
@@ -20256,7 +20349,7 @@ function credentialRenewalFailedMessage(remedy, label = "[Halfcycle]") {
 ${remedy}
 `;
 }
-function noCoverageStatement(reason, remedySaid = false, engagementId) {
+function noCoverageStatement(reason, remedySaid = false, engagementId, version2 = installedVersion()) {
   if (reason === "not-this-account") {
     return [
       "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked.",
@@ -20265,11 +20358,11 @@ function noCoverageStatement(reason, remedySaid = false, engagementId) {
       "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming.",
       `[halfcycle] ${requestAccessSentence(engagementId)}`,
       "[halfcycle] If this account is wrong, sign in as the one that owns the project and run",
-      '[halfcycle] "npx halfcycle" again.'
+      `[halfcycle] ${signInCommand(version2)} again.`
     ].join("\n");
   }
   const statement = `${NO_SIGN_IN_HERE}, so edits made in this session won't be checked.`;
-  return remedySaid ? statement : `${statement} ${HOOK_REMEDY}`;
+  return remedySaid ? statement : `${statement} ${hookRemedy(version2)}`;
 }
 function notRunReport(notRun, label = "[Halfcycle]") {
   if (!notRun || notRun.length === 0)
@@ -20494,7 +20587,7 @@ async function attempt2(url2, token, request, fetchFn, retry) {
 
 // dist/git.js
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { relative } from "node:path";
 var COLOR_AWARE_SUBCOMMANDS = /* @__PURE__ */ new Set(["diff", "show", "log"]);
 function spawnGit(args2, cwd, timeoutMs, extra) {
@@ -20527,7 +20620,7 @@ function getSingleFileDiff(absFilePath, repoRoot) {
     return diffResult.value;
   }
   try {
-    const content = readFileSync(absFilePath, "utf-8");
+    const content = readFileSync2(absFilePath, "utf-8");
     if (!content.trim())
       return "";
     const lines2 = content.split("\n");
@@ -21354,7 +21447,7 @@ function detectBlastRadiusMarkers(filePath, diffContent) {
 }
 
 // dist/extract/numeric-columns.js
-import { readFileSync as readFileSync2, readdirSync } from "node:fs";
+import { readFileSync as readFileSync3, readdirSync } from "node:fs";
 import { join as join2 } from "node:path";
 function extractNumericColumns(diffContent, context = {}) {
   const addedLines = [];
@@ -21432,7 +21525,7 @@ function walkForRegistrations(dir, repoRoot, acc) {
       continue;
     let content;
     try {
-      content = readFileSync2(absPath, "utf-8");
+      content = readFileSync3(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -21569,7 +21662,7 @@ function resolveWireFields(lines2, decls) {
 }
 
 // dist/fixtures-manifest.js
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join as join3 } from "node:path";
 function manifestPath(repoRoot) {
   return join3(repoRoot, "test", "fixtures", "captured", "manifest.json");
@@ -21582,7 +21675,7 @@ function loadManifest(repoRoot) {
     return [];
   let raw;
   try {
-    raw = readFileSync3(manifestPath(repoRoot), "utf-8");
+    raw = readFileSync4(manifestPath(repoRoot), "utf-8");
   } catch {
     return [];
   }
@@ -21855,7 +21948,7 @@ function toAstShapes(markers) {
 }
 
 // dist/extract/context.js
-import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "node:fs";
 import { join as join4, relative as relative2, sep } from "node:path";
 
 // dist/extract/repo-facts.js
@@ -22005,7 +22098,7 @@ function walk(dir, repoRoot, acc, facts, underDocs = false) {
     noteFileName(facts, entry.name, underDocs);
     if (!underDocs && isFactManifest(entry.name)) {
       try {
-        noteManifest(facts, entry.name, readFileSync4(join4(dir, entry.name), "utf-8"));
+        noteManifest(facts, entry.name, readFileSync5(join4(dir, entry.name), "utf-8"));
       } catch {
         continue;
       }
@@ -22016,7 +22109,7 @@ function walk(dir, repoRoot, acc, facts, underDocs = false) {
     const absPath = join4(dir, entry.name);
     let content;
     try {
-      content = readFileSync4(absPath, "utf-8");
+      content = readFileSync5(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -22350,34 +22443,6 @@ function cleanRunSummary(verdict, scope) {
   return `[Halfcycle CI] ${verdict} ${files}, ${scope.signals} signal(s) checked.`;
 }
 
-// dist/pinned-engagement.js
-import { readFileSync as readFileSync5 } from "node:fs";
-import { resolve } from "node:path";
-function readPinnedId(root) {
-  let raw;
-  try {
-    raw = readFileSync5(resolve(root, BUNDLE_PIN_REL), "utf-8");
-  } catch {
-    return { problem: "no-pin" };
-  }
-  let pin;
-  try {
-    pin = JSON.parse(raw);
-  } catch {
-    return { problem: "no-id" };
-  }
-  const id = typeof pin === "object" && pin !== null ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
-  return typeof id === "string" && id !== "" ? { id } : { problem: "no-id" };
-}
-function pinnedEngagementId(root) {
-  const pinned = readPinnedId(root);
-  return "id" in pinned && isEngagementId(pinned.id) ? pinned.id : void 0;
-}
-function projectFolder(env = process.env) {
-  const dir = env["CLAUDE_PROJECT_DIR"];
-  return dir !== void 0 && dir !== "" ? dir : process.cwd();
-}
-
 // dist/credential-store.js
 import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync6, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2, realpathSync } from "node:fs";
 import { homedir as homedir3, platform } from "node:os";
@@ -22514,12 +22579,12 @@ async function mintThroughJoin(controlOrigin, engagementId, accountCredential, f
   }
   if (!response.ok) {
     if (response.status === UNAUTHORIZED)
-      return { ok: false, remedy: HOOK_REMEDY };
+      return { ok: false, remedy: hookRemedy(installedVersion()) };
     return { ok: false, remedy: planeSentence(body) ?? UNREADABLE_REFUSAL_REMEDY };
   }
   const parsed = engagementCredentialResponseSchema.safeParse(body);
   if (!parsed.success)
-    return { ok: false, remedy: UNREADABLE_MINT_REMEDY };
+    return { ok: false, remedy: unreadableMintRemedy() };
   return { ok: true, token: parsed.data.sessionToken, source: "mint" };
 }
 function planeSentence(body) {
@@ -22530,11 +22595,13 @@ function planeSentence(body) {
 }
 var UNREACHABLE_REMEDY = "The Halfcycle service could not be reached to renew this credential. Nothing is wrong with this repository; the next change will try again.";
 var UNREADABLE_REFUSAL_REMEDY = "The Halfcycle service declined to renew this credential and gave no reason this version could read.";
-var UNREADABLE_MINT_REMEDY = 'The Halfcycle service answered with a credential this version could not read. Update the installed Halfcycle runner: run "npx halfcycle" in this repository.';
+function unreadableMintRemedy() {
+  return `The Halfcycle service answered with a credential this version could not read. Update the installed Halfcycle runner: run ${signInCommand(installedVersion())} in this repository.`;
+}
 async function refreshEngagementCredential(opts) {
   const envFilePath = readEnvFilePath(opts.source);
   if (!envFilePath)
-    return { ok: false, remedy: HOOK_REMEDY };
+    return { ok: false, remedy: hookRemedy(installedVersion()) };
   const stored = readStoredEngagementToken(envFilePath);
   if (stored !== void 0 && stored !== opts.refusedToken) {
     return { ok: true, token: stored, source: "disk" };
@@ -22542,7 +22609,7 @@ async function refreshEngagementCredential(opts) {
   const controlOrigin = readControlOrigin(opts.source).origin;
   const accountCredential = readAccountCredential(controlOrigin, opts.home);
   if (!accountCredential)
-    return { ok: false, remedy: HOOK_REMEDY };
+    return { ok: false, remedy: hookRemedy(installedVersion()) };
   const minted = await mintThroughJoin(controlOrigin, opts.engagementId, accountCredential, opts.fetchFn ?? globalThis.fetch);
   if (!minted.ok)
     return minted;
@@ -22563,10 +22630,10 @@ async function evaluateWithRefresh(opts) {
   const fetchFn = opts.fetchFn ?? globalThis.fetch;
   const first = await evaluate(opts.guardServiceUrl, opts.token, opts.request, fetchFn);
   if (first.ok)
-    return { result: first, token: opts.token, remedy: HOOK_REMEDY };
+    return { result: first, token: opts.token, remedy: hookRemedy(installedVersion()) };
   const failure = classifyFailure(first);
   if (failure.kind !== "credential" || failure.statusCode !== UNAUTHORIZED) {
-    return { result: first, token: opts.token, remedy: HOOK_REMEDY };
+    return { result: first, token: opts.token, remedy: hookRemedy(installedVersion()) };
   }
   const refreshed = await refreshEngagementCredential({
     engagementId: opts.engagementId,
@@ -22578,7 +22645,7 @@ async function evaluateWithRefresh(opts) {
   if (!refreshed.ok)
     return { result: first, token: opts.token, remedy: refreshed.remedy };
   const retry = await evaluate(opts.guardServiceUrl, refreshed.token, opts.request, fetchFn);
-  return { result: retry, token: refreshed.token, remedy: HOOK_REMEDY };
+  return { result: retry, token: refreshed.token, remedy: hookRemedy(installedVersion()) };
 }
 
 // dist/hooks/marker.js
@@ -23708,7 +23775,7 @@ async function observeChanges(sessionId, reply, deps = {}) {
 var R1_START_NOT_HERE = "Halfcycle cannot count what this phase has changed on this computer yet, because the commit the phase started from is not here. Get the project's latest history, and it counts again at the end of the next reply.";
 var R2_START_NOT_ON_BRANCH = "Halfcycle cannot count what this phase has changed on this branch, because the branch does not contain the commit the phase started from. Switch to the branch the phase is built on, and it counts again at the end of the next reply.";
 function r3NoStartRecorded(phase) {
-  return `Halfcycle cannot count what phase "${phase}" changes, because no starting commit was recorded when it opened. To count from where the project is now, run: ${HALFCYCLE_COMMAND} open-phase ${quoteForShell(phase)} --actor "you" --evidence "<what shows this phase is ready to start>"`;
+  return `Halfcycle cannot count what phase "${phase}" changes, because no starting commit was recorded when it opened. To count from where the project is now, run: ${halfcycleCommand(installedVersion())} open-phase ${quoteForShell(phase)} --actor "you" --evidence "<what shows this phase is ready to start>"`;
 }
 function r4OutsideThePlan(parts) {
   const first = parts.length === 1 ? "Halfcycle saw changes to a part this phase's plan does not include:" : "Halfcycle saw changes to parts this phase's plan does not include:";
@@ -29412,21 +29479,187 @@ function recogniseSimple(cmd) {
 function programForms(words) {
   const forms = [words];
   const prog = basename3(words[0].text);
+  const args2 = words.slice(1);
   let rest;
   if (prog === "npx" || prog === "bunx" || prog === "pnpx") {
-    rest = skipRunnerOptions(words.slice(1));
+    rest = skipRunnerOptions(args2);
   } else if (prog === "npm" || prog === PNPM || prog === "yarn" || prog === "bun") {
-    const lead = skipLeading(words.slice(1), MANAGER_VALUE_OPTIONS);
+    const lead = skipLeading(args2, MANAGER_VALUE_OPTIONS);
     const sub = lead[0]?.text;
     if (sub === "exec" || sub === "dlx" || sub === "x")
       rest = skipRunnerOptions(lead.slice(1));
     else if (sub !== void 0 && prog !== "npm")
       rest = lead;
+  } else {
+    const started = PYTHON_PROGRAM.test(prog) ? pythonStarts(args2) : prog === "ruby" ? rubyStarts(args2) : prog === "bundle" ? bundleExecStarts(args2) : prog === "go" ? goRunStarts(args2) : prog === "cargo" ? cargoRunStarts(args2) : void 0;
+    if (started !== void 0 && started.length > 0 && startsPublisher(started[0]))
+      rest = started;
   }
   if (rest !== void 0 && rest.length > 0)
     forms.push(rest);
   return forms;
 }
+var PYTHON_PROGRAM = /^python(\d+(\.\d+)*)?$/;
+function startsPublisher(word) {
+  const prog = basename3(word.text);
+  return Object.hasOwn(PUBLISH_SEQUENCES, prog) || Object.hasOwn(DEPLOY_SEQUENCES, prog) || prog === VERCEL;
+}
+function readCluster(args2, i, letters) {
+  const word = args2[i];
+  const t = word.text;
+  for (let k = 1; k < t.length; k++) {
+    const c = t[k];
+    if (letters.stop.includes(c))
+      return null;
+    const tail = t.slice(k + 1);
+    if (letters.start.includes(c))
+      return tail !== "" ? [{ text: tail, literal: word.literal }, ...args2.slice(i + 1)] : args2.slice(i + 1);
+    if (letters.value.includes(c))
+      return tail !== "" ? i + 1 : i + 2;
+    if (letters.attached.includes(c))
+      return i + 1;
+  }
+  return i + 1;
+}
+function interpreterStarts(args2, letters) {
+  let i = 0;
+  while (i < args2.length) {
+    const t = args2[i].text;
+    if (t === "--")
+      return args2.slice(i + 1);
+    if (t === "-")
+      return void 0;
+    if (!t.startsWith("-"))
+      return args2.slice(i);
+    if (t.startsWith("--")) {
+      i++;
+      continue;
+    }
+    const next = readCluster(args2, i, letters);
+    if (next === null)
+      return void 0;
+    if (typeof next !== "number")
+      return next;
+    i = next;
+  }
+  return void 0;
+}
+function pythonStarts(args2) {
+  return interpreterStarts(args2, { stop: "c", start: "m", value: "WX", attached: "" });
+}
+function rubyStarts(args2) {
+  return interpreterStarts(args2, { stop: "e", start: "S", value: "IrCE", attached: "0FiKTWx" });
+}
+function bundleExecStarts(args2) {
+  const lead = skipLeading(args2, EMPTY);
+  return lead[0]?.text === "exec" ? skipLeading(lead.slice(1), EMPTY) : void 0;
+}
+var GO_BUILD_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "C",
+  "p",
+  "asmflags",
+  "buildmode",
+  "compiler",
+  "coverpkg",
+  "covermode",
+  "exec",
+  "gccgoflags",
+  "gcflags",
+  "installsuffix",
+  "ldflags",
+  "mod",
+  "modfile",
+  "overlay",
+  "pgo",
+  "pkgdir",
+  "tags",
+  "toolexec"
+]);
+function goRunStarts(args2) {
+  if (args2[0]?.text !== "run")
+    return void 0;
+  const rest = args2.slice(1);
+  let i = 0;
+  while (i < rest.length) {
+    const t = rest[i].text;
+    if (t === "--") {
+      i++;
+      break;
+    }
+    if (!t.startsWith("-"))
+      break;
+    const name = t.replace(/^--?/, "");
+    i += !name.includes("=") && GO_BUILD_VALUE_FLAGS.has(name) ? 2 : 1;
+  }
+  const pkg = rest[i];
+  if (pkg === void 0 || pkg.text.startsWith(".") || pkg.text.startsWith("/") || pkg.text.endsWith(".go"))
+    return void 0;
+  const parts = pkg.text.split("@")[0].split("/").filter((p) => p !== "");
+  let last = parts.pop();
+  if (last !== void 0 && /^v\d+$/.test(last) && parts.length > 0)
+    last = parts.pop();
+  return last === void 0 ? void 0 : [{ text: last, literal: pkg.literal }, ...rest.slice(i + 1)];
+}
+var CARGO_VALUE_OPTIONS = /* @__PURE__ */ new Set(["-C", "-Z", "--config", "--color"]);
+var CARGO_RUN_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+  "-F",
+  "--features",
+  "--target",
+  "--target-dir",
+  "--manifest-path",
+  "-j",
+  "--jobs",
+  "--profile",
+  "--color",
+  "--config",
+  "-Z",
+  "--message-format",
+  "--lockfile-path"
+]);
+var CARGO_PROGRAM_OPTIONS = ["--bin", "--example", "-p", "--package"];
+function cargoRunStarts(args2) {
+  let i = 0;
+  while (i < args2.length) {
+    const t = args2[i].text;
+    if (t === "--" || !(t.startsWith("-") || t.startsWith("+")))
+      break;
+    i += CARGO_VALUE_OPTIONS.has(t) ? 2 : 1;
+  }
+  const sub = args2[i]?.text;
+  if (sub !== "run" && sub !== "r")
+    return void 0;
+  const rest = args2.slice(i + 1);
+  let named;
+  let namedByPackage = false;
+  const passed = [];
+  for (let j = 0; j < rest.length; j++) {
+    const word = rest[j];
+    const t = word.text;
+    if (t === "--") {
+      passed.push(...rest.slice(j + 1));
+      break;
+    }
+    if (!t.startsWith("-")) {
+      passed.push(word);
+      continue;
+    }
+    const eq = t.indexOf("=");
+    const attachedP = /^-p[^=]/.test(t);
+    const name = attachedP ? "-p" : eq < 0 ? t : t.slice(0, eq);
+    if (CARGO_PROGRAM_OPTIONS.includes(name)) {
+      const value = attachedP ? { text: t.slice(2), literal: word.literal } : eq < 0 ? rest[++j] : { text: t.slice(eq + 1), literal: word.literal };
+      const byPackage = name === "-p" || name === "--package";
+      if (value !== void 0 && (named === void 0 || namedByPackage && !byPackage)) {
+        named = value;
+        namedByPackage = byPackage;
+      }
+      continue;
+    }
+    if (eq < 0 && CARGO_RUN_VALUE_OPTIONS.has(name))
+      j++;
+  }
+  return named === void 0 ? void 0 : [named, ...passed];
+}
 var MANAGER_VALUE_OPTIONS = /* @__PURE__ */ new Set(["--filter", "-F", "-C", "--dir", "--prefix", "--cwd", "--workspace"]);
 function skipLeading(words, valueOptions) {
   let j = 0;
@@ -30085,9 +30318,10 @@ function publishMatch(cmd, prog, args2) {
     return [];
   return containsSequence(operandTexts(args2), seqs) ? [{ type: "publish", program: prog, command: cmd }] : [];
 }
+var VERCEL = "vercel";
 var PRODUCTION_DEPLOY_OPTIONS = ["--prod", "--production"];
 function deployMatch(cmd, prog, args2) {
-  if (prog === "vercel") {
+  if (prog === VERCEL) {
     return hasLong(args2, ...PRODUCTION_DEPLOY_OPTIONS) ? [{ type: "deploy", program: prog, command: cmd }] : [];
   }
   const seqs = DEPLOY_SEQUENCES[prog];
@@ -33187,6 +33421,97 @@ function judgeChange(input, call, deps) {
   };
 }
 
+// dist/risky/skip-checks.js
+var SKIP_CHECKS_GIT_SUBCOMMANDS = ["commit", "push"];
+var GIT_PROGRAM = "git";
+var NO_VERIFY = "--no-verify";
+var COMMIT_LONG_VALUE = /* @__PURE__ */ new Set([
+  "--message",
+  "--file",
+  "--template",
+  "--reuse-message",
+  "--reedit-message",
+  "--author",
+  "--date",
+  "--cleanup",
+  "--fixup",
+  "--squash",
+  "--trailer",
+  "--pathspec-from-file"
+]);
+var COMMIT_GRAMMAR = {
+  shortSkip: "n",
+  shortValue: /* @__PURE__ */ new Set(["m", "F", "c", "C", "t", "u", "S"]),
+  shortSeparateValue: /* @__PURE__ */ new Set(["m", "F", "c", "C", "t"]),
+  longValue: COMMIT_LONG_VALUE
+};
+var PUSH_LONG_VALUE = /* @__PURE__ */ new Set(["--push-option", "--repo", "--receive-pack", "--exec"]);
+var PUSH_GRAMMAR = {
+  shortSkip: null,
+  shortValue: /* @__PURE__ */ new Set(["o"]),
+  shortSeparateValue: /* @__PURE__ */ new Set(["o"]),
+  longValue: PUSH_LONG_VALUE
+};
+var GRAMMARS = {
+  commit: COMMIT_GRAMMAR,
+  push: PUSH_GRAMMAR
+};
+function skipsChecks(command) {
+  const out = [];
+  for (const cmd of splitCommand(command)) {
+    if (cmd.words.length === 0 || basename3(cmd.words[0].text) !== GIT_PROGRAM)
+      continue;
+    const args2 = cmd.words.slice(1);
+    const { at } = gitArgsOf(args2);
+    const sub = args2[at]?.text;
+    const verb = SKIP_CHECKS_GIT_SUBCOMMANDS.find((v) => v === sub);
+    if (verb === void 0)
+      continue;
+    if (carriesSkip(args2.slice(at + 1), GRAMMARS[verb]))
+      out.push({ verb, command: cmd });
+  }
+  return out;
+}
+function carriesSkip(rest, grammar) {
+  for (let i = 0; i < rest.length; i++) {
+    const word = rest[i];
+    const t = word.text;
+    if (t === "--")
+      return false;
+    if (t.startsWith("--")) {
+      if (!t.includes("=") && grammar.longValue.has(t)) {
+        i++;
+        continue;
+      }
+      if (hasLongAsGitReads([word], NO_VERIFY))
+        return true;
+      continue;
+    }
+    if (t.length < 2 || !t.startsWith("-"))
+      continue;
+    for (let k = 1; k < t.length; k++) {
+      const letter = t[k];
+      if (letter === grammar.shortSkip)
+        return true;
+      if (grammar.shortValue.has(letter)) {
+        if (k === t.length - 1 && grammar.shortSeparateValue.has(letter))
+          i++;
+        break;
+      }
+    }
+  }
+  return false;
+}
+var SKIP_CHECKS_COMMIT_FIX = "Run it again without --no-verify or -n. If a check fails, fix what it found.";
+var SKIP_CHECKS_PUSH_FIX = "Run it again without --no-verify. If a check fails, fix what it found.";
+function skipChecksRefusal(match, description) {
+  const what = match.verb === "commit" ? "A commit" : "A push";
+  return {
+    person: `Halfcycle: ${what} was stopped. It would skip this project's own checks, and those always run here. ${reasonSentence(description)} ${NOTHING_WAS_CHANGED}`,
+    agent: match.verb === "commit" ? SKIP_CHECKS_COMMIT_FIX : SKIP_CHECKS_PUSH_FIX
+  };
+}
+
 // dist/risky/save.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { chmodSync as chmodSync2, constants as fsConstants, copyFileSync, lstatSync as lstatSync4, mkdirSync as mkdirSync11, readdirSync as readdirSync10, readFileSync as readFileSync26, readlinkSync, realpathSync as realpathSync9, renameSync as renameSync14, rmSync as rmSync4, statSync as statSync10, symlinkSync, writeFileSync as writeFileSync16 } from "node:fs";
@@ -33789,6 +34114,9 @@ function runPreToolUse(deps) {
   if (calls === null || !calls.every((c) => CHECKED.has(c.toolName)))
     return unreadable(deps, input);
   const call = calls[0] ?? { toolName: stringOf(input, "tool_name") ?? "", toolInput: {} };
+  const skipped = skippedChecksReply(calls);
+  if (skipped !== null)
+    return skipped;
   let answer;
   try {
     answer = riskyAnswer(calls, () => {
@@ -33859,6 +34187,24 @@ function runPreToolUse(deps) {
     return "";
   }
 }
+function skippedChecksReply(calls) {
+  try {
+    for (const c of calls) {
+      const command = c.toolName === "Bash" ? c.toolInput["command"] : void 0;
+      if (typeof command !== "string")
+        continue;
+      const match = skipsChecks(command)[0];
+      if (match === void 0)
+        continue;
+      const text = skipChecksRefusal(match, reasonOf(c));
+      return `${preToolUseReplyText("refuse", text.person, text.agent)}
+`;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
 function clockOf(deps) {
   return deps.now ?? (() => /* @__PURE__ */ new Date());
 }
@@ -33926,7 +34272,7 @@ function autonomousAnswer(call, staked, sendsSaves, mode, autonomy, deps) {
       });
       if (!saved.saved)
         return refuse(autonomyA12(typeSentenceFor(saved.reason === AUTONOMY_COULD_NOT_TELL_REASON ? [] : staked), saved.reason));
-      return `${preToolUseSavedText(autonomyA9(what, saved.id))}
+      return `${preToolUseSavedText(autonomyA9(what, saved.id, installedVersion(deps.env ?? process.env)))}
 `;
     }
     default: {
@@ -34661,7 +35007,7 @@ function nothingDone(act) {
   return act === "approve" ? "Nothing was approved" : "Nothing was sent back";
 }
 function showCommand(phase) {
-  return `\`${HALFCYCLE_COMMAND} plan ${quoteForShell(phase)} --show\``;
+  return `\`${halfcycleCommand(installedVersion())} plan ${quoteForShell(phase)} --show\``;
 }
 function recordedLine(act, phase, planVersion) {
   return act === "approve" ? line(`Approved "${phase}", plan version ${planVersion}, in your session.`) : line(`Sent "${phase}" back with your note, plan version ${planVersion}, in your session. The note is given first to the next session that asks what to do.`);
@@ -34670,13 +35016,13 @@ function notAttendedLine(act) {
   return line(`${nothingDone(act)}: approving or sending back by typing counts only when a person types it into an open session.`);
 }
 function notSignedInLine(act) {
-  return line(`${nothingDone(act)}: this project is not signed in on this computer. ${HOOK_REMEDY}`);
+  return line(`${nothingDone(act)}: this project is not signed in on this computer. ${hookRemedy(installedVersion())}`);
 }
 function notOwnerLine(act) {
   return line(`${nothingDone(act)}: only the project's owner can approve or send back this scope.`);
 }
 function showFirstLine(act) {
-  return line(`${nothingDone(act)}: that phase has not been listed here. List its parts first with \`${HALFCYCLE_COMMAND} plan <phase> --show\`, then type the line again.`);
+  return line(`${nothingDone(act)}: that phase has not been listed here. List its parts first with \`${halfcycleCommand(installedVersion())} plan <phase> --show\`, then type the line again.`);
 }
 function namedPhases(phases) {
   const quoted2 = phases.map((phase) => `"${phase}"`);
@@ -34701,7 +35047,7 @@ function noteRefusedLine() {
   return line("Nothing was sent back: the note was not accepted. Reword it in plain words and type the send-back again.");
 }
 function approveRefusedLine() {
-  return line(`${nothingDone("approve")}: Halfcycle did not accept the request. ${CLIENT_UPDATE_SENTENCE}`);
+  return line(`${nothingDone("approve")}: Halfcycle did not accept the request. ${clientUpdateSentence(installedVersion())}`);
 }
 function cannotReachLine(act) {
   return line(`${nothingDone(act)}: Halfcycle could not be reached just now. Type the line again in a minute.`);
@@ -34742,7 +35088,7 @@ function reviewNotAttendedLine() {
   return line(`${NOTHING_RECORDED}: reviewing by typing counts only when a person types it into an open session.`);
 }
 function reviewNotSignedInLine() {
-  return line(`${NOTHING_RECORDED}: this project is not signed in on this computer. ${HOOK_REMEDY}`);
+  return line(`${NOTHING_RECORDED}: this project is not signed in on this computer. ${hookRemedy(installedVersion())}`);
 }
 function reviewCannotReachLine() {
   return line(`${NOTHING_RECORDED}: Halfcycle could not be reached just now. Type the line again in a minute.`);
@@ -34838,7 +35184,7 @@ function reviewCloseRefusedLine(phase, steps) {
   return line([head, ...steps.map(unfinishedStepLine), "Then type the line again."].join(" "));
 }
 function reviewRefusedLine(act) {
-  return act === "accept" ? line(`${NOTHING_RECORDED}: Halfcycle did not accept the request. Update Halfcycle by running \`${HALFCYCLE_COMMAND}\` in this project's folder, then type the line again.`) : line(`${NOTHING_RECORDED}: the words were not accepted. Reword them in plain words and type the line again.`);
+  return act === "accept" ? line(`${NOTHING_RECORDED}: Halfcycle did not accept the request. Update Halfcycle by running \`${halfcycleCommand(installedVersion())}\` in this project's folder, then type the line again.`) : line(`${NOTHING_RECORDED}: the words were not accepted. Reword them in plain words and type the line again.`);
 }
 function stillWaitingOf(phase, waiting) {
   const named = namedPhase(phase);
@@ -34955,7 +35301,7 @@ function autonomyNotAttendedLine() {
   return line(`${AUTONOMY_NOTHING_CHANGED}: turning this on or off by typing counts only when a person types it into an open session.`);
 }
 function autonomyNotSignedInLine() {
-  return line(`${AUTONOMY_NOTHING_CHANGED}: this project is not signed in on this computer. ${HOOK_REMEDY}`);
+  return line(`${AUTONOMY_NOTHING_CHANGED}: this project is not signed in on this computer. ${hookRemedy(installedVersion())}`);
 }
 function autonomyNotOwnerLine() {
   return line(`${AUTONOMY_NOTHING_CHANGED}: only the project's owner can turn this on or off.`);
@@ -35037,7 +35383,7 @@ function waitNotAttendedLine() {
   return line(`${NOTHING_RECORDED}: an answer counts only when a person types it into an open session.`);
 }
 function waitNotSignedInLine() {
-  return line(`${NOTHING_RECORDED}: this project is not signed in on this computer. ${HOOK_REMEDY}`);
+  return line(`${NOTHING_RECORDED}: this project is not signed in on this computer. ${hookRemedy(installedVersion())}`);
 }
 function waitNotOwnerLine() {
   return line(`${NOTHING_RECORDED}: only the project's owner can answer a decision that waits for them.`);
@@ -35124,7 +35470,7 @@ function paceNotAttendedText() {
   return `${PACE_NOTHING_CHANGED_OPENING}: a choice that uses more of your allowance counts only when a person types it into an open session.`;
 }
 function paceNotSignedInText() {
-  return `${PACE_NOTHING_CHANGED_OPENING}: this project is not signed in on this computer. ${HOOK_REMEDY}`;
+  return `${PACE_NOTHING_CHANGED_OPENING}: this project is not signed in on this computer. ${hookRemedy(installedVersion())}`;
 }
 function paceNotOwnerText() {
   return `${PACE_NOTHING_CHANGED_OPENING}: only the project's owner can change this.`;
@@ -35884,12 +36230,11 @@ function runResolveEngagement(cwd, registryPath) {
 }
 
 // dist/refresh-credential.js
-import { lstatSync as lstatSync5, readFileSync as readFileSync32, realpathSync as realpathSync11 } from "node:fs";
+import { lstatSync as lstatSync5, readFileSync as readFileSync31, realpathSync as realpathSync11 } from "node:fs";
 import { homedir as homedir19 } from "node:os";
 import { join as join24, resolve as resolve12 } from "node:path";
 
 // dist/mcp-headers.js
-import { readFileSync as readFileSync31 } from "node:fs";
 import { homedir as homedir18 } from "node:os";
 import { dirname as dirname10, resolve as resolve11 } from "node:path";
 var URL_FLAG = "--url";
@@ -35920,22 +36265,6 @@ function projectRootFromBinary(binaryPath) {
   const depth = VENDORED_BIN_REL.split("/").length - 1;
   return resolve11(dirname10(binaryPath), ...Array(depth).fill(".."));
 }
-function readPinnedVersion(root) {
-  let raw;
-  try {
-    raw = readFileSync31(resolve11(root, BUNDLE_PIN_REL), "utf-8");
-  } catch {
-    return void 0;
-  }
-  let pin;
-  try {
-    pin = JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-  const version2 = typeof pin === "object" && pin !== null ? pin["version"] : void 0;
-  return typeof version2 === "string" && version2 !== "" ? version2 : void 0;
-}
 function resolveStore(root, home) {
   const pinned = readPinnedId(root);
   if ("problem" in pinned)
@@ -35964,23 +36293,25 @@ function sentences(lines2) {
 `).join("");
 }
 function badIdSentence(root) {
+  const signIn = signInCommand(readPinnedVersion(root));
   return sentences([
     `${resolve11(root, BUNDLE_PIN_REL)} names an engagement id that is not a Halfcycle project id,`,
-    'so no credential was read. Delete that file and run "npx halfcycle" again: this repository',
+    `so no credential was read. Delete that file and run ${signIn} again: this repository`,
     "is then set up as a new Halfcycle project."
   ]);
 }
 function storeProblemSentence(problem, root, home, engagementId) {
+  const signIn = signInCommand(readPinnedVersion(root));
   switch (problem) {
     case "no-pin":
       return sentences([
         `no ${BUNDLE_PIN_REL} in ${root}, so this repository has no Halfcycle engagement.`,
-        'run "npx halfcycle" here to install one.'
+        `run ${signIn} here to install one.`
       ]);
     case "no-id":
       return sentences([
         `${resolve11(root, BUNDLE_PIN_REL)} names no engagement id.`,
-        'run "npx halfcycle" here to rewrite it.'
+        `run ${signIn} here to rewrite it.`
       ]);
     case "bad-id":
       return badIdSentence(root);
@@ -35991,12 +36322,12 @@ function storeProblemSentence(problem, root, home, engagementId) {
         "broken.",
         requestAccessSentence(engagementId),
         "If this account is wrong, sign in as the account that owns it and run",
-        '"npx halfcycle" again.'
+        `${signIn} again.`
       ]);
     case "no-credential":
       return sentences([
         `this machine holds no credential for engagement ${engagementId ?? ""}.`,
-        `run "npx halfcycle" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve11(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
+        `run ${signIn} in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve11(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
       ]);
   }
 }
@@ -36021,6 +36352,7 @@ async function chooseBearer(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr;
   const home = opts.home ?? homedir18();
   const root = projectRootFromBinary(opts.binaryPath);
+  const signIn = signInCommand(readPinnedVersion(root));
   const environmentToken = opts.environmentTokenFirst ? readEnvironmentToken() : void 0;
   const store = resolveStore(root, home);
   let storedToken;
@@ -36033,7 +36365,7 @@ async function chooseBearer(opts) {
     if (storedToken === void 0) {
       writeErr(sentences([
         `GUARD_SERVICE_TOKEN is absent or empty in ${store.path}.`,
-        `run "npx halfcycle" in this repository to rewrite this machine's credential.`
+        `run ${signIn} in this repository to rewrite this machine's credential.`
       ]));
       return NO_CREDENTIAL_PLACEHOLDER;
     }
@@ -36053,7 +36385,7 @@ async function chooseBearer(opts) {
     } else {
       writeErr(sentences([
         "this machine has no Halfcycle server address recorded for this repository, so the credential was not sent.",
-        'run "npx halfcycle" in this repository on this machine to record it.'
+        `run ${signIn} in this repository on this machine to record it.`
       ]));
     }
     return NO_CREDENTIAL_PLACEHOLDER;
@@ -36065,7 +36397,7 @@ async function chooseBearer(opts) {
     writeErr(sentences([
       `${registrationFile} asks for this repository's Halfcycle credential to be sent to ${shownUrl(requested ?? "")},`,
       `which is not this machine's Halfcycle server (${want ?? "none recorded"}). The credential was NOT sent.`,
-      `if nobody meant to change ${registrationFile}, treat that change as suspect; "npx halfcycle" restores the entry.`
+      `if nobody meant to change ${registrationFile}, treat that change as suspect; ${signIn} restores the entry.`
     ]));
     return NO_CREDENTIAL_PLACEHOLDER;
   }
@@ -36085,6 +36417,7 @@ async function chooseBearer(opts) {
 async function mcpHeaders(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr;
   const root = projectRootFromBinary(opts.binaryPath);
+  const signIn = signInCommand(readPinnedVersion(root));
   const variableUrl = readMcpServerUrl();
   try {
     return headerLine(await chooseBearer({
@@ -36102,7 +36435,7 @@ async function mcpHeaders(opts) {
     try {
       writeErr(sentences([
         `the credential could not be read: ${err instanceof Error ? err.message : String(err)}`,
-        `run "npx halfcycle" in this repository to rewrite this machine's credential.`
+        `run ${signIn} in this repository to rewrite this machine's credential.`
       ]));
     } catch {
       return headerLine(NO_CREDENTIAL_PLACEHOLDER, readPinnedVersion(root));
@@ -36117,11 +36450,13 @@ async function headersVerbLine(binaryPath, rest, run = mcpHeaders, writeErr = de
   } catch (err) {
     if (url2 === void 0)
       throw err;
-    const fallback = headerLine(NO_CREDENTIAL_PLACEHOLDER, readPinnedVersion(projectRootFromBinary(binaryPath)));
+    const version2 = readPinnedVersion(projectRootFromBinary(binaryPath));
+    const signIn = signInCommand(version2);
+    const fallback = headerLine(NO_CREDENTIAL_PLACEHOLDER, version2);
     try {
       writeErr(sentences([
         `the credential could not be read: ${err instanceof Error ? err.message : String(err)}`,
-        `run "npx halfcycle" in this repository to rewrite this machine's credential.`
+        `run ${signIn} in this repository to rewrite this machine's credential.`
       ]));
     } catch {
       return fallback;
@@ -36185,7 +36520,7 @@ var SESSION_START_PROBE_ATTEMPTS = 2;
 function registeredMcpUrl(projectRoot) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync32(resolve12(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
+    parsed = JSON.parse(readFileSync31(resolve12(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
   } catch {
     return void 0;
   }
@@ -36220,7 +36555,7 @@ function reportOf(body) {
   const instructions = body["result"]["instructions"];
   return typeof instructions === "string" ? checksReportOfInstructions(instructions) : "none";
 }
-async function postInitialize(url2, bearer, fetchFn, signal) {
+async function postInitialize(url2, bearer, fetchFn, signal, version2) {
   let res;
   try {
     res = await fetchFn(url2, {
@@ -36235,7 +36570,7 @@ async function postInitialize(url2, bearer, fetchFn, signal) {
   }
   if (res.status === 401) {
     discardBody(res);
-    return NO_CREDENTIAL_SENTENCE;
+    return noCredentialSentence(version2);
   }
   if (res.status < 200 || res.status > 299) {
     discardBody(res);
@@ -36255,12 +36590,12 @@ async function postInitialize(url2, bearer, fetchFn, signal) {
   }
   return namesItsServer(body) ? { report: reportOf(body) } : SERVICE_PROBLEM_SENTENCE;
 }
-async function probeDelivery(url2, bearer, fetchFn, deadlineMs, maxAttempts) {
+async function probeDelivery(url2, bearer, fetchFn, deadlineMs, maxAttempts, version2) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), deadlineMs);
   try {
     for (let attempt3 = 0; attempt3 < maxAttempts; attempt3++) {
-      const outcome = await postInitialize(url2, bearer, fetchFn, controller.signal);
+      const outcome = await postInitialize(url2, bearer, fetchFn, controller.signal, version2);
       if (outcome !== CUT_OFF)
         return outcome;
     }
@@ -36271,9 +36606,11 @@ async function probeDelivery(url2, bearer, fetchFn, deadlineMs, maxAttempts) {
 }
 async function checkConnection(renewedToken, opts) {
   const profile = opts.profile ?? AGENT_PROFILES["claude-code"];
-  const url2 = registeredMcpUrl(projectRootFromBinary(opts.binaryPath));
+  const root = projectRootFromBinary(opts.binaryPath);
+  const url2 = registeredMcpUrl(root);
   if (url2 === void 0)
     return void 0;
+  const version2 = readPinnedVersion(root);
   const bearer = await chooseBearer({
     binaryPath: opts.binaryPath,
     home: opts.home,
@@ -36284,9 +36621,9 @@ async function checkConnection(renewedToken, opts) {
     environmentTokenFirst: false
   });
   if (CREDENTIAL_PLACEHOLDERS.includes(bearer)) {
-    return { sentence: PLACEHOLDER_SENTENCES[bearer], url: url2, bearer, connected: false };
+    return { sentence: placeholderSentencesOf(version2)[bearer], url: url2, bearer, connected: false };
   }
-  const outcome = await probeDelivery(url2, bearer, opts.fetchFn ?? globalThis.fetch, opts.checkDeadlineMs ?? CONNECTION_CHECK_DEADLINE_MS, opts.maxAttempts ?? SESSION_START_PROBE_ATTEMPTS);
+  const outcome = await probeDelivery(url2, bearer, opts.fetchFn ?? globalThis.fetch, opts.checkDeadlineMs ?? CONNECTION_CHECK_DEADLINE_MS, opts.maxAttempts ?? SESSION_START_PROBE_ATTEMPTS, version2);
   if (typeof outcome === "string")
     return { sentence: outcome, url: url2, bearer, connected: false };
   return { sentence: connectedSentenceFor(profile), url: url2, bearer, connected: true, report: outcome.report };
@@ -36374,12 +36711,13 @@ function headlessInUntrustedFolder(input, profile, opts) {
   const cwd = input["cwd"];
   const folder2 = typeof cwd === "string" && cwd !== "" ? cwd : projectRootFromBinary(opts.binaryPath);
   const stateFile = join24(readClaudeConfigFolder() ?? opts.home ?? homedir19(), CLAUDE_STATE_FILENAME);
-  return trustOfWorkingFolder(folder2, stateFile, process.platform, { lstatSync: lstatSync5, readFileSync: readFileSync32, realpathSync: realpathSync11 }) === "not-trusted";
+  return trustOfWorkingFolder(folder2, stateFile, process.platform, { lstatSync: lstatSync5, readFileSync: readFileSync31, realpathSync: realpathSync11 }) === "not-trusted";
 }
 async function runRefreshCredential(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr2;
   const profile = opts.profile ?? AGENT_PROFILES["claude-code"];
   const startedAt = Date.now();
+  const startVersion = readPinnedVersion(projectRootFromBinary(opts.binaryPath));
   try {
     const renewalSaid = [];
     let renewalOpen = true;
@@ -36410,7 +36748,7 @@ async function runRefreshCredential(opts) {
               if (notices?.scope !== void 0)
                 parts.push(...scopeNoticeLines(notices.scope, engagementId));
               if (notices?.review !== void 0)
-                parts.push(...reviewNoticeText(notices.review));
+                parts.push(...reviewNoticeText(notices.review, startVersion));
               for (const entry of notices?.approvedInConsole ?? [])
                 parts.push(approvedInConsoleSentence(entry.phase));
             }
@@ -36438,18 +36776,18 @@ async function runRefreshCredential(opts) {
       return `${nonBlockingReply("SessionStart", FOLDER_NOT_TRUSTED_NOTICE)}
 `;
     if (readConfig().config === null) {
-      const remedySaid = parts.some(namesTheSignInCommand);
+      const remedySaid = parts.some((part) => namesTheSignInCommand(part, startVersion));
       aFailureOfOurs = true;
-      parts.push(noCoverageStatement(readNeverConfiguredReason(), remedySaid, pinnedEngagementId(projectRootFromBinary(opts.binaryPath))));
+      parts.push(noCoverageStatement(readNeverConfiguredReason(), remedySaid, pinnedEngagementId(projectRootFromBinary(opts.binaryPath)), startVersion));
     }
     for (const said of renewalSaid) {
       aFailureOfOurs = true;
-      if (namesTheSignInCommand(said) && parts.some(namesTheSignInCommand))
+      if (namesTheSignInCommand(said, startVersion) && parts.some((part) => namesTheSignInCommand(part, startVersion)))
         continue;
       parts.push(said.trimEnd());
     }
     if (aFailureOfOurs)
-      parts.push(DOCTOR_LINE);
+      parts.push(doctorLine(startVersion));
     return parts.length === 0 ? "" : `${nonBlockingReply("SessionStart", parts.join("\n"))}
 `;
   } catch (err) {
@@ -36467,7 +36805,7 @@ async function runRefreshCredential(opts) {
 import { fileURLToPath } from "node:url";
 
 // dist/capture.js
-import { readFileSync as readFileSync33, writeFileSync as writeFileSync20, mkdirSync as mkdirSync14, existsSync as existsSync10 } from "node:fs";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync20, mkdirSync as mkdirSync14, existsSync as existsSync10 } from "node:fs";
 import { dirname as dirname11 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -36535,7 +36873,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync33(fromFile, "utf-8");
+    return readFileSync32(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -36548,7 +36886,7 @@ function relativeFixturePath(repoRoot, fixture) {
 // dist/prove.js
 import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
-import { createWriteStream, mkdirSync as mkdirSync15, readdirSync as readdirSync11, readFileSync as readFileSync34, renameSync as renameSync18, unlinkSync as unlinkSync12, writeFileSync as writeFileSync21 } from "node:fs";
+import { createWriteStream, mkdirSync as mkdirSync15, readdirSync as readdirSync11, readFileSync as readFileSync33, renameSync as renameSync18, unlinkSync as unlinkSync12, writeFileSync as writeFileSync21 } from "node:fs";
 import { homedir as homedir20 } from "node:os";
 import { dirname as dirname12, join as join25 } from "node:path";
 
@@ -36625,13 +36963,56 @@ function cargoTestCounts(output) {
     failed: sum(lines2.map((m) => Number(m[2])))
   };
 }
+var UNITTEST_COLOUR_CODE = /\u001b\[[0-9;]*m/g;
+var UNITTEST_RAN_LINE = /^Ran (\d+) tests? in \d+(?:\.\d+)?s\s*$/;
+var UNITTEST_STATUS_LINE = /^(?:OK|FAILED|NO TESTS RAN)(?: \((.*)\))?$/;
+var UNITTEST_PAIR = /^(failures|errors|skipped|expected failures|unexpected successes)=(\d+)$/;
+function unittestPairs(list) {
+  const pairs = /* @__PURE__ */ new Map();
+  if (list === void 0)
+    return pairs;
+  for (const part of list.split(",")) {
+    const match = part.trim().match(UNITTEST_PAIR);
+    if (!match)
+      return null;
+    pairs.set(match[1], (pairs.get(match[1]) ?? 0) + Number(match[2]));
+  }
+  return pairs;
+}
+function unittestCounts(output) {
+  const lines2 = output.split("\n").map((line2) => line2.endsWith("\r") ? line2.slice(0, -1) : line2);
+  let total = null;
+  for (let i = 0; i < lines2.length; i++) {
+    const ran = lines2[i].match(UNITTEST_RAN_LINE);
+    if (!ran)
+      continue;
+    let next = i + 1;
+    while (next < lines2.length && lines2[next].trim() === "")
+      next++;
+    if (next >= lines2.length)
+      continue;
+    const status = lines2[next].replace(UNITTEST_COLOUR_CODE, "").trim().match(UNITTEST_STATUS_LINE);
+    if (!status)
+      continue;
+    const pairs = unittestPairs(status[1]);
+    if (!pairs)
+      continue;
+    const count = (key) => pairs.get(key) ?? 0;
+    const failed2 = count("failures") + count("errors") + count("unexpected successes");
+    const accounted = failed2 + count("skipped") + count("expected failures");
+    const passed = Math.max(0, Number(ran[1]) - accounted);
+    total = total ? { passed: total.passed + passed, failed: total.failed + failed2 } : { passed, failed: failed2 };
+  }
+  return total;
+}
 var FORMAT_PARSERS = [
   nodeTestRunnerCounts,
   mochaCounts,
   jestCounts,
   vitestCounts,
   pytestCounts,
-  cargoTestCounts
+  cargoTestCounts,
+  unittestCounts
 ];
 function parseTestCounts(output) {
   let total = null;
@@ -36759,7 +37140,7 @@ function keptCheckPath(dir, subject, label) {
 }
 function readKeptCheck(dir, subject, label) {
   try {
-    const raw = JSON.parse(readFileSync34(keptCheckPath(dir, subject, label), "utf-8"));
+    const raw = JSON.parse(readFileSync33(keptCheckPath(dir, subject, label), "utf-8"));
     if (typeof raw.command !== "string" || raw.command === "" || typeof raw.commandId !== "string")
       return null;
     const b = raw.before;
@@ -36784,7 +37165,7 @@ function readQueue(dir) {
     const path = join25(dir, QUEUE_DIR_NAME, name);
     let parsed = null;
     try {
-      parsed = testRunReportSchema.safeParse(JSON.parse(readFileSync34(path, "utf-8")));
+      parsed = testRunReportSchema.safeParse(JSON.parse(readFileSync33(path, "utf-8")));
     } catch {
       parsed = null;
     }
@@ -37027,7 +37408,7 @@ ${PROVE_USAGE}`);
   const end = await runCommand(command, repoRoot, logPath2, env, deps);
   let output = "";
   try {
-    output = readFileSync34(logPath2, "utf-8");
+    output = readFileSync33(logPath2, "utf-8");
   } catch {
     output = "";
   }
@@ -37077,7 +37458,7 @@ ${PROVE_USAGE}`);
 
 // dist/statusline.js
 import { spawn as spawn3 } from "node:child_process";
-import { readFileSync as readFileSync35 } from "node:fs";
+import { readFileSync as readFileSync34 } from "node:fs";
 import nodePath7 from "node:path";
 var OWN_STATUS_LINE_DEADLINE_MS = 5e3;
 var PERSON_SETTINGS_FILENAME = "settings.json";
@@ -37115,7 +37496,7 @@ function halfcycleStatusLineOf(figures) {
 }
 function personStatusLineCommand(configFolder) {
   try {
-    const v = JSON.parse(readFileSync35(nodePath7.join(configFolder, PERSON_SETTINGS_FILENAME), "utf-8"));
+    const v = JSON.parse(readFileSync34(nodePath7.join(configFolder, PERSON_SETTINGS_FILENAME), "utf-8"));
     const line2 = v["statusLine"];
     if (typeof line2 !== "object" || line2 === null)
       return null;
@@ -37233,7 +37614,7 @@ function usageFigures2(env, deps = {}) {
   }
   return figures;
 }
-function connectionKind(bearer, sentence) {
+function connectionKind(bearer, sentence, version2) {
   if (bearer === NOT_THIS_ACCOUNT_PLACEHOLDER)
     return "other-account";
   if (bearer === UPDATE_CLAUDE_CODE_PLACEHOLDER)
@@ -37246,7 +37627,7 @@ function connectionKind(bearer, sentence) {
     return "cannot-reach";
   if (sentence === SERVICE_PROBLEM_SENTENCE)
     return "service-problem";
-  if (sentence === NO_CREDENTIAL_SENTENCE)
+  if (sentence === noCredentialSentence(version2))
     return "signed-out";
   throw new Error("the connection check gave an outcome with no kind");
 }
@@ -37260,7 +37641,7 @@ async function checkConnectionLine(opts) {
   const withUsage = usage.length === 0 ? {} : { usage };
   if (result === void 0)
     return { kind: "not-registered", sentence: null, ...withUsage };
-  const line2 = { kind: connectionKind(result.bearer, result.sentence), sentence: result.sentence };
+  const line2 = { kind: connectionKind(result.bearer, result.sentence, readPinnedVersion(projectRootFromBinary(opts.binaryPath))), sentence: result.sentence };
   const report = result.report === void 0 || result.report === "none" ? {} : { report: result.report };
   return { ...line2, ...report, ...withUsage };
 }