halfcycle 0.3.11 → 0.3.13

package/dist/bin.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // dist/bin.js
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { readFileSync as readFileSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { join as join10 } from "node:path";
 
 // dist/install.js
 import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
@@ -413,6 +413,7 @@ var LOOPBACK_RESULT = {
   APPROVED: "approved",
   DECLINED: "declined"
 };
+var DASHBOARD_URL = "https://app.halfcycle.ai";
 function loopbackVerificationUrl(verificationUrl, target) {
   let url;
   try {
@@ -425,6 +426,16 @@ function loopbackVerificationUrl(verificationUrl, target) {
   return url.toString();
 }
 
+// ../events/dist/account-identity.js
+import { z as z7 } from "zod";
+var accountIdentitySchema = z7.object({
+  accountId: z7.string().min(1),
+  email: z7.string().min(1).optional()
+}).strict();
+function safeParseAccountIdentity(payload) {
+  return accountIdentitySchema.safeParse(payload);
+}
+
 // dist/engagement-credential.js
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -693,6 +704,13 @@ function readRootCommit(targetRepoRoot) {
 function readRemote(targetRepoRoot) {
   return git(targetRepoRoot, ["remote", "get-url", "origin"]);
 }
+function readCommitCount(targetRepoRoot) {
+  const out = git(targetRepoRoot, ["rev-list", "--count", "HEAD"]);
+  if (out === null)
+    return null;
+  const count = Number.parseInt(out, 10);
+  return Number.isFinite(count) ? count : null;
+}
 function mintOrReadIdentity(targetRepoRoot) {
   const path = join3(targetRepoRoot, ".halfcycle", "project.json");
   if (existsSync(path)) {
@@ -1323,12 +1341,24 @@ ${header}
     return "failed";
   }
 }
-function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, writtenPaths) {
+function previousAccountId(targetRepoRoot, engagementId) {
+  try {
+    const existing = readBundlePin(targetRepoRoot);
+    if (existing === null || existing.engagementId !== engagementId)
+      return void 0;
+    return existing.accountId;
+  } catch {
+    return void 0;
+  }
+}
+function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, accountId, writtenPaths) {
+  const carried = accountId ?? previousAccountId(targetRepoRoot, engagementId);
   const pin = {
     version,
     engagementId,
     engagementType,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...carried !== void 0 && carried.trim() !== "" ? { accountId: carried } : {}
   };
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
@@ -1483,7 +1513,7 @@ function migrateLegacyEnvLocal(targetRepo, stored) {
   }
 }
 async function install(options) {
-  const { targetRepo, engagementId, engagementType, credential, home } = options;
+  const { targetRepo, engagementId, engagementType, credential, home, accountId } = options;
   if (!existsSync3(targetRepo)) {
     throw new Error(`[bundle install] Target repo does not exist: ${targetRepo}`);
   }
@@ -1572,7 +1602,7 @@ async function install(options) {
     case "absent":
       break;
   }
-  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, report.writtenPaths);
+  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, accountId, report.writtenPaths);
   writeCrewRoster(targetRepo, report);
   const scanResult = runBootstrapScan(targetRepo);
   return {
@@ -1598,126 +1628,6 @@ function controlOriginNote(resolved) {
   return resolved.source === "environment" ? `${resolved.origin} (from HALFCYCLE_SERVICE_URL)` : `${resolved.origin} (the Halfcycle plane)`;
 }
 
-// dist/create-engagement.js
-var CreateEngagementRefused = class extends Error {
-  status;
-  serverMessage;
-  errorCode;
-  constructor(status, serverMessage, errorCode, message) {
-    super(message);
-    this.status = status;
-    this.serverMessage = serverMessage;
-    this.errorCode = errorCode;
-    this.name = "CreateEngagementRefused";
-  }
-  /**
-   * Is this a refusal of the CALLER's credential — the arm signing in again can fix?
-   *
-   * `PublicStartDisabled` is excluded even though it is a 403, and that exclusion is
-   * the whole reason this is a method rather than a status comparison at the call
-   * site: the flag gates the DEPLOYMENT, identically for every caller, so no
-   * credential and no sign-in changes the answer. Treating it as an auth refusal
-   * would send a developer through a browser handoff to arrive at the same 403.
-   *
-   * **THIS IS THE CREATE ROUTE'S DERIVATION AND THE JOIN CALLER MUST NOT USE IT
-   * (T-24).** On the join route a 403 has two causes that share a status AND a
-   * discriminant (`error: 'Forbidden'`), so nothing on this object can tell them
-   * apart: the credential may be a live engagement token carrying no account, or the
-   * engagement id may not resolve. Signing in again cannot fix the second, and
-   * treating it as though it could would discard a good credential, walk the
-   * developer through a browser, and arrive at the identical 403 — a remedy that
-   * loops. `bin.ts`'s join path therefore retries on `401` ALONE, at the call site,
-   * where the reason can be written down. See `joinPinnedEngagement` there.
-   */
-  get authRefused() {
-    if (this.errorCode === "PublicStartDisabled")
-      return false;
-    return this.status === 401 || this.status === 403;
-  }
-};
-function planeRefusal(detail) {
-  let body;
-  try {
-    body = JSON.parse(detail);
-  } catch {
-    return void 0;
-  }
-  if (typeof body !== "object" || body === null)
-    return void 0;
-  const candidate = body;
-  if (typeof candidate.message !== "string" || candidate.message.trim() === "")
-    return void 0;
-  const hasDiscriminant = typeof candidate.error === "string" || typeof candidate.statusCode === "number" || typeof candidate.status === "string";
-  if (!hasDiscriminant)
-    return void 0;
-  return {
-    message: candidate.message,
-    error: typeof candidate.error === "string" ? candidate.error : void 0
-  };
-}
-var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
-async function createEngagement(baseUrl, name, credential) {
-  return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements`, name ? { name } : {}, credential, { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" });
-}
-async function joinEngagement(baseUrl, engagementId, credential) {
-  return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements/${encodeURIComponent(engagementId)}/join`, {}, credential, {
-    action: "Join-engagement",
-    nothingHappened: "No credential was minted",
-    route: "POST /engagements/:engagementId/join"
-  });
-}
-async function requestEngagementValues(url, requestBody, credential, shape) {
-  const bearer = credential?.trim();
-  let res;
-  try {
-    res = await fetch(url, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...bearer ? { authorization: `Bearer ${bearer}` } : {}
-      },
-      body: JSON.stringify(requestBody)
-    });
-  } catch (err) {
-    throw new Error(`[bundle install] Could not reach the Halfcycle control plane at ${url}: ${err instanceof Error ? err.message : String(err)}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
-  }
-  if (!res.ok) {
-    const detail = await res.text().catch(() => "");
-    const refusal = res.status === 404 ? void 0 : planeRefusal(detail);
-    if (refusal) {
-      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
-    }
-    const wrongOrigin = res.status === 404 ? `That address answered, but it does not serve ${shape.route} \u2014 so it is not the control plane. ` : "";
-    throw new Error(`[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${wrongOrigin}${detail ? `Response: ${detail.slice(0, 300)}. ` : ""}${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
-  }
-  const body = await res.json().catch(() => null);
-  if (!body || typeof body.engagementId !== "string" || typeof body.sessionToken !== "string") {
-    throw new Error(`[bundle install] ${shape.action} response from ${url} did not carry {engagementId, sessionToken}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
-  }
-  for (const [field, value] of [
-    ["engagementId", body.engagementId],
-    ["sessionToken", body.sessionToken]
-  ]) {
-    if (value.trim() === "") {
-      throw new Error(`[bundle install] The Halfcycle plane at ${url} answered with a blank ${field} (the field is present but empty). An install cannot proceed on it: it would be written into this engagement's credential store, read back as a configured value, and every guard evaluation would fail against it for the life of the engagement. ${shape.nothingHappened} and nothing was written. ` + CONTROL_ORIGIN_HINT);
-    }
-  }
-  if (typeof body.mcpUrl !== "string" || body.mcpUrl.trim() === "") {
-    throw new Error(`[bundle install] The Halfcycle plane at ${url} created an engagement but did not say where its MCP server lives (no mcpUrl on the response). Without that address the install would write an MCP registration pointing nowhere, so nothing was written. Either that plane is older than this installer, or ${url} is not a Halfcycle control plane.`);
-  }
-  if (typeof body.guardUrl !== "string" || body.guardUrl.trim() === "") {
-    throw new Error(`[bundle install] The Halfcycle plane at ${url} created an engagement but did not say where its guard service lives (no guardUrl on the response). Without that address the install would wire a guard hook that evaluates nothing, so nothing was written. Either that plane is older than this installer, or ${url} is not a Halfcycle control plane.`);
-  }
-  const controlTelemetryUrl = typeof body.controlTelemetryUrl === "string" && body.controlTelemetryUrl.trim() !== "" ? body.controlTelemetryUrl.trim().replace(/\/+$/, "") : void 0;
-  return {
-    engagementId: body.engagementId,
-    sessionToken: body.sessionToken,
-    mcpUrl: body.mcpUrl.trim().replace(/\/+$/, ""),
-    guardUrl: body.guardUrl.trim().replace(/\/+$/, ""),
-    ...controlTelemetryUrl !== void 0 ? { controlTelemetryUrl } : {}
-  };
-}
-
 // dist/device-signin.js
 import { spawn } from "node:child_process";
 import { platform as platform3 } from "node:os";
@@ -1728,8 +1638,10 @@ import { randomBytes, timingSafeEqual } from "node:crypto";
 var LOOPBACK_PORT_ENV = "HALFCYCLE_LOOPBACK_PORT";
 var DEFAULT_STILL_WAITING_MS = 15e3;
 function completionPage(result) {
-  const headline = result === LOOPBACK_RESULT.APPROVED ? "Signed in. You can close this tab and return to your terminal." : "Sign-in declined. Nothing was created. You can close this tab.";
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Halfcycle</title></head><body style="font:16px/1.5 system-ui;padding:3rem"><p>${headline}</p></body></html>`;
+  const approved = result === LOOPBACK_RESULT.APPROVED;
+  const headline = approved ? "Signed in. You can close this tab and return to your terminal." : "Sign-in declined. Nothing was created. You can close this tab.";
+  const successLink = approved ? `<p><a href="${DASHBOARD_URL}" style="color:#c8a24b">Go to your projects</a></p>` : "";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Halfcycle</title></head><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0a0a;color:#fafafa;font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif"><div style="max-width:26rem;padding:2rem;text-align:center"><p>${headline}</p>${successLink}</div></body></html>`;
 }
 function isLoopbackPeer(remoteAddress) {
   if (remoteAddress === void 0)
@@ -1800,14 +1712,14 @@ async function bindLoopback(env = process.env) {
     else
       pending = callback;
   }));
-  const bindProblem = await new Promise((resolve2) => {
+  const bindProblem = await new Promise((resolve4) => {
     const onError = (err) => {
-      resolve2(`${err.code ?? "bind failed"} on ${LOOPBACK_REDIRECT_HOST}:${wanted.port}`);
+      resolve4(`${err.code ?? "bind failed"} on ${LOOPBACK_REDIRECT_HOST}:${wanted.port}`);
     };
     server.once("error", onError);
     server.listen({ host: LOOPBACK_REDIRECT_HOST, port: wanted.port }, () => {
       server.removeListener("error", onError);
-      resolve2(null);
+      resolve4(null);
     });
   });
   if (bindProblem !== null) {
@@ -1823,9 +1735,9 @@ async function bindLoopback(env = process.env) {
     bound: true,
     target: { port: address.port, state },
     boundAddress: address.address,
-    waitForCallback: ({ timeoutMs, onStillWaiting, stillWaitingMs = DEFAULT_STILL_WAITING_MS }) => new Promise((resolve2) => {
+    waitForCallback: ({ timeoutMs, onStillWaiting, stillWaitingMs = DEFAULT_STILL_WAITING_MS }) => new Promise((resolve4) => {
       if (pending !== null) {
-        resolve2(pending);
+        resolve4(pending);
         return;
       }
       const startedAt = Date.now();
@@ -1835,7 +1747,7 @@ async function bindLoopback(env = process.env) {
           clearInterval(ticker);
         clearTimeout(timer);
         deliver = null;
-        resolve2(value);
+        resolve4(value);
       };
       const timer = setTimeout(() => finish(null), Math.max(0, timeoutMs));
       deliver = finish;
@@ -1844,9 +1756,9 @@ async function bindLoopback(env = process.env) {
   };
 }
 function closeServer(server) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve4) => {
     server.closeAllConnections();
-    server.close(() => resolve2());
+    server.close(() => resolve4());
   });
 }
 
@@ -1868,7 +1780,7 @@ function defaultWrite(text) {
   process.stdout.write(text);
 }
 function defaultSleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 function browserOpenCommand(os, url) {
   if (os === "darwin")
@@ -1894,12 +1806,12 @@ async function openBrowser(url, env = process.env) {
     return { opened: false, reason: "the sign-in address is not an http(s) URL this CLI will open" };
   }
   const { command, args: args2 } = browserOpenCommand(platform3(), url);
-  return new Promise((resolve2) => {
+  return new Promise((resolve4) => {
     let child;
     try {
       child = spawn(command, args2, { stdio: "ignore", env });
     } catch (err) {
-      resolve2({
+      resolve4({
         opened: false,
         reason: `${command} could not be run (${err instanceof Error ? err.message : String(err)})`
       });
@@ -1911,7 +1823,7 @@ async function openBrowser(url, env = process.env) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve2(attempt);
+      resolve4(attempt);
     };
     const timer = setTimeout(() => {
       child.unref();
@@ -2131,6 +2043,134 @@ async function deviceCodeSignIn(serviceUrl, started, env, deps) {
   };
 }
 
+// dist/create-engagement.js
+var CreateEngagementRefused = class extends Error {
+  status;
+  serverMessage;
+  errorCode;
+  constructor(status, serverMessage, errorCode, message) {
+    super(message);
+    this.status = status;
+    this.serverMessage = serverMessage;
+    this.errorCode = errorCode;
+    this.name = "CreateEngagementRefused";
+  }
+  /**
+   * Is this a refusal of the CALLER's credential — the arm signing in again can fix?
+   *
+   * `PublicStartDisabled` is excluded even though it is a 403, and that exclusion is
+   * the whole reason this is a method rather than a status comparison at the call
+   * site: the flag gates the DEPLOYMENT, identically for every caller, so no
+   * credential and no sign-in changes the answer. Treating it as an auth refusal
+   * would send a developer through a browser handoff to arrive at the same 403.
+   *
+   * **THIS IS THE CREATE ROUTE'S DERIVATION AND THE JOIN CALLER MUST NOT USE IT
+   * (T-24).** On the join route a 403 has two causes that share a status AND a
+   * discriminant (`error: 'Forbidden'`), so nothing on this object can tell them
+   * apart: the credential may be a live engagement token carrying no account, or the
+   * engagement id may not resolve. Signing in again cannot fix the second, and
+   * treating it as though it could would discard a good credential, walk the
+   * developer through a browser, and arrive at the identical 403 — a remedy that
+   * loops. `bin.ts`'s join path therefore retries on `401` ALONE, at the call site,
+   * where the reason can be written down. See `joinPinnedEngagement` there.
+   */
+  get authRefused() {
+    if (this.errorCode === "PublicStartDisabled")
+      return false;
+    return this.status === 401 || this.status === 403;
+  }
+};
+function planeRefusal(detail) {
+  let body;
+  try {
+    body = JSON.parse(detail);
+  } catch {
+    return void 0;
+  }
+  if (typeof body !== "object" || body === null)
+    return void 0;
+  const candidate = body;
+  if (typeof candidate.message !== "string" || candidate.message.trim() === "")
+    return void 0;
+  const hasDiscriminant = typeof candidate.error === "string" || typeof candidate.statusCode === "number" || typeof candidate.status === "string";
+  if (!hasDiscriminant)
+    return void 0;
+  return {
+    message: candidate.message,
+    error: typeof candidate.error === "string" ? candidate.error : void 0
+  };
+}
+var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
+async function createEngagement(baseUrl, name, credential, derivedName) {
+  return requestEngagementValues(
+    `${baseUrl.replace(/\/+$/, "")}/engagements`,
+    // A stated name wins over a guess, and the body carries at most one of them —
+    // the plane applies the same ordering, so the two cannot disagree about which
+    // one a row was named from.
+    name ? { name } : derivedName ? { derivedName } : {},
+    credential,
+    { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" }
+  );
+}
+async function joinEngagement(baseUrl, engagementId, credential) {
+  return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements/${encodeURIComponent(engagementId)}/join`, {}, credential, {
+    action: "Join-engagement",
+    nothingHappened: "No credential was minted",
+    route: "POST /engagements/:engagementId/join"
+  });
+}
+async function requestEngagementValues(url, requestBody, credential, shape) {
+  const bearer = credential?.trim();
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...bearer ? { authorization: `Bearer ${bearer}` } : {}
+      },
+      body: JSON.stringify(requestBody)
+    });
+  } catch (err) {
+    throw new Error(`[bundle install] Could not reach the Halfcycle control plane at ${url}: ${err instanceof Error ? err.message : String(err)}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
+  }
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    const refusal = res.status === 404 ? void 0 : planeRefusal(detail);
+    if (refusal) {
+      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
+    }
+    const wrongOrigin = res.status === 404 ? `That address answered, but it does not serve ${shape.route} \u2014 so it is not the control plane. ` : "";
+    throw new Error(`[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${wrongOrigin}${detail ? `Response: ${detail.slice(0, 300)}. ` : ""}${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || typeof body.engagementId !== "string" || typeof body.sessionToken !== "string") {
+    throw new Error(`[bundle install] ${shape.action} response from ${url} did not carry {engagementId, sessionToken}. ${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
+  }
+  for (const [field, value] of [
+    ["engagementId", body.engagementId],
+    ["sessionToken", body.sessionToken]
+  ]) {
+    if (value.trim() === "") {
+      throw new Error(`[bundle install] The Halfcycle plane at ${url} answered with a blank ${field} (the field is present but empty). An install cannot proceed on it: it would be written into this engagement's credential store, read back as a configured value, and every guard evaluation would fail against it for the life of the engagement. ${shape.nothingHappened} and nothing was written. ` + CONTROL_ORIGIN_HINT);
+    }
+  }
+  if (typeof body.mcpUrl !== "string" || body.mcpUrl.trim() === "") {
+    throw new Error(`[bundle install] The Halfcycle plane at ${url} created an engagement but did not say where its MCP server lives (no mcpUrl on the response). Without that address the install would write an MCP registration pointing nowhere, so nothing was written. Either that plane is older than this installer, or ${url} is not a Halfcycle control plane.`);
+  }
+  if (typeof body.guardUrl !== "string" || body.guardUrl.trim() === "") {
+    throw new Error(`[bundle install] The Halfcycle plane at ${url} created an engagement but did not say where its guard service lives (no guardUrl on the response). Without that address the install would wire a guard hook that evaluates nothing, so nothing was written. Either that plane is older than this installer, or ${url} is not a Halfcycle control plane.`);
+  }
+  const controlTelemetryUrl = typeof body.controlTelemetryUrl === "string" && body.controlTelemetryUrl.trim() !== "" ? body.controlTelemetryUrl.trim().replace(/\/+$/, "") : void 0;
+  return {
+    engagementId: body.engagementId,
+    sessionToken: body.sessionToken,
+    mcpUrl: body.mcpUrl.trim().replace(/\/+$/, ""),
+    guardUrl: body.guardUrl.trim().replace(/\/+$/, ""),
+    ...controlTelemetryUrl !== void 0 ? { controlTelemetryUrl } : {}
+  };
+}
+
 // dist/resolve-credential.js
 async function obtainCredential(serviceUrl, opts = {}) {
   const env = opts.env ?? process.env;
@@ -2139,8 +2179,16 @@ async function obtainCredential(serviceUrl, opts = {}) {
     return { credential: fromEnv, source: "environment" };
   const stored = readStoredCredential(serviceUrl, opts.home);
   if (stored) {
-    return { credential: stored.credential, source: "stored", accountId: stored.accountId };
+    return {
+      credential: stored.credential,
+      source: "stored",
+      accountId: stored.accountId,
+      signedInAt: stored.signedInAt
+    };
   }
+  return signInAndStore(serviceUrl, opts);
+}
+async function signInAndStore(serviceUrl, opts) {
   const signedIn = await signIn(serviceUrl, opts);
   writeStoredCredential(serviceUrl, {
     accountId: signedIn.accountId,
@@ -2153,21 +2201,15 @@ async function obtainCredential(serviceUrl, opts = {}) {
     accountId: signedIn.accountId
   };
 }
+async function switchAccount(serviceUrl, opts = {}) {
+  forgetStoredCredential(serviceUrl, opts.home);
+  return signInAndStore(serviceUrl, opts);
+}
 async function replaceRefusedCredential(serviceUrl, refused, opts = {}) {
   if (refused.source !== "stored")
     return null;
   forgetStoredCredential(serviceUrl, opts.home);
-  const signedIn = await signIn(serviceUrl, opts);
-  writeStoredCredential(serviceUrl, {
-    accountId: signedIn.accountId,
-    credential: signedIn.credential,
-    expiresAt: signedIn.expiresAt
-  }, opts.home);
-  return {
-    credential: signedIn.credential,
-    source: "browser-handoff",
-    accountId: signedIn.accountId
-  };
+  return signInAndStore(serviceUrl, opts);
 }
 function refusedCredentialRemedy(source) {
   switch (source) {
@@ -2180,6 +2222,238 @@ function refusedCredentialRemedy(source) {
   }
 }
 
+// dist/confirm-identity.js
+import { createInterface } from "node:readline/promises";
+var IDENTITY_TIMEOUT_MS = 5e3;
+var IDENTITY_DECLINED = "identity-declined";
+async function describeAccount(serviceUrl, credential, fetchImpl = fetch) {
+  const url = `${serviceUrl.replace(/\/+$/, "")}/account`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), IDENTITY_TIMEOUT_MS);
+  try {
+    const res = await fetchImpl(url, {
+      headers: { authorization: `Bearer ${credential}` },
+      signal: controller.signal
+    });
+    if (!res.ok)
+      return void 0;
+    const parsed = safeParseAccountIdentity(await res.json());
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function accountLabel(identity, storedAccountId) {
+  const accountId = identity?.accountId ?? storedAccountId;
+  if (identity?.email !== void 0 && identity.email.trim() !== "") {
+    return accountId !== void 0 ? `${identity.email} (account ${accountId})` : identity.email;
+  }
+  if (accountId !== void 0)
+    return `account ${accountId} (no email on record for it)`;
+  return "the account this credential belongs to, which this plane did not name";
+}
+function onlyDate(iso) {
+  if (iso === void 0)
+    return void 0;
+  const match = /^(\d{4}-\d{2}-\d{2})/.exec(iso);
+  return match?.[1] ?? iso;
+}
+function actClause(act) {
+  return act.kind === "create" ? `create a NEW project for that account, and install into ${act.targetRepo}` : `join the project this repository is pinned to (${act.engagementId}) as that account, and install into ${act.targetRepo}`;
+}
+async function defaultAsk(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+    process.stdin.pause();
+  }
+}
+function readDecision(answer) {
+  const said = answer.trim().toLowerCase();
+  if (said === "y" || said === "yes")
+    return "proceed";
+  if (said === "s" || said === "switch")
+    return "switch-account";
+  return "stop";
+}
+function actingAs(credential, identity) {
+  const accountId = identity?.accountId ?? credential.accountId;
+  return accountId === void 0 ? credential : { ...credential, accountId };
+}
+function armScript(credential, act, label, home) {
+  switch (credential.source) {
+    case "browser-handoff":
+      return {
+        preamble: `[halfcycle] Signed in as ${label}. This install will ${actClause(act)}.
+`,
+        asks: false,
+        noTerminalNote: "",
+        switchOpening: "",
+        stopRemedy: "",
+        afterSwitch: ""
+      };
+    case "environment":
+      return {
+        preamble: `[halfcycle] HALFCYCLE_TOKEN is set in this environment, and this install will use it.
+[halfcycle]   Account: ${label}
+[halfcycle]   About to ${actClause(act)}
+[halfcycle] A variable exported by a shell profile is not a choice about this run \u2014 if that is not your account, the project will belong to it and not to you.
+`,
+        asks: true,
+        // Deliberately nothing. This is the arm's DESIGNED case — a run with no browser
+        // and no human — the preamble has already named the account and the variable,
+        // and a line about having nobody to ask would print on every CI job forever.
+        noTerminalNote: "",
+        switchOpening: `[halfcycle] Signing you in through your browser \u2014 this install will use that account instead.
+`,
+        stopRemedy: `Stopped before anything was created \u2014 nothing was created and nothing was written. HALFCYCLE_TOKEN in this environment is the credential for ${label}, and it takes precedence over any saved sign-in \u2014 so unset it, or set it to your own account's credential, before running this again.`,
+        // The switch is real for THIS run (the new credential is what gets used) and it
+        // does not persist: `obtainCredential` reads the variable first, so the next run
+        // is the same variable again. Said here rather than discovered tomorrow.
+        afterSwitch: `[halfcycle] HALFCYCLE_TOKEN is still set in this environment and still wins over a saved sign-in \u2014 unset it, or the next run will use it again.
+`
+      };
+    case "stored": {
+      const savedOn = onlyDate(credential.signedInAt);
+      return {
+        preamble: `[halfcycle] This machine already has a Halfcycle sign-in saved, and this install will use it.
+[halfcycle]   Account: ${label}
+` + (savedOn !== void 0 ? `[halfcycle]   Saved on this machine: ${savedOn}
+` : "") + `[halfcycle]   About to ${actClause(act)}
+[halfcycle] If that is not your account, the project will belong to it and not to you \u2014 you would not see the project in your own Halfcycle.
+`,
+        asks: true,
+        // Not a question nobody will read — a record of what happened, the two ways to
+        // make the next run act as somebody else (both executable from exactly the state
+        // this is printed in), and where to look for the answer once this output is gone.
+        noTerminalNote: `[halfcycle] Nothing here to ask at (no terminal), so this is continuing as that account.
+[halfcycle] To run as a different one, set HALFCYCLE_TOKEN for that account, or remove ${accountStorePath(home)} and run this again with a terminal to sign in.
+[halfcycle] When this install finishes, which account it used is recorded in .halfcycle/bundle.json, so it can be checked after this output is gone.
+`,
+        switchOpening: `[halfcycle] Forgetting this machine's saved sign-in and signing you in through your browser.
+`,
+        stopRemedy: `Stopped before anything was created \u2014 nothing was created and nothing was written. This machine's saved sign-in is for ${label}. Run this again and answer "s" to sign in as a different account, or remove ${accountStorePath(home)} to be asked for a sign-in next time.`,
+        afterSwitch: ""
+      };
+    }
+  }
+}
+async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
+  const write = deps.write ?? ((text) => process.stdout.write(text));
+  const identity = await describeAccount(serviceUrl, credential.credential, deps.fetchImpl);
+  const label = accountLabel(identity, credential.accountId);
+  const acting = actingAs(credential, identity);
+  const script = armScript(credential, act, label, deps.home);
+  write(script.preamble);
+  if (!script.asks)
+    return acting;
+  if (deps.assumeYes === true) {
+    write(`[halfcycle] Continuing as that account without asking, because --yes was given.
+`);
+    return acting;
+  }
+  const interactive = deps.interactive ?? (process.stdin.isTTY === true && !isNonInteractive(deps.env));
+  if (!interactive) {
+    if (script.noTerminalNote !== "")
+      write(script.noTerminalNote);
+    return acting;
+  }
+  const ask = deps.ask ?? defaultAsk;
+  const decision = readDecision(await ask(`[halfcycle] Continue as that account?  [y] yes   [s] sign in as someone else   [anything else] stop: `));
+  if (decision === "proceed")
+    return acting;
+  if (decision === "switch-account") {
+    write(script.switchOpening);
+    const replacement = await switchAccount(serviceUrl, deps);
+    const replacementIdentity = await describeAccount(serviceUrl, replacement.credential, deps.fetchImpl);
+    write(`[halfcycle] Signed in as ${accountLabel(replacementIdentity, replacement.accountId)}. This install will ${actClause(act)}.
+`);
+    if (script.afterSwitch !== "")
+      write(script.afterSwitch);
+    return actingAs(replacement, replacementIdentity);
+  }
+  throw new SignInRefused(IDENTITY_DECLINED, script.stopRemedy);
+}
+
+// dist/project-name.js
+import { basename, resolve } from "node:path";
+var MAX_DERIVED_NAME_LEN = 100;
+var EMPTY_SEGMENTS = /* @__PURE__ */ new Set(["", ".", "..", "/", "\\"]);
+function repositoryNameFromRemote(remote) {
+  const trimmed = remote.trim();
+  if (trimmed.length === 0)
+    return void 0;
+  const withoutTrailingSlash = trimmed.replace(/\/+$/, "");
+  const lastSeparator = Math.max(withoutTrailingSlash.lastIndexOf("/"), withoutTrailingSlash.lastIndexOf(":"));
+  const segment = withoutTrailingSlash.slice(lastSeparator + 1);
+  const name = segment.replace(/\.git$/i, "").trim();
+  return name.length > 0 ? name : void 0;
+}
+function deriveProjectName(targetRepoRoot) {
+  const remote = readRemote(targetRepoRoot);
+  const fromRemote = remote ? repositoryNameFromRemote(remote) : void 0;
+  const candidate = fromRemote ?? basename(resolve(targetRepoRoot));
+  const name = candidate.trim();
+  if (EMPTY_SEGMENTS.has(name))
+    return void 0;
+  return name.slice(0, MAX_DERIVED_NAME_LEN);
+}
+
+// dist/own-engagement.js
+async function createOwnedEngagement(serviceUrl, targetRepo, deps = {}) {
+  let credential = await confirmActingIdentity(serviceUrl, await obtainCredential(serviceUrl, deps), { kind: "create", targetRepo }, deps);
+  for (; ; ) {
+    try {
+      return {
+        ...await createEngagement(serviceUrl, void 0, credential.credential, deriveProjectName(targetRepo)),
+        actingAccountId: credential.accountId
+      };
+    } catch (err) {
+      if (!(err instanceof CreateEngagementRefused) || !err.authRefused)
+        throw err;
+      const replacement = await replaceRefusedCredential(serviceUrl, credential, deps);
+      if (replacement === null) {
+        throw new SignInRefused(`create-${err.status}`, `${err.serverMessage} ${refusedCredentialRemedy(credential.source)} No engagement was created.`);
+      }
+      process.stdout.write(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
+`);
+      credential = replacement;
+    }
+  }
+}
+var JOIN_REFUSED_LOCAL_REMEDY = "No credential was minted and nothing was written. This repository is pinned to that engagement by .halfcycle/bundle.json \u2014 check that the id in it is the one you meant. To start a NEW engagement here instead, remove that file and re-run.";
+async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps = {}) {
+  let credential = await confirmActingIdentity(serviceUrl, await obtainCredential(serviceUrl, deps), { kind: "join", targetRepo, engagementId }, deps);
+  for (; ; ) {
+    try {
+      return {
+        ...await joinEngagement(serviceUrl, engagementId, credential.credential),
+        actingAccountId: credential.accountId
+      };
+    } catch (err) {
+      if (!(err instanceof CreateEngagementRefused))
+        throw err;
+      if (err.status === 403) {
+        throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${JOIN_REFUSED_LOCAL_REMEDY}`);
+      }
+      if (err.status !== 401) {
+        throw err;
+      }
+      const replacement = await replaceRefusedCredential(serviceUrl, credential, deps);
+      if (replacement === null) {
+        throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${refusedCredentialRemedy(credential.source)} No credential was minted and nothing was written.`);
+      }
+      process.stdout.write(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
+`);
+      credential = replacement;
+    }
+  }
+}
+
 // dist/mint-board-code.js
 async function mintBoardEnterCode(baseUrl, sessionToken) {
   const url = `${baseUrl.replace(/\/+$/, "")}/board/enter-codes`;
@@ -2512,14 +2786,14 @@ function renderBuildRecordMarkdown(record2) {
 
 // dist/build-record/write.js
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join7, resolve, relative as relative2, isAbsolute } from "node:path";
+import { join as join7, resolve as resolve2, relative as relative2, isAbsolute } from "node:path";
 var BUILD_RECORD_DIR = join7("docs", "build-records");
 function serialiseRecordJson(record2) {
   return JSON.stringify(record2, null, 2) + "\n";
 }
 function writeBuildRecord(repoRoot, record2) {
-  const outDir = resolve(repoRoot, BUILD_RECORD_DIR);
-  const expected = resolve(repoRoot, BUILD_RECORD_DIR);
+  const outDir = resolve2(repoRoot, BUILD_RECORD_DIR);
+  const expected = resolve2(repoRoot, BUILD_RECORD_DIR);
   const rel = relative2(expected, outDir);
   if (rel !== "" || isAbsolute(rel)) {
     throw new Error(`[build-record] refusing to write outside ${BUILD_RECORD_DIR}`);
@@ -2792,8 +3066,351 @@ var PLACEHOLDERS = {
   "--evidence": '"\u2026"'
 };
 
+// dist/banner.js
+var MARK_FULL = {
+  width: 32,
+  discRows: 7,
+  lines: [
+    "          :+oshhhhso+:",
+    "       :sdMMMMMMMMMMMMds:",
+    "     :hMMMMMMMMMMMMMMMMMMh:",
+    "    oMMMMMMMMMMMMMMMMMMMMMMo",
+    "   oMMMMMMMMMMMMMMMMMMMMMMMMo",
+    "   NMMMMMMMMMMMMMMMMMMMMMMMMN",
+    "  :ssssssssssssssssssssssssss:",
+    "  +dddddddddddddddddddddddddd+",
+    "   Nd                      dN",
+    "   oMy                    yMo",
+    "    oMh:                :hMo",
+    "     :hMy-            -yMh:",
+    "       :sdNys++--++syNds:",
+    "          :+oshhhhso+:"
+  ]
+};
+var MARK_NARROW = {
+  width: 24,
+  discRows: 5,
+  lines: [
+    "      -ohdMMMMdho-",
+    "    +dMMMMMMMMMMMMd+",
+    "   yMMMMMMMMMMMMMMMMy",
+    "  sMMMMMMMMMMMMMMMMMMs",
+    "  yhhhhhhhhhhhhhhhhhhy",
+    "  NdhhhhhhhhhhhhhhhhdN",
+    "  sd                ds",
+    "   yd:            :dy",
+    "    +dy+        +yd+",
+    "      -ohhhhhhhho-"
+  ]
+};
+var UNICODE_GLYPHS = {
+  rule: "\u2500",
+  swatch: "\u2584",
+  dot: "\xB7",
+  dash: "\u2014"
+};
+var ASCII_GLYPHS = {
+  rule: "-",
+  swatch: "#",
+  dot: "|",
+  dash: "-"
+};
+function toAscii(text) {
+  let out = text;
+  for (const key of Object.keys(UNICODE_GLYPHS)) {
+    out = out.split(UNICODE_GLYPHS[key]).join(ASCII_GLYPHS[key]);
+  }
+  return out.replace(/[^ -~]/g, "?");
+}
+var INK = {
+  plain: "",
+  dim: "2",
+  bold: "1",
+  /** Yellow — the nearest ANSI seat for the brand's gold, used for labels and the URL. */
+  key: "33",
+  keyBold: "33;1"
+};
+var SWATCH_SGR = ["90", "31", "32", "33", "34", "35", "36", "37"];
+var ESC = "\x1B";
+var RESET = `${ESC}[0m`;
+function paint(segments, colour) {
+  return segments.map((s) => colour && s.sgr !== "" ? `${ESC}[${s.sgr}m${s.text}${RESET}` : s.text).join("");
+}
+var GAP = 4;
+var FULL_LAYOUT = { art: MARK_FULL, label: 13, rule: 28, palette: true, minColumns: 76 };
+var NARROW_LAYOUT = { art: MARK_NARROW, label: 10, rule: 20, palette: false, minColumns: 48 };
+var DEFAULT_COLUMNS = 80;
+function usableColumns(environment) {
+  const columns = environment.columns;
+  return columns !== void 0 && columns > 0 ? columns : DEFAULT_COLUMNS;
+}
+function isSet(value) {
+  return value !== void 0 && value !== "";
+}
+function plainTextRequested(env) {
+  return isSet(env["NO_COLOR"]) || env["TERM"] === "dumb";
+}
+function decideCut(environment = {}) {
+  const env = environment.env ?? {};
+  if (environment.quiet === true)
+    return "none";
+  if (environment.isTTY !== true)
+    return "line";
+  if (plainTextRequested(env))
+    return "line";
+  const columns = usableColumns(environment);
+  if (columns >= FULL_LAYOUT.minColumns)
+    return "full";
+  if (columns >= NARROW_LAYOUT.minColumns)
+    return "narrow";
+  return "line";
+}
+function decideColour(environment = {}) {
+  const env = environment.env ?? {};
+  const force = env["FORCE_COLOR"];
+  if (isSet(force))
+    return force !== "0";
+  if (plainTextRequested(env))
+    return false;
+  return environment.isTTY === true;
+}
+function decideUnicode(environment = {}) {
+  const env = environment.env ?? {};
+  if ((environment.platform ?? "") !== "win32") {
+    const locale = env["LC_ALL"] ?? env["LC_CTYPE"] ?? env["LANG"] ?? "";
+    return locale === "" || /utf-?8/i.test(locale);
+  }
+  return isSet(env["WT_SESSION"]) || isSet(env["TERMINUS_SUBLIME"]) || env["ConEmuTask"] === "{cmd::Cmder}" || env["TERM_PROGRAM"] === "vscode";
+}
+function padEnd(text, width) {
+  return text + " ".repeat(Math.max(0, width - text.length));
+}
+function clip(text, width) {
+  if (width < 8 || text.length <= width)
+    return text;
+  return `${text.slice(0, width - 3)}...`;
+}
+function paletteRow(swatch) {
+  const row = [];
+  SWATCH_SGR.forEach((sgr, i) => {
+    if (i > 0)
+      row.push({ text: " ", sgr: INK.plain });
+    row.push({ text: swatch.repeat(2), sgr });
+  });
+  return row;
+}
+function factColumn(content, layout, glyphs, text, valueWidth) {
+  const rows = [];
+  const head = text(content.head);
+  const at = head.indexOf("@");
+  rows.push(at < 0 ? [{ text: head, sgr: INK.keyBold }] : [
+    { text: head.slice(0, at), sgr: INK.keyBold },
+    { text: "@", sgr: INK.dim },
+    { text: head.slice(at + 1), sgr: INK.bold }
+  ]);
+  rows.push([{ text: glyphs.rule.repeat(layout.rule), sgr: INK.dim }]);
+  const narrow = layout.art === MARK_NARROW;
+  for (const fact2 of content.facts) {
+    const raw = narrow ? fact2.narrow : fact2.value;
+    if (raw === void 0)
+      continue;
+    rows.push([
+      { text: padEnd(`${text(fact2.label)}:`, layout.label), sgr: INK.key },
+      { text: clip(text(raw), valueWidth), sgr: INK.plain }
+    ]);
+  }
+  if (layout.palette) {
+    rows.push([]);
+    rows.push(paletteRow(glyphs.swatch));
+  }
+  return rows;
+}
+function renderBlock(content, layout, environment) {
+  const unicode = decideUnicode(environment);
+  const colour = decideColour(environment);
+  const glyphs = unicode ? UNICODE_GLYPHS : ASCII_GLYPHS;
+  const text = (raw) => unicode ? raw : toAscii(raw);
+  const art = layout.art;
+  const valueWidth = usableColumns(environment) - (art.width + GAP + layout.label);
+  const right = factColumn(content, layout, glyphs, text, valueWidth);
+  const top = Math.max(0, Math.floor((art.lines.length - right.length) / 2));
+  const height = Math.max(art.lines.length, right.length + top);
+  const lines = [];
+  for (let i = 0; i < height; i++) {
+    const artLine = art.lines[i] ?? "";
+    const segments = [];
+    if (artLine.length > 0) {
+      segments.push({ text: artLine, sgr: i < art.discRows ? INK.plain : INK.dim });
+    }
+    const rightRow = right[i - top];
+    if (rightRow !== void 0 && rightRow.length > 0) {
+      segments.push({ text: " ".repeat(Math.max(0, art.width + GAP - artLine.length)), sgr: INK.plain });
+      segments.push(...rightRow);
+    }
+    lines.push(segments);
+  }
+  const tagline = layout.art === MARK_NARROW ? content.tagNarrow ?? content.tag : content.tag;
+  lines.push([]);
+  tagline.forEach((line, i) => {
+    lines.push([{ text: `  ${text(line)}`, sgr: i === 0 ? INK.bold : INK.dim }]);
+  });
+  lines.push([]);
+  lines.push([{ text: `  ${text(content.url)}`, sgr: INK.key }]);
+  return lines.map((segments) => paint(segments, colour)).join("\n");
+}
+function renderLine(content, environment) {
+  const unicode = decideUnicode(environment);
+  const dot = unicode ? UNICODE_GLYPHS.dot : ASCII_GLYPHS.dot;
+  const named = content.version === "" ? "Halfcycle" : `Halfcycle v${content.version}`;
+  const raw = `${named} ${dot} ${content.url}`;
+  return unicode ? raw : toAscii(raw);
+}
+function renderBanner(content, environment = {}) {
+  switch (decideCut(environment)) {
+    case "none":
+      return "";
+    case "line":
+      return renderLine(content, environment);
+    case "narrow":
+      return renderBlock(content, NARROW_LAYOUT, environment);
+    case "full":
+      return renderBlock(content, FULL_LAYOUT, environment);
+  }
+}
+function printBanner(sink, content, environment = {}) {
+  const text = renderBanner(content, environment);
+  if (text === "")
+    return;
+  sink.write(`${text}
+`);
+}
+function currentEnvironment(quiet2) {
+  return {
+    columns: process.stdout.columns,
+    isTTY: process.stdout.isTTY === true,
+    quiet: quiet2,
+    env: process.env,
+    platform: process.platform
+  };
+}
+
+// dist/banner-facts.js
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { basename as basename2, join as join9, resolve as resolve3 } from "node:path";
+var BRAND_URL = "halfcycle.ai";
+var TAGLINE = [
+  "Fewer cycles.",
+  "The thinking moves earlier. So does the finish."
+];
+var TAGLINE_NARROW = [
+  "Fewer cycles.",
+  "The thinking moves earlier.",
+  "So does the finish."
+];
+function bundleVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync8(join9(BUNDLE_ROOT, "package.json"), "utf-8"));
+    return typeof pkg.version === "string" ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function claudeCodeVersion() {
+  try {
+    const raw = execFileSync3("claude", ["--version"], {
+      encoding: "utf-8",
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return /(\d+\.\d+\.\d+)/.exec(raw)?.[1];
+  } catch {
+    return void 0;
+  }
+}
+var REAL_PROBES = {
+  bundleVersion,
+  claudeCodeVersion,
+  projectName: (dir) => {
+    try {
+      return deriveProjectName(dir);
+    } catch {
+      return void 0;
+    }
+  },
+  commitCount: (dir) => {
+    try {
+      return readCommitCount(dir);
+    } catch {
+      return null;
+    }
+  },
+  installedVersion: (dir) => {
+    try {
+      return readBundlePin(dir)?.version;
+    } catch {
+      return void 0;
+    }
+  },
+  planeHost: (env) => {
+    try {
+      const resolved = resolveControlOrigin(env);
+      return resolved.source === "default" ? BRAND_URL : new URL(resolved.origin).host;
+    } catch {
+      return void 0;
+    }
+  }
+};
+function fact(label, value, narrow) {
+  if (value === void 0 || value === "")
+    return void 0;
+  return narrow === void 0 ? { label, value } : { label, value, narrow };
+}
+function openingBannerContent(projectDir, env = process.env, probes = REAL_PROBES) {
+  const dot = UNICODE_GLYPHS.dot;
+  const dash = UNICODE_GLYPHS.dash;
+  const version = probes.bundleVersion();
+  const name = probes.projectName(projectDir) ?? safeBasename(projectDir);
+  const commits = probes.commitCount(projectDir);
+  const installed = probes.installedVersion(projectDir);
+  const project = commits === null ? name : `${name} ${dot} git ${dot} ${commits} ${commits === 1 ? "commit" : "commits"}`;
+  const status = installed === void 0 ? `new ${dash} nothing installed yet` : `installed ${dash} v${installed}`;
+  const facts = [
+    fact("Version", version, version),
+    fact("Claude Code", probes.claudeCodeVersion()),
+    fact("Project", project, name),
+    fact("Status", status, installed === void 0 ? "new" : "installed"),
+    fact("Plane", probes.planeHost(env))
+  ].filter((f) => f !== void 0);
+  return {
+    head: `halfcycle@${name}`,
+    facts,
+    tag: TAGLINE,
+    tagNarrow: TAGLINE_NARROW,
+    url: BRAND_URL,
+    // `''` when even this package's own manifest could not be read. The one-line cut
+    // drops the whole `vX.Y.Z` clause in that case rather than printing a bare `v`.
+    version: version ?? ""
+  };
+}
+function safeBasename(dir) {
+  try {
+    const name = basename2(resolve3(dir)).trim();
+    return name === "" ? "project" : name;
+  } catch {
+    return "project";
+  }
+}
+
 // dist/bin.js
-var args = process.argv.slice(2);
+var ASSUME_YES_FLAGS = /* @__PURE__ */ new Set(["--yes", "-y"]);
+var QUIET_FLAGS = /* @__PURE__ */ new Set(["--quiet", "-q"]);
+var VERBOSE_FLAGS = /* @__PURE__ */ new Set(["--verbose", "-v"]);
+var rawArgs = process.argv.slice(2);
+var assumeYes = rawArgs.some((a) => ASSUME_YES_FLAGS.has(a));
+var quiet = rawArgs.some((a) => QUIET_FLAGS.has(a));
+var verbose = rawArgs.some((a) => VERBOSE_FLAGS.has(a));
+var args = rawArgs.filter((a) => !ASSUME_YES_FLAGS.has(a) && !QUIET_FLAGS.has(a) && !VERBOSE_FLAGS.has(a));
 var MIN_HEADERS_HELPER_VERSION = "2.1.118";
 var MIN_HEADER_ROTATION_VERSION = "2.1.193";
 function compareVersions(a, b) {
@@ -2807,10 +3424,10 @@ function compareVersions(a, b) {
   }
   return 0;
 }
-function reportClaudeCodeVersion() {
+function reportClaudeCodeVersion(verbose2) {
   let raw;
   try {
-    raw = execFileSync3("claude", ["--version"], {
+    raw = execFileSync4("claude", ["--version"], {
       encoding: "utf-8",
       timeout: 5e3,
       stdio: ["ignore", "pipe", "ignore"]
@@ -2823,73 +3440,44 @@ function reportClaudeCodeVersion() {
     return;
   const version = found[1];
   if (compareVersions(version, MIN_HEADERS_HELPER_VERSION) >= 0) {
-    process.stdout.write(`[halfcycle] Claude Code ${version} detected \u2014 new enough for the credential helper.
+    if (verbose2) {
+      process.stdout.write(`[halfcycle] Claude Code ${version} detected \u2014 new enough for the credential helper.
 `);
+    }
     return;
   }
   process.stdout.write(`[halfcycle] WARNING: Claude Code ${version} is older than ${MIN_HEADERS_HELPER_VERSION}, which ignores the credential helper this install wrote. The Halfcycle server will connect with no credential and every call will fail \u2014 upgrade Claude Code, then re-open this folder.
 `);
 }
+function shortId(id) {
+  return id.length > 10 ? `${id.slice(0, 8)}\u2026` : id;
+}
 var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|client]
          install into target (default: the current directory)
+         --yes / -y: use this machine's saved sign-in without being asked
   halfcycle check-drift <target-repo>
   halfcycle build-record <phase-id> [--repo <root>]
   halfcycle open-phase <phase|--none> --actor "\u2026" (--evidence "\u2026" | --override --reason "\u2026") [--repo <root>]
   halfcycle close-phase <phase> --verdict <clean|defects> --actor "\u2026" [--finding "\u2026"]\u2026 [--override --reason "\u2026"] [--repo <root>]
+
+  --quiet / -q: print no opening banner (any command)
+  --verbose / -v: print full run detail (paths written, merged, skipped) on install
 `;
 function isHalfcycleMonorepo(dir) {
   try {
-    const pkg = JSON.parse(readFileSync8(join9(dir, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(join10(dir, "package.json"), "utf-8"));
     return pkg.name === "halfcycle-monorepo";
   } catch {
     return false;
   }
 }
-async function createOwnedEngagement(serviceUrl) {
-  let credential = await obtainCredential(serviceUrl);
-  for (; ; ) {
-    try {
-      return await createEngagement(serviceUrl, void 0, credential.credential);
-    } catch (err) {
-      if (!(err instanceof CreateEngagementRefused) || !err.authRefused)
-        throw err;
-      const replacement = await replaceRefusedCredential(serviceUrl, credential);
-      if (replacement === null) {
-        throw new SignInRefused(`create-${err.status}`, `${err.serverMessage} ${refusedCredentialRemedy(credential.source)} No engagement was created.`);
-      }
-      process.stdout.write(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
-`);
-      credential = replacement;
-    }
-  }
-}
-var JOIN_REFUSED_LOCAL_REMEDY = "No credential was minted and nothing was written. This repository is pinned to that engagement by .halfcycle/bundle.json \u2014 check that the id in it is the one you meant. To start a NEW engagement here instead, remove that file and re-run.";
-async function joinPinnedEngagement(serviceUrl, engagementId) {
-  let credential = await obtainCredential(serviceUrl);
-  for (; ; ) {
-    try {
-      return await joinEngagement(serviceUrl, engagementId, credential.credential);
-    } catch (err) {
-      if (!(err instanceof CreateEngagementRefused))
-        throw err;
-      if (err.status === 403) {
-        throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${JOIN_REFUSED_LOCAL_REMEDY}`);
-      }
-      if (err.status !== 401) {
-        throw err;
-      }
-      const replacement = await replaceRefusedCredential(serviceUrl, credential);
-      if (replacement === null) {
-        throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${refusedCredentialRemedy(credential.source)} No credential was minted and nothing was written.`);
-      }
-      process.stdout.write(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
-`);
-      credential = replacement;
-    }
-  }
-}
 async function main() {
   const [cmd, ...rest] = args;
+  const bareTarget = cmd !== void 0 && !cmd.startsWith("-") && !/^(check-drift|build-record|open-phase|close-phase)$/.test(cmd);
+  const installArm = cmd === "install" || cmd === void 0 || bareTarget;
+  const positionals = cmd === "install" ? rest : args;
+  const targetRepo = installArm ? positionals[0] ?? process.cwd() : process.cwd();
+  printBanner(process.stdout, openingBannerContent(targetRepo), currentEnvironment(quiet));
   if (cmd === "--help" || cmd === "-h" || cmd === "help") {
     process.stdout.write(`halfcycle \u2014 install and drive the Halfcycle method in a repository.
 
@@ -2898,10 +3486,7 @@ ${USAGE}`);
     process.exit(0);
     return;
   }
-  const bareTarget = cmd !== void 0 && !cmd.startsWith("-") && !/^(check-drift|build-record|open-phase|close-phase)$/.test(cmd);
-  if (cmd === "install" || cmd === void 0 || bareTarget) {
-    const positionals = cmd === "install" ? rest : args;
-    const targetRepo = positionals[0] ?? process.cwd();
+  if (installArm) {
     const engagementIdArg = positionals[1];
     const engagementTypeRaw = positionals[2] ?? "client";
     if (isHalfcycleMonorepo(targetRepo)) {
@@ -2923,18 +3508,26 @@ ${USAGE}`);
     try {
       const controlOrigin = resolveControlOrigin(process.env);
       const serviceUrl = controlOrigin.origin;
-      process.stdout.write(`[halfcycle] Halfcycle plane: ${controlOriginNote(controlOrigin)}
+      if (verbose || controlOrigin.source !== "default") {
+        process.stdout.write(`[halfcycle] Halfcycle plane: ${controlOriginNote(controlOrigin)}
 `);
+      }
       const pinned = readPinnedEngagement(targetRepo);
       const requestedId = engagementIdArg ?? pinned?.engagementId;
       const reusable = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
       let engagementId;
       let credential;
+      let actingAccountId;
+      let foundLine = "";
       if (reusable !== void 0 && pinned !== null) {
         engagementId = pinned.engagementId;
         credential = reusable;
-        process.stdout.write(`[halfcycle] Re-using the engagement already pinned in this repo: ${pinned.engagementId}
+        actingAccountId = readBundlePin(targetRepo)?.accountId;
+        foundLine = `already set up here \u2014 reusing engagement ${shortId(pinned.engagementId)}`;
+        if (verbose) {
+          process.stdout.write(`[halfcycle] Re-using the engagement already pinned in this repo: ${pinned.engagementId}
 `);
+        }
         if (pinned.fromLegacyEnvLocal) {
           process.stdout.write(`[halfcycle] Its credential is in this repository's .env.local \u2014 an install from before
 [halfcycle] credentials moved out of the tree. It is being copied to
@@ -2943,8 +3536,9 @@ ${USAGE}`);
 `);
         }
       } else if (requestedId !== void 0) {
-        const joined = await joinPinnedEngagement(serviceUrl, requestedId);
+        const joined = await joinPinnedEngagement(serviceUrl, requestedId, targetRepo, { assumeYes });
         engagementId = joined.engagementId;
+        actingAccountId = joined.actingAccountId;
         credential = {
           serviceUrl,
           token: joined.sessionToken,
@@ -2955,11 +3549,15 @@ ${USAGE}`);
           // an absent value, never `undefined` verbatim.
           controlTelemetryUrl: joined.controlTelemetryUrl
         };
-        process.stdout.write(`[halfcycle] Joined engagement ${joined.engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
+        foundLine = `this repo is pinned to a shared project \u2014 joining it as you (${shortId(joined.engagementId)})`;
+        if (verbose) {
+          process.stdout.write(`[halfcycle] Joined engagement ${joined.engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
 `);
+        }
       } else {
-        const created = await createOwnedEngagement(serviceUrl);
+        const created = await createOwnedEngagement(serviceUrl, targetRepo, { assumeYes });
         engagementId = created.engagementId;
+        actingAccountId = created.actingAccountId;
         credential = {
           serviceUrl,
           token: created.sessionToken,
@@ -2973,26 +3571,32 @@ ${USAGE}`);
           // emission is fail-open on that absence.
           controlTelemetryUrl: created.controlTelemetryUrl
         };
-        process.stdout.write(`[halfcycle] Created engagement ${created.engagementId}
+        foundLine = `no Halfcycle project here yet \u2014 creating one (${shortId(created.engagementId)})`;
+        if (verbose) {
+          process.stdout.write(`[halfcycle] Created engagement ${created.engagementId}
 `);
+        }
       }
       const result = await install({
         targetRepo,
         engagementId,
         engagementType: engagementTypeRaw,
-        credential
+        credential,
+        accountId: actingAccountId
       });
-      process.stdout.write(`[halfcycle] Installed v${result.version} into ${targetRepo}
+      if (verbose) {
+        process.stdout.write(`[halfcycle] Installed v${result.version} into ${targetRepo}
 `);
-      process.stdout.write(`[halfcycle] Written: ${result.writtenPaths.length} paths
+        process.stdout.write(`[halfcycle] Written: ${result.writtenPaths.length} paths
 `);
-      if (result.mergedPaths.length > 0) {
-        process.stdout.write(`[halfcycle] Merged: ${result.mergedPaths.join(", ")}
+        if (result.mergedPaths.length > 0) {
+          process.stdout.write(`[halfcycle] Merged: ${result.mergedPaths.join(", ")}
 `);
-      }
-      if (result.skippedPaths.length > 0) {
-        process.stdout.write(`[halfcycle] Skipped (already present): ${result.skippedPaths.join(", ")}
+        }
+        if (result.skippedPaths.length > 0) {
+          process.stdout.write(`[halfcycle] Skipped (already present): ${result.skippedPaths.join(", ")}
 `);
+        }
       }
       if (result.collidedPaths.length > 0) {
         process.stdout.write(`[halfcycle] Collided (a name you already use \u2014 NOT overwritten): ${result.collidedPaths.join(", ")}
@@ -3010,22 +3614,37 @@ ${USAGE}`);
       }
       const probe = await probeMcpOrigin(credential.mcpUrl);
       if (probe.reached) {
-        process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
+        if (verbose) {
+          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
 `);
+        }
       } else {
         process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
 [halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not the CONTROL origin (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
 `);
       }
-      process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_COVERAGE_REQUIRED_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
+      if (verbose) {
+        process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_COVERAGE_REQUIRED_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
+`);
+        process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
+`);
+        process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
+`);
+        process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
+`);
+      }
+      reportClaudeCodeVersion(verbose);
+      const identity = await describeAccount(credential.serviceUrl, credential.token);
+      const written = result.writtenPaths.length;
+      const merged = result.mergedPaths.length;
+      process.stdout.write(`[halfcycle] Signed in as ${accountLabel(identity, actingAccountId)}
 `);
-      process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
+      process.stdout.write(`[halfcycle] Found: ${foundLine}
 `);
-      process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
+      process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, guards armed on every edit
 `);
-      process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
+      process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
-      reportClaudeCodeVersion();
       try {
         const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
         process.stdout.write(`[halfcycle] Your board (first visit): ${minted.boardUrl}
@@ -3050,17 +3669,17 @@ ${USAGE}`);
     return;
   }
   if (cmd === "check-drift") {
-    const targetRepo = rest[0];
-    if (!targetRepo) {
+    const targetRepo2 = rest[0];
+    if (!targetRepo2) {
       process.stderr.write("halfcycle-bundle: usage: halfcycle-bundle check-drift <target-repo>\n");
       process.exit(1);
       return;
     }
     try {
-      const { drifted, installed, current } = checkDrift(targetRepo);
+      const { drifted, installed, current } = checkDrift(targetRepo2);
       if (drifted) {
         process.stdout.write(`[halfcycle-bundle] DRIFT DETECTED: installed=${installed ?? "none"} current=${current}
-[halfcycle-bundle] Re-run "halfcycle-bundle install ${targetRepo}" to sync.
+[halfcycle-bundle] Re-run "halfcycle-bundle install ${targetRepo2}" to sync.
 `);
         process.exit(2);
       } else {
@@ -3085,12 +3704,12 @@ ${USAGE}`);
     }
     const phaseId = Number(phaseArg);
     try {
-      const inputPath = join9(repoRoot, ".workbench", "build-record", `phase-${phaseId}.input.json`);
-      const input = JSON.parse(readFileSync8(inputPath, "utf-8"));
+      const inputPath = join10(repoRoot, ".workbench", "build-record", `phase-${phaseId}.input.json`);
+      const input = JSON.parse(readFileSync9(inputPath, "utf-8"));
       const result = assemblePhaseBuildRecord({
         repoRoot,
-        phasesDir: join9(repoRoot, "docs", "phases"),
-        guardEvalLogDir: input.guardEvalLogDir ?? join9(repoRoot, ".workbench", "guard-eval-log"),
+        phasesDir: join10(repoRoot, "docs", "phases"),
+        guardEvalLogDir: input.guardEvalLogDir ?? join10(repoRoot, ".workbench", "guard-eval-log"),
         phaseId,
         narrated: input.narrated,
         touchedInvariants: input.touchedInvariants