halfcycle 0.3.26 → 0.3.27

package/dist/bin.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 
 // dist/bin.js
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join11 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync10, statSync } from "node:fs";
+import { join as join12 } from "node:path";
 
 // dist/install.js
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname2, join as join5, relative } from "node:path";
+import { dirname as dirname2, join as join5, posix, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../events/dist/result.js
@@ -36,6 +38,11 @@ var ENGAGEMENTS_DIR_NAME = "engagements";
 var ENGAGEMENT_ENV_FILENAME = "env";
 var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
 var ACCOUNT_STORE_FILENAME = "account.json";
+var ENGAGEMENT_ID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
+var ENGAGEMENT_ID_SHAPE = new RegExp(ENGAGEMENT_ID_PATTERN);
+function isEngagementId(value) {
+  return typeof value === "string" && ENGAGEMENT_ID_SHAPE.test(value);
+}
 var ENGAGEMENT_ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
 function shq(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -1024,7 +1031,19 @@ var ENGAGEMENTS_DIR = ENGAGEMENTS_DIR_NAME;
 var ENV_FILENAME = ENGAGEMENT_ENV_FILENAME;
 var HALFCYCLE_DIR = HALFCYCLE_DIR_NAME;
 var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
+var InvalidEngagementIdError = class extends Error {
+  constructor(engagementId) {
+    const shown = JSON.stringify(engagementId.length > 80 ? `${engagementId.slice(0, 80)}\u2026` : engagementId);
+    super(`${shown} is not a Halfcycle project id, so it cannot name a folder on this machine and nothing was written. A project id looks like 3f2a1c4e-8b7d-4e2f-9a61-0c5d7e8f9b10. If it is the "${PIN_ENGAGEMENT_ID_FIELD}" in .halfcycle/bundle.json, delete that file and run "npx halfcycle" again: this repository is then set up as a new Halfcycle project.`);
+    this.name = "InvalidEngagementIdError";
+  }
+};
+function assertEngagementId(engagementId) {
+  if (!isEngagementId(engagementId))
+    throw new InvalidEngagementIdError(engagementId);
+}
 function engagementStateDir(engagementId, home) {
+  assertEngagementId(engagementId);
   return join2(halfcycleHome(home), ENGAGEMENTS_DIR, engagementId);
 }
 function engagementEnvPath(engagementId, home) {
@@ -1127,6 +1146,14 @@ halfcycle_env_file() {
     HALFCYCLE_ENV_PROBLEM="no-id"
     return 1
   fi
+  # The id is about to become a path under $HOME, and it came from a committed
+  # file: anything that is not a project id (a "../", a "/") is refused here,
+  # before the path exists. hc_id holds no newline (the pin was flattened above),
+  # so grep sees exactly one line.
+  if ! printf '%s\\n' "$hc_id" | grep -Eq '${ENGAGEMENT_ID_PATTERN}'; then
+    HALFCYCLE_ENV_PROBLEM="bad-id"
+    return 1
+  fi
   HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
   if [ -z "\${HOME:-}" ]; then
     HALFCYCLE_ENV_PROBLEM="no-home"
@@ -1202,6 +1229,264 @@ function mintOrReadIdentity(targetRepoRoot) {
   return { identity, minted: true };
 }
 
+// dist/install-manifest.js
+import { createHash } from "node:crypto";
+var INSTALL_MANIFEST_REL = ".halfcycle/install-manifest.json";
+var INSTALL_MANIFEST_FORMAT = "halfcycle-install-manifest/v1";
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function canonicalJson(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalJson);
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => [k, canonicalJson(v)]);
+    return Object.fromEntries(entries);
+  }
+  return value;
+}
+function canonicalSha256(value) {
+  return sha256Hex(JSON.stringify(canonicalJson(value)));
+}
+function byString(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function serializeManifest(manifest) {
+  const settings = {
+    ...manifest.settings,
+    hookCommands: [...manifest.settings.hookCommands].sort(byString),
+    denyAddedSha256: [...manifest.settings.denyAddedSha256].sort(byString),
+    eventsCreated: [...manifest.settings.eventsCreated].sort(byString)
+  };
+  const ordered = {
+    ...manifest,
+    files: [...manifest.files].sort((a, b) => byString(a.path, b.path)),
+    createdDirs: [...manifest.createdDirs].sort(byString),
+    leftAlone: [...manifest.leftAlone].sort(byString),
+    settings
+  };
+  return JSON.stringify(canonicalJson(ordered), null, 2) + "\n";
+}
+var UnreadableManifestError = class extends Error {
+  constructor(reason) {
+    super(reason);
+    this.name = "UnreadableManifestError";
+  }
+};
+var HEX64 = /^[0-9a-f]{64}$/;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function stringArray(value, field) {
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
+    throw new UnreadableManifestError(`"${field}" is not a list of strings`);
+  }
+  return value;
+}
+function hashArray(value, field) {
+  const list = stringArray(value, field);
+  if (!list.every((v) => HEX64.test(v)))
+    throw new UnreadableManifestError(`"${field}" holds a value that is not a hash`);
+  return list;
+}
+function bool(value, field) {
+  if (typeof value !== "boolean")
+    throw new UnreadableManifestError(`"${field}" is not true or false`);
+  return value;
+}
+function onlyKeys(value, allowed, where) {
+  const extra = Object.keys(value).filter((k) => !allowed.includes(k));
+  if (extra.length > 0)
+    throw new UnreadableManifestError(`${where} has a field this version does not know: ${extra.join(", ")}`);
+}
+function parseManifest(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new UnreadableManifestError("it is not valid JSON");
+  }
+  if (!isRecord(raw))
+    throw new UnreadableManifestError("it is not a JSON object");
+  onlyKeys(raw, ["format", "files", "createdDirs", "leftAlone", "settings", "mcp", "gitignore"], "the manifest");
+  if (raw["format"] !== INSTALL_MANIFEST_FORMAT) {
+    throw new UnreadableManifestError(`its format is not ${INSTALL_MANIFEST_FORMAT}`);
+  }
+  if (!Array.isArray(raw["files"]))
+    throw new UnreadableManifestError('"files" is not a list');
+  const files = raw["files"].map((entry) => {
+    if (!isRecord(entry) || typeof entry["path"] !== "string") {
+      throw new UnreadableManifestError('a "files" entry has no path');
+    }
+    if (entry["perMachine"] === true) {
+      onlyKeys(entry, ["path", "perMachine"], `the "files" entry for ${entry["path"]}`);
+      return { path: entry["path"], perMachine: true };
+    }
+    onlyKeys(entry, ["path", "sha256"], `the "files" entry for ${entry["path"]}`);
+    if (typeof entry["sha256"] !== "string" || !HEX64.test(entry["sha256"])) {
+      throw new UnreadableManifestError(`the "files" entry for ${entry["path"]} has no valid hash`);
+    }
+    return { path: entry["path"], sha256: entry["sha256"] };
+  });
+  const s = raw["settings"];
+  if (!isRecord(s))
+    throw new UnreadableManifestError('"settings" is missing');
+  onlyKeys(s, [
+    "created",
+    "adopted",
+    "hookCommands",
+    "denyAddedSha256",
+    "schemaBefore",
+    "eventsCreated",
+    "hooksCreated",
+    "permissionsCreated",
+    "denyCreated"
+  ], '"settings"');
+  const settings = {
+    created: bool(s["created"], "settings.created"),
+    adopted: bool(s["adopted"], "settings.adopted"),
+    hookCommands: stringArray(s["hookCommands"], "settings.hookCommands"),
+    denyAddedSha256: hashArray(s["denyAddedSha256"], "settings.denyAddedSha256"),
+    ..."schemaBefore" in s ? { schemaBefore: s["schemaBefore"] } : {},
+    eventsCreated: stringArray(s["eventsCreated"], "settings.eventsCreated"),
+    hooksCreated: bool(s["hooksCreated"], "settings.hooksCreated"),
+    permissionsCreated: bool(s["permissionsCreated"], "settings.permissionsCreated"),
+    denyCreated: bool(s["denyCreated"], "settings.denyCreated")
+  };
+  let mcp;
+  if (raw["mcp"] !== void 0) {
+    const m = raw["mcp"];
+    if (!isRecord(m))
+      throw new UnreadableManifestError('"mcp" is not an object');
+    onlyKeys(m, ["created", "adopted", "mcpServersCreated", "entrySha256"], '"mcp"');
+    if (m["entrySha256"] !== void 0 && (typeof m["entrySha256"] !== "string" || !HEX64.test(m["entrySha256"]))) {
+      throw new UnreadableManifestError('"mcp.entrySha256" is not a hash');
+    }
+    mcp = {
+      created: bool(m["created"], "mcp.created"),
+      adopted: bool(m["adopted"], "mcp.adopted"),
+      mcpServersCreated: bool(m["mcpServersCreated"], "mcp.mcpServersCreated"),
+      ...typeof m["entrySha256"] === "string" ? { entrySha256: m["entrySha256"] } : {}
+    };
+  }
+  const g = raw["gitignore"];
+  if (!isRecord(g))
+    throw new UnreadableManifestError('"gitignore" is missing');
+  onlyKeys(g, ["created", "appended"], '"gitignore"');
+  const gitignore = {
+    created: bool(g["created"], "gitignore.created"),
+    appended: stringArray(g["appended"], "gitignore.appended")
+  };
+  const paths = files.map((f) => f.path);
+  if (new Set(paths).size !== paths.length)
+    throw new UnreadableManifestError('"files" names a path twice');
+  const leftAlone = stringArray(raw["leftAlone"], "leftAlone");
+  if (leftAlone.some((p) => paths.includes(p))) {
+    throw new UnreadableManifestError('a path is in both "files" and "leftAlone"');
+  }
+  return {
+    format: INSTALL_MANIFEST_FORMAT,
+    files,
+    createdDirs: stringArray(raw["createdDirs"], "createdDirs"),
+    leftAlone,
+    settings,
+    ...mcp !== void 0 ? { mcp } : {},
+    gitignore
+  };
+}
+function startManifest(previous, isMember, isMemberDir) {
+  const files = /* @__PURE__ */ new Map();
+  for (const entry of previous?.files ?? []) {
+    if (isMember(entry.path))
+      files.set(entry.path, entry);
+  }
+  return {
+    previous,
+    files,
+    collided: /* @__PURE__ */ new Set(),
+    createdDirs: new Set((previous?.createdDirs ?? []).filter(isMemberDir)),
+    settings: previous?.settings,
+    mcp: previous?.mcp,
+    gitignore: previous?.gitignore
+  };
+}
+function recordInstalledFile(draft, path, bytes) {
+  draft.files.set(path, { path, sha256: sha256Hex(bytes) });
+}
+function recordPerMachineFile(draft, path) {
+  draft.files.set(path, { path, perMachine: true });
+}
+function recordCollision(draft, path) {
+  draft.collided.add(path);
+}
+function recordCreatedDir(draft, path) {
+  draft.createdDirs.add(path);
+}
+function recordSettings(draft, observed) {
+  const prev = draft.settings;
+  if (prev === void 0) {
+    draft.settings = observed;
+    return;
+  }
+  draft.settings = {
+    created: prev.created,
+    adopted: prev.adopted,
+    hookCommands: union(prev.hookCommands, observed.hookCommands),
+    denyAddedSha256: union(prev.denyAddedSha256, observed.denyAddedSha256),
+    ..."schemaBefore" in prev ? { schemaBefore: prev.schemaBefore } : "schemaBefore" in observed ? { schemaBefore: observed.schemaBefore } : {},
+    eventsCreated: union(prev.eventsCreated, observed.eventsCreated),
+    hooksCreated: prev.hooksCreated,
+    permissionsCreated: prev.permissionsCreated,
+    denyCreated: prev.denyCreated
+  };
+}
+function recordMcp(draft, observed) {
+  const prev = draft.mcp;
+  if (prev === void 0) {
+    draft.mcp = observed;
+    return;
+  }
+  const entrySha256 = observed.entrySha256 ?? prev.entrySha256;
+  draft.mcp = {
+    created: prev.created,
+    adopted: prev.adopted,
+    mcpServersCreated: prev.mcpServersCreated,
+    ...entrySha256 !== void 0 ? { entrySha256 } : {}
+  };
+}
+function recordGitignore(draft, created, appended) {
+  const prev = draft.gitignore;
+  draft.gitignore = {
+    created: prev?.created ?? created,
+    appended: [...prev?.appended ?? [], ...appended.filter((a) => a !== "")]
+  };
+}
+function finishManifest(draft) {
+  const files = [...draft.files.values()];
+  const leftAlone = [...draft.collided].filter((p) => !draft.files.has(p));
+  return {
+    format: INSTALL_MANIFEST_FORMAT,
+    files,
+    createdDirs: [...draft.createdDirs],
+    leftAlone,
+    settings: draft.settings ?? {
+      created: false,
+      adopted: false,
+      hookCommands: [],
+      denyAddedSha256: [],
+      eventsCreated: [],
+      hooksCreated: false,
+      permissionsCreated: false,
+      denyCreated: false
+    },
+    ...draft.mcp !== void 0 ? { mcp: draft.mcp } : {},
+    gitignore: draft.gitignore ?? { created: false, appended: [] }
+  };
+}
+function union(a, b) {
+  return [.../* @__PURE__ */ new Set([...a, ...b])];
+}
+
 // dist/mcp-endpoint.js
 var MCP_ENDPOINT_PATH = "/mcp";
 function mcpEndpointUrl(origin) {
@@ -1287,8 +1572,9 @@ function scanLayers(targetRepo, scannedAt = (/* @__PURE__ */ new Date()).toISOSt
   }
   return { format: HALFCYCLE_STATE_FORMAT, note: HALFCYCLE_STATE_NOTE, layers };
 }
+var BOOTSTRAP_STATE_REL = ".halfcycle/state.json";
 function runBootstrapScan(targetRepo) {
-  const statePath = join4(targetRepo, ".halfcycle", "state.json");
+  const statePath = join4(targetRepo, BOOTSTRAP_STATE_REL);
   if (existsSync2(statePath)) {
     const existing = JSON.parse(readFileSync4(statePath, "utf-8"));
     return { state: existing, ran: false };
@@ -1347,22 +1633,152 @@ function isAllowlisted(targetRelPath) {
     return normalised === p || normalised.startsWith(p + "/");
   });
 }
+var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
+var PROJECT_IDENTITY_REL = ".halfcycle/project.json";
+var CREW_ROSTER_REL = ".halfcycle/crew.json";
+var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
+var SETTINGS_REL = ".claude/settings.json";
+var GITIGNORE_REL = ".gitignore";
+function commandStubRel(name) {
+  return `.claude/commands/${name}.md`;
+}
+var RETIRED_WRITE_SET_FILES = [];
+var RETIRED_HOOK_COMMANDS = [];
+var RETIRED_DENY_PATTERNS = [];
+function installerHookCommands() {
+  const settings = JSON.parse(generateSettingsJson());
+  return Object.values(settings.hooks ?? {}).flatMap((entries) => entries.flatMap((entry) => entry.hooks.map((h) => h.command)));
+}
+function closedWriteSet() {
+  const files = /* @__PURE__ */ new Set([
+    ...(readPluginManifest().commands ?? []).map((cmd) => commandStubRel(cmd.name)),
+    ...Object.keys(OWNED_GENERATED_HEADERS),
+    VENDORED_BIN_REL,
+    CREW_ROSTER_REL,
+    BUNDLE_PIN_REL,
+    PROJECT_IDENTITY_REL,
+    BOOTSTRAP_STATE_REL,
+    CAPTURED_INDEX_REL,
+    INSTALL_MANIFEST_REL,
+    ...RETIRED_WRITE_SET_FILES
+  ]);
+  const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, GITIGNORE_REL]);
+  const dirs = /* @__PURE__ */ new Set();
+  for (const path of [...files, ...merged]) {
+    for (let dir = posix.dirname(path); dir !== "."; dir = posix.dirname(dir))
+      dirs.add(dir);
+  }
+  const ownedDirs = new Set([...dirs].filter((dir) => `${dir}/`.startsWith(INSTALLER_OWNED_DIR)));
+  return {
+    files,
+    merged,
+    dirs,
+    ownedDirs,
+    hookCommands: /* @__PURE__ */ new Set([...installerHookCommands(), ...RETIRED_HOOK_COMMANDS]),
+    denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
+    gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL])
+  };
+}
+function readPreviousManifest(targetRepo) {
+  try {
+    return parseManifest(readFileSync5(join5(targetRepo, INSTALL_MANIFEST_REL), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function noteFile(draft, targetRepo, rel, outcome) {
+  if (outcome === "collided") {
+    recordCollision(draft, rel);
+    return;
+  }
+  recordInstalledFile(draft, rel, readFileSync5(join5(targetRepo, rel)));
+}
+function recordSettingsMerge(draft, existing, generated, preexisted) {
+  const generatedHooks = generated.hooks ?? {};
+  const hookCommands = Object.values(generatedHooks).flatMap((entries) => entries.flatMap((entry) => entry.hooks.map((h) => h.command)));
+  const ours = new Set(hookCommands);
+  const existingHooks = isPlainObject(existing.hooks) ? existing.hooks : void 0;
+  const heldOurs = Object.values(existingHooks ?? {}).some((entries) => Array.isArray(entries) && entries.some((entry) => isHalfcycleEntry(entry, ours)));
+  const existingDeny = Array.isArray(existing.permissions?.deny) ? existing.permissions.deny : [];
+  const schemaChanged = generated.$schema !== void 0 && existing.$schema !== generated.$schema;
+  recordSettings(draft, {
+    created: !preexisted,
+    adopted: draft.previous === null && heldOurs,
+    hookCommands,
+    denyAddedSha256: (generated.permissions?.deny ?? []).filter((rule) => !existingDeny.includes(rule)).map((rule) => sha256Hex(rule)),
+    ...schemaChanged ? { schemaBefore: existing.$schema ?? null } : {},
+    eventsCreated: Object.keys(generatedHooks).filter((event) => !(existingHooks && event in existingHooks)),
+    hooksCreated: existing.hooks === void 0,
+    permissionsCreated: existing.permissions === void 0,
+    denyCreated: existing.permissions?.deny === void 0
+  });
+}
+function recordMcpMerge(draft, existingText, writtenText) {
+  const before = existingText === null ? void 0 : JSON.parse(existingText);
+  const servers = isPlainObject(before) ? before["mcpServers"] : void 0;
+  const written = JSON.parse(writtenText);
+  recordMcp(draft, {
+    created: existingText === null,
+    adopted: draft.previous === null && isPlainObject(servers) && MCP_SERVER_KEY in servers,
+    mcpServersCreated: !(isPlainObject(before) && "mcpServers" in before),
+    entrySha256: canonicalSha256(written.mcpServers[MCP_SERVER_KEY])
+  });
+}
+function recordMcpAdoptionOnly(draft, existingText) {
+  if (draft.previous !== null || draft.mcp !== void 0)
+    return;
+  let before;
+  try {
+    before = JSON.parse(existingText);
+  } catch {
+    return;
+  }
+  const servers = isPlainObject(before) ? before["mcpServers"] : void 0;
+  if (!isPlainObject(servers) || !(MCP_SERVER_KEY in servers))
+    return;
+  recordMcp(draft, { created: false, adopted: true, mcpServersCreated: false });
+}
+function recordGitignoreReconcile(draft, before, after) {
+  const adopted = draft.gitignore === void 0 && before !== null ? adoptOlderGitignoreBlock(before) : "";
+  let appended = "";
+  if (after !== null && after !== before) {
+    if (before === null)
+      appended = after;
+    else if (after.startsWith(before))
+      appended = after.slice(before.length);
+  }
+  recordGitignore(draft, before === null && after !== null, [adopted, appended]);
+}
+function assertManifestInWriteSet(manifest, writeSet) {
+  const strays = [
+    ...manifest.files.map((f) => f.path).filter((p) => !writeSet.files.has(p)),
+    ...manifest.leftAlone.filter((p) => !writeSet.files.has(p)),
+    ...manifest.createdDirs.filter((p) => !writeSet.dirs.has(p))
+  ];
+  if (strays.length > 0) {
+    throw new Error(`[bundle install] the install record names paths outside the write set: ${strays.join(", ")}`);
+  }
+}
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function readPluginManifest() {
   const manifestPath = join5(BUNDLE_ROOT, ".claude-plugin", "plugin.json");
   const raw = readFileSync5(manifestPath, "utf-8");
   return JSON.parse(raw);
 }
-function copyManifestCommands(manifest, targetRepo, report) {
-  const commandsTargetDir = join5(targetRepo, ".claude", "commands");
+function copyManifestCommands(manifest, targetRepo, report, draft) {
   for (const cmd of manifest.commands ?? []) {
     const srcFile = join5(BUNDLE_ROOT, ".claude-plugin", cmd.path);
     if (!existsSync3(srcFile)) {
       throw new Error(`[bundle install] plugin.json declares command "${cmd.name}" at "${cmd.path}", but no file exists there (${srcFile}). The manifest and commands/ must agree.`);
     }
-    const destFile = join5(commandsTargetDir, `${cmd.name}.md`);
+    const rel = commandStubRel(cmd.name);
+    const destFile = join5(targetRepo, rel);
     const content = readFileSync5(srcFile, "utf-8");
-    const rel = relative(targetRepo, destFile).replace(/\\/g, "/");
-    record(report, writeCollisionSafe(destFile, targetRepo, content), rel);
+    const outcome = writeCollisionSafe(destFile, targetRepo, content);
+    record(report, outcome, rel);
+    noteFile(draft, targetRepo, rel, outcome);
   }
 }
 function writeAllowlisted(targetAbsPath, targetRepoRoot, content, writtenPaths) {
@@ -1428,6 +1844,7 @@ function recordOwnedGenerated(report, targetAbsPath, targetRepoRoot, content, ge
   record(report, outcome, rel);
   if (replacedExisting)
     report.replacedPaths.push(rel);
+  return outcome;
 }
 function recordOwned(report, targetAbsPath, targetRepoRoot, content, rel) {
   const existedBefore = existsSync3(targetAbsPath);
@@ -1435,6 +1852,7 @@ function recordOwned(report, targetAbsPath, targetRepoRoot, content, rel) {
   record(report, outcome, rel);
   if (outcome === "written" && existedBefore)
     report.replacedPaths.push(rel);
+  return outcome;
 }
 function record(report, outcome, rel) {
   const bucket = {
@@ -1759,101 +2177,53 @@ printf '%s\\n' '${USER_PROMPT_REMINDER_SENTENCE}'
 exit 0
 `;
 }
-function generateCiStanza() {
-  return `# Halfcycle guard CI job \u2014 generated by the Halfcycle installer.
-# Below is a complete GitHub Actions workflow: a name, the events it runs on, and
-# one job. It assumes no package manager and no monorepo tooling: it runs the
-# self-contained guard binary vendored at .halfcycle/bin/, so it works in a Python
-# or Go repository as well as a Node one \u2014 the only prerequisite is Node 20 to run
-# the bundled binary.
-#
-# NO WORKFLOW YET? Copy everything from the \`name:\` line to the end of the job
-# into a new file, .github/workflows/halfcycle-guard.yml, without the leading
-# "# " on each line. That file is complete as it stands: commit it, and the check
-# runs on the next push and on every pull request.
-#
-# ALREADY HAVE A WORKFLOW? Copy only the job \u2014 from \`halfcycle-guard-ci:\` down to
-# its \`run:\` line \u2014 under the \`jobs:\` key of the workflow you have, keeping the
-# indentation. The job carries its own \`permissions\` block, so it needs nothing
-# from the rest of that file.
-#
-# THERE IS NOTHING TO STORE. No token in your repository's secrets, no project id
-# to look up, and no address to set. The \`permissions\` block below is the whole
-# configuration: it lets the job ask GitHub for a short-lived signed token naming
-# the repository it is running in, and Halfcycle trusts the name GitHub signs
-# rather than anything the job says about itself. That token is traded for a
-# credential that lives for minutes, and nothing is kept at either end.
-#
-# BOTH PERMISSION LINES, NOT JUST THE SECOND. Declaring any permission
-# replaces the defaults rather than adding to them, so a block naming only
-# \`id-token\` takes read access away from the checkout step and a private
-# repository stops checking out before the guard is reached. If your workflow
-# already has a \`permissions\` block, add \`id-token: write\` to it and leave the
-# rest alone.
-#
-# ONE THING TO DO FIRST, ONCE, ON YOUR OWN MACHINE. In this project, run
-#
-#     npx halfcycle ci bind <owner>/<repo>
-#
-# naming this repository as GitHub spells it (for example acme/widgets). That
-# tells Halfcycle this project's CI runs from that repository, and it is the only
-# thing that makes a run mean anything: without it, Halfcycle has a signed
-# statement of which repository the job is in and no idea whose project that is.
-# The check says exactly that, and names the command, if you skip it.
-#
-# THERE IS NO ADDRESS TO CONFIGURE ANYWHERE IN HALFCYCLE. Every service this
-# product talks to has one address, the same for every user, and it ships in the
-# tools you already have: the installer, the guard hook and the binary this job
-# runs each know where to go. If something tells you to set a Halfcycle URL, it is
-# out of date.
-#
-# WHICH BRANCH MODEL THIS ASSUMES: none. It works on pull-request branches AND on
-# commits pushed straight to the default branch, which is the shape most
-# Halfcycle engagements settle on. The \`on:\` block is what runs it in both
-# places: every push, and every pull request. Narrow it if you want (for example
-# \`branches: [main]\` under \`push:\`), but keep \`pull_request\`, or a change is
-# first checked after it has merged. \`fetch-depth\` is what makes the check work
-# there: it needs the commit BEFORE the one it is evaluating, and the default
-# shallow checkout does not have it. With \`fetch-depth: 0\` the check fails loudly
-# if it cannot work out what to evaluate \u2014 it will not pass quietly having
-# evaluated nothing.
-#
-# name: Halfcycle guard
-# on:
-#   push:
-#   pull_request:
-# jobs:
-#   halfcycle-guard-ci:
-#     runs-on: ubuntu-latest
-#     permissions:
-#       contents: read
-#       id-token: write
-#     steps:
-#       - uses: actions/checkout@v4
-#         with:
-#           # REQUIRED. 0 = full history. The check diffs against the commit before
-#           # HEAD (or the fork point on a branch); the default depth of 1 has
-#           # neither. Do not lower this.
-#           fetch-depth: 0
-#       - uses: actions/setup-node@v4
-#         with:
-#           node-version: '20'
-#       - name: Halfcycle guard CI check
-#         # No env block, on purpose: this step holds no secret. The permissions
-#         # above are what authenticate it.
-#         run: node ./.halfcycle/bin/bin.bundle.mjs ci
-#
-# The job prints the diff base it used and how many files it evaluated, on every
-# run. If that line says 0 files on a commit that changed something, the base is
-# wrong \u2014 set HALFCYCLE_DIFF_BASE in an env block OF YOUR COPY of the check step,
-# to name it explicitly (on a GitHub push event, \${{ github.event.before }} is the
-# right value).
-#
-# EDIT YOUR COPY, NOT THIS FILE. This one is regenerated by the installer and your
-# changes to it would be replaced the next time you run \`npx halfcycle\`. It is
-# also inert where it sits: no CI system reads this path. Copy the workflow above
-# \u2014 or just its job \u2014 into .github/workflows/ and change it there.
-`;
+var CI_STANZA_KNOWN_HEADER_HASHES = [
+  "b225800b2d699811f32ac213238cbf81c35b5e6a74114bdf55e39cd9d7e2928f",
+  "674181735460f051af7c157222cf851fc3000fb3b8af3a10ea0bde9fe5eaba1f",
+  "d17bde608a6fec54a63cb934a28d88acc8babc205334b5ee84d4ed6ee219d340",
+  "85e71d3f6551977b241a28468f121ee4d1c4edef40a2c4dc1aa6f2f737ebd037"
+];
+function isTrackedAndClean(targetRepo, relPath) {
+  try {
+    execFileSync2("git", ["-C", targetRepo, "ls-files", "--error-unmatch", "--", relPath], {
+      stdio: "ignore"
+    });
+  } catch {
+    return false;
+  }
+  try {
+    execFileSync2("git", ["-C", targetRepo, "diff", "--quiet", "HEAD", "--", relPath], {
+      stdio: "ignore"
+    });
+  } catch {
+    return false;
+  }
+  return true;
+}
+function removeLegacyCiStanza(targetRepo) {
+  const rel = ".halfcycle/ci-stanza.yml";
+  const path = join5(targetRepo, rel);
+  if (!existsSync3(path))
+    return "absent";
+  let raw;
+  try {
+    raw = readFileSync5(path, "utf-8");
+  } catch {
+    return "failed";
+  }
+  const headerLine = raw.split("\n")[0] ?? "";
+  const digest = createHash2("sha256").update(headerLine, "utf-8").digest("hex");
+  const ours = CI_STANZA_KNOWN_HEADER_HASHES.includes(digest);
+  if (!ours)
+    return "kept-foreign";
+  if (!isTrackedAndClean(targetRepo, rel))
+    return "kept-uncommitted";
+  try {
+    rmSync(path);
+  } catch {
+    return "failed";
+  }
+  return "removed";
 }
 var MCP_REGISTRATION_REL = ".mcp.json";
 var MCP_SERVER_KEY = "halfcycle";
@@ -1895,13 +2265,81 @@ PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
 
 ${engagementResolutionShell()}
 
+# Read one KEY's value out of the credential store into HC_VALUE, in the CALLER's
+# shell (call it as a statement, never inside $(...)). Last assignment wins,
+# matching the shell's own \`.\` semantics. An optional leading \`export \` is
+# tolerated because a hand-edited store may use one.
+halfcycle_store_value() {
+  HC_VALUE=""
+  hc_line=$(grep "^[[:space:]]*\\(export[[:space:]][[:space:]]*\\)\\{0,1\\}$2=" "$1" | tail -n 1)
+  hc_v=\${hc_line#*"$2="}
+  hc_v=$(printf '%s' "$hc_v" | tr -d '\\r')
+
+  # Strip one layer of matching quotes. The store is WRITTEN single-quoted (both
+  # writers use the same shq: this installer and Studio's provider), because
+  # guard-runner.sh SOURCES the same file and an unquoted value carrying a space
+  # would execute its own remainder. This reader greps rather than sources, so it
+  # has to undo the quoting itself \u2014 and it must land on the same value the
+  # sourcing consumer gets, or one file has two answers.
+  case $hc_v in
+    '"'*'"') hc_v=\${hc_v#'"'}; hc_v=\${hc_v%'"'} ;;
+    "'"*"'")
+      hc_v=\${hc_v#"'"}; hc_v=\${hc_v%"'"}
+      # \u2026and undo shq's embedded-quote escape, '\\'' -> '. The backslash is matched
+      # through a BRACKET EXPRESSION on purpose. MEASURED, on GNU sed 4.9 (Linux,
+      # the CI platform) and BSD sed (macOS), feeding each the script from a file so
+      # no shell quoting is in the way:
+      #
+      #   s/'[\\]''/'/g   a'\\''b -> a'b     both      <- shipped
+      #   s/'\\''/'/g     a'\\''b -> a'\\''b   both      <- matches NOTHING, exit 0
+      #
+      # A bare \\' in a BRE is undefined by POSIX, and the obvious pattern therefore
+      # does not fail loudly \u2014 it silently substitutes nothing, on BOTH platforms,
+      # and the token then travels with four stray characters in it. The bracket
+      # expression makes the backslash literal by a construction POSIX does define.
+      hc_v=$(printf '%s' "$hc_v" | sed "s/'[\\]''/'/g") ;;
+  esac
+  HC_VALUE=$hc_v
+}
+
+# The scheme and host[:port] of a URL, lowercased \u2014 or NOTHING when the URL holds
+# a space or a control character anywhere. That refusal is the load-bearing part:
+# a URL parser drops tabs and newlines before it reads the host, so
+# "https://ours<newline>@elsewhere/" is a request to "elsewhere", while a
+# line-by-line reading here would see only "https://ours". The host ends at the
+# first / ? # or backslash, which is where a URL parser ends it for http(s).
+halfcycle_origin() {
+  hc_u=$1
+  if [ "$(printf '%s' "$hc_u" | tr -d '[:cntrl:][:space:]')" != "$hc_u" ]; then
+    return 0
+  fi
+  printf '%s\\n' "$hc_u" | sed -n 's|^\\([A-Za-z][A-Za-z0-9+.-]*://[^/?#\\\\]*\\).*$|\\1|p' | tr '[:upper:]' '[:lower:]'
+}
+
 # HALFCYCLE_TOKEN in the environment WINS, and it is the CI arm: a job with no
 # browser and no per-user store exports the credential, and a stale store on a
 # long-lived runner must not silently win over it. Same order, and the same reason,
-# as the CLI's own resolver (\`resolve-credential.ts\`).
+# as the CLI's own resolver (\`resolve-credential.ts\`). The server it may be sent
+# to is NOT taken from the environment: it is read from this machine's store in
+# both arms, so a token supplied this way still goes only where this machine was
+# set up to send it.
+# The pin names an id that is not a project id. Re-running the installer against
+# that pin refuses it too, so the one remedy that works is a fresh pin.
+halfcycle_bad_id_message() {
+  echo "halfcycle: $PROJECT_ROOT/.halfcycle/bundle.json names an engagement id that is not a Halfcycle project id," >&2
+  echo "halfcycle: so no credential was read. Delete that file and run \\"npx halfcycle\\" again: this repository" >&2
+  echo "halfcycle: is then set up as a new Halfcycle project." >&2
+}
+
 TOKEN=\${HALFCYCLE_TOKEN:-}
+MCP_URL=""
 
-if [ -z "$TOKEN" ]; then
+if [ -n "$TOKEN" ]; then
+  if halfcycle_env_file "$PROJECT_ROOT"; then
+    halfcycle_store_value "$HALFCYCLE_ENV_FILE" HALFCYCLE_MCP_URL
+    MCP_URL=$HC_VALUE
+  fi
+else
   if ! halfcycle_env_file "$PROJECT_ROOT"; then
     case $HALFCYCLE_ENV_PROBLEM in
       no-pin)
@@ -1910,6 +2348,8 @@ if [ -z "$TOKEN" ]; then
       no-id)
         echo "halfcycle: $PROJECT_ROOT/.halfcycle/bundle.json names no engagement id." >&2
         echo "halfcycle: run \\"npx halfcycle\\" here to rewrite it." >&2 ;;
+      bad-id)
+        halfcycle_bad_id_message ;;
       no-home)
         echo "halfcycle: HOME is not set, so the credential store cannot be located." >&2 ;;
       *)
@@ -1932,42 +2372,48 @@ if [ -z "$TOKEN" ]; then
   fi
   ENV_FILE="$HALFCYCLE_ENV_FILE"
 
-  # Last assignment wins, matching the shell's own \`.\` semantics. An optional
-  # leading \`export \` is tolerated because a hand-edited store may use one.
-  LINE=$(grep '^[[:space:]]*\\(export[[:space:]][[:space:]]*\\)\\{0,1\\}HALFCYCLE_TOKEN=' "$ENV_FILE" | tail -n 1)
-  TOKEN=\${LINE#*HALFCYCLE_TOKEN=}
-  TOKEN=$(printf '%s' "$TOKEN" | tr -d '\\r')
-
-  # Strip one layer of matching quotes. The store is WRITTEN single-quoted (both
-  # writers use the same shq: this installer and Studio's provider), because
-  # guard-runner.sh SOURCES the same file and an unquoted value carrying a space
-  # would execute its own remainder. This reader greps rather than sources, so it
-  # has to undo the quoting itself \u2014 and it must land on the same value the
-  # sourcing consumer gets, or one file has two answers.
-  case $TOKEN in
-    '"'*'"') TOKEN=\${TOKEN#'"'}; TOKEN=\${TOKEN%'"'} ;;
-    "'"*"'")
-      TOKEN=\${TOKEN#"'"}; TOKEN=\${TOKEN%"'"}
-      # \u2026and undo shq's embedded-quote escape, '\\'' -> '. The backslash is matched
-      # through a BRACKET EXPRESSION on purpose. MEASURED, on GNU sed 4.9 (Linux,
-      # the CI platform) and BSD sed (macOS), feeding each the script from a file so
-      # no shell quoting is in the way:
-      #
-      #   s/'[\\]''/'/g   a'\\''b -> a'b     both      <- shipped
-      #   s/'\\''/'/g     a'\\''b -> a'\\''b   both      <- matches NOTHING, exit 0
-      #
-      # A bare \\' in a BRE is undefined by POSIX, and the obvious pattern therefore
-      # does not fail loudly \u2014 it silently substitutes nothing, on BOTH platforms,
-      # and the token then travels with four stray characters in it. The bracket
-      # expression makes the backslash literal by a construction POSIX does define.
-      TOKEN=$(printf '%s' "$TOKEN" | sed "s/'[\\]''/'/g") ;;
-  esac
-
+  halfcycle_store_value "$ENV_FILE" HALFCYCLE_TOKEN
+  TOKEN=$HC_VALUE
   if [ -z "$TOKEN" ]; then
     echo "halfcycle: HALFCYCLE_TOKEN is absent or empty in $ENV_FILE." >&2
     echo "halfcycle: run \\"npx halfcycle\\" in this repository to rewrite this machine's credential." >&2
     exit 1
   fi
+  halfcycle_store_value "$ENV_FILE" HALFCYCLE_MCP_URL
+  MCP_URL=$HC_VALUE
+fi
+
+# THE TOKEN GOES ONLY TO THIS MACHINE'S HALFCYCLE SERVER. .mcp.json is a tracked
+# file: anyone who can land a commit can change the server's url, and this script
+# would then hand the credential to whatever it names. Claude Code tells the helper
+# which url it is about to connect to (CLAUDE_CODE_MCP_SERVER_URL); the server this
+# machine was set up against is recorded OUTSIDE the repository, beside the
+# credential. The two must share scheme, host and port, or nothing is printed.
+# No url at all is a refusal too: sending the credential without knowing where it
+# is going is the thing this check exists to stop.
+REQUESTED=\${CLAUDE_CODE_MCP_SERVER_URL:-}
+if [ -z "$REQUESTED" ]; then
+  echo "halfcycle: Claude Code did not say which server it is connecting to, so the Halfcycle credential was not sent." >&2
+  echo "halfcycle: update Claude Code, then reconnect." >&2
+  exit 1
+fi
+if [ -z "$MCP_URL" ] && [ "\${HALFCYCLE_ENV_PROBLEM:-}" = "bad-id" ]; then
+  halfcycle_bad_id_message
+  exit 1
+fi
+if [ -z "$MCP_URL" ]; then
+  echo "halfcycle: this machine has no Halfcycle server address recorded for this repository, so the credential was not sent." >&2
+  echo "halfcycle: run \\"npx halfcycle\\" in this repository on this machine to record it." >&2
+  exit 1
+fi
+WANT=$(halfcycle_origin "$MCP_URL")
+GOT=$(halfcycle_origin "$REQUESTED")
+if [ -z "$WANT" ] || [ "$GOT" != "$WANT" ]; then
+  SHOWN=$(printf '%s' "$REQUESTED" | tr -cd '[:graph:]' | cut -c1-200)
+  echo "halfcycle: .mcp.json asks for this repository's Halfcycle credential to be sent to $SHOWN," >&2
+  echo "halfcycle: which is not this machine's Halfcycle server (\${WANT:-none recorded}). The credential was NOT sent." >&2
+  echo "halfcycle: if nobody meant to change .mcp.json, treat that change as suspect; \\"npx halfcycle\\" restores the entry." >&2
+  exit 1
 fi
 
 # JSON-escape: backslash first, then double quote. A token carrying either would
@@ -1983,7 +2429,7 @@ function generateMcpRegistration(existing, mcpOrigin) {
   if (existing !== null) {
     const parsed = JSON.parse(existing);
     if (parsed !== null && typeof parsed === "object") {
-      base = { mcpServers: {}, ...parsed };
+      base = { ...parsed };
     }
   }
   if (typeof base.mcpServers !== "object" || base.mcpServers === null) {
@@ -1997,13 +2443,33 @@ function generateMcpRegistration(existing, mcpOrigin) {
   return JSON.stringify(base, null, 2) + "\n";
 }
 var REQUIRED_GITIGNORE_ENTRIES = [".halfcycle/state.json", `${ZONE_B_DIR}/`];
+var GITIGNORE_HEADER = "# Halfcycle \u2014 machine-local secrets/state and Zone-B (never push to client remote)";
+function adoptOlderGitignoreBlock(before) {
+  const claimable = /* @__PURE__ */ new Set([...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL]);
+  const claimed = [];
+  let underHeader = false;
+  const lines = before.split("\n");
+  for (const [i, line] of lines.entries()) {
+    if (line === GITIGNORE_HEADER) {
+      if (i > 0 && lines[i - 1] === "")
+        claimed.push("");
+      claimed.push(line);
+      underHeader = true;
+    } else if (line.trim() === "") {
+      underHeader = false;
+    } else if (underHeader && claimable.has(line)) {
+      claimed.push(line);
+    }
+  }
+  return claimed.length > 0 ? claimed.join("\n") + "\n" : "";
+}
 function gitignoreCovers(content) {
   const lines = new Set(content.split("\n").map((l) => l.trim()));
   return REQUIRED_GITIGNORE_ENTRIES.every((entry) => lines.has(entry));
 }
 function reconcileGitignore(targetRepo) {
-  const gitignorePath = join5(targetRepo, ".gitignore");
-  const header = "# Halfcycle \u2014 machine-local secrets/state and Zone-B (never push to client remote)";
+  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
+  const header = GITIGNORE_HEADER;
   try {
     if (!existsSync3(gitignorePath)) {
       const body = [header, ...REQUIRED_GITIGNORE_ENTRIES].join("\n") + "\n";
@@ -2048,7 +2514,7 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, a
     installedAt,
     ...carried !== void 0 ? { accountId: carried } : {}
   };
-  const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
+  const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
 }
 function writeCrewRoster(targetRepoRoot, report) {
@@ -2058,11 +2524,11 @@ function writeCrewRoster(targetRepoRoot, report) {
   };
   const rendered = `${JSON.stringify(doc, null, 2)}
 `;
-  const crewPath = join5(targetRepoRoot, ".halfcycle", "crew.json");
-  recordOwned(report, crewPath, targetRepoRoot, rendered, ".halfcycle/crew.json");
+  const crewPath = join5(targetRepoRoot, CREW_ROSTER_REL);
+  return recordOwned(report, crewPath, targetRepoRoot, rendered, CREW_ROSTER_REL);
 }
 function readBundlePin(targetRepoRoot) {
-  const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
+  const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
   if (!existsSync3(pinPath))
     return null;
   return JSON.parse(readFileSync5(pinPath, "utf-8"));
@@ -2072,6 +2538,7 @@ function readPinnedEngagement(targetRepoRoot, home) {
   const engagementId = pin?.engagementId;
   if (engagementId === void 0 || engagementId === "")
     return null;
+  assertEngagementId(engagementId);
   const stored = readEngagementEnv(engagementId, home);
   const fromStore = stored === null ? void 0 : toCredential(stored);
   if (fromStore !== void 0) {
@@ -2123,7 +2590,7 @@ function checkDrift(targetRepoRoot) {
   return { drifted: installed !== current, installed, current };
 }
 function writeProjectIdentity(targetRepo) {
-  const path = join5(targetRepo, ".halfcycle", "project.json");
+  const path = join5(targetRepo, PROJECT_IDENTITY_REL);
   const { identity } = mintOrReadIdentity(targetRepo);
   const serialized = JSON.stringify(identity, null, 2) + "\n";
   if (existsSync3(path) && readFileSync5(path, "utf-8") === serialized)
@@ -2202,6 +2669,7 @@ function migrateLegacyEnvLocal(targetRepo, stored) {
 }
 async function install(options) {
   const { targetRepo, engagementId, engagementType, credential, home, accountId } = options;
+  assertEngagementId(engagementId);
   if (!existsSync3(targetRepo)) {
     throw new Error(`[bundle install] Target repo does not exist: ${targetRepo}`);
   }
@@ -2213,22 +2681,30 @@ async function install(options) {
     collidedPaths: [],
     replacedPaths: []
   };
-  copyManifestCommands(manifest, targetRepo, report);
-  const capturedDir = join5(targetRepo, "test", "fixtures", "captured");
-  const capturedManifest = join5(capturedDir, "manifest.json");
+  const writeSet = closedWriteSet();
+  const draft = startManifest(readPreviousManifest(targetRepo), (path) => writeSet.files.has(path), (path) => writeSet.dirs.has(path));
+  const dirsBefore = new Set([...writeSet.dirs].filter((dir) => existsSync3(join5(targetRepo, dir))));
+  copyManifestCommands(manifest, targetRepo, report, draft);
+  const capturedManifest = join5(targetRepo, CAPTURED_INDEX_REL);
+  const srcManifest = join5(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
   if (!existsSync3(capturedManifest)) {
-    const srcManifest = join5(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
     writeAllowlisted(capturedManifest, targetRepo, readFileSync5(srcManifest, "utf-8"), report.writtenPaths);
+    noteFile(draft, targetRepo, CAPTURED_INDEX_REL, "written");
   } else {
-    report.skippedPaths.push("test/fixtures/captured/manifest.json");
+    report.skippedPaths.push(CAPTURED_INDEX_REL);
+    if (readFileSync5(capturedManifest).equals(readFileSync5(srcManifest))) {
+      noteFile(draft, targetRepo, CAPTURED_INDEX_REL, "skipped");
+    }
   }
   const vendoredBinSrc = resolveVendoredBinary();
   const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
-  recordOwned(report, vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8"), ".halfcycle/bin/bin.bundle.mjs");
-  const settingsPath = join5(targetRepo, ".claude", "settings.json");
+  const vendoredOutcome = recordOwned(report, vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8"), VENDORED_BIN_REL);
+  noteFile(draft, targetRepo, VENDORED_BIN_REL, vendoredOutcome);
+  const settingsPath = join5(targetRepo, SETTINGS_REL);
   const settingsPreexisted = existsSync3(settingsPath);
   const generatedSettings = JSON.parse(generateSettingsJson());
   const existingSettings = settingsPreexisted ? JSON.parse(readFileSync5(settingsPath, "utf-8")) : {};
+  recordSettingsMerge(draft, existingSettings, generatedSettings, settingsPreexisted);
   const mergedSettings = mergeSettings(existingSettings, generatedSettings);
   const mergedSettingsText = JSON.stringify(mergedSettings, null, 2) + "\n";
   mkdirSync4(dirname2(settingsPath), { recursive: true });
@@ -2242,16 +2718,33 @@ async function install(options) {
   ]) {
     const rel = `.claude/hooks/${name}`;
     const hookPath = join5(targetRepo, ".claude", "hooks", name);
-    recordOwnedGenerated(report, hookPath, targetRepo, content, OWNED_GENERATED_HEADERS[rel], rel);
+    const outcome = recordOwnedGenerated(report, hookPath, targetRepo, content, OWNED_GENERATED_HEADERS[rel], rel);
+    noteFile(draft, targetRepo, rel, outcome);
+  }
+  switch (removeLegacyCiStanza(targetRepo)) {
+    case "removed":
+      report.writtenPaths.push(".halfcycle/ci-stanza.yml (REMOVED \u2014 Halfcycle no longer generates this file)");
+      break;
+    case "kept-foreign":
+      report.skippedPaths.push(".halfcycle/ci-stanza.yml (KEPT \u2014 this file was not generated by Halfcycle, so it was left alone)");
+      break;
+    case "kept-uncommitted":
+      report.skippedPaths.push(".halfcycle/ci-stanza.yml (KEPT \u2014 this looks like a Halfcycle-generated file, but it is not a clean, committed copy in this repository, so it was left alone rather than risk losing an edit)");
+      break;
+    case "failed":
+      report.skippedPaths.push(".halfcycle/ci-stanza.yml (could not be removed \u2014 DELETE IT BY HAND: Halfcycle no longer uses this file)");
+      break;
+    case "absent":
+      break;
   }
-  const ciStanzaPath = join5(targetRepo, ".halfcycle", "ci-stanza.yml");
-  recordOwned(report, ciStanzaPath, targetRepo, generateCiStanza(), ".halfcycle/ci-stanza.yml");
   if (credential) {
     const helperPath = join5(targetRepo, MCP_HEADERS_HELPER_REL);
-    recordOwnedGenerated(report, helperPath, targetRepo, generateMcpHeadersHelper(), OWNED_GENERATED_HEADERS[MCP_HEADERS_HELPER_REL], MCP_HEADERS_HELPER_REL);
+    const helperOutcome = recordOwnedGenerated(report, helperPath, targetRepo, generateMcpHeadersHelper(), OWNED_GENERATED_HEADERS[MCP_HEADERS_HELPER_REL], MCP_HEADERS_HELPER_REL);
+    noteFile(draft, targetRepo, MCP_HEADERS_HELPER_REL, helperOutcome);
     const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
     const existingMcp = existsSync3(mcpPath) ? readFileSync5(mcpPath, "utf-8") : null;
     const mcpContent = generateMcpRegistration(existingMcp, credential.mcpUrl);
+    recordMcpMerge(draft, existingMcp, mcpContent);
     if (existingMcp === null) {
       writeAllowlisted(mcpPath, targetRepo, mcpContent, report.writtenPaths);
     } else if (existingMcp !== mcpContent) {
@@ -2261,14 +2754,22 @@ async function install(options) {
     }
   } else {
     report.skippedPaths.push(`${MCP_REGISTRATION_REL} (no MCP origin \u2014 no credential supplied)`);
+    const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
+    if (existsSync3(mcpPath))
+      recordMcpAdoptionOnly(draft, readFileSync5(mcpPath, "utf-8"));
   }
+  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
+  const gitignoreBefore = existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf-8") : null;
   const gitignoreOutcome = reconcileGitignore(targetRepo);
+  recordGitignoreReconcile(draft, gitignoreBefore, existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf-8") : null);
   if (gitignoreOutcome === "failed") {
     report.skippedPaths.push(".gitignore (write failed \u2014 see credential refusal)");
   } else {
     record(report, gitignoreOutcome, ".gitignore");
   }
-  record(report, writeProjectIdentity(targetRepo), ".halfcycle/project.json");
+  const identityOutcome = writeProjectIdentity(targetRepo);
+  record(report, identityOutcome, PROJECT_IDENTITY_REL);
+  noteFile(draft, targetRepo, PROJECT_IDENTITY_REL, identityOutcome);
   const credentialPath = engagementEnvPath(engagementId, home);
   if (credential) {
     record(report, writeEngagementCredential(credential, engagementId, home), credentialPath);
@@ -2294,8 +2795,18 @@ async function install(options) {
       break;
   }
   writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, accountId, report.writtenPaths);
-  writeCrewRoster(targetRepo, report);
+  noteFile(draft, targetRepo, BUNDLE_PIN_REL, "written");
+  noteFile(draft, targetRepo, CREW_ROSTER_REL, writeCrewRoster(targetRepo, report));
   const scanResult = runBootstrapScan(targetRepo);
+  if (existsSync3(join5(targetRepo, BOOTSTRAP_STATE_REL)))
+    recordPerMachineFile(draft, BOOTSTRAP_STATE_REL);
+  for (const dir of writeSet.dirs) {
+    if (!dirsBefore.has(dir) && existsSync3(join5(targetRepo, dir)))
+      recordCreatedDir(draft, dir);
+  }
+  const installManifest = finishManifest(draft);
+  assertManifestInWriteSet(installManifest, writeSet);
+  recordOwned(report, join5(targetRepo, INSTALL_MANIFEST_REL), targetRepo, serializeManifest(installManifest), INSTALL_MANIFEST_REL);
   return {
     version: manifest.version,
     writtenPaths: report.writtenPaths,
@@ -3560,11 +4071,11 @@ function projectSeedGuard(fired, includeExplanation) {
 
 // dist/build-record/sources.js
 import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
-import { createHash } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { join as join8 } from "node:path";
 
 // dist/build-record/close-record.js
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname3, join as join6 } from "node:path";
 var CLOSE_RECORD_FORMAT = "halfcycle-phase-close/v1";
@@ -3581,11 +4092,11 @@ function closeRecordPath(repoRoot, phase) {
 }
 function resolveCloseAtHead(repoRoot) {
   try {
-    const closeCommit = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
+    const closeCommit = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
-    const closedDate = execFileSync2("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], {
+    const closedDate = execFileSync3("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -3809,7 +4320,7 @@ function syntheticRunId(record2) {
     record2["runType"],
     record2["phase"]
   ].join("|");
-  const hex = createHash("sha256").update(`legacy-guard-eval-run:${key}`).digest("hex");
+  const hex = createHash3("sha256").update(`legacy-guard-eval-run:${key}`).digest("hex");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 function readGuardEvalLog(logDir, phaseId) {
@@ -3981,6 +4492,8 @@ var OPEN_PHASE_ENV_KEYS = [
 ];
 function readRepoCredential(repoRoot, env = process.env, home) {
   const pinned = readPinnedEngagementId(repoRoot);
+  if (pinned !== null)
+    assertEngagementId(pinned);
   const fromStore = pinned === null ? null : readEngagementEnv(pinned, home);
   const looked = pinned === null ? `${join9(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
   const values = {};
@@ -4007,6 +4520,9 @@ function readPinnedEngagementId(repoRoot) {
   }
 }
 function writePhaseStamp(engagementId, phase, home) {
+  if (!isEngagementId(engagementId)) {
+    return { path: "(none \u2014 no valid project id)", reason: new InvalidEngagementIdError(engagementId).message };
+  }
   const path = engagementEnvPath(engagementId, home);
   if (phase !== null && !isValidPhaseIdentity(phase)) {
     return { path, reason: new InvalidPhaseIdentityError(phase).message };
@@ -4115,115 +4631,13 @@ async function closePhase(credential, phase, outcome, close, home, repoRoot) {
   return { engagementId: body.engagementId, status: body.status, stampFailure, closeRecord };
 }
 
-// dist/ci-bind.js
-function parseCiRepositoryArg(arg) {
-  const parts = arg.split("/");
-  if (parts.length !== 2)
-    return null;
-  const [owner, repo] = parts;
-  if (owner === void 0 || owner.trim() === "")
-    return null;
-  if (repo === void 0 || repo.trim() === "")
-    return null;
-  return { owner, repo };
-}
-var CiBindRefused = class extends Error {
-  status;
-  constructor(status, message) {
-    super(message);
-    this.status = status;
-    this.name = "CiBindRefused";
-  }
-  /** Is this the ONE arm signing in again can fix — see this file's header. */
-  get authRefused() {
-    return this.status === 401;
-  }
-  /**
-   * Is this "ours to fix, try again", not "yours to fix"? The question is not
-   * mechanical (did a handler run) — it is what a developer reading the message
-   * does next. `502`/`504` are the reverse proxy in front of the published origin
-   * answering for a control plane that is down or slow, with an HTML body this
-   * file's own `requestBinding` cannot parse, so the message would otherwise
-   * degrade to a bare "the URL returned 502". `503` is `resolveAccount`'s own
-   * fail-closed refusal when it could not reach the token store — the caller's
-   * credential was never actually checked, and its posture is emphatic this is NOT
-   * a "no". **`500` belongs beside them, not with the 4xx arms.** It is an
-   * unhandled throw: nothing decided the request's merits, and the bind may even
-   * have half-happened if the throw landed after a commit. On this route the
-   * body is the same degraded "the URL returned 500" a 502/504 produces — an
-   * internal path echoed back with no advice — so `refused (500)` would send a
-   * developer to re-check ownership, the repository name and whether it is bound
-   * elsewhere: every 4xx question, none of them this status's actual cause.
-   *
-   * So this is every `5xx`, not an enumerated set of three — the boundary is
-   * "did any handler decide yes or no", and a 4xx is the only family that ever did.
-   */
-  get unavailable() {
-    return this.status >= 500 && this.status < 600;
-  }
-};
-async function requestBinding(method, serviceUrl, engagementId, repository, credential, noun) {
-  const url = `${serviceUrl.replace(/\/+$/, "")}/engagements/${encodeURIComponent(engagementId)}/ci-bindings/${encodeURIComponent(repository.owner)}/${encodeURIComponent(repository.repo)}`;
-  let res;
-  try {
-    res = await fetch(url, { method, headers: { authorization: `Bearer ${credential}` } });
-  } catch (err) {
-    throw new Error(`[halfcycle] Could not reach the Halfcycle service at ${url}: ${err instanceof Error ? err.message : String(err)}. Nothing was ${noun}.`);
-  }
-  if (res.status === 204)
-    return;
-  const body = await res.json().catch(() => null);
-  const message = typeof body?.message === "string" ? body.message : `${url} returned ${res.status}.`;
-  throw new CiBindRefused(res.status, message);
-}
-async function setCiBinding(action, serviceUrl, engagementId, repository, deps = {}) {
-  const noun = action === "bind" ? "bound" : "unbound";
-  const signInDeps = {
-    ...deps,
-    reason: deps.reason ?? (action === "bind" ? "trust this repository for this engagement's CI" : "stop trusting this repository for this engagement's CI")
-  };
-  let credential = await obtainCredential(serviceUrl, signInDeps);
-  for (; ; ) {
-    try {
-      await requestBinding(action === "bind" ? "PUT" : "DELETE", serviceUrl, engagementId, repository, credential.credential, noun);
-      return;
-    } catch (err) {
-      if (!(err instanceof CiBindRefused) || !err.authRefused)
-        throw err;
-      const replacement = await replaceRefusedCredential(serviceUrl, credential, signInDeps);
-      if (replacement === null) {
-        throw new SignInRefused(`ci-${action}-${err.status}`, `${err.message} ${refusedCredentialRemedy(credential.source)} Nothing was ${noun}.`);
-      }
-      process.stdout.write(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
-`);
-      credential = replacement;
-    }
-  }
-}
-function bindCiRepository(serviceUrl, engagementId, repository, deps = {}) {
-  return setCiBinding("bind", serviceUrl, engagementId, repository, deps);
-}
-function unbindCiRepository(serviceUrl, engagementId, repository, deps = {}) {
-  return setCiBinding("unbind", serviceUrl, engagementId, repository, deps);
-}
-
 // dist/cli-contract.js
-var CLI_VERBS = ["install", "check-drift", "build-record", "open-phase", "close-phase", "ci"];
+var CLI_VERBS = ["install", "check-drift", "build-record", "open-phase", "close-phase", "uninstall"];
 var CONTRACTS = [
-  // `install`, `check-drift`, `build-record` and `ci` take positionals and no
-  // required flags. They are declared so the verb set has ONE home — a remedy
-  // naming a verb this CLI does not have is the same defect as one missing a flag.
-  //
-  // `ci`'s two forms (`ci bind <owner>/<repo>`, `ci unbind <owner>/<repo>`) take a
-  // sub-action and a repository as POSITIONALS, not flags — this table answers only
-  // *which flags must an invocation carry*, and neither form has one (T-11,
-  // `ci-oidc-token-exchange`). The route it calls declares no wire shape either
-  // (path segments in, `204` out — T-05), so there is no schema for an argument
-  // here to disagree with.
   { verb: "install", required: [], conditional: [] },
   { verb: "check-drift", required: [], conditional: [] },
   { verb: "build-record", required: [], conditional: [] },
-  { verb: "ci", required: [], conditional: [] },
+  { verb: "uninstall", required: [], conditional: [] },
   {
     verb: "open-phase",
     required: [
@@ -4330,10 +4744,618 @@ var PLACEHOLDERS = {
   "--evidence": '"\u2026"'
 };
 
+// dist/uninstall.js
+import { lstatSync, readFileSync as readFileSync8, readdirSync, rmSync as rmSync2, rmdirSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname4, join as join10, relative as relative3, sep } from "node:path";
+var REMOVE_CREDENTIAL_FLAG = "--remove-credential";
+function parseUninstallArgs(args2) {
+  let removeCredential = false;
+  for (const arg of args2) {
+    if (arg === REMOVE_CREDENTIAL_FLAG) {
+      removeCredential = true;
+      continue;
+    }
+    return {
+      error: arg.startsWith("-") ? `unknown flag "${arg}" \u2014 the one flag is ${REMOVE_CREDENTIAL_FLAG}. Nothing was changed.` : `unexpected argument "${arg}" \u2014 run it in the project directory, with no path. Nothing was changed.`
+    };
+  }
+  return { removeCredential };
+}
+function lexists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function symlinkOnPath(root, rel) {
+  let current = root;
+  for (const segment of rel.split("/")) {
+    current = join10(current, segment);
+    try {
+      if (lstatSync(current).isSymbolicLink())
+        return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function isPlainObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function serializeJson(value) {
+  return JSON.stringify(value, null, 2) + "\n";
+}
+var Refusal = class extends Error {
+};
+function readMergedJson(targetRepo, rel) {
+  if (symlinkOnPath(targetRepo, rel))
+    return { state: "symlink" };
+  const path = join10(targetRepo, rel);
+  if (!lexists(path))
+    return { state: "absent" };
+  let value;
+  try {
+    value = JSON.parse(readFileSync8(path, "utf-8"));
+  } catch {
+    value = void 0;
+  }
+  if (!isPlainObject2(value)) {
+    throw new Refusal(`${rel} is not a JSON object, so Halfcycle cannot take its own entries out of it and nothing was removed. Fix it or delete it, then run "npx halfcycle uninstall" again.`);
+  }
+  return { state: "object", value };
+}
+function validate(options) {
+  const { targetRepo, removeCredential, home } = options;
+  const manifestPath = join10(targetRepo, INSTALL_MANIFEST_REL);
+  const pinPath = join10(targetRepo, BUNDLE_PIN_REL);
+  if (symlinkOnPath(targetRepo, INSTALL_MANIFEST_REL) || symlinkOnPath(targetRepo, BUNDLE_PIN_REL)) {
+    throw new Refusal(`.halfcycle, or a file Halfcycle keeps in it, is a symbolic link here, so nothing was followed and nothing was removed.`);
+  }
+  if (!lexists(manifestPath)) {
+    if (!lexists(pinPath))
+      return "not-installed";
+    throw new Refusal(`Halfcycle was installed here by a version that kept no record of what it wrote, so nothing was removed. Run "npx halfcycle" once \u2014 it writes that record \u2014 then run "npx halfcycle uninstall".`);
+  }
+  let manifest;
+  try {
+    manifest = parseManifest(readFileSync8(manifestPath, "utf-8"));
+  } catch (err) {
+    const why = err instanceof UnreadableManifestError ? err.message : "it could not be read";
+    throw new Refusal(`${INSTALL_MANIFEST_REL} cannot be read (${why}), so nothing was removed. Restore it from git, or run "npx halfcycle" once to rewrite it, then run "npx halfcycle uninstall" again.`);
+  }
+  let engagementId;
+  let pinReadable = true;
+  if (lexists(pinPath)) {
+    try {
+      const pin = JSON.parse(readFileSync8(pinPath, "utf-8"));
+      const id = isPlainObject2(pin) ? pin["engagementId"] : void 0;
+      engagementId = typeof id === "string" && id !== "" ? id : void 0;
+    } catch {
+      pinReadable = false;
+    }
+  }
+  let idValid = false;
+  if (engagementId !== void 0) {
+    try {
+      assertEngagementId(engagementId);
+      idValid = true;
+    } catch {
+      idValid = false;
+    }
+  }
+  if (removeCredential) {
+    if (!pinReadable) {
+      throw new Refusal(`${BUNDLE_PIN_REL} cannot be read, so there is no project id to find this machine's credential by. Nothing was removed.`);
+    }
+    if (engagementId !== void 0 && !idValid) {
+      throw new Refusal(`the project id in ${BUNDLE_PIN_REL} is not a valid Halfcycle project id, so it cannot name a folder on this machine. Nothing was removed, here or under ~/.halfcycle.`);
+    }
+    if (engagementId !== void 0) {
+      const expectedParent = join10(home ?? homedir2(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME);
+      if (dirname4(engagementStateDir(engagementId, home)) !== expectedParent) {
+        throw new Refusal(`the project id in ${BUNDLE_PIN_REL} does not name a folder under ~/.halfcycle/engagements. Nothing was removed.`);
+      }
+    }
+  }
+  return {
+    manifest,
+    engagementId,
+    idValid,
+    settings: readMergedJson(targetRepo, SETTINGS_REL),
+    mcp: manifest.mcp !== void 0 ? readMergedJson(targetRepo, MCP_REGISTRATION_REL) : { state: "absent" }
+  };
+}
+function unmergeSettings(value, rec, writeSet) {
+  let changed = false;
+  const refused = [];
+  const commands = new Set(rec.hookCommands.filter((c) => writeSet.hookCommands.has(c)));
+  for (const command of rec.hookCommands) {
+    if (!writeSet.hookCommands.has(command)) {
+      refused.push(`${SETTINGS_REL}: the hook command ${JSON.stringify(command)} (Halfcycle never writes it, so it was kept)`);
+    }
+  }
+  const denyHashes = rec.denyAddedSha256.filter((h) => writeSet.denyRuleSha256.has(h));
+  if (denyHashes.length < rec.denyAddedSha256.length) {
+    refused.push(`${SETTINGS_REL}: a deny rule the install record names but Halfcycle never adds (it was kept)`);
+  }
+  const hooks = value["hooks"];
+  if (isPlainObject2(hooks)) {
+    let emptiedAnEvent = false;
+    for (const event of Object.keys(hooks)) {
+      const entries = hooks[event];
+      if (!Array.isArray(entries))
+        continue;
+      let touched = false;
+      const next = [];
+      for (const entry of entries) {
+        const wellFormed = isPlainObject2(entry) && Array.isArray(entry["hooks"]) && entry["hooks"].every(isPlainObject2);
+        if (!wellFormed || !isHalfcycleEntry(entry, commands)) {
+          next.push(entry);
+          continue;
+        }
+        touched = true;
+        const remaining = entry["hooks"].filter((h) => !(typeof h["command"] === "string" && commands.has(h["command"])));
+        if (remaining.length > 0)
+          next.push({ ...entry, hooks: remaining });
+      }
+      if (touched)
+        changed = true;
+      if (next.length === 0 && (rec.eventsCreated.includes(event) || rec.adopted && touched)) {
+        delete hooks[event];
+        changed = true;
+        emptiedAnEvent = true;
+      } else if (touched) {
+        hooks[event] = next;
+      }
+    }
+    if (Object.keys(hooks).length === 0 && (rec.hooksCreated || rec.adopted && emptiedAnEvent)) {
+      delete value["hooks"];
+      changed = true;
+    }
+  }
+  const permissions = value["permissions"];
+  if (isPlainObject2(permissions) && Array.isArray(permissions["deny"])) {
+    const deny = permissions["deny"];
+    for (const hash of denyHashes) {
+      for (let i = deny.length - 1; i >= 0; i--) {
+        const rule = deny[i];
+        if (typeof rule === "string" && sha256Hex(rule) === hash) {
+          deny.splice(i, 1);
+          changed = true;
+          break;
+        }
+      }
+    }
+    if (deny.length === 0 && rec.denyCreated) {
+      delete permissions["deny"];
+      changed = true;
+    }
+    if (Object.keys(permissions).length === 0 && rec.permissionsCreated) {
+      delete value["permissions"];
+      changed = true;
+    }
+  }
+  if ("schemaBefore" in rec) {
+    if (rec.schemaBefore === null) {
+      if ("$schema" in value) {
+        delete value["$schema"];
+        changed = true;
+      }
+    } else if (value["$schema"] !== rec.schemaBefore) {
+      value["$schema"] = rec.schemaBefore;
+      changed = true;
+    }
+  }
+  return { changed, refused };
+}
+function unmergeMcp(value, rec) {
+  const servers = value["mcpServers"];
+  if (!isPlainObject2(servers))
+    return { changed: false, keptEntry: false };
+  let changed = false;
+  let keptEntry = false;
+  let removedEntry = false;
+  if (MCP_SERVER_KEY in servers) {
+    if (rec.entrySha256 !== void 0 && canonicalSha256(servers[MCP_SERVER_KEY]) === rec.entrySha256) {
+      delete servers[MCP_SERVER_KEY];
+      changed = true;
+      removedEntry = true;
+    } else {
+      keptEntry = true;
+    }
+  }
+  if (Object.keys(servers).length === 0 && (rec.mcpServersCreated || rec.adopted && removedEntry)) {
+    delete value["mcpServers"];
+    changed = true;
+  }
+  return { changed, keptEntry };
+}
+function trimGitignore(targetRepo, text, rec, writeSet) {
+  const keptLines = [];
+  const foreignLines = [];
+  let current = text;
+  for (const block of [...rec.appended].reverse()) {
+    const lines = block.split("\n").filter((line) => line !== "");
+    const foreign = lines.filter((line) => !writeSet.gitignoreLines.has(line));
+    foreignLines.push(...foreign);
+    const ours = lines.filter((line) => writeSet.gitignoreLines.has(line));
+    const entries = ours.filter((line) => line !== GITIGNORE_HEADER);
+    const kept = entries.filter((line) => coveredPathExists(targetRepo, line));
+    keptLines.push(...kept);
+    if (kept.length === 0 && foreign.length === 0 && current.includes(block)) {
+      const at = current.lastIndexOf(block);
+      current = current.slice(0, at) + current.slice(at + block.length);
+      continue;
+    }
+    const separated = block.startsWith("\n") || block.includes("\n\n");
+    const removable = ours.filter((line) => line === GITIGNORE_HEADER ? kept.length === 0 && foreign.length === 0 : !kept.includes(line));
+    for (const line of removable) {
+      const fileLines = current.split("\n");
+      const at = fileLines.lastIndexOf(line);
+      if (at < 0)
+        continue;
+      const withSeparator = line === GITIGNORE_HEADER && separated && at > 0 && fileLines[at - 1] === "";
+      fileLines.splice(withSeparator ? at - 1 : at, withSeparator ? 2 : 1);
+      current = fileLines.join("\n");
+    }
+  }
+  return { text: current, keptLines, foreignLines };
+}
+function coveredPathExists(targetRepo, line) {
+  const path = line.trim().replace(/^\//, "").replace(/\/$/, "");
+  return path !== "" && lexists(join10(targetRepo, path));
+}
+function uninstall(options) {
+  const result = {
+    removed: [],
+    restored: [],
+    kept: [],
+    keptIgnoreLines: [],
+    leftAlone: [],
+    failed: []
+  };
+  const nothingToSay = { kind: "nothing-to-say" };
+  let checked;
+  try {
+    checked = validate(options);
+  } catch (err) {
+    if (err instanceof Refusal) {
+      return { outcome: "refused", exitCode: 1, refusal: err.message, ...result, credential: nothingToSay };
+    }
+    throw err;
+  }
+  if (checked === "not-installed") {
+    return { outcome: "not-installed", exitCode: 0, ...result, credential: nothingToSay };
+  }
+  const { targetRepo, home } = options;
+  const { manifest } = checked;
+  const writeSet = closedWriteSet();
+  const named = /* @__PURE__ */ new Set();
+  const name = (list, text, path) => {
+    list.push(text);
+    if (path !== void 0)
+      named.add(path);
+  };
+  applyMergedJson(targetRepo, SETTINGS_REL, checked.settings, result, name, (value) => {
+    const { changed, refused } = unmergeSettings(value, manifest.settings, writeSet);
+    for (const note of refused)
+      name(result.leftAlone, note);
+    return { changed, created: manifest.settings.created, adopted: manifest.settings.adopted, keptNote: void 0 };
+  });
+  const mcpRecord = manifest.mcp;
+  if (mcpRecord !== void 0) {
+    applyMergedJson(targetRepo, MCP_REGISTRATION_REL, checked.mcp, result, name, (value) => {
+      const { changed, keptEntry } = unmergeMcp(value, mcpRecord);
+      return {
+        changed,
+        created: mcpRecord.created,
+        adopted: mcpRecord.adopted,
+        keptNote: keptEntry ? `${MCP_REGISTRATION_REL} (its "${MCP_SERVER_KEY}" server entry)` : void 0
+      };
+    });
+  }
+  const deferred = /* @__PURE__ */ new Set([BUNDLE_PIN_REL, INSTALL_MANIFEST_REL]);
+  for (const entry of manifest.files) {
+    if (deferred.has(entry.path))
+      continue;
+    removeRecordedFile(targetRepo, entry, writeSet, result, name);
+  }
+  for (const path of manifest.leftAlone) {
+    if (lexists(join10(targetRepo, path)))
+      name(result.leftAlone, path, path);
+  }
+  switch (removeLegacyCiStanza(targetRepo)) {
+    case "removed":
+      name(result.removed, ".halfcycle/ci-stanza.yml", ".halfcycle/ci-stanza.yml");
+      break;
+    case "kept-foreign":
+      name(result.leftAlone, ".halfcycle/ci-stanza.yml", ".halfcycle/ci-stanza.yml");
+      break;
+    case "kept-uncommitted":
+      name(result.kept, ".halfcycle/ci-stanza.yml", ".halfcycle/ci-stanza.yml");
+      break;
+    case "failed":
+      name(result.failed, ".halfcycle/ci-stanza.yml", ".halfcycle/ci-stanza.yml");
+      break;
+    case "absent":
+      break;
+  }
+  const createdDirs = [.../* @__PURE__ */ new Set([...manifest.createdDirs, ...writeSet.ownedDirs])].sort((a, b) => b.split("/").length - a.split("/").length || (a < b ? 1 : a > b ? -1 : 0));
+  for (const dir of createdDirs) {
+    if (dir === ".halfcycle")
+      continue;
+    removeEmptyCreatedDir(targetRepo, dir, writeSet, result, name);
+  }
+  trimGitignoreFile(targetRepo, manifest.gitignore, writeSet, result, name);
+  const credential = handleCredential(options, checked);
+  const credentialFailed = credential.kind === "failed";
+  if (result.failed.length === 0 && !credentialFailed) {
+    const pinEntry = manifest.files.find((f) => f.path === BUNDLE_PIN_REL);
+    if (pinEntry !== void 0)
+      removeRecordedFile(targetRepo, pinEntry, writeSet, result, name);
+    else if (lexists(join10(targetRepo, BUNDLE_PIN_REL)))
+      name(result.leftAlone, BUNDLE_PIN_REL, BUNDLE_PIN_REL);
+    try {
+      rmSync2(join10(targetRepo, INSTALL_MANIFEST_REL), { force: true });
+      named.add(INSTALL_MANIFEST_REL);
+    } catch {
+      name(result.failed, INSTALL_MANIFEST_REL, INSTALL_MANIFEST_REL);
+    }
+    if (manifest.createdDirs.includes(".halfcycle") || writeSet.ownedDirs.has(".halfcycle")) {
+      removeEmptyCreatedDir(targetRepo, ".halfcycle", writeSet, result, name);
+    }
+  } else {
+    named.add(BUNDLE_PIN_REL);
+    named.add(INSTALL_MANIFEST_REL);
+  }
+  for (const path of filesUnder(targetRepo, ".halfcycle")) {
+    if (!named.has(path))
+      name(result.leftAlone, path, path);
+  }
+  const exitCode = result.failed.length > 0 || credentialFailed || credential.kind === "no-project-id" ? 1 : 0;
+  return { outcome: "uninstalled", exitCode, ...result, credential };
+}
+function applyMergedJson(targetRepo, rel, file, lists, name, edit) {
+  if (file.state === "absent")
+    return;
+  if (file.state === "symlink") {
+    name(lists.leftAlone, `${rel} (a symbolic link, or inside one \u2014 not followed)`, rel);
+    return;
+  }
+  const value = file.value;
+  const { changed, created, adopted, keptNote } = edit(value);
+  if (keptNote !== void 0)
+    name(lists.kept, keptNote, rel);
+  const path = join10(targetRepo, rel);
+  const empty = Object.keys(value).length === 0;
+  try {
+    if (empty && created && !adopted) {
+      rmSync2(path);
+      name(lists.removed, rel, rel);
+    } else if (changed) {
+      writeFileSync7(path, serializeJson(value), "utf-8");
+      name(lists.restored, rel, rel);
+    }
+    if (adopted && lexists(path)) {
+      name(lists.leftAlone, `${rel} (an older Halfcycle version changed it before keeping a record, so some of what it added may still be there \u2014 it cannot be told apart from your own)`, rel);
+    }
+  } catch {
+    name(lists.failed, rel, rel);
+  }
+}
+function removeRecordedFile(targetRepo, entry, writeSet, lists, name) {
+  const { path } = entry;
+  if (!writeSet.files.has(path)) {
+    name(lists.leftAlone, `${path} (Halfcycle never writes this path, so it was not removed)`, path);
+    return;
+  }
+  if (symlinkOnPath(targetRepo, path)) {
+    name(lists.leftAlone, `${path} (a symbolic link, or inside one \u2014 not followed)`, path);
+    return;
+  }
+  const abs = join10(targetRepo, path);
+  let isFile;
+  try {
+    isFile = lstatSync(abs).isFile();
+  } catch {
+    return;
+  }
+  if (!isFile) {
+    name(lists.leftAlone, `${path} (not a file)`, path);
+    return;
+  }
+  if ("sha256" in entry) {
+    let bytes;
+    try {
+      bytes = readFileSync8(abs);
+    } catch {
+      name(lists.failed, path, path);
+      return;
+    }
+    if (sha256Hex(bytes) !== entry.sha256) {
+      name(lists.kept, path, path);
+      return;
+    }
+  }
+  try {
+    rmSync2(abs);
+    name(lists.removed, path, path);
+  } catch {
+    name(lists.failed, path, path);
+  }
+}
+function removeEmptyCreatedDir(targetRepo, dir, writeSet, lists, name) {
+  if (!writeSet.dirs.has(dir) || symlinkOnPath(targetRepo, dir))
+    return;
+  const abs = join10(targetRepo, dir);
+  try {
+    if (!lstatSync(abs).isDirectory() || readdirSync(abs).length > 0)
+      return;
+  } catch {
+    return;
+  }
+  try {
+    rmdirSync(abs);
+  } catch {
+    name(lists.failed, `${dir}/`, dir);
+  }
+}
+function trimGitignoreFile(targetRepo, rec, writeSet, lists, name) {
+  if (rec.appended.length === 0)
+    return;
+  if (symlinkOnPath(targetRepo, GITIGNORE_REL)) {
+    name(lists.leftAlone, `${GITIGNORE_REL} (a symbolic link \u2014 not followed)`, GITIGNORE_REL);
+    return;
+  }
+  const path = join10(targetRepo, GITIGNORE_REL);
+  let before;
+  try {
+    before = readFileSync8(path, "utf-8");
+  } catch {
+    return;
+  }
+  const { text, keptLines, foreignLines } = trimGitignore(targetRepo, before, rec, writeSet);
+  for (const line of foreignLines) {
+    name(lists.leftAlone, `${GITIGNORE_REL}: the line ${JSON.stringify(line)} (Halfcycle never writes it, so it was kept)`);
+  }
+  for (const line of keptLines) {
+    lists.keptIgnoreLines.push(`${line.trim()} \u2014 ${line.trim().replace(/^\//, "")} still exists`);
+  }
+  if (text === before)
+    return;
+  try {
+    if (text === "" && rec.created) {
+      rmSync2(path);
+      name(lists.removed, GITIGNORE_REL, GITIGNORE_REL);
+    } else {
+      writeFileSync7(path, text, "utf-8");
+      name(lists.restored, GITIGNORE_REL, GITIGNORE_REL);
+    }
+  } catch {
+    name(lists.failed, GITIGNORE_REL, GITIGNORE_REL);
+  }
+}
+function handleCredential(options, checked) {
+  const { removeCredential, home } = options;
+  const { engagementId, idValid } = checked;
+  if (!removeCredential) {
+    if (engagementId === void 0)
+      return { kind: "nothing-to-say" };
+    if (!idValid)
+      return { kind: "invalid-id" };
+    const dir2 = engagementStateDir(engagementId, home);
+    return lexists(dir2) ? { kind: "still-held", dir: dir2 } : { kind: "nothing-to-say" };
+  }
+  if (engagementId === void 0)
+    return { kind: "no-project-id" };
+  const dir = engagementStateDir(engagementId, home);
+  if (!lexists(dir))
+    return { kind: "not-held", dir };
+  try {
+    if (lstatSync(dir).isSymbolicLink())
+      return { kind: "failed", dir, reason: "it is a symbolic link" };
+    rmSync2(engagementEnvPath(engagementId, home), { force: true });
+    rmSync2(notThisAccountMarkerPath(engagementId, home), { force: true });
+    if (readdirSync(dir).length === 0)
+      rmdirSync(dir);
+  } catch (err) {
+    return { kind: "failed", dir, reason: err instanceof Error ? err.message : String(err) };
+  }
+  return { kind: "removed", dir };
+}
+function filesUnder(root, rel) {
+  const out = [];
+  const walk = (dirRel) => {
+    let names;
+    try {
+      if (!lstatSync(join10(root, dirRel)).isDirectory())
+        return;
+      names = readdirSync(join10(root, dirRel));
+    } catch {
+      return;
+    }
+    for (const entry of names.sort()) {
+      const childRel = `${dirRel}/${entry}`;
+      try {
+        if (lstatSync(join10(root, childRel)).isDirectory())
+          walk(childRel);
+        else
+          out.push(childRel);
+      } catch {
+        continue;
+      }
+    }
+  };
+  walk(rel);
+  return out;
+}
+function shownPath(path, home) {
+  const base = home ?? homedir2();
+  const rel = relative3(base, path);
+  const under = rel !== "" && !rel.startsWith("..") && !rel.startsWith(sep);
+  return `${under ? `~/${rel.split(sep).join("/")}` : path}/`;
+}
+function renderUninstallReport(result, home) {
+  if (result.outcome === "refused") {
+    return { stdout: "", stderr: `halfcycle uninstall: ${result.refusal ?? "refused."}
+` };
+  }
+  if (result.outcome === "not-installed") {
+    return { stdout: "[halfcycle] Halfcycle is not installed in this directory, so there is nothing to remove.\n", stderr: "" };
+  }
+  const out = [];
+  const section = (title, items) => {
+    if (items.length === 0)
+      return;
+    out.push(`[halfcycle] ${title}`);
+    for (const item of items)
+      out.push(`  ${item}`);
+  };
+  section("Removed from this project:", result.removed);
+  section("Restored \u2014 only Halfcycle's entries were taken out:", result.restored);
+  section("Kept, because it changed after Halfcycle wrote it \u2014 delete it yourself if you do not want it:", result.kept);
+  section('Kept in .gitignore, because the path each line covers still exists \u2014 without the line, "git add ." would commit it:', result.keptIgnoreLines);
+  section("Left alone \u2014 Halfcycle did not write these, or cannot tell that it did:", result.leftAlone);
+  section('Could not remove \u2014 fix the cause, then run "npx halfcycle uninstall" again to finish:', result.failed);
+  const c = result.credential;
+  switch (c.kind) {
+    case "still-held":
+      out.push(`[halfcycle] This machine still holds this project's credential, at ${shownPath(c.dir, home)}.`);
+      out.push("  Every checkout and worktree of this project on this machine uses it.");
+      out.push(`  To remove it too:  npx halfcycle uninstall ${REMOVE_CREDENTIAL_FLAG}`);
+      break;
+    case "invalid-id":
+      out.push(`[halfcycle] This machine may still hold a credential for this project, but the project id in ${BUNDLE_PIN_REL} is not valid, so it is not shown as a path.`);
+      break;
+    case "removed":
+      out.push(`[halfcycle] Removed this machine's credential for this project, at ${shownPath(c.dir, home)}.`);
+      out.push("  Every other checkout and worktree of this project on this machine used it too. Each stops reaching");
+      out.push("  Halfcycle until `npx halfcycle` is run there again.");
+      break;
+    case "not-held":
+      out.push(`[halfcycle] This machine holds no credential for this project (nothing at ${shownPath(c.dir, home)}).`);
+      break;
+    case "no-project-id":
+      out.push(`[halfcycle] No credential was removed: ${BUNDLE_PIN_REL} is missing, so there is no project id to find it by.`);
+      break;
+    case "failed":
+      out.push(`[halfcycle] Could not remove this machine's credential for this project, at ${shownPath(c.dir, home)}: ${c.reason}. Run "npx halfcycle uninstall ${REMOVE_CREDENTIAL_FLAG}" again to finish.`);
+      break;
+    case "nothing-to-say":
+      break;
+  }
+  out.push("[halfcycle] Your project on Halfcycle is unchanged. Restart any Claude Code session open in this project.");
+  return { stdout: out.join("\n") + "\n", stderr: "" };
+}
+
 // dist/banner-facts.js
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { readFileSync as readFileSync8 } from "node:fs";
-import { basename as basename3, join as join10, resolve as resolve3 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { basename as basename3, join as join11, resolve as resolve3 } from "node:path";
 var BRAND_URL = "halfcycle.ai";
 var TAGLINE = [
   "Fewer cycles.",
@@ -4346,7 +5368,7 @@ var TAGLINE_NARROW = [
 ];
 function bundleVersion() {
   try {
-    const pkg = JSON.parse(readFileSync8(join10(BUNDLE_ROOT, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(join11(BUNDLE_ROOT, "package.json"), "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -4354,7 +5376,7 @@ function bundleVersion() {
 }
 function claudeCodeVersion() {
   try {
-    const raw = execFileSync3("claude", ["--version"], {
+    const raw = execFileSync4("claude", ["--version"], {
       encoding: "utf-8",
       timeout: 3e3,
       stdio: ["ignore", "pipe", "ignore"]
@@ -4466,7 +5488,7 @@ function compareVersions(a, b) {
 function reportClaudeCodeVersion(verbose2) {
   let raw;
   try {
-    raw = execFileSync4("claude", ["--version"], {
+    raw = execFileSync5("claude", ["--version"], {
       encoding: "utf-8",
       timeout: 5e3,
       stdio: ["ignore", "pipe", "ignore"]
@@ -4498,23 +5520,36 @@ var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|cli
   halfcycle build-record <phase> [--repo <root>]
   halfcycle open-phase <phase|--none> --actor "\u2026" (--evidence "\u2026" | --override --reason "\u2026") [--repo <root>]
   halfcycle close-phase <phase> --verdict <clean|defects> --actor "\u2026" [--finding "\u2026"]\u2026 [--override --reason "\u2026"] [--repo <root>]
-  halfcycle ci bind <owner>/<repo> [--repo <root>]
-  halfcycle ci unbind <owner>/<repo> [--repo <root>]
+  halfcycle uninstall [${REMOVE_CREDENTIAL_FLAG}]
+         take out what the installer added to this project, keeping anything you changed
+         ${REMOVE_CREDENTIAL_FLAG}: also remove this machine's credential for the project, which every
+         checkout and worktree of that project on this machine shares
 
   --quiet / -q: print no opening banner (any command)
   --verbose / -v: print full run detail (paths written, merged, skipped) on install
+
+  Support: hello@halfcycle.ai
 `;
 function isHalfcycleMonorepo(dir) {
   try {
-    const pkg = JSON.parse(readFileSync9(join11(dir, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync10(join12(dir, "package.json"), "utf-8"));
     return pkg.name === "halfcycle-monorepo";
   } catch {
     return false;
   }
 }
+var RETIRED_VERBS = /* @__PURE__ */ new Map([
+  ["ci", '"ci" was removed \u2014 CI setup is part of your project, not Halfcycle']
+]);
 async function main() {
   const [cmd, ...rest] = args;
-  const bareTarget = cmd !== void 0 && !cmd.startsWith("-") && !/^(check-drift|build-record|open-phase|close-phase|ci)$/.test(cmd);
+  if (cmd !== void 0 && RETIRED_VERBS.has(cmd)) {
+    process.stderr.write(`halfcycle: ${RETIRED_VERBS.get(cmd)}
+`);
+    process.exit(2);
+    return;
+  }
+  const bareTarget = cmd !== void 0 && !cmd.startsWith("-") && !CLI_VERBS.includes(cmd);
   const installArm = cmd === "install" || cmd === void 0 || bareTarget;
   const positionals = cmd === "install" ? rest : args;
   const targetRepo = installArm ? positionals[0] ?? process.cwd() : process.cwd();
@@ -4530,6 +5565,12 @@ ${USAGE}`);
   if (installArm) {
     const engagementIdArg = positionals[1];
     const engagementTypeRaw = positionals[2] ?? "client";
+    if (!existsSync5(targetRepo) || !statSync(targetRepo).isDirectory()) {
+      process.stderr.write(`halfcycle: no such directory: ${targetRepo}
+`);
+      process.exit(1);
+      return;
+    }
     if (isHalfcycleMonorepo(targetRepo)) {
       process.stderr.write(`halfcycle: refusing to install into the Halfcycle monorepo itself (${targetRepo}).
   The bare form installs into the CURRENT directory, and this directory is the
@@ -4553,6 +5594,8 @@ ${USAGE}`);
         process.stdout.write(`[halfcycle] Halfcycle service: ${controlOriginNote(controlOrigin)}
 `);
       }
+      if (engagementIdArg !== void 0)
+        assertEngagementId(engagementIdArg);
       const pinned = readPinnedEngagement(targetRepo);
       const requestedId = engagementIdArg ?? pinned?.engagementId;
       const held = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
@@ -4716,8 +5759,6 @@ ${USAGE}`);
         process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
         process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
-`);
-        process.stdout.write(`[halfcycle] To check changes in CI too: run \`npx halfcycle ci bind <owner>/<repo>\` in this folder once, then copy the workflow in .halfcycle/ci-stanza.yml into .github/workflows/ (or just its job into a workflow you have) \u2014 there is no secret to store.
 `);
       }
       if (credential) {
@@ -4740,6 +5781,29 @@ ${USAGE}`);
         return;
       }
       process.stderr.write(`halfcycle install failed: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+    return;
+  }
+  if (cmd === "uninstall") {
+    const parsed = parseUninstallArgs(rest);
+    if ("error" in parsed) {
+      process.stderr.write(`halfcycle uninstall: ${parsed.error}
+
+Usage:
+${USAGE}`);
+      process.exit(2);
+      return;
+    }
+    try {
+      const result = uninstall({ targetRepo: process.cwd(), removeCredential: parsed.removeCredential });
+      const { stdout, stderr } = renderUninstallReport(result);
+      process.stdout.write(stdout);
+      process.stderr.write(stderr);
+      process.exit(result.exitCode);
+    } catch (err) {
+      process.stderr.write(`halfcycle uninstall failed: ${err instanceof Error ? err.message : String(err)}
 `);
       process.exit(1);
     }
@@ -4782,12 +5846,12 @@ ${USAGE}`);
     const phaseId = phaseArg;
     try {
       assertValidPhaseIdentity(phaseId, BUILD_RECORD_DIR);
-      const inputPath = join11(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phaseId)}.input.json`);
-      const input = JSON.parse(readFileSync9(inputPath, "utf-8"));
+      const inputPath = join12(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phaseId)}.input.json`);
+      const input = JSON.parse(readFileSync10(inputPath, "utf-8"));
       const result = assemblePhaseBuildRecord({
         repoRoot,
-        phasesDir: join11(repoRoot, "docs", "phases"),
-        guardEvalLogDir: input.guardEvalLogDir ?? join11(repoRoot, ".workbench", "guard-eval-log"),
+        phasesDir: join12(repoRoot, "docs", "phases"),
+        guardEvalLogDir: input.guardEvalLogDir ?? join12(repoRoot, ".workbench", "guard-eval-log"),
         phaseId,
         narrated: input.narrated,
         touchedInvariants: input.touchedInvariants
@@ -4976,69 +6040,6 @@ halfcycle close-phase: until ${closed.stampFailure.path} can be written, guard e
         return;
       }
       process.stderr.write(`halfcycle close-phase failed: ${err instanceof Error ? err.message : String(err)}
-`);
-      process.exit(1);
-    }
-    return;
-  }
-  if (cmd === "ci") {
-    const repoRoot = flagValue(rest, "--repo") ?? process.cwd();
-    const positionals2 = rest.filter((token, i) => !token.startsWith("--") && !(i > 0 && rest[i - 1] === "--repo"));
-    const action = positionals2[0];
-    const repositoryArg = positionals2[1];
-    if (action !== "bind" && action !== "unbind") {
-      process.stderr.write("halfcycle ci: name bind or unbind.\n  halfcycle ci bind <owner>/<repo> [--repo <root>]\n  halfcycle ci unbind <owner>/<repo> [--repo <root>]\n");
-      process.exit(2);
-      return;
-    }
-    if (repositoryArg === void 0) {
-      process.stderr.write(`halfcycle ci ${action}: name the repository, as owner/repo.
-`);
-      process.exit(2);
-      return;
-    }
-    const repository = parseCiRepositoryArg(repositoryArg);
-    if (repository === null) {
-      process.stderr.write(`halfcycle ci ${action}: "${repositoryArg}" is not a repository \u2014 give it as owner/repo, exactly as GitHub spells it, for example acme/widgets.
-`);
-      process.exit(2);
-      return;
-    }
-    const pin = readBundlePin(repoRoot);
-    if (pin === null || pin.engagementId === "") {
-      process.stderr.write(`halfcycle ci ${action}: ${join11(repoRoot, ".halfcycle", "bundle.json")} names no Halfcycle engagement. Run \`npx halfcycle\` here first.
-`);
-      process.exit(1);
-      return;
-    }
-    try {
-      const controlOrigin = resolveControlOrigin(process.env);
-      const label = `${repository.owner}/${repository.repo}`;
-      if (action === "bind") {
-        await bindCiRepository(controlOrigin.origin, pin.engagementId, repository);
-        process.stdout.write(`[halfcycle] ${label} now trusts this engagement's CI \u2014 a workflow there granting both \`contents: read\` and \`id-token: write\` can authenticate with no stored secret. Both lines: declaring any permission replaces the defaults, so naming only the identity token stops a private repository checking out.
-`);
-      } else {
-        await unbindCiRepository(controlOrigin.origin, pin.engagementId, repository);
-        process.stdout.write(`[halfcycle] ${label} no longer trusts this engagement's CI.
-`);
-      }
-      process.exit(0);
-    } catch (err) {
-      if (err instanceof SignInRefused) {
-        process.stderr.write(`halfcycle ci ${action}: ${err.message}
-`);
-        process.exit(1);
-        return;
-      }
-      if (err instanceof CiBindRefused) {
-        const label = err.unavailable ? `temporarily unavailable (${err.status})` : `refused (${err.status})`;
-        process.stderr.write(`halfcycle ci ${action}: ${label}. ${err.message}
-`);
-        process.exit(1);
-        return;
-      }
-      process.stderr.write(`halfcycle ci ${action} failed: ${err instanceof Error ? err.message : String(err)}
 `);
       process.exit(1);
     }
@@ -5072,6 +6073,7 @@ function firstPositional(argv) {
 }
 main().catch((err) => {
   process.stderr.write(`halfcycle: unexpected error: ${err instanceof Error ? err.message : String(err)}
+Contact hello@halfcycle.ai if this keeps happening.
 `);
   process.exit(1);
 });