halfcycle 0.3.35 → 0.3.36

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.35",
+  "version": "0.3.36",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/README.md

@@ -167,6 +167,11 @@ Nothing you already had is changed. Existing settings are preserved, and a name
 - Claude Code **2.1.118+**
 - Node 20+
 - A git repository
+- On Windows, if you use PowerShell: let it run the scripts Node installs, once per user. Otherwise PowerShell refuses `npx` with *running scripts is disabled on this system*:
+
+  ```powershell
+  Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
+  ```
 
 ## Getting started
 
@@ -176,6 +181,14 @@ git init
 npx halfcycle
 ```
 
+In Windows PowerShell, separate the first two commands with `;` instead of `&&`:
+
+```powershell
+mkdir my-project; cd my-project
+git init
+npx halfcycle
+```
+
 Then open the folder in Claude Code and run `/halfcycle-setup`, and answer the questions it asks about your project.
 
 **Accept the workspace trust prompt when Claude Code shows it.** The install writes a credential helper and a set of hooks that are shell commands, so Claude Code asks before it runs them. It is expected, and it appears once.

package/bin/bin.bundle.mjs

@@ -14548,7 +14548,10 @@ var matcherSchema = external_exports.discriminatedUnion("kind", [
 var HALFCYCLE_DIR_NAME = ".halfcycle";
 var ENGAGEMENTS_DIR_NAME = "engagements";
 var ENGAGEMENT_ENV_FILENAME = "env";
+var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
 var ACCOUNT_STORE_FILENAME = "account.json";
+var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
+var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
 var ENGAGEMENT_ID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
 var ENGAGEMENT_ID_SHAPE = new RegExp(ENGAGEMENT_ID_PATTERN);
 function isEngagementId(value) {
@@ -14761,10 +14764,10 @@ var EXCERPT_DEFAULTS = {
   maxExcerptsPerFile: 5,
   maxExcerptsPerChangeSet: 20
 };
-function readConfig() {
-  const guardServiceUrl = readGuardOrigin().origin;
-  const guardServiceToken = process.env["GUARD_SERVICE_TOKEN"];
-  const guardEngagementId = process.env["GUARD_ENGAGEMENT_ID"];
+function readConfig(env = process.env) {
+  const guardServiceUrl = readGuardOrigin(env).origin;
+  const guardServiceToken = env["GUARD_SERVICE_TOKEN"];
+  const guardEngagementId = env["GUARD_ENGAGEMENT_ID"];
   const missing = [];
   if (!guardServiceToken)
     missing.push("GUARD_SERVICE_TOKEN");
@@ -14786,8 +14789,8 @@ function readNeverConfiguredReason() {
 function isHalfcycleOwnCi() {
   return process.env["HALFCYCLE_INTERNAL_CI"] === "1";
 }
-function readGuardOrigin() {
-  return resolveGuardOrigin(process.env);
+function readGuardOrigin(env = process.env) {
+  return resolveGuardOrigin(env);
 }
 function readActionsOidcEnv() {
   const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"]?.trim();
@@ -14796,11 +14799,19 @@ function readActionsOidcEnv() {
     return void 0;
   return { requestUrl, requestToken };
 }
-function readControlOrigin() {
-  return resolveControlOrigin(process.env);
+function readControlOrigin(env = process.env) {
+  return resolveControlOrigin(env);
 }
-function readEnvFilePath() {
-  const raw = process.env["HALFCYCLE_ENV_FILE"]?.trim();
+function readEnvFilePath(env = process.env) {
+  const raw = env["HALFCYCLE_ENV_FILE"]?.trim();
+  return raw ? raw : void 0;
+}
+function readEnvironmentToken() {
+  const raw = process.env["HALFCYCLE_TOKEN"];
+  return raw?.trim() ? raw : void 0;
+}
+function readMcpServerUrl() {
+  const raw = process.env["CLAUDE_CODE_MCP_SERVER_URL"];
   return raw ? raw : void 0;
 }
 function readExcerptConfig() {
@@ -15281,6 +15292,9 @@ var ciTokenExchangeResponseSchema = external_exports.object({
   expiresAt: utcIso8601,
   engagementId: external_exports.string()
 }).strict();
+var NO_CREDENTIAL_PLACEHOLDER = "halfcycle:no-credential";
+var NOT_THIS_ACCOUNT_PLACEHOLDER = "halfcycle:not-this-account";
+var UPDATE_CLAUDE_CODE_PLACEHOLDER = "halfcycle:update-claude-code";
 
 // dist/hook-protocol.js
 import { writeSync } from "node:fs";
@@ -17186,7 +17200,7 @@ function cleanRunSummary(verdict, scope) {
 }
 
 // dist/credential-store.js
-import { chmodSync, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2, realpathSync } from "node:fs";
+import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2, realpathSync } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
 import { dirname as dirname3, join as join5 } from "node:path";
 var REFRESHED_TOKEN_KEYS = ["HALFCYCLE_TOKEN", "GUARD_SERVICE_TOKEN"];
@@ -17194,6 +17208,9 @@ var TOKEN_READ_KEY = "GUARD_SERVICE_TOKEN";
 function composeEngagementEnvPath(engagementId, home) {
   return join5(home ?? homedir2(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, ENGAGEMENT_ENV_FILENAME);
 }
+function hasNotThisAccountMarker(engagementId, home) {
+  return existsSync2(join5(home ?? homedir2(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, NOT_THIS_ACCOUNT_MARKER_FILENAME));
+}
 function readAccountCredential(controlOrigin, home) {
   let raw;
   try {
@@ -17208,13 +17225,20 @@ function readAccountCredential(controlOrigin, home) {
   return entry.credential;
 }
 function readStoredEngagementToken(envFilePath) {
+  const values = readEngagementStore(envFilePath);
+  return values === void 0 ? void 0 : storedEngagementToken(values);
+}
+function readEngagementStore(envFilePath) {
   let raw;
   try {
     raw = readFileSync5(envFilePath, "utf-8");
   } catch {
     return void 0;
   }
-  const value = parseEnvText(raw)[TOKEN_READ_KEY];
+  return parseEnvText(raw);
+}
+function storedEngagementToken(values) {
+  const value = values[TOKEN_READ_KEY];
   return value && value.trim() !== "" ? value : void 0;
 }
 function writeRefreshedToken(opts) {
@@ -17325,14 +17349,14 @@ var UNREACHABLE_REMEDY = "The Halfcycle service could not be reached to renew th
 var UNREADABLE_REFUSAL_REMEDY = "The Halfcycle service declined to renew this credential and gave no reason this version could read.";
 var UNREADABLE_MINT_REMEDY = 'The Halfcycle service answered with a credential this version could not read. Update the installed Halfcycle runner: run "npx halfcycle" in this repository.';
 async function refreshEngagementCredential(opts) {
-  const envFilePath = readEnvFilePath();
+  const envFilePath = readEnvFilePath(opts.source);
   if (!envFilePath)
     return { ok: false, remedy: HOOK_REMEDY };
   const stored = readStoredEngagementToken(envFilePath);
   if (stored !== void 0 && stored !== opts.refusedToken) {
     return { ok: true, token: stored, source: "disk" };
   }
-  const controlOrigin = readControlOrigin().origin;
+  const controlOrigin = readControlOrigin(opts.source).origin;
   const accountCredential = readAccountCredential(controlOrigin, opts.home);
   if (!accountCredential)
     return { ok: false, remedy: HOOK_REMEDY };
@@ -17375,7 +17399,7 @@ async function evaluateWithRefresh(opts) {
 }
 
 // dist/seat-configuration.js
-import { existsSync as existsSync2, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join6, relative as relative3, resolve } from "node:path";
 function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
@@ -17484,7 +17508,7 @@ function readPathStates(projectDir, repoRoot) {
   const status = getWiringStatus(HALFCYCLE_HOOK_WIRING_PATHS, projectDir);
   if (!status.ok)
     return unknown2();
-  const mapped = mapWiringStatus(status.value, prefix, HALFCYCLE_HOOK_WIRING_PATHS, (rel) => existsSync2(join6(projectDir, rel)));
+  const mapped = mapWiringStatus(status.value, prefix, HALFCYCLE_HOOK_WIRING_PATHS, (rel) => existsSync3(join6(projectDir, rel)));
   return mapped ?? unknown2();
 }
 function mapWiringStatus(output, prefix, paths, onDisk) {
@@ -17656,17 +17680,17 @@ ${guardLines}${notRunBlock}`);
   }
 }
 function readStdin() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
 
 // dist/hooks/marker.js
 import { createHash } from "node:crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join7 } from "node:path";
 var MARKER_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -17695,7 +17719,7 @@ function dedupePath(repoRoot, sessionId) {
 }
 function readMarker(repoRoot, sessionId) {
   const path = markerPath(repoRoot, sessionId);
-  if (!existsSync3(path))
+  if (!existsSync4(path))
     return null;
   try {
     return readFileSync7(path, "utf-8").trim() || null;
@@ -17706,7 +17730,7 @@ function readMarker(repoRoot, sessionId) {
 function deleteMarker(repoRoot, sessionId) {
   for (const path of [markerPath(repoRoot, sessionId), dedupePath(repoRoot, sessionId)]) {
     try {
-      if (existsSync3(path))
+      if (existsSync4(path))
         unlinkSync3(path);
     } catch {
     }
@@ -17714,7 +17738,7 @@ function deleteMarker(repoRoot, sessionId) {
 }
 function readDedupe(repoRoot, sessionId) {
   const path = dedupePath(repoRoot, sessionId);
-  if (!existsSync3(path))
+  if (!existsSync4(path))
     return null;
   try {
     const parsed = JSON.parse(readFileSync7(path, "utf-8"));
@@ -17968,9 +17992,9 @@ async function readHookStdin() {
   }
 }
 function readStdin2() {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     if (process.stdin.isTTY) {
-      resolve2("");
+      resolve3("");
       return;
     }
     const chunks = [];
@@ -17980,7 +18004,7 @@ function readStdin2() {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve2(Buffer.concat(chunks).toString("utf-8"));
+      resolve3(Buffer.concat(chunks).toString("utf-8"));
     };
     const timer = setTimeout(done, 2e3);
     process.stdin.on("data", (chunk) => chunks.push(chunk));
@@ -18002,14 +18026,14 @@ async function runStop() {
 }
 
 // dist/resolve-engagement.js
-import { existsSync as existsSync4, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
 import { join as join8, sep as sep2 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function defaultRegistryPath() {
   return join8(homedir4(), ".halfcycle", "registry.json");
 }
 function readRegistry(registryPath = defaultRegistryPath()) {
-  if (!existsSync4(registryPath))
+  if (!existsSync5(registryPath))
     return {};
   try {
     const parsed = JSON.parse(readFileSync8(registryPath, "utf-8"));
@@ -18061,39 +18085,240 @@ function runResolveEngagement(cwd, registryPath) {
 
 // dist/refresh-credential.js
 var UNAUTHORIZED2 = 401;
-async function runRefreshCredential(opts) {
+var LIVE_PROBE_STATUSES = /* @__PURE__ */ new Set([200, 403]);
+async function refreshCredentialToken(opts) {
+  const source = opts?.source;
   if (readNeverConfiguredReason() === "not-this-account")
-    return 0;
-  if (!readEnvFilePath())
-    return 0;
-  const configResult = readConfig();
+    return { token: void 0 };
+  if (!readEnvFilePath(source))
+    return { token: void 0 };
+  const configResult = readConfig(source);
   if (!configResult.config)
-    return 0;
+    return { token: void 0 };
   const { guardServiceToken, guardEngagementId } = configResult.config;
-  const controlOrigin = readControlOrigin().origin;
+  const controlOrigin = readControlOrigin(source).origin;
   const fetchFn = opts?.fetchFn ?? globalThis.fetch;
   const accountCredential = readAccountCredential(controlOrigin, opts?.home);
   if (accountCredential)
     await probeAccount(controlOrigin, accountCredential, fetchFn);
   const probe = await probeAccount(controlOrigin, guardServiceToken, fetchFn);
-  if (!probe.reached || probe.status !== UNAUTHORIZED2)
-    return 0;
+  if (!probe.reached)
+    return { token: void 0 };
+  if (probe.status !== UNAUTHORIZED2) {
+    return { token: LIVE_PROBE_STATUSES.has(probe.status) ? guardServiceToken : void 0 };
+  }
   const refreshed = await refreshEngagementCredential({
     engagementId: guardEngagementId,
     refusedToken: guardServiceToken,
     fetchFn,
-    home: opts?.home
+    home: opts?.home,
+    source
   });
   if (!refreshed.ok) {
     const write = opts?.write ?? ((text) => process.stdout.write(text));
     write(credentialRenewalFailedMessage(refreshed.remedy));
+    return { token: void 0 };
   }
+  return { token: refreshed.token };
+}
+async function runRefreshCredential(opts) {
+  await refreshCredentialToken(opts);
   return 0;
 }
 
+// dist/mcp-headers.js
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, resolve as resolve2 } from "node:path";
+function headerLine(bearer) {
+  return `${JSON.stringify({ Authorization: `Bearer ${bearer}` })}
+`;
+}
+function projectRootFromBinary(binaryPath) {
+  const depth = VENDORED_BIN_REL.split("/").length - 1;
+  return resolve2(dirname4(binaryPath), ...Array(depth).fill(".."));
+}
+function readPinnedId(root) {
+  let raw;
+  try {
+    raw = readFileSync9(resolve2(root, BUNDLE_PIN_REL), "utf-8");
+  } catch {
+    return { problem: "no-pin" };
+  }
+  let pin;
+  try {
+    pin = JSON.parse(raw);
+  } catch {
+    return { problem: "no-id" };
+  }
+  const id = typeof pin === "object" && pin !== null ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
+  return typeof id === "string" && id !== "" ? { id } : { problem: "no-id" };
+}
+function resolveStore(root, home) {
+  const pinned = readPinnedId(root);
+  if ("problem" in pinned)
+    return { ok: false, problem: pinned.problem };
+  if (!isEngagementId(pinned.id))
+    return { ok: false, problem: "bad-id" };
+  const notThisAccount = hasNotThisAccountMarker(pinned.id, home);
+  const path = composeEngagementEnvPath(pinned.id, home);
+  const values = readEngagementStore(path);
+  if (values === void 0) {
+    return { ok: false, problem: notThisAccount ? "not-this-account" : "no-credential", engagementId: pinned.id };
+  }
+  return { ok: true, path, values };
+}
+function urlOrigin(url2) {
+  if (/[\s\u0000-\u001f\u007f-\u009f]/u.test(url2))
+    return void 0;
+  const match = /^([A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#\\]*)/.exec(url2);
+  return match ? match[1].toLowerCase() : void 0;
+}
+function shownUrl(url2) {
+  return url2.replace(/[^\x21-\x7e]/g, "").slice(0, 200);
+}
+function sentences(lines) {
+  return lines.map((line) => `halfcycle: ${line}
+`).join("");
+}
+function badIdSentence(root) {
+  return sentences([
+    `${resolve2(root, BUNDLE_PIN_REL)} names an engagement id that is not a Halfcycle project id,`,
+    'so no credential was read. Delete that file and run "npx halfcycle" again: this repository',
+    "is then set up as a new Halfcycle project."
+  ]);
+}
+function storeProblemSentence(problem, root, home, engagementId) {
+  switch (problem) {
+    case "no-pin":
+      return sentences([
+        `no ${BUNDLE_PIN_REL} in ${root}, so this repository has no Halfcycle engagement.`,
+        'run "npx halfcycle" here to install one.'
+      ]);
+    case "no-id":
+      return sentences([
+        `${resolve2(root, BUNDLE_PIN_REL)} names no engagement id.`,
+        'run "npx halfcycle" here to rewrite it.'
+      ]);
+    case "bad-id":
+      return badIdSentence(root);
+    case "not-this-account":
+      return sentences([
+        "this project belongs to another Halfcycle account, so this machine has no",
+        "credential for it and the Halfcycle tools are not available here. Nothing is",
+        "broken \u2014 ask the project's owner for view access, or sign in as the account",
+        'that owns it and run "npx halfcycle" again.'
+      ]);
+    case "no-credential":
+      return sentences([
+        `this machine holds no credential for engagement ${engagementId ?? ""}.`,
+        `run "npx halfcycle" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve2(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
+      ]);
+  }
+}
+async function refreshWithinDeadline(source, opts, writeErr) {
+  let timer;
+  const deadline = new Promise((settle) => {
+    timer = setTimeout(() => settle(void 0), opts.deadlineMs ?? CONTROL_TIMEOUT_MS);
+  });
+  const refresh = refreshCredentialToken({
+    fetchFn: opts.fetchFn,
+    home: opts.home,
+    write: writeErr,
+    source
+  }).then((result) => result.token, () => void 0);
+  try {
+    return await Promise.race([refresh, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function decide(opts, writeErr) {
+  const home = opts.home ?? homedir5();
+  const root = projectRootFromBinary(opts.binaryPath);
+  const environmentToken = readEnvironmentToken();
+  const store = resolveStore(root, home);
+  let storedToken;
+  if (environmentToken === void 0) {
+    if (!store.ok) {
+      writeErr(storeProblemSentence(store.problem, root, home, store.engagementId));
+      return headerLine(store.problem === "not-this-account" ? NOT_THIS_ACCOUNT_PLACEHOLDER : NO_CREDENTIAL_PLACEHOLDER);
+    }
+    storedToken = storedEngagementToken(store.values);
+    if (storedToken === void 0) {
+      writeErr(sentences([
+        `GUARD_SERVICE_TOKEN is absent or empty in ${store.path}.`,
+        `run "npx halfcycle" in this repository to rewrite this machine's credential.`
+      ]));
+      return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+    }
+  }
+  const requested = readMcpServerUrl();
+  const recorded = store.ok ? store.values["HALFCYCLE_MCP_URL"] : void 0;
+  if (requested === void 0 && store.ok) {
+    writeErr(sentences([
+      "Claude Code did not say which server it is connecting to, so the Halfcycle credential was not sent.",
+      "update Claude Code, then reconnect."
+    ]));
+    return headerLine(UPDATE_CLAUDE_CODE_PLACEHOLDER);
+  }
+  if (!recorded) {
+    if (!store.ok && store.problem === "bad-id") {
+      writeErr(badIdSentence(root));
+    } else {
+      writeErr(sentences([
+        "this machine has no Halfcycle server address recorded for this repository, so the credential was not sent.",
+        'run "npx halfcycle" in this repository on this machine to record it.'
+      ]));
+    }
+    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+  }
+  const want = urlOrigin(recorded);
+  const got = requested === void 0 ? void 0 : urlOrigin(requested);
+  if (want === void 0 || got !== want) {
+    writeErr(sentences([
+      `.mcp.json asks for this repository's Halfcycle credential to be sent to ${shownUrl(requested ?? "")},`,
+      `which is not this machine's Halfcycle server (${want ?? "none recorded"}). The credential was NOT sent.`,
+      'if nobody meant to change .mcp.json, treat that change as suspect; "npx halfcycle" restores the entry.'
+    ]));
+    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+  }
+  if (environmentToken !== void 0)
+    return headerLine(environmentToken);
+  if (!store.ok || storedToken === void 0)
+    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+  const source = {
+    HALFCYCLE_ENV_FILE: store.path,
+    GUARD_SERVICE_TOKEN: storedToken,
+    GUARD_ENGAGEMENT_ID: store.values["GUARD_ENGAGEMENT_ID"],
+    HALFCYCLE_SERVICE_URL: store.values["HALFCYCLE_SERVICE_URL"]
+  };
+  const refreshed = await refreshWithinDeadline(source, opts, writeErr);
+  return headerLine(refreshed ?? storedToken);
+}
+async function mcpHeaders(opts) {
+  const writeErr = opts.writeErr ?? ((text) => void process.stderr.write(text));
+  try {
+    return await decide(opts, writeErr);
+  } catch (err) {
+    try {
+      writeErr(sentences([
+        `the credential could not be read: ${err instanceof Error ? err.message : String(err)}`,
+        `run "npx halfcycle" in this repository to rewrite this machine's credential.`
+      ]));
+    } catch {
+      return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+    }
+    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+  }
+}
+
+// dist/bin.js
+import { fileURLToPath } from "node:url";
+
 // dist/capture.js
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync5 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync6 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
   const raw = opts.input ?? readInputFile(opts.fromFile);
@@ -18128,7 +18353,7 @@ function runCapture(provider, endpoint, opts = {}) {
   const fixture = fixturePath(repoRoot, provider, slug);
   const manifestFile = manifestPath(repoRoot);
   try {
-    mkdirSync3(dirname4(fixture), { recursive: true });
+    mkdirSync3(dirname5(fixture), { recursive: true });
     writeFileSync4(fixture, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -18160,7 +18385,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync9(fromFile, "utf-8");
+    return readFileSync10(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -18184,6 +18409,11 @@ async function main() {
     process.exit(code);
     return;
   }
+  if (cmd === "mcp-headers") {
+    const line = await mcpHeaders({ binaryPath: fileURLToPath(import.meta.url) });
+    process.stdout.write(line, () => process.exit(0));
+    return;
+  }
   if (cmd === "resolve-engagement") {
     const cwd = sub ?? process.cwd();
     const code = runResolveEngagement(cwd);
@@ -18249,16 +18479,17 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
          halfcycle-runner hook stop
          halfcycle-runner hook subagent-stop
          halfcycle-runner refresh-credential
+         halfcycle-runner mcp-headers
          halfcycle-runner resolve-engagement <cwd>
          halfcycle-runner capture <provider> <endpoint> [--from <file>]
 `);
   process.exit(1);
 }
 function readStdin3() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }

package/dist/banner-facts.d.ts

@@ -18,6 +18,7 @@
  *
  * INV-001: Node builtins and modules inside this package only.
  */
+import { type ClaudeVersionProbeDeps } from './claude-version-probe.js';
 import { type BannerContent } from './banner.js';
 /**
  * The brand's front door.
@@ -50,9 +51,12 @@ export declare function bundleVersion(): string | undefined;
  * treating it as a problem would put a warning on a correct install. This is the second
  * place in the CLI that asks; they are deliberately separate calls because that one exists
  * to WARN about an old version and this one exists to state a fact, and collapsing them
- * would make the banner responsible for a compatibility check.
+ * would make the banner responsible for a compatibility check. Both go through
+ * `probeClaudeCodeVersion` (`claude-version-probe.ts`), which is what runs `claude.cmd`
+ * through `cmd.exe` on Windows; `deps` exists so a test can inject the platform and the exec
+ * call rather than depending on this actually running on Windows.
  */
-export declare function claudeCodeVersion(): string | undefined;
+export declare function claudeCodeVersion(deps?: ClaudeVersionProbeDeps): string | undefined;
 /** Everything the fact collector is allowed to reach outside itself, so a test can hand it
  *  a world instead of standing in one. */
 export interface FactProbes {

package/dist/banner-facts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"banner-facts.d.ts","sourceRoot":"","sources":["../src/banner-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,OAAO,EAAkB,KAAK,aAAa,EAAmB,MAAM,aAAa,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,iBAAiB,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,SAAS,MAAM,EAGpC,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAOlD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAWtD;AAED;0CAC0C;AAC1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,CAAC;CACtE;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,EAAE,UAqCzB,CAAC;AAQF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,GAAE,UAAwB,GAC/B,aAAa,CAsCf"}
+{"version":3,"file":"banner-facts.d.ts","sourceRoot":"","sources":["../src/banner-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAkB,KAAK,aAAa,EAAmB,MAAM,aAAa,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,iBAAiB,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,SAAS,MAAM,EAGpC,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAOlD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,sBAA2B,GAAG,MAAM,GAAG,SAAS,CAEvF;AAED;0CAC0C;AAC1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,CAAC;CACtE;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,EAAE,UAqCzB,CAAC;AAQF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,GAAE,UAAwB,GAC/B,aAAa,CAsCf"}