halfcycle 0.3.35 → 0.3.37

package/dist/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // dist/bin.js
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync10, statSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync10, realpathSync, statSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
 import { join as join10 } from "node:path";
 
 // dist/install.js
@@ -35,6 +35,8 @@ var ENGAGEMENTS_DIR_NAME = "engagements";
 var ENGAGEMENT_ENV_FILENAME = "env";
 var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
 var ACCOUNT_STORE_FILENAME = "account.json";
+var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
+var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
 var ENGAGEMENT_ID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$";
 var ENGAGEMENT_ID_SHAPE = new RegExp(ENGAGEMENT_ID_PATTERN);
 function isEngagementId(value) {
@@ -228,6 +230,10 @@ function looksLikeSecret(text) {
   return false;
 }
 
+// ../core/dist/mcp-registration.js
+var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_SERVER_KEY = "halfcycle";
+
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
@@ -1218,6 +1224,19 @@ var ciTokenExchangeResponseSchema = z10.object({
   expiresAt: utcIso8601,
   engagementId: z10.string()
 }).strict();
+var NO_CREDENTIAL_PLACEHOLDER = "halfcycle:no-credential";
+var NOT_THIS_ACCOUNT_PLACEHOLDER = "halfcycle:not-this-account";
+var UPDATE_CLAUDE_CODE_PLACEHOLDER = "halfcycle:update-claude-code";
+var SWITCH_ACCOUNT_ANSWER = 'answer "s" when asked';
+var NO_CREDENTIAL_SENTENCE = 'Halfcycle is not connected: this machine has no working Halfcycle credential for this project. Run "npx halfcycle" in the project folder to sign in again.';
+var NOT_THIS_ACCOUNT_SENTENCE = `Halfcycle is not connected: this project belongs to another Halfcycle account. To switch, run "npx halfcycle" in this project and ${SWITCH_ACCOUNT_ANSWER}.`;
+var UPDATE_CLAUDE_CODE_SENTENCE = "Halfcycle is not connected: this Claude Code version does not name the server it connects to, so no credential was sent. Update Claude Code, then reopen.";
+var NO_NODE_SENTENCE = "Halfcycle is not connected: Node is not installed, or not on the path this session uses, so nothing here is checked. Install Node, then reopen.";
+var PLACEHOLDER_SENTENCES = Object.freeze({
+  [NO_CREDENTIAL_PLACEHOLDER]: NO_CREDENTIAL_SENTENCE,
+  [NOT_THIS_ACCOUNT_PLACEHOLDER]: NOT_THIS_ACCOUNT_SENTENCE,
+  [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
+});
 
 // ../events/dist/phase-record.js
 import { z as z11 } from "zod";
@@ -1322,7 +1341,6 @@ function forgetStoredCredential(serviceUrl, home) {
 var ENGAGEMENTS_DIR = ENGAGEMENTS_DIR_NAME;
 var ENV_FILENAME = ENGAGEMENT_ENV_FILENAME;
 var HALFCYCLE_DIR = HALFCYCLE_DIR_NAME;
-var PIN_ENGAGEMENT_ID_FIELD = "engagementId";
 var InvalidEngagementIdError = class extends Error {
   constructor(engagementId) {
     const shown = JSON.stringify(engagementId.length > 80 ? `${engagementId.slice(0, 80)}\u2026` : engagementId);
@@ -1640,6 +1658,15 @@ function bool(value, field) {
     throw new UnreadableManifestError(`"${field}" is not true or false`);
   return value;
 }
+function appendedTextRecord(value, field) {
+  if (!isRecord(value))
+    throw new UnreadableManifestError(`"${field}" is not an object`);
+  onlyKeys(value, ["created", "appended"], `"${field}"`);
+  return {
+    created: bool(value["created"], `${field}.created`),
+    appended: stringArray(value["appended"], `${field}.appended`)
+  };
+}
 function onlyKeys(value, allowed, where) {
   const extra = Object.keys(value).filter((k) => !allowed.includes(k));
   if (extra.length > 0)
@@ -1654,7 +1681,7 @@ function parseManifest(text) {
   }
   if (!isRecord(raw))
     throw new UnreadableManifestError("it is not a JSON object");
-  onlyKeys(raw, ["format", "files", "createdDirs", "leftAlone", "settings", "mcp", "gitignore"], "the manifest");
+  onlyKeys(raw, ["format", "files", "createdDirs", "leftAlone", "settings", "mcp", "gitignore", "gitattributes"], "the manifest");
   if (raw["format"] !== INSTALL_MANIFEST_FORMAT) {
     throw new UnreadableManifestError(`its format is not ${INSTALL_MANIFEST_FORMAT}`);
   }
@@ -1715,14 +1742,10 @@ function parseManifest(text) {
       ...typeof m["entrySha256"] === "string" ? { entrySha256: m["entrySha256"] } : {}
     };
   }
-  const g = raw["gitignore"];
-  if (!isRecord(g))
+  if (raw["gitignore"] === void 0)
     throw new UnreadableManifestError('"gitignore" is missing');
-  onlyKeys(g, ["created", "appended"], '"gitignore"');
-  const gitignore = {
-    created: bool(g["created"], "gitignore.created"),
-    appended: stringArray(g["appended"], "gitignore.appended")
-  };
+  const gitignore = appendedTextRecord(raw["gitignore"], "gitignore");
+  const gitattributes = raw["gitattributes"] === void 0 ? void 0 : appendedTextRecord(raw["gitattributes"], "gitattributes");
   const paths = files.map((f) => f.path);
   if (new Set(paths).size !== paths.length)
     throw new UnreadableManifestError('"files" names a path twice');
@@ -1737,7 +1760,8 @@ function parseManifest(text) {
     leftAlone,
     settings,
     ...mcp !== void 0 ? { mcp } : {},
-    gitignore
+    gitignore,
+    ...gitattributes !== void 0 ? { gitattributes } : {}
   };
 }
 function startManifest(previous, isMember, isMemberDir) {
@@ -1753,12 +1777,16 @@ function startManifest(previous, isMember, isMemberDir) {
     createdDirs: new Set((previous?.createdDirs ?? []).filter(isMemberDir)),
     settings: previous?.settings,
     mcp: previous?.mcp,
-    gitignore: previous?.gitignore
+    gitignore: previous?.gitignore,
+    gitattributes: previous?.gitattributes
   };
 }
 function recordInstalledFile(draft, path, bytes) {
   draft.files.set(path, { path, sha256: sha256Hex(bytes) });
 }
+function recordRemovedFile(draft, path) {
+  draft.files.delete(path);
+}
 function recordPerMachineFile(draft, path) {
   draft.files.set(path, { path, perMachine: true });
 }
@@ -1801,8 +1829,15 @@ function recordMcp(draft, observed) {
   };
 }
 function recordGitignore(draft, created, appended) {
-  const prev = draft.gitignore;
-  draft.gitignore = {
+  draft.gitignore = carryAppended(draft.gitignore, created, appended);
+}
+function recordGitattributes(draft, created, appended) {
+  if (draft.gitattributes === void 0 && !created && appended.every((a) => a === ""))
+    return;
+  draft.gitattributes = carryAppended(draft.gitattributes, created, appended);
+}
+function carryAppended(prev, created, appended) {
+  return {
     created: prev?.created ?? created,
     appended: [...prev?.appended ?? [], ...appended.filter((a) => a !== "")]
   };
@@ -1826,7 +1861,8 @@ function finishManifest(draft) {
       denyCreated: false
     },
     ...draft.mcp !== void 0 ? { mcp: draft.mcp } : {},
-    gitignore: draft.gitignore ?? { created: false, appended: [] }
+    gitignore: draft.gitignore ?? { created: false, appended: [] },
+    ...draft.gitattributes !== void 0 ? { gitattributes: draft.gitattributes } : {}
   };
 }
 function union(a, b) {
@@ -1977,11 +2013,12 @@ var WRITE_ALLOWLIST = [
   ".claude/hooks",
   ".claude/settings.json",
   ".halfcycle",
-  ".halfcycle/bundle.json",
+  BUNDLE_PIN_REL,
   ".halfcycle/bin",
   "docs/build-records",
   "test/fixtures/captured",
-  ".mcp.json",
+  MCP_REGISTRATION_REL,
+  ".gitattributes",
   ZONE_B_DIR
 ];
 function isAllowlisted(targetRelPath) {
@@ -1991,15 +2028,16 @@ function isAllowlisted(targetRelPath) {
     return normalised === p || normalised.startsWith(p + "/");
   });
 }
-var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
 var PROJECT_IDENTITY_REL = ".halfcycle/project.json";
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
 var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
 var GITIGNORE_REL = ".gitignore";
+var GITATTRIBUTES_REL = ".gitattributes";
 function commandStubRel(name) {
   return `.claude/commands/${name}.md`;
 }
-var RETIRED_WRITE_SET_FILES = [];
+var RETIRED_MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
+var RETIRED_WRITE_SET_FILES = [RETIRED_MCP_HEADERS_HELPER_REL];
 var RETIRED_DENY_PATTERNS = [];
 function closedWriteSet() {
   const files = /* @__PURE__ */ new Set([
@@ -2014,7 +2052,7 @@ function closedWriteSet() {
     INSTALL_MANIFEST_REL,
     ...RETIRED_WRITE_SET_FILES
   ]);
-  const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, GITIGNORE_REL]);
+  const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, GITIGNORE_REL, GITATTRIBUTES_REL]);
   const dirs = /* @__PURE__ */ new Set();
   for (const path of [...files, ...merged]) {
     for (let dir = posix.dirname(path); dir !== "."; dir = posix.dirname(dir))
@@ -2028,7 +2066,11 @@ function closedWriteSet() {
     ownedDirs,
     hookCommands: new Set(HALFCYCLE_HOOK_COMMANDS),
     denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
-    gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL])
+    gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL]),
+    gitattributesLines: /* @__PURE__ */ new Set([
+      GITATTRIBUTES_HEADER,
+      ...lfRules([...Object.keys(OWNED_GENERATED_HEADERS), ...RETIRED_WRITE_SET_FILES])
+    ])
   };
 }
 function readPreviousManifest(targetRepo) {
@@ -2092,15 +2134,19 @@ function recordMcpAdoptionOnly(draft, existingText) {
 }
 function recordGitignoreReconcile(draft, before, after) {
   const adopted = draft.gitignore === void 0 && before !== null ? adoptOlderGitignoreBlock(before) : "";
-  let appended = "";
-  if (after !== null && after !== before) {
-    if (before === null)
-      appended = after;
-    else if (after.startsWith(before))
-      appended = after.slice(before.length);
-  }
+  const appended = appendedText(before, after);
   recordGitignore(draft, before === null && after !== null, [adopted, appended]);
 }
+function recordGitattributesReconcile(draft, before, after) {
+  recordGitattributes(draft, before === null && after !== null, [appendedText(before, after)]);
+}
+function appendedText(before, after) {
+  if (after === null || after === before)
+    return "";
+  if (before === null)
+    return after;
+  return after.startsWith(before) ? after.slice(before.length) : "";
+}
 function assertManifestInWriteSet(manifest, writeSet) {
   const strays = [
     ...manifest.files.map((f) => f.path).filter((p) => !writeSet.files.has(p)),
@@ -2115,7 +2161,8 @@ function findNotShared(targetRepo, manifest, collidedPaths) {
   const merged = [
     SETTINGS_REL,
     ...manifest.mcp !== void 0 ? [MCP_REGISTRATION_REL] : [],
-    ...manifest.gitignore.created || manifest.gitignore.appended.length > 0 ? [GITIGNORE_REL] : []
+    ...manifest.gitignore.created || manifest.gitignore.appended.length > 0 ? [GITIGNORE_REL] : [],
+    ...manifest.gitattributes !== void 0 && (manifest.gitattributes.created || manifest.gitattributes.appended.length > 0) ? [GITATTRIBUTES_REL] : []
   ];
   const collided = new Set(collidedPaths);
   const dirVerdicts = /* @__PURE__ */ new Map();
@@ -2343,6 +2390,20 @@ exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
 }
 var GENERATED_SESSION_START_HEADER = "# Session-start marker \u2014 generated by";
 var SESSION_ID_FROM_HOOK_INPUT_SH = `SESSION_ID="$(printf '%s' "$INPUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);process.stdout.write(typeof j.session_id==="string"?j.session_id:"")}catch{process.stdout.write("")}})' 2>/dev/null || true)"`;
+var REPO_HASH_FROM_ROOT_SH = `HASH="$(printf '%s' "$REPO_ROOT" | node -e 'const c=[];process.stdin.on("data",d=>c.push(d)).on("end",()=>{process.stdout.write(require("node:crypto").createHash("sha256").update(Buffer.concat(c)).digest("hex").slice(0,12))})' 2>/dev/null || true)"`;
+function noNodeReplyShell() {
+  const reply = JSON.stringify({
+    systemMessage: NO_NODE_SENTENCE,
+    hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: NO_NODE_SENTENCE }
+  });
+  if (reply.includes("'")) {
+    throw new Error("[bundle install] the no-Node notice cannot be single-quoted; refusing to write the session-start script.");
+  }
+  return `if ! command -v node >/dev/null 2>&1; then
+  printf '%s\\n' '${reply}'
+  exit 0
+fi`;
+}
 function generateSessionStartMarker() {
   return `#!/usr/bin/env bash
 ${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
@@ -2351,10 +2412,15 @@ ${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
 # it began instead of only against the latest commit. The session id comes in on
 # stdin with the hook input; without one, the older session-less name is written
 # and the stop-time check compares against the latest commit as it used to.
+#
+# Without Node nothing Halfcycle installs here can run, so this says so once and
+# writes no marker.
+${noNodeReplyShell()}
 INPUT="$(cat 2>/dev/null || true)"
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${REPO_HASH_FROM_ROOT_SH}
+if [ -z "$HASH" ]; then exit 0; fi
 ${SESSION_ID_FROM_HOOK_INPUT_SH}
 MARKER_DIR="\${TMPDIR:-/tmp}"
 MARKER_DIR="\${MARKER_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
@@ -2364,64 +2430,6 @@ else
   MARKER_FILE="\${MARKER_DIR}/halfcycle-session-\${HASH}.ref"
 fi
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
-
-# ---------------------------------------------------------------------------
-# STANDING GUARD-COVERAGE STATEMENT (T-27; two arms since T-02b).
-#
-# A repository with no credential on this machine is UNGUARDED: the PostToolUse
-# hook will find nothing to evaluate with, and it says so once per edit, after
-# the edit. This says it once, up front, before anything is written \u2014 which is
-# the one thing a session-start hook can do that nothing else can.
-#
-# TWO REASONS TO HAVE NO CREDENTIAL, TWO DIFFERENT THINGS TO SAY (T-02b,
-# solo-project-ownership \u2014 outcome B). "You have not signed in here yet" is
-# fixed by re-running the installer; "this is not your project" is permanent,
-# and the same remedy would send the reader in a circle forever. The two are
-# told apart by HALFCYCLE_ENV_NOT_THIS_ACCOUNT, set by \`halfcycle_env_file\`
-# below from a machine-level marker beside the credential store.
-#
-# Everything below runs in a SUBSHELL: it sources a credential store, and a
-# session-start hook must not leak an engagement's variables into whatever the
-# editor runs next. Any failure inside it is swallowed; this script's exit
-# status is 0 either way, and the marker above has already been written.
-# ---------------------------------------------------------------------------
-${engagementResolutionShell()}
-
-(
-  if halfcycle_env_file "$REPO_ROOT"; then
-    set -a
-    . "$HALFCYCLE_ENV_FILE"
-    set +a
-  fi
-  if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
-    # OUTCOME B (T-02b, solo-project-ownership). This is not the missing-keys
-    # case below wearing different words: there is nothing to fix, and the loop
-    # that follows is skipped entirely rather than run and then overridden \u2014 a
-    # repository whose credential is absent for THIS reason must never be told
-    # to re-run the installer, which can never obtain one for it.
-    echo "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked."
-    echo "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is"
-    echo "[halfcycle] evaluated, and nothing you do is reported as having passed."
-    echo "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming."
-    echo "[halfcycle] Ask the project's owner for view access."
-    echo "[halfcycle] If this account is wrong, sign in as the one that owns the project and run"
-    echo "[halfcycle] \\"npx halfcycle\\" again."
-  else
-    hc_missing=""
-    for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
-      eval "hc_value=\\\${$hc_key:-}"
-      if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
-    done
-    if [ -n "$hc_missing" ]; then
-      echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
-      echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
-      echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
-      echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
-      echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
-      echo "[halfcycle] and needs nothing configured first."
-    fi
-  fi
-) 2>/dev/null || true
 exit 0
 `;
 }
@@ -2437,7 +2445,8 @@ INPUT="$(cat 2>/dev/null || true)"
 
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${REPO_HASH_FROM_ROOT_SH}
+if [ -z "$HASH" ]; then exit 0; fi
 
 # The session id arrives on stdin as part of the hook payload. Empty when absent.
 ${SESSION_ID_FROM_HOOK_INPUT_SH}
@@ -2484,7 +2493,8 @@ set -e
 
 # The project root is resolved from THIS SCRIPT'S OWN LOCATION, never from the
 # session's cwd \u2014 a session started in a subdirectory must find the same root
-# .mcp.json the editor loaded, which is the bug mcp-headers.sh already paid for.
+# .mcp.json the editor loaded, which is the bug the editor's headers command
+# already paid for.
 HC_SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 HC_PROJECT_ROOT=$(CDPATH= cd -- "$HC_SCRIPT_DIR/../.." && pwd)
 HC_REGISTRATION="$HC_PROJECT_ROOT/${MCP_REGISTRATION_REL}"
@@ -2531,7 +2541,9 @@ function isTrackedAndClean(targetRepo, relPath) {
   return true;
 }
 function removeLegacyCiStanza(targetRepo) {
-  const rel = ".halfcycle/ci-stanza.yml";
+  return removeRetiredGeneratedFile(targetRepo, ".halfcycle/ci-stanza.yml", 0, CI_STANZA_KNOWN_HEADER_HASHES);
+}
+function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeaderHashes) {
   const path = join5(targetRepo, rel);
   if (!existsSync3(path))
     return "absent";
@@ -2541,10 +2553,9 @@ function removeLegacyCiStanza(targetRepo) {
   } catch {
     return "failed";
   }
-  const headerLine = raw.split("\n")[0] ?? "";
+  const headerLine = raw.split("\n")[headerLineIndex] ?? "";
   const digest = createHash2("sha256").update(headerLine, "utf-8").digest("hex");
-  const ours = CI_STANZA_KNOWN_HEADER_HASHES.includes(digest);
-  if (!ours)
+  if (!knownHeaderHashes.includes(digest))
     return "kept-foreign";
   if (!isTrackedAndClean(targetRepo, rel))
     return "kept-uncommitted";
@@ -2555,205 +2566,33 @@ function removeLegacyCiStanza(targetRepo) {
   }
   return "removed";
 }
-var MCP_REGISTRATION_REL = ".mcp.json";
-var MCP_SERVER_KEY = "halfcycle";
-var MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
-var MCP_HEADERS_HELPER_COMMAND = `/bin/sh -c 'd=$(pwd); while [ ! -f "$d/${MCP_HEADERS_HELPER_REL}" ] && [ "$d" != / ]; do d=$(dirname "$d"); done; [ -f "$d/${MCP_HEADERS_HELPER_REL}" ] || { echo "halfcycle: ${MCP_HEADERS_HELPER_REL} not found at or above $(pwd); re-run npx halfcycle" >&2; exit 1; }; exec /bin/sh "$d/${MCP_HEADERS_HELPER_REL}"'`;
-var GENERATED_MCP_HEADERS_HEADER = "# Halfcycle MCP connection headers \u2014 generated by";
+var MCP_HEADERS_HELPER_COMMAND = `node -e "${[
+  `const p=require('path'),f=require('fs'),c=require('child_process');`,
+  `let d=process.cwd();`,
+  `for(;;){`,
+  `const b=p.join(d,'${VENDORED_BIN_REL}');`,
+  `if(f.existsSync(b)){`,
+  `const r=c.spawnSync(process.execPath,[b,'mcp-headers'],{stdio:'inherit'});`,
+  `process.exit(typeof r.status==='number'?r.status:1)}`,
+  `const u=p.dirname(d);`,
+  `if(u===d)break;`,
+  `d=u}`,
+  `console.error('halfcycle: no ${VENDORED_BIN_REL} at or above '+process.cwd()+'; run npx halfcycle in the project folder');`,
+  `process.exit(1)`
+].join("")}"`;
+var MCP_HEADERS_KNOWN_HEADER_HASHES = [
+  "37a733ea588b3361b2bbfd86c44e0c95da30d7af6acffd1243ece83c811f0af2",
+  "6732ec6d2d2bf7cb33017749a3d021b59af653dcd07c3811693b5a242d44b1a1"
+];
+function removeRetiredMcpHeadersHelper(targetRepo) {
+  return removeRetiredGeneratedFile(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL, 1, MCP_HEADERS_KNOWN_HEADER_HASHES);
+}
 var OWNED_GENERATED_HEADERS = {
   ".claude/hooks/guard-runner.sh": GENERATED_GUARD_RUNNER_HEADER,
   ".claude/hooks/user-prompt-reminder.sh": GENERATED_USER_PROMPT_REMINDER_HEADER,
   ".claude/hooks/session-end-marker.sh": GENERATED_SESSION_END_HEADER,
-  ".claude/hooks/session-start-marker.sh": GENERATED_SESSION_START_HEADER,
-  ".halfcycle/mcp-headers.sh": GENERATED_MCP_HEADERS_HEADER
+  ".claude/hooks/session-start-marker.sh": GENERATED_SESSION_START_HEADER
 };
-function generateMcpHeadersHelper() {
-  return `#!/bin/sh
-${GENERATED_MCP_HEADERS_HEADER} the Halfcycle installer.
-#
-# Claude Code runs this at MCP connection time, from the session's cwd, and merges
-# its stdout into the connection headers for the "halfcycle" server in .mcp.json.
-#
-# It exists because \${VAR} expansion in .mcp.json reads the PROCESS environment
-# only: nothing loads a credential into a session, so a referenced
-# \${HALFCYCLE_TOKEN} expanded to nothing and the server was silently absent from
-# the tool list.
-#
-# This file is tracked and holds NO secret. NEITHER DOES ANY OTHER FILE IN THIS
-# REPOSITORY (T-09): the credential lives at machine level, outside every checkout,
-# and this script READS one line out of it (never sources \u2014 a credential store is
-# not code).
-set -eu
-
-# The project root is resolved from THIS SCRIPT'S OWN LOCATION, never from the
-# caller's working directory. Claude Code runs the helper from the SESSION's cwd,
-# and a session started in a subdirectory still finds the root .mcp.json \u2014 so a
-# relative read here silently produced no credential for anyone who started the
-# session in any subdirectory of a monorepo.
-SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
-
-${engagementResolutionShell()}
-
-# Read one KEY's value out of the credential store into HC_VALUE, in the CALLER's
-# shell (call it as a statement, never inside $(...)). Last assignment wins,
-# matching the shell's own \`.\` semantics. An optional leading \`export \` is
-# tolerated because a hand-edited store may use one.
-halfcycle_store_value() {
-  HC_VALUE=""
-  hc_line=$(grep "^[[:space:]]*\\(export[[:space:]][[:space:]]*\\)\\{0,1\\}$2=" "$1" | tail -n 1)
-  hc_v=\${hc_line#*"$2="}
-  hc_v=$(printf '%s' "$hc_v" | tr -d '\\r')
-
-  # Strip one layer of matching quotes. The store is WRITTEN single-quoted (both
-  # writers use the same shq: this installer and Studio's provider), because
-  # guard-runner.sh SOURCES the same file and an unquoted value carrying a space
-  # would execute its own remainder. This reader greps rather than sources, so it
-  # has to undo the quoting itself \u2014 and it must land on the same value the
-  # sourcing consumer gets, or one file has two answers.
-  case $hc_v in
-    '"'*'"') hc_v=\${hc_v#'"'}; hc_v=\${hc_v%'"'} ;;
-    "'"*"'")
-      hc_v=\${hc_v#"'"}; hc_v=\${hc_v%"'"}
-      # \u2026and undo shq's embedded-quote escape, '\\'' -> '. The backslash is matched
-      # through a BRACKET EXPRESSION on purpose. MEASURED, on GNU sed 4.9 (Linux,
-      # the CI platform) and BSD sed (macOS), feeding each the script from a file so
-      # no shell quoting is in the way:
-      #
-      #   s/'[\\]''/'/g   a'\\''b -> a'b     both      <- shipped
-      #   s/'\\''/'/g     a'\\''b -> a'\\''b   both      <- matches NOTHING, exit 0
-      #
-      # A bare \\' in a BRE is undefined by POSIX, and the obvious pattern therefore
-      # does not fail loudly \u2014 it silently substitutes nothing, on BOTH platforms,
-      # and the token then travels with four stray characters in it. The bracket
-      # expression makes the backslash literal by a construction POSIX does define.
-      hc_v=$(printf '%s' "$hc_v" | sed "s/'[\\]''/'/g") ;;
-  esac
-  HC_VALUE=$hc_v
-}
-
-# The scheme and host[:port] of a URL, lowercased \u2014 or NOTHING when the URL holds
-# a space or a control character anywhere. That refusal is the load-bearing part:
-# a URL parser drops tabs and newlines before it reads the host, so
-# "https://ours<newline>@elsewhere/" is a request to "elsewhere", while a
-# line-by-line reading here would see only "https://ours". The host ends at the
-# first / ? # or backslash, which is where a URL parser ends it for http(s).
-halfcycle_origin() {
-  hc_u=$1
-  if [ "$(printf '%s' "$hc_u" | tr -d '[:cntrl:][:space:]')" != "$hc_u" ]; then
-    return 0
-  fi
-  printf '%s\\n' "$hc_u" | sed -n 's|^\\([A-Za-z][A-Za-z0-9+.-]*://[^/?#\\\\]*\\).*$|\\1|p' | tr '[:upper:]' '[:lower:]'
-}
-
-# HALFCYCLE_TOKEN in the environment WINS, and it is the CI arm: a job with no
-# browser and no per-user store exports the credential, and a stale store on a
-# long-lived runner must not silently win over it. Same order, and the same reason,
-# as the CLI's own resolver (\`resolve-credential.ts\`). The server it may be sent
-# to is NOT taken from the environment: it is read from this machine's store in
-# both arms, so a token supplied this way still goes only where this machine was
-# set up to send it.
-# The pin names an id that is not a project id. Re-running the installer against
-# that pin refuses it too, so the one remedy that works is a fresh pin.
-halfcycle_bad_id_message() {
-  echo "halfcycle: $PROJECT_ROOT/.halfcycle/bundle.json names an engagement id that is not a Halfcycle project id," >&2
-  echo "halfcycle: so no credential was read. Delete that file and run \\"npx halfcycle\\" again: this repository" >&2
-  echo "halfcycle: is then set up as a new Halfcycle project." >&2
-}
-
-TOKEN=\${HALFCYCLE_TOKEN:-}
-MCP_URL=""
-
-if [ -n "$TOKEN" ]; then
-  if halfcycle_env_file "$PROJECT_ROOT"; then
-    halfcycle_store_value "$HALFCYCLE_ENV_FILE" HALFCYCLE_MCP_URL
-    MCP_URL=$HC_VALUE
-  fi
-else
-  if ! halfcycle_env_file "$PROJECT_ROOT"; then
-    case $HALFCYCLE_ENV_PROBLEM in
-      no-pin)
-        echo "halfcycle: no .halfcycle/bundle.json in $PROJECT_ROOT, so this repository has no Halfcycle engagement." >&2
-        echo "halfcycle: run \\"npx halfcycle\\" here to install one." >&2 ;;
-      no-id)
-        echo "halfcycle: $PROJECT_ROOT/.halfcycle/bundle.json names no engagement id." >&2
-        echo "halfcycle: run \\"npx halfcycle\\" here to rewrite it." >&2 ;;
-      bad-id)
-        halfcycle_bad_id_message ;;
-      no-home)
-        echo "halfcycle: HOME is not set, so the credential store cannot be located." >&2 ;;
-      *)
-        # OUTCOME B (T-02b, solo-project-ownership) is a \`no-credential\` PROBLEM
-        # with a REASON attached, checked here rather than as a fifth case value
-        # \u2014 see \`engagementResolutionShell\`'s own docblock for why. Re-running
-        # this installer can never obtain a credential for this reason, so it is
-        # the one sentence in this file that must not say to.
-        if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
-          echo "halfcycle: this project belongs to another Halfcycle account, so this machine has no" >&2
-          echo "halfcycle: credential for it and the Halfcycle tools are not available here. Nothing is" >&2
-          echo "halfcycle: broken \u2014 ask the project's owner for view access, or sign in as the account" >&2
-          echo "halfcycle: that owns it and run \\"npx halfcycle\\" again." >&2
-        else
-          echo "halfcycle: this machine holds no credential for engagement $HALFCYCLE_ENV_ENGAGEMENT." >&2
-          echo "halfcycle: run \\"npx halfcycle\\" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to $HOME/.halfcycle, outside this repository." >&2
-        fi ;;
-    esac
-    exit 1
-  fi
-  ENV_FILE="$HALFCYCLE_ENV_FILE"
-
-  halfcycle_store_value "$ENV_FILE" HALFCYCLE_TOKEN
-  TOKEN=$HC_VALUE
-  if [ -z "$TOKEN" ]; then
-    echo "halfcycle: HALFCYCLE_TOKEN is absent or empty in $ENV_FILE." >&2
-    echo "halfcycle: run \\"npx halfcycle\\" in this repository to rewrite this machine's credential." >&2
-    exit 1
-  fi
-  halfcycle_store_value "$ENV_FILE" HALFCYCLE_MCP_URL
-  MCP_URL=$HC_VALUE
-fi
-
-# THE TOKEN GOES ONLY TO THIS MACHINE'S HALFCYCLE SERVER. .mcp.json is a tracked
-# file: anyone who can land a commit can change the server's url, and this script
-# would then hand the credential to whatever it names. Claude Code tells the helper
-# which url it is about to connect to (CLAUDE_CODE_MCP_SERVER_URL); the server this
-# machine was set up against is recorded OUTSIDE the repository, beside the
-# credential. The two must share scheme, host and port, or nothing is printed.
-# No url at all is a refusal too: sending the credential without knowing where it
-# is going is the thing this check exists to stop.
-REQUESTED=\${CLAUDE_CODE_MCP_SERVER_URL:-}
-if [ -z "$REQUESTED" ]; then
-  echo "halfcycle: Claude Code did not say which server it is connecting to, so the Halfcycle credential was not sent." >&2
-  echo "halfcycle: update Claude Code, then reconnect." >&2
-  exit 1
-fi
-if [ -z "$MCP_URL" ] && [ "\${HALFCYCLE_ENV_PROBLEM:-}" = "bad-id" ]; then
-  halfcycle_bad_id_message
-  exit 1
-fi
-if [ -z "$MCP_URL" ]; then
-  echo "halfcycle: this machine has no Halfcycle server address recorded for this repository, so the credential was not sent." >&2
-  echo "halfcycle: run \\"npx halfcycle\\" in this repository on this machine to record it." >&2
-  exit 1
-fi
-WANT=$(halfcycle_origin "$MCP_URL")
-GOT=$(halfcycle_origin "$REQUESTED")
-if [ -z "$WANT" ] || [ "$GOT" != "$WANT" ]; then
-  SHOWN=$(printf '%s' "$REQUESTED" | tr -cd '[:graph:]' | cut -c1-200)
-  echo "halfcycle: .mcp.json asks for this repository's Halfcycle credential to be sent to $SHOWN," >&2
-  echo "halfcycle: which is not this machine's Halfcycle server (\${WANT:-none recorded}). The credential was NOT sent." >&2
-  echo "halfcycle: if nobody meant to change .mcp.json, treat that change as suspect; \\"npx halfcycle\\" restores the entry." >&2
-  exit 1
-fi
-
-# JSON-escape: backslash first, then double quote. A token carrying either would
-# otherwise emit invalid JSON, and invalid JSON is dropped SILENTLY \u2014 the
-# connection succeeds carrying no Authorization header at all.
-ESCAPED=$(printf '%s' "$TOKEN" | sed -e 's/\\\\/\\\\\\\\/g' -e 's/"/\\\\"/g')
-
-printf '{"Authorization":"Bearer %s"}\\n' "$ESCAPED"
-`;
-}
 function generateMcpRegistration(existing, mcpOrigin) {
   let base = { mcpServers: {} };
   if (existing !== null) {
@@ -2820,6 +2659,42 @@ ${header}
     return "failed";
   }
 }
+var GITATTRIBUTES_HEADER = "# Halfcycle \u2014 generated scripts keep LF line endings";
+function readTextOrNull(path) {
+  try {
+    return readFileSync5(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function lfRules(paths) {
+  return [...paths].filter((path) => path.endsWith(".sh")).map((path) => `${path} text eol=lf`);
+}
+var REQUIRED_GITATTRIBUTES_RULES = lfRules(Object.keys(OWNED_GENERATED_HEADERS));
+function reconcileGitattributes(targetRepo) {
+  const path = join5(targetRepo, GITATTRIBUTES_REL);
+  const rules = REQUIRED_GITATTRIBUTES_RULES;
+  const routed = [];
+  try {
+    if (lstatOrNull(path)?.isSymbolicLink() === true)
+      return "failed";
+    if (!existsSync3(path)) {
+      writeAllowlisted(path, targetRepo, [GITATTRIBUTES_HEADER, ...rules].join("\n") + "\n", routed);
+      return "written";
+    }
+    const existing = readFileSync5(path, "utf-8");
+    const present = new Set(existing.split("\n").map((l) => l.trim()));
+    const toAdd = rules.filter((rule) => !present.has(rule));
+    if (toAdd.length === 0)
+      return "skipped";
+    const separator = existing === "" ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+    const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join("\n") + "\n";
+    writeAllowlisted(path, targetRepo, existing + suffix, routed);
+    return "written";
+  } catch {
+    return "failed";
+  }
+}
 function previousPinForEngagement(targetRepoRoot, engagementId) {
   try {
     const existing = readBundlePin(targetRepoRoot);
@@ -3070,9 +2945,6 @@ async function install(options) {
       break;
   }
   if (credential) {
-    const helperPath = join5(targetRepo, MCP_HEADERS_HELPER_REL);
-    const helperOutcome = recordOwnedGenerated(report, helperPath, targetRepo, generateMcpHeadersHelper(), OWNED_GENERATED_HEADERS[MCP_HEADERS_HELPER_REL], MCP_HEADERS_HELPER_REL);
-    noteFile(draft, targetRepo, MCP_HEADERS_HELPER_REL, helperOutcome);
     const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
     const existingMcp = existsSync3(mcpPath) ? readFileSync5(mcpPath, "utf-8") : null;
     const mcpContent = generateMcpRegistration(existingMcp, credential.mcpUrl);
@@ -3084,6 +2956,24 @@ async function install(options) {
     } else {
       report.skippedPaths.push(MCP_REGISTRATION_REL);
     }
+    const helperRel = RETIRED_MCP_HEADERS_HELPER_REL;
+    switch (removeRetiredMcpHeadersHelper(targetRepo)) {
+      case "removed":
+        recordRemovedFile(draft, helperRel);
+        report.writtenPaths.push(`${helperRel} (REMOVED \u2014 Halfcycle no longer uses this file)`);
+        break;
+      case "kept-foreign":
+        report.skippedPaths.push(`${helperRel} (KEPT \u2014 Halfcycle no longer uses this file, and it is not one Halfcycle generated byte for byte, so it was left alone; delete it if nothing of yours needs it)`);
+        break;
+      case "kept-uncommitted":
+        report.skippedPaths.push(`${helperRel} (KEPT \u2014 Halfcycle no longer uses this file, but it is not a clean, committed copy in this repository, so it was left alone rather than risk losing an edit; delete it when you are ready)`);
+        break;
+      case "failed":
+        report.skippedPaths.push(`${helperRel} (could not be removed \u2014 Halfcycle no longer uses this file, DELETE IT BY HAND)`);
+        break;
+      case "absent":
+        break;
+    }
   } else {
     report.skippedPaths.push(`${MCP_REGISTRATION_REL} (no MCP origin \u2014 no credential supplied)`);
     const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
@@ -3099,6 +2989,15 @@ async function install(options) {
   } else {
     record(report, gitignoreOutcome, ".gitignore");
   }
+  const gitattributesPath = join5(targetRepo, GITATTRIBUTES_REL);
+  const gitattributesBefore = readTextOrNull(gitattributesPath);
+  const gitattributesOutcome = reconcileGitattributes(targetRepo);
+  recordGitattributesReconcile(draft, gitattributesBefore, readTextOrNull(gitattributesPath));
+  if (gitattributesOutcome === "failed") {
+    report.skippedPaths.push(`${GITATTRIBUTES_REL} (write failed \u2014 a clone made with core.autocrlf=true may check the hook scripts out with CRLF line endings)`);
+  } else {
+    record(report, gitattributesOutcome, GITATTRIBUTES_REL);
+  }
   const identityOutcome = writeProjectIdentity(targetRepo);
   record(report, identityOutcome, PROJECT_IDENTITY_REL);
   noteFile(draft, targetRepo, PROJECT_IDENTITY_REL, identityOutcome);
@@ -3257,6 +3156,7 @@ async function bindLoopback(env = process.env, engagementId) {
   const state = randomBytes(32).toString("hex");
   let pending = null;
   let deliver = null;
+  let abandon = null;
   const server = createServer(createCallbackHandler(state, (callback) => {
     if (deliver)
       deliver(callback);
@@ -3298,12 +3198,18 @@ async function bindLoopback(env = process.env, engagementId) {
           clearInterval(ticker);
         clearTimeout(timer);
         deliver = null;
+        abandon = null;
         resolve4(value);
       };
       const timer = setTimeout(() => finish(null), Math.max(0, timeoutMs));
       deliver = finish;
+      abandon = () => finish(null);
     }),
-    close: () => closeServer(server)
+    close: () => {
+      if (abandon !== null)
+        abandon();
+      return closeServer(server);
+    }
   };
 }
 function closeServer(server) {
@@ -3337,8 +3243,13 @@ function defaultSleep(ms) {
 function browserOpenCommand(os, url) {
   if (os === "darwin")
     return { command: "open", args: [url] };
-  if (os === "win32")
-    return { command: "cmd", args: ["/c", "start", "", url] };
+  if (os === "win32") {
+    return {
+      command: "cmd.exe",
+      args: ["/d", "/s", "/c", `"start "" "${url}""`],
+      windowsVerbatimArguments: true
+    };
+  }
   return { command: "xdg-open", args: [url] };
 }
 function isOpenableUrl(url) {
@@ -3349,19 +3260,35 @@ function isOpenableUrl(url) {
     return false;
   }
 }
+function hasWin32UnsafeOpenerChars(url) {
+  if (url.includes('"') || url.includes("%"))
+    return true;
+  for (let i = 0; i < url.length; i++) {
+    const code = url.charCodeAt(i);
+    if (code <= 31 || code === 127)
+      return true;
+  }
+  return false;
+}
 var BROWSER_OPEN_GRACE_MS = 3e3;
-async function openBrowser(url, env = process.env) {
+async function openBrowser(url, env = process.env, os = platform3(), spawnImpl = spawn) {
   if ((env["HALFCYCLE_NO_BROWSER"] ?? "").trim() !== "") {
     return { opened: false, reason: "HALFCYCLE_NO_BROWSER is set in this environment" };
   }
   if (!isOpenableUrl(url)) {
     return { opened: false, reason: "the sign-in address is not an http(s) URL this CLI will open" };
   }
-  const { command, args: args2 } = browserOpenCommand(platform3(), url);
+  if (os === "win32" && hasWin32UnsafeOpenerChars(url)) {
+    return {
+      opened: false,
+      reason: 'the sign-in address holds a " or %, or a control character, this opener will not pass to cmd.exe on Windows'
+    };
+  }
+  const { command, args: args2, windowsVerbatimArguments } = browserOpenCommand(os, url);
   return new Promise((resolve4) => {
     let child;
     try {
-      child = spawn(command, args2, { stdio: "ignore", env });
+      child = spawnImpl(command, args2, { stdio: "ignore", env, windowsVerbatimArguments });
     } catch (err) {
       resolve4({
         opened: false,
@@ -3433,82 +3360,107 @@ function tryRefusal(body) {
   }
   return { status: candidate.status, message: candidate.message };
 }
+async function askControlOnce(tokenUrl, started) {
+  let body;
+  try {
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ deviceCode: started.deviceCode })
+    });
+    body = await res.json().catch(() => null);
+  } catch {
+    return null;
+  }
+  const parsed = devicePollResponseSchema.safeParse(body);
+  return parsed.success ? parsed.data : null;
+}
+function tokenUrlFor(serviceUrl) {
+  return `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
+}
+function localDeadline(started) {
+  return new Date(started.expiresAt).getTime() + started.pollIntervalMs * DEADLINE_SLACK_INTERVALS;
+}
 async function pollForCredential(serviceUrl, started, deps = {}) {
   const write = deps.write ?? defaultWrite;
   const sleep = deps.sleep ?? defaultSleep;
   const now = deps.now ?? Date.now;
-  const url = `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
+  const url = tokenUrlFor(serviceUrl);
   const interval = started.pollIntervalMs;
-  const deadline = new Date(started.expiresAt).getTime() + interval * DEADLINE_SLACK_INTERVALS;
+  const deadline = localDeadline(started);
   const startedAt = now();
   let announcedAt = startedAt;
   for (; ; ) {
-    let body;
-    let reachable = true;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: started.deviceCode })
-      });
-      body = await res.json().catch(() => null);
-    } catch {
-      reachable = false;
-    }
-    if (reachable) {
-      const parsed = devicePollResponseSchema.safeParse(body);
-      if (parsed.success) {
-        const answer = parsed.data;
-        if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
-          return answer;
-        if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
-          throw new SignInRefused(answer.status, answer.message);
-        }
+    const answer = await askControlOnce(url, started);
+    if (answer !== null) {
+      if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
+        return answer;
+      if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
+        throw new SignInRefused(answer.status, answer.message);
       }
     }
     if (now() >= deadline) {
       throw new SignInRefused(SIGN_IN_TIMED_OUT, SIGN_IN_TIMEOUT_MESSAGE);
     }
-    if (now() - announcedAt >= STILL_WAITING_MS) {
+    if (now() - announcedAt >= (deps.stillWaitingMs ?? STILL_WAITING_MS)) {
       announcedAt = now();
-      write(`[halfcycle] Still waiting for the browser (${Math.round((announcedAt - startedAt) / 1e3)}s). Code: ${started.userCode}
-`);
+      write(stillWaitingLine(announcedAt - startedAt, started));
     }
     await sleep(interval);
   }
 }
+function stillWaitingLine(elapsedMs, started) {
+  return `[halfcycle] Still waiting for the browser (${Math.round(elapsedMs / 1e3)}s). Code: ${started.userCode}
+`;
+}
 var LOOPBACK_TIMEOUT_MESSAGE = "Sign-in timed out: the browser never came back to this terminal. Nothing was created. Run the command again \u2014 or, if this machine cannot hand the browser back (a remote session, a container), run it with HALFCYCLE_NO_BROWSER=1 to use the code-based sign-in instead.";
-var LOOPBACK_COLLECT_ATTEMPTS = 3;
-async function collectDecidedCredential(serviceUrl, started, deps) {
-  const sleep = deps.sleep ?? defaultSleep;
-  const url = `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
-  let lastProblem = LOOPBACK_TIMEOUT_MESSAGE;
-  for (let attempt = 0; attempt < LOOPBACK_COLLECT_ATTEMPTS; attempt++) {
-    if (attempt > 0)
-      await sleep(started.pollIntervalMs);
-    let body;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: started.deviceCode })
-      });
-      body = await res.json().catch(() => null);
-    } catch (err) {
-      lastProblem = `The browser finished signing you in, but this terminal could not reach the Halfcycle service to collect the credential: ${err instanceof Error ? err.message : String(err)}. Run the command again.`;
-      continue;
+async function pollBesideLoopback(serviceUrl, started, wake, deps) {
+  const sleep = deps.sleep;
+  const now = deps.now ?? Date.now;
+  const url = tokenUrlFor(serviceUrl);
+  const deadline = localDeadline(started);
+  let arrived = false;
+  let spent = false;
+  let interrupt = null;
+  void wake.then(() => {
+    arrived = true;
+    if (interrupt !== null)
+      interrupt();
+  });
+  for (; ; ) {
+    const answer = await askControlOnce(url, started);
+    if (answer !== null) {
+      if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
+        return answer;
+      if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
+        throw new SignInRefused(answer.status, answer.message);
+      }
     }
-    const parsed = devicePollResponseSchema.safeParse(body);
-    if (!parsed.success)
+    if (now() >= deadline) {
+      throw new SignInRefused(SIGN_IN_TIMED_OUT, LOOPBACK_TIMEOUT_MESSAGE);
+    }
+    if (arrived && !spent) {
+      spent = true;
       continue;
-    const answer = parsed.data;
-    if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
-      return answer;
-    if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
-      throw new SignInRefused(answer.status, answer.message);
     }
+    if (sleep === void 0) {
+      await new Promise((resolve4) => {
+        const timer = setTimeout(resolve4, started.pollIntervalMs);
+        interrupt = () => {
+          clearTimeout(timer);
+          resolve4();
+        };
+      });
+    } else {
+      await new Promise((resolve4) => {
+        interrupt = resolve4;
+        void sleep(started.pollIntervalMs).then(resolve4);
+      });
+    }
+    interrupt = null;
+    if (arrived)
+      spent = true;
   }
-  throw new SignInRefused(SIGN_IN_TIMED_OUT, lastProblem);
 }
 async function signIn(serviceUrl, deps = {}) {
   const write = deps.write ?? defaultWrite;
@@ -3533,24 +3485,16 @@ async function signIn(serviceUrl, deps = {}) {
       const url = loopbackVerificationUrl(started.verificationUrl, bind.target);
       const attempt = await openBrowser(url, env);
       if (attempt.opened) {
-        write(`[halfcycle] Opened your browser to finish signing in. This terminal is waiting.
+        write(`[halfcycle] Opened your browser to finish signing in. Code: ${started.userCode}. This terminal is waiting.
 `);
-        const deadline = new Date(started.expiresAt).getTime() + started.pollIntervalMs * DEADLINE_SLACK_INTERVALS;
-        const callback = await bind.waitForCallback({
-          timeoutMs: deadline - now(),
-          onStillWaiting: (elapsed) => (
-            // NO CODE IN THIS LINE. The device-code path prints the code here
-            // because a human is comparing it; on this path there is nothing to
-            // compare and criterion 1 is that none is displayed AT ALL.
-            write(`[halfcycle] Still waiting for the browser (${Math.round(elapsed / 1e3)}s).
-`)
-          )
+        const startedAt = now();
+        const redirect = bind.waitForCallback({
+          timeoutMs: localDeadline(started) - startedAt,
+          onStillWaiting: (elapsed) => write(stillWaitingLine(elapsed, started)),
+          stillWaitingMs: deps.stillWaitingMs ?? STILL_WAITING_MS
         });
+        const approved = await pollBesideLoopback(serviceUrl, started, redirect.then(() => void 0), deps);
         await closeListener();
-        if (callback === null) {
-          throw new SignInRefused(SIGN_IN_TIMED_OUT, LOOPBACK_TIMEOUT_MESSAGE);
-        }
-        const approved = await collectDecidedCredential(serviceUrl, started, deps);
         write(`[halfcycle] Signed in as account ${approved.accountId} \u2014 continuing.
 `);
         return {
@@ -4214,7 +4158,7 @@ function armScript(credential, act, label, plainLabel, home) {
 }
 function identitySwitchRemedy(home, interactive) {
   const setOrRemove = `set HALFCYCLE_TOKEN for that account, or remove ${accountStorePath(home)}`;
-  return interactive ? `To act as a different account: run this again and answer "s" when asked, ${setOrRemove} to be asked for a sign-in next time.` : `To act as a different account: ${setOrRemove} and run this again with a terminal to sign in.`;
+  return interactive ? `To act as a different account: run this again and ${SWITCH_ACCOUNT_ANSWER}, ${setOrRemove} to be asked for a sign-in next time.` : `To act as a different account: ${setOrRemove} and run this again with a terminal to sign in.`;
 }
 async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
   const write = deps.write ?? ((text) => process.stdout.write(text));
@@ -4384,7 +4328,7 @@ async function mintBoardEnterCode(baseUrl, sessionToken) {
 
 // dist/probe-mcp.js
 var PROBE_TIMEOUT_MS = 5e3;
-async function probeMcpOrigin(mcpUrl) {
+async function probeMcpOrigin(mcpUrl, token) {
   const url = mcpEndpointUrl(mcpUrl);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
@@ -4392,32 +4336,71 @@ async function probeMcpOrigin(mcpUrl) {
   try {
     res = await fetch(url, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
       body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} }),
+      redirect: "manual",
       signal: controller.signal
     });
   } catch (err) {
     return {
       reached: false,
+      credentialRefused: false,
       problem: controller.signal.aborted ? `it did not answer within ${PROBE_TIMEOUT_MS / 1e3} seconds` : `it could not be reached (${err instanceof Error ? err.message : String(err)})`
     };
   } finally {
     clearTimeout(timer);
   }
   if (res.status === 404) {
-    return { reached: false, problem: "that address answered, but it serves no /mcp endpoint" };
+    return { reached: false, credentialRefused: false, problem: "that address answered, but it serves no /mcp endpoint" };
+  }
+  if (res.status === 401) {
+    return {
+      reached: false,
+      credentialRefused: true,
+      problem: "it answered, but refused this machine's Halfcycle credential"
+    };
+  }
+  if (res.status >= 300 && res.status < 400) {
+    return {
+      reached: false,
+      credentialRefused: false,
+      problem: `it redirected elsewhere (${res.status}), which is not followed, so the credential was not sent on`
+    };
   }
   if (!res.ok) {
-    return { reached: false, problem: `it answered ${res.status}` };
+    return { reached: false, credentialRefused: false, problem: `it answered ${res.status}` };
   }
   const body = await res.json().catch(() => null);
   const name = body?.result?.serverInfo?.name;
   if (typeof name !== "string" || name === "") {
-    return { reached: false, problem: "it answered, but not as an MCP server" };
+    return { reached: false, credentialRefused: false, problem: "it answered, but not as an MCP server" };
   }
   return { reached: true, serverName: name };
 }
 
+// dist/claude-version-probe.js
+import { execFileSync as execFileSync3 } from "node:child_process";
+function probeClaudeCodeVersion(timeoutMs, deps = {}) {
+  const platform4 = deps.platform ?? process.platform;
+  const exec = deps.exec ?? execFileSync3;
+  let raw;
+  try {
+    raw = platform4 === "win32" ? exec("cmd.exe", ["/d", "/s", "/c", '"claude --version"'], {
+      encoding: "utf-8",
+      timeout: timeoutMs,
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsVerbatimArguments: true
+    }) : exec("claude", ["--version"], {
+      encoding: "utf-8",
+      timeout: timeoutMs,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return void 0;
+  }
+  return /(\d+\.\d+\.\d+)/.exec(raw)?.[1];
+}
+
 // dist/build-record/write.js
 import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeSync } from "node:fs";
 import { basename as basename2, join as join6, resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
@@ -4993,7 +4976,7 @@ async function openPhase(credential, phase, entry, home) {
 }
 
 // dist/close-phase.js
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 var NO_STATEMENTS = { thesis: null, outcome: null, deviations: [] };
 function readCloseCommit(repoRoot) {
   if (repoRoot === void 0) {
@@ -5004,7 +4987,7 @@ function readCloseCommit(repoRoot) {
   }
   let out;
   try {
-    out = execFileSync3("git", ["-C", repoRoot, "rev-parse", "HEAD"], {
+    out = execFileSync4("git", ["-C", repoRoot, "rev-parse", "HEAD"], {
       encoding: "utf-8",
       env: gitEnvForNamedRepo(),
       stdio: ["ignore", "pipe", "ignore"]
@@ -5299,7 +5282,7 @@ function validate(options) {
   if (lexists(pinPath)) {
     try {
       const pin = JSON.parse(readFileSync8(pinPath, "utf-8"));
-      const id = isPlainObject2(pin) ? pin["engagementId"] : void 0;
+      const id = isPlainObject2(pin) ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
       engagementId = typeof id === "string" && id !== "" ? id : void 0;
     } catch {
       pinReadable = false;
@@ -5441,17 +5424,33 @@ function unmergeMcp(value, rec) {
   }
   return { changed, keptEntry };
 }
-function trimGitignore(targetRepo, text, rec, writeSet) {
+function gitignoreRules(targetRepo, writeSet) {
+  return {
+    rel: GITIGNORE_REL,
+    header: GITIGNORE_HEADER,
+    ourLines: writeSet.gitignoreLines,
+    keepLine: (line) => coveredPathExists(targetRepo, line)
+  };
+}
+function gitattributesRules(writeSet) {
+  return {
+    rel: GITATTRIBUTES_REL,
+    header: GITATTRIBUTES_HEADER,
+    ourLines: writeSet.gitattributesLines,
+    keepLine: () => false
+  };
+}
+function trimAppendedBlocks(text, rec, rules) {
   const keptLines = [];
   const foreignLines = [];
   let current = text;
   for (const block of [...rec.appended].reverse()) {
     const lines = block.split("\n").filter((line) => line !== "");
-    const foreign = lines.filter((line) => !writeSet.gitignoreLines.has(line));
+    const foreign = lines.filter((line) => !rules.ourLines.has(line));
     foreignLines.push(...foreign);
-    const ours = lines.filter((line) => writeSet.gitignoreLines.has(line));
-    const entries = ours.filter((line) => line !== GITIGNORE_HEADER);
-    const kept = entries.filter((line) => coveredPathExists(targetRepo, line));
+    const ours = lines.filter((line) => rules.ourLines.has(line));
+    const entries = ours.filter((line) => line !== rules.header);
+    const kept = entries.filter((line) => rules.keepLine(line));
     keptLines.push(...kept);
     if (kept.length === 0 && foreign.length === 0 && current.includes(block)) {
       const at = current.lastIndexOf(block);
@@ -5459,13 +5458,13 @@ function trimGitignore(targetRepo, text, rec, writeSet) {
       continue;
     }
     const separated = block.startsWith("\n") || block.includes("\n\n");
-    const removable = ours.filter((line) => line === GITIGNORE_HEADER ? kept.length === 0 && foreign.length === 0 : !kept.includes(line));
+    const removable = ours.filter((line) => line === rules.header ? kept.length === 0 && foreign.length === 0 : !kept.includes(line));
     for (const line of removable) {
       const fileLines = current.split("\n");
       const at = fileLines.lastIndexOf(line);
       if (at < 0)
         continue;
-      const withSeparator = line === GITIGNORE_HEADER && separated && at > 0 && fileLines[at - 1] === "";
+      const withSeparator = line === rules.header && separated && at > 0 && fileLines[at - 1] === "";
       fileLines.splice(withSeparator ? at - 1 : at, withSeparator ? 2 : 1);
       current = fileLines.join("\n");
     }
@@ -5557,7 +5556,13 @@ function uninstall(options) {
       continue;
     removeEmptyCreatedDir(targetRepo, dir, writeSet, result, name);
   }
-  trimGitignoreFile(targetRepo, manifest.gitignore, writeSet, result, name);
+  const keptIgnoreLines = trimAppendedFile(targetRepo, manifest.gitignore, gitignoreRules(targetRepo, writeSet), result, name);
+  for (const line of keptIgnoreLines) {
+    result.keptIgnoreLines.push(`${line.trim()} \u2014 ${line.trim().replace(/^\//, "")} still exists`);
+  }
+  if (manifest.gitattributes !== void 0) {
+    trimAppendedFile(targetRepo, manifest.gitattributes, gitattributesRules(writeSet), result, name);
+  }
   const credential = handleCredential(options, checked);
   const credentialFailed = credential.kind === "failed";
   if (result.failed.length === 0 && !credentialFailed) {
@@ -5671,40 +5676,39 @@ function removeEmptyCreatedDir(targetRepo, dir, writeSet, lists, name) {
     name(lists.failed, `${dir}/`, dir);
   }
 }
-function trimGitignoreFile(targetRepo, rec, writeSet, lists, name) {
+function trimAppendedFile(targetRepo, rec, rules, lists, name) {
+  const { rel } = rules;
   if (rec.appended.length === 0)
-    return;
-  if (symlinkOnPath(targetRepo, GITIGNORE_REL)) {
-    name(lists.leftAlone, `${GITIGNORE_REL} (a symbolic link \u2014 not followed)`, GITIGNORE_REL);
-    return;
+    return [];
+  if (symlinkOnPath(targetRepo, rel)) {
+    name(lists.leftAlone, `${rel} (a symbolic link \u2014 not followed)`, rel);
+    return [];
   }
-  const path = join8(targetRepo, GITIGNORE_REL);
+  const path = join8(targetRepo, rel);
   let before;
   try {
     before = readFileSync8(path, "utf-8");
   } catch {
-    return;
+    return [];
   }
-  const { text, keptLines, foreignLines } = trimGitignore(targetRepo, before, rec, writeSet);
+  const { text, keptLines, foreignLines } = trimAppendedBlocks(before, rec, rules);
   for (const line of foreignLines) {
-    name(lists.leftAlone, `${GITIGNORE_REL}: the line ${JSON.stringify(line)} (Halfcycle never writes it, so it was kept)`);
-  }
-  for (const line of keptLines) {
-    lists.keptIgnoreLines.push(`${line.trim()} \u2014 ${line.trim().replace(/^\//, "")} still exists`);
+    name(lists.leftAlone, `${rel}: the line ${JSON.stringify(line)} (Halfcycle never writes it, so it was kept)`);
   }
   if (text === before)
-    return;
+    return keptLines;
   try {
     if (text === "" && rec.created) {
       rmSync3(path);
-      name(lists.removed, GITIGNORE_REL, GITIGNORE_REL);
+      name(lists.removed, rel, rel);
     } else {
       writeFileSync5(path, text, "utf-8");
-      name(lists.restored, GITIGNORE_REL, GITIGNORE_REL);
+      name(lists.restored, rel, rel);
     }
   } catch {
-    name(lists.failed, GITIGNORE_REL, GITIGNORE_REL);
+    name(lists.failed, rel, rel);
   }
+  return keptLines;
 }
 function handleCredential(options, checked) {
   const { removeCredential, home } = options;
@@ -5820,7 +5824,6 @@ function renderUninstallReport(result, home) {
 }
 
 // dist/banner-facts.js
-import { execFileSync as execFileSync4 } from "node:child_process";
 import { readFileSync as readFileSync9 } from "node:fs";
 import { basename as basename3, join as join9, resolve as resolve3 } from "node:path";
 var BRAND_URL = "halfcycle.ai";
@@ -5841,17 +5844,8 @@ function bundleVersion() {
     return void 0;
   }
 }
-function claudeCodeVersion() {
-  try {
-    const raw = execFileSync4("claude", ["--version"], {
-      encoding: "utf-8",
-      timeout: 3e3,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    return /(\d+\.\d+\.\d+)/.exec(raw)?.[1];
-  } catch {
-    return void 0;
-  }
+function claudeCodeVersion(deps = {}) {
+  return probeClaudeCodeVersion(3e3, deps);
 }
 var REAL_PROBES = {
   bundleVersion,
@@ -5952,21 +5946,10 @@ function compareVersions(a, b) {
   }
   return 0;
 }
-function reportClaudeCodeVersion(verbose2) {
-  let raw;
-  try {
-    raw = execFileSync5("claude", ["--version"], {
-      encoding: "utf-8",
-      timeout: 5e3,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
-    return;
-  }
-  const found = /(\d+\.\d+\.\d+)/.exec(raw);
-  if (!found)
+function reportClaudeCodeVersion(verbose2, deps = {}) {
+  const version = probeClaudeCodeVersion(5e3, deps);
+  if (version === void 0)
     return;
-  const version = found[1];
   if (compareVersions(version, MIN_HEADERS_HELPER_VERSION) >= 0) {
     if (verbose2) {
       process.stdout.write(`[halfcycle] Claude Code ${version} detected \u2014 new enough for the credential helper.
@@ -6008,6 +5991,15 @@ function isHalfcycleMonorepo(dir) {
     return false;
   }
 }
+function isHomeFolder(dir) {
+  try {
+    const target = realpathSync(dir);
+    const home = realpathSync(homedir3());
+    return process.platform === "win32" ? target.toLowerCase() === home.toLowerCase() : target === home;
+  } catch {
+    return false;
+  }
+}
 var RETIRED_VERBS = /* @__PURE__ */ new Map([
   ["ci", '"ci" was removed \u2014 CI setup is part of your project, not Halfcycle']
 ]);
@@ -6047,6 +6039,12 @@ ${USAGE}`);
   product's own source tree \u2014 installing here would write over tracked files.
   To see what this CLI does:      halfcycle --help
   To install into a real project: halfcycle <path-to-that-repo>
+`);
+      process.exit(1);
+      return;
+    }
+    if (isHomeFolder(targetRepo)) {
+      process.stderr.write(`halfcycle: refusing to set up in your home folder (${targetRepo}). Run "npx halfcycle" inside a project folder.
 `);
       process.exit(1);
       return;
@@ -6189,12 +6187,16 @@ ${USAGE}`);
 `);
       }
       if (credential) {
-        const probe = await probeMcpOrigin(credential.mcpUrl);
+        const probe = await probeMcpOrigin(credential.mcpUrl, credential.token);
         if (probe.reached) {
           if (verbose) {
             process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
 `);
           }
+        } else if (probe.credentialRefused) {
+          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 ${probe.problem}.
+[halfcycle] The address is right, but the Halfcycle commands will have no method context until it accepts this machine's credential. Re-run "npx halfcycle" in this folder; if it says this again, the refusal is on Halfcycle's side, not in this project.
+`);
         } else {
           process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
 [halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not the CONTROL origin (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
@@ -6204,11 +6206,11 @@ ${USAGE}`);
       if (credential && verbose) {
         process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_COVERAGE_REQUIRED_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
 `);
-        process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
+        process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through the Halfcycle runner in ${VENDORED_BIN_REL}, so there is no token in this tree to commit and nothing for you to export.
 `);
-        process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
+        process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the connection runs a command from this project, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
 `);
-        process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
+        process.stdout.write(`[halfcycle] If Halfcycle reads as not connected, or every call returns 401, the connection could not read GUARD_SERVICE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
 `);
       }
       if (credential === void 0 && notThisAccountMessage !== void 0) {
@@ -6228,10 +6230,13 @@ ${USAGE}`);
       if (result.notShared)
         process.stdout.write(`${renderNotShared(result.notShared)}
 `);
+      if (credential) {
+        process.stdout.write("[halfcycle] Commit the files Halfcycle set up here, so every copy of this project runs the same checks.\n");
+      }
       if (credential) {
         process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
-        process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
+        process.stdout.write(`[halfcycle] Claude Code will then ask whether to use a new MCP server. The cursor starts on "Continue without using this MCP server" \u2014 choose to use it instead; without it Halfcycle will not connect.
 `);
       }
       if (credential) {