halfcycle 0.3.35 → 0.3.37

package/dist/install.d.ts

@@ -21,7 +21,7 @@
  * (E1-T-09). The name is deliberately innocuous — it discloses nothing about
  * Halfcycle's scaffold contents.
  */
-import { SETTINGS_REL, WRITE_CAPABLE_TOOLS } from '@halfcycle/core';
+import { BUNDLE_PIN_REL, MCP_REGISTRATION_REL, MCP_SERVER_KEY, SETTINGS_REL, WRITE_CAPABLE_TOOLS } from '@halfcycle/core';
 export type EngagementType = 'self-build' | 'client';
 export interface BundlePin {
     version: string;
@@ -279,8 +279,8 @@ export declare const ZONE_B_DIR = ".workbench";
  * depending on build mode — see the comment above `findBundleRoot`).
  */
 export declare const BUNDLE_ROOT: string;
-/** The committed pin. */
-export declare const BUNDLE_PIN_REL = ".halfcycle/bundle.json";
+/** The committed pin. Its one home is `@halfcycle/core`; re-exported for the uninstaller. */
+export { BUNDLE_PIN_REL };
 /**
  * The three files the installer merges into rather than owns. `SETTINGS_REL` lives
  * with the hook table in `@halfcycle/core` and is re-exported here, as is
@@ -288,6 +288,8 @@ export declare const BUNDLE_PIN_REL = ".halfcycle/bundle.json";
  */
 export { SETTINGS_REL, WRITE_CAPABLE_TOOLS };
 export declare const GITIGNORE_REL = ".gitignore";
+/** The attributes file the installer appends its line-ending rules to. */
+export declare const GITATTRIBUTES_REL = ".gitattributes";
 export interface ClosedWriteSet {
     /** Files the installer writes whole. */
     readonly files: ReadonlySet<string>;
@@ -303,6 +305,8 @@ export interface ClosedWriteSet {
     readonly denyRuleSha256: ReadonlySet<string>;
     /** Every line the installer appends to `.gitignore`. */
     readonly gitignoreLines: ReadonlySet<string>;
+    /** Every line the installer appends to `.gitattributes`, retired scripts' included. */
+    readonly gitattributesLines: ReadonlySet<string>;
 }
 /**
  * THE CLOSED WRITE SET, derived from the same constants the installer writes with
@@ -312,8 +316,11 @@ export interface ClosedWriteSet {
  * deny rule or a `.gitignore` line is taken out only if the manifest records it AND
  * it is one the installer generates: `HALFCYCLE_HOOK_COMMANDS` (the hook table's
  * commands plus the retired ones — the set `generateSettingsJson` builds from), the
- * hashes of `DENY_PATTERNS`, and the `.gitignore` header plus
- * `REQUIRED_GITIGNORE_ENTRIES` plus the `.env.local` line older versions wrote.
+ * hashes of `DENY_PATTERNS`, the `.gitignore` header plus
+ * `REQUIRED_GITIGNORE_ENTRIES` plus the `.env.local` line older versions wrote, and
+ * the `.gitattributes` header plus one LF rule per generated `.sh` path, current
+ * (`OWNED_GENERATED_HEADERS`) OR retired (`RETIRED_WRITE_SET_FILES`) — so a rule an
+ * earlier version wrote for a script a later one retires is still recognised.
  * Without it a crafted manifest could name a developer's own hook, deny rule or
  * ignore line and have uninstall delete it.
  *
@@ -324,9 +331,10 @@ export interface ClosedWriteSet {
  * that is not removed, whatever else it says.
  *
  * DERIVED, NOT LISTED. The command stubs come from `plugin.json`'s `commands[]`, the
- * same array `copyManifestCommands` copies from; the hook scripts and the headers
- * helper from `OWNED_GENERATED_HEADERS`, the table the owned-generated writes key
- * on; the rest from the named constants their writers use. The directories are the
+ * same array `copyManifestCommands` copies from; the hook scripts from
+ * `OWNED_GENERATED_HEADERS`, the table the owned-generated writes key on; the retired
+ * headers helper from `RETIRED_WRITE_SET_FILES`; the rest from the named constants
+ * their writers use. The directories are the
  * ancestors of every member, so a new file under a new directory brings its
  * directory with it. The writer and the remover therefore cannot hold two lists.
  */
@@ -419,8 +427,11 @@ export declare const USER_PROMPT_REMINDER_SENTENCE: string;
  * protecting anyone: see DENY_PATTERNS for what these nine do and do not cover.
  */
 export declare function generateSettingsJson(): string;
-/** What `removeLegacyCiStanza` found on disk and did about it. */
-export type CiStanzaRemoval = 'removed' | 'kept-foreign' | 'kept-uncommitted' | 'absent' | 'failed';
+/**
+ * What a retired generated file's removal found on disk and did about it
+ * (`removeLegacyCiStanza`, `removeRetiredMcpHeadersHelper`).
+ */
+export type RetiredFileRemoval = 'removed' | 'kept-foreign' | 'kept-uncommitted' | 'absent' | 'failed';
 /**
  * Delete `.halfcycle/ci-stanza.yml` when, and only when, BOTH hold (R-25 fix
  * wave, F1): its opening line hashes to exactly one generation this installer
@@ -444,7 +455,7 @@ export type CiStanzaRemoval = 'removed' | 'kept-foreign' | 'kept-uncommitted' |
  * reported, never thrown. Cleaning up a file this task retires must not fail an
  * otherwise-successful install.
  */
-export declare function removeLegacyCiStanza(targetRepo: string): CiStanzaRemoval;
+export declare function removeLegacyCiStanza(targetRepo: string): RetiredFileRemoval;
 /**
  * **THE INSTALLER WRITES NO `.env.example`, AND THIS IS WHERE THAT GENERATOR WAS.**
  *
@@ -493,13 +504,21 @@ export declare function removeLegacyCiStanza(targetRepo: string): CiStanzaRemova
  * key from the store makes every already-installed repository read as credential-less
  * on its next run and silently join a fresh credential.
  */
-/** The project-scoped MCP registration file — `.mcp.json` at the repo root, the
- * Claude Code convention. Root-level, so it is a distinct allowlist entry. */
-export declare const MCP_REGISTRATION_REL = ".mcp.json";
-/** The key the Halfcycle server is registered under inside `.mcp.json`'s
- *  `mcpServers` — one home, because two generated shell scripts now look for it and
- *  a literal typed twice is a literal that can disagree with itself. */
-export declare const MCP_SERVER_KEY = "halfcycle";
+export { MCP_REGISTRATION_REL, MCP_SERVER_KEY };
+/**
+ * Delete the retired `.halfcycle/mcp-headers.sh` when, and only when, BOTH hold —
+ * the rule `removeLegacyCiStanza` follows, applied to this path
+ * (`windows-client-seat`, AC5): its second line hashes to one of
+ * `MCP_HEADERS_KNOWN_HEADER_HASHES`, AND `isTrackedAndClean` holds. Anything else is
+ * KEPT and reported, never deleted. A committed edit below an untouched header passes
+ * both keys and is deleted; accepted, because git history keeps it.
+ *
+ * CALLED ONLY AFTER `.mcp.json` HAS BEEN REWRITTEN to `MCP_HEADERS_HELPER_COMMAND`.
+ * Until then the old registration still names this script, and deleting it would
+ * take the credential away from a session that has not been migrated. An install
+ * with no MCP origin rewrites no registration, so it removes nothing.
+ */
+export declare function removeRetiredMcpHeadersHelper(targetRepo: string): RetiredFileRemoval;
 /**
  * THE ONE HOME of *which generated files this installer claims as its own, and by
  * what evidence* (#1103). Every entry is a client-tree path this package
@@ -533,13 +552,16 @@ export declare const MCP_SERVER_KEY = "halfcycle";
  * generation (`#1112`). T-25 removed the generator itself; the four forms' hashes
  * now live in `CI_STANZA_KNOWN_HEADER_HASHES`, evidence for a REMOVAL rather than
  * a write.
+ *
+ * `.halfcycle/mcp-headers.sh` LEFT this table (`windows-client-seat`): nothing writes
+ * it any more. Its path is in `RETIRED_WRITE_SET_FILES` and its two header forms'
+ * hashes in `MCP_HEADERS_KNOWN_HEADER_HASHES`, the same move the CI stanza made.
  */
 export declare const OWNED_GENERATED_HEADERS: {
     readonly '.claude/hooks/guard-runner.sh': "# Governance hook wrapper — generated by";
     readonly '.claude/hooks/user-prompt-reminder.sh': "# UserPromptSubmit house-rule reminder — generated by";
     readonly '.claude/hooks/session-end-marker.sh': "# Session-end marker cleanup — generated by";
     readonly '.claude/hooks/session-start-marker.sh': "# Session-start marker — generated by";
-    readonly '.halfcycle/mcp-headers.sh': "# Halfcycle MCP connection headers — generated by";
 };
 /**
  * The header line every `.gitignore` block this installer appends opens with. One
@@ -547,6 +569,13 @@ export declare const OWNED_GENERATED_HEADERS: {
  * is what lets a first-manifest run claim the blocks an older version appended.
  */
 export declare const GITIGNORE_HEADER = "# Halfcycle \u2014 machine-local secrets/state and Zone-B (never push to client remote)";
+/**
+ * The header line every `.gitattributes` block this installer appends opens with
+ * (`windows-install-hygiene.md`, AC1). Git for Windows usually clones with
+ * `core.autocrlf=true`, which would check the generated bash scripts out with CR
+ * line endings; the rules under this header pin them to LF in every clone.
+ */
+export declare const GITATTRIBUTES_HEADER = "# Halfcycle \u2014 generated scripts keep LF line endings";
 /**
  * Read the pinned bundle.json from a target repo and compare its version
  * against the current bundle version. Returns the installed pin if present.
@@ -641,8 +670,8 @@ export declare function readBundlePin(targetRepoRoot: string): BundlePin | null;
  *     either way. Reading the process environment for a secret here is still the one
  *     thing the paragraph below exists to prevent, and is still not done.
  *
- * PARSES, NEVER SOURCES — a credential store is not code, exactly as the generated
- * `mcp-headers.sh` treats it.
+ * PARSES, NEVER SOURCES — a credential store is not code, exactly as the runner's
+ * `mcp-headers` verb treats it (through core's `parseEnvText`).
  */
 export declare function readPinnedEngagement(targetRepoRoot: string, home?: string): {
     engagementId: string;
@@ -666,8 +695,9 @@ export declare function checkDrift(targetRepoRoot: string): {
  * 4. vendored guard binary → .halfcycle/bin/bin.bundle.mjs (self-contained)
  * 5. Governance-hook wiring (.claude/settings.json, guard-runner.sh,
  *    session-start-marker.sh, user-prompt-reminder.sh)
- * 6. (nothing) — no CI stanza (removed at T-25); the MCP registration and the
- *    connection-headers helper it names (credentialed installs only — T-24).
+ * 6. (nothing) — no CI stanza (removed at T-25); the MCP registration
+ *    (credentialed installs only — T-24), then the retired connection-headers
+ *    helper's removal (`windows-client-seat`).
  *    NO env scaffold either: the installer writes no `.env.example` at all
  *    (operator decision, 2026-08-30)
  * 7. .gitignore + project identity + the engagement credential (OUTSIDE the tree,

package/dist/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAGL,YAAY,EAEZ,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAyCzB,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kFAAkF;IAClF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,oBAAoB,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE;;;;;OAKG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAa1D;AAMD,6EAA6E;AAC7E,eAAO,MAAM,UAAU,eAAe,CAAC;AAiCvC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAA4B,CAAC;AAoGrD,yBAAyB;AACzB,eAAO,MAAM,cAAc,2BAA2B,CAAC;AAOvD;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC7C,eAAO,MAAM,aAAa,eAAe,CAAC;AAoB1C,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9C;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,cAAc,IAAI,cAAc,CA8B/C;AAyTD;;;;;;;;;GASG;AACH,KAAK,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AA+FtD;;;oFAGoF;AACpF,wBAAgB,UAAU,CACxB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CA0Bb;AAsND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAU1C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,QAG0C,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAqB7C;AAghBD,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAyCpG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAqBxE;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAMH;8EAC8E;AAC9E,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD;;wEAEwE;AACxE,eAAO,MAAM,cAAc,cAAc,CAAC;AA0I1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,uBAAuB;;;;;;CAM1B,CAAC;AA2RX;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,4FACyD,CAAC;AA4NvF;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAItE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC;2EACuE;IACvE,kBAAkB,EAAE,OAAO,CAAC;CAC7B,GAAG,IAAI,CAuBP;AA+ED,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMlH;AAmRD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA+Z7E"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EACL,cAAc,EAGd,oBAAoB,EACpB,cAAc,EACd,YAAY,EAEZ,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AA0CzB,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kFAAkF;IAClF,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mFAAmF;IACnF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,oBAAoB,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE;;;;;OAKG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAa1D;AAMD,6EAA6E;AAC7E,eAAO,MAAM,UAAU,eAAe,CAAC;AAiCvC;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAA4B,CAAC;AAqGrD,6FAA6F;AAC7F,OAAO,EAAE,cAAc,EAAE,CAAC;AAO1B;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC7C,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAsClD,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,IAAI,cAAc,CAkC/C;AA0UD;;;;;;;;;GASG;AACH,KAAK,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AA+FtD;;;oFAGoF;AACpF,wBAAgB,UAAU,CACxB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,GACd,WAAW,CA0Bb;AAsND;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAU1C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,QAG0C,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAqB7C;AAifD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAyCvG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAE3E;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAUH,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC;AA+FhD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAEpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,uBAAuB;;;;;CAK1B,CAAC;AAiGX;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,4FACyD,CAAC;AAgFvF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8DAAyD,CAAC;AA8M3F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAItE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,MAAM,GACZ;IACD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACzC;2EACuE;IACvE,kBAAkB,EAAE,OAAO,CAAC;CAC7B,GAAG,IAAI,CAuBP;AA+ED,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMlH;AAmRD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAmc7E"}

package/dist/loopback-signin.d.ts

@@ -3,7 +3,10 @@
  *
  * `npx halfcycle` binds an ephemeral port on `127.0.0.1`, hands that port to the
  * confirmation page through the URL it opens, and waits for the page to redirect the
- * browser back to it. No code is displayed, nothing is compared, and nothing polls.
+ * browser back to it. The redirect is a WAKE-UP, not the answer: `device-signin.ts`
+ * polls control beside this wait (walk F3, 2026-10-08), so a sign-in approved on
+ * another tab or device completes without it, and the credential is only ever
+ * collected by that one poll loop. This module never calls control.
  *
  * ---------------------------------------------------------------------------
  * WHY THE OLD FLOW IS NOT SIMPLY BETTER-DOCUMENTED. The device-code flow showed the
@@ -96,7 +99,10 @@ export interface LoopbackListener {
     /**
      * Wait for the browser. Resolves with the callback, or `null` when `timeoutMs`
      * elapses first — a timeout is a fact the caller words, not an error this module
-     * throws.
+     * throws. `close()` also ends a wait in progress with `null`: the caller's poll can
+     * finish the sign-in while this is still waiting, and a wait nobody can end would
+     * keep its timer and its still-waiting ticker alive after the terminal said
+     * *Signed in*.
      */
     waitForCallback(opts: {
         timeoutMs: number;

package/dist/loopback-signin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback-signin.d.ts","sourceRoot":"","sources":["../src/loopback-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAIH,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,+DAA+D;QAC/D,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAKxE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAoG7C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIzE;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EAChD,YAAY,CAAC,EAAE,MAAM,GACpB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAmCvD;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAuE9B"}
+{"version":3,"file":"loopback-signin.d.ts","sourceRoot":"","sources":["../src/loopback-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAIH,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,+DAA+D;QAC/D,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAKxE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAqG7C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIzE;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EAChD,YAAY,CAAC,EAAE,MAAM,GACpB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAmCvD;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,mBAAmB,CAAC,CA8E9B"}

package/dist/open-phase.d.ts

@@ -97,7 +97,8 @@ export interface RepoCredential {
  * engagement this is*.
  *
  * READ, NEVER SOURCED — a credential store is not code, and this parses `KEY=value`
- * lines exactly as the generated `mcp-headers.sh` does. The process environment WINS
+ * lines with core's `parseEnvText`, exactly as the runner's `mcp-headers` verb does
+ * (the editor's headers command since `windows-client-seat`). The process environment WINS
  * when it carries a key, so an operator can point one command at a different plane
  * without editing a file, and a CI job with no per-user store works by exporting
  * them.

package/dist/open-phase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-phase.d.ts","sourceRoot":"","sources":["../src/open-phase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAY3B;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,MAAM,EAAE,MAAM;aAEd,OAAO,EAAE,MAAM,GAAG,IAAI;gBAFtB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kFAItB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,CAAC,EAAE,MAAM,GACZ,cAAc,CA4BhB;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,iBAAiB,GAAG,IAAI,CAmB1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAyEtB"}
+{"version":3,"file":"open-phase.d.ts","sourceRoot":"","sources":["../src/open-phase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAY3B;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,yEAAyE;QACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,MAAM,EAAE,MAAM;aAEd,OAAO,EAAE,MAAM,GAAG,IAAI;gBAFtB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kFAItB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,CAAC,EAAE,MAAM,GACZ,cAAc,CA4BhB;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,iBAAiB,GAAG,IAAI,CAmB1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,kBAAkB,EACzB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAyEtB"}

package/dist/probe-mcp.d.ts

@@ -16,11 +16,36 @@
  * restarting would be worse than saying so. Same degrade posture as the board
  * mint in `bin.ts`.
  *
- * **`initialize` is the probe** because it is the one MCP call that needs no
- * credential and identifies the server: a wrong origin 404s, a right one answers
- * with its `serverInfo`. The alternative — a plain `GET /health` — would prove an
- * origin is alive without proving it serves MCP, which is exactly the distinction
- * that was missing.
+ * **`initialize` is the probe** because it identifies the server: a wrong
+ * origin 404s, a right one answers with its `serverInfo`. The alternative — a
+ * plain `GET /health` — would prove an origin is alive without proving it serves
+ * MCP, which is exactly the distinction that was missing.
+ *
+ * **It carries this machine's credential** (`windows-client-seat` AC4). This
+ * docblock used to say `initialize` was chosen because it needs no credential.
+ * That stops being true when delivery checks the bearer before any method runs,
+ * so the probe sends the same `Authorization: Bearer <token>` the editor's
+ * headers command sends. Three consequences, each deliberate:
+ *
+ *  - **A 401 is its own outcome, not "unreachable".** The address answered, so
+ *    the address is right; what was refused is the credential. The call site
+ *    in `bin.ts` prints a different line for it, because the unreachable line
+ *    tells the developer the service is down and to wait.
+ *  - **Today's delivery still reads reachable.** It answers `initialize`
+ *    without looking at the header, and an extra header changes nothing. This
+ *    matters because the CLI that sends it publishes BEFORE delivery starts
+ *    refusing.
+ *  - **The credential goes to the recorded origin and nowhere else.** The URL
+ *    is composed by `mcpEndpointUrl` from the same origin `.mcp.json` names, and
+ *    redirects are NOT followed (`redirect: 'manual'`): a 3xx is reported, never
+ *    chased, so no other host is ever sent the bearer by this call, whatever
+ *    the fetch implementation does with `Authorization` across a redirect. A
+ *    redirect is also not a working registration — a client that followed it
+ *    would arrive at an origin the credential was not issued for — so calling
+ *    it unreachable is the honest answer, not a lost case.
+ *
+ * The token never appears in a returned sentence: every `problem` below is
+ * built from the status, the timeout and the transport error's message only.
  *
  * INV-001: Node builtins and the global `fetch` only. No hosted import.
  */
@@ -30,9 +55,14 @@ export type McpProbe =
     reached: true;
     serverName: string;
 }
-/** It did not. `problem` is a plain-words sentence naming what happened. */
+/**
+ * It did not. `problem` is a plain-words sentence naming what happened.
+ * `credentialRefused` is true for exactly one answer — a 401 — where the
+ * address is right and the credential is what was turned away.
+ */
  | {
     reached: false;
+    credentialRefused: boolean;
     problem: string;
 };
 /**
@@ -42,6 +72,8 @@ export type McpProbe =
  *                is composed by `mcpEndpointUrl` — the SAME function that composes
  *                the literal url written into `.mcp.json` (T-24), so this probe
  *                cannot report an address the registration does not use.
+ * @param token   This machine's credential for the project — the value the
+ *                editor's headers command sends. Sent to that endpoint only.
  */
-export declare function probeMcpOrigin(mcpUrl: string): Promise<McpProbe>;
+export declare function probeMcpOrigin(mcpUrl: string, token: string): Promise<McpProbe>;
 //# sourceMappingURL=probe-mcp.d.ts.map

package/dist/probe-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probe-mcp.d.ts","sourceRoot":"","sources":["../src/probe-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH,MAAM,MAAM,QAAQ;AAClB,4FAA4F;AAC1F;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACvC,4EAA4E;GAC1E;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuCtE"}
+{"version":3,"file":"probe-mcp.d.ts","sourceRoot":"","sources":["../src/probe-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAQH,MAAM,MAAM,QAAQ;AAClB,4FAA4F;AAC1F;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AACvC;;;;GAIG;GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4DrF"}

package/dist/uninstall.d.ts

@@ -20,7 +20,7 @@
  *      template an earlier version wrote (`removeLegacyCiStanza`, which carries its
  *      own two keys: an exact known header and a clean committed copy);
  *   4. remove the directories an install created, deepest first, when empty;
- *   5. trim `.gitignore`;
+ *   5. trim `.gitignore`, then `.gitattributes`;
  *   6. remove this machine's credential for the project, if asked;
  *   7. only when nothing so far failed: the pin, the manifest, then `.halfcycle/`.
  * A failure at 3–6 therefore leaves the pin and the manifest in place, and a rerun

package/dist/uninstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../src/uninstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAsCH,2BAA2B;AAC3B,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9D,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAc7G;AAwWD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CA6HpE;AA+OD,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmEhH"}
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../src/uninstall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAyCH,2BAA2B;AAC3B,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,aAAa,CAAC;IAC9D,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAc7G;AA6YD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAoIpE;AA+OD,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmEhH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.35",
+  "version": "0.3.37",
   "description": "Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.",
   "keywords": [
     "claude",