halfcycle 0.3.36 → 0.3.38

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.36",
+  "version": "0.3.38",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/README.md

@@ -146,6 +146,8 @@ This matters enough to be specific about.
 
 **Halfcycle never holds or proxies your Claude credential.** Inference runs on your own Claude Code, on your own subscription or seats. We are not a hosted runtime reselling you inference.
 
+**Your own Halfcycle credential lives outside this repository, in a file named `env` under your home directory — never in anything you'd commit.** Closing a phase rewrites it, to clear which phase was open, and it is also renewed there automatically to keep your connection current. Nothing else changes it.
+
 **What the checks receive is the shape of a change, not its contents.** File paths, structural shapes, environment variable names and how they are used, the tables a write touches, route signatures, outbound host names. There is no file body and no diff in the request.
 
 **Source excerpts are off, at both ends, for every engagement today.** The wire format does have a field for them, so the honest version of this is a conditional statement rather than a flat one, and it rests on three things rather than on our good intentions: your runner does not attach an excerpt unless you turn a flag on, and that flag is off by default; anything that does arrive for an engagement that has not opted in is stripped on our side before the checks or any model see it; and there is no way to opt in today, because nothing in the product can set that flag. If that ever changes, our privacy policy changes with it, and it is the policy — not this paragraph — that states the guarantee.
@@ -191,7 +193,9 @@ npx halfcycle
 
 Then open the folder in Claude Code and run `/halfcycle-setup`, and answer the questions it asks about your project.
 
-**Accept the workspace trust prompt when Claude Code shows it.** The install writes a credential helper and a set of hooks that are shell commands, so Claude Code asks before it runs them. It is expected, and it appears once.
+**Accept the workspace trust prompt when Claude Code shows it.** The install writes a credential helper and a set of hooks that are shell commands, so Claude Code asks before it runs them. It is expected.
+
+**A second prompt follows — it is not the trust prompt again.** After you accept the trust prompt, Claude Code asks whether to use a new MCP server. The cursor starts on *Continue without using this MCP server*; choose to use the server instead, or Halfcycle will not connect.
 
 You will get a board link on install. That is where the work becomes visible to anyone who is not you.
 

package/bin/bin.bundle.mjs

@@ -14749,6 +14749,10 @@ function looksLikeSecret(text) {
   return false;
 }
 
+// ../core/dist/mcp-registration.js
+var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_SERVER_KEY = "halfcycle";
+
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
 function resolveControlOrigin(env) {
@@ -15285,7 +15289,9 @@ var engagementCredentialResponseSchema = external_exports.object({
   sessionToken: external_exports.string(),
   mcpUrl: external_exports.string(),
   guardUrl: external_exports.string(),
-  controlTelemetryUrl: external_exports.string()
+  controlTelemetryUrl: external_exports.string(),
+  methodVersion: external_exports.string().optional(),
+  consoleUrl: external_exports.string().optional()
 }).strict();
 var ciTokenExchangeResponseSchema = external_exports.object({
   token: external_exports.string(),
@@ -15295,6 +15301,22 @@ var ciTokenExchangeResponseSchema = external_exports.object({
 var NO_CREDENTIAL_PLACEHOLDER = "halfcycle:no-credential";
 var NOT_THIS_ACCOUNT_PLACEHOLDER = "halfcycle:not-this-account";
 var UPDATE_CLAUDE_CODE_PLACEHOLDER = "halfcycle:update-claude-code";
+var CREDENTIAL_PLACEHOLDERS = [
+  NO_CREDENTIAL_PLACEHOLDER,
+  NOT_THIS_ACCOUNT_PLACEHOLDER,
+  UPDATE_CLAUDE_CODE_PLACEHOLDER
+];
+var SWITCH_ACCOUNT_ANSWER = 'answer "s" when asked';
+var NO_CREDENTIAL_SENTENCE = 'Halfcycle is not connected: this machine has no working Halfcycle credential for this project. Run "npx halfcycle" in the project folder to sign in again.';
+var NOT_THIS_ACCOUNT_SENTENCE = `Halfcycle is not connected: this project belongs to another Halfcycle account. To switch, run "npx halfcycle" in this project and ${SWITCH_ACCOUNT_ANSWER}.`;
+var UPDATE_CLAUDE_CODE_SENTENCE = "Halfcycle is not connected: this Claude Code version does not name the server it connects to, so no credential was sent. Update Claude Code, then reopen.";
+var CANNOT_REACH_SENTENCE = "Halfcycle is not connected: its server could not be reached, so its tools are unavailable in this session. Check your network, then reopen the project.";
+var SERVICE_PROBLEM_SENTENCE = "Halfcycle is not connected: its service had a problem just now, so nothing in this session is being checked. Reopen the project to try again.";
+var PLACEHOLDER_SENTENCES = Object.freeze({
+  [NO_CREDENTIAL_PLACEHOLDER]: NO_CREDENTIAL_SENTENCE,
+  [NOT_THIS_ACCOUNT_PLACEHOLDER]: NOT_THIS_ACCOUNT_SENTENCE,
+  [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
+});
 
 // dist/hook-protocol.js
 import { writeSync } from "node:fs";
@@ -15303,7 +15325,7 @@ function emitBlock(reason) {
   process.exit(0);
 }
 function nonBlockingReply(event, text) {
-  if (event === "PostToolUse") {
+  if (event === "PostToolUse" || event === "SessionStart") {
     return JSON.stringify({
       systemMessage: text,
       hookSpecificOutput: { hookEventName: event, additionalContext: text }
@@ -15337,7 +15359,7 @@ function hookReply(event) {
   };
 }
 function infraWarningText(message) {
-  return `[Halfcycle] WARNING: Guard service unavailable \u2014 ${message}. Session continues (fail-open).`;
+  return `[Halfcycle] WARNING: Guard service unavailable \u2014 ${message}. The session continues without checks.`;
 }
 function localFaultText(message) {
   return `[Halfcycle] WARNING: Local fault \u2014 ${message}. The guard service was not contacted. Session continues (fail-open).`;
@@ -15348,11 +15370,15 @@ This is not a service outage: the guard service answered. The suspect is this re
 }
 var UNCONFIGURED_EXIT_TOOL_USE = 2;
 var UNCONFIGURED_EXIT_STOP_FAMILY = 1;
-function emitNeverConfigured(missing, exitCode, reason) {
-  writeSync(2, neverConfiguredReport(missing, reason));
+function emitNeverConfigured(exitCode, reason) {
+  writeSync(2, neverConfiguredReport(reason));
   process.exitCode = exitCode;
 }
-var HOOK_REMEDY = `Fix it by running "npx halfcycle" in this repository: it may open your browser to sign in first, then writes this engagement's credentials to ~/.halfcycle \u2014 outside the repository \u2014 and the hook loads them itself.`;
+var SIGN_IN_COMMAND = '"npx halfcycle"';
+var HOOK_REMEDY = `Run ${SIGN_IN_COMMAND} in the project folder to sign in.`;
+function namesTheSignInCommand(text) {
+  return text.includes(SIGN_IN_COMMAND);
+}
 var PERMISSIONS_BLOCK = "\n    permissions:\n      contents: read\n      id-token: write\n\n";
 var BOTH_LINES_SENTENCE = "BOTH LINES. Declaring any permission replaces the defaults rather than adding to them, so a block naming only the identity token takes read access away from the checkout step and a private repository stops checking out before this check is reached.";
 var CI_CANNOT_PROVE_PROJECT = "has no way to prove which project it belongs to";
@@ -15360,17 +15386,17 @@ var CI_REMEDY_LEAD = "Add this to the workflow \u2014 at the top of the file, or
 var CI_OLDER_SETUP = "The older setup, GUARD_SERVICE_TOKEN and GUARD_ENGAGEMENT_ID supplied as repository secrets, still works unchanged, and a job that has both needs neither line.";
 var CI_REMEDY = `This job cannot vouch for anything, because it ${CI_CANNOT_PROVE_PROJECT}. ${CI_REMEDY_LEAD} ${CI_OLDER_SETUP}`;
 var CI_NOT_SUPPORTED_MESSAGE = "[Halfcycle CI] This is Halfcycle-internal and is not supported in your CI.\n";
-var NEVER_CONFIGURED_HEADLINE = "GUARD NEVER CONFIGURED";
+var NEVER_CONFIGURED_HEADLINE = "Halfcycle guidance and support won't be available";
 var NOT_A_SERVICE_OUTAGE = "This is not a service outage.";
-function neverConfiguredMessage(missing, remedy, label = "[Halfcycle]") {
-  return `${label} ${NEVER_CONFIGURED_HEADLINE} \u2014 this repository has no guard coverage.
-No evaluation was attempted, because there is nothing to attempt one with: ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} absent.
-${NOT_A_SERVICE_OUTAGE} It means the guard has never run here \u2014 not on this change, and not on any change before it.
+var NO_SIGN_IN_HERE = `${NEVER_CONFIGURED_HEADLINE} in this project on this machine: there is no Halfcycle sign-in for this project here`;
+function neverConfiguredMessage(remedy, label = "[Halfcycle]") {
+  return `${label} ${NO_SIGN_IN_HERE}. Edits made in this session won't be checked.
+${NOT_A_SERVICE_OUTAGE}
 ${remedy}
 `;
 }
 function ciNeverConfiguredMessage() {
-  return `[Halfcycle CI] ${NEVER_CONFIGURED_HEADLINE} \u2014 this job ${CI_CANNOT_PROVE_PROJECT}, so it checked nothing. ${CI_REMEDY_LEAD}
+  return `[Halfcycle CI] ${NEVER_CONFIGURED_HEADLINE} in this job: it ${CI_CANNOT_PROVE_PROJECT}, so it checked nothing. ${CI_REMEDY_LEAD}
 ${NOT_A_SERVICE_OUTAGE} Nothing was sent: this job holds no credential and was not permitted to ask GitHub for a signed identity token. It speaks for this job on this change only \u2014 other jobs and earlier changes it did not see.
 ${CI_OLDER_SETUP}
 `;
@@ -15379,10 +15405,10 @@ function notThisAccountReport(label) {
   return `${label} This project belongs to another Halfcycle account. Halfcycle is Solo today \u2014 one person works on a project at a time \u2014 so no credential exists for this machine and none will be issued. Nothing here needs fixing; this copy simply is not checked. Ask the project's owner for view access, or \u2014 if this account is wrong \u2014 sign in as the one that owns the project and run "npx halfcycle" again.
 `;
 }
-function neverConfiguredReport(missing, reason, label = "[Halfcycle]") {
+function neverConfiguredReport(reason, label = "[Halfcycle]") {
   switch (reason) {
     case "no-credential-yet":
-      return neverConfiguredMessage(missing, HOOK_REMEDY, label);
+      return neverConfiguredMessage(HOOK_REMEDY, label);
     case "not-this-account":
       return notThisAccountReport(label);
   }
@@ -15410,11 +15436,8 @@ function classifyFailure(failure) {
   return {
     kind: "service",
     message: failure.message,
-    // Unchanged wording for this class ON PURPOSE — a genuine outage still says
-    // exactly what it said before, and still fails open locally. This task moved
-    // ONE condition out of this branch; it did not redefine the branch.
-    label: "infrastructure failure",
-    reason: `infrastructure failure: ${failure.message}`
+    label: "service unavailable",
+    reason: failure.message
   };
 }
 var CREDENTIAL_REJECTED_EXIT_TOOL_USE = UNCONFIGURED_EXIT_TOOL_USE;
@@ -15438,6 +15461,21 @@ function credentialRenewalFailedMessage(remedy, label = "[Halfcycle]") {
 ${remedy}
 `;
 }
+function noCoverageStatement(reason, remedySaid = false) {
+  if (reason === "not-this-account") {
+    return [
+      "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked.",
+      "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is",
+      "[halfcycle] evaluated, and nothing you do is reported as having passed.",
+      "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming.",
+      "[halfcycle] Ask the project's owner for view access.",
+      "[halfcycle] If this account is wrong, sign in as the one that owns the project and run",
+      '[halfcycle] "npx halfcycle" again.'
+    ].join("\n");
+  }
+  const statement = `${NO_SIGN_IN_HERE}, so edits made in this session won't be checked.`;
+  return remedySaid ? statement : `${statement} ${HOOK_REMEDY}`;
+}
 function notRunReport(notRun, label = "[Halfcycle]") {
   if (!notRun || notRun.length === 0)
     return "";
@@ -17287,6 +17325,7 @@ function writeRefreshedToken(opts) {
 
 // dist/credential-refresh.js
 var CONTROL_TIMEOUT_MS = 5e3;
+var CONNECTION_CHECK_DEADLINE_MS = 3e3;
 var UNAUTHORIZED = 401;
 async function probeAccount(controlOrigin, credential, fetchFn = globalThis.fetch) {
   const controller = new AbortController();
@@ -17590,7 +17629,7 @@ async function evaluateEdit(reply, readSeat) {
   const configResult = readConfig();
   if (!configResult.config) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet });
-    emitNeverConfigured(configResult.missing, UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason());
+    emitNeverConfigured(UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason());
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
@@ -17680,10 +17719,10 @@ ${guardLines}${notRunBlock}`);
   }
 }
 function readStdin() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve4(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
@@ -17885,7 +17924,7 @@ async function evaluateSession(input, kind, reply, readSeat) {
   const configResult = readConfig();
   if (!configResult.config) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet, diffBase });
-    emitNeverConfigured(configResult.missing, UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason());
+    emitNeverConfigured(UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason());
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
@@ -17978,6 +18017,7 @@ ${guardLines}${notRunBlock}`);
 }
 
 // dist/hooks/stdin.js
+var HOOK_STDIN_GRACE_MS = 2e3;
 async function readHookStdin() {
   try {
     const raw = await readStdin2();
@@ -17992,9 +18032,9 @@ async function readHookStdin() {
   }
 }
 function readStdin2() {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     if (process.stdin.isTTY) {
-      resolve3("");
+      resolve4("");
       return;
     }
     const chunks = [];
@@ -18004,9 +18044,9 @@ function readStdin2() {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve3(Buffer.concat(chunks).toString("utf-8"));
+      resolve4(Buffer.concat(chunks).toString("utf-8"));
     };
-    const timer = setTimeout(done, 2e3);
+    const timer = setTimeout(done, HOOK_STDIN_GRACE_MS);
     process.stdin.on("data", (chunk) => chunks.push(chunk));
     process.stdin.on("end", done);
     process.stdin.on("error", done);
@@ -18084,52 +18124,16 @@ function runResolveEngagement(cwd, registryPath) {
 }
 
 // dist/refresh-credential.js
-var UNAUTHORIZED2 = 401;
-var LIVE_PROBE_STATUSES = /* @__PURE__ */ new Set([200, 403]);
-async function refreshCredentialToken(opts) {
-  const source = opts?.source;
-  if (readNeverConfiguredReason() === "not-this-account")
-    return { token: void 0 };
-  if (!readEnvFilePath(source))
-    return { token: void 0 };
-  const configResult = readConfig(source);
-  if (!configResult.config)
-    return { token: void 0 };
-  const { guardServiceToken, guardEngagementId } = configResult.config;
-  const controlOrigin = readControlOrigin(source).origin;
-  const fetchFn = opts?.fetchFn ?? globalThis.fetch;
-  const accountCredential = readAccountCredential(controlOrigin, opts?.home);
-  if (accountCredential)
-    await probeAccount(controlOrigin, accountCredential, fetchFn);
-  const probe = await probeAccount(controlOrigin, guardServiceToken, fetchFn);
-  if (!probe.reached)
-    return { token: void 0 };
-  if (probe.status !== UNAUTHORIZED2) {
-    return { token: LIVE_PROBE_STATUSES.has(probe.status) ? guardServiceToken : void 0 };
-  }
-  const refreshed = await refreshEngagementCredential({
-    engagementId: guardEngagementId,
-    refusedToken: guardServiceToken,
-    fetchFn,
-    home: opts?.home,
-    source
-  });
-  if (!refreshed.ok) {
-    const write = opts?.write ?? ((text) => process.stdout.write(text));
-    write(credentialRenewalFailedMessage(refreshed.remedy));
-    return { token: void 0 };
-  }
-  return { token: refreshed.token };
-}
-async function runRefreshCredential(opts) {
-  await refreshCredentialToken(opts);
-  return 0;
-}
+import { readFileSync as readFileSync10 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
 
 // dist/mcp-headers.js
 import { readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { dirname as dirname4, resolve as resolve2 } from "node:path";
+function defaultWriteErr(text) {
+  process.stderr.write(text);
+}
 function headerLine(bearer) {
   return `${JSON.stringify({ Authorization: `Bearer ${bearer}` })}
 `;
@@ -18233,16 +18237,17 @@ async function refreshWithinDeadline(source, opts, writeErr) {
     clearTimeout(timer);
   }
 }
-async function decide(opts, writeErr) {
+async function chooseBearer(opts) {
+  const writeErr = opts.writeErr ?? defaultWriteErr;
   const home = opts.home ?? homedir5();
   const root = projectRootFromBinary(opts.binaryPath);
-  const environmentToken = readEnvironmentToken();
+  const environmentToken = opts.environmentTokenFirst ? readEnvironmentToken() : void 0;
   const store = resolveStore(root, home);
   let storedToken;
   if (environmentToken === void 0) {
     if (!store.ok) {
       writeErr(storeProblemSentence(store.problem, root, home, store.engagementId));
-      return headerLine(store.problem === "not-this-account" ? NOT_THIS_ACCOUNT_PLACEHOLDER : NO_CREDENTIAL_PLACEHOLDER);
+      return store.problem === "not-this-account" ? NOT_THIS_ACCOUNT_PLACEHOLDER : NO_CREDENTIAL_PLACEHOLDER;
     }
     storedToken = storedEngagementToken(store.values);
     if (storedToken === void 0) {
@@ -18250,17 +18255,17 @@ async function decide(opts, writeErr) {
         `GUARD_SERVICE_TOKEN is absent or empty in ${store.path}.`,
         `run "npx halfcycle" in this repository to rewrite this machine's credential.`
       ]));
-      return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+      return NO_CREDENTIAL_PLACEHOLDER;
     }
   }
-  const requested = readMcpServerUrl();
+  const requested = opts.requestedUrl;
   const recorded = store.ok ? store.values["HALFCYCLE_MCP_URL"] : void 0;
   if (requested === void 0 && store.ok) {
     writeErr(sentences([
       "Claude Code did not say which server it is connecting to, so the Halfcycle credential was not sent.",
       "update Claude Code, then reconnect."
     ]));
-    return headerLine(UPDATE_CLAUDE_CODE_PLACEHOLDER);
+    return UPDATE_CLAUDE_CODE_PLACEHOLDER;
   }
   if (!recorded) {
     if (!store.ok && store.problem === "bad-id") {
@@ -18271,7 +18276,7 @@ async function decide(opts, writeErr) {
         'run "npx halfcycle" in this repository on this machine to record it.'
       ]));
     }
-    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+    return NO_CREDENTIAL_PLACEHOLDER;
   }
   const want = urlOrigin(recorded);
   const got = requested === void 0 ? void 0 : urlOrigin(requested);
@@ -18281,25 +18286,31 @@ async function decide(opts, writeErr) {
       `which is not this machine's Halfcycle server (${want ?? "none recorded"}). The credential was NOT sent.`,
       'if nobody meant to change .mcp.json, treat that change as suspect; "npx halfcycle" restores the entry.'
     ]));
-    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+    return NO_CREDENTIAL_PLACEHOLDER;
   }
   if (environmentToken !== void 0)
-    return headerLine(environmentToken);
+    return environmentToken;
   if (!store.ok || storedToken === void 0)
-    return headerLine(NO_CREDENTIAL_PLACEHOLDER);
+    return NO_CREDENTIAL_PLACEHOLDER;
   const source = {
     HALFCYCLE_ENV_FILE: store.path,
     GUARD_SERVICE_TOKEN: storedToken,
     GUARD_ENGAGEMENT_ID: store.values["GUARD_ENGAGEMENT_ID"],
     HALFCYCLE_SERVICE_URL: store.values["HALFCYCLE_SERVICE_URL"]
   };
-  const refreshed = await refreshWithinDeadline(source, opts, writeErr);
-  return headerLine(refreshed ?? storedToken);
+  const renewed = opts.renewal === "renew-here" ? await refreshWithinDeadline(source, opts, writeErr) : opts.renewal.token;
+  return renewed ?? storedToken;
 }
 async function mcpHeaders(opts) {
-  const writeErr = opts.writeErr ?? ((text) => void process.stderr.write(text));
+  const writeErr = opts.writeErr ?? defaultWriteErr;
   try {
-    return await decide(opts, writeErr);
+    return headerLine(await chooseBearer({
+      ...opts,
+      writeErr,
+      requestedUrl: readMcpServerUrl(),
+      renewal: "renew-here",
+      environmentTokenFirst: true
+    }));
   } catch (err) {
     try {
       writeErr(sentences([
@@ -18313,11 +18324,178 @@ async function mcpHeaders(opts) {
   }
 }
 
+// dist/refresh-credential.js
+var UNAUTHORIZED2 = 401;
+var LIVE_PROBE_STATUSES = /* @__PURE__ */ new Set([200, 403]);
+async function refreshCredentialToken(opts) {
+  const source = opts?.source;
+  if (readNeverConfiguredReason() === "not-this-account")
+    return { token: void 0 };
+  if (!readEnvFilePath(source))
+    return { token: void 0 };
+  const configResult = readConfig(source);
+  if (!configResult.config)
+    return { token: void 0 };
+  const { guardServiceToken, guardEngagementId } = configResult.config;
+  const controlOrigin = readControlOrigin(source).origin;
+  const fetchFn = opts?.fetchFn ?? globalThis.fetch;
+  const accountCredential = readAccountCredential(controlOrigin, opts?.home);
+  if (accountCredential)
+    await probeAccount(controlOrigin, accountCredential, fetchFn);
+  const probe = await probeAccount(controlOrigin, guardServiceToken, fetchFn);
+  if (!probe.reached)
+    return { token: void 0 };
+  if (probe.status !== UNAUTHORIZED2) {
+    return { token: LIVE_PROBE_STATUSES.has(probe.status) ? guardServiceToken : void 0 };
+  }
+  const refreshed = await refreshEngagementCredential({
+    engagementId: guardEngagementId,
+    refusedToken: guardServiceToken,
+    fetchFn,
+    home: opts?.home,
+    source
+  });
+  if (!refreshed.ok) {
+    const write = opts?.write ?? ((text) => process.stdout.write(text));
+    write(credentialRenewalFailedMessage(refreshed.remedy));
+    return { token: void 0 };
+  }
+  return { token: refreshed.token };
+}
+var CHECKED_SOURCES = /* @__PURE__ */ new Set(["startup", "resume"]);
+var INITIALIZE_BODY = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} });
+function registeredMcpUrl(projectRoot) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync10(resolve3(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return void 0;
+  const servers = parsed["mcpServers"];
+  if (typeof servers !== "object" || servers === null || !Object.hasOwn(servers, MCP_SERVER_KEY))
+    return void 0;
+  const entry = servers[MCP_SERVER_KEY];
+  if (typeof entry !== "object" || entry === null)
+    return void 0;
+  const url2 = entry["url"];
+  return typeof url2 === "string" ? url2 : void 0;
+}
+function namesItsServer(body) {
+  if (typeof body !== "object" || body === null)
+    return false;
+  const result = body["result"];
+  if (typeof result !== "object" || result === null)
+    return false;
+  const info = result["serverInfo"];
+  if (typeof info !== "object" || info === null)
+    return false;
+  const name = info["name"];
+  return typeof name === "string" && name !== "";
+}
+function discardBody(res) {
+  res.body?.cancel().catch(() => void 0);
+}
+async function probeDelivery(url2, bearer, fetchFn, deadlineMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deadlineMs);
+  try {
+    let res;
+    try {
+      res = await fetchFn(url2, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${bearer}` },
+        body: INITIALIZE_BODY,
+        redirect: "manual",
+        signal: controller.signal
+      });
+    } catch {
+      return CANNOT_REACH_SENTENCE;
+    }
+    if (res.status === 401) {
+      discardBody(res);
+      return NO_CREDENTIAL_SENTENCE;
+    }
+    if (res.status < 200 || res.status > 299) {
+      discardBody(res);
+      return SERVICE_PROBLEM_SENTENCE;
+    }
+    let body;
+    try {
+      body = await res.json();
+    } catch {
+      return controller.signal.aborted ? CANNOT_REACH_SENTENCE : SERVICE_PROBLEM_SENTENCE;
+    }
+    return namesItsServer(body) ? void 0 : SERVICE_PROBLEM_SENTENCE;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkConnection(renewedToken, opts) {
+  const url2 = registeredMcpUrl(projectRootFromBinary(opts.binaryPath));
+  if (url2 === void 0)
+    return void 0;
+  const bearer = await chooseBearer({
+    binaryPath: opts.binaryPath,
+    home: opts.home,
+    fetchFn: opts.fetchFn,
+    writeErr: opts.writeErr,
+    requestedUrl: url2,
+    renewal: { token: renewedToken },
+    environmentTokenFirst: false
+  });
+  if (CREDENTIAL_PLACEHOLDERS.includes(bearer)) {
+    return PLACEHOLDER_SENTENCES[bearer];
+  }
+  return probeDelivery(url2, bearer, opts.fetchFn ?? globalThis.fetch, opts.checkDeadlineMs ?? CONNECTION_CHECK_DEADLINE_MS);
+}
+function defaultWriteErr2(text) {
+  process.stderr.write(text);
+}
+async function runRefreshCredential(opts) {
+  const writeErr = opts.writeErr ?? defaultWriteErr2;
+  try {
+    const renewalSaid = [];
+    let renewalOpen = true;
+    const [input, renewedToken] = await Promise.all([
+      (opts.readInput ?? readHookStdin)(),
+      refreshWithinDeadline(void 0, { fetchFn: opts.fetchFn, home: opts.home, deadlineMs: opts.renewalDeadlineMs }, (text) => {
+        if (renewalOpen)
+          renewalSaid.push(text);
+      })
+    ]);
+    renewalOpen = false;
+    const parts = [];
+    if (CHECKED_SOURCES.has(input["source"])) {
+      const outcome = await checkConnection(renewedToken, { ...opts, writeErr });
+      if (outcome !== void 0)
+        parts.push(outcome);
+    }
+    if (readConfig().config === null) {
+      const remedySaid = parts.some(namesTheSignInCommand);
+      parts.push(noCoverageStatement(readNeverConfiguredReason(), remedySaid));
+    }
+    for (const said of renewalSaid)
+      parts.push(said.trimEnd());
+    return parts.length === 0 ? "" : `${nonBlockingReply("SessionStart", parts.join("\n"))}
+`;
+  } catch (err) {
+    try {
+      writeErr(`halfcycle: the session-start check could not finish: ${(err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ")}
+`);
+    } catch {
+      return "";
+    }
+    return "";
+  }
+}
+
 // dist/bin.js
 import { fileURLToPath } from "node:url";
 
 // dist/capture.js
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync6 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -18385,7 +18563,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync10(fromFile, "utf-8");
+    return readFileSync11(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -18405,8 +18583,8 @@ async function main() {
     return;
   }
   if (cmd === "refresh-credential") {
-    const code = await runRefreshCredential();
-    process.exit(code);
+    const reply = await runRefreshCredential({ binaryPath: fileURLToPath(import.meta.url) });
+    process.stdout.write(reply, () => process.exit(0));
     return;
   }
   if (cmd === "mcp-headers") {
@@ -18486,10 +18664,10 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
   process.exit(1);
 }
 function readStdin3() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve4(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }