halfcycle 0.3.7 → 0.3.9

package/dist/bin.js

@@ -10,6 +10,421 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as rea
 import { dirname as dirname2, join as join5, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
+// ../events/dist/result.js
+import { z as z2 } from "zod";
+
+// ../core/dist/guard-record.js
+import { z } from "zod";
+var severitySchema = z.enum(["info", "warn", "block"]);
+var channelSchema = z.enum(["stable", "candidate", "rented"]);
+var matcherKindSchema = z.enum(["grep", "ast", "integrationTest", "llm"]);
+var matcherConfigSchema = z.record(z.string(), z.unknown());
+var grepMatcherSchema = z.object({ kind: z.literal("grep"), config: matcherConfigSchema }).strict();
+var astMatcherSchema = z.object({ kind: z.literal("ast"), config: matcherConfigSchema }).strict();
+var integrationTestMatcherSchema = z.object({ kind: z.literal("integrationTest"), config: matcherConfigSchema }).strict();
+var llmMatcherSchema = z.object({ kind: z.literal("llm"), config: matcherConfigSchema }).strict();
+var matcherSchema = z.discriminatedUnion("kind", [
+  grepMatcherSchema,
+  astMatcherSchema,
+  integrationTestMatcherSchema,
+  llmMatcherSchema
+]);
+
+// ../events/dist/result.js
+var firedGuardSchema = z2.object({
+  guardId: z2.string(),
+  patternRef: z2.string(),
+  severity: severitySchema,
+  explanation: z2.string(),
+  /**
+   * The repo-relative path of the file this firing was decided on. The matcher
+   * has the file live at the moment it decides to fire; this is the field that
+   * carries the answer out. It is the CLIENT's own coordinate — the wire type
+   * still has no field for a matcher body, a channel, a version, a scope or a
+   * guard's provenance, and physically cannot carry one.
+   *
+   * THE PRESENCE RULE, WHICH LIVES HERE AND NOT IN A CONSUMER'S PROSE: every
+   * firing produced from this contract version onward carries `path`, so on the
+   * WIRE, absence means exactly one thing — a response from a guard service
+   * older than this contract. It is declared optional because a client's guard
+   * runner is built from its own checkout and calls a service that may be older
+   * than it; a required field would make that pairing unparseable.
+   *
+   * The rule does NOT transfer to a store that persists a firing, where an
+   * absent path has a second legitimate meaning: a row written before the
+   * column existed. A persisted NULL is therefore not a writer bug.
+   *
+   * NO SHAPE CONSTRAINT. This value is whatever the changed tree called the
+   * file. A consumer that maps it onto a coordinate with its own path rule must
+   * safe-parse it and decide what to do with a refusal, rather than assume the
+   * two shapes agree.
+   */
+  path: z2.string().optional()
+}).strict();
+var resultEnvelopeSchema = z2.object({
+  guardsFired: z2.array(firedGuardSchema),
+  severity: severitySchema.nullable(),
+  blocking: z2.boolean(),
+  explanation: z2.string()
+}).strict();
+var wireErrorSchema = z2.object({
+  statusCode: z2.number(),
+  error: z2.string(),
+  message: z2.string()
+}).strict();
+
+// ../events/dist/telemetry.js
+import { z as z3 } from "zod";
+var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var guardEvalOutcomeSchema = z3.enum([
+  "evaluated",
+  "infra-error",
+  "contract-error",
+  "unconfigured"
+]);
+var guardEvalRunSchema = z3.object({
+  // `runId`/`outcome` are the E2 run-observability additions, declared
+  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
+  // migration. Every new record populated by the migrated writer (T-07)
+  // carries both; a legacy line predating the amendment carries neither and
+  // must still parse (the mixed-era guard-eval log the Build-Record reader
+  // assembles from, and the runner emit not yet migrated). So the presence
+  // refinement below is skipped for a legacy line (no `outcome`), and the
+  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
+  // where the schema may then be tightened to required. runId is uuid-checked
+  // WHEN present; outcome is enum-checked when present.
+  runId: z3.string().uuid().optional(),
+  engagementId: z3.string().optional(),
+  runType: z3.enum(["hook", "ci"]),
+  occurredAt: utcIso8601,
+  outcome: guardEvalOutcomeSchema.optional(),
+  failureReason: z3.string().optional(),
+  phase: z3.string().optional(),
+  scope: z3.record(z3.string(), z3.unknown()),
+  cost: z3.record(z3.string(), z3.unknown()).optional(),
+  result: resultEnvelopeSchema.optional()
+}).strict().superRefine((run, ctx) => {
+  if (run.outcome === void 0)
+    return;
+  if (run.outcome === "evaluated" && run.result === void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["result"],
+      message: "result is required when outcome is 'evaluated'"
+    });
+  }
+  if (run.outcome !== "evaluated" && run.result !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["result"],
+      message: "result is only present when outcome is 'evaluated'"
+    });
+  }
+  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["engagementId"],
+      message: "engagementId is required unless outcome is 'unconfigured'"
+    });
+  }
+});
+
+// ../events/dist/engagement-lifecycle.js
+import { z as z4 } from "zod";
+var utcIso86012 = z4.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var engagementTypeSchema = z4.enum(["client"]);
+var lifecycleStatusSchema = z4.enum(["active", "delivering", "closed"]);
+var createEngagementRequestSchema = z4.object({
+  name: z4.string(),
+  region: z4.string(),
+  engagementType: engagementTypeSchema
+}).strict();
+var createEngagementResponseSchema = z4.object({
+  engagementId: z4.string(),
+  name: z4.string(),
+  region: z4.string(),
+  status: lifecycleStatusSchema,
+  createdAt: utcIso86012,
+  sessionToken: z4.string()
+}).strict();
+var engagementStatusResponseSchema = z4.object({
+  engagementId: z4.string(),
+  name: z4.string(),
+  region: z4.string(),
+  status: lifecycleStatusSchema,
+  installLinked: z4.boolean(),
+  createdAt: utcIso86012,
+  updatedAt: utcIso86012
+}).strict();
+var linkInstallationRequestSchema = z4.object({
+  installationId: z4.string(),
+  engagementId: z4.string()
+}).strict();
+var startBuildRequestSchema = z4.object({
+  engagementId: z4.string()
+}).strict();
+var startBuildResponseSchema = z4.object({
+  engagementId: z4.string(),
+  status: lifecycleStatusSchema,
+  enqueuedAt: utcIso86012
+}).strict();
+var acceptanceOutcomeSchema = z4.object({
+  verdict: z4.enum(["clean", "defects"]),
+  findings: z4.number().int().nonnegative(),
+  findingsDetail: z4.array(z4.object({ summary: z4.string() }).strict())
+}).strict();
+var PHASE_CLOSE_REASON_MAX = 1900;
+var phaseCloseDecisionSchema = z4.discriminatedUnion("decision", [
+  z4.object({
+    decision: z4.literal("done-when-met"),
+    /** Who is closing the phase. */
+    actor: z4.string()
+  }).strict(),
+  z4.object({
+    decision: z4.literal("override"),
+    /** Who is closing it anyway. */
+    actor: z4.string(),
+    /**
+     * Why, in their own words. Bounded: the reason is kept on the phase's
+     * permanent record of its own close, and that record refuses anything
+     * longer — so an over-long reason is refused here, before the close is
+     * attempted, rather than failing the close itself.
+     */
+    reason: z4.string().max(PHASE_CLOSE_REASON_MAX)
+  }).strict()
+]);
+var acceptPhaseRequestSchema = z4.object({
+  phase: z4.string(),
+  acceptanceOutcome: acceptanceOutcomeSchema,
+  close: phaseCloseDecisionSchema.optional()
+}).strict();
+var coeFindingRequestSchema = z4.object({
+  phase: z4.string(),
+  description: z4.string(),
+  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z4.string().nullable()
+}).strict();
+var coeFindingResponseSchema = z4.object({
+  findingId: z4.string(),
+  engagementId: z4.string(),
+  phase: z4.string(),
+  description: z4.string(),
+  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z4.string().nullable(),
+  createdAt: utcIso86012
+}).strict();
+var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
+  z4.object({
+    decision: z4.literal("entry-condition-met"),
+    /** Who attests. */
+    actor: z4.string(),
+    /** What makes the entry condition hold, in the attester's own words. */
+    evidence: z4.string()
+  }).strict(),
+  z4.object({
+    decision: z4.literal("override"),
+    /** Who is opening it anyway. */
+    actor: z4.string(),
+    /** Why, in the operator's own words. */
+    reason: z4.string()
+  }).strict()
+]);
+var PHASE_ENTRY_DECISION_KINDS = [
+  "entry-condition-met",
+  "override"
+];
+var PHASE_CLOSE_DECISION_KINDS = ["phase-closed", "phase-close-override"];
+var phaseDecisionKindSchema = z4.enum([
+  ...PHASE_ENTRY_DECISION_KINDS,
+  ...PHASE_CLOSE_DECISION_KINDS
+]);
+var openPhaseRequestSchema = z4.object({
+  phase: z4.string().nullable(),
+  entry: phaseEntryDecisionSchema
+}).strict();
+var phaseEntryDecisionRecordSchema = z4.object({
+  decisionId: z4.string(),
+  decision: z4.enum(PHASE_ENTRY_DECISION_KINDS),
+  actor: z4.string(),
+  /** The evidence (attestation) or the reason (override) — one basis per row. */
+  justification: z4.string(),
+  blockingFinding: z4.string().nullable(),
+  decidedAt: utcIso86012
+}).strict();
+var openPhaseResponseSchema = z4.object({
+  engagement: engagementStatusResponseSchema,
+  /** What is open now. `null` is project scope. */
+  phase: z4.string().nullable(),
+  /** What was open before this decision. `null` is project scope. */
+  previousPhase: z4.string().nullable(),
+  decision: phaseEntryDecisionRecordSchema
+}).strict();
+
+// ../events/dist/crew.js
+import { z as z5 } from "zod";
+var crewGroupSchema = z5.enum(["builder", "reviewer", "always-on"]);
+var crewTierSchema = z5.enum(["deep", "standard", "fast"]);
+var CREW_DISCIPLINE_MAX = 64;
+var crewMemberSchema = z5.object({
+  // The agent's name. The same twenty-one on every project, so a name is a
+  // vocabulary a returning client already knows.
+  callsign: z5.string().min(1).max(32),
+  // Which of the three headings this member reads under.
+  group: crewGroupSchema,
+  // The kind of work this member takes. A task names a discipline, and only
+  // agents holding it can be dispatched to it.
+  discipline: z5.string().min(1).max(CREW_DISCIPLINE_MAX),
+  // How much thinking this member brings. There is no field naming the supplier
+  // behind it, on this shape or on any other.
+  tier: crewTierSchema
+}).strict();
+var CREW_ROSTER = [
+  // ── builders: code ──────────────────────────────────────────────────────────
+  { callsign: "ADA", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "OTTO", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "MILO", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "NOVA", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "KAI", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "HUGO", group: "builder", discipline: "infrastructure", tier: "standard" },
+  { callsign: "WREN", group: "builder", discipline: "refactor", tier: "fast" },
+  { callsign: "PIP", group: "builder", discipline: "refactor", tier: "fast" },
+  // ── builders: specs and docs ────────────────────────────────────────────────
+  { callsign: "IRIS", group: "builder", discipline: "feature spec", tier: "deep" },
+  { callsign: "JUNO", group: "builder", discipline: "feature spec", tier: "standard" },
+  { callsign: "LEX", group: "builder", discipline: "context & docs", tier: "fast" },
+  // ── reviewers ───────────────────────────────────────────────────────────────
+  { callsign: "VERA", group: "reviewer", discipline: "spec consistency", tier: "deep" },
+  { callsign: "ODIN", group: "reviewer", discipline: "cross-spec audit", tier: "deep" },
+  { callsign: "CASS", group: "reviewer", discipline: "code review", tier: "deep" },
+  { callsign: "THEO", group: "reviewer", discipline: "code review", tier: "standard" },
+  { callsign: "ECHO", group: "reviewer", discipline: "test quality", tier: "standard" },
+  { callsign: "MAVIS", group: "reviewer", discipline: "suites & coverage", tier: "standard" },
+  { callsign: "ZARA", group: "reviewer", discipline: "smoke & walk aid", tier: "standard" },
+  { callsign: "NORA", group: "reviewer", discipline: "evidence & provenance", tier: "fast" },
+  // ── always on: continuous, takes no task ────────────────────────────────────
+  { callsign: "ARGUS", group: "always-on", discipline: "guard \xB7 every diff", tier: "standard" },
+  { callsign: "ATLAS", group: "always-on", discipline: "coordinator", tier: "deep" }
+];
+var CREW_ROSTER_SIZE = CREW_ROSTER.length;
+var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
+
+// ../events/dist/device-auth.js
+import { z as z6 } from "zod";
+var utcIso86013 = z6.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var DEVICE_AUTH_STATUS = {
+  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
+  PENDING: "pending",
+  /** The poll: approved, and the credential is in this body. Once only. 200. */
+  APPROVED: "approved",
+  /** Confirm: the decision was recorded (approve or decline). 200. */
+  RECORDED: "recorded",
+  /** The human refused at the confirmation page. 400 on the poll. */
+  DECLINED: "declined",
+  /** The code's absolute expiry has passed. 400. */
+  EXPIRED: "expired",
+  /** Never minted, or already spent. 400. */
+  UNKNOWN: "unknown",
+  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
+  INVALID_DECISION: "invalid-decision",
+  /** Confirm: an approval arrived with no signed-in identity. 400. */
+  IDENTITY_REQUIRED: "identity-required",
+  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
+  NOT_CONFIGURED: "not-configured",
+  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
+  UNAUTHORIZED: "unauthorized",
+  /** Confirm: the code was already approved, declined or claimed. 409. */
+  ALREADY_DECIDED: "already-decided",
+  /**
+   * Confirm: an approval named a signed-in identity whose account has not accepted
+   * the terms of service and privacy policy currently in force (T-18, #588). 400.
+   *
+   * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
+   * says nothing about the code itself — the code is still `pending` after this
+   * response, exactly as it was before the request, so the SAME userCode can be
+   * confirmed again once the caller has recorded acceptance. `deviceConfirmRequestSchema`'s
+   * `acceptTerms` is how a second confirm says it did.
+   */
+  TERMS_REQUIRED: "terms-required"
+};
+var DEVICE_POLL_REFUSALS = [
+  DEVICE_AUTH_STATUS.DECLINED,
+  DEVICE_AUTH_STATUS.EXPIRED,
+  DEVICE_AUTH_STATUS.UNKNOWN
+];
+var deviceAuthStartResponseSchema = z6.object({
+  deviceCode: z6.string().min(1),
+  userCode: z6.string().min(1),
+  verificationUrl: z6.string().min(1),
+  expiresAt: utcIso86013,
+  pollIntervalMs: z6.number().int().positive()
+}).strict();
+var devicePollPendingSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.PENDING),
+  pollIntervalMs: z6.number().int().positive()
+}).strict();
+var devicePollApprovedSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.APPROVED),
+  accountId: z6.string().min(1),
+  credential: z6.string().min(1),
+  expiresAt: utcIso86013
+}).strict();
+var deviceAuthRefusalSchema = z6.object({
+  status: z6.enum([
+    DEVICE_AUTH_STATUS.DECLINED,
+    DEVICE_AUTH_STATUS.EXPIRED,
+    DEVICE_AUTH_STATUS.UNKNOWN,
+    DEVICE_AUTH_STATUS.INVALID_DECISION,
+    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
+    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
+    DEVICE_AUTH_STATUS.UNAUTHORIZED,
+    DEVICE_AUTH_STATUS.ALREADY_DECIDED,
+    DEVICE_AUTH_STATUS.TERMS_REQUIRED
+  ]),
+  message: z6.string().min(1)
+}).strict();
+var devicePollResponseSchema = z6.union([
+  devicePollPendingSchema,
+  devicePollApprovedSchema,
+  deviceAuthRefusalSchema
+]);
+var deviceConfirmRequestSchema = z6.object({
+  userCode: z6.string().min(1),
+  decision: z6.enum(["approve", "decline"]),
+  externalAuthId: z6.string().min(1).optional(),
+  email: z6.string().optional(),
+  acceptTerms: z6.boolean().optional()
+}).strict();
+var deviceConfirmRecordedSchema = z6.object({
+  status: z6.literal(DEVICE_AUTH_STATUS.RECORDED),
+  accountId: z6.string().min(1).optional()
+}).strict();
+var deviceConfirmResponseSchema = z6.union([
+  deviceConfirmRecordedSchema,
+  deviceAuthRefusalSchema
+]);
+var LOOPBACK_REDIRECT_HOST = "127.0.0.1";
+var LOOPBACK_PORT_MIN = 1024;
+var LOOPBACK_PORT_MAX = 65535;
+var LOOPBACK_CALLBACK_PATH = "/halfcycle-cli-callback";
+var LOOPBACK_QUERY_PORT = "loopback_port";
+var LOOPBACK_QUERY_STATE = "loopback_state";
+var LOOPBACK_QUERY_RESULT = "result";
+var LOOPBACK_RESULT = {
+  APPROVED: "approved",
+  DECLINED: "declined"
+};
+function loopbackVerificationUrl(verificationUrl, target) {
+  let url;
+  try {
+    url = new URL(verificationUrl);
+  } catch {
+    return verificationUrl;
+  }
+  url.searchParams.set(LOOPBACK_QUERY_PORT, String(target.port));
+  url.searchParams.set(LOOPBACK_QUERY_STATE, target.state);
+  return url.toString();
+}
+
 // dist/engagement-credential.js
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -165,507 +580,190 @@ function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
   }
   let result = out.join("\n");
   if (existing.endsWith("\n") && !result.endsWith("\n"))
-    result += "\n";
-  return result;
-}
-function readEngagementEnv(engagementId, home) {
-  try {
-    return parseEnvText(readFileSync2(engagementEnvPath(engagementId, home), "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function writeEngagementEnv(engagementId, values, home) {
-  const path = engagementEnvPath(engagementId, home);
-  const dir = engagementStateDir(engagementId, home);
-  mkdirSync2(dir, { recursive: true, mode: 448 });
-  let existing;
-  try {
-    existing = readFileSync2(path, "utf-8");
-  } catch {
-    existing = null;
-  }
-  const reconciled = reconcileEnvText(existing, values);
-  const outcome = existing === reconciled ? "skipped" : "written";
-  if (outcome === "written") {
-    writeFileSync2(path, reconciled, { mode: 384 });
-  }
-  applyOwnerOnly(path, dir);
-  return outcome;
-}
-function applyOwnerOnly(path, dir) {
-  if (platform2() === "win32")
-    return;
-  try {
-    chmodSync2(path, 384);
-  } catch {
-  }
-  try {
-    chmodSync2(dir, 448);
-  } catch {
-  }
-}
-function engagementResolutionShell() {
-  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
-# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
-#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
-# written owner-only by \`npx halfcycle\`. What this repository holds is the
-# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
-# the pin, then name the file. There is no jq here and node is not dependable on a
-# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
-# file, because sed is line-oriented and the pin's line breaks are not a contract.
-#
-# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
-# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
-# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
-# would discard everything it set.
-halfcycle_env_file() {
-  HALFCYCLE_ENV_FILE=""
-  HALFCYCLE_ENV_ENGAGEMENT=""
-  HALFCYCLE_ENV_PROBLEM=""
-  hc_pin="$1/.halfcycle/bundle.json"
-  if [ ! -f "$hc_pin" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-pin"
-    return 1
-  fi
-  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
-  if [ -z "$hc_id" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-id"
-    return 1
-  fi
-  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
-  if [ -z "\${HOME:-}" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-home"
-    return 1
-  fi
-  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
-  if [ ! -f "$hc_env" ]; then
-    HALFCYCLE_ENV_PROBLEM="no-credential"
-    return 1
-  fi
-  HALFCYCLE_ENV_FILE="$hc_env"
-  return 0
-}
-# --- end Halfcycle credential resolution ------------------------------------`;
-}
-
-// dist/identity.js
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import { randomUUID } from "node:crypto";
-var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
-function git(targetRepoRoot, args2) {
-  try {
-    const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const trimmed = out.trim();
-    return trimmed.length > 0 ? trimmed : null;
-  } catch {
-    return null;
-  }
-}
-function readRootCommit(targetRepoRoot) {
-  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
-  if (!roots)
-    return null;
-  const lines = roots.split("\n").filter((l) => l.length > 0);
-  return lines.length > 0 ? lines[lines.length - 1] : null;
-}
-function readRemote(targetRepoRoot) {
-  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
-}
-function mintOrReadIdentity(targetRepoRoot) {
-  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
-  if (existsSync(path)) {
-    const onDisk = JSON.parse(readFileSync3(path, "utf-8"));
-    const identity2 = {
-      projectId: onDisk.projectId ?? "",
-      rootCommit: onDisk.rootCommit ?? null,
-      remote: onDisk.remote ?? null,
-      note: PROJECT_IDENTITY_NOTE
-    };
-    return { identity: identity2, minted: false };
-  }
-  const identity = {
-    projectId: randomUUID(),
-    rootCommit: readRootCommit(targetRepoRoot),
-    remote: readRemote(targetRepoRoot),
-    note: PROJECT_IDENTITY_NOTE
-  };
-  return { identity, minted: true };
-}
-
-// dist/mcp-endpoint.js
-var MCP_ENDPOINT_PATH = "/mcp";
-function mcpEndpointUrl(origin) {
-  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
-}
-
-// dist/merge-settings.js
-function isHalfcycleEntry(entry, halfcycleCommands) {
-  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
-}
-function mergeSettings(existing, generated) {
-  const merged = { ...existing };
-  if (generated.$schema !== void 0) {
-    merged.$schema = generated.$schema;
-  }
-  const generatedHooks = generated.hooks ?? {};
-  const halfcycleCommands = /* @__PURE__ */ new Set();
-  for (const entries of Object.values(generatedHooks)) {
-    for (const entry of entries) {
-      for (const h of entry.hooks)
-        halfcycleCommands.add(h.command);
-    }
-  }
-  const existingHooks = existing.hooks ?? {};
-  const mergedHooks = {};
-  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
-  for (const event of events) {
-    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
-    const halfcycleEntries = generatedHooks[event] ?? [];
-    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
+    result += "\n";
+  return result;
+}
+function readEngagementEnv(engagementId, home) {
+  try {
+    return parseEnvText(readFileSync2(engagementEnvPath(engagementId, home), "utf-8"));
+  } catch {
+    return null;
   }
-  merged.hooks = mergedHooks;
-  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
-  return merged;
 }
-function mergePermissions(existing, generated) {
-  if (existing === void 0 && generated === void 0)
-    return void 0;
-  const result = { ...existing ?? {} };
-  const generatedDeny = generated?.deny ?? [];
-  if (generatedDeny.length > 0) {
-    const theirs = existing?.deny ?? [];
-    const seen = new Set(theirs);
-    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
+function writeEngagementEnv(engagementId, values, home) {
+  const path = engagementEnvPath(engagementId, home);
+  const dir = engagementStateDir(engagementId, home);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  let existing;
+  try {
+    existing = readFileSync2(path, "utf-8");
+  } catch {
+    existing = null;
   }
-  return result;
+  const reconciled = reconcileEnvText(existing, values);
+  const outcome = existing === reconciled ? "skipped" : "written";
+  if (outcome === "written") {
+    writeFileSync2(path, reconciled, { mode: 384 });
+  }
+  applyOwnerOnly(path, dir);
+  return outcome;
 }
-
-// dist/scan.js
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
-
-// ../events/dist/result.js
-import { z as z2 } from "zod";
-
-// ../core/dist/guard-record.js
-import { z } from "zod";
-var severitySchema = z.enum(["info", "warn", "block"]);
-var channelSchema = z.enum(["stable", "candidate", "rented"]);
-var matcherKindSchema = z.enum(["grep", "ast", "integrationTest", "llm"]);
-var matcherConfigSchema = z.record(z.string(), z.unknown());
-var grepMatcherSchema = z.object({ kind: z.literal("grep"), config: matcherConfigSchema }).strict();
-var astMatcherSchema = z.object({ kind: z.literal("ast"), config: matcherConfigSchema }).strict();
-var integrationTestMatcherSchema = z.object({ kind: z.literal("integrationTest"), config: matcherConfigSchema }).strict();
-var llmMatcherSchema = z.object({ kind: z.literal("llm"), config: matcherConfigSchema }).strict();
-var matcherSchema = z.discriminatedUnion("kind", [
-  grepMatcherSchema,
-  astMatcherSchema,
-  integrationTestMatcherSchema,
-  llmMatcherSchema
-]);
-
-// ../events/dist/result.js
-var firedGuardSchema = z2.object({
-  guardId: z2.string(),
-  patternRef: z2.string(),
-  severity: severitySchema,
-  explanation: z2.string()
-}).strict();
-var resultEnvelopeSchema = z2.object({
-  guardsFired: z2.array(firedGuardSchema),
-  severity: severitySchema.nullable(),
-  blocking: z2.boolean(),
-  explanation: z2.string()
-}).strict();
-var wireErrorSchema = z2.object({
-  statusCode: z2.number(),
-  error: z2.string(),
-  message: z2.string()
-}).strict();
-
-// ../events/dist/telemetry.js
-import { z as z3 } from "zod";
-var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
-var guardEvalOutcomeSchema = z3.enum([
-  "evaluated",
-  "infra-error",
-  "contract-error",
-  "unconfigured"
-]);
-var guardEvalRunSchema = z3.object({
-  // `runId`/`outcome` are the E2 run-observability additions, declared
-  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
-  // migration. Every new record populated by the migrated writer (T-07)
-  // carries both; a legacy line predating the amendment carries neither and
-  // must still parse (the mixed-era guard-eval log the Build-Record reader
-  // assembles from, and the runner emit not yet migrated). So the presence
-  // refinement below is skipped for a legacy line (no `outcome`), and the
-  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
-  // where the schema may then be tightened to required. runId is uuid-checked
-  // WHEN present; outcome is enum-checked when present.
-  runId: z3.string().uuid().optional(),
-  engagementId: z3.string().optional(),
-  runType: z3.enum(["hook", "ci"]),
-  occurredAt: utcIso8601,
-  outcome: guardEvalOutcomeSchema.optional(),
-  failureReason: z3.string().optional(),
-  phase: z3.string().optional(),
-  scope: z3.record(z3.string(), z3.unknown()),
-  cost: z3.record(z3.string(), z3.unknown()).optional(),
-  result: resultEnvelopeSchema.optional()
-}).strict().superRefine((run, ctx) => {
-  if (run.outcome === void 0)
+function applyOwnerOnly(path, dir) {
+  if (platform2() === "win32")
     return;
-  if (run.outcome === "evaluated" && run.result === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is required when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "evaluated" && run.result !== void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is only present when outcome is 'evaluated'"
-    });
+  try {
+    chmodSync2(path, 384);
+  } catch {
   }
-  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["engagementId"],
-      message: "engagementId is required unless outcome is 'unconfigured'"
-    });
+  try {
+    chmodSync2(dir, 448);
+  } catch {
   }
-});
-
-// ../events/dist/engagement-lifecycle.js
-import { z as z4 } from "zod";
-var utcIso86012 = z4.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
-var engagementTypeSchema = z4.enum(["client"]);
-var lifecycleStatusSchema = z4.enum(["active", "delivering", "closed"]);
-var createEngagementRequestSchema = z4.object({
-  name: z4.string(),
-  region: z4.string(),
-  engagementType: engagementTypeSchema
-}).strict();
-var createEngagementResponseSchema = z4.object({
-  engagementId: z4.string(),
-  name: z4.string(),
-  region: z4.string(),
-  status: lifecycleStatusSchema,
-  createdAt: utcIso86012,
-  sessionToken: z4.string()
-}).strict();
-var engagementStatusResponseSchema = z4.object({
-  engagementId: z4.string(),
-  name: z4.string(),
-  region: z4.string(),
-  status: lifecycleStatusSchema,
-  installLinked: z4.boolean(),
-  createdAt: utcIso86012,
-  updatedAt: utcIso86012
-}).strict();
-var linkInstallationRequestSchema = z4.object({
-  installationId: z4.string(),
-  engagementId: z4.string()
-}).strict();
-var startBuildRequestSchema = z4.object({
-  engagementId: z4.string()
-}).strict();
-var startBuildResponseSchema = z4.object({
-  engagementId: z4.string(),
-  status: lifecycleStatusSchema,
-  enqueuedAt: utcIso86012
-}).strict();
-var acceptanceOutcomeSchema = z4.object({
-  verdict: z4.enum(["clean", "defects"]),
-  findings: z4.number().int().nonnegative(),
-  findingsDetail: z4.array(z4.object({ summary: z4.string() }).strict())
-}).strict();
-var phaseCloseDecisionSchema = z4.discriminatedUnion("decision", [
-  z4.object({
-    decision: z4.literal("done-when-met"),
-    /** Who is closing the phase. */
-    actor: z4.string()
-  }).strict(),
-  z4.object({
-    decision: z4.literal("override"),
-    /** Who is closing it anyway. */
-    actor: z4.string(),
-    /** Why, in their own words. */
-    reason: z4.string()
-  }).strict()
-]);
-var acceptPhaseRequestSchema = z4.object({
-  phase: z4.string(),
-  acceptanceOutcome: acceptanceOutcomeSchema,
-  close: phaseCloseDecisionSchema.optional()
-}).strict();
-var coeFindingRequestSchema = z4.object({
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable()
-}).strict();
-var coeFindingResponseSchema = z4.object({
-  findingId: z4.string(),
-  engagementId: z4.string(),
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable(),
-  createdAt: utcIso86012
-}).strict();
-var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
-  z4.object({
-    decision: z4.literal("entry-condition-met"),
-    /** Who attests. */
-    actor: z4.string(),
-    /** What makes the entry condition hold, in the attester's own words. */
-    evidence: z4.string()
-  }).strict(),
-  z4.object({
-    decision: z4.literal("override"),
-    /** Who is opening it anyway. */
-    actor: z4.string(),
-    /** Why, in the operator's own words. */
-    reason: z4.string()
-  }).strict()
-]);
-var openPhaseRequestSchema = z4.object({
-  phase: z4.string().nullable(),
-  entry: phaseEntryDecisionSchema
-}).strict();
-var phaseEntryDecisionRecordSchema = z4.object({
-  decisionId: z4.string(),
-  decision: z4.enum(["entry-condition-met", "override"]),
-  actor: z4.string(),
-  /** The evidence (attestation) or the reason (override) — one basis per row. */
-  justification: z4.string(),
-  blockingFinding: z4.string().nullable(),
-  decidedAt: utcIso86012
-}).strict();
-var openPhaseResponseSchema = z4.object({
-  engagement: engagementStatusResponseSchema,
-  /** What is open now. `null` is project scope. */
-  phase: z4.string().nullable(),
-  /** What was open before this decision. `null` is project scope. */
-  previousPhase: z4.string().nullable(),
-  decision: phaseEntryDecisionRecordSchema
-}).strict();
+}
+function engagementResolutionShell() {
+  return `# --- Halfcycle credential resolution (generated; do not edit) ----------------
+# THE CREDENTIAL IS NOT IN THIS REPOSITORY. It lives at
+#   $HOME/.halfcycle/${ENGAGEMENTS_DIR}/<engagement-id>/${ENV_FILENAME}
+# written owner-only by \`npx halfcycle\`. What this repository holds is the
+# engagement id, in the committed .halfcycle/bundle.json. So: read the id out of
+# the pin, then name the file. There is no jq here and node is not dependable on a
+# desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
+# file, because sed is line-oriented and the pin's line breaks are not a contract.
+#
+# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
+# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
+# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
+# would discard everything it set.
+halfcycle_env_file() {
+  HALFCYCLE_ENV_FILE=""
+  HALFCYCLE_ENV_ENGAGEMENT=""
+  HALFCYCLE_ENV_PROBLEM=""
+  hc_pin="$1/.halfcycle/bundle.json"
+  if [ ! -f "$hc_pin" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-pin"
+    return 1
+  fi
+  hc_id=$(tr -d '\\n' < "$hc_pin" | sed -n 's/.*"${PIN_ENGAGEMENT_ID_FIELD}"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')
+  if [ -z "$hc_id" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-id"
+    return 1
+  fi
+  HALFCYCLE_ENV_ENGAGEMENT="$hc_id"
+  if [ -z "\${HOME:-}" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-home"
+    return 1
+  fi
+  hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
+  if [ ! -f "$hc_env" ]; then
+    HALFCYCLE_ENV_PROBLEM="no-credential"
+    return 1
+  fi
+  HALFCYCLE_ENV_FILE="$hc_env"
+  return 0
+}
+# --- end Halfcycle credential resolution ------------------------------------`;
+}
 
-// ../events/dist/device-auth.js
-import { z as z5 } from "zod";
-var utcIso86013 = z5.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
-var DEVICE_AUTH_STATUS = {
-  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
-  PENDING: "pending",
-  /** The poll: approved, and the credential is in this body. Once only. 200. */
-  APPROVED: "approved",
-  /** Confirm: the decision was recorded (approve or decline). 200. */
-  RECORDED: "recorded",
-  /** The human refused at the confirmation page. 400 on the poll. */
-  DECLINED: "declined",
-  /** The code's absolute expiry has passed. 400. */
-  EXPIRED: "expired",
-  /** Never minted, or already spent. 400. */
-  UNKNOWN: "unknown",
-  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
-  INVALID_DECISION: "invalid-decision",
-  /** Confirm: an approval arrived with no signed-in identity. 400. */
-  IDENTITY_REQUIRED: "identity-required",
-  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
-  NOT_CONFIGURED: "not-configured",
-  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
-  UNAUTHORIZED: "unauthorized",
-  /** Confirm: the code was already approved, declined or claimed. 409. */
-  ALREADY_DECIDED: "already-decided"
-};
-var DEVICE_POLL_REFUSALS = [
-  DEVICE_AUTH_STATUS.DECLINED,
-  DEVICE_AUTH_STATUS.EXPIRED,
-  DEVICE_AUTH_STATUS.UNKNOWN
-];
-var deviceAuthStartResponseSchema = z5.object({
-  deviceCode: z5.string().min(1),
-  userCode: z5.string().min(1),
-  verificationUrl: z5.string().min(1),
-  expiresAt: utcIso86013,
-  pollIntervalMs: z5.number().int().positive()
-}).strict();
-var devicePollPendingSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.PENDING),
-  pollIntervalMs: z5.number().int().positive()
-}).strict();
-var devicePollApprovedSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.APPROVED),
-  accountId: z5.string().min(1),
-  credential: z5.string().min(1),
-  expiresAt: utcIso86013
-}).strict();
-var deviceAuthRefusalSchema = z5.object({
-  status: z5.enum([
-    DEVICE_AUTH_STATUS.DECLINED,
-    DEVICE_AUTH_STATUS.EXPIRED,
-    DEVICE_AUTH_STATUS.UNKNOWN,
-    DEVICE_AUTH_STATUS.INVALID_DECISION,
-    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
-    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
-    DEVICE_AUTH_STATUS.UNAUTHORIZED,
-    DEVICE_AUTH_STATUS.ALREADY_DECIDED
-  ]),
-  message: z5.string().min(1)
-}).strict();
-var devicePollResponseSchema = z5.union([
-  devicePollPendingSchema,
-  devicePollApprovedSchema,
-  deviceAuthRefusalSchema
-]);
-var deviceConfirmRequestSchema = z5.object({
-  userCode: z5.string().min(1),
-  decision: z5.enum(["approve", "decline"]),
-  externalAuthId: z5.string().min(1).optional(),
-  email: z5.string().optional()
-}).strict();
-var deviceConfirmRecordedSchema = z5.object({
-  status: z5.literal(DEVICE_AUTH_STATUS.RECORDED),
-  accountId: z5.string().min(1).optional()
-}).strict();
-var deviceConfirmResponseSchema = z5.union([
-  deviceConfirmRecordedSchema,
-  deviceAuthRefusalSchema
-]);
-var LOOPBACK_REDIRECT_HOST = "127.0.0.1";
-var LOOPBACK_PORT_MIN = 1024;
-var LOOPBACK_PORT_MAX = 65535;
-var LOOPBACK_CALLBACK_PATH = "/halfcycle-cli-callback";
-var LOOPBACK_QUERY_PORT = "loopback_port";
-var LOOPBACK_QUERY_STATE = "loopback_state";
-var LOOPBACK_QUERY_RESULT = "result";
-var LOOPBACK_RESULT = {
-  APPROVED: "approved",
-  DECLINED: "declined"
-};
-function loopbackVerificationUrl(verificationUrl, target) {
-  let url;
+// dist/identity.js
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
+function git(targetRepoRoot, args2) {
   try {
-    url = new URL(verificationUrl);
+    const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const trimmed = out.trim();
+    return trimmed.length > 0 ? trimmed : null;
   } catch {
-    return verificationUrl;
+    return null;
   }
-  url.searchParams.set(LOOPBACK_QUERY_PORT, String(target.port));
-  url.searchParams.set(LOOPBACK_QUERY_STATE, target.state);
-  return url.toString();
+}
+function readRootCommit(targetRepoRoot) {
+  const roots = git(targetRepoRoot, ["rev-list", "--max-parents=0", "HEAD"]);
+  if (!roots)
+    return null;
+  const lines = roots.split("\n").filter((l) => l.length > 0);
+  return lines.length > 0 ? lines[lines.length - 1] : null;
+}
+function readRemote(targetRepoRoot) {
+  return git(targetRepoRoot, ["remote", "get-url", "origin"]);
+}
+function mintOrReadIdentity(targetRepoRoot) {
+  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
+  if (existsSync(path)) {
+    const onDisk = JSON.parse(readFileSync3(path, "utf-8"));
+    const identity2 = {
+      projectId: onDisk.projectId ?? "",
+      rootCommit: onDisk.rootCommit ?? null,
+      remote: onDisk.remote ?? null,
+      note: PROJECT_IDENTITY_NOTE
+    };
+    return { identity: identity2, minted: false };
+  }
+  const identity = {
+    projectId: randomUUID(),
+    rootCommit: readRootCommit(targetRepoRoot),
+    remote: readRemote(targetRepoRoot),
+    note: PROJECT_IDENTITY_NOTE
+  };
+  return { identity, minted: true };
+}
+
+// dist/mcp-endpoint.js
+var MCP_ENDPOINT_PATH = "/mcp";
+function mcpEndpointUrl(origin) {
+  return `${origin.trim().replace(/\/+$/, "")}${MCP_ENDPOINT_PATH}`;
+}
+
+// dist/merge-settings.js
+function isHalfcycleEntry(entry, halfcycleCommands) {
+  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
+}
+function mergeSettings(existing, generated) {
+  const merged = { ...existing };
+  if (generated.$schema !== void 0) {
+    merged.$schema = generated.$schema;
+  }
+  const generatedHooks = generated.hooks ?? {};
+  const halfcycleCommands = /* @__PURE__ */ new Set();
+  for (const entries of Object.values(generatedHooks)) {
+    for (const entry of entries) {
+      for (const h of entry.hooks)
+        halfcycleCommands.add(h.command);
+    }
+  }
+  const existingHooks = existing.hooks ?? {};
+  const mergedHooks = {};
+  const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
+  for (const event of events) {
+    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
+    const halfcycleEntries = generatedHooks[event] ?? [];
+    mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
+  }
+  merged.hooks = mergedHooks;
+  merged.permissions = mergePermissions(existing.permissions, generated.permissions);
+  return merged;
+}
+function mergePermissions(existing, generated) {
+  if (existing === void 0 && generated === void 0)
+    return void 0;
+  const result = { ...existing ?? {} };
+  const generatedDeny = generated?.deny ?? [];
+  if (generatedDeny.length > 0) {
+    const theirs = existing?.deny ?? [];
+    const seen = new Set(theirs);
+    result.deny = [...theirs, ...generatedDeny.filter((p) => !seen.has(p))];
+  }
+  return result;
 }
 
 // dist/scan.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
 var HALFCYCLE_STATE_NOTE = [
   "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
@@ -801,6 +899,18 @@ function writeCollisionSafe(targetAbsPath, targetRepoRoot, content) {
   writeFileSync4(targetAbsPath, content, "utf-8");
   return "written";
 }
+function writeOwned(targetAbsPath, targetRepoRoot, content) {
+  const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
+  if (!isAllowlisted(rel)) {
+    throw new Error(`[bundle install] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
+  }
+  if (existsSync3(targetAbsPath) && readFileSync5(targetAbsPath, "utf-8") === content) {
+    return "skipped";
+  }
+  mkdirSync4(dirname2(targetAbsPath), { recursive: true });
+  writeFileSync4(targetAbsPath, content, "utf-8");
+  return "written";
+}
 function record(report, outcome, rel) {
   const bucket = {
     written: report.writtenPaths,
@@ -921,6 +1031,42 @@ if [ -z "$REPO_ROOT" ]; then exit 0; fi
 HASH="$(echo -n "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
 MARKER_FILE="\${TMPDIR%/}/halfcycle-session-\${HASH}.ref"
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
+
+# ---------------------------------------------------------------------------
+# STANDING GUARD-COVERAGE STATEMENT (T-27).
+#
+# A repository with no credential on this machine is UNGUARDED: the PostToolUse
+# hook will find nothing to evaluate with, and it says so once per edit, after
+# the edit. This says it once, up front, before anything is written \u2014 which is
+# the one thing a session-start hook can do that nothing else can.
+#
+# Everything below runs in a SUBSHELL: it sources a credential store, and a
+# session-start hook must not leak an engagement's variables into whatever the
+# editor runs next. Any failure inside it is swallowed; this script's exit
+# status is 0 either way, and the marker above has already been written.
+# ---------------------------------------------------------------------------
+${engagementResolutionShell()}
+
+(
+  if halfcycle_env_file "$REPO_ROOT"; then
+    set -a
+    . "$HALFCYCLE_ENV_FILE"
+    set +a
+  fi
+  hc_missing=""
+  for hc_key in ${GUARD_ENV_KEYS.join(" ")}; do
+    eval "hc_value=\\\${$hc_key:-}"
+    if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
+  done
+  if [ -n "$hc_missing" ]; then
+    echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
+    echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
+    echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
+    echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
+    echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
+    echo "[halfcycle] and needs nothing configured first."
+  fi
+) 2>/dev/null || true
 exit 0
 `;
 }
@@ -934,6 +1080,13 @@ function generateUserPromptReminderHook() {
 # one home: RULE_SENTENCE_PLAIN in the method repo's own position-house-rule
 # test governs it \u2014 reword there and here together, in the same commit.
 #
+# SILENT WHEN THE TOOL IT NAMES IS NOT THERE. The sentence tells the session to
+# call halfcycle_resolve, which arrives over the Halfcycle MCP server registered
+# in .mcp.json. If this repository carries no such registration, the instruction
+# cannot be followed, and a per-prompt instruction that cannot be followed is
+# worse than silence. The standing "no coverage" statement belongs in the
+# session-start banner, which says it once; this hook just stops talking.
+#
 # FAILS OPEN. This hook's stdout is always plain text, never JSON, so it
 # cannot form a {"decision":"block",...} body (UserPromptSubmit's only way to
 # hold the turn). But a write failure here (a closed stdout, say) must still
@@ -941,6 +1094,26 @@ function generateUserPromptReminderHook() {
 # than propagate.
 trap 'exit 0' ERR
 set -e
+
+# The project root is resolved from THIS SCRIPT'S OWN LOCATION, never from the
+# session's cwd \u2014 a session started in a subdirectory must find the same root
+# .mcp.json the editor loaded, which is the bug mcp-headers.sh already paid for.
+HC_SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+HC_PROJECT_ROOT=$(CDPATH= cd -- "$HC_SCRIPT_DIR/../.." && pwd)
+HC_REGISTRATION="$HC_PROJECT_ROOT/${MCP_REGISTRATION_REL}"
+
+# Presence of the FILE is not enough \u2014 a developer's own .mcp.json with no
+# Halfcycle server in it registers no halfcycle_resolve. \`grep\` is guarded with
+# \`|| true\` because a non-match is a status, not an error, and \`set -e\` would
+# otherwise route it through the trap (same outcome here, but by accident).
+HC_REGISTERED=""
+if [ -f "$HC_REGISTRATION" ]; then
+  HC_REGISTERED=$(tr -d '\\n' < "$HC_REGISTRATION" | grep -c '"${MCP_SERVER_KEY}"[[:space:]]*:' || true)
+fi
+if [ -z "$HC_REGISTERED" ] || [ "$HC_REGISTERED" = "0" ]; then
+  exit 0
+fi
+
 printf '%s\\n' '${USER_PROMPT_REMINDER_SENTENCE}'
 exit 0
 `;
@@ -989,6 +1162,13 @@ var ENV_EXAMPLE_NAMES = [
   "GUARD_SERVICE_URL",
   "GUARD_SERVICE_TOKEN",
   "GUARD_ENGAGEMENT_ID",
+  // Declared for ONE reason only: it is written into the credential store, and the
+  // INV-004 check below requires every written name to be named here. It is NOT
+  // read from a client's environment — the generated CI stanza sets the three
+  // GUARD_* names and not this one, and `packages/runner` never reads it at all.
+  // It is how an install REMEMBERS the plane it was created against, which matters
+  // only to our own development and CI planes (operator amendment, 2026-08-30);
+  // nothing tells a client to set it, and the generated prose says so.
   "HALFCYCLE_SERVICE_URL",
   "HALFCYCLE_MCP_URL",
   "HALFCYCLE_TOKEN",
@@ -1022,8 +1202,14 @@ GUARD_ENGAGEMENT_ID=<argType:runtime>
 # TWO ORIGINS, TWO SERVICES (T-22). HALFCYCLE_SERVICE_URL is the Halfcycle
 # CONTROL plane \u2014 it serves engagement creation and the board's first-visit
 # code. HALFCYCLE_MCP_URL is the method-delivery service, which serves /mcp and
-# nothing else here. You configure the first; the platform reports the second on
-# create, so it is written for you and .mcp.json carries the composed address.
+# nothing else here. The platform reports the second on create, so it is written
+# for you and .mcp.json carries the composed address.
+#
+# NEITHER IS A SETTING. Both names are here because both are WRITTEN by the
+# installer into this engagement's credential, and every name it writes is declared
+# here \u2014 that is the rule this section exists for. Halfcycle's address ships in the
+# CLI and is the same one for everybody, so there is nothing to look up and nothing
+# to put in this file. Leave both lines exactly as they are.
 HALFCYCLE_SERVICE_URL=<argType:runtime>
 HALFCYCLE_MCP_URL=<argType:runtime>
 HALFCYCLE_TOKEN=<argType:runtime>
@@ -1036,6 +1222,7 @@ CONTROL_TELEMETRY_URL=<argType:runtime>
 `;
 }
 var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_SERVER_KEY = "halfcycle";
 var MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
 var MCP_HEADERS_HELPER_COMMAND = `/bin/sh -c 'd=$(pwd); while [ ! -f "$d/${MCP_HEADERS_HELPER_REL}" ] && [ "$d" != / ]; do d=$(dirname "$d"); done; [ -f "$d/${MCP_HEADERS_HELPER_REL}" ] || { echo "halfcycle: ${MCP_HEADERS_HELPER_REL} not found at or above $(pwd); re-run npx halfcycle" >&2; exit 1; }; exec /bin/sh "$d/${MCP_HEADERS_HELPER_REL}"'`;
 function generateMcpHeadersHelper() {
@@ -1148,7 +1335,7 @@ function generateMcpRegistration(existing, mcpOrigin) {
   if (typeof base.mcpServers !== "object" || base.mcpServers === null) {
     base.mcpServers = {};
   }
-  base.mcpServers["halfcycle"] = {
+  base.mcpServers[MCP_SERVER_KEY] = {
     type: "http",
     url: mcpEndpointUrl(mcpOrigin),
     headersHelper: MCP_HEADERS_HELPER_COMMAND
@@ -1208,6 +1395,16 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, w
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
 }
+function writeCrewRoster(targetRepoRoot, report) {
+  const doc = {
+    $comment: "GENERATED by the Halfcycle installer \u2014 do not edit by hand. Re-run the installer to pick up a roster change.",
+    crew: CREW_ROSTER
+  };
+  const rendered = `${JSON.stringify(doc, null, 2)}
+`;
+  const crewPath = join5(targetRepoRoot, ".halfcycle", "crew.json");
+  record(report, writeOwned(crewPath, targetRepoRoot, rendered), ".halfcycle/crew.json");
+}
 function readBundlePin(targetRepoRoot) {
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   if (!existsSync3(pinPath))
@@ -1370,7 +1567,7 @@ async function install(options) {
   }
   const vendoredBinSrc = resolveVendoredBinary();
   const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
-  record(report, writeCollisionSafe(vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8")), ".halfcycle/bin/bin.bundle.mjs");
+  record(report, writeOwned(vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8")), ".halfcycle/bin/bin.bundle.mjs");
   const settingsPath = join5(targetRepo, ".claude", "settings.json");
   const settingsPreexisted = existsSync3(settingsPath);
   const generatedSettings = JSON.parse(generateSettingsJson());
@@ -1439,6 +1636,7 @@ async function install(options) {
       break;
   }
   writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, report.writtenPaths);
+  writeCrewRoster(targetRepo, report);
   const scanResult = runBootstrapScan(targetRepo);
   return {
     version: manifest.version,
@@ -1451,6 +1649,18 @@ async function install(options) {
   };
 }
 
+// dist/control-origin.js
+var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
+function resolveControlOrigin(env = process.env) {
+  const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
+  if (configured)
+    return { origin: configured.replace(/\/+$/, ""), source: "environment" };
+  return { origin: DEFAULT_CONTROL_ORIGIN, source: "default" };
+}
+function controlOriginNote(resolved) {
+  return resolved.source === "environment" ? `${resolved.origin} (from HALFCYCLE_SERVICE_URL)` : `${resolved.origin} (the Halfcycle plane)`;
+}
+
 // dist/create-engagement.js
 var CreateEngagementRefused = class extends Error {
   status;
@@ -1508,7 +1718,7 @@ function planeRefusal(detail) {
     error: typeof candidate.error === "string" ? candidate.error : void 0
   };
 }
-var CONTROL_ORIGIN_HINT = "HALFCYCLE_SERVICE_URL must be the Halfcycle CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you do not configure it.";
+var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
 async function createEngagement(baseUrl, name, credential) {
   return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements`, name ? { name } : {}, credential, { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" });
 }
@@ -2500,7 +2710,7 @@ async function closePhase(credential, phase, outcome, close) {
   }
   const parsedClose = phaseCloseDecisionSchema.safeParse(close);
   if (!parsedClose.success) {
-    throw new Error(`[halfcycle] That is not a phase-close decision this platform accepts: ${parsedClose.error.issues.map((i) => i.message).join("; ")}.`);
+    throw new Error(`[halfcycle] That is not a phase-close decision this platform accepts: ${parsedClose.error.issues.map((i) => `${i.path.join(".") || "(decision)"}: ${i.message}`).join("; ")}.`);
   }
   const url = `${credential.serviceUrl}/engagements/${encodeURIComponent(credential.engagementId)}/accept`;
   let res;
@@ -2774,45 +2984,43 @@ ${USAGE}`);
       return;
     }
     try {
-      const serviceUrl = process.env.HALFCYCLE_SERVICE_URL?.trim();
-      const pinned = engagementIdArg === void 0 ? readPinnedEngagement(targetRepo) : null;
-      let engagementId = engagementIdArg ?? pinned?.engagementId ?? "engagement-001";
+      const controlOrigin = resolveControlOrigin(process.env);
+      const serviceUrl = controlOrigin.origin;
+      process.stdout.write(`[halfcycle] Halfcycle plane: ${controlOriginNote(controlOrigin)}
+`);
+      const pinned = readPinnedEngagement(targetRepo);
+      const requestedId = engagementIdArg ?? pinned?.engagementId;
+      const reusable = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
+      let engagementId;
       let credential;
-      if (pinned) {
-        credential = pinned.credential;
+      if (reusable !== void 0 && pinned !== null) {
+        engagementId = pinned.engagementId;
+        credential = reusable;
         process.stdout.write(`[halfcycle] Re-using the engagement already pinned in this repo: ${pinned.engagementId}
 `);
-        if (credential === void 0 && serviceUrl) {
-          const joined = await joinPinnedEngagement(serviceUrl, pinned.engagementId);
-          credential = {
-            serviceUrl,
-            token: joined.sessionToken,
-            mcpUrl: joined.mcpUrl,
-            guardUrl: joined.guardUrl,
-            // T-10 — optional; absent on a plane that has not configured
-            // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
-            // an absent value, never `undefined` verbatim.
-            controlTelemetryUrl: joined.controlTelemetryUrl
-          };
-          process.stdout.write(`[halfcycle] Joined engagement ${joined.engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
-`);
-        } else if (credential === void 0) {
-          process.stdout.write(`[halfcycle] This machine holds no credential for it, and HALFCYCLE_SERVICE_URL is not
-[halfcycle] set \u2014 so there is no plane to ask for one. Nothing will be minted, and the
-[halfcycle] board link and MCP calls will not work until it is. Looked in
-[halfcycle] ${engagementEnvPath(pinned.engagementId)}.
-[halfcycle] Set that variable and re-run to get a credential of your own for this
-[halfcycle] engagement. To start a NEW engagement instead, remove
-[halfcycle] .halfcycle/bundle.json first.
-`);
-        } else if (pinned.fromLegacyEnvLocal) {
+        if (pinned.fromLegacyEnvLocal) {
           process.stdout.write(`[halfcycle] Its credential is in this repository's .env.local \u2014 an install from before
 [halfcycle] credentials moved out of the tree. It is being copied to
 [halfcycle] ${engagementEnvPath(pinned.engagementId)} and taken back out of .env.local.
 [halfcycle] Anything else that file holds is untouched.
 `);
         }
-      } else if (serviceUrl && engagementIdArg === void 0) {
+      } else if (requestedId !== void 0) {
+        const joined = await joinPinnedEngagement(serviceUrl, requestedId);
+        engagementId = joined.engagementId;
+        credential = {
+          serviceUrl,
+          token: joined.sessionToken,
+          mcpUrl: joined.mcpUrl,
+          guardUrl: joined.guardUrl,
+          // T-10 — optional; absent on a plane that has not configured
+          // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
+          // an absent value, never `undefined` verbatim.
+          controlTelemetryUrl: joined.controlTelemetryUrl
+        };
+        process.stdout.write(`[halfcycle] Joined engagement ${joined.engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
+`);
+      } else {
         const created = await createOwnedEngagement(serviceUrl);
         engagementId = created.engagementId;
         credential = {
@@ -2863,44 +3071,32 @@ ${USAGE}`);
 [halfcycle] ${missing.length === 1 ? "it" : "them"}) and re-run, and the credential moves out of the tree.
 `);
       }
-      if (credential) {
-        const probe = await probeMcpOrigin(credential.mcpUrl);
-        if (probe.reached) {
-          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
-`);
-        } else {
-          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
-[halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not your HALFCYCLE_SERVICE_URL (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
-`);
-        }
-      }
-      if (credential) {
-        process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_ENV_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
+      const probe = await probeMcpOrigin(credential.mcpUrl);
+      if (probe.reached) {
+        process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
 `);
       } else {
-        const remedy = pinned ? `Set HALFCYCLE_SERVICE_URL to the Halfcycle CONTROL origin and re-run \u2014 this repo is pinned to engagement ${pinned.engagementId}, and with a plane to ask, the installer mints you a credential of your own for it, at ${engagementEnvPath(pinned.engagementId)}. To start a NEW engagement here instead, remove .halfcycle/bundle.json and re-run.` : engagementIdArg !== void 0 ? `This install named engagement ${engagementIdArg} explicitly, which skips the create that mints a credential. This repo is now pinned to it, so re-run \`npx halfcycle\` with no id and the installer will mint you a credential of your own for it. To start a NEW engagement instead, remove .halfcycle/bundle.json and re-run.` : `Set HALFCYCLE_SERVICE_URL to the Halfcycle CONTROL origin and re-run this installer.`;
-        process.stdout.write(`[halfcycle] Guard evaluation: OFF \u2014 this install had no credential, so no guard will run in this repository and edits are unguarded. ${remedy}
+        process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
+[halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not the CONTROL origin (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
 `);
       }
-      if (credential) {
-        process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
+      process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_ENV_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
 `);
-        process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
+      process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
 `);
-        process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
+      process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
 `);
-        reportClaudeCodeVersion();
-      }
-      if (credential) {
-        try {
-          const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
-          process.stdout.write(`[halfcycle] Your board (first visit): ${minted.boardUrl}
+      process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
 `);
-          process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
+      reportClaudeCodeVersion();
+      try {
+        const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
+        process.stdout.write(`[halfcycle] Your board (first visit): ${minted.boardUrl}
 `);
-        } catch {
-          process.stdout.write("[halfcycle] Your board: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
-        }
+        process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
+`);
+      } catch {
+        process.stdout.write("[halfcycle] Your board: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
       }
       process.exit(0);
     } catch (err) {