halfcycle 0.3.7 → 0.3.9

package/dist/index.js

@@ -3,6 +3,173 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as rea
 import { dirname as dirname2, join as join5, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
+// ../events/dist/result.js
+import { z as z2 } from "zod";
+
+// ../core/dist/guard-record.js
+import { z } from "zod";
+var severitySchema = z.enum(["info", "warn", "block"]);
+var channelSchema = z.enum(["stable", "candidate", "rented"]);
+var matcherKindSchema = z.enum(["grep", "ast", "integrationTest", "llm"]);
+var matcherConfigSchema = z.record(z.string(), z.unknown());
+var grepMatcherSchema = z.object({ kind: z.literal("grep"), config: matcherConfigSchema }).strict();
+var astMatcherSchema = z.object({ kind: z.literal("ast"), config: matcherConfigSchema }).strict();
+var integrationTestMatcherSchema = z.object({ kind: z.literal("integrationTest"), config: matcherConfigSchema }).strict();
+var llmMatcherSchema = z.object({ kind: z.literal("llm"), config: matcherConfigSchema }).strict();
+var matcherSchema = z.discriminatedUnion("kind", [
+  grepMatcherSchema,
+  astMatcherSchema,
+  integrationTestMatcherSchema,
+  llmMatcherSchema
+]);
+
+// ../events/dist/result.js
+var firedGuardSchema = z2.object({
+  guardId: z2.string(),
+  patternRef: z2.string(),
+  severity: severitySchema,
+  explanation: z2.string(),
+  /**
+   * The repo-relative path of the file this firing was decided on. The matcher
+   * has the file live at the moment it decides to fire; this is the field that
+   * carries the answer out. It is the CLIENT's own coordinate — the wire type
+   * still has no field for a matcher body, a channel, a version, a scope or a
+   * guard's provenance, and physically cannot carry one.
+   *
+   * THE PRESENCE RULE, WHICH LIVES HERE AND NOT IN A CONSUMER'S PROSE: every
+   * firing produced from this contract version onward carries `path`, so on the
+   * WIRE, absence means exactly one thing — a response from a guard service
+   * older than this contract. It is declared optional because a client's guard
+   * runner is built from its own checkout and calls a service that may be older
+   * than it; a required field would make that pairing unparseable.
+   *
+   * The rule does NOT transfer to a store that persists a firing, where an
+   * absent path has a second legitimate meaning: a row written before the
+   * column existed. A persisted NULL is therefore not a writer bug.
+   *
+   * NO SHAPE CONSTRAINT. This value is whatever the changed tree called the
+   * file. A consumer that maps it onto a coordinate with its own path rule must
+   * safe-parse it and decide what to do with a refusal, rather than assume the
+   * two shapes agree.
+   */
+  path: z2.string().optional()
+}).strict();
+var resultEnvelopeSchema = z2.object({
+  guardsFired: z2.array(firedGuardSchema),
+  severity: severitySchema.nullable(),
+  blocking: z2.boolean(),
+  explanation: z2.string()
+}).strict();
+var wireErrorSchema = z2.object({
+  statusCode: z2.number(),
+  error: z2.string(),
+  message: z2.string()
+}).strict();
+
+// ../events/dist/telemetry.js
+import { z as z3 } from "zod";
+var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
+var guardEvalOutcomeSchema = z3.enum([
+  "evaluated",
+  "infra-error",
+  "contract-error",
+  "unconfigured"
+]);
+var guardEvalRunSchema = z3.object({
+  // `runId`/`outcome` are the E2 run-observability additions, declared
+  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
+  // migration. Every new record populated by the migrated writer (T-07)
+  // carries both; a legacy line predating the amendment carries neither and
+  // must still parse (the mixed-era guard-eval log the Build-Record reader
+  // assembles from, and the runner emit not yet migrated). So the presence
+  // refinement below is skipped for a legacy line (no `outcome`), and the
+  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
+  // where the schema may then be tightened to required. runId is uuid-checked
+  // WHEN present; outcome is enum-checked when present.
+  runId: z3.string().uuid().optional(),
+  engagementId: z3.string().optional(),
+  runType: z3.enum(["hook", "ci"]),
+  occurredAt: utcIso8601,
+  outcome: guardEvalOutcomeSchema.optional(),
+  failureReason: z3.string().optional(),
+  phase: z3.string().optional(),
+  scope: z3.record(z3.string(), z3.unknown()),
+  cost: z3.record(z3.string(), z3.unknown()).optional(),
+  result: resultEnvelopeSchema.optional()
+}).strict().superRefine((run, ctx) => {
+  if (run.outcome === void 0)
+    return;
+  if (run.outcome === "evaluated" && run.result === void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["result"],
+      message: "result is required when outcome is 'evaluated'"
+    });
+  }
+  if (run.outcome !== "evaluated" && run.result !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["result"],
+      message: "result is only present when outcome is 'evaluated'"
+    });
+  }
+  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      path: ["engagementId"],
+      message: "engagementId is required unless outcome is 'unconfigured'"
+    });
+  }
+});
+
+// ../events/dist/crew.js
+import { z as z4 } from "zod";
+var crewGroupSchema = z4.enum(["builder", "reviewer", "always-on"]);
+var crewTierSchema = z4.enum(["deep", "standard", "fast"]);
+var CREW_DISCIPLINE_MAX = 64;
+var crewMemberSchema = z4.object({
+  // The agent's name. The same twenty-one on every project, so a name is a
+  // vocabulary a returning client already knows.
+  callsign: z4.string().min(1).max(32),
+  // Which of the three headings this member reads under.
+  group: crewGroupSchema,
+  // The kind of work this member takes. A task names a discipline, and only
+  // agents holding it can be dispatched to it.
+  discipline: z4.string().min(1).max(CREW_DISCIPLINE_MAX),
+  // How much thinking this member brings. There is no field naming the supplier
+  // behind it, on this shape or on any other.
+  tier: crewTierSchema
+}).strict();
+var CREW_ROSTER = [
+  // ── builders: code ──────────────────────────────────────────────────────────
+  { callsign: "ADA", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "OTTO", group: "builder", discipline: "implementation", tier: "deep" },
+  { callsign: "MILO", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "NOVA", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "KAI", group: "builder", discipline: "implementation", tier: "standard" },
+  { callsign: "HUGO", group: "builder", discipline: "infrastructure", tier: "standard" },
+  { callsign: "WREN", group: "builder", discipline: "refactor", tier: "fast" },
+  { callsign: "PIP", group: "builder", discipline: "refactor", tier: "fast" },
+  // ── builders: specs and docs ────────────────────────────────────────────────
+  { callsign: "IRIS", group: "builder", discipline: "feature spec", tier: "deep" },
+  { callsign: "JUNO", group: "builder", discipline: "feature spec", tier: "standard" },
+  { callsign: "LEX", group: "builder", discipline: "context & docs", tier: "fast" },
+  // ── reviewers ───────────────────────────────────────────────────────────────
+  { callsign: "VERA", group: "reviewer", discipline: "spec consistency", tier: "deep" },
+  { callsign: "ODIN", group: "reviewer", discipline: "cross-spec audit", tier: "deep" },
+  { callsign: "CASS", group: "reviewer", discipline: "code review", tier: "deep" },
+  { callsign: "THEO", group: "reviewer", discipline: "code review", tier: "standard" },
+  { callsign: "ECHO", group: "reviewer", discipline: "test quality", tier: "standard" },
+  { callsign: "MAVIS", group: "reviewer", discipline: "suites & coverage", tier: "standard" },
+  { callsign: "ZARA", group: "reviewer", discipline: "smoke & walk aid", tier: "standard" },
+  { callsign: "NORA", group: "reviewer", discipline: "evidence & provenance", tier: "fast" },
+  // ── always on: continuous, takes no task ────────────────────────────────────
+  { callsign: "ARGUS", group: "always-on", discipline: "guard \xB7 every diff", tier: "standard" },
+  { callsign: "ATLAS", group: "always-on", discipline: "coordinator", tier: "deep" }
+];
+var CREW_ROSTER_SIZE = CREW_ROSTER.length;
+var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
+
 // dist/engagement-credential.js
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -279,103 +446,6 @@ function mergePermissions(existing, generated) {
 // dist/scan.js
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
-
-// ../events/dist/result.js
-import { z as z2 } from "zod";
-
-// ../core/dist/guard-record.js
-import { z } from "zod";
-var severitySchema = z.enum(["info", "warn", "block"]);
-var channelSchema = z.enum(["stable", "candidate", "rented"]);
-var matcherKindSchema = z.enum(["grep", "ast", "integrationTest", "llm"]);
-var matcherConfigSchema = z.record(z.string(), z.unknown());
-var grepMatcherSchema = z.object({ kind: z.literal("grep"), config: matcherConfigSchema }).strict();
-var astMatcherSchema = z.object({ kind: z.literal("ast"), config: matcherConfigSchema }).strict();
-var integrationTestMatcherSchema = z.object({ kind: z.literal("integrationTest"), config: matcherConfigSchema }).strict();
-var llmMatcherSchema = z.object({ kind: z.literal("llm"), config: matcherConfigSchema }).strict();
-var matcherSchema = z.discriminatedUnion("kind", [
-  grepMatcherSchema,
-  astMatcherSchema,
-  integrationTestMatcherSchema,
-  llmMatcherSchema
-]);
-
-// ../events/dist/result.js
-var firedGuardSchema = z2.object({
-  guardId: z2.string(),
-  patternRef: z2.string(),
-  severity: severitySchema,
-  explanation: z2.string()
-}).strict();
-var resultEnvelopeSchema = z2.object({
-  guardsFired: z2.array(firedGuardSchema),
-  severity: severitySchema.nullable(),
-  blocking: z2.boolean(),
-  explanation: z2.string()
-}).strict();
-var wireErrorSchema = z2.object({
-  statusCode: z2.number(),
-  error: z2.string(),
-  message: z2.string()
-}).strict();
-
-// ../events/dist/telemetry.js
-import { z as z3 } from "zod";
-var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z (INV-015)");
-var guardEvalOutcomeSchema = z3.enum([
-  "evaluated",
-  "infra-error",
-  "contract-error",
-  "unconfigured"
-]);
-var guardEvalRunSchema = z3.object({
-  // `runId`/`outcome` are the E2 run-observability additions, declared
-  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
-  // migration. Every new record populated by the migrated writer (T-07)
-  // carries both; a legacy line predating the amendment carries neither and
-  // must still parse (the mixed-era guard-eval log the Build-Record reader
-  // assembles from, and the runner emit not yet migrated). So the presence
-  // refinement below is skipped for a legacy line (no `outcome`), and the
-  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
-  // where the schema may then be tightened to required. runId is uuid-checked
-  // WHEN present; outcome is enum-checked when present.
-  runId: z3.string().uuid().optional(),
-  engagementId: z3.string().optional(),
-  runType: z3.enum(["hook", "ci"]),
-  occurredAt: utcIso8601,
-  outcome: guardEvalOutcomeSchema.optional(),
-  failureReason: z3.string().optional(),
-  phase: z3.string().optional(),
-  scope: z3.record(z3.string(), z3.unknown()),
-  cost: z3.record(z3.string(), z3.unknown()).optional(),
-  result: resultEnvelopeSchema.optional()
-}).strict().superRefine((run, ctx) => {
-  if (run.outcome === void 0)
-    return;
-  if (run.outcome === "evaluated" && run.result === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is required when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "evaluated" && run.result !== void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is only present when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["engagementId"],
-      message: "engagementId is required unless outcome is 'unconfigured'"
-    });
-  }
-});
-
-// dist/scan.js
 var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
 var HALFCYCLE_STATE_NOTE = [
   "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
@@ -526,6 +596,18 @@ function writeCollisionSafe(targetAbsPath, targetRepoRoot, content) {
   writeFileSync3(targetAbsPath, content, "utf-8");
   return "written";
 }
+function writeOwned(targetAbsPath, targetRepoRoot, content) {
+  const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
+  if (!isAllowlisted(rel)) {
+    throw new Error(`[bundle install] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
+  }
+  if (existsSync3(targetAbsPath) && readFileSync4(targetAbsPath, "utf-8") === content) {
+    return "skipped";
+  }
+  mkdirSync3(dirname2(targetAbsPath), { recursive: true });
+  writeFileSync3(targetAbsPath, content, "utf-8");
+  return "written";
+}
 function record(report, outcome, rel) {
   const bucket = {
     written: report.writtenPaths,
@@ -646,6 +728,42 @@ if [ -z "$REPO_ROOT" ]; then exit 0; fi
 HASH="$(echo -n "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
 MARKER_FILE="\${TMPDIR%/}/halfcycle-session-\${HASH}.ref"
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
+
+# ---------------------------------------------------------------------------
+# STANDING GUARD-COVERAGE STATEMENT (T-27).
+#
+# A repository with no credential on this machine is UNGUARDED: the PostToolUse
+# hook will find nothing to evaluate with, and it says so once per edit, after
+# the edit. This says it once, up front, before anything is written \u2014 which is
+# the one thing a session-start hook can do that nothing else can.
+#
+# Everything below runs in a SUBSHELL: it sources a credential store, and a
+# session-start hook must not leak an engagement's variables into whatever the
+# editor runs next. Any failure inside it is swallowed; this script's exit
+# status is 0 either way, and the marker above has already been written.
+# ---------------------------------------------------------------------------
+${engagementResolutionShell()}
+
+(
+  if halfcycle_env_file "$REPO_ROOT"; then
+    set -a
+    . "$HALFCYCLE_ENV_FILE"
+    set +a
+  fi
+  hc_missing=""
+  for hc_key in ${GUARD_ENV_KEYS.join(" ")}; do
+    eval "hc_value=\\\${$hc_key:-}"
+    if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
+  done
+  if [ -n "$hc_missing" ]; then
+    echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
+    echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
+    echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
+    echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
+    echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
+    echo "[halfcycle] and needs nothing configured first."
+  fi
+) 2>/dev/null || true
 exit 0
 `;
 }
@@ -659,6 +777,13 @@ function generateUserPromptReminderHook() {
 # one home: RULE_SENTENCE_PLAIN in the method repo's own position-house-rule
 # test governs it \u2014 reword there and here together, in the same commit.
 #
+# SILENT WHEN THE TOOL IT NAMES IS NOT THERE. The sentence tells the session to
+# call halfcycle_resolve, which arrives over the Halfcycle MCP server registered
+# in .mcp.json. If this repository carries no such registration, the instruction
+# cannot be followed, and a per-prompt instruction that cannot be followed is
+# worse than silence. The standing "no coverage" statement belongs in the
+# session-start banner, which says it once; this hook just stops talking.
+#
 # FAILS OPEN. This hook's stdout is always plain text, never JSON, so it
 # cannot form a {"decision":"block",...} body (UserPromptSubmit's only way to
 # hold the turn). But a write failure here (a closed stdout, say) must still
@@ -666,6 +791,26 @@ function generateUserPromptReminderHook() {
 # than propagate.
 trap 'exit 0' ERR
 set -e
+
+# The project root is resolved from THIS SCRIPT'S OWN LOCATION, never from the
+# session's cwd \u2014 a session started in a subdirectory must find the same root
+# .mcp.json the editor loaded, which is the bug mcp-headers.sh already paid for.
+HC_SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+HC_PROJECT_ROOT=$(CDPATH= cd -- "$HC_SCRIPT_DIR/../.." && pwd)
+HC_REGISTRATION="$HC_PROJECT_ROOT/${MCP_REGISTRATION_REL}"
+
+# Presence of the FILE is not enough \u2014 a developer's own .mcp.json with no
+# Halfcycle server in it registers no halfcycle_resolve. \`grep\` is guarded with
+# \`|| true\` because a non-match is a status, not an error, and \`set -e\` would
+# otherwise route it through the trap (same outcome here, but by accident).
+HC_REGISTERED=""
+if [ -f "$HC_REGISTRATION" ]; then
+  HC_REGISTERED=$(tr -d '\\n' < "$HC_REGISTRATION" | grep -c '"${MCP_SERVER_KEY}"[[:space:]]*:' || true)
+fi
+if [ -z "$HC_REGISTERED" ] || [ "$HC_REGISTERED" = "0" ]; then
+  exit 0
+fi
+
 printf '%s\\n' '${USER_PROMPT_REMINDER_SENTENCE}'
 exit 0
 `;
@@ -714,6 +859,13 @@ var ENV_EXAMPLE_NAMES = [
   "GUARD_SERVICE_URL",
   "GUARD_SERVICE_TOKEN",
   "GUARD_ENGAGEMENT_ID",
+  // Declared for ONE reason only: it is written into the credential store, and the
+  // INV-004 check below requires every written name to be named here. It is NOT
+  // read from a client's environment — the generated CI stanza sets the three
+  // GUARD_* names and not this one, and `packages/runner` never reads it at all.
+  // It is how an install REMEMBERS the plane it was created against, which matters
+  // only to our own development and CI planes (operator amendment, 2026-08-30);
+  // nothing tells a client to set it, and the generated prose says so.
   "HALFCYCLE_SERVICE_URL",
   "HALFCYCLE_MCP_URL",
   "HALFCYCLE_TOKEN",
@@ -747,8 +899,14 @@ GUARD_ENGAGEMENT_ID=<argType:runtime>
 # TWO ORIGINS, TWO SERVICES (T-22). HALFCYCLE_SERVICE_URL is the Halfcycle
 # CONTROL plane \u2014 it serves engagement creation and the board's first-visit
 # code. HALFCYCLE_MCP_URL is the method-delivery service, which serves /mcp and
-# nothing else here. You configure the first; the platform reports the second on
-# create, so it is written for you and .mcp.json carries the composed address.
+# nothing else here. The platform reports the second on create, so it is written
+# for you and .mcp.json carries the composed address.
+#
+# NEITHER IS A SETTING. Both names are here because both are WRITTEN by the
+# installer into this engagement's credential, and every name it writes is declared
+# here \u2014 that is the rule this section exists for. Halfcycle's address ships in the
+# CLI and is the same one for everybody, so there is nothing to look up and nothing
+# to put in this file. Leave both lines exactly as they are.
 HALFCYCLE_SERVICE_URL=<argType:runtime>
 HALFCYCLE_MCP_URL=<argType:runtime>
 HALFCYCLE_TOKEN=<argType:runtime>
@@ -761,6 +919,7 @@ CONTROL_TELEMETRY_URL=<argType:runtime>
 `;
 }
 var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_SERVER_KEY = "halfcycle";
 var MCP_HEADERS_HELPER_REL = ".halfcycle/mcp-headers.sh";
 var MCP_HEADERS_HELPER_COMMAND = `/bin/sh -c 'd=$(pwd); while [ ! -f "$d/${MCP_HEADERS_HELPER_REL}" ] && [ "$d" != / ]; do d=$(dirname "$d"); done; [ -f "$d/${MCP_HEADERS_HELPER_REL}" ] || { echo "halfcycle: ${MCP_HEADERS_HELPER_REL} not found at or above $(pwd); re-run npx halfcycle" >&2; exit 1; }; exec /bin/sh "$d/${MCP_HEADERS_HELPER_REL}"'`;
 function generateMcpHeadersHelper() {
@@ -873,7 +1032,7 @@ function generateMcpRegistration(existing, mcpOrigin) {
   if (typeof base.mcpServers !== "object" || base.mcpServers === null) {
     base.mcpServers = {};
   }
-  base.mcpServers["halfcycle"] = {
+  base.mcpServers[MCP_SERVER_KEY] = {
     type: "http",
     url: mcpEndpointUrl(mcpOrigin),
     headersHelper: MCP_HEADERS_HELPER_COMMAND
@@ -933,6 +1092,16 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, w
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
 }
+function writeCrewRoster(targetRepoRoot, report) {
+  const doc = {
+    $comment: "GENERATED by the Halfcycle installer \u2014 do not edit by hand. Re-run the installer to pick up a roster change.",
+    crew: CREW_ROSTER
+  };
+  const rendered = `${JSON.stringify(doc, null, 2)}
+`;
+  const crewPath = join5(targetRepoRoot, ".halfcycle", "crew.json");
+  record(report, writeOwned(crewPath, targetRepoRoot, rendered), ".halfcycle/crew.json");
+}
 function readBundlePin(targetRepoRoot) {
   const pinPath = join5(targetRepoRoot, ".halfcycle", "bundle.json");
   if (!existsSync3(pinPath))
@@ -1058,7 +1227,7 @@ async function install(options) {
   }
   const vendoredBinSrc = resolveVendoredBinary();
   const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
-  record(report, writeCollisionSafe(vendoredBinDest, targetRepo, readFileSync4(vendoredBinSrc, "utf-8")), ".halfcycle/bin/bin.bundle.mjs");
+  record(report, writeOwned(vendoredBinDest, targetRepo, readFileSync4(vendoredBinSrc, "utf-8")), ".halfcycle/bin/bin.bundle.mjs");
   const settingsPath = join5(targetRepo, ".claude", "settings.json");
   const settingsPreexisted = existsSync3(settingsPath);
   const generatedSettings = JSON.parse(generateSettingsJson());
@@ -1127,6 +1296,7 @@ async function install(options) {
       break;
   }
   writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, report.writtenPaths);
+  writeCrewRoster(targetRepo, report);
   const scanResult = runBootstrapScan(targetRepo);
   return {
     version: manifest.version,
@@ -1139,6 +1309,9 @@ async function install(options) {
   };
 }
 
+// dist/control-origin.js
+var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
+
 // dist/create-engagement.js
 var CreateEngagementRefused = class extends Error {
   status;
@@ -1196,7 +1369,7 @@ function planeRefusal(detail) {
     error: typeof candidate.error === "string" ? candidate.error : void 0
   };
 }
-var CONTROL_ORIGIN_HINT = "HALFCYCLE_SERVICE_URL must be the Halfcycle CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you do not configure it.";
+var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
 async function createEngagement(baseUrl, name, credential) {
   return requestEngagementValues(`${baseUrl.replace(/\/+$/, "")}/engagements`, name ? { name } : {}, credential, { action: "Create-engagement", nothingHappened: "No engagement was created", route: "POST /engagements" });
 }