halfcycle 0.4.2 → 0.4.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // dist/bin.js
-import { existsSync as existsSync7, readFileSync as readFileSync11, realpathSync as realpathSync3, statSync } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync11, realpathSync as realpathSync3, statSync, writeSync as writeSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join12 } from "node:path";
 
@@ -1648,12 +1648,20 @@ function createProjectIdentityFile(targetRepoRoot) {
 }
 
 // dist/install-manifest.js
+import { Buffer as Buffer2 } from "node:buffer";
 import { createHash } from "node:crypto";
 var INSTALL_MANIFEST_REL = ".halfcycle/install-manifest.json";
 var INSTALL_MANIFEST_FORMAT = "halfcycle-install-manifest/v1";
 function sha256Hex(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
+function lineKey(line) {
+  return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+function fileSha256(bytes) {
+  const text = typeof bytes === "string" ? bytes : Buffer2.from(bytes).toString("utf-8");
+  return sha256Hex(text.split("\n").map(lineKey).join("\n"));
+}
 function canonicalJson(value) {
   if (Array.isArray(value))
     return value.map(canonicalJson);
@@ -1836,7 +1844,7 @@ function startManifest(previous, isMember, isMemberDir) {
   };
 }
 function recordInstalledFile(draft, path, bytes) {
-  draft.files.set(path, { path, sha256: sha256Hex(bytes) });
+  draft.files.set(path, { path, sha256: fileSha256(bytes) });
 }
 function recordRemovedFile(draft, path) {
   draft.files.delete(path);
@@ -1942,8 +1950,20 @@ function projectPageUrl(engagementId) {
 }
 
 // dist/merge-settings.js
+function isHalfcycleCommand(hook, halfcycleCommands) {
+  if (typeof hook !== "object" || hook === null)
+    return false;
+  const command = hook.command;
+  return typeof command === "string" && halfcycleCommands.has(command);
+}
 function isHalfcycleEntry(entry, halfcycleCommands) {
-  return entry.hooks.some((h) => halfcycleCommands.has(h.command));
+  return entry.hooks.some((h) => isHalfcycleCommand(h, halfcycleCommands));
+}
+function withoutHalfcycleCommands(entry, halfcycleCommands) {
+  if (!isHalfcycleEntry(entry, halfcycleCommands))
+    return entry;
+  const remaining = entry.hooks.filter((h) => !isHalfcycleCommand(h, halfcycleCommands));
+  return remaining.length > 0 ? { ...entry, hooks: remaining } : null;
 }
 function mergeSettings(existing, generated) {
   const merged = { ...existing };
@@ -1962,7 +1982,7 @@ function mergeSettings(existing, generated) {
   const mergedHooks = {};
   const events = /* @__PURE__ */ new Set([...Object.keys(existingHooks), ...Object.keys(generatedHooks)]);
   for (const event of events) {
-    const developerEntries = (existingHooks[event] ?? []).filter((entry) => !isHalfcycleEntry(entry, halfcycleCommands));
+    const developerEntries = (existingHooks[event] ?? []).flatMap((entry) => withoutHalfcycleCommands(entry, halfcycleCommands) ?? []);
     const halfcycleEntries = generatedHooks[event] ?? [];
     mergedHooks[event] = [...developerEntries, ...halfcycleEntries];
   }
@@ -2130,6 +2150,7 @@ function closedWriteSet() {
     ownedDirs,
     hookCommands: new Set(HALFCYCLE_HOOK_COMMANDS),
     denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
+    settingsSchema: SETTINGS_SCHEMA,
     gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL]),
     gitattributesLines: /* @__PURE__ */ new Set([
       GITATTRIBUTES_HEADER,
@@ -2142,17 +2163,17 @@ function sha256OfWhatThisVersionWrites(commands) {
   const out = /* @__PURE__ */ new Map();
   const fromFile = (rel, src) => {
     if (existsSync3(src))
-      out.set(rel, sha256Hex(readFileSync5(src)));
+      out.set(rel, fileSha256(readFileSync5(src)));
   };
   for (const cmd of commands)
     fromFile(commandStubRel(cmd.name), join5(BUNDLE_ROOT, ".claude-plugin", cmd.path));
   for (const [rel, content] of hookScriptsThisVersionWrites())
-    out.set(rel, sha256Hex(content));
+    out.set(rel, fileSha256(content));
   fromFile(CAPTURED_INDEX_REL, capturedIndexScaffold());
   return out;
 }
 function bytesAreOurs(path, bytes, recorded, writeSet) {
-  const hash = sha256Hex(bytes);
+  const hash = fileSha256(bytes);
   const recordedHash = recorded !== void 0 && "sha256" in recorded ? recorded.sha256 : void 0;
   return hash === recordedHash || hash === writeSet.generatedSha256.get(path);
 }
@@ -2318,6 +2339,8 @@ function copyManifestCommands(manifest, targetRepo, report, draft, writeSet) {
     record(report, outcome, rel);
     if (replacedExisting)
       report.replacedPaths.push(rel);
+    if (outcome === "collided" && recorded !== void 0)
+      report.editedCollidedPaths.push(rel);
     noteFile(draft, targetRepo, rel, outcome);
   }
 }
@@ -2338,16 +2361,17 @@ function writeCollisionSafe(targetAbsPath, targetRepoRoot, content, isOurs) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
   let replacedExisting = false;
-  if (existsSync3(targetAbsPath)) {
-    const current = readFileSync5(targetAbsPath);
-    if (current.toString("utf-8") === content)
+  const current = existsSync3(targetAbsPath) ? readFileSync5(targetAbsPath) : null;
+  const text = inLineEndingOf(current?.toString("utf-8") ?? null, content);
+  if (current !== null) {
+    if (current.toString("utf-8") === text)
       return { outcome: "skipped", replacedExisting: false };
     if (!isOurs(current))
       return { outcome: "collided", replacedExisting: false };
     replacedExisting = true;
   }
   mkdirSync5(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync5(targetAbsPath, content, "utf-8");
+  writeFileSync5(targetAbsPath, text, "utf-8");
   return { outcome: "written", replacedExisting };
 }
 var INSTALLER_OWNED_DIR = ".halfcycle/";
@@ -2359,11 +2383,12 @@ function writeOwned(targetAbsPath, targetRepoRoot, content) {
   if (!rel.startsWith(INSTALLER_OWNED_DIR)) {
     throw new Error(`[halfcycle] Path-ownership violation: attempted to claim "${rel}" by path. Only ${INSTALLER_OWNED_DIR} is owned outright by this installer; everywhere else a differing file may be a developer's, so ownership must be proved from the file's own contents (writeOwnedGenerated) rather than assumed from where it sits.`);
   }
-  if (existsSync3(targetAbsPath) && readFileSync5(targetAbsPath, "utf-8") === content) {
+  const current = readFileOrNull(targetAbsPath);
+  const text = inLineEndingOf(current, content);
+  if (current === text)
     return "skipped";
-  }
   mkdirSync5(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync5(targetAbsPath, content, "utf-8");
+  writeFileSync5(targetAbsPath, text, "utf-8");
   return "written";
 }
 var GENERATED_HEADER_LINE_INDEX = 1;
@@ -2441,6 +2466,7 @@ function settingsParseRefusal(targetRepo, err) {
   }
   return `${file} could not be read as JSON${where} \u2014 fix it and run "npx halfcycle" again.`;
 }
+var SETTINGS_SCHEMA = "https://json.schemastore.org/claude-code-settings.json";
 function generateSettingsJson() {
   const hooks = {};
   for (const { event, matcher, timeout, command } of HALFCYCLE_HOOK_WIRING) {
@@ -2450,7 +2476,7 @@ function generateSettingsJson() {
     });
   }
   const settings = {
-    $schema: "https://json.schemastore.org/claude-code-settings.json",
+    $schema: SETTINGS_SCHEMA,
     permissions: {
       // deny ONLY. See DENY_PATTERNS — an allow list evaporates under bypass mode
       // and is the machine owner's grant to make, not ours.
@@ -2750,19 +2776,27 @@ function adoptBlockUnderHeader(before, header, claimable) {
   let underHeader = false;
   const lines = before.split("\n");
   for (const [i, line] of lines.entries()) {
-    if (line === header) {
-      if (i > 0 && lines[i - 1] === "")
-        claimed.push("");
+    const key = lineKey(line);
+    if (key === header) {
+      if (i > 0 && lineKey(lines[i - 1]) === "")
+        claimed.push(lines[i - 1]);
       claimed.push(line);
       underHeader = true;
-    } else if (line.trim() === "") {
+    } else if (key.trim() === "") {
       underHeader = false;
-    } else if (underHeader && claimable.has(line)) {
+    } else if (underHeader && claimable.has(key)) {
       claimed.push(line);
     }
   }
   return claimed.length > 0 ? claimed.join("\n") + "\n" : "";
 }
+function lineEndingOf(text) {
+  const at = text.indexOf("\n");
+  return at > 0 && text[at - 1] === "\r" ? "\r\n" : "\n";
+}
+function inLineEndingOf(existing, generated) {
+  return existing === null ? generated : generated.split("\n").join(lineEndingOf(existing));
+}
 function gitignoreCovers(content) {
   const lines = new Set(content.split("\n").map((l) => l.trim()));
   return REQUIRED_GITIGNORE_ENTRIES.every((entry) => lines.has(entry));
@@ -2781,9 +2815,8 @@ function reconcileGitignore(targetRepo) {
       return "skipped";
     const existingLines = new Set(existing.split("\n").map((l) => l.trim()));
     const toAdd = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !existingLines.has(entry));
-    const suffix = (existing.endsWith("\n") ? "" : "\n") + `
-${header}
-` + toAdd.join("\n") + "\n";
+    const eol = lineEndingOf(existing);
+    const suffix = (existing.endsWith("\n") ? "" : eol) + eol + [header, ...toAdd].join(eol) + eol;
     writeFileSync5(gitignorePath, existing + suffix, "utf-8");
     return "written";
   } catch {
@@ -2818,8 +2851,9 @@ function reconcileGitattributes(targetRepo) {
     const toAdd = rules.filter((rule) => !present.has(rule));
     if (toAdd.length === 0)
       return "skipped";
-    const separator = existing === "" ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-    const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join("\n") + "\n";
+    const eol = lineEndingOf(existing);
+    const separator = existing === "" ? "" : existing.endsWith("\n") ? eol : eol + eol;
+    const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join(eol) + eol;
     writeAllowlisted(path, targetRepo, existing + suffix, routed);
     return "written";
   } catch {
@@ -2839,9 +2873,9 @@ function previousPinForEngagement(targetRepoRoot, engagementId) {
 function nonEmpty(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, accountId, methodVersion, writtenPaths) {
+function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, createdByAccountId, methodVersion, writtenPaths) {
   const previous = previousPinForEngagement(targetRepoRoot, engagementId);
-  const carried = nonEmpty(accountId) ?? nonEmpty(previous?.accountId);
+  const carried = pinCreatedByAccountId(previous) ?? nonEmpty(createdByAccountId);
   const carriedMethodVersion = nonEmpty(methodVersion) ?? nonEmpty(previous?.methodVersion);
   const installedAt = nonEmpty(previous?.installedAt) ?? (/* @__PURE__ */ new Date()).toISOString();
   const projectPage = projectPageUrl(engagementId);
@@ -2850,12 +2884,13 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, a
     engagementId,
     engagementType,
     installedAt,
-    ...carried !== void 0 ? { accountId: carried } : {},
+    ...carried !== void 0 ? { createdByAccountId: carried } : {},
     ...carriedMethodVersion !== void 0 ? { methodVersion: carriedMethodVersion } : {},
     ...projectPage !== void 0 ? { projectPage } : {}
   };
   const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
-  writeAllowlisted(pinPath, targetRepoRoot, JSON.stringify(pin, null, 2) + "\n", writtenPaths);
+  const pinText = inLineEndingOf(readFileOrNull(pinPath), JSON.stringify(pin, null, 2) + "\n");
+  writeAllowlisted(pinPath, targetRepoRoot, pinText, writtenPaths);
 }
 function writeCrewRoster(targetRepoRoot, report) {
   const doc = {
@@ -2867,6 +2902,9 @@ function writeCrewRoster(targetRepoRoot, report) {
   const crewPath = join5(targetRepoRoot, CREW_ROSTER_REL);
   return recordOwned(report, crewPath, targetRepoRoot, rendered, CREW_ROSTER_REL);
 }
+function pinCreatedByAccountId(pin) {
+  return nonEmpty(pin?.createdByAccountId) ?? nonEmpty(pin?.accountId);
+}
 function readBundlePin(targetRepoRoot) {
   const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
   if (!existsSync3(pinPath))
@@ -3008,7 +3046,7 @@ function migrateLegacyEnvLocal(targetRepo, stored) {
   }
 }
 async function install(options) {
-  const { targetRepo, engagementId, engagementType, credential, home, accountId } = options;
+  const { targetRepo, engagementId, engagementType, credential, home, createdByAccountId } = options;
   assertEngagementId(engagementId);
   if (!existsSync3(targetRepo)) {
     throw new Error(`[halfcycle] Target repo does not exist: ${targetRepo}`);
@@ -3019,6 +3057,7 @@ async function install(options) {
     skippedPaths: [],
     mergedPaths: [],
     collidedPaths: [],
+    editedCollidedPaths: [],
     replacedPaths: []
   };
   const writeSet = closedWriteSet();
@@ -3040,7 +3079,7 @@ async function install(options) {
   }
   recordSettingsMerge(draft, existingSettings, generatedSettings, settingsPreexisted);
   const mergedSettings = mergeSettings(existingSettings, generatedSettings);
-  const mergedSettingsText = JSON.stringify(mergedSettings, null, 2) + "\n";
+  const mergedSettingsText = inLineEndingOf(readFileOrNull(settingsPath), JSON.stringify(mergedSettings, null, 2) + "\n");
   mkdirSync5(dirname3(settingsPath), { recursive: true });
   writeFileSync5(settingsPath, mergedSettingsText, "utf-8");
   (settingsPreexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
@@ -3068,7 +3107,7 @@ async function install(options) {
   if (credential) {
     const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
     const existingMcp = existsSync3(mcpPath) ? readFileSync5(mcpPath, "utf-8") : null;
-    const mcpContent = generateMcpRegistration(existingMcp, credential.mcpUrl);
+    const mcpContent = inLineEndingOf(existingMcp, generateMcpRegistration(existingMcp, credential.mcpUrl));
     recordMcpMerge(draft, existingMcp, mcpContent);
     if (existingMcp === null) {
       writeAllowlisted(mcpPath, targetRepo, mcpContent, report.writtenPaths);
@@ -3146,7 +3185,7 @@ async function install(options) {
     case "absent":
       break;
   }
-  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, accountId, credential?.methodVersion, report.writtenPaths);
+  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, createdByAccountId, credential?.methodVersion, report.writtenPaths);
   noteFile(draft, targetRepo, BUNDLE_PIN_REL, "written");
   noteFile(draft, targetRepo, CREW_ROSTER_REL, writeCrewRoster(targetRepo, report));
   const scanResult = runBootstrapScan(targetRepo);
@@ -3166,6 +3205,7 @@ async function install(options) {
     skippedPaths: report.skippedPaths,
     mergedPaths: report.mergedPaths,
     collidedPaths: report.collidedPaths,
+    editedCollidedPaths: report.editedCollidedPaths,
     replacedPaths: report.replacedPaths,
     bootstrapScanRan: scanResult.ran,
     legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null,
@@ -3606,7 +3646,7 @@ async function signIn(serviceUrl, deps = {}) {
       const url = loopbackVerificationUrl(started.verificationUrl, bind.target);
       const attempt = await openBrowser(url, env);
       if (attempt.opened) {
-        write(`[halfcycle] Opened your browser to finish signing in. Code: ${started.userCode}. If a browser did not open, go to: ${url}. This terminal is waiting.
+        write(`[halfcycle] Opened your browser to finish signing in. Code: ${started.userCode}. If a browser did not open, go to: ${started.verificationUrl}. This terminal is waiting.
 `);
         const startedAt = now();
         const redirect = bind.waitForCallback({
@@ -4171,17 +4211,13 @@ async function askAccount(serviceUrl, credential, fetchImpl = fetch) {
 async function describeAccount(serviceUrl, credential, fetchImpl = fetch) {
   return (await askAccount(serviceUrl, credential, fetchImpl)).identity;
 }
-function accountLabel(identity, storedAccountId, verbose2 = false, confirmed = true) {
-  const accountId = identity?.accountId ?? storedAccountId;
-  if (identity?.email !== void 0 && identity.email.trim() !== "") {
-    return verbose2 && accountId !== void 0 ? `${identity.email} (account ${accountId})` : identity.email;
-  }
-  if (!confirmed) {
-    return "the account this project is already set up with \u2014 this run could not reach the Halfcycle service to confirm who that is";
+function accountLabel(identity, storedAccountId, verbose2 = false) {
+  if (identity === void 0)
+    return void 0;
+  if (identity.email !== void 0 && identity.email.trim() !== "") {
+    return verbose2 ? `${identity.email} (account ${identity.accountId})` : identity.email;
   }
-  if (accountId !== void 0)
-    return `account ${accountId} (no email on record for it)`;
-  return "the account this credential belongs to, which this service did not name";
+  return `account ${identity.accountId} (no email on record for it)`;
 }
 function onlyDate(iso) {
   if (iso === void 0)
@@ -4227,11 +4263,15 @@ function actingAs(credential, identity) {
 function question(colour) {
   return `[halfcycle] Continue as that account?  ${ink("good", "[y]", colour)} yes   ${ink("key", "[s]", colour)} sign in as someone else   ${ink("faint", "[anything else]", colour)} stop: `;
 }
-function armScript(credential, act, label, plainLabel, home) {
+function accountLine(identity, label) {
+  return identity === void 0 ? "" : `[halfcycle]   Account: ${label}
+`;
+}
+function armScript(credential, act, accountLineText, plainLabel, home) {
   switch (credential.source) {
     case "browser-handoff":
       return {
-        preamble: `[halfcycle] Signed in as ${label}. This install will ${actClause(act)}.
+        preamble: `[halfcycle] This install will ${actClause(act)}.
 `,
         asks: false,
         noTerminalNote: "",
@@ -4239,11 +4279,11 @@ function armScript(credential, act, label, plainLabel, home) {
         stopRemedy: "",
         afterSwitch: ""
       };
-    case "environment":
+    case "environment": {
+      const credentialSentence = plainLabel !== void 0 ? `HALFCYCLE_TOKEN in this environment is the credential for ${plainLabel}, and it takes precedence over any saved sign-in` : `The credential in your environment could not be checked, because the Halfcycle service did not answer, and it takes precedence over any saved sign-in`;
       return {
         preamble: `[halfcycle] HALFCYCLE_TOKEN is set in this environment, and this install will use it.
-[halfcycle]   Account: ${label}
-[halfcycle]   About to ${actClause(act)}
+` + accountLineText + `[halfcycle]   About to ${actClause(act)}
 [halfcycle] A variable exported by a shell profile is not a choice about this run \u2014 if that is not your account, ${wrongAccountConsequence(act)}.
 `,
         asks: true,
@@ -4253,19 +4293,20 @@ function armScript(credential, act, label, plainLabel, home) {
         noTerminalNote: "",
         switchOpening: `[halfcycle] Signing you in through your browser \u2014 this install will use that account instead.
 `,
-        stopRemedy: `Stopped before anything was set up. HALFCYCLE_TOKEN in this environment is the credential for ${plainLabel}, and it takes precedence over any saved sign-in \u2014 so unset it, or set it to your own account's credential, before running this again.`,
+        stopRemedy: `Stopped before anything was set up. ${credentialSentence} \u2014 so unset it, or set it to your own account's credential, before running this again.`,
         // The switch is real for THIS run (the new credential is what gets used) and it
         // does not persist: `obtainCredential` reads the variable first, so the next run
         // is the same variable again. Said here rather than discovered tomorrow.
         afterSwitch: `[halfcycle] HALFCYCLE_TOKEN is still set in this environment and still wins over a saved sign-in \u2014 unset it, or the next run will use it again.
 `
       };
+    }
     case "stored": {
       const savedOn = onlyDate(credential.signedInAt);
+      const savedSignInSentence = plainLabel !== void 0 ? `This machine's saved sign-in is for ${plainLabel}.` : `This machine's saved sign-in could not be checked, because the Halfcycle service did not answer.`;
       return {
         preamble: `[halfcycle] This machine already has a Halfcycle sign-in saved, and this install will use it.
-[halfcycle]   Account: ${label}
-` + (savedOn !== void 0 ? `[halfcycle]   Saved on this machine: ${savedOn}
+` + accountLineText + (savedOn !== void 0 ? `[halfcycle]   Saved on this machine: ${savedOn}
 ` : "") + `[halfcycle]   About to ${actClause(act)}
 [halfcycle] If that is not your account, ${wrongAccountConsequence(act)}${wrongAccountVisibility(act) === void 0 ? "" : ` \u2014 ${wrongAccountVisibility(act)}`}.
 `,
@@ -4275,11 +4316,11 @@ function armScript(credential, act, label, plainLabel, home) {
         // this is printed in), and where to look for the answer once this output is gone.
         noTerminalNote: `[halfcycle] Nothing here to ask at (no terminal), so this is continuing as that account.
 [halfcycle] To run as a different one, set HALFCYCLE_TOKEN for that account, or remove ${accountStorePath(home)} and run this again with a terminal to sign in.
-[halfcycle] When this install finishes, which account it used is recorded in .halfcycle/bundle.json, so it can be checked after this output is gone.
+[halfcycle] .halfcycle/bundle.json records the account that created this project, so that can be checked after this output is gone.
 `,
         switchOpening: `[halfcycle] Forgetting this machine's saved sign-in and signing you in through your browser.
 `,
-        stopRemedy: `Stopped before anything was set up. This machine's saved sign-in is for ${plainLabel}. Run this again and answer "s" to sign in as a different account, or remove ${accountStorePath(home)} to be asked for a sign-in next time.`,
+        stopRemedy: `Stopped before anything was set up. ${savedSignInSentence} Run this again and answer "s" to sign in as a different account, or remove ${accountStorePath(home)} to be asked for a sign-in next time.`,
         afterSwitch: ""
       };
     }
@@ -4294,9 +4335,9 @@ async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
   const colour = deps.colour ?? decideColour({ isTTY: process.stdout.isTTY === true, env: deps.env ?? process.env });
   const identity = await describeAccount(serviceUrl, credential.credential, deps.fetchImpl);
   const plainLabel = accountLabel(identity, credential.accountId, deps.verbose === true);
-  const label = ink("keyBold", plainLabel, colour);
+  const label = plainLabel !== void 0 ? ink("keyBold", plainLabel, colour) : "";
   const acting = actingAs(credential, identity);
-  const script = armScript(credential, act, label, plainLabel, deps.home);
+  const script = armScript(credential, act, accountLine(identity, label), plainLabel, deps.home);
   write(script.preamble);
   if (!script.asks)
     return acting;
@@ -4320,7 +4361,7 @@ async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
     write(script.switchOpening);
     const replacement = await switchAccount(serviceUrl, deps);
     const replacementIdentity = await describeAccount(serviceUrl, replacement.credential, deps.fetchImpl);
-    write(`[halfcycle] Signed in as ${ink("keyBold", accountLabel(replacementIdentity, replacement.accountId, deps.verbose === true), colour)}. This install will ${actClause(act)}.
+    write(`[halfcycle] Signed in. This install will ${actClause(act)}.
 `);
     if (script.afterSwitch !== "")
       write(script.afterSwitch);
@@ -4629,9 +4670,9 @@ var UPGRADE_COMMANDS = {
 };
 var INSTALL_METHOD_RULES = [
   { method: "winget", pattern: /[\\/]WinGet[\\/]/i },
-  { method: "npm", pattern: /node_modules[\\/]/i },
+  { method: "npm", pattern: /node_modules[\\/]|[\\/]npm[\\/]claude(\.cmd|\.exe)?$/i },
   { method: "brew", pattern: /[\\/](Cellar|Caskroom|linuxbrew|homebrew)[\\/]/i },
-  { method: "native", pattern: /[\\/]\.local[\\/]share[\\/]claude(-code)?[\\/]/i }
+  { method: "native", pattern: /[\\/]\.local[\\/](share[\\/]claude(-code)?|bin)[\\/]/i }
 ];
 function probeClaudeCodeInstallMethod(deps = {}) {
   const env = deps.env ?? process.env;
@@ -5836,9 +5877,6 @@ function ourHookEntries(value, commands) {
   }
   return found;
 }
-function isOurHook(hook, commands) {
-  return isPlainObject2(hook) && typeof hook["command"] === "string" && commands.has(hook["command"]);
-}
 function ourMcpServers(value) {
   const servers = value["mcpServers"];
   return isPlainObject2(servers) && MCP_SERVER_KEY in servers ? servers : null;
@@ -5867,9 +5905,9 @@ function unmergeSettings(value, rec, writeSet) {
           continue;
         }
         touched = true;
-        const remaining = entry.hooks.filter((h) => !isOurHook(h, commands));
-        if (remaining.length > 0)
-          next.push({ ...entry, hooks: remaining });
+        const remaining = withoutHalfcycleCommands(entry, commands);
+        if (remaining !== null)
+          next.push(remaining);
       }
       if (touched)
         changed = true;
@@ -5908,16 +5946,12 @@ function unmergeSettings(value, rec, writeSet) {
       changed = true;
     }
   }
-  if ("schemaBefore" in rec) {
-    if (rec.schemaBefore === null) {
-      if ("$schema" in value) {
-        delete value["$schema"];
-        changed = true;
-      }
-    } else if (value["$schema"] !== rec.schemaBefore) {
+  if ("schemaBefore" in rec && value["$schema"] === writeSet.settingsSchema) {
+    if (rec.schemaBefore === null)
+      delete value["$schema"];
+    else
       value["$schema"] = rec.schemaBefore;
-      changed = true;
-    }
+    changed = true;
   }
   return { changed, refused };
 }
@@ -5957,36 +5991,70 @@ function gitattributesRules(writeSet) {
 function trimAppendedBlocks(text, rec, rules) {
   const keptLines = [];
   const foreignLines = [];
+  const eol = lineEndingOf(text);
   let current = text;
   for (const block of [...rec.appended].reverse()) {
-    const lines = block.split("\n").filter((line) => line !== "");
+    const lines = block.split("\n").map(lineKey).filter((line) => line !== "");
     const foreign = lines.filter((line) => !rules.ourLines.has(line));
     foreignLines.push(...foreign);
     const ours = lines.filter((line) => rules.ourLines.has(line));
     const entries = ours.filter((line) => line !== rules.header);
     const kept = entries.filter((line) => rules.keepLine(line));
     keptLines.push(...kept);
-    if (kept.length === 0 && foreign.length === 0 && current.includes(block)) {
-      const at = current.lastIndexOf(block);
-      const head = current.slice(0, at);
-      const tail = current.slice(at + block.length);
-      current = head + (head !== "" && tail !== "" && !head.endsWith("\n") ? "\n" : "") + tail;
+    const found = kept.length === 0 && foreign.length === 0 ? lastOccurrence(current, block) : null;
+    if (found !== null) {
+      const head = current.slice(0, found.start);
+      const tail = current.slice(found.end);
+      current = head + (head !== "" && tail !== "" && !head.endsWith("\n") ? eol : "") + tail;
       continue;
     }
-    const separated = block.startsWith("\n") || block.includes("\n\n");
+    const flat = withoutLineEndCr(block).text;
+    const separated = flat.startsWith("\n") || flat.includes("\n\n");
     const removable = ours.filter((line) => line === rules.header ? kept.length === 0 && foreign.length === 0 : !kept.includes(line));
     for (const line of removable) {
       const fileLines = current.split("\n");
-      const at = fileLines.lastIndexOf(line);
+      const keys = fileLines.map(lineKey);
+      const at = keys.lastIndexOf(line);
       if (at < 0)
         continue;
-      const withSeparator = line === rules.header && separated && at > 0 && fileLines[at - 1] === "";
+      const withSeparator = line === rules.header && separated && at > 0 && keys[at - 1] === "";
       fileLines.splice(withSeparator ? at - 1 : at, withSeparator ? 2 : 1);
       current = fileLines.join("\n");
     }
   }
   return { text: current, keptLines, foreignLines };
 }
+function withoutLineEndCr(text) {
+  let out = "";
+  const at = [];
+  let offset = 0;
+  const lines = text.split("\n");
+  for (const [i, line] of lines.entries()) {
+    const key = lineKey(line);
+    for (let j = 0; j < key.length; j++)
+      at.push(offset + j);
+    out += key;
+    offset += line.length;
+    if (i < lines.length - 1) {
+      out += "\n";
+      at.push(offset);
+      offset += 1;
+    }
+  }
+  return { text: out, at };
+}
+function lastOccurrence(text, block) {
+  const needle = withoutLineEndCr(block).text;
+  if (needle === "")
+    return null;
+  const hay = withoutLineEndCr(text);
+  const found = hay.text.lastIndexOf(needle);
+  if (found < 0)
+    return null;
+  const first = hay.at[found];
+  const start = first > 0 && text[first] === "\n" && text[first - 1] === "\r" ? first - 1 : first;
+  return { start, end: hay.at[found + needle.length - 1] + 1 };
+}
 function coveredPathExists(targetRepo, line) {
   const path = line.trim().replace(/^\//, "").replace(/\/$/, "");
   return path !== "" && lexists(join10(targetRepo, path));
@@ -6111,7 +6179,7 @@ function applyMergedJson(targetRepo, rule, file, deleteWhenEmpty, lists, name, e
   if (!changed)
     return;
   const empty = Object.keys(value).length === 0 && deleteWhenEmpty;
-  writeBack(targetRepo, rel, file.text, empty ? null : serializeJson(value), lists, name);
+  writeBack(targetRepo, rel, file.text, empty ? null : inLineEndingOf(file.text, serializeJson(value)), lists, name);
   if (adopted && lexists(join10(targetRepo, rel))) {
     name(lists.leftAlone, `${rel} (Halfcycle's hooks were taken out. There is no record of this file from before the install, so a permission rule or "$schema" Halfcycle added may still be there \u2014 it cannot be told apart from your own)`, rel);
   }
@@ -6555,6 +6623,21 @@ ${USAGE}`);
       process.exit(1);
       return;
     }
+    let interrupted = false;
+    const onInstallSigint = () => {
+      if (interrupted)
+        return;
+      interrupted = true;
+      const kept = readFolderId(targetRepo) !== void 0 ? `${KEPT_FOLDER_ID_LINE}
+` : "";
+      try {
+        writeSync2(2, `halfcycle: interrupted.
+${kept}`);
+      } catch {
+      }
+      process.exit(1);
+    };
+    process.on("SIGINT", onInstallSigint);
     try {
       const controlOrigin = resolveControlOrigin(process.env);
       const serviceUrl = controlOrigin.origin;
@@ -6575,13 +6658,14 @@ ${USAGE}`);
       let credential;
       let notThisAccountMessage;
       let actingAccountId;
+      let createdByAccountId;
       let actingIdentity;
       let foundLine = "";
       let reusedWithoutFreshAnswer = false;
       if (reusable !== void 0 && pinned !== null) {
         engagementId = pinned.engagementId;
         credential = reusable;
-        actingAccountId = readBundlePin(targetRepo)?.accountId;
+        actingAccountId = heldAnswer?.identity?.accountId;
         foundLine = `already set up here \u2014 reusing engagement ${shortId(pinned.engagementId)}`;
         reusedWithoutFreshAnswer = true;
         if (verbose) {
@@ -6631,6 +6715,7 @@ ${USAGE}`);
 `);
         }
       } else {
+        const hadUsableIdBeforeThisRun = readFolderId(targetRepo) !== void 0;
         const projectId = runPreCreateChecks(targetRepo);
         const created = await createOwnedEngagement(serviceUrl, targetRepo, projectId, { assumeYes, verbose });
         if (isProjectOwnedElsewhere(created)) {
@@ -6642,6 +6727,7 @@ ${PROJECT_RESET_LINE}
         }
         engagementId = created.engagementId;
         actingAccountId = created.actingAccountId;
+        createdByAccountId = created.actingAccountId;
         actingIdentity = created.actingIdentity;
         credential = {
           serviceUrl,
@@ -6661,7 +6747,7 @@ ${PROJECT_RESET_LINE}
           consoleUrl: created.consoleUrl,
           methodVersion: created.methodVersion
         };
-        foundLine = `no Halfcycle project here yet \u2014 creating one (${shortId(created.engagementId)})`;
+        foundLine = hadUsableIdBeforeThisRun ? `picking up this folder's project (${shortId(created.engagementId)})` : `no Halfcycle project here yet \u2014 creating one (${shortId(created.engagementId)})`;
         if (verbose) {
           process.stdout.write(`[halfcycle] Created engagement ${created.engagementId}
 `);
@@ -6672,7 +6758,7 @@ ${PROJECT_RESET_LINE}
         engagementId,
         engagementType: engagementTypeRaw,
         credential,
-        accountId: actingAccountId
+        createdByAccountId
       });
       if (verbose) {
         process.stdout.write(`[halfcycle] Installed v${result.version} into ${targetRepo}
@@ -6688,8 +6774,14 @@ ${PROJECT_RESET_LINE}
 `);
         }
       }
-      if (result.collidedPaths.length > 0) {
-        process.stdout.write(`[halfcycle] Collided (a name you already use \u2014 NOT overwritten): ${result.collidedPaths.join(", ")}
+      const edited = new Set(result.editedCollidedPaths);
+      const trueCollisions = result.collidedPaths.filter((path) => !edited.has(path));
+      if (result.editedCollidedPaths.length > 0) {
+        process.stdout.write(`[halfcycle] Kept (your edited copy of an older Halfcycle file \u2014 NOT overwritten): ${result.editedCollidedPaths.join(", ")}
+`);
+      }
+      if (trueCollisions.length > 0) {
+        process.stdout.write(`[halfcycle] Collided (a name you already use \u2014 NOT overwritten): ${trueCollisions.join(", ")}
 `);
       }
       if (result.replacedPaths.length > 0) {
@@ -6744,8 +6836,10 @@ ${PROJECT_RESET_LINE}
       const identity = actingIdentity ?? heldAnswer?.identity ?? (credential && heldAnswer === void 0 ? await describeAccount(credential.serviceUrl, credential.token) : void 0);
       const written = result.writtenPaths.length;
       const merged = result.mergedPaths.length;
-      process.stdout.write(`[halfcycle] Signed in as ${accountLabel(identity, actingAccountId, verbose, controlOriginConfirmed)}
+      if (identity !== void 0) {
+        process.stdout.write(`[halfcycle] Signed in as ${accountLabel(identity, actingAccountId, verbose)}
 `);
+      }
       process.stdout.write(`[halfcycle] Found: ${foundLine}
 `);
       process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, ${credential ? "guards armed on every edit" : "not checked \u2014 this copy is not this account\u2019s project"}
@@ -6757,7 +6851,7 @@ ${PROJECT_RESET_LINE}
         process.stdout.write(`[halfcycle] Commit the files Halfcycle set up here, including ${BUNDLE_PIN_REL} and ${PROJECT_IDENTITY_REL}, so every copy of this project joins it and runs the same checks.
 `);
       } else if (credential) {
-        process.stdout.write(process.platform !== "win32" && !gitIsInstalled() ? `[halfcycle] Halfcycle needs Git, and it is not installed on this machine \u2014 get it from https://git-scm.com/downloads, then run "git init" here to get checks on every edit.
+        process.stdout.write(process.platform !== "win32" && !gitIsInstalled() ? `[halfcycle] Halfcycle needs Git, and it is not installed on this machine \u2014 get it from https://git-scm.com/downloads to get checks on every edit.
 ` : `[halfcycle] This folder is not a git repository. Halfcycle's checks compare against your git history, so run "git init" here to get checks on every edit.
 `);
       }