halfcycle 0.4.7 → 0.4.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/bin/bin.bundle.mjs

@@ -14899,8 +14899,8 @@ function readConfig(env = process.env) {
     }
   };
 }
-function readNeverConfiguredReason() {
-  return process.env["HALFCYCLE_NOT_THIS_ACCOUNT"] === "1" ? "not-this-account" : "no-credential-yet";
+function readNeverConfiguredReason(env = process.env) {
+  return env["HALFCYCLE_NOT_THIS_ACCOUNT"] === "1" ? "not-this-account" : "no-credential-yet";
 }
 function isHalfcycleOwnCi() {
   return process.env["HALFCYCLE_INTERNAL_CI"] === "1";
@@ -16086,6 +16086,110 @@ function scopeNoticeText(scope, options) {
   };
 }
 
+// ../events/dist/device-auth.js
+var utcIso86012 = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+var DEVICE_AUTH_STATUS = {
+  /** The poll: minted, nobody has acted yet. Keep polling. 200. */
+  PENDING: "pending",
+  /** The poll: approved, and the credential is in this body. Once only. 200. */
+  APPROVED: "approved",
+  /** Confirm: the decision was recorded (approve or decline). 200. */
+  RECORDED: "recorded",
+  /** The human refused at the confirmation page. 400 on the poll. */
+  DECLINED: "declined",
+  /** The code's absolute expiry has passed. 400. */
+  EXPIRED: "expired",
+  /** Never minted, or already spent. 400. */
+  UNKNOWN: "unknown",
+  /** Confirm: neither `approve` nor `decline` was named. Nothing was bound. 400. */
+  INVALID_DECISION: "invalid-decision",
+  /** Confirm: an approval arrived with no signed-in identity. 400. */
+  IDENTITY_REQUIRED: "identity-required",
+  /** This deployment has no `SIGNIN_BASE_URL` / `DEVICE_AUTH_CONFIRM_SECRET`. 503. */
+  NOT_CONFIGURED: "not-configured",
+  /** Confirm: the shared confirmation secret was missing or wrong. 401. */
+  UNAUTHORIZED: "unauthorized",
+  /** Confirm: the code was already approved, declined or claimed. 409. */
+  ALREADY_DECIDED: "already-decided",
+  /**
+   * Confirm: an approval named a signed-in identity whose account has not accepted
+   * the terms of service and privacy policy currently in force. 400.
+   *
+   * NOT BOUND TO THE DEVICE CODE. Unlike every other refusal in this const, this one
+   * says nothing about the code itself — the code is still `pending` after this
+   * response, exactly as it was before the request, so the SAME userCode can be
+   * confirmed again once the caller has recorded acceptance. `deviceConfirmRequestSchema`'s
+   * `acceptTerms` is how a second confirm says it did.
+   */
+  TERMS_REQUIRED: "terms-required"
+};
+var DEVICE_POLL_REFUSALS = [
+  DEVICE_AUTH_STATUS.DECLINED,
+  DEVICE_AUTH_STATUS.EXPIRED,
+  DEVICE_AUTH_STATUS.UNKNOWN
+];
+var deviceAuthStartResponseSchema = external_exports.object({
+  deviceCode: external_exports.string().min(1),
+  userCode: external_exports.string().min(1),
+  verificationUrl: external_exports.string().min(1),
+  expiresAt: utcIso86012,
+  pollIntervalMs: external_exports.number().int().positive()
+}).strict();
+var devicePollPendingSchema = external_exports.object({
+  status: external_exports.literal(DEVICE_AUTH_STATUS.PENDING),
+  pollIntervalMs: external_exports.number().int().positive()
+}).strict();
+var devicePollApprovedSchema = external_exports.object({
+  status: external_exports.literal(DEVICE_AUTH_STATUS.APPROVED),
+  accountId: external_exports.string().min(1),
+  credential: external_exports.string().min(1),
+  expiresAt: utcIso86012
+}).strict();
+var deviceAuthRefusalSchema = external_exports.object({
+  status: external_exports.enum([
+    DEVICE_AUTH_STATUS.DECLINED,
+    DEVICE_AUTH_STATUS.EXPIRED,
+    DEVICE_AUTH_STATUS.UNKNOWN,
+    DEVICE_AUTH_STATUS.INVALID_DECISION,
+    DEVICE_AUTH_STATUS.IDENTITY_REQUIRED,
+    DEVICE_AUTH_STATUS.NOT_CONFIGURED,
+    DEVICE_AUTH_STATUS.UNAUTHORIZED,
+    DEVICE_AUTH_STATUS.ALREADY_DECIDED,
+    DEVICE_AUTH_STATUS.TERMS_REQUIRED
+  ]),
+  message: external_exports.string().min(1)
+}).strict();
+var devicePollResponseSchema = external_exports.union([
+  devicePollPendingSchema,
+  devicePollApprovedSchema,
+  deviceAuthRefusalSchema
+]);
+var deviceConfirmRequestSchema = external_exports.object({
+  userCode: external_exports.string().min(1),
+  decision: external_exports.enum(["approve", "decline"]),
+  externalAuthId: external_exports.string().min(1).optional(),
+  email: external_exports.string().optional(),
+  acceptTerms: external_exports.boolean().optional()
+}).strict();
+var deviceConfirmRecordedSchema = external_exports.object({
+  status: external_exports.literal(DEVICE_AUTH_STATUS.RECORDED),
+  accountId: external_exports.string().min(1).optional()
+}).strict();
+var deviceConfirmResponseSchema = external_exports.union([
+  deviceConfirmRecordedSchema,
+  deviceAuthRefusalSchema
+]);
+var DASHBOARD_URL = "https://app.halfcycle.ai";
+
+// ../events/dist/project-page.js
+function projectPageUrl(engagementId) {
+  return isEngagementId(engagementId) ? `${DASHBOARD_URL}/${encodeURIComponent(engagementId)}` : void 0;
+}
+function requestAccessSentence(engagementId) {
+  const page = projectPageUrl(engagementId) ?? "this project's page on Halfcycle";
+  return `To ask for access, open ${page} signed in as this account and choose "Request access". Then let the project's owner know, so they can approve it.`;
+}
+
 // ../events/dist/credential-wire.js
 var engagementCredentialResponseSchema = external_exports.object({
   engagementId: external_exports.string(),
@@ -16224,8 +16328,8 @@ This is not a service outage: the guard service answered. The suspect is this re
 }
 var UNCONFIGURED_EXIT_TOOL_USE = 2;
 var UNCONFIGURED_EXIT_STOP_FAMILY = 1;
-function emitNeverConfigured(exitCode, reason) {
-  writeSync(2, neverConfiguredReport(reason));
+function emitNeverConfigured(exitCode, reason, engagementId) {
+  writeSync(2, neverConfiguredReport(reason, void 0, engagementId));
   process.exitCode = exitCode;
 }
 var SIGN_IN_COMMAND = '"npx halfcycle"';
@@ -16255,16 +16359,16 @@ ${NOT_A_SERVICE_OUTAGE} Nothing was sent: this job holds no credential and was n
 ${CI_OLDER_SETUP}
 `;
 }
-function notThisAccountReport(label) {
-  return `${label} This project belongs to another Halfcycle account. Halfcycle is Solo today \u2014 one person works on a project at a time \u2014 so no credential exists for this machine and none will be issued. Nothing here needs fixing; this copy simply is not checked. Ask the project's owner for view access, or \u2014 if this account is wrong \u2014 sign in as the one that owns the project and run "npx halfcycle" again.
+function notThisAccountReport(label, engagementId) {
+  return `${label} This project belongs to another Halfcycle account. Halfcycle is Solo today \u2014 one person works on a project at a time \u2014 so no credential exists for this machine and none will be issued. Nothing here needs fixing; this copy simply is not checked. ${requestAccessSentence(engagementId)} If this account is wrong, sign in as the one that owns the project and run "npx halfcycle" again.
 `;
 }
-function neverConfiguredReport(reason, label = "[Halfcycle]") {
+function neverConfiguredReport(reason, label = "[Halfcycle]", engagementId) {
   switch (reason) {
     case "no-credential-yet":
       return neverConfiguredMessage(HOOK_REMEDY, label);
     case "not-this-account":
-      return notThisAccountReport(label);
+      return notThisAccountReport(label, engagementId);
   }
 }
 var CREDENTIAL_REJECTED_STATUSES = /* @__PURE__ */ new Set([401, 403]);
@@ -16315,14 +16419,14 @@ function credentialRenewalFailedMessage(remedy, label = "[Halfcycle]") {
 ${remedy}
 `;
 }
-function noCoverageStatement(reason, remedySaid = false) {
+function noCoverageStatement(reason, remedySaid = false, engagementId) {
   if (reason === "not-this-account") {
     return [
       "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked.",
       "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is",
       "[halfcycle] evaluated, and nothing you do is reported as having passed.",
       "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming.",
-      "[halfcycle] Ask the project's owner for view access.",
+      `[halfcycle] ${requestAccessSentence(engagementId)}`,
       "[halfcycle] If this account is wrong, sign in as the one that owns the project and run",
       '[halfcycle] "npx halfcycle" again.'
     ].join("\n");
@@ -18108,8 +18212,36 @@ function cleanRunSummary(verdict, scope) {
   return `[Halfcycle CI] ${verdict} ${files}, ${scope.signals} signal(s) checked.`;
 }
 
+// dist/pinned-engagement.js
+import { readFileSync as readFileSync5 } from "node:fs";
+import { resolve } from "node:path";
+function readPinnedId(root) {
+  let raw;
+  try {
+    raw = readFileSync5(resolve(root, BUNDLE_PIN_REL), "utf-8");
+  } catch {
+    return { problem: "no-pin" };
+  }
+  let pin;
+  try {
+    pin = JSON.parse(raw);
+  } catch {
+    return { problem: "no-id" };
+  }
+  const id = typeof pin === "object" && pin !== null ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
+  return typeof id === "string" && id !== "" ? { id } : { problem: "no-id" };
+}
+function pinnedEngagementId(root) {
+  const pinned = readPinnedId(root);
+  return "id" in pinned && isEngagementId(pinned.id) ? pinned.id : void 0;
+}
+function projectFolder(env = process.env) {
+  const dir = env["CLAUDE_PROJECT_DIR"];
+  return dir !== void 0 && dir !== "" ? dir : process.cwd();
+}
+
 // dist/credential-store.js
-import { chmodSync, existsSync as existsSync3, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2, realpathSync } from "node:fs";
+import { chmodSync, existsSync as existsSync3, readFileSync as readFileSync6, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2, realpathSync } from "node:fs";
 import { homedir as homedir2, platform } from "node:os";
 import { dirname as dirname3, join as join5 } from "node:path";
 var REFRESHED_TOKEN_KEYS = ["HALFCYCLE_TOKEN", "GUARD_SERVICE_TOKEN"];
@@ -18123,7 +18255,7 @@ function hasNotThisAccountMarker(engagementId, home) {
 function readAccountCredential(controlOrigin, home) {
   let raw;
   try {
-    raw = readFileSync5(join5(home ?? homedir2(), HALFCYCLE_DIR_NAME, ACCOUNT_STORE_FILENAME), "utf-8");
+    raw = readFileSync6(join5(home ?? homedir2(), HALFCYCLE_DIR_NAME, ACCOUNT_STORE_FILENAME), "utf-8");
   } catch {
     return void 0;
   }
@@ -18140,7 +18272,7 @@ function readStoredEngagementToken(envFilePath) {
 function readEngagementStore(envFilePath) {
   let raw;
   try {
-    raw = readFileSync5(envFilePath, "utf-8");
+    raw = readFileSync6(envFilePath, "utf-8");
   } catch {
     return void 0;
   }
@@ -18170,7 +18302,7 @@ function writeRefreshedToken(opts) {
   }
   let existing;
   try {
-    existing = readFileSync5(declaredReal, "utf-8");
+    existing = readFileSync6(declaredReal, "utf-8");
   } catch {
     existing = null;
   }
@@ -18313,7 +18445,7 @@ async function evaluateWithRefresh(opts) {
 
 // dist/hooks/marker.js
 import { createHash } from "node:crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join6 } from "node:path";
 var MARKER_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -18345,7 +18477,7 @@ function readMarker(repoRoot, sessionId) {
   if (!existsSync4(path))
     return null;
   try {
-    return readFileSync6(path, "utf-8").trim() || null;
+    return readFileSync7(path, "utf-8").trim() || null;
   } catch {
     return null;
   }
@@ -18391,7 +18523,7 @@ function readDedupe(repoRoot, sessionId) {
   if (!existsSync4(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
     if (typeof parsed === "object" && parsed !== null && typeof parsed.base === "string" && typeof parsed.digest === "string") {
       return parsed;
     }
@@ -18436,7 +18568,7 @@ function orphanSweep(repoRoot, refKnown, keepSessionId, now = Date.now()) {
     const full = join6(dir, name);
     let unusable = false;
     try {
-      const ref = readFileSync6(full, "utf-8").trim();
+      const ref = readFileSync7(full, "utf-8").trim();
       if (!ref || !refKnown(ref))
         unusable = true;
     } catch {
@@ -18460,9 +18592,9 @@ function orphanSweep(repoRoot, refKnown, keepSessionId, now = Date.now()) {
 }
 
 // dist/seat-configuration.js
-import { existsSync as existsSync5, readFileSync as readFileSync7, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync8, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join7, relative as relative3, resolve } from "node:path";
+import { join as join7, relative as relative3, resolve as resolve2 } from "node:path";
 function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
   try {
     const facts = read(repoRoot);
@@ -18475,7 +18607,7 @@ function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
   }
 }
 function readSeatConfiguration(repoRoot) {
-  const given = resolve(process.env["CLAUDE_PROJECT_DIR"] || process.cwd());
+  const given = resolve2(process.env["CLAUDE_PROJECT_DIR"] || process.cwd());
   const projectDir = realpathSync2.native(given);
   const home = homedir3();
   let realHome = home;
@@ -18497,7 +18629,7 @@ function isPlainObject3(value) {
 function readSettingsFile(projectDir, rel) {
   let raw;
   try {
-    raw = readFileSync7(join7(projectDir, rel), "utf-8");
+    raw = readFileSync8(join7(projectDir, rel), "utf-8");
   } catch (err) {
     const code = err.code;
     const state = code === "ENOENT" || code === "ENOTDIR" ? "absent" : "unreadable";
@@ -18655,7 +18787,7 @@ async function evaluateEdit(reply, readSeat) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet });
     if (!firstNoticeThisSession("credential-missing", repoRoot, input.session_id))
       return;
-    emitNeverConfigured(UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason());
+    emitNeverConfigured(UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason(), pinnedEngagementId(projectFolder()));
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
@@ -18748,10 +18880,10 @@ ${guardLines}${notRunBlock}`);
   }
 }
 function readStdin() {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve4(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve5(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
@@ -18836,7 +18968,7 @@ async function evaluateSession(input, kind, reply, readSeat) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet, diffBase });
     if (!firstNoticeThisSession("credential-missing", repoRoot, sessionId))
       return;
-    emitNeverConfigured(UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason());
+    emitNeverConfigured(UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason(), pinnedEngagementId(projectFolder()));
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
@@ -18947,9 +19079,9 @@ async function readHookStdin() {
   }
 }
 function readStdin2() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     if (process.stdin.isTTY) {
-      resolve4("");
+      resolve5("");
       return;
     }
     const chunks = [];
@@ -18959,7 +19091,7 @@ function readStdin2() {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve4(Buffer.concat(chunks).toString("utf-8"));
+      resolve5(Buffer.concat(chunks).toString("utf-8"));
     };
     const timer = setTimeout(done, HOOK_STDIN_GRACE_MS);
     process.stdin.on("data", (chunk) => chunks.push(chunk));
@@ -18981,7 +19113,7 @@ async function runStop() {
 }
 
 // dist/hooks/user-prompt-submit.js
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import { join as join8 } from "node:path";
 
@@ -19038,6 +19170,9 @@ function notAttendedLine(act) {
 function notSignedInLine(act) {
   return line(`${nothingDone(act)}: this project is not signed in on this computer. ${HOOK_REMEDY}`);
 }
+function notOwnerLine(act) {
+  return line(`${nothingDone(act)}: only the project's owner can approve or send back this scope.`);
+}
 function showFirstLine(act) {
   return line(`${nothingDone(act)}: that phase has not been listed here. List its parts first with \`${HALFCYCLE_COMMAND} plan <phase> --show\`, then type the line again.`);
 }
@@ -19075,7 +19210,7 @@ function lineForAnswer(act, phase, answer) {
     case "build-started":
       return line(`${nothingDone(act)}: tasks in ${phase} have started, so its scope can no longer be sent back. A built part goes back at the phase's review.`);
     case "not-owner":
-      return line(`${nothingDone(act)}: only the project's owner can approve or send back this scope.`);
+      return notOwnerLine(act);
     case "no-owner":
       return line(`${nothingDone(act)}: this project has no owner, so nobody can approve or send back its scope.`);
     case "not-offered":
@@ -19115,8 +19250,9 @@ async function decide(shape, opts) {
   if (!readSessionAttended(env))
     return notAttendedLine(act);
   const read = readConfig(env);
-  if (read.config === null)
-    return notSignedInLine(act);
+  if (read.config === null) {
+    return readNeverConfiguredReason(env) === "not-this-account" ? notOwnerLine(act) : notSignedInLine(act);
+  }
   const { guardServiceToken, guardEngagementId } = read.config;
   const shown = readShownPlans(guardEngagementId, opts.home);
   const match = matchScopePhraseShape(shape, shown);
@@ -19157,7 +19293,7 @@ function readShownPlans(engagementId, home) {
     return [];
   let text;
   try {
-    text = readFileSync8(join8(home ?? homedir4(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, SHOWN_PLANS_FILENAME), "utf-8");
+    text = readFileSync9(join8(home ?? homedir4(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, SHOWN_PLANS_FILENAME), "utf-8");
   } catch {
     return [];
   }
@@ -19196,7 +19332,7 @@ async function post(act, entry, request, engagementId, credential, env, fetchFn
 }
 
 // dist/resolve-engagement.js
-import { existsSync as existsSync6, readFileSync as readFileSync9, realpathSync as realpathSync3 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, realpathSync as realpathSync3 } from "node:fs";
 import { join as join9, sep as sep2 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 function defaultRegistryPath() {
@@ -19206,7 +19342,7 @@ function readRegistry(registryPath = defaultRegistryPath()) {
   if (!existsSync6(registryPath))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync9(registryPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(registryPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const out = {};
@@ -19254,13 +19390,13 @@ function runResolveEngagement(cwd, registryPath) {
 }
 
 // dist/refresh-credential.js
-import { readFileSync as readFileSync11 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 
 // dist/mcp-headers.js
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname4, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, resolve as resolve3 } from "node:path";
 function defaultWriteErr(text) {
   process.stderr.write(text);
 }
@@ -19273,28 +19409,12 @@ function headerLine(bearer, clientVersion) {
 }
 function projectRootFromBinary(binaryPath) {
   const depth = VENDORED_BIN_REL.split("/").length - 1;
-  return resolve2(dirname4(binaryPath), ...Array(depth).fill(".."));
-}
-function readPinnedId(root) {
-  let raw;
-  try {
-    raw = readFileSync10(resolve2(root, BUNDLE_PIN_REL), "utf-8");
-  } catch {
-    return { problem: "no-pin" };
-  }
-  let pin;
-  try {
-    pin = JSON.parse(raw);
-  } catch {
-    return { problem: "no-id" };
-  }
-  const id = typeof pin === "object" && pin !== null ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
-  return typeof id === "string" && id !== "" ? { id } : { problem: "no-id" };
+  return resolve3(dirname4(binaryPath), ...Array(depth).fill(".."));
 }
 function readPinnedVersion(root) {
   let raw;
   try {
-    raw = readFileSync10(resolve2(root, BUNDLE_PIN_REL), "utf-8");
+    raw = readFileSync11(resolve3(root, BUNDLE_PIN_REL), "utf-8");
   } catch {
     return void 0;
   }
@@ -19336,7 +19456,7 @@ function sentences(lines) {
 }
 function badIdSentence(root) {
   return sentences([
-    `${resolve2(root, BUNDLE_PIN_REL)} names an engagement id that is not a Halfcycle project id,`,
+    `${resolve3(root, BUNDLE_PIN_REL)} names an engagement id that is not a Halfcycle project id,`,
     'so no credential was read. Delete that file and run "npx halfcycle" again: this repository',
     "is then set up as a new Halfcycle project."
   ]);
@@ -19350,7 +19470,7 @@ function storeProblemSentence(problem, root, home, engagementId) {
       ]);
     case "no-id":
       return sentences([
-        `${resolve2(root, BUNDLE_PIN_REL)} names no engagement id.`,
+        `${resolve3(root, BUNDLE_PIN_REL)} names no engagement id.`,
         'run "npx halfcycle" here to rewrite it.'
       ]);
     case "bad-id":
@@ -19359,13 +19479,15 @@ function storeProblemSentence(problem, root, home, engagementId) {
       return sentences([
         "this project belongs to another Halfcycle account, so this machine has no",
         "credential for it and the Halfcycle tools are not available here. Nothing is",
-        "broken \u2014 ask the project's owner for view access, or sign in as the account",
-        'that owns it and run "npx halfcycle" again.'
+        "broken.",
+        requestAccessSentence(engagementId),
+        "If this account is wrong, sign in as the account that owns it and run",
+        '"npx halfcycle" again.'
       ]);
     case "no-credential":
       return sentences([
         `this machine holds no credential for engagement ${engagementId ?? ""}.`,
-        `run "npx halfcycle" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve2(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
+        `run "npx halfcycle" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve3(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
       ]);
   }
 }
@@ -19518,7 +19640,7 @@ var INITIALIZE_BODY = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initializ
 function registeredMcpUrl(projectRoot) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(resolve3(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
+    parsed = JSON.parse(readFileSync12(resolve4(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
   } catch {
     return void 0;
   }
@@ -19723,7 +19845,7 @@ async function runRefreshCredential(opts) {
     }
     if (readConfig().config === null) {
       const remedySaid = parts.some(namesTheSignInCommand);
-      parts.push(noCoverageStatement(readNeverConfiguredReason(), remedySaid));
+      parts.push(noCoverageStatement(readNeverConfiguredReason(), remedySaid, pinnedEngagementId(projectRootFromBinary(opts.binaryPath))));
     }
     for (const said of renewalSaid) {
       if (namesTheSignInCommand(said) && parts.some(namesTheSignInCommand))
@@ -19747,7 +19869,7 @@ async function runRefreshCredential(opts) {
 import { fileURLToPath } from "node:url";
 
 // dist/capture.js
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync7 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync7 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -19815,7 +19937,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync12(fromFile, "utf-8");
+    return readFileSync13(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -19927,10 +20049,10 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
   process.exit(1);
 }
 function readStdin3() {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve4(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve5(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }

package/dist/cli.js

@@ -2067,6 +2067,15 @@ function isNotThisAccountRefusal(body) {
   return typeof body === "object" && body !== null && body.reason === NOT_THIS_ACCOUNT_REASON;
 }
 
+// ../events/dist/project-page.js
+function projectPageUrl(engagementId) {
+  return isEngagementId(engagementId) ? `${DASHBOARD_URL}/${encodeURIComponent(engagementId)}` : void 0;
+}
+function requestAccessSentence(engagementId) {
+  const page = projectPageUrl(engagementId) ?? "this project's page on Halfcycle";
+  return `To ask for access, open ${page} signed in as this account and choose "Request access". Then let the project's owner know, so they can approve it.`;
+}
+
 // ../events/dist/account-identity.js
 import { z as z12 } from "zod";
 var accountIdentitySchema = z12.object({
@@ -2788,11 +2797,6 @@ function nodeFloorProgram(guarded) {
   return `if(+process.versions.node.split('.')[0]<${NODE_FLOOR_MAJOR}){console.error('${NODE_FLOOR_SENTENCE_HEAD}'+process.versions.node);process.exitCode=1}else{${guarded}}`;
 }
 
-// dist/project-page.js
-function projectPageUrl(engagementId) {
-  return isEngagementId(engagementId) ? `${DASHBOARD_URL}/${encodeURIComponent(engagementId)}` : void 0;
-}
-
 // dist/merge-settings.js
 function isHalfcycleCommand(hook, halfcycleCommands) {
   if (typeof hook !== "object" || hook === null)
@@ -8886,7 +8890,7 @@ ${PROJECT_RESET_LINE}
 `);
       }
       if (credential === void 0 && notThisAccountMessage !== void 0) {
-        process.stdout.write(`[halfcycle] ${notThisAccountMessage} Your work carries on exactly as it would without Halfcycle: no edit is evaluated, and nothing you do here is reported as having passed. Ask the project's owner for view access. ${identitySwitchRemedy(void 0, isInteractiveRun())}
+        process.stdout.write(`[halfcycle] ${notThisAccountMessage} Your work carries on exactly as it would without Halfcycle: no edit is evaluated, and nothing you do here is reported as having passed. ${requestAccessSentence(engagementId)} ${identitySwitchRemedy(void 0, isInteractiveRun())}
 `);
       }
       reportClaudeCodeVersion(verbose);