heyspex 0.1.0 → 0.2.1

package/dist/cli/hs-init.mjs

@@ -1,19 +1,890 @@
 import { createRequire as __hsCreateRequire } from 'node:module';
 const require = __hsCreateRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// scripts/lib/heyspex-home.mjs
+import { homedir } from "node:os";
+function heyspexHome(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir();
+}
+var init_heyspex_home = __esm({
+  "scripts/lib/heyspex-home.mjs"() {
+    "use strict";
+  }
+});
+
+// vendor/heyspex-mcp/credentials.mjs
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import os, { homedir as homedir2 } from "node:os";
+import { dirname, join, resolve as resolve2 } from "node:path";
+var init_credentials = __esm({
+  "vendor/heyspex-mcp/credentials.mjs"() {
+    "use strict";
+    init_heyspex_home();
+  }
+});
+
+// scripts/lib/dev-mode.mjs
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join2 } from "node:path";
+function devModeFilePath(homeDir = heyspexHome()) {
+  return join2(homeDir, ".heyspex", DEV_MODE_FILENAME);
+}
+function normalizeMode(raw) {
+  const v = String(raw ?? "").trim().toLowerCase();
+  if (v === "prod" || v === "production") return { mode: "prod", reliance: "cloud" };
+  if (v === "dev") return { mode: "dev", reliance: null };
+  if (v === "local") return { mode: "dev", reliance: "local" };
+  if (v === "cloud") return { mode: "dev", reliance: "cloud" };
+  return null;
+}
+function normalizeReliance(raw) {
+  const v = String(raw ?? "").trim().toLowerCase();
+  return v === "local" || v === "cloud" ? v : null;
+}
+function deriveSemantics(mode, reliance) {
+  const effectiveReliance = mode === "prod" ? "cloud" : reliance ?? "local";
+  const local = mode === "dev" && effectiveReliance === "local";
+  return {
+    reliance: effectiveReliance,
+    consoleUrl: local ? LOCAL_CONSOLE_URL : CLOUD_CONSOLE_URL,
+    readTier: local ? "disk" : "neon",
+    vaultWriteMode: local ? "local" : "cloud"
+  };
+}
+function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile = defaultReadFile } = {}) {
+  let raw;
+  try {
+    raw = readFile(devModeFilePath(homeDir));
+  } catch {
+    return { record: null, parseError: null };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const mode = parsed?.mode === "prod" || parsed?.mode === "dev" ? parsed.mode : null;
+    const reliance = normalizeReliance(parsed?.reliance);
+    if (!mode || mode === "dev" && !reliance) {
+      return { record: null, parseError: `invalid dev-mode record: ${JSON.stringify(parsed)}` };
+    }
+    return {
+      record: {
+        mode,
+        reliance: mode === "prod" ? "cloud" : reliance,
+        console_url: typeof parsed.console_url === "string" ? parsed.console_url : null,
+        updated_at: typeof parsed.updated_at === "string" ? parsed.updated_at : null,
+        source: typeof parsed.source === "string" ? parsed.source : null
+      },
+      parseError: null
+    };
+  } catch (err) {
+    return { record: null, parseError: `unparseable dev-mode.json: ${String(err?.message ?? err)}` };
+  }
+}
+function resolveDevMode({
+  env = process.env,
+  homeDir = heyspexHome(),
+  readFile = defaultReadFile,
+  cloudSetting = void 0
+} = {}) {
+  const local = readLocalDevModeRecord({ homeDir, readFile });
+  const cloudKnown = cloudSetting !== void 0;
+  const cloudValue = cloudKnown && cloudSetting ? {
+    mode: cloudSetting.mode === "dev" ? "dev" : "prod",
+    reliance: normalizeReliance(cloudSetting.reliance) ?? "cloud"
+  } : null;
+  let mode;
+  let reliance;
+  let source;
+  let relianceSource;
+  const envParsed = normalizeMode(env.HEYSPEX_DEV_MODE);
+  if (envParsed) {
+    mode = envParsed.mode;
+    const envReliance = envParsed.reliance ?? normalizeReliance(env.HEYSPEX_DEV_RELIANCE);
+    reliance = envReliance ?? "local";
+    source = "env";
+    relianceSource = envReliance ? "env" : "assumed-local";
+  } else if (local.record) {
+    mode = local.record.mode;
+    reliance = local.record.reliance;
+    source = "local-override";
+  } else if (cloudValue) {
+    mode = cloudValue.mode;
+    reliance = cloudValue.reliance;
+    source = "cloud-setting";
+  } else {
+    mode = "prod";
+    reliance = "cloud";
+    source = "default";
+  }
+  const semantics = deriveSemantics(mode, reliance);
+  const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
+  const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  return {
+    mode,
+    reliance: semantics.reliance,
+    consoleUrl,
+    readTier: semantics.readTier,
+    vaultWriteMode: semantics.vaultWriteMode,
+    sources: {
+      mode: source,
+      reliance: relianceSource ?? source,
+      consoleUrl: source === "local-override" && local.record?.console_url ? "local-override" : "derived",
+      readTier: "derived",
+      vaultWriteMode: "derived"
+    },
+    localOverride: {
+      present: local.record !== null,
+      record: local.record,
+      parseError: local.parseError,
+      staleAgainstCloud
+    },
+    cloudSetting: { known: cloudKnown, value: cloudValue }
+  };
+}
+var CLOUD_CONSOLE_URL, LOCAL_CONSOLE_URL, DEV_MODE_FILENAME, defaultReadFile;
+var init_dev_mode = __esm({
+  "scripts/lib/dev-mode.mjs"() {
+    "use strict";
+    init_heyspex_home();
+    init_credentials();
+    CLOUD_CONSOLE_URL = "https://app.heyspex.com";
+    LOCAL_CONSOLE_URL = "http://localhost:3000";
+    DEV_MODE_FILENAME = "dev-mode.json";
+    defaultReadFile = (p) => readFileSync2(p, "utf8");
+  }
+});
+
+// node_modules/kind-of/index.js
+var require_kind_of = __commonJS({
+  "node_modules/kind-of/index.js"(exports2, module2) {
+    "use strict";
+    var toString = Object.prototype.toString;
+    module2.exports = function kindOf(val) {
+      if (val === void 0) return "undefined";
+      if (val === null) return "null";
+      var type = typeof val;
+      if (type === "boolean") return "boolean";
+      if (type === "string") return "string";
+      if (type === "number") return "number";
+      if (type === "symbol") return "symbol";
+      if (type === "function") {
+        return isGeneratorFn(val) ? "generatorfunction" : "function";
+      }
+      if (isArray(val)) return "array";
+      if (isBuffer(val)) return "buffer";
+      if (isArguments(val)) return "arguments";
+      if (isDate(val)) return "date";
+      if (isError(val)) return "error";
+      if (isRegexp(val)) return "regexp";
+      switch (ctorName(val)) {
+        case "Symbol":
+          return "symbol";
+        case "Promise":
+          return "promise";
+        // Set, Map, WeakSet, WeakMap
+        case "WeakMap":
+          return "weakmap";
+        case "WeakSet":
+          return "weakset";
+        case "Map":
+          return "map";
+        case "Set":
+          return "set";
+        // 8-bit typed arrays
+        case "Int8Array":
+          return "int8array";
+        case "Uint8Array":
+          return "uint8array";
+        case "Uint8ClampedArray":
+          return "uint8clampedarray";
+        // 16-bit typed arrays
+        case "Int16Array":
+          return "int16array";
+        case "Uint16Array":
+          return "uint16array";
+        // 32-bit typed arrays
+        case "Int32Array":
+          return "int32array";
+        case "Uint32Array":
+          return "uint32array";
+        case "Float32Array":
+          return "float32array";
+        case "Float64Array":
+          return "float64array";
+      }
+      if (isGeneratorObj(val)) {
+        return "generator";
+      }
+      type = toString.call(val);
+      switch (type) {
+        case "[object Object]":
+          return "object";
+        // iterators
+        case "[object Map Iterator]":
+          return "mapiterator";
+        case "[object Set Iterator]":
+          return "setiterator";
+        case "[object String Iterator]":
+          return "stringiterator";
+        case "[object Array Iterator]":
+          return "arrayiterator";
+      }
+      return type.slice(8, -1).toLowerCase().replace(/\s/g, "");
+    };
+    function ctorName(val) {
+      return typeof val.constructor === "function" ? val.constructor.name : null;
+    }
+    function isArray(val) {
+      if (Array.isArray) return Array.isArray(val);
+      return val instanceof Array;
+    }
+    function isError(val) {
+      return val instanceof Error || typeof val.message === "string" && val.constructor && typeof val.constructor.stackTraceLimit === "number";
+    }
+    function isDate(val) {
+      if (val instanceof Date) return true;
+      return typeof val.toDateString === "function" && typeof val.getDate === "function" && typeof val.setDate === "function";
+    }
+    function isRegexp(val) {
+      if (val instanceof RegExp) return true;
+      return typeof val.flags === "string" && typeof val.ignoreCase === "boolean" && typeof val.multiline === "boolean" && typeof val.global === "boolean";
+    }
+    function isGeneratorFn(name, val) {
+      return ctorName(name) === "GeneratorFunction";
+    }
+    function isGeneratorObj(val) {
+      return typeof val.throw === "function" && typeof val.return === "function" && typeof val.next === "function";
+    }
+    function isArguments(val) {
+      try {
+        if (typeof val.length === "number" && typeof val.callee === "function") {
+          return true;
+        }
+      } catch (err) {
+        if (err.message.indexOf("callee") !== -1) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function isBuffer(val) {
+      if (val.constructor && typeof val.constructor.isBuffer === "function") {
+        return val.constructor.isBuffer(val);
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/is-extendable/index.js
+var require_is_extendable = __commonJS({
+  "node_modules/is-extendable/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function isExtendable(val) {
+      return typeof val !== "undefined" && val !== null && (typeof val === "object" || typeof val === "function");
+    };
+  }
+});
+
+// node_modules/extend-shallow/index.js
+var require_extend_shallow = __commonJS({
+  "node_modules/extend-shallow/index.js"(exports2, module2) {
+    "use strict";
+    var isObject = require_is_extendable();
+    module2.exports = function extend(o) {
+      if (!isObject(o)) {
+        o = {};
+      }
+      var len = arguments.length;
+      for (var i = 1; i < len; i++) {
+        var obj = arguments[i];
+        if (isObject(obj)) {
+          assign(o, obj);
+        }
+      }
+      return o;
+    };
+    function assign(a, b) {
+      for (var key in b) {
+        if (hasOwn(b, key)) {
+          a[key] = b[key];
+        }
+      }
+    }
+    function hasOwn(obj, key) {
+      return Object.prototype.hasOwnProperty.call(obj, key);
+    }
+  }
+});
+
+// node_modules/section-matter/index.js
+var require_section_matter = __commonJS({
+  "node_modules/section-matter/index.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var extend = require_extend_shallow();
+    module2.exports = function(input, options2) {
+      if (typeof options2 === "function") {
+        options2 = { parse: options2 };
+      }
+      var file = toObject(input);
+      var defaults = { section_delimiter: "---", parse: identity };
+      var opts = extend({}, defaults, options2);
+      var delim = opts.section_delimiter;
+      var lines = file.content.split(/\r?\n/);
+      var sections = null;
+      var section = createSection();
+      var content = [];
+      var stack = [];
+      function initSections(val) {
+        file.content = val;
+        sections = [];
+        content = [];
+      }
+      function closeSection(val) {
+        if (stack.length) {
+          section.key = getKey(stack[0], delim);
+          section.content = val;
+          opts.parse(section, sections);
+          sections.push(section);
+          section = createSection();
+          content = [];
+          stack = [];
+        }
+      }
+      for (var i = 0; i < lines.length; i++) {
+        var line = lines[i];
+        var len = stack.length;
+        var ln = line.trim();
+        if (isDelimiter(ln, delim)) {
+          if (ln.length === 3 && i !== 0) {
+            if (len === 0 || len === 2) {
+              content.push(line);
+              continue;
+            }
+            stack.push(ln);
+            section.data = content.join("\n");
+            content = [];
+            continue;
+          }
+          if (sections === null) {
+            initSections(content.join("\n"));
+          }
+          if (len === 2) {
+            closeSection(content.join("\n"));
+          }
+          stack.push(ln);
+          continue;
+        }
+        content.push(line);
+      }
+      if (sections === null) {
+        initSections(content.join("\n"));
+      } else {
+        closeSection(content.join("\n"));
+      }
+      file.sections = sections;
+      return file;
+    };
+    function isDelimiter(line, delim) {
+      if (line.slice(0, delim.length) !== delim) {
+        return false;
+      }
+      if (line.charAt(delim.length + 1) === delim.slice(-1)) {
+        return false;
+      }
+      return true;
+    }
+    function toObject(input) {
+      if (typeOf(input) !== "object") {
+        input = { content: input };
+      }
+      if (typeof input.content !== "string" && !isBuffer(input.content)) {
+        throw new TypeError("expected a buffer or string");
+      }
+      input.content = input.content.toString();
+      input.sections = [];
+      return input;
+    }
+    function getKey(val, delim) {
+      return val ? val.slice(delim.length).trim() : "";
+    }
+    function createSection() {
+      return { key: "", data: "", content: "" };
+    }
+    function identity(val) {
+      return val;
+    }
+    function isBuffer(val) {
+      if (val && val.constructor && typeof val.constructor.isBuffer === "function") {
+        return val.constructor.isBuffer(val);
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/engines.js
+var require_engines = __commonJS({
+  "node_modules/gray-matter/lib/engines.js"(exports, module) {
+    "use strict";
+    var yaml = __require("js-yaml");
+    var engines = exports = module.exports;
+    engines.yaml = {
+      parse: yaml.safeLoad.bind(yaml),
+      stringify: yaml.safeDump.bind(yaml)
+    };
+    engines.json = {
+      parse: JSON.parse.bind(JSON),
+      stringify: function(obj, options2) {
+        const opts = Object.assign({ replacer: null, space: 2 }, options2);
+        return JSON.stringify(obj, opts.replacer, opts.space);
+      }
+    };
+    engines.javascript = {
+      parse: function parse(str, options, wrap) {
+        try {
+          if (wrap !== false) {
+            str = "(function() {\nreturn " + str.trim() + ";\n}());";
+          }
+          return eval(str) || {};
+        } catch (err) {
+          if (wrap !== false && /(unexpected|identifier)/i.test(err.message)) {
+            return parse(str, options, false);
+          }
+          throw new SyntaxError(err);
+        }
+      },
+      stringify: function() {
+        throw new Error("stringifying JavaScript is not supported");
+      }
+    };
+  }
+});
+
+// node_modules/strip-bom-string/index.js
+var require_strip_bom_string = __commonJS({
+  "node_modules/strip-bom-string/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function(str2) {
+      if (typeof str2 === "string" && str2.charAt(0) === "\uFEFF") {
+        return str2.slice(1);
+      }
+      return str2;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/utils.js
+var require_utils = __commonJS({
+  "node_modules/gray-matter/lib/utils.js"(exports2) {
+    "use strict";
+    var stripBom = require_strip_bom_string();
+    var typeOf = require_kind_of();
+    exports2.define = function(obj, key, val) {
+      Reflect.defineProperty(obj, key, {
+        enumerable: false,
+        configurable: true,
+        writable: true,
+        value: val
+      });
+    };
+    exports2.isBuffer = function(val) {
+      return typeOf(val) === "buffer";
+    };
+    exports2.isObject = function(val) {
+      return typeOf(val) === "object";
+    };
+    exports2.toBuffer = function(input) {
+      return typeof input === "string" ? Buffer.from(input) : input;
+    };
+    exports2.toString = function(input) {
+      if (exports2.isBuffer(input)) return stripBom(String(input));
+      if (typeof input !== "string") {
+        throw new TypeError("expected input to be a string or buffer");
+      }
+      return stripBom(input);
+    };
+    exports2.arrayify = function(val) {
+      return val ? Array.isArray(val) ? val : [val] : [];
+    };
+    exports2.startsWith = function(str2, substr, len) {
+      if (typeof len !== "number") len = substr.length;
+      return str2.slice(0, len) === substr;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/defaults.js
+var require_defaults = __commonJS({
+  "node_modules/gray-matter/lib/defaults.js"(exports2, module2) {
+    "use strict";
+    var engines2 = require_engines();
+    var utils = require_utils();
+    module2.exports = function(options2) {
+      const opts = Object.assign({}, options2);
+      opts.delimiters = utils.arrayify(opts.delims || opts.delimiters || "---");
+      if (opts.delimiters.length === 1) {
+        opts.delimiters.push(opts.delimiters[0]);
+      }
+      opts.language = (opts.language || opts.lang || "yaml").toLowerCase();
+      opts.engines = Object.assign({}, engines2, opts.parsers, opts.engines);
+      return opts;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/engine.js
+var require_engine = __commonJS({
+  "node_modules/gray-matter/lib/engine.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function(name, options2) {
+      let engine = options2.engines[name] || options2.engines[aliase(name)];
+      if (typeof engine === "undefined") {
+        throw new Error('gray-matter engine "' + name + '" is not registered');
+      }
+      if (typeof engine === "function") {
+        engine = { parse: engine };
+      }
+      return engine;
+    };
+    function aliase(name) {
+      switch (name.toLowerCase()) {
+        case "js":
+        case "javascript":
+          return "javascript";
+        case "coffee":
+        case "coffeescript":
+        case "cson":
+          return "coffee";
+        case "yaml":
+        case "yml":
+          return "yaml";
+        default: {
+          return name;
+        }
+      }
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/stringify.js
+var require_stringify = __commonJS({
+  "node_modules/gray-matter/lib/stringify.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var getEngine = require_engine();
+    var defaults = require_defaults();
+    module2.exports = function(file, data, options2) {
+      if (data == null && options2 == null) {
+        switch (typeOf(file)) {
+          case "object":
+            data = file.data;
+            options2 = {};
+            break;
+          case "string":
+            return file;
+          default: {
+            throw new TypeError("expected file to be a string or object");
+          }
+        }
+      }
+      const str2 = file.content;
+      const opts = defaults(options2);
+      if (data == null) {
+        if (!opts.data) return file;
+        data = opts.data;
+      }
+      const language = file.language || opts.language;
+      const engine = getEngine(language, opts);
+      if (typeof engine.stringify !== "function") {
+        throw new TypeError('expected "' + language + '.stringify" to be a function');
+      }
+      data = Object.assign({}, file.data, data);
+      const open = opts.delimiters[0];
+      const close = opts.delimiters[1];
+      const matter2 = engine.stringify(data, options2).trim();
+      let buf = "";
+      if (matter2 !== "{}") {
+        buf = newline(open) + newline(matter2) + newline(close);
+      }
+      if (typeof file.excerpt === "string" && file.excerpt !== "") {
+        if (str2.indexOf(file.excerpt.trim()) === -1) {
+          buf += newline(file.excerpt) + newline(close);
+        }
+      }
+      return buf + newline(str2);
+    };
+    function newline(str2) {
+      return str2.slice(-1) !== "\n" ? str2 + "\n" : str2;
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/excerpt.js
+var require_excerpt = __commonJS({
+  "node_modules/gray-matter/lib/excerpt.js"(exports2, module2) {
+    "use strict";
+    var defaults = require_defaults();
+    module2.exports = function(file, options2) {
+      const opts = defaults(options2);
+      if (file.data == null) {
+        file.data = {};
+      }
+      if (typeof opts.excerpt === "function") {
+        return opts.excerpt(file, opts);
+      }
+      const sep2 = file.data.excerpt_separator || opts.excerpt_separator;
+      if (sep2 == null && (opts.excerpt === false || opts.excerpt == null)) {
+        return file;
+      }
+      const delimiter2 = typeof opts.excerpt === "string" ? opts.excerpt : sep2 || opts.delimiters[0];
+      const idx = file.content.indexOf(delimiter2);
+      if (idx !== -1) {
+        file.excerpt = file.content.slice(0, idx);
+      }
+      return file;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/to-file.js
+var require_to_file = __commonJS({
+  "node_modules/gray-matter/lib/to-file.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var stringify = require_stringify();
+    var utils = require_utils();
+    module2.exports = function(file) {
+      if (typeOf(file) !== "object") {
+        file = { content: file };
+      }
+      if (typeOf(file.data) !== "object") {
+        file.data = {};
+      }
+      if (file.contents && file.content == null) {
+        file.content = file.contents;
+      }
+      utils.define(file, "orig", utils.toBuffer(file.content));
+      utils.define(file, "language", file.language || "");
+      utils.define(file, "matter", file.matter || "");
+      utils.define(file, "stringify", function(data, options2) {
+        if (options2 && options2.language) {
+          file.language = options2.language;
+        }
+        return stringify(file, data, options2);
+      });
+      file.content = utils.toString(file.content);
+      file.isEmpty = false;
+      file.excerpt = "";
+      return file;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/parse.js
+var require_parse = __commonJS({
+  "node_modules/gray-matter/lib/parse.js"(exports2, module2) {
+    "use strict";
+    var getEngine = require_engine();
+    var defaults = require_defaults();
+    module2.exports = function(language, str2, options2) {
+      const opts = defaults(options2);
+      const engine = getEngine(language, opts);
+      if (typeof engine.parse !== "function") {
+        throw new TypeError('expected "' + language + '.parse" to be a function');
+      }
+      return engine.parse(str2, opts);
+    };
+  }
+});
+
+// node_modules/gray-matter/index.js
+var require_gray_matter = __commonJS({
+  "node_modules/gray-matter/index.js"(exports2, module2) {
+    "use strict";
+    var fs4 = __require("fs");
+    var sections = require_section_matter();
+    var defaults = require_defaults();
+    var stringify = require_stringify();
+    var excerpt = require_excerpt();
+    var engines2 = require_engines();
+    var toFile = require_to_file();
+    var parse2 = require_parse();
+    var utils = require_utils();
+    function matter2(input, options2) {
+      if (input === "") {
+        return { data: {}, content: input, excerpt: "", orig: input };
+      }
+      let file = toFile(input);
+      const cached = matter2.cache[file.content];
+      if (!options2) {
+        if (cached) {
+          file = Object.assign({}, cached);
+          file.orig = cached.orig;
+          return file;
+        }
+        matter2.cache[file.content] = file;
+      }
+      return parseMatter(file, options2);
+    }
+    function parseMatter(file, options2) {
+      const opts = defaults(options2);
+      const open = opts.delimiters[0];
+      const close = "\n" + opts.delimiters[1];
+      let str2 = file.content;
+      if (opts.language) {
+        file.language = opts.language;
+      }
+      const openLen = open.length;
+      if (!utils.startsWith(str2, open, openLen)) {
+        excerpt(file, opts);
+        return file;
+      }
+      if (str2.charAt(openLen) === open.slice(-1)) {
+        return file;
+      }
+      str2 = str2.slice(openLen);
+      const len = str2.length;
+      const language = matter2.language(str2, opts);
+      if (language.name) {
+        file.language = language.name;
+        str2 = str2.slice(language.raw.length);
+      }
+      let closeIndex = str2.indexOf(close);
+      if (closeIndex === -1) {
+        closeIndex = len;
+      }
+      file.matter = str2.slice(0, closeIndex);
+      const block = file.matter.replace(/^\s*#[^\n]+/gm, "").trim();
+      if (block === "") {
+        file.isEmpty = true;
+        file.empty = file.content;
+        file.data = {};
+      } else {
+        file.data = parse2(file.language, file.matter, opts);
+      }
+      if (closeIndex === len) {
+        file.content = "";
+      } else {
+        file.content = str2.slice(closeIndex + close.length);
+        if (file.content[0] === "\r") {
+          file.content = file.content.slice(1);
+        }
+        if (file.content[0] === "\n") {
+          file.content = file.content.slice(1);
+        }
+      }
+      excerpt(file, opts);
+      if (opts.sections === true || typeof opts.section === "function") {
+        sections(file, opts.section);
+      }
+      return file;
+    }
+    matter2.engines = engines2;
+    matter2.stringify = function(file, data, options2) {
+      if (typeof file === "string") file = matter2(file, options2);
+      return stringify(file, data, options2);
+    };
+    matter2.read = function(filepath, options2) {
+      const str2 = fs4.readFileSync(filepath, "utf8");
+      const file = matter2(str2, options2);
+      file.path = filepath;
+      return file;
+    };
+    matter2.test = function(str2, options2) {
+      return utils.startsWith(str2, defaults(options2).delimiters[0]);
+    };
+    matter2.language = function(str2, options2) {
+      const opts = defaults(options2);
+      const open = opts.delimiters[0];
+      if (matter2.test(str2)) {
+        str2 = str2.slice(open.length);
+      }
+      const language = str2.slice(0, str2.search(/\r?\n/));
+      return {
+        raw: language,
+        name: language ? language.trim() : ""
+      };
+    };
+    matter2.cache = {};
+    matter2.clearCache = function() {
+      matter2.cache = {};
+    };
+    module2.exports = matter2;
+  }
+});
 
 // spex-console/bin/hs-init.ts
 import {
   copyFileSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync as readFileSync4,
-  writeFileSync
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync6,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync11,
+  statSync,
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname, join as join3, resolve } from "node:path";
-import process2 from "node:process";
+import { dirname as dirname6, join as join11, resolve as resolve5 } from "node:path";
+import process4 from "node:process";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+
+// scripts/lib/shared-path-helpers.mjs
+import { isAbsolute, resolve, sep } from "node:path";
+function resolveCodeRoot({
+  explicit,
+  packageRoot,
+  vaultRoot,
+  env = process.env
+} = {}) {
+  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
+  if (fromExplicit) return fromExplicit;
+  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
+  if (fromEnv) return fromEnv;
+  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
+  if (fromPackage) return fromPackage;
+  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
+  return fromVault;
+}
 
 // spex-console/src/lib/cli/customer-claude-md.ts
 function renderCustomerClaudeMd({
@@ -65,15 +936,38 @@ The vault under \`specs/\` is the only persistent queue. File new work via \`hey
 This CLAUDE.md was generated for **${vaultName}** from HeySpex template version **${templateVersion}** \u2014 it is yours to edit. Unlike HeySpex's own platform contract (which carries HeySpex's internal build tooling), everything above applies to *your* vault and *your* agents. Edit it freely as your project's conventions evolve; a later template update will not overwrite your changes.
 `;
 }
-function customerClaudeMdHook() {
+function writeProjectContract(ctx, options2 = {}) {
+  const content = renderCustomerClaudeMd({
+    vaultName: ctx.vaultName,
+    templateVersion: ctx.templateVersion
+  });
+  const results = [];
+  for (const file of options2.files ?? ["CLAUDE.md"]) {
+    const destPath = ctx.deps.joinPath(ctx.targetDir, file);
+    if (!ctx.deps.exists(destPath)) {
+      ctx.deps.writeFile(destPath, content);
+      ctx.recordWrite?.(destPath);
+      results.push({ file, action: "created", path: destPath });
+      continue;
+    }
+    if (ctx.deps.readFile?.(destPath) === content) {
+      results.push({ file, action: "unchanged" });
+      continue;
+    }
+    const templatePath = ctx.deps.joinPath(ctx.targetDir, `${file}.template`);
+    if (ctx.deps.readFile?.(templatePath) !== content) {
+      ctx.deps.writeFile(templatePath, content);
+      ctx.recordWrite?.(templatePath);
+    }
+    const hint = `${file} already exists - left untouched. Generated contract written to ${file}.template; compare with: diff ${file} ${file}.template`;
+    options2.notify?.(hint);
+    results.push({ file, action: "template", path: templatePath, hint });
+  }
+  return results;
+}
+function customerClaudeMdHook(notify) {
   return (ctx) => {
-    const content = renderCustomerClaudeMd({
-      vaultName: ctx.vaultName,
-      templateVersion: ctx.templateVersion
-    });
-    const destPath = ctx.deps.joinPath(ctx.targetDir, "CLAUDE.md");
-    ctx.deps.writeFile(destPath, content);
-    ctx.recordWrite(destPath);
+    writeProjectContract(ctx, { notify });
   };
 }
 
@@ -81,69 +975,200 @@ function customerClaudeMdHook() {
 import { randomUUID } from "node:crypto";
 
 // scripts/lib/console-url-resolver.mjs
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_CONSOLE_URL = "https://app.heyspex.com";
+init_heyspex_home();
+init_dev_mode();
+import { readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join3 } from "node:path";
+var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
 function trimTrailingSlash(url) {
   return url.replace(/\/+$/, "");
 }
-function readCredentialsConsoleUrl({ homeDir = homedir() } = {}) {
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0.0.0.0"]);
+function isLoopbackConsoleUrl(url) {
+  if (typeof url !== "string" || !url) return false;
   try {
-    const raw = readFileSync(join(homeDir, ".heyspex", "credentials.yaml"), "utf8");
-    const match = raw.match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
+    return LOOPBACK_HOSTS.has(new URL(url).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+var staleLoopbackCredentialsWarned = false;
+function warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log }) {
+  if (staleLoopbackCredentialsWarned) return;
+  staleLoopbackCredentialsWarned = true;
+  try {
+    log(
+      `[heyspex] ignoring console_url ${credentialsUrl} from ~/.heyspex/credentials.yaml: the resolved reliance is cloud, and a loopback console cannot serve it \u2014 using ${derivedUrl} (set HEYSPEX_CONSOLE_URL to override explicitly, or run \`hs dev mode:local\` to go back to a local console).
+`
+    );
+  } catch {
+  }
+}
+function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile = defaultReadFile2 } = {}) {
+  try {
+    const raw = readFile(join3(homeDir, ".heyspex", "credentials.yaml"));
+    const match = String(raw ?? "").match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
     const value = match?.[1]?.trim();
     return value && value.length > 0 ? trimTrailingSlash(value) : null;
   } catch {
     return null;
   }
 }
-function readDiscoveryFileConsoleUrl(repoRoot) {
+function defaultReadFile2(p) {
+  return readFileSync3(p, "utf8");
+}
+function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery = defaultReadFile2 } = {}) {
   if (!repoRoot) return null;
-  for (const name of [
-    "console-url",
-    "cockpit-url"
-    /* legacy-cockpit */
-  ]) {
-    try {
-      const discovery = readFileSync(join(repoRoot, ".heyspex", name), "utf8").trim();
-      if (discovery.length > 0) return trimTrailingSlash(discovery);
-    } catch {
-    }
+  try {
+    const discovery = String(readDiscovery(join3(repoRoot, ".heyspex", "console-url")) ?? "").trim();
+    if (discovery.length > 0) return trimTrailingSlash(discovery);
+  } catch {
   }
   return null;
 }
 var ConsoleUrlUnresolvedError = class extends Error {
   constructor() {
     super(
-      `resolveConsoleUrl: no HEYSPEX_CONSOLE_URL/HEYSPEX_COCKPIT_URL env, no console_url: in ~/.heyspex/credentials.yaml, and no .heyspex/console-url discovery file \u2014 refusing to silently fall back to the ${DEFAULT_CONSOLE_URL} default in strict mode.`
+      "resolveConsoleUrl: local reliance with no HEYSPEX_CONSOLE_URL env, no console_url: in ~/.heyspex/credentials.yaml, and no .heyspex/console-url discovery file \u2014 refusing to silently fall back to the localhost:3000 default in strict mode."
     );
     this.name = "ConsoleUrlUnresolvedError";
   }
 };
+function resolveModeEnvelope({ env, homeDir }) {
+  try {
+    const resolved = resolveDevMode({ env, homeDir });
+    return {
+      reliance: resolved.reliance === "cloud" ? "cloud" : "local",
+      consoleUrl: resolved.consoleUrl || DEFAULT_CONSOLE_URL
+    };
+  } catch {
+    return { reliance: "local", consoleUrl: DEFAULT_CONSOLE_URL };
+  }
+}
 function resolveConsoleUrl({
   repoRoot,
   env = process.env,
-  homeDir = homedir(),
-  strict = false
+  homeDir = heyspexHome(),
+  strict = false,
+  devMode,
+  log = (line) => process.stderr.write(line),
+  readFile = defaultReadFile2,
+  readDiscovery = defaultReadFile2
 } = {}) {
-  const envUrl = (env.HEYSPEX_CONSOLE_URL ?? env.HEYSPEX_COCKPIT_URL)?.trim();
+  const envUrl = env.HEYSPEX_CONSOLE_URL?.trim();
   if (envUrl) return trimTrailingSlash(envUrl);
-  const credentialsUrl = readCredentialsConsoleUrl({ homeDir });
-  if (credentialsUrl) return credentialsUrl;
-  const discoveryUrl = readDiscoveryFileConsoleUrl(repoRoot);
-  if (discoveryUrl) return discoveryUrl;
-  if (strict) throw new ConsoleUrlUnresolvedError();
-  return DEFAULT_CONSOLE_URL;
+  const mode = devMode ?? resolveModeEnvelope({ env, homeDir });
+  const cloud = mode.reliance === "cloud";
+  const derivedUrl = trimTrailingSlash(
+    cloud && isLoopbackConsoleUrl(mode.consoleUrl) ? CLOUD_CONSOLE_URL : mode.consoleUrl || DEFAULT_CONSOLE_URL
+  );
+  const credentialsUrl = readCredentialsConsoleUrl({ homeDir, readFile });
+  if (credentialsUrl) {
+    if (cloud && isLoopbackConsoleUrl(credentialsUrl)) {
+      warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log });
+    } else {
+      return credentialsUrl;
+    }
+  }
+  if (!cloud) {
+    const discoveryUrl = readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery });
+    if (discoveryUrl) return discoveryUrl;
+    if (strict) throw new ConsoleUrlUnresolvedError();
+  }
+  return derivedUrl;
 }
 
 // spex-console/src/lib/cli/control-shared.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import path from "node:path";
+
+// scripts/lib/hs-command.mjs
+import { existsSync } from "node:fs";
+import { delimiter, dirname as dirname2, join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+var HS_BIN_NAME = "hs";
+var HS_DISPATCHER_PATH = (() => {
+  try {
+    const here = dirname2(fileURLToPath(import.meta.url));
+    return join4(dirname2(dirname2(here)), "bin", "hs.mjs");
+  } catch {
+    return null;
+  }
+})();
+function shellQuote(p) {
+  return /[\\\s]/.test(p) ? `"${p}"` : p;
+}
+var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
+
+// vendor/heyspex-mcp/console-fetch.mjs
+init_heyspex_home();
+init_credentials();
+import { readFileSync as readFileSync7 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
+
+// vendor/heyspex-mcp/session-owner.mjs
+init_heyspex_home();
+init_credentials();
+import { readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join5 } from "node:path";
+
+// vendor/heyspex-mcp/vault-less-endpoints.mjs
+var VAULT_LESS_ENDPOINTS = Object.freeze([
+  "* /api/mcp/session",
+  "* /api/mcp/pairing-codes",
+  "POST /api/vaults",
+  "GET /api/vaults",
+  "POST /api/workspaces",
+  "GET /api/workspaces",
+  "* /api/admin/dev-mode"
+]);
+
+// vendor/heyspex-mcp/write-outbox.mjs
+import {
+  readdirSync,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3,
+  mkdirSync as mkdirSync3,
+  existsSync as existsSync2,
+  renameSync as renameSync2,
+  rmSync
+} from "node:fs";
+import { basename, join as join6, isAbsolute as isAbsolute2 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+init_heyspex_home();
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6, tmpdir } from "node:os";
+import { dirname as dirname3, join as join7, resolve as resolve3 } from "node:path";
+
+// vendor/heyspex-mcp/console-fetch.mjs
+var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
+
+// spex-console/src/lib/cli/control-shared.ts
+init_credentials();
+
+// spex-console/src/lib/vault-registry/registry-file.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join9, resolve as resolve4 } from "node:path";
+
+// spex-console/src/lib/heyspex-home.ts
+import { homedir as homedir8 } from "node:os";
+
+// spex-console/src/lib/cli/control-shared.ts
 var EXIT = {
   /** Success. */
   OK: 0,
+  /**
+   * A read-only CHECK ran correctly and its answer is "no" — `hs connect
+   * --check` on an unconnected repo. Distinct from {@link EXIT.USAGE} so a
+   * script can tell "you typed the command wrong" from "the command worked,
+   * the repo is not connected". Both were `1` until 2026-09-18, which made
+   * `--check` unusable in a conditional: every caller had to parse stdout to
+   * find out which of the two had happened.
+   */
+  CHECK_FAILED: 2,
   /** Usage error — unknown subcommand/flag, or a missing required argument. */
   USAGE: 1,
   /** Claim race lost — the spec is already claimed by another agent (409). */
@@ -165,12 +1190,63 @@ var EXIT = {
    * from `USAGE`/`INVALID_ARG` — this is an authorization refusal, not a
    * malformed command.
    */
-  FORBIDDEN: 15
+  FORBIDDEN: 15,
+  /**
+   * A CLOUD write refused because no account id could be resolved (no
+   * `HS_ACCOUNT_ID` env var, no `account_id:` in `~/.heyspex/config.yaml`) --
+   * `resolveCloudAccountIdOrRefuse` in `vault-workspace-shared.ts`
+   * ([[HS-YU1S-UAGY-TASK-cloud-writes-refuse-without-a]]). Distinct from
+   * `FORBIDDEN` -- this is "not signed in at all", not "signed in but not
+   * authorized for this override".
+   */
+  SIGN_IN_REQUIRED: 16,
+  /**
+   * Signed in, but the account a repo would be attached to was not confirmed:
+   * a non-interactive install/connect with no matching `--account` / `--yes`,
+   * an `account_id` that disagrees with the bearer's user, or the human
+   * aborting the identity prompt (`install-identity.ts`,
+   * [[HS-HAQI-KODY-DIAG-hs-install-and-hs-connect-bind-a-new]]).
+   */
+  IDENTITY_UNCONFIRMED: 17,
+  /**
+   * The repo this verb runs in is not registered on this machine (no
+   * `~/.heyspex/registry.json` row for its root, or a legacy slug row with no
+   * cloud `vault_id` in its heyspex.yaml), so the call was refused LOCALLY —
+   * nothing was sent. Names `hs connect`
+   * ([[HS-MVG4-WW9R-TASK-mcp-and-hs-name-account-vault-on-every]]).
+   */
+  VAULT_NOT_REGISTERED: 18,
+  /**
+   * The local half of a setup verb (`hs connect`, `hs vault *`, `hs workspace
+   * *`) was written but the CLOUD half did not land -- the console refused
+   * it or was never reached. The verb's receipt names the failed half and the
+   * exact command to re-run
+   * ([[HS-STCY-WW9R-TASK-add-a-shared-receipt-that-reads-back]], invariant 6).
+   * Distinct from {@link EXIT.WRITE_FAILED} so a script can tell "re-run to
+   * sync the cloud" from a generic server failure.
+   */
+  CLOUD_WRITE_FAILED: 19,
+  /**
+   * The repo's committed `heyspex.yaml` records `account: <A>` but the machine
+   * is signed in as another account, so `hs connect` refused and wrote
+   * nothing (marker, registry, cloud). Repair: `hs login --switch-account <A>`
+   * ([[HS-VWUD-WW9R-TASK-record-the-connecting-account-in]], invariant 4).
+   */
+  ACCOUNT_MISMATCH: 20,
+  /**
+   * Both sides of a setup verb's receipt were read back and still DISAGREE
+   * after a short bounded re-read of the cloud side (a briefly stale read is
+   * absorbed first). The write may well have landed; what the verb cannot
+   * claim is that this machine and the console now say the same thing. The
+   * receipt prints the diffs and the command to re-run
+   * ([[HS-FKSR-WW9R-TASK-make-one-hs-connect-run-create-a-cloud]], invariant 6).
+   * Distinct from {@link EXIT.CLOUD_WRITE_FAILED} (a write that did not land).
+   */
+  RECEIPT_DISAGREE: 21
 };
 
 // spex-console/src/lib/cli/init.ts
 var HEYSPEX_YAML_SCHEMA_VERSION = 2;
-var DEFAULT_CONSOLE_URL2 = resolveConsoleUrl();
 function mintVaultId() {
   return randomUUID();
 }
@@ -181,6 +1257,30 @@ function parseVaultId(content) {
   const unquoted = raw.replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1");
   return unquoted.length > 0 ? unquoted : null;
 }
+function parseAccountId(content) {
+  const m = content.match(/^account:[ \t]*(.+?)\s*$/m);
+  if (!m) return null;
+  const raw = m[1].replace(/\s+#.*$/, "").trim();
+  const unquoted = raw.replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1");
+  return unquoted.length > 0 ? unquoted : null;
+}
+var MARKER_ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_.@+-]*$/;
+function recordMarkerAccount(content, accountId) {
+  if (!MARKER_ACCOUNT_ID_RE.test(accountId)) {
+    throw new Error(`recordMarkerAccount: "${accountId}" is not a valid account id`);
+  }
+  const recorded = parseAccountId(content);
+  if (recorded === accountId) return { action: "unchanged", content };
+  if (recorded !== null) return { action: "conflict", recorded, content };
+  const eol = content.includes("\r\n") ? "\r\n" : "\n";
+  const lines = content.replace(/(\r?\n)+$/, "").split(/\r?\n/);
+  const kept = lines.filter((l) => !/^account:\s*$/.test(l));
+  const vaultIdx = kept.findIndex((l) => /^vault_id:/.test(l));
+  const line = `account: ${accountId}`;
+  if (vaultIdx >= 0) kept.splice(vaultIdx + 1, 0, line);
+  else kept.push(line);
+  return { action: "added", content: `${kept.join(eol)}${eol}` };
+}
 function appendVaultIdLine(content, vaultId) {
   const trimmed = content.replace(/\n+$/, "");
   return `${trimmed}
@@ -188,21 +1288,22 @@ vault_id: ${vaultId}
 `;
 }
 function parseInitArgs(argv) {
-  let consoleUrl = (process.env.HEYSPEX_CONSOLE_URL ?? process.env.HEYSPEX_COCKPIT_URL)?.trim() || // legacy-cockpit env
-  DEFAULT_CONSOLE_URL2;
+  let consoleUrl = resolveConsoleUrl();
   let vaultRoot = "specs/";
   let force = false;
   let json = false;
   let customerVaultDir;
   let principles;
   let vaultName;
-  let noGit = false;
+  let git = false;
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--help" || arg === "-h") return { help: true };
     else if (arg === "--json") json = true;
     else if (arg === "--force") force = true;
-    else if (arg === "--no-git") noGit = true;
+    else if (arg === "--git") git = true;
+    else if (arg === "--no-git")
+      git = false;
     else if (arg === "--principles" || arg.startsWith("--principles=")) {
       const v = arg === "--principles" ? argv[++i] : arg.slice("--principles=".length);
       if (v === void 0 || v.trim() === "") {
@@ -215,8 +1316,7 @@ function parseInitArgs(argv) {
         return { error: { code: EXIT.INVALID_ARG, message: "--vault-name requires a value" } };
       }
       vaultName = v.trim();
-    } else if (arg === "--console-url" || arg.startsWith("--console-url=") || arg === "--cockpit-url" || // legacy-cockpit alias
-    arg.startsWith("--cockpit-url=")) {
+    } else if (arg === "--console-url" || arg.startsWith("--console-url=")) {
       const eq = arg.indexOf("=");
       const v = eq === -1 ? argv[++i] : arg.slice(eq + 1);
       if (v === void 0 || v.trim() === "") {
@@ -247,17 +1347,36 @@ function parseInitArgs(argv) {
     }
   }
   return {
-    args: { consoleUrl, vaultRoot, force, json, customerVaultDir, principles, vaultName, noGit }
+    args: { consoleUrl, vaultRoot, force, json, customerVaultDir, principles, vaultName, git }
   };
 }
+var HEYSPEX_CONFIG_DIR = ".heyspex";
+var HEYSPEX_CONFIG_FILE = "config.yaml";
+function seedConfigYaml(root, readSeed, fs4) {
+  const configDir = fs4.joinPath(root, HEYSPEX_CONFIG_DIR);
+  const configPath = fs4.joinPath(configDir, HEYSPEX_CONFIG_FILE);
+  if (fs4.exists(configPath)) return { status: "kept", path: configPath };
+  if (!readSeed) return { status: "no_seed", path: configPath };
+  let seed;
+  try {
+    seed = readSeed();
+  } catch {
+    seed = null;
+  }
+  if (seed === null) return { status: "no_seed", path: configPath };
+  fs4.mkdirRecursive(configDir);
+  fs4.writeFile(configPath, seed);
+  return { status: "seeded", path: configPath };
+}
 function renderHeyspexYaml(args) {
-  return [
+  const body = [
     `schema_version: ${HEYSPEX_YAML_SCHEMA_VERSION}`,
     `console_url: ${args.consoleUrl}`,
     `vault_root: ${args.vaultRoot}`,
     `vault_id: ${args.vaultId}`,
     ""
   ].join("\n");
+  return args.accountId ? recordMarkerAccount(body, args.accountId).content : body;
 }
 function readExistingContent(deps, markerPath) {
   if (!deps.readFile) return null;
@@ -272,17 +1391,60 @@ function runInit(args, deps) {
   const exists = deps.fileExists(markerPath);
   const existingContent = exists ? readExistingContent(deps, markerPath) : null;
   const existingVaultId = existingContent ? parseVaultId(existingContent) : null;
+  if (deps.mkdirRecursive) {
+    const specsPath = deps.joinPath(deps.repoRoot, args.vaultRoot);
+    try {
+      deps.mkdirRecursive(specsPath);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        code: EXIT.WRITE_FAILED,
+        message: `failed to create ${specsPath}: ${message}`,
+        payload: { ok: false, error: "write_failed", path: specsPath, message },
+        isError: true
+      };
+    }
+  }
+  let configSeed = null;
+  const mkdirRecursive = deps.mkdirRecursive;
+  if (mkdirRecursive) {
+    const readConfigSeed2 = deps.readConfigSeed;
+    try {
+      configSeed = seedConfigYaml(
+        deps.repoRoot,
+        readConfigSeed2 ? () => readConfigSeed2.call(deps) : void 0,
+        {
+          exists: (p) => deps.fileExists(p),
+          mkdirRecursive: (p) => mkdirRecursive.call(deps, p),
+          writeFile: (p, c) => deps.writeFile(p, c),
+          joinPath: (...s) => deps.joinPath(...s)
+        }
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const configPath = deps.joinPath(deps.repoRoot, HEYSPEX_CONFIG_DIR, HEYSPEX_CONFIG_FILE);
+      return {
+        code: EXIT.WRITE_FAILED,
+        message: `failed to seed ${configPath}: ${message}`,
+        payload: { ok: false, error: "write_failed", path: configPath, message },
+        isError: true
+      };
+    }
+  }
+  const configNote = configSeed?.status === "seeded" ? ` Seeded ${configSeed.path}.` : configSeed?.status === "kept" ? ` Kept existing ${configSeed.path}.` : "";
+  const configPayload = configSeed === null || configSeed.status === "no_seed" ? {} : { config_yaml: configSeed.path, config_yaml_seeded: configSeed.status === "seeded" };
   if (exists && !args.force) {
     if (existingVaultId) {
       return {
         code: EXIT.OK,
-        message: `heyspex.yaml already exists at ${markerPath} \u2014 vault already initialized (use --force to overwrite).`,
+        message: `heyspex.yaml already exists at ${markerPath} \u2014 vault already initialized (use --force to overwrite).${configNote}`,
         payload: {
           ok: true,
           created: false,
           path: markerPath,
           reason: "already_initialized",
-          vault_id: existingVaultId
+          vault_id: existingVaultId,
+          ...configPayload
         },
         isError: false
       };
@@ -290,8 +1452,14 @@ function runInit(args, deps) {
     if (existingContent === null) {
       return {
         code: EXIT.OK,
-        message: `heyspex.yaml already exists at ${markerPath} \u2014 vault already initialized (use --force to overwrite).`,
-        payload: { ok: true, created: false, path: markerPath, reason: "already_initialized" },
+        message: `heyspex.yaml already exists at ${markerPath} \u2014 vault already initialized (use --force to overwrite).${configNote}`,
+        payload: {
+          ok: true,
+          created: false,
+          path: markerPath,
+          reason: "already_initialized",
+          ...configPayload
+        },
         isError: false
       };
     }
@@ -310,19 +1478,21 @@ function runInit(args, deps) {
     }
     return {
       code: EXIT.OK,
-      message: `Added vault_id to existing heyspex.yaml at ${markerPath} (schema_version unchanged).`,
+      message: `Added vault_id to existing heyspex.yaml at ${markerPath} (schema_version unchanged).${configNote}`,
       payload: {
         ok: true,
         created: false,
         backfilled: true,
         path: markerPath,
-        vault_id: mintedId
+        vault_id: mintedId,
+        ...configPayload
       },
       isError: false
     };
   }
   const vaultId = existingVaultId ?? args.adoptedVaultId ?? mintVaultId();
-  const content = renderHeyspexYaml({ ...args, vaultId });
+  const accountId = null;
+  const content = renderHeyspexYaml({ ...args, vaultId, accountId });
   try {
     deps.writeFile(markerPath, content);
   } catch (err) {
@@ -336,7 +1506,7 @@ function runInit(args, deps) {
   }
   return {
     code: EXIT.OK,
-    message: `${exists ? "Overwrote" : "Wrote"} ${markerPath} (schema_version ${HEYSPEX_YAML_SCHEMA_VERSION}).`,
+    message: `${exists ? "Overwrote" : "Wrote"} ${markerPath} (schema_version ${HEYSPEX_YAML_SCHEMA_VERSION}).${configNote}`,
     payload: {
       ok: true,
       created: true,
@@ -345,7 +1515,9 @@ function runInit(args, deps) {
       schema_version: HEYSPEX_YAML_SCHEMA_VERSION,
       console_url: args.consoleUrl,
       vault_root: args.vaultRoot,
-      vault_id: vaultId
+      vault_id: vaultId,
+      ...accountId ? { account: accountId } : {},
+      ...configPayload
     },
     isError: false
   };
@@ -354,27 +1526,38 @@ var HELP = [
   "Usage:",
   "  hs init [--console-url <url>] [--vault-root <path>] [--force] [--json]",
   "  hs init --customer-vault <dir> [--console-url <url>] [--principles <all|none|a,b>]",
-  "                          [--vault-name <name>] [--no-git] [--json]",
+  "                          [--vault-name <name>] [--git] [--json]",
   "",
   "Write the top-level heyspex.yaml vault marker (schema_version, console_url,",
-  "vault_root, vault_id) \u2014 the committed file the console / web companion read",
+  "vault_root, vault_id; `hs connect` also records `account:`, the account id the",
+  "repo was connected under) \u2014 the committed file the console / web companion read",
   "to bootstrap a vault. Idempotent: an existing marker is left untouched unless",
   "--force, EXCEPT a missing vault_id is backfilled in place either way (backward",
   "compatible \u2014 no schema_version bump). vault_id is reused exactly when already",
   "present; a fresh one is minted only when absent.",
-  "Does not modify .heyspex/config.yaml or its templates (ADR-0009).",
+  "Also scaffolds the vault_root folder and seeds .heyspex/config.yaml (the",
+  "HeySpex workflow settings, ADR-0009) from the shipped template",
+  "(vendor/heyspex-mcp/config-seed.yaml) when that file is absent. An existing",
+  ".heyspex/config.yaml is never rewritten \u2014 not even with --force; change its",
+  "values with `hs settings set <key> <value>`.",
   "",
   "--customer-vault <dir> scaffolds a REAL customer vault at <dir> instead: the",
-  "specs/ folder tree, heyspex.yaml, and every row of the template shipping",
-  "manifest (spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
+  "specs/ folder tree, heyspex.yaml, the seeded .heyspex/config.yaml, and every",
+  "row of the template shipping manifest",
+  "(spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
   "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
-  "plus a generated CLAUDE.md, the kept-principles index, and (unless --no-git)",
-  "one initial `git init` + commit pinning the template version. Refuses a",
-  "non-empty <dir> with a plain error. See init.customer-vault.ts.",
+  "plus a generated CLAUDE.md, the kept-principles index, and the template_version",
+  "pin; with --git, one initial `git init` + commit. Rerunnable: a <dir> that already",
+  "holds heyspex.yaml and an empty/placeholder-only specs/ is accepted, existing",
+  "files are never overwritten (an existing CLAUDE.md gets a CLAUDE.md.template",
+  "beside it), and the result lists each manifest row as created or kept. Refuses a",
+  "non-empty <dir> without heyspex.yaml, or a specs/ holding managed specs.",
+  "See init.customer-vault.ts.",
   "",
   "Flags:",
-  "  --console-url <url>  console_url value (default: $HEYSPEX_CONSOLE_URL or",
-  "                       https://console.heyspex.local).",
+  "  --console-url <url>  console_url value (default: the mode-aware console --",
+  "                       $HEYSPEX_CONSOLE_URL, else the signed-in console, else",
+  "                       https://app.heyspex.com in prod mode).",
   "  --vault-root <path>  vault_root value (default: specs/).",
   "  --customer-vault <dir> Scaffold a new customer vault at <dir> (see above).",
   "  --principles <all|none|a,b> Which universal principle docs to ship",
@@ -382,8 +1565,9 @@ var HELP = [
   "                       keep/skip prompt per principle. Omitted + no TTY: all.",
   "  --vault-name <name>  Display name for the scaffolded vault (--customer-vault",
   "                       only; default: <dir>'s basename).",
-  "  --no-git             Skip git init + the initial commit (--customer-vault only).",
-  "  --force              Overwrite an existing heyspex.yaml.",
+  "  --git                Also run git init + one initial commit (--customer-vault only;",
+  "                       default: no git). --no-git is accepted as a no-op.",
+  "  --force              Overwrite an existing heyspex.yaml (never .heyspex/config.yaml).",
   "  --json               Emit a machine-readable JSON result.",
   "  --help, -h           Show this help.",
   "",
@@ -391,7 +1575,7 @@ var HELP = [
 ].join("\n");
 
 // spex-console/src/lib/cli/init.customer-vault.ts
-import { basename } from "node:path";
+import { basename as basename2 } from "node:path";
 
 // spex-console/src/lib/cli/template-manifest.sources.mjs
 var UNIVERSAL_TEMPLATE_ROWS = [
@@ -407,14 +1591,69 @@ var UNIVERSAL_TEMPLATE_ROWS = [
   {
     platformSource: "specs/protocols/memory-protocol.md",
     dest: "specs/protocols/memory-protocol.md"
+  },
+  {
+    // ~455 lines of HS-REV / MVP-grain / guardrail detail that cannot be
+    // curated cleanly: ships a template-shape abridgement instead.
+    platformSource: "specs/protocols/session-close-protocol.md",
+    abridgedSource: "spex-console/templates/abridged/specs/protocols/session-close-protocol.md",
+    dest: "specs/protocols/session-close-protocol.md"
+  },
+  {
+    platformSource: "specs/protocols/spec-summary-authoring.md",
+    dest: "specs/protocols/spec-summary-authoring.md",
+    dropSections: ["Keeping the code snapshot in sync", "Change log"],
+    dropLinePatterns: ["vendor/heyspex-mcp/summary-contract\\.mjs"]
+  },
+  {
+    platformSource: "specs/protocols/destructive-action-checklist.md",
+    dest: "specs/protocols/destructive-action-checklist.md",
+    dropSections: ["Change log"],
+    dropLinePatterns: ["spex-console/scripts/validate-destructive-actions\\.mjs"],
+    replacements: [
+      [
+        "The 2026-05-22 idea-discard incident showed that strong UX *principles*\n([[errors-destructive-recovery]], [[reversible-user-actions]]) are not\nenough",
+        "A past idea-discard data-loss incident showed that strong UX *principles*\n(recoverable destructive actions, reversible user actions) are not\nenough"
+      ],
+      [
+        "Today: linked from `CLAUDE.md` Console pre-ship checklist; agents must\nwalk it",
+        "Today: agents must\nwalk it"
+      ],
+      [
+        '- [ ] If a *new* destructive surface is introduced, append it to the\n      "Where this is applied" table in\n      [[destructive-action-needs-explicit-button-and-undo]].',
+        "- [ ] If a *new* destructive surface is introduced, record it in a vault memory."
+      ],
+      [
+        "- [ ] Read [[errors-destructive-recovery]] and\n      [[destructive-action-needs-explicit-button-and-undo]] in full.",
+        "- [ ] Read any vault memories on destructive-action recovery and Undo."
+      ],
+      [
+        " (Not covered here; see existing dirty-editor\n      pattern in `specs-surface.tsx`.)",
+        " (Not covered here.)"
+      ]
+    ]
   }
 ];
 
 // dist/cli/._template-manifest-sources.cli-shim.mjs
 var CURATED_TEMPLATE_ROOT = "dist/cli-templates/customer-vault";
 
+// scripts/lib/template-pin.mjs
+var TEMPLATE_VERSION = "1.1.0";
+var TEMPLATE_CORE_DESTS = Object.freeze([
+  "specs/north-star.md",
+  "specs/principles-index.md",
+  "specs/roadmap.md",
+  "specs/entity-model.md",
+  "specs/protocols/canonical-frontmatter-templates.md",
+  "specs/protocols/spec-hierarchy.md",
+  "specs/protocols/memory-protocol.md",
+  "specs/protocols/session-close-protocol.md",
+  "specs/protocols/spec-summary-authoring.md",
+  "specs/protocols/destructive-action-checklist.md"
+]);
+
 // spex-console/src/lib/cli/template-manifest.ts
-var TEMPLATE_VERSION = "1.0.0";
 var TODO_NORTH_STAR = `---
 id: HS-L1
 name: TODO \u2014 your product name
@@ -804,7 +2043,7 @@ var TEMPLATE_MANIFEST = [
 ];
 
 // spex-console/src/lib/cli/init.customer-vault.ts
-var DEFAULT_CONSOLE_URL3 = "https://console.heyspex.local";
+var DEFAULT_CONSOLE_URL2 = "https://console.heyspex.local";
 var SCAFFOLD_FOLDERS = [
   "tasks",
   "epics",
@@ -821,23 +2060,63 @@ var SCAFFOLD_FOLDERS = [
   "checks",
   "events"
 ];
+var PLACEHOLDER_FILES = /* @__PURE__ */ new Set([".gitkeep"]);
+function isDir(deps, path5, name) {
+  if (deps.isDirectory) return deps.isDirectory(path5);
+  try {
+    const kids = deps.readdir(path5);
+    return kids.length > 0 || !name.includes(".");
+  } catch {
+    return false;
+  }
+}
+function findManagedSpecs(deps, targetDir, manifestDests) {
+  const out = [];
+  const walk = (abs, rel) => {
+    for (const name of deps.readdir(abs)) {
+      const childAbs = deps.joinPath(abs, name);
+      const childRel = `${rel}/${name}`;
+      if (isDir(deps, childAbs, name)) walk(childAbs, childRel);
+      else if (!PLACEHOLDER_FILES.has(name) && name.endsWith(".md") && !manifestDests.has(childRel))
+        out.push(childRel);
+    }
+  };
+  const specsRoot = deps.joinPath(targetDir, "specs");
+  if (deps.exists(specsRoot)) walk(specsRoot, "specs");
+  return out;
+}
 function defaultVaultName(targetDir) {
-  return basename(targetDir) || targetDir;
+  return basename2(targetDir) || targetDir;
 }
-function runCustomerVaultInit(args, deps, options = {}) {
+function runCustomerVaultInit(args, deps, options2 = {}) {
   const { targetDir } = args;
   const written = [];
+  const filter = options2.manifestFilter ?? (() => true);
+  const rows = TEMPLATE_MANIFEST.filter(filter);
   if (deps.exists(targetDir)) {
-    const entries = deps.readdir(targetDir);
-    if (entries.length > 0) {
+    const markerPresent = deps.exists(deps.joinPath(targetDir, "heyspex.yaml"));
+    if (!markerPresent && deps.readdir(targetDir).length > 0) {
       return {
         code: EXIT.INVALID_ARG,
-        message: `${targetDir} is not empty \u2014 customer-vault init refuses to write into an existing, non-empty directory.`,
+        message: `${targetDir} is not empty \u2014 customer-vault init refuses to write into an existing, non-empty directory that has no heyspex.yaml.`,
         payload: { ok: false, error: "target_not_empty", path: targetDir },
         isError: true,
         written: []
       };
     }
+    if (markerPresent) {
+      const manifestDests = new Set(TEMPLATE_MANIFEST.map((r) => r.dest));
+      const managed = findManagedSpecs(deps, targetDir, manifestDests);
+      if (managed.length > 0) {
+        return {
+          code: EXIT.INVALID_ARG,
+          message: `${targetDir}/specs already holds managed spec(s) (${managed.slice(0, 3).join(", ")}${managed.length > 3 ? ", ..." : ""}) \u2014 customer-vault init refuses to write over an existing vault.`,
+          payload: { ok: false, error: "specs_not_empty", path: targetDir, specs: managed },
+          isError: true,
+          written: []
+        };
+      }
+    }
   } else {
     deps.mkdirRecursive(targetDir);
   }
@@ -846,19 +2125,37 @@ function runCustomerVaultInit(args, deps, options = {}) {
   for (const folder of SCAFFOLD_FOLDERS) {
     deps.mkdirRecursive(deps.joinPath(specsRoot, folder));
   }
-  const vaultId = mintVaultId();
-  const yamlContent = renderHeyspexYaml({
-    consoleUrl: options.consoleUrl ?? DEFAULT_CONSOLE_URL3,
-    vaultRoot: "specs/",
-    vaultId
-  });
   const heyspexYamlPath = deps.joinPath(targetDir, "heyspex.yaml");
-  deps.writeFile(heyspexYamlPath, yamlContent);
-  written.push(heyspexYamlPath);
-  const filter = options.manifestFilter ?? (() => true);
-  const rows = TEMPLATE_MANIFEST.filter(filter);
+  let vaultId;
+  if (deps.exists(heyspexYamlPath)) {
+    const existingYaml = deps.readFile?.(heyspexYamlPath) ?? null;
+    vaultId = (existingYaml ? parseVaultId(existingYaml) : null) ?? "";
+  } else {
+    vaultId = mintVaultId();
+    deps.writeFile(
+      heyspexYamlPath,
+      renderHeyspexYaml({
+        consoleUrl: options2.consoleUrl ?? DEFAULT_CONSOLE_URL2,
+        vaultRoot: "specs/",
+        vaultId
+      })
+    );
+    written.push(heyspexYamlPath);
+  }
+  const readConfigSeed2 = deps.readConfigSeed;
+  const configSeed = seedConfigYaml(
+    targetDir,
+    readConfigSeed2 ? () => readConfigSeed2.call(deps) : void 0,
+    deps
+  );
+  if (configSeed.status === "seeded") written.push(configSeed.path);
+  const rowResults = [];
   for (const row of rows) {
     const destAbs = deps.joinPath(targetDir, ...row.dest.split("/"));
+    if (deps.exists(destAbs)) {
+      rowResults.push({ dest: row.dest, action: "kept" });
+      continue;
+    }
     if (row.classification === "universal-template") {
       const srcAbs = deps.joinPath(deps.platformRoot, ...row.source.split("/"));
       deps.copyFile(srcAbs, destAbs);
@@ -871,29 +2168,36 @@ function runCustomerVaultInit(args, deps, options = {}) {
       deps.writeFile(destAbs, row.content);
     }
     written.push(destAbs);
+    rowResults.push({ dest: row.dest, action: "created" });
   }
-  if (options.afterScaffold && options.afterScaffold.length > 0) {
+  if (options2.afterScaffold && options2.afterScaffold.length > 0) {
     const ctx = {
       targetDir,
-      vaultName: options.vaultName ?? defaultVaultName(targetDir),
+      vaultName: options2.vaultName ?? defaultVaultName(targetDir),
       templateVersion: TEMPLATE_VERSION,
       manifestRows: rows,
+      rows: rowResults,
       deps,
-      recordWrite: (path) => {
-        written.push(path);
+      recordWrite: (path5) => {
+        written.push(path5);
       }
     };
-    for (const hook of options.afterScaffold) hook(ctx);
+    for (const hook of options2.afterScaffold) hook(ctx);
   }
+  const createdCount = rowResults.filter((r) => r.action === "created").length;
+  const keptCount = rowResults.length - createdCount;
   return {
     code: EXIT.OK,
-    message: `Initialized customer vault at ${targetDir} (${written.length} files written, template v${TEMPLATE_VERSION}).`,
+    message: `Initialized customer vault at ${targetDir} (${written.length} files written, ${createdCount} manifest rows created, ${keptCount} kept, template v${TEMPLATE_VERSION}).`,
     payload: {
       ok: true,
       targetDir,
       templateVersion: TEMPLATE_VERSION,
       vaultId,
-      written
+      written,
+      rows: rowResults,
+      created: createdCount,
+      kept: keptCount
     },
     isError: false,
     written
@@ -902,7 +2206,6 @@ function runCustomerVaultInit(args, deps, options = {}) {
 
 // spex-console/src/lib/cli/init-git-finalize.ts
 import { spawnSync } from "node:child_process";
-import { readFileSync as readFileSync3 } from "node:fs";
 var nodeGitRunner = {
   run(args, cwd) {
     const result = spawnSync("git", args, { cwd, encoding: "utf8" });
@@ -929,14 +2232,19 @@ function ensureTemplateVersionLine(content, version) {
 template_version: ${version}
 `;
 }
+function templatePinHook() {
+  return (ctx) => {
+    const yamlPath = ctx.deps.joinPath(ctx.targetDir, "heyspex.yaml");
+    const existingYaml = ctx.deps.readFile?.(yamlPath);
+    if (existingYaml === null || existingYaml === void 0) return;
+    if (readTemplateVersion(existingYaml) === ctx.templateVersion) return;
+    ctx.deps.writeFile(yamlPath, ensureTemplateVersionLine(existingYaml, ctx.templateVersion));
+    ctx.recordWrite(yamlPath);
+  };
+}
 function gitFinalizeHook(runner, notify) {
   return (ctx) => {
     const target = ctx.targetDir;
-    const yamlPath = ctx.deps.joinPath(target, "heyspex.yaml");
-    const existingYaml = readFileSync3(yamlPath, "utf8");
-    const updatedYaml = ensureTemplateVersionLine(existingYaml, ctx.templateVersion);
-    ctx.deps.writeFile(yamlPath, updatedYaml);
-    ctx.recordWrite(yamlPath);
     const probe = runner.run(["--version"], target);
     if (!probe.ok) {
       notify("git not found - vault left uninitialized, run git init yourself");
@@ -962,15 +2270,1102 @@ function gitFinalizeHook(runner, notify) {
   };
 }
 
+// spex-console/src/lib/cli/install.ts
+import { isAbsolute as isAbsolute3, resolve as resolveNodePath2 } from "node:path";
+
+// scripts/install-cursor-hooks.mjs
+import fs2 from "node:fs";
+import path3 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// scripts/cursor-hooks/manifest.mjs
+var SHIM = "scripts/cursor-hooks/_run.mjs";
+var DEFAULT_TIMEOUT_SECONDS = 5;
+var HOOKS = [
+  // ── Session start ───────────────────────────────────────────────────────
+  // Cursor's sessionStart honors `additional_context`, so these injections
+  // land in context exactly as they do in Claude Code.
+  { event: "sessionStart", hook: "wip-checkpoint", why: "Surface the previous session WIP handoff before work resumes." },
+  { event: "sessionStart", hook: "inject-dev-server-awareness", why: "Once-per-session reminder that dev-server status is a tool call, not a guess." },
+  { event: "sessionStart", hook: "inject-coo-seat", why: "Inject the dev-factory COO seat mandate when the COO window is open." },
+  { event: "sessionStart", hook: "inject-doctrine", why: "Inject the baseline SpexCode Doctrine edition at session start." },
+  { event: "sessionStart", hook: "coo-guard-check", why: "Warn at session start when a breakdown has not been delegated." },
+  { event: "sessionStart", hook: "check-auto-memory-budget", why: "Self-heal and budget-check the auto-memory index." },
+  { event: "sessionStart", hook: "check-claude-md-budget", why: "Advisory budget check on the always-loaded agent contract." },
+  { event: "sessionStart", hook: "check-mcp-freshness-hook", why: "Warn when the running MCP server is stale versus vendor." },
+  { event: "sessionStart", hook: "git-reflog-audit", why: "Session-start git audit (stash/reset/rebase witness)." },
+  { event: "sessionStart", hook: "vault-mirror-catchup", why: "Cloud write mode: detached hs pull --apply closes a stale disk mirror (HS-XJFQ)." },
+  // ── Compaction ──────────────────────────────────────────────────────────
+  // Claude re-runs SessionStart(source: compact) after compaction; Cursor fires
+  // preCompact BEFORE it, so the shim relays this one as SessionStart(compact)
+  // to keep wip-checkpoint's "rollover, not fresh start" framing.
+  { event: "preCompact", hook: "wip-checkpoint", claudeEvent: "SessionStart", why: "Carry the WIP handoff across a context compaction." },
+  // ── Every user turn ─────────────────────────────────────────────────────
+  // beforeSubmitPrompt is Cursor's UserPromptSubmit. It honors `user_message`
+  // but not `additional_context`, so these three surface in the transcript
+  // rather than as invisible context — the routing still reaches the agent,
+  // and the user can see why it fired.
+  { event: "beforeSubmitPrompt", hook: "preflight-reminder", why: "Name the required procedure before a filing/destructive/protocol turn." },
+  { event: "beforeSubmitPrompt", hook: "intent-classifier-trigger", why: "Route capture / research / settings / defer intents to the right skill." },
+  { event: "beforeSubmitPrompt", hook: "inject-communication-style", why: "Re-assert the plain-language communication rules each turn." },
+  { event: "beforeSubmitPrompt", hook: "inject-vault-context", timeout: 10, why: "Lexical vault retrieval for the prompt (surfaced as a user message)." },
+  // ── Before every tool call (any tool) ───────────────────────────────────
+  { event: "preToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PreToolUse"], why: "Claim liveness heartbeat to the console." },
+  { event: "preToolUse", matcher: ".*", hook: "coo-denylist-gate", why: "Hard deny the COO-window deny list." },
+  { event: "preToolUse", matcher: ".*", hook: "log-session-activity", args: ["--event=PreToolUse"], why: "Append agent.tool_called rows to the session log." },
+  // ── Before a file write / delete ─────────────────────────────────────────
+  // Cursor's `Write` covers create AND patch (Claude's Write|Edit|MultiEdit);
+  // the shim re-derives which one from the input shape. `Delete` is included on
+  // the vault guard because removing a profile file is the loss it exists to
+  // prevent, and Claude had no separate delete tool to list.
+  { event: "preToolUse", matcher: "Write|Delete", hook: "env-vault-guard", why: "Block destructive writes to the encrypted env vault (ALWAYS ON)." },
+  { event: "preToolUse", matcher: "Write", hook: "vault-write-tier-guard", why: "Deny disk writes to vault specs in cloud write mode (HS-FCNH)." },
+  { event: "preToolUse", matcher: "Write", hook: "settings-write-gate", why: "Require approval before .heyspex/config.yaml changes." },
+  { event: "preToolUse", matcher: "Write", hook: "enforce-vault-naming", why: "Block vault filenames that violate the naming registry." },
+  { event: "preToolUse", matcher: "Write", hook: "guard-auto-memory-writes", why: "Block new topic files in the auto-memory directory." },
+  { event: "preToolUse", matcher: "Write", hook: "preflight-reminder", why: "Preflight reminder on the edit path itself." },
+  { event: "preToolUse", matcher: "Write", hook: "claim-before-code-gate", why: "Deny the first code edit after plan exit with no claim." },
+  { event: "preToolUse", matcher: "Write", hook: "directive-obligation-gate", why: "Deny product-code writes while a capture_on_idea obligation is unmet, and (claim-before-build) with no claim/capture (HS-20SW)." },
+  // ── Before a shell command ──────────────────────────────────────────────
+  // beforeShellExecution, not preToolUse/Shell: it is the only event guaranteed
+  // to carry the command string, and Cursor honors allow/deny/ask on it.
+  { event: "beforeShellExecution", hook: "env-vault-guard", why: "Block shell writes/exfiltration targeting the env vault (ALWAYS ON)." },
+  { event: "beforeShellExecution", hook: "vault-write-tier-guard", why: "Deny shell writes to vault specs in cloud write mode (HS-FCNH)." },
+  { event: "beforeShellExecution", hook: "settings-write-gate", why: "Catch shell writes to .heyspex/config.yaml." },
+  { event: "beforeShellExecution", hook: "enforce-vault-naming", why: "Catch vault files created via the shell." },
+  { event: "beforeShellExecution", hook: "guard-auto-memory-writes", why: "Catch auto-memory topic files created via the shell." },
+  { event: "beforeShellExecution", hook: "preflight-reminder", why: "Preflight reminder on rm -rf / force-push shaped commands." },
+  { event: "beforeShellExecution", hook: "dev-server-task-reminder", timeout: 10, why: "Dev-server start/stop hard gate plus DB-safety reminder." },
+  { event: "beforeShellExecution", hook: "git-stash-gate", timeout: 10, why: "Always ask before a mutating git stash." },
+  { event: "beforeShellExecution", hook: "git-identity-guard", why: "Agents never write git identity (owner ruling 2026-09-19, ALWAYS ON)." },
+  { event: "beforeShellExecution", hook: "capture-execution-gate", why: "Block dev-factory research/paid-model/routing shell commands past an ungrounded capture (HS-KNJ8, platform)." },
+  { event: "beforeShellExecution", hook: "directive-obligation-gate", why: "Deny build commands and product-code shell writes while a capture obligation is unmet (HS-20SW)." },
+  // ── Before specific MCP tools ───────────────────────────────────────────
+  // Cursor fires preToolUse for MCP tools too (matcher `MCP:<name>`), so these
+  // stay on preToolUse rather than beforeMCPExecution — registering both would
+  // fire each gate twice. Scoping is the shim's `tool` regex because a Cursor
+  // matcher cannot name one MCP tool per entry portably.
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_claim_spec$", hook: "coo-guard-check", why: "Block a claim whose breakdown was never delegated." },
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_file_spec$", hook: "capture-workflow-gate", timeout: 8, why: "Deny filing an implementation spec straight out of an open capture." },
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_settings_set$", hook: "settings-write-gate", why: "Require approval for settings changes made through MCP." },
+  { event: "preToolUse", matcher: ".*", tool: "[Nn]eon__(prepare_database_migration|complete_database_migration|reset_from_parent|delete_branch)$", hook: "dev-server-task-reminder", timeout: 10, why: "DB-safety gate on Neon migration/reset/delete tools." },
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_file_spec$", hook: "diagnose-capture-reminder", why: "Warn when a diagnose is filed with no capture holding the owner words (HS-IK2D)." },
+  { event: "preToolUse", matcher: ".*", tool: "^(Workflow|Skill)$", hook: "research-method-guard", why: "Research method guard on Skill/Workflow launches (HS-EN4F, ALWAYS ON)." },
+  { event: "preToolUse", matcher: ".*", tool: "^(Workflow|Skill)$", hook: "deep-research-cost-gate", why: "Cost confirmation before a paid deep-research harness launch." },
+  { event: "preToolUse", matcher: ".*", tool: "^(WebSearch|WebFetch|web_search|web_fetch)$|heyspex_save_research$", hook: "research-protocol-gate", why: "WebSearch/WebFetch/save_research refused until the research preflight ran (HS-K0ZP, HS-EN4F)." },
+  // ── Before a subagent spawn ─────────────────────────────────────────────
+  // subagentStart over preToolUse/Task: it carries subagent_type and the model,
+  // which is exactly what the routing gate decides on, and it can deny.
+  { event: "subagentStart", hook: "agent-spawn-delegation-gate", why: "Block a build/breakdown/critic subagent on an off-routing model." },
+  { event: "subagentStart", hook: "capture-execution-gate", why: "Block a dev-factory subagent spawn past an ungrounded capture (HS-KNJ8, platform)." },
+  { event: "subagentStart", hook: "directive-obligation-gate", why: "Deny a build subagent while a capture obligation is unmet or the session has no claim/capture (HS-20SW)." },
+  // ── After every tool call ───────────────────────────────────────────────
+  { event: "postToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PostToolUse"], why: "Claim liveness heartbeat after the call resolves." },
+  { event: "postToolUse", matcher: ".*", hook: "log-session-activity", args: ["--event=PostToolUse"], why: "Append the tool result row to the session log." },
+  { event: "postToolUse", matcher: ".*", hook: "directive-obligation-gate", why: "Discharge the capture obligation on a capture write; track claim acquire/release (HS-20SW)." },
+  { event: "postToolUse", matcher: ".*", hook: "close-terminal-on-ship", why: "Close the Launch terminal once the spec ships." },
+  { event: "postToolUse", matcher: "Write", hook: "notify-status-flip", why: "Sound on an in_review status flip." },
+  { event: "postToolUse", matcher: "Write", hook: "scripts/stamp-provenance-on-edit.mjs", why: "Stamp assisted_by provenance on direct spec edits." },
+  // afterFileEdit is a distinct signal, not a duplicate: it reports the edit
+  // that actually landed (with old/new strings) even when the write came from a
+  // path postToolUse did not describe as an edit.
+  { event: "afterFileEdit", matcher: ".*", hook: "close-terminal-on-ship", why: "Ship detection from the concrete file edit." },
+  // ── End of the agent turn ───────────────────────────────────────────────
+  // Cursor's `stop` honors `followup_message`, which is how a blocking Stop
+  // hook re-drives the agent — the same effect as Claude's exit-2 block.
+  { event: "stop", hook: "emit-claim-status", args: ["--event=Stop"], why: "Mark the claim pending-on-response." },
+  { event: "stop", hook: "naughty-list-gate", why: "Re-drive the turn when the final message uses banned jargon." },
+  { event: "stop", hook: "id-display-format-gate", why: "Re-drive the turn when a reply breaks the Naming V3 display-id format." },
+  { event: "stop", hook: "epic-milestone-phrasing-gate", why: "Re-drive the turn when a reply breaks the epic/milestone phrasing rules." },
+  { event: "stop", hook: "git-reflog-audit", why: "Session-close git audit backstop (stash/reset/rebase witness)." },
+  { event: "stop", hook: "enforce-session-sequence", why: "Re-drive the turn when work shipped without record_wip." },
+  { event: "stop", hook: "directive-obligation-gate", why: "Re-drive the turn ONCE (followup_message) when a capture obligation is still unmet (HS-20SW)." },
+  // ── Session end ─────────────────────────────────────────────────────────
+  { event: "sessionEnd", hook: "session-end", why: "Release the claim and notify the console." },
+  { event: "sessionEnd", hook: "close-terminal-on-ship", why: "Final terminal cleanup." }
+];
+var UNPORTABLE = [
+  {
+    hook: "plan-review-gate",
+    claudeEvent: "PreToolUse/ExitPlanMode",
+    reason: "Cursor exposes no ExitPlanMode tool call to hooks.",
+    coveredBy: ".cursor/rules/plan-review-required.mdc (always-on rule)"
+  },
+  {
+    hook: "plan-exit-ingest-gate",
+    claudeEvent: "PreToolUse/ExitPlanMode",
+    reason: "Same missing trigger; it is also what arms claim-before-code-gate.",
+    coveredBy: ".cursor/rules/plan-review-required.mdc + spec-creation-linkage.mdc"
+  }
+];
+function commandFor(entry) {
+  const parts = ["node", SHIM, entry.hook];
+  if (entry.tool) parts.push(`--hs-tool="${entry.tool}"`);
+  if (entry.claudeEvent) parts.push(`--hs-claude-event=${entry.claudeEvent}`);
+  for (const arg of entry.args ?? []) parts.push(arg);
+  return parts.join(" ");
+}
+function commandForPlugin(entry) {
+  return commandFor(entry).replace(`node ${SHIM}`, `node "$CURSOR_PROJECT_DIR/${SHIM}"`);
+}
+var CUSTOMER_LAUNCHER = ".cursor/heyspex/run-hook.mjs";
+function commandForCustomer(entry) {
+  return commandFor(entry).replace(`node ${SHIM}`, `node "$CURSOR_PROJECT_DIR/${CUSTOMER_LAUNCHER}"`);
+}
+function identityFor(entry) {
+  return `${entry.hook}::${entry.tool ?? ""}::${(entry.args ?? []).join(" ")}`;
+}
+function timeoutFor(entry) {
+  return entry.timeout ?? DEFAULT_TIMEOUT_SECONDS;
+}
+
+// scripts/lib/customer-kit.mjs
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path2 from "node:path";
+import os2 from "node:os";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+
+// scripts/lib/hook-dispositions.mjs
+var HOSTS = Object.freeze(["claude-code", "cursor", "copilot"]);
+var DISPOSITIONS = Object.freeze(["mapped", "advisory-degraded", "unportable", "not-shipped"]);
+var mapped = (note) => Object.freeze({ disposition: "mapped", ...note ? { note } : {} });
+var degraded = (note) => Object.freeze({ disposition: "advisory-degraded", note });
+var unportable = (control) => Object.freeze({ disposition: "unportable", control });
+var notShipped = Object.freeze({ disposition: "not-shipped" });
+var CC = mapped();
+var COPILOT_PROMPT_DROPPED = "Copilot drops command-hook output on userPromptSubmitted (no prompt-time context channel); the text moves to sessionStart / .github/copilot-instructions.md.";
+var CURSOR_PROMPT_USER_MESSAGE = "Cursor beforeSubmitPrompt honors user_message only (no additional_context): the text surfaces in the transcript instead of as invisible context.";
+var COPILOT_NO_PLAN_TOOL = "MCP preflight refusals (heyspex_claim_spec / heyspex_submit_for_review / heyspex_save_research) + .github/copilot-instructions.md plan rule (state the plan in chat, claim the spec before editing) + HS-20SW directive-obligation-gate claim-before-build deny";
+var HOOK_DISPOSITIONS = Object.freeze({
+  // ── customer: session start / compaction ──────────────────────────────────
+  "wip-checkpoint": {
+    "claude-code": CC,
+    cursor: mapped("preCompact is relayed as SessionStart(compact)."),
+    copilot: mapped("sessionStart additionalContext is delivered; the preCompact leg writes WIP only (no output channel), re-injected at the next sessionStart.")
+  },
+  "inject-doctrine": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext.") },
+  "check-auto-memory-budget": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext.") },
+  "check-claude-md-budget": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext.") },
+  "git-reflog-audit": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext and agentStop.") },
+  "vault-mirror-catchup": { "claude-code": CC, cursor: mapped(), copilot: mapped("Detached side effect on sessionStart.") },
+  // ── customer: every user turn ─────────────────────────────────────────────
+  "preflight-reminder": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(`${COPILOT_PROMPT_DROPPED} Real enforcement is the MCP preflight refusal.`)
+  },
+  "intent-classifier-trigger": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(
+      `${COPILOT_PROMPT_DROPPED} The hook still runs and arms obligation state; the HS-20SW directive-obligation-gate turns that state into a hard deny.`
+    )
+  },
+  "inject-communication-style": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(COPILOT_PROMPT_DROPPED)
+  },
+  "inject-vault-context": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(`${COPILOT_PROMPT_DROPPED} Per-prompt vault retrieval has no Copilot channel at all.`)
+  },
+  // ── customer: before a tool call (hard gates) ─────────────────────────────
+  "git-identity-guard": { "claude-code": CC, cursor: mapped("beforeShellExecution. Always on."), copilot: mapped("preToolUse on bash/powershell. Always on.") },
+  "vault-write-tier-guard": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/edit/bash/powershell.") },
+  "settings-write-gate": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/edit/bash/powershell and the MCP settings tool.") },
+  "emit-claim-status": { "claude-code": CC, cursor: mapped(), copilot: mapped("Telemetry on preToolUse/postToolUse/agentStop; the cloud agent needs a network allow rule for the console.") },
+  "enforce-vault-naming": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/bash/powershell.") },
+  "guard-auto-memory-writes": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/bash/powershell.") },
+  "directive-obligation-gate": {
+    "claude-code": CC,
+    cursor: mapped(),
+    copilot: mapped("HS-20SW: hard deny on task/create/edit/write-shaped shell while a capture obligation is unmet; the only hard capture-on-idea guarantee on Copilot.")
+  },
+  "claim-before-code-gate": {
+    "claude-code": CC,
+    cursor: degraded("Armed only by plan-exit-ingest-gate, which has no Cursor trigger, so it stays dormant; covered by the HS-20SW claim-before-build rule."),
+    copilot: degraded("Armed only by plan-exit-ingest-gate, which has no Copilot trigger (no ExitPlanMode tool), so it stays dormant; covered by the HS-20SW claim-before-build rule.")
+  },
+  "capture-workflow-gate": {
+    "claude-code": CC,
+    cursor: mapped(),
+    copilot: mapped("preToolUse on the MCP heyspex_file_spec tool; MCP tool naming in hook payloads is unverified live (matched by suffix).")
+  },
+  "diagnose-capture-reminder": {
+    "claude-code": CC,
+    cursor: mapped("preToolUse agent_message delivers the reminder."),
+    copilot: degraded("Copilot preToolUse has no context channel for an inject, so this advisory is silent (lost).")
+  },
+  "git-stash-gate": {
+    "claude-code": CC,
+    cursor: mapped(),
+    copilot: mapped('The Claude "ask" becomes a deny where no user is present (cloud agent, CLI autopilot).')
+  },
+  "research-protocol-gate": { "claude-code": CC, cursor: mapped("Always on."), copilot: mapped("preToolUse on web_fetch/web_search and the MCP save_research tool. Always on; the MCP refusal duplicates it.") },
+  "research-method-guard": {
+    "claude-code": CC,
+    cursor: mapped("preToolUse with a Skill|Workflow tool filter. Always on."),
+    copilot: unportable("MCP preflight refusal on heyspex_save_research (hard floor, hook-independent) + .github/copilot-instructions.md research rule; Copilot has no Skill or Workflow tool to hook.")
+  },
+  "deep-research-cost-gate": {
+    "claude-code": CC,
+    cursor: mapped("preToolUse with a Workflow|Skill tool filter."),
+    copilot: unportable("MCP preflight refusal on heyspex_save_research + .github/copilot-instructions.md cost-confirmation rule; Copilot has no Skill or Workflow tool to hook.")
+  },
+  "plan-review-gate": {
+    "claude-code": CC,
+    cursor: unportable(".cursor/rules/plan-review-required.mdc (always-on rule)"),
+    copilot: unportable(COPILOT_NO_PLAN_TOOL)
+  },
+  "plan-exit-ingest-gate": {
+    "claude-code": CC,
+    cursor: unportable(".cursor/rules/plan-review-required.mdc + spec-creation-linkage.mdc"),
+    copilot: unportable(COPILOT_NO_PLAN_TOOL)
+  },
+  // ── customer: end of turn / session ───────────────────────────────────────
+  "naughty-list-gate": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped('agentStop {decision:"block"} re-drive, capped at 8 consecutive blocks.') },
+  "id-display-format-gate": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped("agentStop re-drive; reads the transcript (format is not a stable API).") },
+  "epic-milestone-phrasing-gate": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped("agentStop re-drive; reads the transcript (format is not a stable API).") },
+  "enforce-session-sequence": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped("agentStop re-drive, capped at 8 consecutive blocks.") },
+  "notify-status-flip": { "claude-code": CC, cursor: mapped(), copilot: mapped("Side effect on postToolUse.") },
+  "close-terminal-on-ship": { "claude-code": CC, cursor: mapped(), copilot: mapped("Side effect on postToolUse / sessionEnd.") },
+  "scripts/stamp-provenance-on-edit.mjs": { "claude-code": CC, cursor: mapped(), copilot: mapped("Side effect on postToolUse.") },
+  "session-end": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionEnd.") },
+  // ── platform: heyspex-app development machinery (never installed in a customer repo) ──
+  "inject-dev-server-awareness": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "inject-coo-seat": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "coo-guard-check": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "coo-denylist-gate": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "agent-spawn-delegation-gate": { "claude-code": CC, cursor: mapped("subagentStart."), copilot: notShipped },
+  "capture-execution-gate": { "claude-code": CC, cursor: mapped("beforeShellExecution + subagentStart."), copilot: notShipped },
+  "check-mcp-freshness-hook": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "dev-server-task-reminder": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "env-vault-guard": { "claude-code": CC, cursor: mapped("Always on."), copilot: notShipped },
+  "log-session-activity": { "claude-code": CC, cursor: mapped(), copilot: notShipped }
+});
+function dispositionFor(hook, host) {
+  return HOOK_DISPOSITIONS[hook]?.[host] ?? null;
+}
+
+// scripts/lib/customer-kit.mjs
+var HOOK_SCOPES = Object.freeze({
+  // ── customer: vault / workflow / safety gates ─────────────────────────────
+  "wip-checkpoint": { scope: "customer", why: "Previous-session WIP handoff, read from the active vault." },
+  "inject-doctrine": {
+    scope: "customer",
+    why: "Owner ruling 2026-10-03 (HS-A2PO): ships. A customer session gets the baseline edition of SpexCode Doctrine (CUSTOMER_HOOK_DATA), the foundation its own learned layer is built on; never the platform's learned file."
+  },
+  "check-auto-memory-budget": { scope: "customer", why: "Auto-memory index budget for the session project." },
+  "check-claude-md-budget": { scope: "customer", why: "Budget check on the project's always-loaded agent contract." },
+  "git-reflog-audit": { scope: "customer", why: "Session-close git audit backstop (stash/reset/rebase witness)." },
+  "preflight-reminder": { scope: "customer", why: "Names the required procedure before filing/destructive turns." },
+  "intent-classifier-trigger": { scope: "customer", why: "Routes capture/research/settings/defer intents." },
+  "inject-communication-style": { scope: "customer", why: "Plain-language communication rules each turn." },
+  "inject-vault-context": { scope: "customer", why: "Lexical vault retrieval for the prompt." },
+  "git-identity-guard": { scope: "customer", why: "Agents never write git identity (owner ruling 2026-09-19)." },
+  "vault-write-tier-guard": { scope: "customer", why: "Cloud write mode: disk edits to vault specs are a mirror the console never reads back (HS-FCNH)." },
+  "settings-write-gate": { scope: "customer", why: "Approval before the vault's .heyspex/config.yaml changes." },
+  "emit-claim-status": { scope: "customer", why: "Claim liveness heartbeat to the console." },
+  "enforce-vault-naming": { scope: "customer", why: "Naming V3 filename guard (HS-RY2N)." },
+  "guard-auto-memory-writes": { scope: "customer", why: "No new topic files in the auto-memory directory." },
+  "plan-review-gate": { scope: "customer", why: "Plan review + QC markers before ExitPlanMode." },
+  "plan-exit-ingest-gate": { scope: "customer", why: "Plan ingest on ExitPlanMode; arms claim-before-code." },
+  "claim-before-code-gate": { scope: "customer", why: "First code edit after plan exit needs a claim." },
+  "directive-obligation-gate": { scope: "customer", why: "A capture_on_idea directive leaves a durable obligation; an unmet one denies sub-agent spawns, product-code writes and builds, and re-drives Stop once. Also claim-before-build (HS-20SW)." },
+  "capture-workflow-gate": { scope: "customer", why: "No implementation spec straight out of an open capture." },
+  "vault-mirror-catchup": { scope: "customer", why: "Cloud write mode: a SessionStart detached `hs pull --apply` closes a stale disk mirror before the first tool call (HS-XJFQ)." },
+  "diagnose-capture-reminder": { scope: "customer", why: "Warn when a diagnose is filed with no capture holding the owner's words (HS-IK2D)." },
+  "git-stash-gate": { scope: "customer", why: "Always ask before a mutating git stash." },
+  "research-method-guard": { scope: "customer", why: "Research method guard (HS-EN4F)." },
+  "deep-research-cost-gate": { scope: "customer", why: "Cost confirmation before a paid deep-research launch." },
+  "research-protocol-gate": { scope: "customer", why: "WebSearch/WebFetch refused until research preflight ran (HS-K0ZP, HS-EN4F)." },
+  "naughty-list-gate": { scope: "customer", why: "Re-drive a final message that uses banned jargon." },
+  "id-display-format-gate": { scope: "customer", why: "Naming V3 display-id format in replies." },
+  "epic-milestone-phrasing-gate": { scope: "customer", why: "Epic/milestone phrasing rules in replies." },
+  "enforce-session-sequence": { scope: "customer", why: "Re-drive a turn that shipped without record_wip." },
+  "notify-status-flip": { scope: "customer", why: "Sound on an in_review status flip." },
+  "close-terminal-on-ship": { scope: "customer", why: "Close the launch terminal once the spec ships." },
+  "scripts/stamp-provenance-on-edit.mjs": { scope: "customer", why: "Stamp assisted_by provenance on direct spec edits (active vault)." },
+  "session-end": { scope: "customer", why: "Release the claim and export session events." },
+  // ── platform: heyspex-app's own development machinery ─────────────────────
+  "inject-dev-server-awareness": { scope: "platform", why: "About the spex-console dev server in heyspex-app." },
+  "inject-coo-seat": { scope: "platform", why: "dev-factory COO seat mandate." },
+  "coo-guard-check": { scope: "platform", why: "dev-factory breakdown-delegation guard." },
+  "coo-denylist-gate": { scope: "platform", why: "dev-factory COO window deny list." },
+  "agent-spawn-delegation-gate": { scope: "platform", why: "dev-factory seat routing for subagents." },
+  "capture-execution-gate": { scope: "platform", why: "Blocks dev-factory research/paid-model/routing surfaces past an ungrounded capture (HS-KNJ8)." },
+  "check-mcp-freshness-hook": { scope: "platform", why: "Freshness of the vendored MCP build \u2014 a platform-dev concern." },
+  "dev-server-task-reminder": { scope: "platform", why: "spex-console dev server + Neon DB safety." },
+  "env-vault-guard": { scope: "platform", why: "Guards heyspex-app's encrypted env vault paths." },
+  "log-session-activity": { scope: "platform", why: "Resolves .heyspex state from the platform checkout's own location, not the project \u2014 would log customer sessions into heyspex-app." }
+});
+var CUSTOMER_HOOK_DATA = Object.freeze({
+  "inject-doctrine": Object.freeze(["spexharness/doctrine/baseline/SPEXCODE-DOCTRINE.baseline.json"])
+});
+var CLAUDE_HOOK_ROWS = Object.freeze([
+  { event: "SessionStart", hook: "wip-checkpoint", timeout: 5 },
+  { event: "SessionStart", hook: "inject-dev-server-awareness", timeout: 5 },
+  { event: "SessionStart", hook: "inject-coo-seat", timeout: 5 },
+  { event: "SessionStart", hook: "inject-doctrine", timeout: 5 },
+  { event: "SessionStart", hook: "coo-guard-check", timeout: 5 },
+  { event: "SessionStart", hook: "check-auto-memory-budget", timeout: 5 },
+  { event: "SessionStart", hook: "check-claude-md-budget", timeout: 5 },
+  { event: "SessionStart", hook: "check-mcp-freshness-hook", timeout: 5 },
+  { event: "SessionStart", hook: "git-reflog-audit", timeout: 5 },
+  { event: "SessionStart", hook: "vault-mirror-catchup", timeout: 5 },
+  { event: "PreCompact", hook: "wip-checkpoint", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "preflight-reminder", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "intent-classifier-trigger", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "inject-communication-style", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "inject-vault-context", timeout: 10 },
+  { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash|PowerShell", hook: "env-vault-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell", hook: "git-identity-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash|PowerShell", hook: "vault-write-tier-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|Edit|NotebookEdit|Bash|PowerShell|mcp__heyspex__heyspex_settings_set", hook: "settings-write-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PreToolUse"], timeout: 5 },
+  { event: "PreToolUse", matcher: ".*", hook: "coo-denylist-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Agent|Task", hook: "agent-spawn-delegation-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell|Agent|Task", hook: "capture-execution-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Agent|Task|Edit|Write|MultiEdit|NotebookEdit|Bash|PowerShell", hook: "directive-obligation-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "mcp__heyspex__heyspex_claim_spec", hook: "coo-guard-check", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|NotebookEdit|Bash|PowerShell", hook: "enforce-vault-naming", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|NotebookEdit|Bash|PowerShell", hook: "guard-auto-memory-writes", timeout: 5 },
+  { event: "PreToolUse", matcher: "Edit|MultiEdit|Write|Bash|PowerShell", hook: "preflight-reminder", timeout: 5 },
+  { event: "PreToolUse", matcher: "ExitPlanMode", hook: "plan-review-gate", timeout: 8 },
+  { event: "PreToolUse", matcher: "ExitPlanMode", hook: "plan-exit-ingest-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Edit|MultiEdit|Write", hook: "claim-before-code-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "mcp__heyspex__heyspex_file_spec", hook: "capture-workflow-gate", timeout: 8 },
+  { event: "PreToolUse", matcher: "mcp__heyspex__heyspex_file_spec", hook: "diagnose-capture-reminder", timeout: 5 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell|mcp__neon__prepare_database_migration|mcp__neon__complete_database_migration|mcp__neon__reset_from_parent|mcp__neon__delete_branch|mcp__Neon__prepare_database_migration|mcp__Neon__complete_database_migration|mcp__Neon__reset_from_parent|mcp__Neon__delete_branch", hook: "dev-server-task-reminder", timeout: 10 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell", hook: "git-stash-gate", timeout: 10 },
+  { event: "PreToolUse", matcher: "Skill|Workflow", hook: "research-method-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Workflow|Skill", hook: "deep-research-cost-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "WebSearch|WebFetch|mcp__heyspex__heyspex_save_research|mcp__plugin_heyspex_heyspex__heyspex_save_research", hook: "research-protocol-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: ".*", hook: "log-session-activity", timeout: 5 },
+  { event: "Stop", hook: "emit-claim-status", args: ["--event=Stop"], timeout: 5 },
+  { event: "Stop", hook: "naughty-list-gate", timeout: 5 },
+  { event: "Stop", hook: "id-display-format-gate", timeout: 5 },
+  { event: "Stop", hook: "epic-milestone-phrasing-gate", timeout: 5 },
+  { event: "Stop", hook: "git-reflog-audit", timeout: 5 },
+  { event: "Stop", hook: "enforce-session-sequence", timeout: 5 },
+  { event: "Stop", hook: "directive-obligation-gate", timeout: 5 },
+  { event: "PostToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PostToolUse"], timeout: 5 },
+  { event: "PostToolUse", matcher: "Skill|mcp__heyspex__heyspex_update_capture|mcp__heyspex__heyspex_promote_capture.*|mcp__heyspex__heyspex_file_spec|mcp__heyspex__heyspex_claim_spec|mcp__heyspex__heyspex_release_spec|mcp__heyspex__heyspex_defer_spec", hook: "directive-obligation-gate", timeout: 5 },
+  { event: "PostToolUse", matcher: "Edit|Write|MultiEdit", hook: "notify-status-flip", timeout: 5 },
+  { event: "PostToolUse", matcher: "Edit|Write|MultiEdit", hook: "close-terminal-on-ship", timeout: 5 },
+  { event: "PostToolUse", matcher: "Edit|Write|MultiEdit", hook: "scripts/stamp-provenance-on-edit.mjs", timeout: 5 },
+  { event: "PostToolUse", matcher: ".*", hook: "log-session-activity", timeout: 5 },
+  { event: "SessionEnd", hook: "session-end", timeout: 5 },
+  { event: "SessionEnd", hook: "close-terminal-on-ship", timeout: 5 }
+]);
+var COMMAND_SCOPES = Object.freeze({
+  "hs-backfill.md": { scope: "customer", why: "Backfill completed work into the vault." },
+  "hs-capture.md": { scope: "customer", why: "Capture intake." },
+  "hs-defer.md": { scope: "customer", why: "Split + defer remaining work." },
+  "hs-doctor.md": { scope: "customer", why: "Install-surface repair when heyspex_* tools are missing." },
+  "hs-ground.md": { scope: "customer", why: "Pre-plan grounding report." },
+  "hs-handoff.md": { scope: "customer", why: "Short-code lane handoff." },
+  "hs-next.md": { scope: "customer", why: "On-deck prompt + claim handshake." },
+  "hs-promote.md": { scope: "customer", why: "Capture \u2192 research \u2192 milestone promotion." },
+  "hs-push.md": { scope: "customer", why: "Push an epic plan into the vault." },
+  "hs-qc.md": { scope: "customer", why: "Post-plan QC gate." },
+  "hs-res.md": { scope: "customer", why: "Research method entrypoint (SpexCrawl/DeepSeek)." },
+  "hs-resolve.md": { scope: "customer", why: "Resolution lane." },
+  "hs-review.md": { scope: "customer", why: "Review queue." },
+  "hs-view.md": { scope: "customer", why: "Open a console surface." },
+  "hs-auto.md": { scope: "platform", why: "Routes work into dev-factory (platform build system)." },
+  "hs-dev.md": { scope: "platform", why: "Admin/dev-only HeySpex dev/prod mode switch." },
+  "hs-log.md": { scope: "platform", why: "Admin/dev-only dev-server log watcher." },
+  "kill-ports.md": { scope: "platform", why: "Kills local dev-server ports." },
+  "prototype.md": { scope: "platform", why: "Console design-preview prototypes inside spex-console." }
+});
+function hookScope(hook) {
+  return HOOK_SCOPES[hook]?.scope ?? null;
+}
+function toPosixPath(p) {
+  return String(p).replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function samePlatformPath(a, b) {
+  if (!a || !b) return false;
+  const norm = (p) => {
+    const s = toPosixPath(path2.resolve(p));
+    return process.platform === "win32" ? s.toLowerCase() : s;
+  };
+  return norm(a) === norm(b);
+}
+var MCP_PROJECT_PREFIX = "mcp__heyspex__";
+var MCP_PLUGIN_PREFIX = "mcp__plugin_heyspex_heyspex__";
+function widenMcpMatcher(matcher) {
+  if (!matcher) return matcher;
+  const parts = matcher.split("|");
+  const out = [];
+  for (const part of parts) {
+    if (!out.includes(part)) out.push(part);
+    if (part.startsWith(MCP_PROJECT_PREFIX)) {
+      const plugin = MCP_PLUGIN_PREFIX + part.slice(MCP_PROJECT_PREFIX.length);
+      if (!parts.includes(plugin) && !out.includes(plugin)) out.push(plugin);
+    }
+  }
+  return out.join("|");
+}
+function customerHookRows() {
+  return CLAUDE_HOOK_ROWS.filter((r) => hookScope(r.hook) === "customer");
+}
+function hookTail(row) {
+  return [row.hook, ...row.args ?? []].join(" ");
+}
+var CLAUDE_HOOK_SHIM = "scripts/claude-hooks/_run.mjs";
+var CURSOR_HOOK_SHIM = "scripts/cursor-hooks/_run.mjs";
+var CUSTOMER_LAUNCHERS = Object.freeze({
+  claude: Object.freeze({
+    rel: Object.freeze([".claude", "heyspex", "run-hook.mjs"]),
+    projectDirEnv: "CLAUDE_PROJECT_DIR",
+    shim: CLAUDE_HOOK_SHIM,
+    registry: ".claude/settings.json"
+  }),
+  cursor: Object.freeze({
+    rel: Object.freeze([".cursor", "heyspex", "run-hook.mjs"]),
+    projectDirEnv: "CURSOR_PROJECT_DIR",
+    shim: CURSOR_HOOK_SHIM,
+    registry: ".cursor/hooks.json"
+  })
+});
+var BOOTSTRAP_WALK = "var d=process.cwd(),r=e.CLAUDE_PROJECT_DIR;if(!r||!f.existsSync(p.join(r,...n))){r='';for(;;){if(f.existsSync(p.join(d,...n))){r=d;break}var q=p.dirname(d);if(q===d)break;d=q}}";
+function buildBootstrap({ plugin = false } = {}) {
+  const walk = BOOTSTRAP_WALK;
+  const body = plugin ? "var f=require('fs'),p=require('path'),u=require('url'),e=process.env,n=['scripts','claude-hooks','_run.mjs'],s='',m=e.CLAUDE_PLUGIN_ROOT||e.COPILOT_PLUGIN_ROOT||e.PLUGIN_ROOT;if(m&&f.existsSync(p.join(m,'bin','run-hook.mjs')))s=p.join(m,'bin','run-hook.mjs');if(!s){" + walk + "if(r){e.CLAUDE_PROJECT_DIR=r;s=p.join(r,...n)}}" : "var f=require('fs'),p=require('path'),u=require('url'),e=process.env,n=['scripts','claude-hooks','_run.mjs'],s='';" + walk + "if(r){e.CLAUDE_PROJECT_DIR=r;s=p.join(r,...n)}";
+  return body + "if(!s)process.exit(0);process.argv=[process.argv[0],s].concat(process.argv.slice(1));import(u.pathToFileURL(s).href).catch(function(){process.exit(0)});" + (plugin ? "//bin/run-hook.mjs" : "//scripts/claude-hooks/_run.mjs");
+}
+var PLATFORM_RUNNER_PREFIX = 'node -e "' + buildBootstrap() + '"';
+var PLUGIN_RUNNER_PREFIX = 'node -e "' + buildBootstrap({ plugin: true }) + '"';
+function buildCustomerBootstrap() {
+  const rel = CUSTOMER_LAUNCHERS.claude.rel.map((s) => "'" + s + "'").join(",");
+  return "var f=require('fs'),p=require('path'),u=require('url'),e=process.env,n=[" + rel + "],s='';" + BOOTSTRAP_WALK + "if(r){e.CLAUDE_PROJECT_DIR=r;s=p.join(r,...n)}if(!s)process.exit(0);process.argv=[process.argv[0],s].concat(process.argv.slice(1));import(u.pathToFileURL(s).href).catch(function(){process.exit(0)});//" + CUSTOMER_LAUNCHERS.claude.rel.join("/");
+}
+var CUSTOMER_RUNNER_PREFIX = 'node -e "' + buildCustomerBootstrap() + '"';
+var LAUNCHER_TEMPLATE = [
+  "#!/usr/bin/env node",
+  "// HeySpex hook launcher -- GENERATED by hs install / hs connect. Commit it with this repo.",
+  "//",
+  "// Every HeySpex hook registered in __REGISTRY__ runs",
+  '//   node "$__ENV__/__LAUNCHER__" <hook> [args]',
+  "// This file carries NO machine-specific path. It finds the heyspex package this",
+  "// repo depends on (node_modules/heyspex) and hands off in-process to the",
+  "// package's hook shim (__SHIM__), so the same committed command works on every",
+  "// machine the repo is cloned to.",
+  "//",
+  "// Resolution order (the first root that carries the shim wins):",
+  "//   1. HEYSPEX_PLATFORM_ROOT                    explicit machine-local override",
+  "//   2. HEYSPEX_MCP_ENTRY -> its package root    machine-local override",
+  "//   3. node_modules/heyspex, walking up from this file   (the repo-local dependency)",
+  "//   4. node_modules/heyspex up from $__ENV__, $CLAUDE_PROJECT_DIR, $CURSOR_PROJECT_DIR, cwd",
+  "//   5. <npm root -g>/heyspex                    a global install, last resort",
+  "// Nothing found -> one stderr line and exit 0 (fail-open, like the shim itself).",
+  "import { spawnSync } from 'node:child_process';",
+  "import { existsSync } from 'node:fs';",
+  "import { dirname, resolve } from 'node:path';",
+  "import { fileURLToPath, pathToFileURL } from 'node:url';",
+  "",
+  "const SHIM = '__SHIM__'.split('/');",
+  "const here = dirname(fileURLToPath(import.meta.url));",
+  "const env = process.env;",
+  "const text = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);",
+  "const hasShim = (root) => Boolean(root) && existsSync(resolve(root, ...SHIM));",
+  "",
+  "function packageUpFrom(start) {",
+  "  let dir = resolve(start);",
+  "  for (;;) {",
+  "    const candidate = resolve(dir, 'node_modules', 'heyspex');",
+  "    if (hasShim(candidate)) return candidate;",
+  "    const parent = dirname(dir);",
+  "    if (parent === dir) return null;",
+  "    dir = parent;",
+  "  }",
+  "}",
+  "",
+  "function globalPackage() {",
+  "  try {",
+  "    // One command string through the shell: npm is a .cmd on Windows, and a",
+  "    // shell + args array is what node deprecates (DEP0190).",
+  "    const res = spawnSync('npm root -g', { encoding: 'utf8', timeout: 5000, shell: true });",
+  "    const root = String(res.stdout ?? '').trim();",
+  "    return root ? resolve(root, 'heyspex') : null;",
+  "  } catch {",
+  "    return null;",
+  "  }",
+  "}",
+  "",
+  "const mcpEntry = text(env.HEYSPEX_MCP_ENTRY);",
+  "const starts = [...new Set([here, text(env.__ENV__), text(env.CLAUDE_PROJECT_DIR), text(env.CURSOR_PROJECT_DIR), process.cwd()].filter(Boolean))];",
+  "let root =",
+  "  [text(env.HEYSPEX_PLATFORM_ROOT), mcpEntry && resolve(mcpEntry, '..', '..', '..')].find(hasShim) ??",
+  "  starts.map(packageUpFrom).find(Boolean) ??",
+  "  null;",
+  "if (!root) {",
+  "  const global = globalPackage();",
+  "  if (hasShim(global)) root = global;",
+  "}",
+  "",
+  "if (!root) {",
+  "  process.stderr.write(",
+  "    '[heyspex] hook ' + (process.argv[2] ?? '?') + ' skipped: no heyspex package found ' +",
+  `      '(run "npm install heyspex" in this repo, or set HEYSPEX_PLATFORM_ROOT). Looked for __SHIM__ under ' +`,
+  "      'HEYSPEX_PLATFORM_ROOT, HEYSPEX_MCP_ENTRY, node_modules/heyspex up from ' + starts.join(', ') + ', and npm root -g.\\n',",
+  "  );",
+  "  process.exit(0);",
+  "}",
+  "",
+  "// argv is already [node, <this file>, <hook>, ...args] -- the shape the shim",
+  '// reads; the shim path replaces this file so a shim guarded by "am I main?"',
+  "// (the Cursor one) runs exactly as if Cursor had invoked it directly.",
+  "const shim = resolve(root, ...SHIM);",
+  "process.argv[1] = shim;",
+  "try {",
+  "  await import(pathToFileURL(shim).href);",
+  "} catch (err) {",
+  "  process.stderr.write('[heyspex] hook ' + (process.argv[2] ?? '?') + ' skipped: ' + (err && err.message ? err.message : err) + '\\n');",
+  "  process.exit(0);",
+  "}",
+  ""
+].join("\n");
+function renderCustomerLauncher(surface = "claude") {
+  const l = CUSTOMER_LAUNCHERS[surface];
+  return LAUNCHER_TEMPLATE.replace(
+    /__(REGISTRY|ENV|LAUNCHER|SHIM)__/g,
+    (_m, token) => token === "REGISTRY" ? l.registry : token === "ENV" ? l.projectDirEnv : token === "LAUNCHER" ? l.rel.join("/") : l.shim
+  );
+}
+function planCustomerLauncherWrite(existing, surface = "claude") {
+  const text = renderCustomerLauncher(surface);
+  if (existing === null || existing === void 0) return { write: true, reason: "missing", text };
+  if (String(existing).replace(/\r\n/g, "\n") === text) return { write: false, reason: "unchanged", text };
+  return { write: true, reason: "update", text };
+}
+function renderCustomerHooks(runnerPrefix) {
+  return customerHookRows().map((row) => ({
+    event: row.event,
+    ...row.matcher ? { matcher: widenMcpMatcher(row.matcher) } : {},
+    command: `${runnerPrefix} ${hookTail(row)}`,
+    timeout: row.timeout,
+    tail: hookTail(row)
+  }));
+}
+function renderPluginHooksDocument() {
+  const hooks = {};
+  for (const d of renderCustomerHooks(PLUGIN_RUNNER_PREFIX)) {
+    (hooks[d.event] ??= []).push({
+      ...d.matcher ? { matcher: d.matcher } : {},
+      hooks: [{ type: "command", command: d.command, timeout: d.timeout }]
+    });
+  }
+  return {
+    hooks
+  };
+}
+function renderPluginHooksText() {
+  return `${JSON.stringify(renderPluginHooksDocument(), null, 2)}
+`;
+}
+var COPILOT_EVENT_NAMES = Object.freeze({
+  SessionStart: "sessionStart",
+  SessionEnd: "sessionEnd",
+  UserPromptSubmit: "userPromptSubmitted",
+  PreToolUse: "preToolUse",
+  PostToolUse: "postToolUse",
+  Stop: "agentStop",
+  PreCompact: "preCompact"
+});
+var GITHUB_HOOKS_STATE_ARMING = Object.freeze(["intent-classifier-trigger"]);
+var COPILOT_TOOL_NAMES = Object.freeze({
+  Write: "create",
+  Edit: "edit",
+  MultiEdit: "edit",
+  NotebookEdit: "edit",
+  Bash: "bash",
+  PowerShell: "powershell",
+  Agent: "task",
+  Task: "task",
+  WebFetch: "web_fetch",
+  WebSearch: "web_search"
+});
+function toCopilotMatcher(matcher) {
+  if (!matcher) return void 0;
+  const out = [];
+  for (const part of matcher.split("|")) {
+    let t = null;
+    if (part === ".*") t = ".*";
+    else if (COPILOT_TOOL_NAMES[part]) t = COPILOT_TOOL_NAMES[part];
+    else if (part.startsWith(MCP_PROJECT_PREFIX)) t = ".*" + part.slice(MCP_PROJECT_PREFIX.length);
+    else if (part.startsWith(MCP_PLUGIN_PREFIX)) t = ".*" + part.slice(MCP_PLUGIN_PREFIX.length);
+    if (t && !out.includes(t)) out.push(t);
+  }
+  if (out.includes(".*")) return ".*";
+  return out.length ? out.join("|") : null;
+}
+function githubHookNames() {
+  const names = /* @__PURE__ */ new Set();
+  for (const r of customerHookRows()) {
+    if (dispositionFor(r.hook, "copilot")?.disposition === "mapped" || GITHUB_HOOKS_STATE_ARMING.includes(r.hook)) names.add(r.hook);
+  }
+  return names;
+}
+function githubHookCommand(row) {
+  const tail = hookTail(row);
+  return `R=node_modules/heyspex/scripts/claude-hooks/_run.mjs; [ -f "$R" ] || R=./scripts/claude-hooks/_run.mjs; [ -f "$R" ] || exit 0; exec node "$R" ${tail}`;
+}
+function renderGithubHooksDocument() {
+  const allowed = githubHookNames();
+  const hooks = {};
+  for (const row of customerHookRows()) {
+    if (!allowed.has(row.hook)) continue;
+    const event = COPILOT_EVENT_NAMES[row.event];
+    if (!event) continue;
+    const matcher = toCopilotMatcher(row.matcher);
+    if (matcher === null) continue;
+    (hooks[event] ??= []).push({
+      type: "command",
+      ...matcher ? { matcher } : {},
+      bash: githubHookCommand(row),
+      timeoutSec: row.timeout
+    });
+  }
+  return { version: 1, hooks };
+}
+function renderGithubHooksText() {
+  return `${JSON.stringify(renderGithubHooksDocument(), null, 2)}
+`;
+}
+var HARNESS_COMMAND_SURFACES = Object.freeze([
+  {
+    installedDir: Object.freeze([".claude", "commands"]),
+    packagedDir: Object.freeze(["dist", "cli-templates", "harness-commands", "claude"]),
+    devSourceDir: Object.freeze([".claude", "commands"])
+  },
+  {
+    installedDir: Object.freeze([".cursor", "commands"]),
+    packagedDir: Object.freeze(["dist", "cli-templates", "harness-commands", "cursor"]),
+    devSourceDir: Object.freeze([".cursor", "commands"])
+  }
+]);
+var NPM_ALIASES = Object.freeze({ doctor: "doctor", setup: "doctor --fix" });
+var SCRIPT_VERBS = Object.freeze({
+  "scripts/heyspex-doctor.mjs": "doctor",
+  "scripts/hs-view.mjs": "view",
+  "scripts/hs-capture-cli.mjs": "capture",
+  "scripts/hs-next.mjs": "next",
+  "scripts/hs-mode.mjs": "mode",
+  "scripts/hs-settings.mjs": "settings",
+  "scripts/hs-companion.mjs": "companion",
+  "scripts/wip-ledger-health.mjs": "wip",
+  "scripts/dev-server-status.mjs": "server status",
+  "scripts/dev-server-stop.mjs": "server stop"
+});
+var PORTABLE_PACKAGE_DIR = "node_modules/heyspex";
+var fsDeps = {
+  joinPath: (...s) => path2.join(...s),
+  readFile: (p) => {
+    try {
+      return fs.readFileSync(p, "utf8");
+    } catch {
+      return null;
+    }
+  },
+  listDir: (d) => {
+    try {
+      return fs.readdirSync(d);
+    } catch {
+      return [];
+    }
+  }
+};
+function invokedDirectly(importMetaUrl, selfBasename, argv1 = process.argv[1]) {
+  try {
+    if (!argv1) return false;
+    const self = fileURLToPath2(importMetaUrl);
+    if (path2.basename(self) !== selfBasename) return false;
+    return pathToFileURL(path2.resolve(argv1)).href === pathToFileURL(self).href;
+  } catch {
+    return false;
+  }
+}
+var SELF = fileURLToPath2(import.meta.url);
+if (invokedDirectly(import.meta.url, "customer-kit.mjs")) {
+  const platformRoot = path2.resolve(path2.dirname(SELF), "..", "..");
+  const target = path2.join(platformRoot, "plugins", "heyspex", "hooks", "hooks.json");
+  const want = renderPluginHooksText();
+  const same = (fsDeps.readFile(target) ?? "").replace(/\r\n/g, "\n") === want;
+  if (process.argv.includes("--write-plugin-hooks")) {
+    if (!same) fs.writeFileSync(target, want, "utf8");
+    console.log(`customer-kit: ${same ? "unchanged" : "wrote"} ${path2.relative(platformRoot, target)}`);
+  } else if (process.argv.includes("--check-plugin-hooks")) {
+    if (!same) {
+      console.error("customer-kit: plugins/heyspex/hooks/hooks.json is stale \u2014 run `node scripts/lib/customer-kit.mjs --write-plugin-hooks`");
+      process.exit(1);
+    }
+    console.log("customer-kit: plugins/heyspex/hooks/hooks.json up to date");
+  } else if (process.argv.includes("--write-github-hooks") || process.argv.includes("--check-github-hooks")) {
+    const ghTarget = path2.join(platformRoot, ".github", "hooks", "heyspex.json");
+    const ghWant = renderGithubHooksText();
+    const ghSame = (fsDeps.readFile(ghTarget) ?? "").replace(/\r\n/g, "\n") === ghWant;
+    if (process.argv.includes("--write-github-hooks")) {
+      if (!ghSame) {
+        fs.mkdirSync(path2.dirname(ghTarget), { recursive: true });
+        fs.writeFileSync(ghTarget, ghWant, "utf8");
+      }
+      console.log(`customer-kit: ${ghSame ? "unchanged" : "wrote"} ${path2.relative(platformRoot, ghTarget).replace(/\\/g, "/")}`);
+    } else if (!ghSame) {
+      console.error("customer-kit: .github/hooks/heyspex.json is stale - run `node scripts/lib/customer-kit.mjs --write-github-hooks`");
+      process.exit(1);
+    } else {
+      console.log("customer-kit: .github/hooks/heyspex.json up to date");
+    }
+  } else {
+    console.log("usage: node scripts/lib/customer-kit.mjs --write-plugin-hooks | --check-plugin-hooks");
+  }
+}
+
+// scripts/install-cursor-hooks.mjs
+var PLATFORM_ROOT = path3.resolve(path3.dirname(fileURLToPath3(import.meta.url)), "..");
+var REPO_ROOT = process.env.HS_SETUP_TARGET?.trim() ? path3.resolve(process.env.HS_SETUP_TARGET.trim()) : PLATFORM_ROOT;
+var SETTINGS_PATH = path3.join(REPO_ROOT, ".cursor", "hooks.json");
+function cursorKitFor(targetRoot, platformRoot = PLATFORM_ROOT) {
+  const customer = !samePlatformPath(targetRoot, platformRoot);
+  return {
+    customer,
+    hooks: customer ? HOOKS.filter((h) => hookScope(h.hook) === "customer") : HOOKS,
+    commandFor: customer ? commandForCustomer : commandFor,
+    launcher: customer ? { rel: CUSTOMER_LAUNCHERS.cursor.rel, plan: planCustomerLauncherWrite } : null
+  };
+}
+var KIT = cursorKitFor(REPO_ROOT);
+var ACTIVE_HOOKS = KIT.hooks;
+var LAUNCHER_PATH = path3.join(REPO_ROOT, ...CUSTOMER_LAUNCHERS.cursor.rel);
+var LEGACY_MARKER = "scripts/claude-hooks/";
+function readSettings() {
+  try {
+    const raw = fs2.readFileSync(SETTINGS_PATH, "utf8").trim();
+    if (!raw) return { version: 1, hooks: {} };
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") {
+      parsed.version ??= 1;
+      parsed.hooks ??= {};
+      return parsed;
+    }
+  } catch (err) {
+    if (err && err.code === "ENOENT") return { version: 1, hooks: {} };
+    throw err;
+  }
+  return { version: 1, hooks: {} };
+}
+function writeSettings(settings) {
+  fs2.mkdirSync(path3.dirname(SETTINGS_PATH), { recursive: true });
+  fs2.writeFileSync(SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}
+`, "utf8");
+}
+var commandOf = (entry) => entry && typeof entry.command === "string" ? entry.command : "";
+var isOurRunner = (token) => token.includes(SHIM) || token.includes(CUSTOMER_LAUNCHER);
+var isShimEntry = (raw) => isOurRunner(commandOf(raw));
+var isLegacyEntry = (raw) => !isShimEntry(raw) && commandOf(raw).includes(LEGACY_MARKER);
+function identityOfCommand(command) {
+  const tokens = command.trim().split(/\s+/);
+  const shimAt = tokens.findIndex(isOurRunner);
+  if (shimAt === -1) return null;
+  const rest = tokens.slice(shimAt + 1);
+  const hook = rest[0] ?? "";
+  let tool = "";
+  const args = [];
+  for (const token of rest.slice(1)) {
+    if (token.startsWith("--hs-tool=")) {
+      tool = token.slice("--hs-tool=".length).replace(/^"([\s\S]*)"$/, "$1");
+    } else if (token.startsWith("--hs-claude-event=")) continue;
+    else args.push(token);
+  }
+  return `${hook}::${tool}::${args.join(" ")}`;
+}
+function desiredEntry(entry, render = KIT.commandFor) {
+  return {
+    command: render(entry),
+    timeout: timeoutFor(entry),
+    ...entry.matcher ? { matcher: entry.matcher } : {}
+  };
+}
+function sameEntry(raw, entry, render = KIT.commandFor) {
+  const want = desiredEntry(entry, render);
+  return commandOf(raw) === want.command && raw.timeout === want.timeout && (raw.matcher ?? void 0) === (want.matcher ?? void 0);
+}
+var PLUGIN_HOOKS_PATH = path3.join(REPO_ROOT, "plugins", "heyspex", "hooks", "cursor-hooks.json");
+function pluginHooksDocument() {
+  const hooks = {};
+  for (const entry of HOOKS) {
+    hooks[entry.event] ??= [];
+    hooks[entry.event].push({
+      command: commandForPlugin(entry),
+      timeout: timeoutFor(entry),
+      ...entry.matcher ? { matcher: entry.matcher } : {}
+    });
+  }
+  return {
+    _comment: "GENERATED by scripts/install-cursor-hooks.mjs from scripts/cursor-hooks/manifest.mjs \u2014 do not edit by hand; run `npm run hooks:install-cursor`. Commands resolve through $CURSOR_PROJECT_DIR because the shim and hook bodies live in the host vault checkout, not the plugin cache. WARNING: enabling this plugin in a repo whose .cursor/hooks.json still registers the same hooks runs every hook twice \u2014 validate in a fresh clone, or run `node scripts/install-cursor-hooks.mjs --uninstall` there first.",
+    version: 1,
+    hooks
+  };
+}
+function pluginHooksText() {
+  return `${JSON.stringify(pluginHooksDocument(), null, 2)}
+`;
+}
+function syncPluginHooks() {
+  const want = pluginHooksText();
+  let have = null;
+  try {
+    have = fs2.readFileSync(PLUGIN_HOOKS_PATH, "utf8");
+  } catch {
+    have = null;
+  }
+  if (have === want) return false;
+  fs2.mkdirSync(path3.dirname(PLUGIN_HOOKS_PATH), { recursive: true });
+  fs2.writeFileSync(PLUGIN_HOOKS_PATH, want, "utf8");
+  return true;
+}
+function mergeCursorHooks(settings, { hooks = ACTIVE_HOOKS, commandFor: render = KIT.commandFor } = {}) {
+  settings.version = 1;
+  settings.hooks ??= {};
+  const added = [];
+  const repaired = [];
+  const removed = [];
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const keep = entries.filter((raw) => {
+      if (!isLegacyEntry(raw)) return true;
+      removed.push(`${event}: ${commandOf(raw)}`);
+      return false;
+    });
+    settings.hooks[event] = keep;
+  }
+  for (const entry of hooks) {
+    settings.hooks[entry.event] ??= [];
+    const entries = settings.hooks[entry.event];
+    const identity = identityFor(entry);
+    const existing = entries.filter(
+      (raw2) => isShimEntry(raw2) && identityOfCommand(commandOf(raw2)) === identity
+    );
+    if (existing.length === 0) {
+      entries.push(desiredEntry(entry, render));
+      added.push(`${entry.event}/${entry.hook}`);
+      continue;
+    }
+    for (const extra of existing.slice(1)) {
+      entries.splice(entries.indexOf(extra), 1);
+      removed.push(`${entry.event}: duplicate ${entry.hook}`);
+    }
+    const raw = existing[0];
+    if (!sameEntry(raw, entry, render)) {
+      Object.assign(raw, desiredEntry(entry, render));
+      if (!entry.matcher && "matcher" in raw) delete raw.matcher;
+      repaired.push(`${entry.event}/${entry.hook}`);
+    }
+  }
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const wanted = new Set(hooks.filter((h) => h.event === event).map(identityFor));
+    settings.hooks[event] = entries.filter((raw) => {
+      if (!isShimEntry(raw)) return true;
+      if (wanted.has(identityOfCommand(commandOf(raw)))) return true;
+      removed.push(`${event}: retired ${commandOf(raw)}`);
+      return false;
+    });
+    if (settings.hooks[event].length === 0) delete settings.hooks[event];
+  }
+  return { added, repaired, removed };
+}
+function launcherPlan() {
+  let existing = null;
+  try {
+    existing = fs2.readFileSync(LAUNCHER_PATH, "utf8");
+  } catch {
+    existing = null;
+  }
+  return planCustomerLauncherWrite(existing, "cursor");
+}
+function install({ json = false } = {}) {
+  const settings = readSettings();
+  const { added, repaired, removed } = mergeCursorHooks(settings);
+  const settingsChanged = added.length + repaired.length + removed.length > 0;
+  if (settingsChanged) writeSettings(settings);
+  let launcherWritten = false;
+  if (KIT.customer) {
+    const plan = launcherPlan();
+    if (plan.write) {
+      fs2.mkdirSync(path3.dirname(LAUNCHER_PATH), { recursive: true });
+      fs2.writeFileSync(LAUNCHER_PATH, plan.text, "utf8");
+      launcherWritten = true;
+    }
+  }
+  const pluginChanged = KIT.customer ? false : syncPluginHooks();
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          changed: settingsChanged || pluginChanged || launcherWritten,
+          added,
+          repaired,
+          removed,
+          pluginChanged,
+          launcherWritten,
+          total: ACTIVE_HOOKS.length,
+          customer: KIT.customer
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (pluginChanged) {
+    console.log(`install-cursor-hooks: regenerated ${path3.relative(REPO_ROOT, PLUGIN_HOOKS_PATH)}`);
+  }
+  if (launcherWritten) {
+    console.log(`install-cursor-hooks: wrote ${path3.relative(REPO_ROOT, LAUNCHER_PATH)} (resolves node_modules/heyspex)`);
+  }
+  if (!settingsChanged) {
+    console.log(`install-cursor-hooks: already installed (${ACTIVE_HOOKS.length} hooks, no changes).`);
+    return;
+  }
+  const parts = [];
+  if (added.length) parts.push(`added ${added.length}`);
+  if (repaired.length) parts.push(`repaired ${repaired.length}`);
+  if (removed.length) parts.push(`removed ${removed.length}`);
+  console.log(
+    `install-cursor-hooks: ${parts.join("; ")} \u2192 ${path3.relative(REPO_ROOT, SETTINGS_PATH)} (${ACTIVE_HOOKS.length} hooks registered)`
+  );
+  for (const line of removed) console.log(`  - ${line}`);
+  console.log(
+    KIT.customer ? `  Launcher: ${CUSTOMER_LAUNCHER} \u2192 node_modules/heyspex/${SHIM} (HeySpex off-switch + Cursor\u2194Claude payload translation)` : `  Shim: ${SHIM} (HeySpex off-switch + Cursor\u2194Claude payload translation)`
+  );
+  for (const gap of UNPORTABLE) {
+    console.log(`  Not registerable in Cursor: ${gap.hook} (${gap.reason}) \u2192 covered by ${gap.coveredBy}`);
+  }
+}
+function check({ json = false } = {}) {
+  const settings = readSettings();
+  const issues = [];
+  const entriesFor = (event) => Array.isArray(settings?.hooks?.[event]) ? settings.hooks[event] : [];
+  for (const entry of ACTIVE_HOOKS) {
+    const identity = identityFor(entry);
+    const ours = entriesFor(entry.event).filter(
+      (raw) => isShimEntry(raw) && identityOfCommand(commandOf(raw)) === identity
+    );
+    if (ours.length === 0) {
+      issues.push(`${entry.event}: missing ${entry.hook}`);
+      continue;
+    }
+    if (ours.length > 1) issues.push(`${entry.event}: ${entry.hook} registered ${ours.length}\xD7`);
+    for (const raw of ours) {
+      if (!sameEntry(raw, entry)) {
+        issues.push(
+          `${entry.event}/${entry.hook}: drift \u2014 expected \`${KIT.commandFor(entry)}\` (timeout ${timeoutFor(entry)}, matcher ${entry.matcher ?? "none"}), found \`${commandOf(raw)}\` (timeout ${raw.timeout}, matcher ${raw.matcher ?? "none"})`
+        );
+      }
+    }
+  }
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    if (!Array.isArray(entries)) continue;
+    for (const raw of entries) {
+      if (isLegacyEntry(raw)) {
+        issues.push(`${event}: superseded direct registration \u2014 ${commandOf(raw)}`);
+      } else if (isShimEntry(raw) && !ACTIVE_HOOKS.some((h) => h.event === event && identityFor(h) === identityOfCommand(commandOf(raw)))) {
+        issues.push(`${event}: not part of this repo's hook set \u2014 ${commandOf(raw)}`);
+      }
+    }
+  }
+  let pluginOnDisk = null;
+  try {
+    pluginOnDisk = fs2.readFileSync(PLUGIN_HOOKS_PATH, "utf8");
+  } catch {
+    pluginOnDisk = null;
+  }
+  if (!KIT.customer && pluginOnDisk !== pluginHooksText()) {
+    issues.push(
+      `plugins/heyspex/hooks/cursor-hooks.json: ${pluginOnDisk === null ? "missing" : "stale"} \u2014 regenerate with \`npm run hooks:install-cursor\``
+    );
+  }
+  if (KIT.customer) {
+    const plan = launcherPlan();
+    if (plan.write) {
+      issues.push(`${CUSTOMER_LAUNCHER}: ${plan.reason === "missing" ? "missing" : "stale"} \u2014 the hook rows point at it`);
+    }
+  }
+  if (json) {
+    console.log(JSON.stringify({ ok: issues.length === 0, issues, total: ACTIVE_HOOKS.length, customer: KIT.customer }, null, 2));
+    process.exit(issues.length === 0 ? 0 : 1);
+  }
+  if (issues.length === 0) {
+    console.log(`install-cursor-hooks --check: OK (${ACTIVE_HOOKS.length} hooks registered)`);
+    process.exit(0);
+  }
+  console.error("install-cursor-hooks --check: drift detected");
+  for (const issue of issues) console.error(`  - ${issue}`);
+  console.error("  Run `node scripts/install-cursor-hooks.mjs` to repair.");
+  process.exit(1);
+}
+function uninstall() {
+  const settings = readSettings();
+  if (!settings.hooks) {
+    console.log("install-cursor-hooks: nothing to uninstall (no hooks block).");
+    return;
+  }
+  let removed = 0;
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const keep = entries.filter((raw) => !isShimEntry(raw) && !isLegacyEntry(raw));
+    removed += entries.length - keep.length;
+    if (keep.length === 0) delete settings.hooks[event];
+    else settings.hooks[event] = keep;
+  }
+  if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+  writeSettings(settings);
+  console.log(`install-cursor-hooks: uninstalled ${removed} hook entr${removed === 1 ? "y" : "ies"}.`);
+}
+if (invokedDirectly(import.meta.url, "install-cursor-hooks.mjs")) {
+  const argv = process.argv.slice(2);
+  const json = argv.includes("--json");
+  if (argv.includes("--uninstall")) uninstall();
+  else if (argv.includes("--check")) check({ json });
+  else install({ json });
+}
+
+// spex-console/src/lib/cli/install.ts
+init_credentials();
+
+// spex-console/src/lib/cli/connect-checks.ts
+import { dirname as dirname5 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+
+// spex-console/src/lib/dev-mode.ts
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+init_credentials();
+
+// spex-console/src/lib/cli/connect-checks.ts
+init_credentials();
+
+// spex-console/src/lib/cli/satellite.ts
+import { resolve as resolveNodePath } from "node:path";
+import process2 from "node:process";
+
 // spex-console/src/lib/cli/principle-selection.ts
-import { basename as basename2 } from "node:path";
+import { basename as basename3 } from "node:path";
 var PRINCIPLES_INDEX_DEST = "specs/principles-index.md";
 function principleKey(row) {
-  const base = basename2(row.dest, ".md");
+  const base = basename3(row.dest, ".md");
   return base.startsWith("principle-") ? base.slice("principle-".length) : base;
 }
 function principleWikilink(row) {
-  return basename2(row.dest, ".md");
+  return basename3(row.dest, ".md");
 }
 function parsePrinciplesFlag(value, rows) {
   const principleRows = rows.filter((row) => row.group === "principle");
@@ -1015,6 +3410,7 @@ function principleManifestFilter(selected) {
 }
 function principlesIndexHook(selected, rows) {
   return (ctx) => {
+    if (ctx.rows.some((r) => r.dest === PRINCIPLES_INDEX_DEST && r.action === "kept")) return;
     const indexRow = rows.find((row) => row.dest === PRINCIPLES_INDEX_DEST);
     if (!indexRow || indexRow.content === void 0) {
       throw new Error(
@@ -1031,10 +3427,292 @@ function principlesIndexHook(selected, rows) {
   };
 }
 
+// spex-console/src/lib/cli/receipt.ts
+var RECEIPT_AGREEMENT_FIELDS = [
+  "vault_id",
+  "workspace_id",
+  "account_id",
+  "active_vault_id"
+];
+var ALL_FIELDS = [
+  ...RECEIPT_AGREEMENT_FIELDS,
+  "display_name",
+  "archived"
+];
+
+// spex-console/src/lib/cli/vault-workspace-shared.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+
+// spex-console/src/lib/indexer/parser.ts
+var import_gray_matter = __toESM(require_gray_matter(), 1);
+import { createHash as createHash2 } from "node:crypto";
+import { promises as fs3 } from "node:fs";
+import path4 from "node:path";
+
+// spex-console/src/lib/cli/install.ts
+var MCP_REL = ["vendor", "heyspex-mcp", "cli.mjs"];
+var PORTABLE_MCP_CLI = Object.freeze({
+  claude: `\${CLAUDE_PROJECT_DIR:-.}/${PORTABLE_PACKAGE_DIR}/${MCP_REL.join("/")}`,
+  cursor: `\${workspaceFolder}/${PORTABLE_PACKAGE_DIR}/${MCP_REL.join("/")}`
+});
+function resolveCallerPath(p, env, fallbackCwd) {
+  const trimmed = p?.trim() ?? "";
+  if (!trimmed) return "";
+  if (isAbsolute3(trimmed)) return trimmed;
+  const base = env.HS_INVOKED_CWD?.trim() || fallbackCwd;
+  return resolveNodePath2(base, trimmed);
+}
+var DEFAULT_REMOTE_MCP_URL = "https://app.heyspex.com/api/mcp";
+var REMOTE_MCP_TOKEN_ENV = "HEYSPEX_MCP_TOKEN";
+var PLUGIN_MARKETPLACE_NAME = "heyspex-marketplace";
+var PLUGIN_INSTALL_SPEC = `heyspex@${PLUGIN_MARKETPLACE_NAME}`;
+var WRITE_TARGET_KIND = {
+  specsGitkeep: "specs_gitkeep",
+  heyspexYaml: "heyspex_yaml",
+  cursorMcp: "cursor_mcp",
+  claudeMcp: "claude_mcp",
+  claudeMd: "claude_md",
+  agentsMd: "agents_md",
+  statuslineVendor: "statusline_vendor",
+  gitignore: "gitignore",
+  claudeMdTemplate: "claude_md_template",
+  agentsMdTemplate: "agents_md_template"
+};
+var INSTALL_WRITE_TARGETS = [
+  {
+    kind: WRITE_TARGET_KIND.specsGitkeep,
+    rel: "specs/.gitkeep",
+    path: (targetDir, joinPath) => joinPath(targetDir, "specs", ".gitkeep"),
+    appliesTo: (_args, opts) => !opts.attached
+  },
+  {
+    kind: WRITE_TARGET_KIND.heyspexYaml,
+    rel: "heyspex.yaml",
+    path: (targetDir, joinPath) => joinPath(targetDir, "heyspex.yaml"),
+    appliesTo: (_args, opts) => !opts.attached
+  },
+  {
+    kind: WRITE_TARGET_KIND.cursorMcp,
+    rel: ".cursor/mcp.json",
+    path: (targetDir, joinPath) => joinPath(targetDir, ".cursor", "mcp.json"),
+    appliesTo: (args) => args.cursor
+  },
+  {
+    kind: WRITE_TARGET_KIND.claudeMcp,
+    rel: ".mcp.json",
+    path: (targetDir, joinPath) => joinPath(targetDir, ".mcp.json"),
+    appliesTo: (args) => args.claude
+  },
+  {
+    kind: WRITE_TARGET_KIND.claudeMd,
+    rel: "CLAUDE.md",
+    path: (targetDir, joinPath) => joinPath(targetDir, "CLAUDE.md"),
+    appliesTo: (args, opts) => args.claude && opts.installContract
+  },
+  {
+    kind: WRITE_TARGET_KIND.agentsMd,
+    rel: "AGENTS.md",
+    path: (targetDir, joinPath) => joinPath(targetDir, "AGENTS.md"),
+    appliesTo: (_args, opts) => opts.installContract
+  },
+  // The customer-template step (--register-vault) writes the project contract
+  // beside a hand-authored CLAUDE.md/AGENTS.md as <file>.template; a rerun
+  // rewrites it when the generated text changed.
+  {
+    kind: WRITE_TARGET_KIND.claudeMdTemplate,
+    rel: "CLAUDE.md.template",
+    path: (targetDir, joinPath) => joinPath(targetDir, "CLAUDE.md.template"),
+    appliesTo: (args, opts) => Boolean(args.registerVault) && !opts.attached && args.claude && opts.installContract
+  },
+  {
+    kind: WRITE_TARGET_KIND.agentsMdTemplate,
+    rel: "AGENTS.md.template",
+    path: (targetDir, joinPath) => joinPath(targetDir, "AGENTS.md.template"),
+    appliesTo: (args, opts) => Boolean(args.registerVault) && !opts.attached && opts.installContract
+  },
+  {
+    kind: WRITE_TARGET_KIND.statuslineVendor,
+    rel: "scripts/claude-statusline",
+    path: (targetDir, joinPath) => joinPath(targetDir, "scripts", "claude-statusline"),
+    appliesTo: (args) => (args.statusline ?? true) && args.claude
+  },
+  {
+    kind: WRITE_TARGET_KIND.gitignore,
+    rel: ".gitignore",
+    path: (targetDir, joinPath) => joinPath(targetDir, ".gitignore"),
+    // A satellite owns no vault content and writes no machine-local
+    // manifests of its own (its .mcp.json/.cursor/mcp.json point AT the
+    // attached vault, not a fresh one this repo would need to gitignore) --
+    // only a real vault bootstrap gets one.
+    appliesTo: (_args, opts) => !opts.attached
+  }
+];
+var INSTALL_HELP = [
+  "Usage:",
+  "  hs install [--target <dir>] [--platform <dir>] [--force] [--dry-run] [--json]",
+  "             [--no-cursor] [--no-claude] [--claude-apply]",
+  "             [--plugin | --plugin-apply] [--plugin-scope user|project|local]",
+  "             [--copilot-hooks | --copilot-plugin | --copilot-plugin-apply]",
+  "             [--no-statusline]",
+  "             [--cc | --command-code] [--register-vault [--workspace <id>]]",
+  "             [--remote[=<url>]]",
+  "  hs install --attach-vault <vault-id|vault-path> [--target <dir>] [...]",
+  "",
+  "Bootstrap a project vault for HeySpex agent tooling:",
+  "  \u2022 specs/ + heyspex.yaml (via hs init)",
+  "  \u2022 .cursor/mcp.json  \u2014 Cursor MCP (gitignored, machine-local path to platform MCP)",
+  "  \u2022 .mcp.json         \u2014 Claude Code project MCP (absolute platform path)",
+  "  \u2022 CLAUDE.md / AGENTS.md \u2014 thin agent contract pointing at the HeySpex MCP server",
+  "  \u2022 agent kit (customer repos) \u2014 the customer-scoped HeySpex hooks in",
+  "    .claude/settings.json + .cursor/hooks.json and the /hs-* commands in",
+  "    .claude/commands + .cursor/commands, every platform path absolute.",
+  "    Scope table: scripts/lib/customer-kit.mjs. Re-runs are no-ops; a command",
+  "    file you edited is left alone (--force overwrites it). `hs doctor` flags",
+  "    a missing or stale kit.",
+  "",
+  "Satellite repo (--attach-vault): wire a CODE repo to an EXISTING vault instead",
+  "of making it a vault. Writes the MCP manifests + agent contract only, with",
+  "HEYSPEX_VAULT_ROOT pinned to the attached vault's absolute root -- no specs/,",
+  "no heyspex.yaml, no new registry row. The target is the repo you are standing",
+  "in (or --target), never the vault being attached.",
+  "",
+  "That pin IS the attachment, so it must land somewhere: --attach-vault refuses a",
+  "flag combination that writes no stdio manifest (--no-cursor --no-claude), and",
+  "refuses to re-pin over manifests that name a different vault unless you pass",
+  "--force. Re-attaching to the SAME vault is a no-op and says so.",
+  "",
+  '--attach-vault --remote: the stdio pin under "heyspex" in .mcp.json is preserved',
+  "(never replaced by the HTTP form, even with --force) and the cloud form is",
+  'written under a second key, "heyspex-cloud" -- Claude Code registers both the',
+  "attached-vault local server and the cloud server. Without --force, a pin that",
+  "already names a DIFFERENT vault still refuses and names the conflicting key,",
+  "same as the non-remote case.",
+  "",
+  "Verify with `hs connect --check` from the satellite -- it is the command that",
+  "audits THIS repo's rows and reports the attachment. `hs doctor` resolves",
+  "THROUGH the pin and audits the ATTACHED VAULT repo, so it reports that vault's",
+  "connection state, not the satellite's.",
+  "",
+  "Conflict scan: every install checks the target repo against the known-conflict",
+  "registry (beads, workflow-pm, bd hooks, \u2026). See:",
+  "  specs/protocols/customer-vault-local-install-protocol.md",
+  "",
+  "Run from the HeySpex platform repo, or pass --platform to its checkout.",
+  "Target defaults to the current directory.",
+  "",
+  "Flags:",
+  "  --target <dir>     Project repo to bootstrap (default: cwd).",
+  "  --platform <dir>   HeySpex platform checkout (default: HS_INSTALL_PLATFORM or dispatcher root).",
+  "  --claude-apply     Run `claude mcp add --scope project` after writing files.",
+  "  --plugin           Print the Claude Code plugin registration block (self-hosted",
+  "                     marketplace at the platform root \u2014 HS-QTBK prototype).",
+  "  --plugin-apply     Run `claude plugin marketplace add` + `claude plugin install`",
+  "                     after writing files. Marketplace + plugin names are read from",
+  `                     the platform's .claude-plugin/marketplace.json (fallback: ${PLUGIN_INSTALL_SPEC}).`,
+  "  --plugin-scope <s> Plugin install scope: user, project (default), or local.",
+  "                     Implies --plugin.",
+  "  --copilot-hooks    Write .github/hooks/heyspex.json (GitHub Copilot hooks) into the",
+  "                     target. Commands resolve node_modules/heyspex first, so an npm-only",
+  "                     install (no heyspex repo checkout) works. Pick this OR the plugin.",
+  "  --copilot-plugin   Print `copilot plugin marketplace add '<platform>'` +",
+  "                     `copilot plugin install <plugin>@<marketplace>` (the platform root is",
+  "                     node_modules/heyspex for a published install).",
+  "  --copilot-plugin-apply  Run those two commands when `copilot` is on PATH.",
+  "                     Requesting the Copilot plugin AND --copilot-hooks warns and skips the",
+  "                     hooks file (both would fire every hook twice).",
+  "  --remote[=<url>]   Write .mcp.json for the REMOTE (cloud) MCP endpoint instead of",
+  `                     the local stdio server \u2014 the Streamable-HTTP form against`,
+  `                     ${DEFAULT_REMOTE_MCP_URL} (or <url>), authenticated by the`,
+  `                     env reference \`\${${REMOTE_MCP_TOKEN_ENV}}\` (never the literal token).`,
+  '                     With --attach-vault, the stdio pin survives under "heyspex" and',
+  '                     this is written under "heyspex-cloud" instead (see above). If',
+  "                     this machine already ran `hs login` / `hs mcp pair <code>`, the",
+  "                     printed guidance resolves the bearer from",
+  "                     ~/.heyspex/credentials.yaml automatically -- no manual export",
+  "                     needed on that machine.",
+  "  --no-statusline    Skip the branded statusline (statusLine entry in the target's",
+  "                     .claude/settings.json + machine-level glyph install).",
+  "  --cc, --command-code  Print `cmdc mcp add` PowerShell one-liner for Command Code.",
+  "  --attach-vault <v> SATELLITE mode: attach this repo to the EXISTING vault named",
+  "                     by a registry id (`hs vault list`) or the vault repo's path,",
+  "                     instead of scaffolding specs/ + heyspex.yaml here. The vault",
+  "                     must already be registered on this machine. Mutually exclusive",
+  "                     with --register-vault and --workspace, and with any flag",
+  "                     combination that would leave no stdio manifest to pin.",
+  "                     Combines with --remote (see --remote above): the pin and the",
+  "                     cloud endpoint coexist in .mcp.json under separate keys.",
+  "  --register-vault   Register this repo's vault into ~/.heyspex/registry.json during install,",
+  "                     and -- when this machine is signed in -- on the console too; both",
+  "                     sides are read back (GET /api/vaults) and printed as a receipt.",
+  "                     Re-running changes nothing and sends no cloud write.",
+  "  --workspace <id>   With --register-vault: ensure this workspace exists, make it active,",
+  "                     and associate the vault with it (default: the vault's current",
+  "                     workspace, else your per-account default ws-<account>).",
+  "  --no-cursor        Skip .cursor/mcp.json.",
+  "  --no-claude        Skip .mcp.json and Claude instructions.",
+  "  --force            Overwrite existing MCP manifests and heyspex.yaml.",
+  "  --dry-run          Print the plan without writing.",
+  "  --skip-conflict-check  Skip the known-conflict registry scan.",
+  "  --json             Machine-readable result.",
+  "  --account <email|id> Confirm the account this repo is attached to. An interactive",
+  "                     install asks (continue / sign in as someone else / create an",
+  "                     account / abort); a non-interactive one with --register-vault or",
+  "                     --remote refuses without this or --yes. See `hs whoami`.",
+  "  --yes              Confirm the signed-in account shown, without typing it.",
+  "  --help, -h         Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 11 bad-arg \xB7 13 write-failed \xB7 16 sign-in required \xB7",
+  "12 console unreachable (account check) \xB7 17 account not confirmed \xB7",
+  "19 the cloud half did not land (the receipt names the retry) \xB7 21 both sides read back and disagree"
+].join("\n");
+
+// spex-console/bin/run-entry.ts
+import process3 from "node:process";
+var BinExit = class extends Error {
+  code;
+  constructor(code) {
+    super(`exit ${code}`);
+    this.name = "BinExit";
+    this.code = code;
+  }
+};
+function runEntry(name, main2, options2 = {}) {
+  const { fallbackCode = 1, unhandledLabel = "unhandled" } = options2;
+  void (async () => {
+    try {
+      await main2();
+    } catch (err) {
+      if (err instanceof BinExit) {
+        process3.exitCode = err.code;
+        return;
+      }
+      const message = err instanceof Error ? err.message : String(err);
+      process3.stderr.write(`${name}: ${unhandledLabel}: ${message}
+`);
+      process3.exitCode = fallbackCode;
+    }
+  })();
+}
+
 // spex-console/bin/hs-init.ts
-var INTERACTIVE = process2.stdin.isTTY === true;
+var INTERACTIVE = process4.stdin.isTTY === true;
+var PKG_ROOT = resolve5(
+  resolveCodeRoot({ packageRoot: resolve5(dirname6(fileURLToPath4(import.meta.url)), "..", "..") })
+);
+var CONFIG_SEED_PATH = join11(PKG_ROOT, "vendor", "heyspex-mcp", "config-seed.yaml");
+function readConfigSeed() {
+  try {
+    return readFileSync11(CONFIG_SEED_PATH, "utf8");
+  } catch {
+    process4.stderr.write(
+      `hs init: warning \u2014 config seed template not found at ${CONFIG_SEED_PATH}; .heyspex/config.yaml was not seeded (run \`hs settings set <key> <value>\` to create it).
+`
+    );
+    return null;
+  }
+}
 async function askYesNo(question) {
-  const rl = createInterface({ input: process2.stdin, output: process2.stdout });
+  const rl = createInterface({ input: process4.stdin, output: process4.stdout });
   try {
     const answer = (await rl.question(`${question} `)).trim().toLowerCase();
     return answer === "y" || answer === "yes" || answer === "";
@@ -1047,9 +3725,9 @@ async function resolvePrincipleSelection(principlesFlag) {
     return parsePrinciplesFlag(principlesFlag, TEMPLATE_MANIFEST);
   }
   if (INTERACTIVE) {
-    process2.stdout.write("Select which universal principle docs to ship with this vault:\n");
+    process4.stdout.write("Select which universal principle docs to ship with this vault:\n");
     for (const choice of listPrincipleChoices(TEMPLATE_MANIFEST)) {
-      process2.stdout.write(`  - ${choice.key}: ${choice.summary}
+      process4.stdout.write(`  - ${choice.key}: ${choice.summary}
 `);
     }
     const selected = await promptPrincipleSelection(askYesNo, TEMPLATE_MANIFEST);
@@ -1058,47 +3736,60 @@ async function resolvePrincipleSelection(principlesFlag) {
   return parsePrinciplesFlag(void 0, TEMPLATE_MANIFEST);
 }
 async function main() {
-  const repoRoot = process2.env.HS_VAULT_ROOT ? resolve(process2.env.HS_VAULT_ROOT) : process2.cwd();
-  const parsed = parseInitArgs(process2.argv.slice(3));
+  const repoRoot = process4.env.HS_VAULT_ROOT ? resolve5(process4.env.HS_VAULT_ROOT) : process4.cwd();
+  const parsed = parseInitArgs(process4.argv.slice(3));
   if (parsed.help) {
-    process2.stdout.write(`${HELP}
+    process4.stdout.write(`${HELP}
 `);
-    process2.exit(EXIT.OK);
+    process4.exitCode = EXIT.OK;
+    return;
   }
   if (parsed.error) {
-    process2.stderr.write(`hs init: ${parsed.error.message}
+    process4.stderr.write(`hs init: ${parsed.error.message}
 `);
-    process2.exit(parsed.error.code);
+    process4.exitCode = parsed.error.code;
+    return;
   }
   const args = parsed.args;
   if (args.customerVaultDir) {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const platformRoot = resolve(here, "..", "..");
-    const targetDir = resolve(args.customerVaultDir);
+    const here = dirname6(fileURLToPath4(import.meta.url));
+    const platformRoot = resolve5(here, "..", "..");
+    const targetDir = resolve5(resolveCallerPath(args.customerVaultDir, process4.env, process4.cwd()));
     const deps = {
       platformRoot,
-      exists: (p) => existsSync(p),
-      readdir: (p) => readdirSync(p),
+      exists: (p) => existsSync5(p),
+      readdir: (p) => readdirSync2(p),
       mkdirRecursive: (p) => {
-        mkdirSync(p, { recursive: true });
+        mkdirSync6(p, { recursive: true });
       },
-      writeFile: (p, c) => writeFileSync(p, c, "utf8"),
+      writeFile: (p, c) => writeFileSync6(p, c, "utf8"),
       copyFile: (src, dest) => copyFileSync(src, dest),
-      joinPath: (...s) => join3(...s)
+      joinPath: (...s) => join11(...s),
+      readConfigSeed,
+      readFile: (p) => {
+        try {
+          return readFileSync11(p, "utf8");
+        } catch {
+          return null;
+        }
+      },
+      isDirectory: (p) => statSync(p).isDirectory()
     };
     const principlesResult = await resolvePrincipleSelection(args.principles);
     if (!principlesResult.ok) {
-      process2.stderr.write(`hs init: ${principlesResult.message}
+      process4.stderr.write(`hs init: ${principlesResult.message}
 `);
-      process2.exit(EXIT.INVALID_ARG);
+      process4.exitCode = EXIT.INVALID_ARG;
+      return;
     }
     const selected = principlesResult.selected;
     const notices = [];
     const afterScaffold = [
-      customerClaudeMdHook(),
-      principlesIndexHook(selected, TEMPLATE_MANIFEST)
+      customerClaudeMdHook((msg) => notices.push(msg)),
+      principlesIndexHook(selected, TEMPLATE_MANIFEST),
+      templatePinHook()
     ];
-    if (!args.noGit) {
+    if (args.git) {
       afterScaffold.push(gitFinalizeHook(nodeGitRunner, (msg) => notices.push(msg)));
     }
     const result2 = runCustomerVaultInit({ targetDir }, deps, {
@@ -1107,7 +3798,7 @@ async function main() {
       manifestFilter: principleManifestFilter(selected),
       afterScaffold
     });
-    const sink2 = result2.isError ? process2.stderr : process2.stdout;
+    const sink2 = result2.isError ? process4.stderr : process4.stdout;
     if (args.json) {
       sink2.write(`${JSON.stringify({ ...result2.payload, notices })}
 `);
@@ -1117,29 +3808,29 @@ async function main() {
       for (const notice of notices) sink2.write(`${notice}
 `);
     }
-    process2.exit(result2.code);
+    process4.exitCode = result2.code;
+    return;
   }
   const result = runInit(args, {
     repoRoot,
-    fileExists: (p) => existsSync(p),
+    fileExists: (p) => existsSync5(p),
     readFile: (p) => {
       try {
-        return readFileSync4(p, "utf8");
+        return readFileSync11(p, "utf8");
       } catch {
         return null;
       }
     },
-    writeFile: (p, c) => writeFileSync(p, c, "utf8"),
-    joinPath: (...s) => join3(...s)
+    writeFile: (p, c) => writeFileSync6(p, c, "utf8"),
+    joinPath: (...s) => join11(...s),
+    mkdirRecursive: (p) => {
+      mkdirSync6(p, { recursive: true });
+    },
+    readConfigSeed
   });
-  const sink = result.isError ? process2.stderr : process2.stdout;
+  const sink = result.isError ? process4.stderr : process4.stdout;
   sink.write(`${args.json ? JSON.stringify(result.payload) : result.message}
 `);
-  process2.exit(result.code);
+  process4.exitCode = result.code;
 }
-main().catch((err) => {
-  const message = err instanceof Error ? err.message : String(err);
-  process2.stderr.write(`hs init: unhandled: ${message}
-`);
-  process2.exit(EXIT.WRITE_FAILED);
-});
+runEntry("hs init", main, { fallbackCode: EXIT.WRITE_FAILED });