heyspex 0.2.0 → 0.2.1

package/dist/cli/hs-init.mjs

@@ -1,25 +1,71 @@
 import { createRequire as __hsCreateRequire } from 'node:module';
 const require = __hsCreateRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// scripts/lib/heyspex-home.mjs
+import { homedir } from "node:os";
+function heyspexHome(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir();
+}
+var init_heyspex_home = __esm({
+  "scripts/lib/heyspex-home.mjs"() {
+    "use strict";
+  }
+});
 
 // vendor/heyspex-mcp/credentials.mjs
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import os, { homedir } from "node:os";
+import os, { homedir as homedir2 } from "node:os";
 import { dirname, join, resolve as resolve2 } from "node:path";
 var init_credentials = __esm({
   "vendor/heyspex-mcp/credentials.mjs"() {
     "use strict";
+    init_heyspex_home();
   }
 });
 
 // scripts/lib/dev-mode.mjs
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { join as join2 } from "node:path";
-function devModeFilePath(homeDir = homedir2()) {
+function devModeFilePath(homeDir = heyspexHome()) {
   return join2(homeDir, ".heyspex", DEV_MODE_FILENAME);
 }
 function normalizeMode(raw) {
@@ -44,7 +90,7 @@ function deriveSemantics(mode, reliance) {
     vaultWriteMode: local ? "local" : "cloud"
   };
 }
-function readLocalDevModeRecord({ homeDir = homedir2(), readFile = defaultReadFile } = {}) {
+function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile = defaultReadFile } = {}) {
   let raw;
   try {
     raw = readFile(devModeFilePath(homeDir));
@@ -74,7 +120,7 @@ function readLocalDevModeRecord({ homeDir = homedir2(), readFile = defaultReadFi
 }
 function resolveDevMode({
   env = process.env,
-  homeDir = homedir2(),
+  homeDir = heyspexHome(),
   readFile = defaultReadFile,
   cloudSetting = void 0
 } = {}) {
@@ -137,6 +183,7 @@ var CLOUD_CONSOLE_URL, LOCAL_CONSOLE_URL, DEV_MODE_FILENAME, defaultReadFile;
 var init_dev_mode = __esm({
   "scripts/lib/dev-mode.mjs"() {
     "use strict";
+    init_heyspex_home();
     init_credentials();
     CLOUD_CONSOLE_URL = "https://app.heyspex.com";
     LOCAL_CONSOLE_URL = "http://localhost:3000";
@@ -145,20 +192,681 @@ var init_dev_mode = __esm({
   }
 });
 
+// node_modules/kind-of/index.js
+var require_kind_of = __commonJS({
+  "node_modules/kind-of/index.js"(exports2, module2) {
+    "use strict";
+    var toString = Object.prototype.toString;
+    module2.exports = function kindOf(val) {
+      if (val === void 0) return "undefined";
+      if (val === null) return "null";
+      var type = typeof val;
+      if (type === "boolean") return "boolean";
+      if (type === "string") return "string";
+      if (type === "number") return "number";
+      if (type === "symbol") return "symbol";
+      if (type === "function") {
+        return isGeneratorFn(val) ? "generatorfunction" : "function";
+      }
+      if (isArray(val)) return "array";
+      if (isBuffer(val)) return "buffer";
+      if (isArguments(val)) return "arguments";
+      if (isDate(val)) return "date";
+      if (isError(val)) return "error";
+      if (isRegexp(val)) return "regexp";
+      switch (ctorName(val)) {
+        case "Symbol":
+          return "symbol";
+        case "Promise":
+          return "promise";
+        // Set, Map, WeakSet, WeakMap
+        case "WeakMap":
+          return "weakmap";
+        case "WeakSet":
+          return "weakset";
+        case "Map":
+          return "map";
+        case "Set":
+          return "set";
+        // 8-bit typed arrays
+        case "Int8Array":
+          return "int8array";
+        case "Uint8Array":
+          return "uint8array";
+        case "Uint8ClampedArray":
+          return "uint8clampedarray";
+        // 16-bit typed arrays
+        case "Int16Array":
+          return "int16array";
+        case "Uint16Array":
+          return "uint16array";
+        // 32-bit typed arrays
+        case "Int32Array":
+          return "int32array";
+        case "Uint32Array":
+          return "uint32array";
+        case "Float32Array":
+          return "float32array";
+        case "Float64Array":
+          return "float64array";
+      }
+      if (isGeneratorObj(val)) {
+        return "generator";
+      }
+      type = toString.call(val);
+      switch (type) {
+        case "[object Object]":
+          return "object";
+        // iterators
+        case "[object Map Iterator]":
+          return "mapiterator";
+        case "[object Set Iterator]":
+          return "setiterator";
+        case "[object String Iterator]":
+          return "stringiterator";
+        case "[object Array Iterator]":
+          return "arrayiterator";
+      }
+      return type.slice(8, -1).toLowerCase().replace(/\s/g, "");
+    };
+    function ctorName(val) {
+      return typeof val.constructor === "function" ? val.constructor.name : null;
+    }
+    function isArray(val) {
+      if (Array.isArray) return Array.isArray(val);
+      return val instanceof Array;
+    }
+    function isError(val) {
+      return val instanceof Error || typeof val.message === "string" && val.constructor && typeof val.constructor.stackTraceLimit === "number";
+    }
+    function isDate(val) {
+      if (val instanceof Date) return true;
+      return typeof val.toDateString === "function" && typeof val.getDate === "function" && typeof val.setDate === "function";
+    }
+    function isRegexp(val) {
+      if (val instanceof RegExp) return true;
+      return typeof val.flags === "string" && typeof val.ignoreCase === "boolean" && typeof val.multiline === "boolean" && typeof val.global === "boolean";
+    }
+    function isGeneratorFn(name, val) {
+      return ctorName(name) === "GeneratorFunction";
+    }
+    function isGeneratorObj(val) {
+      return typeof val.throw === "function" && typeof val.return === "function" && typeof val.next === "function";
+    }
+    function isArguments(val) {
+      try {
+        if (typeof val.length === "number" && typeof val.callee === "function") {
+          return true;
+        }
+      } catch (err) {
+        if (err.message.indexOf("callee") !== -1) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function isBuffer(val) {
+      if (val.constructor && typeof val.constructor.isBuffer === "function") {
+        return val.constructor.isBuffer(val);
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/is-extendable/index.js
+var require_is_extendable = __commonJS({
+  "node_modules/is-extendable/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function isExtendable(val) {
+      return typeof val !== "undefined" && val !== null && (typeof val === "object" || typeof val === "function");
+    };
+  }
+});
+
+// node_modules/extend-shallow/index.js
+var require_extend_shallow = __commonJS({
+  "node_modules/extend-shallow/index.js"(exports2, module2) {
+    "use strict";
+    var isObject = require_is_extendable();
+    module2.exports = function extend(o) {
+      if (!isObject(o)) {
+        o = {};
+      }
+      var len = arguments.length;
+      for (var i = 1; i < len; i++) {
+        var obj = arguments[i];
+        if (isObject(obj)) {
+          assign(o, obj);
+        }
+      }
+      return o;
+    };
+    function assign(a, b) {
+      for (var key in b) {
+        if (hasOwn(b, key)) {
+          a[key] = b[key];
+        }
+      }
+    }
+    function hasOwn(obj, key) {
+      return Object.prototype.hasOwnProperty.call(obj, key);
+    }
+  }
+});
+
+// node_modules/section-matter/index.js
+var require_section_matter = __commonJS({
+  "node_modules/section-matter/index.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var extend = require_extend_shallow();
+    module2.exports = function(input, options2) {
+      if (typeof options2 === "function") {
+        options2 = { parse: options2 };
+      }
+      var file = toObject(input);
+      var defaults = { section_delimiter: "---", parse: identity };
+      var opts = extend({}, defaults, options2);
+      var delim = opts.section_delimiter;
+      var lines = file.content.split(/\r?\n/);
+      var sections = null;
+      var section = createSection();
+      var content = [];
+      var stack = [];
+      function initSections(val) {
+        file.content = val;
+        sections = [];
+        content = [];
+      }
+      function closeSection(val) {
+        if (stack.length) {
+          section.key = getKey(stack[0], delim);
+          section.content = val;
+          opts.parse(section, sections);
+          sections.push(section);
+          section = createSection();
+          content = [];
+          stack = [];
+        }
+      }
+      for (var i = 0; i < lines.length; i++) {
+        var line = lines[i];
+        var len = stack.length;
+        var ln = line.trim();
+        if (isDelimiter(ln, delim)) {
+          if (ln.length === 3 && i !== 0) {
+            if (len === 0 || len === 2) {
+              content.push(line);
+              continue;
+            }
+            stack.push(ln);
+            section.data = content.join("\n");
+            content = [];
+            continue;
+          }
+          if (sections === null) {
+            initSections(content.join("\n"));
+          }
+          if (len === 2) {
+            closeSection(content.join("\n"));
+          }
+          stack.push(ln);
+          continue;
+        }
+        content.push(line);
+      }
+      if (sections === null) {
+        initSections(content.join("\n"));
+      } else {
+        closeSection(content.join("\n"));
+      }
+      file.sections = sections;
+      return file;
+    };
+    function isDelimiter(line, delim) {
+      if (line.slice(0, delim.length) !== delim) {
+        return false;
+      }
+      if (line.charAt(delim.length + 1) === delim.slice(-1)) {
+        return false;
+      }
+      return true;
+    }
+    function toObject(input) {
+      if (typeOf(input) !== "object") {
+        input = { content: input };
+      }
+      if (typeof input.content !== "string" && !isBuffer(input.content)) {
+        throw new TypeError("expected a buffer or string");
+      }
+      input.content = input.content.toString();
+      input.sections = [];
+      return input;
+    }
+    function getKey(val, delim) {
+      return val ? val.slice(delim.length).trim() : "";
+    }
+    function createSection() {
+      return { key: "", data: "", content: "" };
+    }
+    function identity(val) {
+      return val;
+    }
+    function isBuffer(val) {
+      if (val && val.constructor && typeof val.constructor.isBuffer === "function") {
+        return val.constructor.isBuffer(val);
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/engines.js
+var require_engines = __commonJS({
+  "node_modules/gray-matter/lib/engines.js"(exports, module) {
+    "use strict";
+    var yaml = __require("js-yaml");
+    var engines = exports = module.exports;
+    engines.yaml = {
+      parse: yaml.safeLoad.bind(yaml),
+      stringify: yaml.safeDump.bind(yaml)
+    };
+    engines.json = {
+      parse: JSON.parse.bind(JSON),
+      stringify: function(obj, options2) {
+        const opts = Object.assign({ replacer: null, space: 2 }, options2);
+        return JSON.stringify(obj, opts.replacer, opts.space);
+      }
+    };
+    engines.javascript = {
+      parse: function parse(str, options, wrap) {
+        try {
+          if (wrap !== false) {
+            str = "(function() {\nreturn " + str.trim() + ";\n}());";
+          }
+          return eval(str) || {};
+        } catch (err) {
+          if (wrap !== false && /(unexpected|identifier)/i.test(err.message)) {
+            return parse(str, options, false);
+          }
+          throw new SyntaxError(err);
+        }
+      },
+      stringify: function() {
+        throw new Error("stringifying JavaScript is not supported");
+      }
+    };
+  }
+});
+
+// node_modules/strip-bom-string/index.js
+var require_strip_bom_string = __commonJS({
+  "node_modules/strip-bom-string/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function(str2) {
+      if (typeof str2 === "string" && str2.charAt(0) === "\uFEFF") {
+        return str2.slice(1);
+      }
+      return str2;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/utils.js
+var require_utils = __commonJS({
+  "node_modules/gray-matter/lib/utils.js"(exports2) {
+    "use strict";
+    var stripBom = require_strip_bom_string();
+    var typeOf = require_kind_of();
+    exports2.define = function(obj, key, val) {
+      Reflect.defineProperty(obj, key, {
+        enumerable: false,
+        configurable: true,
+        writable: true,
+        value: val
+      });
+    };
+    exports2.isBuffer = function(val) {
+      return typeOf(val) === "buffer";
+    };
+    exports2.isObject = function(val) {
+      return typeOf(val) === "object";
+    };
+    exports2.toBuffer = function(input) {
+      return typeof input === "string" ? Buffer.from(input) : input;
+    };
+    exports2.toString = function(input) {
+      if (exports2.isBuffer(input)) return stripBom(String(input));
+      if (typeof input !== "string") {
+        throw new TypeError("expected input to be a string or buffer");
+      }
+      return stripBom(input);
+    };
+    exports2.arrayify = function(val) {
+      return val ? Array.isArray(val) ? val : [val] : [];
+    };
+    exports2.startsWith = function(str2, substr, len) {
+      if (typeof len !== "number") len = substr.length;
+      return str2.slice(0, len) === substr;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/defaults.js
+var require_defaults = __commonJS({
+  "node_modules/gray-matter/lib/defaults.js"(exports2, module2) {
+    "use strict";
+    var engines2 = require_engines();
+    var utils = require_utils();
+    module2.exports = function(options2) {
+      const opts = Object.assign({}, options2);
+      opts.delimiters = utils.arrayify(opts.delims || opts.delimiters || "---");
+      if (opts.delimiters.length === 1) {
+        opts.delimiters.push(opts.delimiters[0]);
+      }
+      opts.language = (opts.language || opts.lang || "yaml").toLowerCase();
+      opts.engines = Object.assign({}, engines2, opts.parsers, opts.engines);
+      return opts;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/engine.js
+var require_engine = __commonJS({
+  "node_modules/gray-matter/lib/engine.js"(exports2, module2) {
+    "use strict";
+    module2.exports = function(name, options2) {
+      let engine = options2.engines[name] || options2.engines[aliase(name)];
+      if (typeof engine === "undefined") {
+        throw new Error('gray-matter engine "' + name + '" is not registered');
+      }
+      if (typeof engine === "function") {
+        engine = { parse: engine };
+      }
+      return engine;
+    };
+    function aliase(name) {
+      switch (name.toLowerCase()) {
+        case "js":
+        case "javascript":
+          return "javascript";
+        case "coffee":
+        case "coffeescript":
+        case "cson":
+          return "coffee";
+        case "yaml":
+        case "yml":
+          return "yaml";
+        default: {
+          return name;
+        }
+      }
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/stringify.js
+var require_stringify = __commonJS({
+  "node_modules/gray-matter/lib/stringify.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var getEngine = require_engine();
+    var defaults = require_defaults();
+    module2.exports = function(file, data, options2) {
+      if (data == null && options2 == null) {
+        switch (typeOf(file)) {
+          case "object":
+            data = file.data;
+            options2 = {};
+            break;
+          case "string":
+            return file;
+          default: {
+            throw new TypeError("expected file to be a string or object");
+          }
+        }
+      }
+      const str2 = file.content;
+      const opts = defaults(options2);
+      if (data == null) {
+        if (!opts.data) return file;
+        data = opts.data;
+      }
+      const language = file.language || opts.language;
+      const engine = getEngine(language, opts);
+      if (typeof engine.stringify !== "function") {
+        throw new TypeError('expected "' + language + '.stringify" to be a function');
+      }
+      data = Object.assign({}, file.data, data);
+      const open = opts.delimiters[0];
+      const close = opts.delimiters[1];
+      const matter2 = engine.stringify(data, options2).trim();
+      let buf = "";
+      if (matter2 !== "{}") {
+        buf = newline(open) + newline(matter2) + newline(close);
+      }
+      if (typeof file.excerpt === "string" && file.excerpt !== "") {
+        if (str2.indexOf(file.excerpt.trim()) === -1) {
+          buf += newline(file.excerpt) + newline(close);
+        }
+      }
+      return buf + newline(str2);
+    };
+    function newline(str2) {
+      return str2.slice(-1) !== "\n" ? str2 + "\n" : str2;
+    }
+  }
+});
+
+// node_modules/gray-matter/lib/excerpt.js
+var require_excerpt = __commonJS({
+  "node_modules/gray-matter/lib/excerpt.js"(exports2, module2) {
+    "use strict";
+    var defaults = require_defaults();
+    module2.exports = function(file, options2) {
+      const opts = defaults(options2);
+      if (file.data == null) {
+        file.data = {};
+      }
+      if (typeof opts.excerpt === "function") {
+        return opts.excerpt(file, opts);
+      }
+      const sep2 = file.data.excerpt_separator || opts.excerpt_separator;
+      if (sep2 == null && (opts.excerpt === false || opts.excerpt == null)) {
+        return file;
+      }
+      const delimiter2 = typeof opts.excerpt === "string" ? opts.excerpt : sep2 || opts.delimiters[0];
+      const idx = file.content.indexOf(delimiter2);
+      if (idx !== -1) {
+        file.excerpt = file.content.slice(0, idx);
+      }
+      return file;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/to-file.js
+var require_to_file = __commonJS({
+  "node_modules/gray-matter/lib/to-file.js"(exports2, module2) {
+    "use strict";
+    var typeOf = require_kind_of();
+    var stringify = require_stringify();
+    var utils = require_utils();
+    module2.exports = function(file) {
+      if (typeOf(file) !== "object") {
+        file = { content: file };
+      }
+      if (typeOf(file.data) !== "object") {
+        file.data = {};
+      }
+      if (file.contents && file.content == null) {
+        file.content = file.contents;
+      }
+      utils.define(file, "orig", utils.toBuffer(file.content));
+      utils.define(file, "language", file.language || "");
+      utils.define(file, "matter", file.matter || "");
+      utils.define(file, "stringify", function(data, options2) {
+        if (options2 && options2.language) {
+          file.language = options2.language;
+        }
+        return stringify(file, data, options2);
+      });
+      file.content = utils.toString(file.content);
+      file.isEmpty = false;
+      file.excerpt = "";
+      return file;
+    };
+  }
+});
+
+// node_modules/gray-matter/lib/parse.js
+var require_parse = __commonJS({
+  "node_modules/gray-matter/lib/parse.js"(exports2, module2) {
+    "use strict";
+    var getEngine = require_engine();
+    var defaults = require_defaults();
+    module2.exports = function(language, str2, options2) {
+      const opts = defaults(options2);
+      const engine = getEngine(language, opts);
+      if (typeof engine.parse !== "function") {
+        throw new TypeError('expected "' + language + '.parse" to be a function');
+      }
+      return engine.parse(str2, opts);
+    };
+  }
+});
+
+// node_modules/gray-matter/index.js
+var require_gray_matter = __commonJS({
+  "node_modules/gray-matter/index.js"(exports2, module2) {
+    "use strict";
+    var fs4 = __require("fs");
+    var sections = require_section_matter();
+    var defaults = require_defaults();
+    var stringify = require_stringify();
+    var excerpt = require_excerpt();
+    var engines2 = require_engines();
+    var toFile = require_to_file();
+    var parse2 = require_parse();
+    var utils = require_utils();
+    function matter2(input, options2) {
+      if (input === "") {
+        return { data: {}, content: input, excerpt: "", orig: input };
+      }
+      let file = toFile(input);
+      const cached = matter2.cache[file.content];
+      if (!options2) {
+        if (cached) {
+          file = Object.assign({}, cached);
+          file.orig = cached.orig;
+          return file;
+        }
+        matter2.cache[file.content] = file;
+      }
+      return parseMatter(file, options2);
+    }
+    function parseMatter(file, options2) {
+      const opts = defaults(options2);
+      const open = opts.delimiters[0];
+      const close = "\n" + opts.delimiters[1];
+      let str2 = file.content;
+      if (opts.language) {
+        file.language = opts.language;
+      }
+      const openLen = open.length;
+      if (!utils.startsWith(str2, open, openLen)) {
+        excerpt(file, opts);
+        return file;
+      }
+      if (str2.charAt(openLen) === open.slice(-1)) {
+        return file;
+      }
+      str2 = str2.slice(openLen);
+      const len = str2.length;
+      const language = matter2.language(str2, opts);
+      if (language.name) {
+        file.language = language.name;
+        str2 = str2.slice(language.raw.length);
+      }
+      let closeIndex = str2.indexOf(close);
+      if (closeIndex === -1) {
+        closeIndex = len;
+      }
+      file.matter = str2.slice(0, closeIndex);
+      const block = file.matter.replace(/^\s*#[^\n]+/gm, "").trim();
+      if (block === "") {
+        file.isEmpty = true;
+        file.empty = file.content;
+        file.data = {};
+      } else {
+        file.data = parse2(file.language, file.matter, opts);
+      }
+      if (closeIndex === len) {
+        file.content = "";
+      } else {
+        file.content = str2.slice(closeIndex + close.length);
+        if (file.content[0] === "\r") {
+          file.content = file.content.slice(1);
+        }
+        if (file.content[0] === "\n") {
+          file.content = file.content.slice(1);
+        }
+      }
+      excerpt(file, opts);
+      if (opts.sections === true || typeof opts.section === "function") {
+        sections(file, opts.section);
+      }
+      return file;
+    }
+    matter2.engines = engines2;
+    matter2.stringify = function(file, data, options2) {
+      if (typeof file === "string") file = matter2(file, options2);
+      return stringify(file, data, options2);
+    };
+    matter2.read = function(filepath, options2) {
+      const str2 = fs4.readFileSync(filepath, "utf8");
+      const file = matter2(str2, options2);
+      file.path = filepath;
+      return file;
+    };
+    matter2.test = function(str2, options2) {
+      return utils.startsWith(str2, defaults(options2).delimiters[0]);
+    };
+    matter2.language = function(str2, options2) {
+      const opts = defaults(options2);
+      const open = opts.delimiters[0];
+      if (matter2.test(str2)) {
+        str2 = str2.slice(open.length);
+      }
+      const language = str2.slice(0, str2.search(/\r?\n/));
+      return {
+        raw: language,
+        name: language ? language.trim() : ""
+      };
+    };
+    matter2.cache = {};
+    matter2.clearCache = function() {
+      matter2.cache = {};
+    };
+    module2.exports = matter2;
+  }
+});
+
 // spex-console/bin/hs-init.ts
 import {
   copyFileSync,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync4,
-  readdirSync,
-  readFileSync as readFileSync8,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync6,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync11,
   statSync,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { dirname as dirname5, join as join9, resolve as resolve5 } from "node:path";
-import process3 from "node:process";
+import { dirname as dirname6, join as join11, resolve as resolve5 } from "node:path";
+import process4 from "node:process";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // scripts/lib/shared-path-helpers.mjs
 import { isAbsolute, resolve, sep } from "node:path";
@@ -228,13 +936,13 @@ The vault under \`specs/\` is the only persistent queue. File new work via \`hey
 This CLAUDE.md was generated for **${vaultName}** from HeySpex template version **${templateVersion}** \u2014 it is yours to edit. Unlike HeySpex's own platform contract (which carries HeySpex's internal build tooling), everything above applies to *your* vault and *your* agents. Edit it freely as your project's conventions evolve; a later template update will not overwrite your changes.
 `;
 }
-function writeProjectContract(ctx, options = {}) {
+function writeProjectContract(ctx, options2 = {}) {
   const content = renderCustomerClaudeMd({
     vaultName: ctx.vaultName,
     templateVersion: ctx.templateVersion
   });
   const results = [];
-  for (const file of options.files ?? ["CLAUDE.md"]) {
+  for (const file of options2.files ?? ["CLAUDE.md"]) {
     const destPath = ctx.deps.joinPath(ctx.targetDir, file);
     if (!ctx.deps.exists(destPath)) {
       ctx.deps.writeFile(destPath, content);
@@ -252,7 +960,7 @@ function writeProjectContract(ctx, options = {}) {
       ctx.recordWrite?.(templatePath);
     }
     const hint = `${file} already exists - left untouched. Generated contract written to ${file}.template; compare with: diff ${file} ${file}.template`;
-    options.notify?.(hint);
+    options2.notify?.(hint);
     results.push({ file, action: "template", path: templatePath, hint });
   }
   return results;
@@ -267,9 +975,10 @@ function customerClaudeMdHook(notify) {
 import { randomUUID } from "node:crypto";
 
 // scripts/lib/console-url-resolver.mjs
+init_heyspex_home();
 init_dev_mode();
 import { readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { join as join3 } from "node:path";
 var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
 function trimTrailingSlash(url) {
@@ -296,7 +1005,7 @@ function warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log }) {
   } catch {
   }
 }
-function readCredentialsConsoleUrl({ homeDir = homedir3(), readFile = defaultReadFile2 } = {}) {
+function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile = defaultReadFile2 } = {}) {
   try {
     const raw = readFile(join3(homeDir, ".heyspex", "credentials.yaml"));
     const match = String(raw ?? "").match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
@@ -340,7 +1049,7 @@ function resolveModeEnvelope({ env, homeDir }) {
 function resolveConsoleUrl({
   repoRoot,
   env = process.env,
-  homeDir = homedir3(),
+  homeDir = heyspexHome(),
   strict = false,
   devMode,
   log = (line) => process.stderr.write(line),
@@ -392,15 +1101,17 @@ function shellQuote(p) {
 var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
 
 // vendor/heyspex-mcp/console-fetch.mjs
+init_heyspex_home();
 init_credentials();
-import { readFileSync as readFileSync6 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join7 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
 
 // vendor/heyspex-mcp/session-owner.mjs
+init_heyspex_home();
 init_credentials();
 import { readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join5 } from "node:path";
 
 // vendor/heyspex-mcp/vault-less-endpoints.mjs
@@ -414,10 +1125,23 @@ var VAULT_LESS_ENDPOINTS = Object.freeze([
   "* /api/admin/dev-mode"
 ]);
 
+// vendor/heyspex-mcp/write-outbox.mjs
+import {
+  readdirSync,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3,
+  mkdirSync as mkdirSync3,
+  existsSync as existsSync2,
+  renameSync as renameSync2,
+  rmSync
+} from "node:fs";
+import { basename, join as join6, isAbsolute as isAbsolute2 } from "node:path";
+
 // vendor/heyspex-mcp/vault-resolve.mjs
-import { existsSync as existsSync2, readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir5, tmpdir } from "node:os";
-import { dirname as dirname3, join as join6, resolve as resolve3 } from "node:path";
+init_heyspex_home();
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
+import { homedir as homedir6, tmpdir } from "node:os";
+import { dirname as dirname3, join as join7, resolve as resolve3 } from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
@@ -426,9 +1150,11 @@ var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMAT
 init_credentials();
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync7, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { dirname as dirname4, join as join8, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join9, resolve as resolve4 } from "node:path";
+
+// spex-console/src/lib/heyspex-home.ts
+import { homedir as homedir8 } from "node:os";
 
 // spex-console/src/lib/cli/control-shared.ts
 var EXIT = {
@@ -626,10 +1352,10 @@ function parseInitArgs(argv) {
 }
 var HEYSPEX_CONFIG_DIR = ".heyspex";
 var HEYSPEX_CONFIG_FILE = "config.yaml";
-function seedConfigYaml(root, readSeed, fs) {
-  const configDir = fs.joinPath(root, HEYSPEX_CONFIG_DIR);
-  const configPath = fs.joinPath(configDir, HEYSPEX_CONFIG_FILE);
-  if (fs.exists(configPath)) return { status: "kept", path: configPath };
+function seedConfigYaml(root, readSeed, fs4) {
+  const configDir = fs4.joinPath(root, HEYSPEX_CONFIG_DIR);
+  const configPath = fs4.joinPath(configDir, HEYSPEX_CONFIG_FILE);
+  if (fs4.exists(configPath)) return { status: "kept", path: configPath };
   if (!readSeed) return { status: "no_seed", path: configPath };
   let seed;
   try {
@@ -638,8 +1364,8 @@ function seedConfigYaml(root, readSeed, fs) {
     seed = null;
   }
   if (seed === null) return { status: "no_seed", path: configPath };
-  fs.mkdirRecursive(configDir);
-  fs.writeFile(configPath, seed);
+  fs4.mkdirRecursive(configDir);
+  fs4.writeFile(configPath, seed);
   return { status: "seeded", path: configPath };
 }
 function renderHeyspexYaml(args) {
@@ -765,7 +1491,7 @@ function runInit(args, deps) {
     };
   }
   const vaultId = existingVaultId ?? args.adoptedVaultId ?? mintVaultId();
-  const accountId = args.accountId ?? (existingContent ? parseAccountId(existingContent) : null);
+  const accountId = null;
   const content = renderHeyspexYaml({ ...args, vaultId, accountId });
   try {
     deps.writeFile(markerPath, content);
@@ -849,7 +1575,7 @@ var HELP = [
 ].join("\n");
 
 // spex-console/src/lib/cli/init.customer-vault.ts
-import { basename } from "node:path";
+import { basename as basename2 } from "node:path";
 
 // spex-console/src/lib/cli/template-manifest.sources.mjs
 var UNIVERSAL_TEMPLATE_ROWS = [
@@ -1335,10 +2061,10 @@ var SCAFFOLD_FOLDERS = [
   "events"
 ];
 var PLACEHOLDER_FILES = /* @__PURE__ */ new Set([".gitkeep"]);
-function isDir(deps, path2, name) {
-  if (deps.isDirectory) return deps.isDirectory(path2);
+function isDir(deps, path5, name) {
+  if (deps.isDirectory) return deps.isDirectory(path5);
   try {
-    const kids = deps.readdir(path2);
+    const kids = deps.readdir(path5);
     return kids.length > 0 || !name.includes(".");
   } catch {
     return false;
@@ -1360,12 +2086,12 @@ function findManagedSpecs(deps, targetDir, manifestDests) {
   return out;
 }
 function defaultVaultName(targetDir) {
-  return basename(targetDir) || targetDir;
+  return basename2(targetDir) || targetDir;
 }
-function runCustomerVaultInit(args, deps, options = {}) {
+function runCustomerVaultInit(args, deps, options2 = {}) {
   const { targetDir } = args;
   const written = [];
-  const filter = options.manifestFilter ?? (() => true);
+  const filter = options2.manifestFilter ?? (() => true);
   const rows = TEMPLATE_MANIFEST.filter(filter);
   if (deps.exists(targetDir)) {
     const markerPresent = deps.exists(deps.joinPath(targetDir, "heyspex.yaml"));
@@ -1409,7 +2135,7 @@ function runCustomerVaultInit(args, deps, options = {}) {
     deps.writeFile(
       heyspexYamlPath,
       renderHeyspexYaml({
-        consoleUrl: options.consoleUrl ?? DEFAULT_CONSOLE_URL2,
+        consoleUrl: options2.consoleUrl ?? DEFAULT_CONSOLE_URL2,
         vaultRoot: "specs/",
         vaultId
       })
@@ -1444,19 +2170,19 @@ function runCustomerVaultInit(args, deps, options = {}) {
     written.push(destAbs);
     rowResults.push({ dest: row.dest, action: "created" });
   }
-  if (options.afterScaffold && options.afterScaffold.length > 0) {
+  if (options2.afterScaffold && options2.afterScaffold.length > 0) {
     const ctx = {
       targetDir,
-      vaultName: options.vaultName ?? defaultVaultName(targetDir),
+      vaultName: options2.vaultName ?? defaultVaultName(targetDir),
       templateVersion: TEMPLATE_VERSION,
       manifestRows: rows,
       rows: rowResults,
       deps,
-      recordWrite: (path2) => {
-        written.push(path2);
+      recordWrite: (path5) => {
+        written.push(path5);
       }
     };
-    for (const hook of options.afterScaffold) hook(ctx);
+    for (const hook of options2.afterScaffold) hook(ctx);
   }
   const createdCount = rowResults.filter((r) => r.action === "created").length;
   const keptCount = rowResults.length - createdCount;
@@ -1544,15 +2270,1102 @@ function gitFinalizeHook(runner, notify) {
   };
 }
 
+// spex-console/src/lib/cli/install.ts
+import { isAbsolute as isAbsolute3, resolve as resolveNodePath2 } from "node:path";
+
+// scripts/install-cursor-hooks.mjs
+import fs2 from "node:fs";
+import path3 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// scripts/cursor-hooks/manifest.mjs
+var SHIM = "scripts/cursor-hooks/_run.mjs";
+var DEFAULT_TIMEOUT_SECONDS = 5;
+var HOOKS = [
+  // ── Session start ───────────────────────────────────────────────────────
+  // Cursor's sessionStart honors `additional_context`, so these injections
+  // land in context exactly as they do in Claude Code.
+  { event: "sessionStart", hook: "wip-checkpoint", why: "Surface the previous session WIP handoff before work resumes." },
+  { event: "sessionStart", hook: "inject-dev-server-awareness", why: "Once-per-session reminder that dev-server status is a tool call, not a guess." },
+  { event: "sessionStart", hook: "inject-coo-seat", why: "Inject the dev-factory COO seat mandate when the COO window is open." },
+  { event: "sessionStart", hook: "inject-doctrine", why: "Inject the baseline SpexCode Doctrine edition at session start." },
+  { event: "sessionStart", hook: "coo-guard-check", why: "Warn at session start when a breakdown has not been delegated." },
+  { event: "sessionStart", hook: "check-auto-memory-budget", why: "Self-heal and budget-check the auto-memory index." },
+  { event: "sessionStart", hook: "check-claude-md-budget", why: "Advisory budget check on the always-loaded agent contract." },
+  { event: "sessionStart", hook: "check-mcp-freshness-hook", why: "Warn when the running MCP server is stale versus vendor." },
+  { event: "sessionStart", hook: "git-reflog-audit", why: "Session-start git audit (stash/reset/rebase witness)." },
+  { event: "sessionStart", hook: "vault-mirror-catchup", why: "Cloud write mode: detached hs pull --apply closes a stale disk mirror (HS-XJFQ)." },
+  // ── Compaction ──────────────────────────────────────────────────────────
+  // Claude re-runs SessionStart(source: compact) after compaction; Cursor fires
+  // preCompact BEFORE it, so the shim relays this one as SessionStart(compact)
+  // to keep wip-checkpoint's "rollover, not fresh start" framing.
+  { event: "preCompact", hook: "wip-checkpoint", claudeEvent: "SessionStart", why: "Carry the WIP handoff across a context compaction." },
+  // ── Every user turn ─────────────────────────────────────────────────────
+  // beforeSubmitPrompt is Cursor's UserPromptSubmit. It honors `user_message`
+  // but not `additional_context`, so these three surface in the transcript
+  // rather than as invisible context — the routing still reaches the agent,
+  // and the user can see why it fired.
+  { event: "beforeSubmitPrompt", hook: "preflight-reminder", why: "Name the required procedure before a filing/destructive/protocol turn." },
+  { event: "beforeSubmitPrompt", hook: "intent-classifier-trigger", why: "Route capture / research / settings / defer intents to the right skill." },
+  { event: "beforeSubmitPrompt", hook: "inject-communication-style", why: "Re-assert the plain-language communication rules each turn." },
+  { event: "beforeSubmitPrompt", hook: "inject-vault-context", timeout: 10, why: "Lexical vault retrieval for the prompt (surfaced as a user message)." },
+  // ── Before every tool call (any tool) ───────────────────────────────────
+  { event: "preToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PreToolUse"], why: "Claim liveness heartbeat to the console." },
+  { event: "preToolUse", matcher: ".*", hook: "coo-denylist-gate", why: "Hard deny the COO-window deny list." },
+  { event: "preToolUse", matcher: ".*", hook: "log-session-activity", args: ["--event=PreToolUse"], why: "Append agent.tool_called rows to the session log." },
+  // ── Before a file write / delete ─────────────────────────────────────────
+  // Cursor's `Write` covers create AND patch (Claude's Write|Edit|MultiEdit);
+  // the shim re-derives which one from the input shape. `Delete` is included on
+  // the vault guard because removing a profile file is the loss it exists to
+  // prevent, and Claude had no separate delete tool to list.
+  { event: "preToolUse", matcher: "Write|Delete", hook: "env-vault-guard", why: "Block destructive writes to the encrypted env vault (ALWAYS ON)." },
+  { event: "preToolUse", matcher: "Write", hook: "vault-write-tier-guard", why: "Deny disk writes to vault specs in cloud write mode (HS-FCNH)." },
+  { event: "preToolUse", matcher: "Write", hook: "settings-write-gate", why: "Require approval before .heyspex/config.yaml changes." },
+  { event: "preToolUse", matcher: "Write", hook: "enforce-vault-naming", why: "Block vault filenames that violate the naming registry." },
+  { event: "preToolUse", matcher: "Write", hook: "guard-auto-memory-writes", why: "Block new topic files in the auto-memory directory." },
+  { event: "preToolUse", matcher: "Write", hook: "preflight-reminder", why: "Preflight reminder on the edit path itself." },
+  { event: "preToolUse", matcher: "Write", hook: "claim-before-code-gate", why: "Deny the first code edit after plan exit with no claim." },
+  { event: "preToolUse", matcher: "Write", hook: "directive-obligation-gate", why: "Deny product-code writes while a capture_on_idea obligation is unmet, and (claim-before-build) with no claim/capture (HS-20SW)." },
+  // ── Before a shell command ──────────────────────────────────────────────
+  // beforeShellExecution, not preToolUse/Shell: it is the only event guaranteed
+  // to carry the command string, and Cursor honors allow/deny/ask on it.
+  { event: "beforeShellExecution", hook: "env-vault-guard", why: "Block shell writes/exfiltration targeting the env vault (ALWAYS ON)." },
+  { event: "beforeShellExecution", hook: "vault-write-tier-guard", why: "Deny shell writes to vault specs in cloud write mode (HS-FCNH)." },
+  { event: "beforeShellExecution", hook: "settings-write-gate", why: "Catch shell writes to .heyspex/config.yaml." },
+  { event: "beforeShellExecution", hook: "enforce-vault-naming", why: "Catch vault files created via the shell." },
+  { event: "beforeShellExecution", hook: "guard-auto-memory-writes", why: "Catch auto-memory topic files created via the shell." },
+  { event: "beforeShellExecution", hook: "preflight-reminder", why: "Preflight reminder on rm -rf / force-push shaped commands." },
+  { event: "beforeShellExecution", hook: "dev-server-task-reminder", timeout: 10, why: "Dev-server start/stop hard gate plus DB-safety reminder." },
+  { event: "beforeShellExecution", hook: "git-stash-gate", timeout: 10, why: "Always ask before a mutating git stash." },
+  { event: "beforeShellExecution", hook: "git-identity-guard", why: "Agents never write git identity (owner ruling 2026-09-19, ALWAYS ON)." },
+  { event: "beforeShellExecution", hook: "capture-execution-gate", why: "Block dev-factory research/paid-model/routing shell commands past an ungrounded capture (HS-KNJ8, platform)." },
+  { event: "beforeShellExecution", hook: "directive-obligation-gate", why: "Deny build commands and product-code shell writes while a capture obligation is unmet (HS-20SW)." },
+  // ── Before specific MCP tools ───────────────────────────────────────────
+  // Cursor fires preToolUse for MCP tools too (matcher `MCP:<name>`), so these
+  // stay on preToolUse rather than beforeMCPExecution — registering both would
+  // fire each gate twice. Scoping is the shim's `tool` regex because a Cursor
+  // matcher cannot name one MCP tool per entry portably.
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_claim_spec$", hook: "coo-guard-check", why: "Block a claim whose breakdown was never delegated." },
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_file_spec$", hook: "capture-workflow-gate", timeout: 8, why: "Deny filing an implementation spec straight out of an open capture." },
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_settings_set$", hook: "settings-write-gate", why: "Require approval for settings changes made through MCP." },
+  { event: "preToolUse", matcher: ".*", tool: "[Nn]eon__(prepare_database_migration|complete_database_migration|reset_from_parent|delete_branch)$", hook: "dev-server-task-reminder", timeout: 10, why: "DB-safety gate on Neon migration/reset/delete tools." },
+  { event: "preToolUse", matcher: ".*", tool: "heyspex_file_spec$", hook: "diagnose-capture-reminder", why: "Warn when a diagnose is filed with no capture holding the owner words (HS-IK2D)." },
+  { event: "preToolUse", matcher: ".*", tool: "^(Workflow|Skill)$", hook: "research-method-guard", why: "Research method guard on Skill/Workflow launches (HS-EN4F, ALWAYS ON)." },
+  { event: "preToolUse", matcher: ".*", tool: "^(Workflow|Skill)$", hook: "deep-research-cost-gate", why: "Cost confirmation before a paid deep-research harness launch." },
+  { event: "preToolUse", matcher: ".*", tool: "^(WebSearch|WebFetch|web_search|web_fetch)$|heyspex_save_research$", hook: "research-protocol-gate", why: "WebSearch/WebFetch/save_research refused until the research preflight ran (HS-K0ZP, HS-EN4F)." },
+  // ── Before a subagent spawn ─────────────────────────────────────────────
+  // subagentStart over preToolUse/Task: it carries subagent_type and the model,
+  // which is exactly what the routing gate decides on, and it can deny.
+  { event: "subagentStart", hook: "agent-spawn-delegation-gate", why: "Block a build/breakdown/critic subagent on an off-routing model." },
+  { event: "subagentStart", hook: "capture-execution-gate", why: "Block a dev-factory subagent spawn past an ungrounded capture (HS-KNJ8, platform)." },
+  { event: "subagentStart", hook: "directive-obligation-gate", why: "Deny a build subagent while a capture obligation is unmet or the session has no claim/capture (HS-20SW)." },
+  // ── After every tool call ───────────────────────────────────────────────
+  { event: "postToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PostToolUse"], why: "Claim liveness heartbeat after the call resolves." },
+  { event: "postToolUse", matcher: ".*", hook: "log-session-activity", args: ["--event=PostToolUse"], why: "Append the tool result row to the session log." },
+  { event: "postToolUse", matcher: ".*", hook: "directive-obligation-gate", why: "Discharge the capture obligation on a capture write; track claim acquire/release (HS-20SW)." },
+  { event: "postToolUse", matcher: ".*", hook: "close-terminal-on-ship", why: "Close the Launch terminal once the spec ships." },
+  { event: "postToolUse", matcher: "Write", hook: "notify-status-flip", why: "Sound on an in_review status flip." },
+  { event: "postToolUse", matcher: "Write", hook: "scripts/stamp-provenance-on-edit.mjs", why: "Stamp assisted_by provenance on direct spec edits." },
+  // afterFileEdit is a distinct signal, not a duplicate: it reports the edit
+  // that actually landed (with old/new strings) even when the write came from a
+  // path postToolUse did not describe as an edit.
+  { event: "afterFileEdit", matcher: ".*", hook: "close-terminal-on-ship", why: "Ship detection from the concrete file edit." },
+  // ── End of the agent turn ───────────────────────────────────────────────
+  // Cursor's `stop` honors `followup_message`, which is how a blocking Stop
+  // hook re-drives the agent — the same effect as Claude's exit-2 block.
+  { event: "stop", hook: "emit-claim-status", args: ["--event=Stop"], why: "Mark the claim pending-on-response." },
+  { event: "stop", hook: "naughty-list-gate", why: "Re-drive the turn when the final message uses banned jargon." },
+  { event: "stop", hook: "id-display-format-gate", why: "Re-drive the turn when a reply breaks the Naming V3 display-id format." },
+  { event: "stop", hook: "epic-milestone-phrasing-gate", why: "Re-drive the turn when a reply breaks the epic/milestone phrasing rules." },
+  { event: "stop", hook: "git-reflog-audit", why: "Session-close git audit backstop (stash/reset/rebase witness)." },
+  { event: "stop", hook: "enforce-session-sequence", why: "Re-drive the turn when work shipped without record_wip." },
+  { event: "stop", hook: "directive-obligation-gate", why: "Re-drive the turn ONCE (followup_message) when a capture obligation is still unmet (HS-20SW)." },
+  // ── Session end ─────────────────────────────────────────────────────────
+  { event: "sessionEnd", hook: "session-end", why: "Release the claim and notify the console." },
+  { event: "sessionEnd", hook: "close-terminal-on-ship", why: "Final terminal cleanup." }
+];
+var UNPORTABLE = [
+  {
+    hook: "plan-review-gate",
+    claudeEvent: "PreToolUse/ExitPlanMode",
+    reason: "Cursor exposes no ExitPlanMode tool call to hooks.",
+    coveredBy: ".cursor/rules/plan-review-required.mdc (always-on rule)"
+  },
+  {
+    hook: "plan-exit-ingest-gate",
+    claudeEvent: "PreToolUse/ExitPlanMode",
+    reason: "Same missing trigger; it is also what arms claim-before-code-gate.",
+    coveredBy: ".cursor/rules/plan-review-required.mdc + spec-creation-linkage.mdc"
+  }
+];
+function commandFor(entry) {
+  const parts = ["node", SHIM, entry.hook];
+  if (entry.tool) parts.push(`--hs-tool="${entry.tool}"`);
+  if (entry.claudeEvent) parts.push(`--hs-claude-event=${entry.claudeEvent}`);
+  for (const arg of entry.args ?? []) parts.push(arg);
+  return parts.join(" ");
+}
+function commandForPlugin(entry) {
+  return commandFor(entry).replace(`node ${SHIM}`, `node "$CURSOR_PROJECT_DIR/${SHIM}"`);
+}
+var CUSTOMER_LAUNCHER = ".cursor/heyspex/run-hook.mjs";
+function commandForCustomer(entry) {
+  return commandFor(entry).replace(`node ${SHIM}`, `node "$CURSOR_PROJECT_DIR/${CUSTOMER_LAUNCHER}"`);
+}
+function identityFor(entry) {
+  return `${entry.hook}::${entry.tool ?? ""}::${(entry.args ?? []).join(" ")}`;
+}
+function timeoutFor(entry) {
+  return entry.timeout ?? DEFAULT_TIMEOUT_SECONDS;
+}
+
+// scripts/lib/customer-kit.mjs
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path2 from "node:path";
+import os2 from "node:os";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+
+// scripts/lib/hook-dispositions.mjs
+var HOSTS = Object.freeze(["claude-code", "cursor", "copilot"]);
+var DISPOSITIONS = Object.freeze(["mapped", "advisory-degraded", "unportable", "not-shipped"]);
+var mapped = (note) => Object.freeze({ disposition: "mapped", ...note ? { note } : {} });
+var degraded = (note) => Object.freeze({ disposition: "advisory-degraded", note });
+var unportable = (control) => Object.freeze({ disposition: "unportable", control });
+var notShipped = Object.freeze({ disposition: "not-shipped" });
+var CC = mapped();
+var COPILOT_PROMPT_DROPPED = "Copilot drops command-hook output on userPromptSubmitted (no prompt-time context channel); the text moves to sessionStart / .github/copilot-instructions.md.";
+var CURSOR_PROMPT_USER_MESSAGE = "Cursor beforeSubmitPrompt honors user_message only (no additional_context): the text surfaces in the transcript instead of as invisible context.";
+var COPILOT_NO_PLAN_TOOL = "MCP preflight refusals (heyspex_claim_spec / heyspex_submit_for_review / heyspex_save_research) + .github/copilot-instructions.md plan rule (state the plan in chat, claim the spec before editing) + HS-20SW directive-obligation-gate claim-before-build deny";
+var HOOK_DISPOSITIONS = Object.freeze({
+  // ── customer: session start / compaction ──────────────────────────────────
+  "wip-checkpoint": {
+    "claude-code": CC,
+    cursor: mapped("preCompact is relayed as SessionStart(compact)."),
+    copilot: mapped("sessionStart additionalContext is delivered; the preCompact leg writes WIP only (no output channel), re-injected at the next sessionStart.")
+  },
+  "inject-doctrine": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext.") },
+  "check-auto-memory-budget": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext.") },
+  "check-claude-md-budget": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext.") },
+  "git-reflog-audit": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionStart additionalContext and agentStop.") },
+  "vault-mirror-catchup": { "claude-code": CC, cursor: mapped(), copilot: mapped("Detached side effect on sessionStart.") },
+  // ── customer: every user turn ─────────────────────────────────────────────
+  "preflight-reminder": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(`${COPILOT_PROMPT_DROPPED} Real enforcement is the MCP preflight refusal.`)
+  },
+  "intent-classifier-trigger": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(
+      `${COPILOT_PROMPT_DROPPED} The hook still runs and arms obligation state; the HS-20SW directive-obligation-gate turns that state into a hard deny.`
+    )
+  },
+  "inject-communication-style": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(COPILOT_PROMPT_DROPPED)
+  },
+  "inject-vault-context": {
+    "claude-code": CC,
+    cursor: degraded(CURSOR_PROMPT_USER_MESSAGE),
+    copilot: degraded(`${COPILOT_PROMPT_DROPPED} Per-prompt vault retrieval has no Copilot channel at all.`)
+  },
+  // ── customer: before a tool call (hard gates) ─────────────────────────────
+  "git-identity-guard": { "claude-code": CC, cursor: mapped("beforeShellExecution. Always on."), copilot: mapped("preToolUse on bash/powershell. Always on.") },
+  "vault-write-tier-guard": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/edit/bash/powershell.") },
+  "settings-write-gate": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/edit/bash/powershell and the MCP settings tool.") },
+  "emit-claim-status": { "claude-code": CC, cursor: mapped(), copilot: mapped("Telemetry on preToolUse/postToolUse/agentStop; the cloud agent needs a network allow rule for the console.") },
+  "enforce-vault-naming": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/bash/powershell.") },
+  "guard-auto-memory-writes": { "claude-code": CC, cursor: mapped(), copilot: mapped("preToolUse on create/bash/powershell.") },
+  "directive-obligation-gate": {
+    "claude-code": CC,
+    cursor: mapped(),
+    copilot: mapped("HS-20SW: hard deny on task/create/edit/write-shaped shell while a capture obligation is unmet; the only hard capture-on-idea guarantee on Copilot.")
+  },
+  "claim-before-code-gate": {
+    "claude-code": CC,
+    cursor: degraded("Armed only by plan-exit-ingest-gate, which has no Cursor trigger, so it stays dormant; covered by the HS-20SW claim-before-build rule."),
+    copilot: degraded("Armed only by plan-exit-ingest-gate, which has no Copilot trigger (no ExitPlanMode tool), so it stays dormant; covered by the HS-20SW claim-before-build rule.")
+  },
+  "capture-workflow-gate": {
+    "claude-code": CC,
+    cursor: mapped(),
+    copilot: mapped("preToolUse on the MCP heyspex_file_spec tool; MCP tool naming in hook payloads is unverified live (matched by suffix).")
+  },
+  "diagnose-capture-reminder": {
+    "claude-code": CC,
+    cursor: mapped("preToolUse agent_message delivers the reminder."),
+    copilot: degraded("Copilot preToolUse has no context channel for an inject, so this advisory is silent (lost).")
+  },
+  "git-stash-gate": {
+    "claude-code": CC,
+    cursor: mapped(),
+    copilot: mapped('The Claude "ask" becomes a deny where no user is present (cloud agent, CLI autopilot).')
+  },
+  "research-protocol-gate": { "claude-code": CC, cursor: mapped("Always on."), copilot: mapped("preToolUse on web_fetch/web_search and the MCP save_research tool. Always on; the MCP refusal duplicates it.") },
+  "research-method-guard": {
+    "claude-code": CC,
+    cursor: mapped("preToolUse with a Skill|Workflow tool filter. Always on."),
+    copilot: unportable("MCP preflight refusal on heyspex_save_research (hard floor, hook-independent) + .github/copilot-instructions.md research rule; Copilot has no Skill or Workflow tool to hook.")
+  },
+  "deep-research-cost-gate": {
+    "claude-code": CC,
+    cursor: mapped("preToolUse with a Workflow|Skill tool filter."),
+    copilot: unportable("MCP preflight refusal on heyspex_save_research + .github/copilot-instructions.md cost-confirmation rule; Copilot has no Skill or Workflow tool to hook.")
+  },
+  "plan-review-gate": {
+    "claude-code": CC,
+    cursor: unportable(".cursor/rules/plan-review-required.mdc (always-on rule)"),
+    copilot: unportable(COPILOT_NO_PLAN_TOOL)
+  },
+  "plan-exit-ingest-gate": {
+    "claude-code": CC,
+    cursor: unportable(".cursor/rules/plan-review-required.mdc + spec-creation-linkage.mdc"),
+    copilot: unportable(COPILOT_NO_PLAN_TOOL)
+  },
+  // ── customer: end of turn / session ───────────────────────────────────────
+  "naughty-list-gate": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped('agentStop {decision:"block"} re-drive, capped at 8 consecutive blocks.') },
+  "id-display-format-gate": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped("agentStop re-drive; reads the transcript (format is not a stable API).") },
+  "epic-milestone-phrasing-gate": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped("agentStop re-drive; reads the transcript (format is not a stable API).") },
+  "enforce-session-sequence": { "claude-code": CC, cursor: mapped("stop followup_message re-drive."), copilot: mapped("agentStop re-drive, capped at 8 consecutive blocks.") },
+  "notify-status-flip": { "claude-code": CC, cursor: mapped(), copilot: mapped("Side effect on postToolUse.") },
+  "close-terminal-on-ship": { "claude-code": CC, cursor: mapped(), copilot: mapped("Side effect on postToolUse / sessionEnd.") },
+  "scripts/stamp-provenance-on-edit.mjs": { "claude-code": CC, cursor: mapped(), copilot: mapped("Side effect on postToolUse.") },
+  "session-end": { "claude-code": CC, cursor: mapped(), copilot: mapped("sessionEnd.") },
+  // ── platform: heyspex-app development machinery (never installed in a customer repo) ──
+  "inject-dev-server-awareness": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "inject-coo-seat": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "coo-guard-check": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "coo-denylist-gate": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "agent-spawn-delegation-gate": { "claude-code": CC, cursor: mapped("subagentStart."), copilot: notShipped },
+  "capture-execution-gate": { "claude-code": CC, cursor: mapped("beforeShellExecution + subagentStart."), copilot: notShipped },
+  "check-mcp-freshness-hook": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "dev-server-task-reminder": { "claude-code": CC, cursor: mapped(), copilot: notShipped },
+  "env-vault-guard": { "claude-code": CC, cursor: mapped("Always on."), copilot: notShipped },
+  "log-session-activity": { "claude-code": CC, cursor: mapped(), copilot: notShipped }
+});
+function dispositionFor(hook, host) {
+  return HOOK_DISPOSITIONS[hook]?.[host] ?? null;
+}
+
+// scripts/lib/customer-kit.mjs
+var HOOK_SCOPES = Object.freeze({
+  // ── customer: vault / workflow / safety gates ─────────────────────────────
+  "wip-checkpoint": { scope: "customer", why: "Previous-session WIP handoff, read from the active vault." },
+  "inject-doctrine": {
+    scope: "customer",
+    why: "Owner ruling 2026-10-03 (HS-A2PO): ships. A customer session gets the baseline edition of SpexCode Doctrine (CUSTOMER_HOOK_DATA), the foundation its own learned layer is built on; never the platform's learned file."
+  },
+  "check-auto-memory-budget": { scope: "customer", why: "Auto-memory index budget for the session project." },
+  "check-claude-md-budget": { scope: "customer", why: "Budget check on the project's always-loaded agent contract." },
+  "git-reflog-audit": { scope: "customer", why: "Session-close git audit backstop (stash/reset/rebase witness)." },
+  "preflight-reminder": { scope: "customer", why: "Names the required procedure before filing/destructive turns." },
+  "intent-classifier-trigger": { scope: "customer", why: "Routes capture/research/settings/defer intents." },
+  "inject-communication-style": { scope: "customer", why: "Plain-language communication rules each turn." },
+  "inject-vault-context": { scope: "customer", why: "Lexical vault retrieval for the prompt." },
+  "git-identity-guard": { scope: "customer", why: "Agents never write git identity (owner ruling 2026-09-19)." },
+  "vault-write-tier-guard": { scope: "customer", why: "Cloud write mode: disk edits to vault specs are a mirror the console never reads back (HS-FCNH)." },
+  "settings-write-gate": { scope: "customer", why: "Approval before the vault's .heyspex/config.yaml changes." },
+  "emit-claim-status": { scope: "customer", why: "Claim liveness heartbeat to the console." },
+  "enforce-vault-naming": { scope: "customer", why: "Naming V3 filename guard (HS-RY2N)." },
+  "guard-auto-memory-writes": { scope: "customer", why: "No new topic files in the auto-memory directory." },
+  "plan-review-gate": { scope: "customer", why: "Plan review + QC markers before ExitPlanMode." },
+  "plan-exit-ingest-gate": { scope: "customer", why: "Plan ingest on ExitPlanMode; arms claim-before-code." },
+  "claim-before-code-gate": { scope: "customer", why: "First code edit after plan exit needs a claim." },
+  "directive-obligation-gate": { scope: "customer", why: "A capture_on_idea directive leaves a durable obligation; an unmet one denies sub-agent spawns, product-code writes and builds, and re-drives Stop once. Also claim-before-build (HS-20SW)." },
+  "capture-workflow-gate": { scope: "customer", why: "No implementation spec straight out of an open capture." },
+  "vault-mirror-catchup": { scope: "customer", why: "Cloud write mode: a SessionStart detached `hs pull --apply` closes a stale disk mirror before the first tool call (HS-XJFQ)." },
+  "diagnose-capture-reminder": { scope: "customer", why: "Warn when a diagnose is filed with no capture holding the owner's words (HS-IK2D)." },
+  "git-stash-gate": { scope: "customer", why: "Always ask before a mutating git stash." },
+  "research-method-guard": { scope: "customer", why: "Research method guard (HS-EN4F)." },
+  "deep-research-cost-gate": { scope: "customer", why: "Cost confirmation before a paid deep-research launch." },
+  "research-protocol-gate": { scope: "customer", why: "WebSearch/WebFetch refused until research preflight ran (HS-K0ZP, HS-EN4F)." },
+  "naughty-list-gate": { scope: "customer", why: "Re-drive a final message that uses banned jargon." },
+  "id-display-format-gate": { scope: "customer", why: "Naming V3 display-id format in replies." },
+  "epic-milestone-phrasing-gate": { scope: "customer", why: "Epic/milestone phrasing rules in replies." },
+  "enforce-session-sequence": { scope: "customer", why: "Re-drive a turn that shipped without record_wip." },
+  "notify-status-flip": { scope: "customer", why: "Sound on an in_review status flip." },
+  "close-terminal-on-ship": { scope: "customer", why: "Close the launch terminal once the spec ships." },
+  "scripts/stamp-provenance-on-edit.mjs": { scope: "customer", why: "Stamp assisted_by provenance on direct spec edits (active vault)." },
+  "session-end": { scope: "customer", why: "Release the claim and export session events." },
+  // ── platform: heyspex-app's own development machinery ─────────────────────
+  "inject-dev-server-awareness": { scope: "platform", why: "About the spex-console dev server in heyspex-app." },
+  "inject-coo-seat": { scope: "platform", why: "dev-factory COO seat mandate." },
+  "coo-guard-check": { scope: "platform", why: "dev-factory breakdown-delegation guard." },
+  "coo-denylist-gate": { scope: "platform", why: "dev-factory COO window deny list." },
+  "agent-spawn-delegation-gate": { scope: "platform", why: "dev-factory seat routing for subagents." },
+  "capture-execution-gate": { scope: "platform", why: "Blocks dev-factory research/paid-model/routing surfaces past an ungrounded capture (HS-KNJ8)." },
+  "check-mcp-freshness-hook": { scope: "platform", why: "Freshness of the vendored MCP build \u2014 a platform-dev concern." },
+  "dev-server-task-reminder": { scope: "platform", why: "spex-console dev server + Neon DB safety." },
+  "env-vault-guard": { scope: "platform", why: "Guards heyspex-app's encrypted env vault paths." },
+  "log-session-activity": { scope: "platform", why: "Resolves .heyspex state from the platform checkout's own location, not the project \u2014 would log customer sessions into heyspex-app." }
+});
+var CUSTOMER_HOOK_DATA = Object.freeze({
+  "inject-doctrine": Object.freeze(["spexharness/doctrine/baseline/SPEXCODE-DOCTRINE.baseline.json"])
+});
+var CLAUDE_HOOK_ROWS = Object.freeze([
+  { event: "SessionStart", hook: "wip-checkpoint", timeout: 5 },
+  { event: "SessionStart", hook: "inject-dev-server-awareness", timeout: 5 },
+  { event: "SessionStart", hook: "inject-coo-seat", timeout: 5 },
+  { event: "SessionStart", hook: "inject-doctrine", timeout: 5 },
+  { event: "SessionStart", hook: "coo-guard-check", timeout: 5 },
+  { event: "SessionStart", hook: "check-auto-memory-budget", timeout: 5 },
+  { event: "SessionStart", hook: "check-claude-md-budget", timeout: 5 },
+  { event: "SessionStart", hook: "check-mcp-freshness-hook", timeout: 5 },
+  { event: "SessionStart", hook: "git-reflog-audit", timeout: 5 },
+  { event: "SessionStart", hook: "vault-mirror-catchup", timeout: 5 },
+  { event: "PreCompact", hook: "wip-checkpoint", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "preflight-reminder", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "intent-classifier-trigger", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "inject-communication-style", timeout: 5 },
+  { event: "UserPromptSubmit", hook: "inject-vault-context", timeout: 10 },
+  { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash|PowerShell", hook: "env-vault-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell", hook: "git-identity-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit|Bash|PowerShell", hook: "vault-write-tier-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|Edit|NotebookEdit|Bash|PowerShell|mcp__heyspex__heyspex_settings_set", hook: "settings-write-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PreToolUse"], timeout: 5 },
+  { event: "PreToolUse", matcher: ".*", hook: "coo-denylist-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Agent|Task", hook: "agent-spawn-delegation-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell|Agent|Task", hook: "capture-execution-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Agent|Task|Edit|Write|MultiEdit|NotebookEdit|Bash|PowerShell", hook: "directive-obligation-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "mcp__heyspex__heyspex_claim_spec", hook: "coo-guard-check", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|NotebookEdit|Bash|PowerShell", hook: "enforce-vault-naming", timeout: 5 },
+  { event: "PreToolUse", matcher: "Write|NotebookEdit|Bash|PowerShell", hook: "guard-auto-memory-writes", timeout: 5 },
+  { event: "PreToolUse", matcher: "Edit|MultiEdit|Write|Bash|PowerShell", hook: "preflight-reminder", timeout: 5 },
+  { event: "PreToolUse", matcher: "ExitPlanMode", hook: "plan-review-gate", timeout: 8 },
+  { event: "PreToolUse", matcher: "ExitPlanMode", hook: "plan-exit-ingest-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "Edit|MultiEdit|Write", hook: "claim-before-code-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "mcp__heyspex__heyspex_file_spec", hook: "capture-workflow-gate", timeout: 8 },
+  { event: "PreToolUse", matcher: "mcp__heyspex__heyspex_file_spec", hook: "diagnose-capture-reminder", timeout: 5 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell|mcp__neon__prepare_database_migration|mcp__neon__complete_database_migration|mcp__neon__reset_from_parent|mcp__neon__delete_branch|mcp__Neon__prepare_database_migration|mcp__Neon__complete_database_migration|mcp__Neon__reset_from_parent|mcp__Neon__delete_branch", hook: "dev-server-task-reminder", timeout: 10 },
+  { event: "PreToolUse", matcher: "Bash|PowerShell", hook: "git-stash-gate", timeout: 10 },
+  { event: "PreToolUse", matcher: "Skill|Workflow", hook: "research-method-guard", timeout: 5 },
+  { event: "PreToolUse", matcher: "Workflow|Skill", hook: "deep-research-cost-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: "WebSearch|WebFetch|mcp__heyspex__heyspex_save_research|mcp__plugin_heyspex_heyspex__heyspex_save_research", hook: "research-protocol-gate", timeout: 5 },
+  { event: "PreToolUse", matcher: ".*", hook: "log-session-activity", timeout: 5 },
+  { event: "Stop", hook: "emit-claim-status", args: ["--event=Stop"], timeout: 5 },
+  { event: "Stop", hook: "naughty-list-gate", timeout: 5 },
+  { event: "Stop", hook: "id-display-format-gate", timeout: 5 },
+  { event: "Stop", hook: "epic-milestone-phrasing-gate", timeout: 5 },
+  { event: "Stop", hook: "git-reflog-audit", timeout: 5 },
+  { event: "Stop", hook: "enforce-session-sequence", timeout: 5 },
+  { event: "Stop", hook: "directive-obligation-gate", timeout: 5 },
+  { event: "PostToolUse", matcher: ".*", hook: "emit-claim-status", args: ["--event=PostToolUse"], timeout: 5 },
+  { event: "PostToolUse", matcher: "Skill|mcp__heyspex__heyspex_update_capture|mcp__heyspex__heyspex_promote_capture.*|mcp__heyspex__heyspex_file_spec|mcp__heyspex__heyspex_claim_spec|mcp__heyspex__heyspex_release_spec|mcp__heyspex__heyspex_defer_spec", hook: "directive-obligation-gate", timeout: 5 },
+  { event: "PostToolUse", matcher: "Edit|Write|MultiEdit", hook: "notify-status-flip", timeout: 5 },
+  { event: "PostToolUse", matcher: "Edit|Write|MultiEdit", hook: "close-terminal-on-ship", timeout: 5 },
+  { event: "PostToolUse", matcher: "Edit|Write|MultiEdit", hook: "scripts/stamp-provenance-on-edit.mjs", timeout: 5 },
+  { event: "PostToolUse", matcher: ".*", hook: "log-session-activity", timeout: 5 },
+  { event: "SessionEnd", hook: "session-end", timeout: 5 },
+  { event: "SessionEnd", hook: "close-terminal-on-ship", timeout: 5 }
+]);
+var COMMAND_SCOPES = Object.freeze({
+  "hs-backfill.md": { scope: "customer", why: "Backfill completed work into the vault." },
+  "hs-capture.md": { scope: "customer", why: "Capture intake." },
+  "hs-defer.md": { scope: "customer", why: "Split + defer remaining work." },
+  "hs-doctor.md": { scope: "customer", why: "Install-surface repair when heyspex_* tools are missing." },
+  "hs-ground.md": { scope: "customer", why: "Pre-plan grounding report." },
+  "hs-handoff.md": { scope: "customer", why: "Short-code lane handoff." },
+  "hs-next.md": { scope: "customer", why: "On-deck prompt + claim handshake." },
+  "hs-promote.md": { scope: "customer", why: "Capture \u2192 research \u2192 milestone promotion." },
+  "hs-push.md": { scope: "customer", why: "Push an epic plan into the vault." },
+  "hs-qc.md": { scope: "customer", why: "Post-plan QC gate." },
+  "hs-res.md": { scope: "customer", why: "Research method entrypoint (SpexCrawl/DeepSeek)." },
+  "hs-resolve.md": { scope: "customer", why: "Resolution lane." },
+  "hs-review.md": { scope: "customer", why: "Review queue." },
+  "hs-view.md": { scope: "customer", why: "Open a console surface." },
+  "hs-auto.md": { scope: "platform", why: "Routes work into dev-factory (platform build system)." },
+  "hs-dev.md": { scope: "platform", why: "Admin/dev-only HeySpex dev/prod mode switch." },
+  "hs-log.md": { scope: "platform", why: "Admin/dev-only dev-server log watcher." },
+  "kill-ports.md": { scope: "platform", why: "Kills local dev-server ports." },
+  "prototype.md": { scope: "platform", why: "Console design-preview prototypes inside spex-console." }
+});
+function hookScope(hook) {
+  return HOOK_SCOPES[hook]?.scope ?? null;
+}
+function toPosixPath(p) {
+  return String(p).replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function samePlatformPath(a, b) {
+  if (!a || !b) return false;
+  const norm = (p) => {
+    const s = toPosixPath(path2.resolve(p));
+    return process.platform === "win32" ? s.toLowerCase() : s;
+  };
+  return norm(a) === norm(b);
+}
+var MCP_PROJECT_PREFIX = "mcp__heyspex__";
+var MCP_PLUGIN_PREFIX = "mcp__plugin_heyspex_heyspex__";
+function widenMcpMatcher(matcher) {
+  if (!matcher) return matcher;
+  const parts = matcher.split("|");
+  const out = [];
+  for (const part of parts) {
+    if (!out.includes(part)) out.push(part);
+    if (part.startsWith(MCP_PROJECT_PREFIX)) {
+      const plugin = MCP_PLUGIN_PREFIX + part.slice(MCP_PROJECT_PREFIX.length);
+      if (!parts.includes(plugin) && !out.includes(plugin)) out.push(plugin);
+    }
+  }
+  return out.join("|");
+}
+function customerHookRows() {
+  return CLAUDE_HOOK_ROWS.filter((r) => hookScope(r.hook) === "customer");
+}
+function hookTail(row) {
+  return [row.hook, ...row.args ?? []].join(" ");
+}
+var CLAUDE_HOOK_SHIM = "scripts/claude-hooks/_run.mjs";
+var CURSOR_HOOK_SHIM = "scripts/cursor-hooks/_run.mjs";
+var CUSTOMER_LAUNCHERS = Object.freeze({
+  claude: Object.freeze({
+    rel: Object.freeze([".claude", "heyspex", "run-hook.mjs"]),
+    projectDirEnv: "CLAUDE_PROJECT_DIR",
+    shim: CLAUDE_HOOK_SHIM,
+    registry: ".claude/settings.json"
+  }),
+  cursor: Object.freeze({
+    rel: Object.freeze([".cursor", "heyspex", "run-hook.mjs"]),
+    projectDirEnv: "CURSOR_PROJECT_DIR",
+    shim: CURSOR_HOOK_SHIM,
+    registry: ".cursor/hooks.json"
+  })
+});
+var BOOTSTRAP_WALK = "var d=process.cwd(),r=e.CLAUDE_PROJECT_DIR;if(!r||!f.existsSync(p.join(r,...n))){r='';for(;;){if(f.existsSync(p.join(d,...n))){r=d;break}var q=p.dirname(d);if(q===d)break;d=q}}";
+function buildBootstrap({ plugin = false } = {}) {
+  const walk = BOOTSTRAP_WALK;
+  const body = plugin ? "var f=require('fs'),p=require('path'),u=require('url'),e=process.env,n=['scripts','claude-hooks','_run.mjs'],s='',m=e.CLAUDE_PLUGIN_ROOT||e.COPILOT_PLUGIN_ROOT||e.PLUGIN_ROOT;if(m&&f.existsSync(p.join(m,'bin','run-hook.mjs')))s=p.join(m,'bin','run-hook.mjs');if(!s){" + walk + "if(r){e.CLAUDE_PROJECT_DIR=r;s=p.join(r,...n)}}" : "var f=require('fs'),p=require('path'),u=require('url'),e=process.env,n=['scripts','claude-hooks','_run.mjs'],s='';" + walk + "if(r){e.CLAUDE_PROJECT_DIR=r;s=p.join(r,...n)}";
+  return body + "if(!s)process.exit(0);process.argv=[process.argv[0],s].concat(process.argv.slice(1));import(u.pathToFileURL(s).href).catch(function(){process.exit(0)});" + (plugin ? "//bin/run-hook.mjs" : "//scripts/claude-hooks/_run.mjs");
+}
+var PLATFORM_RUNNER_PREFIX = 'node -e "' + buildBootstrap() + '"';
+var PLUGIN_RUNNER_PREFIX = 'node -e "' + buildBootstrap({ plugin: true }) + '"';
+function buildCustomerBootstrap() {
+  const rel = CUSTOMER_LAUNCHERS.claude.rel.map((s) => "'" + s + "'").join(",");
+  return "var f=require('fs'),p=require('path'),u=require('url'),e=process.env,n=[" + rel + "],s='';" + BOOTSTRAP_WALK + "if(r){e.CLAUDE_PROJECT_DIR=r;s=p.join(r,...n)}if(!s)process.exit(0);process.argv=[process.argv[0],s].concat(process.argv.slice(1));import(u.pathToFileURL(s).href).catch(function(){process.exit(0)});//" + CUSTOMER_LAUNCHERS.claude.rel.join("/");
+}
+var CUSTOMER_RUNNER_PREFIX = 'node -e "' + buildCustomerBootstrap() + '"';
+var LAUNCHER_TEMPLATE = [
+  "#!/usr/bin/env node",
+  "// HeySpex hook launcher -- GENERATED by hs install / hs connect. Commit it with this repo.",
+  "//",
+  "// Every HeySpex hook registered in __REGISTRY__ runs",
+  '//   node "$__ENV__/__LAUNCHER__" <hook> [args]',
+  "// This file carries NO machine-specific path. It finds the heyspex package this",
+  "// repo depends on (node_modules/heyspex) and hands off in-process to the",
+  "// package's hook shim (__SHIM__), so the same committed command works on every",
+  "// machine the repo is cloned to.",
+  "//",
+  "// Resolution order (the first root that carries the shim wins):",
+  "//   1. HEYSPEX_PLATFORM_ROOT                    explicit machine-local override",
+  "//   2. HEYSPEX_MCP_ENTRY -> its package root    machine-local override",
+  "//   3. node_modules/heyspex, walking up from this file   (the repo-local dependency)",
+  "//   4. node_modules/heyspex up from $__ENV__, $CLAUDE_PROJECT_DIR, $CURSOR_PROJECT_DIR, cwd",
+  "//   5. <npm root -g>/heyspex                    a global install, last resort",
+  "// Nothing found -> one stderr line and exit 0 (fail-open, like the shim itself).",
+  "import { spawnSync } from 'node:child_process';",
+  "import { existsSync } from 'node:fs';",
+  "import { dirname, resolve } from 'node:path';",
+  "import { fileURLToPath, pathToFileURL } from 'node:url';",
+  "",
+  "const SHIM = '__SHIM__'.split('/');",
+  "const here = dirname(fileURLToPath(import.meta.url));",
+  "const env = process.env;",
+  "const text = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);",
+  "const hasShim = (root) => Boolean(root) && existsSync(resolve(root, ...SHIM));",
+  "",
+  "function packageUpFrom(start) {",
+  "  let dir = resolve(start);",
+  "  for (;;) {",
+  "    const candidate = resolve(dir, 'node_modules', 'heyspex');",
+  "    if (hasShim(candidate)) return candidate;",
+  "    const parent = dirname(dir);",
+  "    if (parent === dir) return null;",
+  "    dir = parent;",
+  "  }",
+  "}",
+  "",
+  "function globalPackage() {",
+  "  try {",
+  "    // One command string through the shell: npm is a .cmd on Windows, and a",
+  "    // shell + args array is what node deprecates (DEP0190).",
+  "    const res = spawnSync('npm root -g', { encoding: 'utf8', timeout: 5000, shell: true });",
+  "    const root = String(res.stdout ?? '').trim();",
+  "    return root ? resolve(root, 'heyspex') : null;",
+  "  } catch {",
+  "    return null;",
+  "  }",
+  "}",
+  "",
+  "const mcpEntry = text(env.HEYSPEX_MCP_ENTRY);",
+  "const starts = [...new Set([here, text(env.__ENV__), text(env.CLAUDE_PROJECT_DIR), text(env.CURSOR_PROJECT_DIR), process.cwd()].filter(Boolean))];",
+  "let root =",
+  "  [text(env.HEYSPEX_PLATFORM_ROOT), mcpEntry && resolve(mcpEntry, '..', '..', '..')].find(hasShim) ??",
+  "  starts.map(packageUpFrom).find(Boolean) ??",
+  "  null;",
+  "if (!root) {",
+  "  const global = globalPackage();",
+  "  if (hasShim(global)) root = global;",
+  "}",
+  "",
+  "if (!root) {",
+  "  process.stderr.write(",
+  "    '[heyspex] hook ' + (process.argv[2] ?? '?') + ' skipped: no heyspex package found ' +",
+  `      '(run "npm install heyspex" in this repo, or set HEYSPEX_PLATFORM_ROOT). Looked for __SHIM__ under ' +`,
+  "      'HEYSPEX_PLATFORM_ROOT, HEYSPEX_MCP_ENTRY, node_modules/heyspex up from ' + starts.join(', ') + ', and npm root -g.\\n',",
+  "  );",
+  "  process.exit(0);",
+  "}",
+  "",
+  "// argv is already [node, <this file>, <hook>, ...args] -- the shape the shim",
+  '// reads; the shim path replaces this file so a shim guarded by "am I main?"',
+  "// (the Cursor one) runs exactly as if Cursor had invoked it directly.",
+  "const shim = resolve(root, ...SHIM);",
+  "process.argv[1] = shim;",
+  "try {",
+  "  await import(pathToFileURL(shim).href);",
+  "} catch (err) {",
+  "  process.stderr.write('[heyspex] hook ' + (process.argv[2] ?? '?') + ' skipped: ' + (err && err.message ? err.message : err) + '\\n');",
+  "  process.exit(0);",
+  "}",
+  ""
+].join("\n");
+function renderCustomerLauncher(surface = "claude") {
+  const l = CUSTOMER_LAUNCHERS[surface];
+  return LAUNCHER_TEMPLATE.replace(
+    /__(REGISTRY|ENV|LAUNCHER|SHIM)__/g,
+    (_m, token) => token === "REGISTRY" ? l.registry : token === "ENV" ? l.projectDirEnv : token === "LAUNCHER" ? l.rel.join("/") : l.shim
+  );
+}
+function planCustomerLauncherWrite(existing, surface = "claude") {
+  const text = renderCustomerLauncher(surface);
+  if (existing === null || existing === void 0) return { write: true, reason: "missing", text };
+  if (String(existing).replace(/\r\n/g, "\n") === text) return { write: false, reason: "unchanged", text };
+  return { write: true, reason: "update", text };
+}
+function renderCustomerHooks(runnerPrefix) {
+  return customerHookRows().map((row) => ({
+    event: row.event,
+    ...row.matcher ? { matcher: widenMcpMatcher(row.matcher) } : {},
+    command: `${runnerPrefix} ${hookTail(row)}`,
+    timeout: row.timeout,
+    tail: hookTail(row)
+  }));
+}
+function renderPluginHooksDocument() {
+  const hooks = {};
+  for (const d of renderCustomerHooks(PLUGIN_RUNNER_PREFIX)) {
+    (hooks[d.event] ??= []).push({
+      ...d.matcher ? { matcher: d.matcher } : {},
+      hooks: [{ type: "command", command: d.command, timeout: d.timeout }]
+    });
+  }
+  return {
+    hooks
+  };
+}
+function renderPluginHooksText() {
+  return `${JSON.stringify(renderPluginHooksDocument(), null, 2)}
+`;
+}
+var COPILOT_EVENT_NAMES = Object.freeze({
+  SessionStart: "sessionStart",
+  SessionEnd: "sessionEnd",
+  UserPromptSubmit: "userPromptSubmitted",
+  PreToolUse: "preToolUse",
+  PostToolUse: "postToolUse",
+  Stop: "agentStop",
+  PreCompact: "preCompact"
+});
+var GITHUB_HOOKS_STATE_ARMING = Object.freeze(["intent-classifier-trigger"]);
+var COPILOT_TOOL_NAMES = Object.freeze({
+  Write: "create",
+  Edit: "edit",
+  MultiEdit: "edit",
+  NotebookEdit: "edit",
+  Bash: "bash",
+  PowerShell: "powershell",
+  Agent: "task",
+  Task: "task",
+  WebFetch: "web_fetch",
+  WebSearch: "web_search"
+});
+function toCopilotMatcher(matcher) {
+  if (!matcher) return void 0;
+  const out = [];
+  for (const part of matcher.split("|")) {
+    let t = null;
+    if (part === ".*") t = ".*";
+    else if (COPILOT_TOOL_NAMES[part]) t = COPILOT_TOOL_NAMES[part];
+    else if (part.startsWith(MCP_PROJECT_PREFIX)) t = ".*" + part.slice(MCP_PROJECT_PREFIX.length);
+    else if (part.startsWith(MCP_PLUGIN_PREFIX)) t = ".*" + part.slice(MCP_PLUGIN_PREFIX.length);
+    if (t && !out.includes(t)) out.push(t);
+  }
+  if (out.includes(".*")) return ".*";
+  return out.length ? out.join("|") : null;
+}
+function githubHookNames() {
+  const names = /* @__PURE__ */ new Set();
+  for (const r of customerHookRows()) {
+    if (dispositionFor(r.hook, "copilot")?.disposition === "mapped" || GITHUB_HOOKS_STATE_ARMING.includes(r.hook)) names.add(r.hook);
+  }
+  return names;
+}
+function githubHookCommand(row) {
+  const tail = hookTail(row);
+  return `R=node_modules/heyspex/scripts/claude-hooks/_run.mjs; [ -f "$R" ] || R=./scripts/claude-hooks/_run.mjs; [ -f "$R" ] || exit 0; exec node "$R" ${tail}`;
+}
+function renderGithubHooksDocument() {
+  const allowed = githubHookNames();
+  const hooks = {};
+  for (const row of customerHookRows()) {
+    if (!allowed.has(row.hook)) continue;
+    const event = COPILOT_EVENT_NAMES[row.event];
+    if (!event) continue;
+    const matcher = toCopilotMatcher(row.matcher);
+    if (matcher === null) continue;
+    (hooks[event] ??= []).push({
+      type: "command",
+      ...matcher ? { matcher } : {},
+      bash: githubHookCommand(row),
+      timeoutSec: row.timeout
+    });
+  }
+  return { version: 1, hooks };
+}
+function renderGithubHooksText() {
+  return `${JSON.stringify(renderGithubHooksDocument(), null, 2)}
+`;
+}
+var HARNESS_COMMAND_SURFACES = Object.freeze([
+  {
+    installedDir: Object.freeze([".claude", "commands"]),
+    packagedDir: Object.freeze(["dist", "cli-templates", "harness-commands", "claude"]),
+    devSourceDir: Object.freeze([".claude", "commands"])
+  },
+  {
+    installedDir: Object.freeze([".cursor", "commands"]),
+    packagedDir: Object.freeze(["dist", "cli-templates", "harness-commands", "cursor"]),
+    devSourceDir: Object.freeze([".cursor", "commands"])
+  }
+]);
+var NPM_ALIASES = Object.freeze({ doctor: "doctor", setup: "doctor --fix" });
+var SCRIPT_VERBS = Object.freeze({
+  "scripts/heyspex-doctor.mjs": "doctor",
+  "scripts/hs-view.mjs": "view",
+  "scripts/hs-capture-cli.mjs": "capture",
+  "scripts/hs-next.mjs": "next",
+  "scripts/hs-mode.mjs": "mode",
+  "scripts/hs-settings.mjs": "settings",
+  "scripts/hs-companion.mjs": "companion",
+  "scripts/wip-ledger-health.mjs": "wip",
+  "scripts/dev-server-status.mjs": "server status",
+  "scripts/dev-server-stop.mjs": "server stop"
+});
+var PORTABLE_PACKAGE_DIR = "node_modules/heyspex";
+var fsDeps = {
+  joinPath: (...s) => path2.join(...s),
+  readFile: (p) => {
+    try {
+      return fs.readFileSync(p, "utf8");
+    } catch {
+      return null;
+    }
+  },
+  listDir: (d) => {
+    try {
+      return fs.readdirSync(d);
+    } catch {
+      return [];
+    }
+  }
+};
+function invokedDirectly(importMetaUrl, selfBasename, argv1 = process.argv[1]) {
+  try {
+    if (!argv1) return false;
+    const self = fileURLToPath2(importMetaUrl);
+    if (path2.basename(self) !== selfBasename) return false;
+    return pathToFileURL(path2.resolve(argv1)).href === pathToFileURL(self).href;
+  } catch {
+    return false;
+  }
+}
+var SELF = fileURLToPath2(import.meta.url);
+if (invokedDirectly(import.meta.url, "customer-kit.mjs")) {
+  const platformRoot = path2.resolve(path2.dirname(SELF), "..", "..");
+  const target = path2.join(platformRoot, "plugins", "heyspex", "hooks", "hooks.json");
+  const want = renderPluginHooksText();
+  const same = (fsDeps.readFile(target) ?? "").replace(/\r\n/g, "\n") === want;
+  if (process.argv.includes("--write-plugin-hooks")) {
+    if (!same) fs.writeFileSync(target, want, "utf8");
+    console.log(`customer-kit: ${same ? "unchanged" : "wrote"} ${path2.relative(platformRoot, target)}`);
+  } else if (process.argv.includes("--check-plugin-hooks")) {
+    if (!same) {
+      console.error("customer-kit: plugins/heyspex/hooks/hooks.json is stale \u2014 run `node scripts/lib/customer-kit.mjs --write-plugin-hooks`");
+      process.exit(1);
+    }
+    console.log("customer-kit: plugins/heyspex/hooks/hooks.json up to date");
+  } else if (process.argv.includes("--write-github-hooks") || process.argv.includes("--check-github-hooks")) {
+    const ghTarget = path2.join(platformRoot, ".github", "hooks", "heyspex.json");
+    const ghWant = renderGithubHooksText();
+    const ghSame = (fsDeps.readFile(ghTarget) ?? "").replace(/\r\n/g, "\n") === ghWant;
+    if (process.argv.includes("--write-github-hooks")) {
+      if (!ghSame) {
+        fs.mkdirSync(path2.dirname(ghTarget), { recursive: true });
+        fs.writeFileSync(ghTarget, ghWant, "utf8");
+      }
+      console.log(`customer-kit: ${ghSame ? "unchanged" : "wrote"} ${path2.relative(platformRoot, ghTarget).replace(/\\/g, "/")}`);
+    } else if (!ghSame) {
+      console.error("customer-kit: .github/hooks/heyspex.json is stale - run `node scripts/lib/customer-kit.mjs --write-github-hooks`");
+      process.exit(1);
+    } else {
+      console.log("customer-kit: .github/hooks/heyspex.json up to date");
+    }
+  } else {
+    console.log("usage: node scripts/lib/customer-kit.mjs --write-plugin-hooks | --check-plugin-hooks");
+  }
+}
+
+// scripts/install-cursor-hooks.mjs
+var PLATFORM_ROOT = path3.resolve(path3.dirname(fileURLToPath3(import.meta.url)), "..");
+var REPO_ROOT = process.env.HS_SETUP_TARGET?.trim() ? path3.resolve(process.env.HS_SETUP_TARGET.trim()) : PLATFORM_ROOT;
+var SETTINGS_PATH = path3.join(REPO_ROOT, ".cursor", "hooks.json");
+function cursorKitFor(targetRoot, platformRoot = PLATFORM_ROOT) {
+  const customer = !samePlatformPath(targetRoot, platformRoot);
+  return {
+    customer,
+    hooks: customer ? HOOKS.filter((h) => hookScope(h.hook) === "customer") : HOOKS,
+    commandFor: customer ? commandForCustomer : commandFor,
+    launcher: customer ? { rel: CUSTOMER_LAUNCHERS.cursor.rel, plan: planCustomerLauncherWrite } : null
+  };
+}
+var KIT = cursorKitFor(REPO_ROOT);
+var ACTIVE_HOOKS = KIT.hooks;
+var LAUNCHER_PATH = path3.join(REPO_ROOT, ...CUSTOMER_LAUNCHERS.cursor.rel);
+var LEGACY_MARKER = "scripts/claude-hooks/";
+function readSettings() {
+  try {
+    const raw = fs2.readFileSync(SETTINGS_PATH, "utf8").trim();
+    if (!raw) return { version: 1, hooks: {} };
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") {
+      parsed.version ??= 1;
+      parsed.hooks ??= {};
+      return parsed;
+    }
+  } catch (err) {
+    if (err && err.code === "ENOENT") return { version: 1, hooks: {} };
+    throw err;
+  }
+  return { version: 1, hooks: {} };
+}
+function writeSettings(settings) {
+  fs2.mkdirSync(path3.dirname(SETTINGS_PATH), { recursive: true });
+  fs2.writeFileSync(SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}
+`, "utf8");
+}
+var commandOf = (entry) => entry && typeof entry.command === "string" ? entry.command : "";
+var isOurRunner = (token) => token.includes(SHIM) || token.includes(CUSTOMER_LAUNCHER);
+var isShimEntry = (raw) => isOurRunner(commandOf(raw));
+var isLegacyEntry = (raw) => !isShimEntry(raw) && commandOf(raw).includes(LEGACY_MARKER);
+function identityOfCommand(command) {
+  const tokens = command.trim().split(/\s+/);
+  const shimAt = tokens.findIndex(isOurRunner);
+  if (shimAt === -1) return null;
+  const rest = tokens.slice(shimAt + 1);
+  const hook = rest[0] ?? "";
+  let tool = "";
+  const args = [];
+  for (const token of rest.slice(1)) {
+    if (token.startsWith("--hs-tool=")) {
+      tool = token.slice("--hs-tool=".length).replace(/^"([\s\S]*)"$/, "$1");
+    } else if (token.startsWith("--hs-claude-event=")) continue;
+    else args.push(token);
+  }
+  return `${hook}::${tool}::${args.join(" ")}`;
+}
+function desiredEntry(entry, render = KIT.commandFor) {
+  return {
+    command: render(entry),
+    timeout: timeoutFor(entry),
+    ...entry.matcher ? { matcher: entry.matcher } : {}
+  };
+}
+function sameEntry(raw, entry, render = KIT.commandFor) {
+  const want = desiredEntry(entry, render);
+  return commandOf(raw) === want.command && raw.timeout === want.timeout && (raw.matcher ?? void 0) === (want.matcher ?? void 0);
+}
+var PLUGIN_HOOKS_PATH = path3.join(REPO_ROOT, "plugins", "heyspex", "hooks", "cursor-hooks.json");
+function pluginHooksDocument() {
+  const hooks = {};
+  for (const entry of HOOKS) {
+    hooks[entry.event] ??= [];
+    hooks[entry.event].push({
+      command: commandForPlugin(entry),
+      timeout: timeoutFor(entry),
+      ...entry.matcher ? { matcher: entry.matcher } : {}
+    });
+  }
+  return {
+    _comment: "GENERATED by scripts/install-cursor-hooks.mjs from scripts/cursor-hooks/manifest.mjs \u2014 do not edit by hand; run `npm run hooks:install-cursor`. Commands resolve through $CURSOR_PROJECT_DIR because the shim and hook bodies live in the host vault checkout, not the plugin cache. WARNING: enabling this plugin in a repo whose .cursor/hooks.json still registers the same hooks runs every hook twice \u2014 validate in a fresh clone, or run `node scripts/install-cursor-hooks.mjs --uninstall` there first.",
+    version: 1,
+    hooks
+  };
+}
+function pluginHooksText() {
+  return `${JSON.stringify(pluginHooksDocument(), null, 2)}
+`;
+}
+function syncPluginHooks() {
+  const want = pluginHooksText();
+  let have = null;
+  try {
+    have = fs2.readFileSync(PLUGIN_HOOKS_PATH, "utf8");
+  } catch {
+    have = null;
+  }
+  if (have === want) return false;
+  fs2.mkdirSync(path3.dirname(PLUGIN_HOOKS_PATH), { recursive: true });
+  fs2.writeFileSync(PLUGIN_HOOKS_PATH, want, "utf8");
+  return true;
+}
+function mergeCursorHooks(settings, { hooks = ACTIVE_HOOKS, commandFor: render = KIT.commandFor } = {}) {
+  settings.version = 1;
+  settings.hooks ??= {};
+  const added = [];
+  const repaired = [];
+  const removed = [];
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const keep = entries.filter((raw) => {
+      if (!isLegacyEntry(raw)) return true;
+      removed.push(`${event}: ${commandOf(raw)}`);
+      return false;
+    });
+    settings.hooks[event] = keep;
+  }
+  for (const entry of hooks) {
+    settings.hooks[entry.event] ??= [];
+    const entries = settings.hooks[entry.event];
+    const identity = identityFor(entry);
+    const existing = entries.filter(
+      (raw2) => isShimEntry(raw2) && identityOfCommand(commandOf(raw2)) === identity
+    );
+    if (existing.length === 0) {
+      entries.push(desiredEntry(entry, render));
+      added.push(`${entry.event}/${entry.hook}`);
+      continue;
+    }
+    for (const extra of existing.slice(1)) {
+      entries.splice(entries.indexOf(extra), 1);
+      removed.push(`${entry.event}: duplicate ${entry.hook}`);
+    }
+    const raw = existing[0];
+    if (!sameEntry(raw, entry, render)) {
+      Object.assign(raw, desiredEntry(entry, render));
+      if (!entry.matcher && "matcher" in raw) delete raw.matcher;
+      repaired.push(`${entry.event}/${entry.hook}`);
+    }
+  }
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const wanted = new Set(hooks.filter((h) => h.event === event).map(identityFor));
+    settings.hooks[event] = entries.filter((raw) => {
+      if (!isShimEntry(raw)) return true;
+      if (wanted.has(identityOfCommand(commandOf(raw)))) return true;
+      removed.push(`${event}: retired ${commandOf(raw)}`);
+      return false;
+    });
+    if (settings.hooks[event].length === 0) delete settings.hooks[event];
+  }
+  return { added, repaired, removed };
+}
+function launcherPlan() {
+  let existing = null;
+  try {
+    existing = fs2.readFileSync(LAUNCHER_PATH, "utf8");
+  } catch {
+    existing = null;
+  }
+  return planCustomerLauncherWrite(existing, "cursor");
+}
+function install({ json = false } = {}) {
+  const settings = readSettings();
+  const { added, repaired, removed } = mergeCursorHooks(settings);
+  const settingsChanged = added.length + repaired.length + removed.length > 0;
+  if (settingsChanged) writeSettings(settings);
+  let launcherWritten = false;
+  if (KIT.customer) {
+    const plan = launcherPlan();
+    if (plan.write) {
+      fs2.mkdirSync(path3.dirname(LAUNCHER_PATH), { recursive: true });
+      fs2.writeFileSync(LAUNCHER_PATH, plan.text, "utf8");
+      launcherWritten = true;
+    }
+  }
+  const pluginChanged = KIT.customer ? false : syncPluginHooks();
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          changed: settingsChanged || pluginChanged || launcherWritten,
+          added,
+          repaired,
+          removed,
+          pluginChanged,
+          launcherWritten,
+          total: ACTIVE_HOOKS.length,
+          customer: KIT.customer
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (pluginChanged) {
+    console.log(`install-cursor-hooks: regenerated ${path3.relative(REPO_ROOT, PLUGIN_HOOKS_PATH)}`);
+  }
+  if (launcherWritten) {
+    console.log(`install-cursor-hooks: wrote ${path3.relative(REPO_ROOT, LAUNCHER_PATH)} (resolves node_modules/heyspex)`);
+  }
+  if (!settingsChanged) {
+    console.log(`install-cursor-hooks: already installed (${ACTIVE_HOOKS.length} hooks, no changes).`);
+    return;
+  }
+  const parts = [];
+  if (added.length) parts.push(`added ${added.length}`);
+  if (repaired.length) parts.push(`repaired ${repaired.length}`);
+  if (removed.length) parts.push(`removed ${removed.length}`);
+  console.log(
+    `install-cursor-hooks: ${parts.join("; ")} \u2192 ${path3.relative(REPO_ROOT, SETTINGS_PATH)} (${ACTIVE_HOOKS.length} hooks registered)`
+  );
+  for (const line of removed) console.log(`  - ${line}`);
+  console.log(
+    KIT.customer ? `  Launcher: ${CUSTOMER_LAUNCHER} \u2192 node_modules/heyspex/${SHIM} (HeySpex off-switch + Cursor\u2194Claude payload translation)` : `  Shim: ${SHIM} (HeySpex off-switch + Cursor\u2194Claude payload translation)`
+  );
+  for (const gap of UNPORTABLE) {
+    console.log(`  Not registerable in Cursor: ${gap.hook} (${gap.reason}) \u2192 covered by ${gap.coveredBy}`);
+  }
+}
+function check({ json = false } = {}) {
+  const settings = readSettings();
+  const issues = [];
+  const entriesFor = (event) => Array.isArray(settings?.hooks?.[event]) ? settings.hooks[event] : [];
+  for (const entry of ACTIVE_HOOKS) {
+    const identity = identityFor(entry);
+    const ours = entriesFor(entry.event).filter(
+      (raw) => isShimEntry(raw) && identityOfCommand(commandOf(raw)) === identity
+    );
+    if (ours.length === 0) {
+      issues.push(`${entry.event}: missing ${entry.hook}`);
+      continue;
+    }
+    if (ours.length > 1) issues.push(`${entry.event}: ${entry.hook} registered ${ours.length}\xD7`);
+    for (const raw of ours) {
+      if (!sameEntry(raw, entry)) {
+        issues.push(
+          `${entry.event}/${entry.hook}: drift \u2014 expected \`${KIT.commandFor(entry)}\` (timeout ${timeoutFor(entry)}, matcher ${entry.matcher ?? "none"}), found \`${commandOf(raw)}\` (timeout ${raw.timeout}, matcher ${raw.matcher ?? "none"})`
+        );
+      }
+    }
+  }
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    if (!Array.isArray(entries)) continue;
+    for (const raw of entries) {
+      if (isLegacyEntry(raw)) {
+        issues.push(`${event}: superseded direct registration \u2014 ${commandOf(raw)}`);
+      } else if (isShimEntry(raw) && !ACTIVE_HOOKS.some((h) => h.event === event && identityFor(h) === identityOfCommand(commandOf(raw)))) {
+        issues.push(`${event}: not part of this repo's hook set \u2014 ${commandOf(raw)}`);
+      }
+    }
+  }
+  let pluginOnDisk = null;
+  try {
+    pluginOnDisk = fs2.readFileSync(PLUGIN_HOOKS_PATH, "utf8");
+  } catch {
+    pluginOnDisk = null;
+  }
+  if (!KIT.customer && pluginOnDisk !== pluginHooksText()) {
+    issues.push(
+      `plugins/heyspex/hooks/cursor-hooks.json: ${pluginOnDisk === null ? "missing" : "stale"} \u2014 regenerate with \`npm run hooks:install-cursor\``
+    );
+  }
+  if (KIT.customer) {
+    const plan = launcherPlan();
+    if (plan.write) {
+      issues.push(`${CUSTOMER_LAUNCHER}: ${plan.reason === "missing" ? "missing" : "stale"} \u2014 the hook rows point at it`);
+    }
+  }
+  if (json) {
+    console.log(JSON.stringify({ ok: issues.length === 0, issues, total: ACTIVE_HOOKS.length, customer: KIT.customer }, null, 2));
+    process.exit(issues.length === 0 ? 0 : 1);
+  }
+  if (issues.length === 0) {
+    console.log(`install-cursor-hooks --check: OK (${ACTIVE_HOOKS.length} hooks registered)`);
+    process.exit(0);
+  }
+  console.error("install-cursor-hooks --check: drift detected");
+  for (const issue of issues) console.error(`  - ${issue}`);
+  console.error("  Run `node scripts/install-cursor-hooks.mjs` to repair.");
+  process.exit(1);
+}
+function uninstall() {
+  const settings = readSettings();
+  if (!settings.hooks) {
+    console.log("install-cursor-hooks: nothing to uninstall (no hooks block).");
+    return;
+  }
+  let removed = 0;
+  for (const [event, entries] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    const keep = entries.filter((raw) => !isShimEntry(raw) && !isLegacyEntry(raw));
+    removed += entries.length - keep.length;
+    if (keep.length === 0) delete settings.hooks[event];
+    else settings.hooks[event] = keep;
+  }
+  if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+  writeSettings(settings);
+  console.log(`install-cursor-hooks: uninstalled ${removed} hook entr${removed === 1 ? "y" : "ies"}.`);
+}
+if (invokedDirectly(import.meta.url, "install-cursor-hooks.mjs")) {
+  const argv = process.argv.slice(2);
+  const json = argv.includes("--json");
+  if (argv.includes("--uninstall")) uninstall();
+  else if (argv.includes("--check")) check({ json });
+  else install({ json });
+}
+
+// spex-console/src/lib/cli/install.ts
+init_credentials();
+
+// spex-console/src/lib/cli/connect-checks.ts
+import { dirname as dirname5 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+
+// spex-console/src/lib/dev-mode.ts
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join10 } from "node:path";
+init_credentials();
+
+// spex-console/src/lib/cli/connect-checks.ts
+init_credentials();
+
+// spex-console/src/lib/cli/satellite.ts
+import { resolve as resolveNodePath } from "node:path";
+import process2 from "node:process";
+
 // spex-console/src/lib/cli/principle-selection.ts
-import { basename as basename2 } from "node:path";
+import { basename as basename3 } from "node:path";
 var PRINCIPLES_INDEX_DEST = "specs/principles-index.md";
 function principleKey(row) {
-  const base = basename2(row.dest, ".md");
+  const base = basename3(row.dest, ".md");
   return base.startsWith("principle-") ? base.slice("principle-".length) : base;
 }
 function principleWikilink(row) {
-  return basename2(row.dest, ".md");
+  return basename3(row.dest, ".md");
 }
 function parsePrinciplesFlag(value, rows) {
   const principleRows = rows.filter((row) => row.group === "principle");
@@ -1614,8 +3427,247 @@ function principlesIndexHook(selected, rows) {
   };
 }
 
+// spex-console/src/lib/cli/receipt.ts
+var RECEIPT_AGREEMENT_FIELDS = [
+  "vault_id",
+  "workspace_id",
+  "account_id",
+  "active_vault_id"
+];
+var ALL_FIELDS = [
+  ...RECEIPT_AGREEMENT_FIELDS,
+  "display_name",
+  "archived"
+];
+
+// spex-console/src/lib/cli/vault-workspace-shared.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+
+// spex-console/src/lib/indexer/parser.ts
+var import_gray_matter = __toESM(require_gray_matter(), 1);
+import { createHash as createHash2 } from "node:crypto";
+import { promises as fs3 } from "node:fs";
+import path4 from "node:path";
+
+// spex-console/src/lib/cli/install.ts
+var MCP_REL = ["vendor", "heyspex-mcp", "cli.mjs"];
+var PORTABLE_MCP_CLI = Object.freeze({
+  claude: `\${CLAUDE_PROJECT_DIR:-.}/${PORTABLE_PACKAGE_DIR}/${MCP_REL.join("/")}`,
+  cursor: `\${workspaceFolder}/${PORTABLE_PACKAGE_DIR}/${MCP_REL.join("/")}`
+});
+function resolveCallerPath(p, env, fallbackCwd) {
+  const trimmed = p?.trim() ?? "";
+  if (!trimmed) return "";
+  if (isAbsolute3(trimmed)) return trimmed;
+  const base = env.HS_INVOKED_CWD?.trim() || fallbackCwd;
+  return resolveNodePath2(base, trimmed);
+}
+var DEFAULT_REMOTE_MCP_URL = "https://app.heyspex.com/api/mcp";
+var REMOTE_MCP_TOKEN_ENV = "HEYSPEX_MCP_TOKEN";
+var PLUGIN_MARKETPLACE_NAME = "heyspex-marketplace";
+var PLUGIN_INSTALL_SPEC = `heyspex@${PLUGIN_MARKETPLACE_NAME}`;
+var WRITE_TARGET_KIND = {
+  specsGitkeep: "specs_gitkeep",
+  heyspexYaml: "heyspex_yaml",
+  cursorMcp: "cursor_mcp",
+  claudeMcp: "claude_mcp",
+  claudeMd: "claude_md",
+  agentsMd: "agents_md",
+  statuslineVendor: "statusline_vendor",
+  gitignore: "gitignore",
+  claudeMdTemplate: "claude_md_template",
+  agentsMdTemplate: "agents_md_template"
+};
+var INSTALL_WRITE_TARGETS = [
+  {
+    kind: WRITE_TARGET_KIND.specsGitkeep,
+    rel: "specs/.gitkeep",
+    path: (targetDir, joinPath) => joinPath(targetDir, "specs", ".gitkeep"),
+    appliesTo: (_args, opts) => !opts.attached
+  },
+  {
+    kind: WRITE_TARGET_KIND.heyspexYaml,
+    rel: "heyspex.yaml",
+    path: (targetDir, joinPath) => joinPath(targetDir, "heyspex.yaml"),
+    appliesTo: (_args, opts) => !opts.attached
+  },
+  {
+    kind: WRITE_TARGET_KIND.cursorMcp,
+    rel: ".cursor/mcp.json",
+    path: (targetDir, joinPath) => joinPath(targetDir, ".cursor", "mcp.json"),
+    appliesTo: (args) => args.cursor
+  },
+  {
+    kind: WRITE_TARGET_KIND.claudeMcp,
+    rel: ".mcp.json",
+    path: (targetDir, joinPath) => joinPath(targetDir, ".mcp.json"),
+    appliesTo: (args) => args.claude
+  },
+  {
+    kind: WRITE_TARGET_KIND.claudeMd,
+    rel: "CLAUDE.md",
+    path: (targetDir, joinPath) => joinPath(targetDir, "CLAUDE.md"),
+    appliesTo: (args, opts) => args.claude && opts.installContract
+  },
+  {
+    kind: WRITE_TARGET_KIND.agentsMd,
+    rel: "AGENTS.md",
+    path: (targetDir, joinPath) => joinPath(targetDir, "AGENTS.md"),
+    appliesTo: (_args, opts) => opts.installContract
+  },
+  // The customer-template step (--register-vault) writes the project contract
+  // beside a hand-authored CLAUDE.md/AGENTS.md as <file>.template; a rerun
+  // rewrites it when the generated text changed.
+  {
+    kind: WRITE_TARGET_KIND.claudeMdTemplate,
+    rel: "CLAUDE.md.template",
+    path: (targetDir, joinPath) => joinPath(targetDir, "CLAUDE.md.template"),
+    appliesTo: (args, opts) => Boolean(args.registerVault) && !opts.attached && args.claude && opts.installContract
+  },
+  {
+    kind: WRITE_TARGET_KIND.agentsMdTemplate,
+    rel: "AGENTS.md.template",
+    path: (targetDir, joinPath) => joinPath(targetDir, "AGENTS.md.template"),
+    appliesTo: (args, opts) => Boolean(args.registerVault) && !opts.attached && opts.installContract
+  },
+  {
+    kind: WRITE_TARGET_KIND.statuslineVendor,
+    rel: "scripts/claude-statusline",
+    path: (targetDir, joinPath) => joinPath(targetDir, "scripts", "claude-statusline"),
+    appliesTo: (args) => (args.statusline ?? true) && args.claude
+  },
+  {
+    kind: WRITE_TARGET_KIND.gitignore,
+    rel: ".gitignore",
+    path: (targetDir, joinPath) => joinPath(targetDir, ".gitignore"),
+    // A satellite owns no vault content and writes no machine-local
+    // manifests of its own (its .mcp.json/.cursor/mcp.json point AT the
+    // attached vault, not a fresh one this repo would need to gitignore) --
+    // only a real vault bootstrap gets one.
+    appliesTo: (_args, opts) => !opts.attached
+  }
+];
+var INSTALL_HELP = [
+  "Usage:",
+  "  hs install [--target <dir>] [--platform <dir>] [--force] [--dry-run] [--json]",
+  "             [--no-cursor] [--no-claude] [--claude-apply]",
+  "             [--plugin | --plugin-apply] [--plugin-scope user|project|local]",
+  "             [--copilot-hooks | --copilot-plugin | --copilot-plugin-apply]",
+  "             [--no-statusline]",
+  "             [--cc | --command-code] [--register-vault [--workspace <id>]]",
+  "             [--remote[=<url>]]",
+  "  hs install --attach-vault <vault-id|vault-path> [--target <dir>] [...]",
+  "",
+  "Bootstrap a project vault for HeySpex agent tooling:",
+  "  \u2022 specs/ + heyspex.yaml (via hs init)",
+  "  \u2022 .cursor/mcp.json  \u2014 Cursor MCP (gitignored, machine-local path to platform MCP)",
+  "  \u2022 .mcp.json         \u2014 Claude Code project MCP (absolute platform path)",
+  "  \u2022 CLAUDE.md / AGENTS.md \u2014 thin agent contract pointing at the HeySpex MCP server",
+  "  \u2022 agent kit (customer repos) \u2014 the customer-scoped HeySpex hooks in",
+  "    .claude/settings.json + .cursor/hooks.json and the /hs-* commands in",
+  "    .claude/commands + .cursor/commands, every platform path absolute.",
+  "    Scope table: scripts/lib/customer-kit.mjs. Re-runs are no-ops; a command",
+  "    file you edited is left alone (--force overwrites it). `hs doctor` flags",
+  "    a missing or stale kit.",
+  "",
+  "Satellite repo (--attach-vault): wire a CODE repo to an EXISTING vault instead",
+  "of making it a vault. Writes the MCP manifests + agent contract only, with",
+  "HEYSPEX_VAULT_ROOT pinned to the attached vault's absolute root -- no specs/,",
+  "no heyspex.yaml, no new registry row. The target is the repo you are standing",
+  "in (or --target), never the vault being attached.",
+  "",
+  "That pin IS the attachment, so it must land somewhere: --attach-vault refuses a",
+  "flag combination that writes no stdio manifest (--no-cursor --no-claude), and",
+  "refuses to re-pin over manifests that name a different vault unless you pass",
+  "--force. Re-attaching to the SAME vault is a no-op and says so.",
+  "",
+  '--attach-vault --remote: the stdio pin under "heyspex" in .mcp.json is preserved',
+  "(never replaced by the HTTP form, even with --force) and the cloud form is",
+  'written under a second key, "heyspex-cloud" -- Claude Code registers both the',
+  "attached-vault local server and the cloud server. Without --force, a pin that",
+  "already names a DIFFERENT vault still refuses and names the conflicting key,",
+  "same as the non-remote case.",
+  "",
+  "Verify with `hs connect --check` from the satellite -- it is the command that",
+  "audits THIS repo's rows and reports the attachment. `hs doctor` resolves",
+  "THROUGH the pin and audits the ATTACHED VAULT repo, so it reports that vault's",
+  "connection state, not the satellite's.",
+  "",
+  "Conflict scan: every install checks the target repo against the known-conflict",
+  "registry (beads, workflow-pm, bd hooks, \u2026). See:",
+  "  specs/protocols/customer-vault-local-install-protocol.md",
+  "",
+  "Run from the HeySpex platform repo, or pass --platform to its checkout.",
+  "Target defaults to the current directory.",
+  "",
+  "Flags:",
+  "  --target <dir>     Project repo to bootstrap (default: cwd).",
+  "  --platform <dir>   HeySpex platform checkout (default: HS_INSTALL_PLATFORM or dispatcher root).",
+  "  --claude-apply     Run `claude mcp add --scope project` after writing files.",
+  "  --plugin           Print the Claude Code plugin registration block (self-hosted",
+  "                     marketplace at the platform root \u2014 HS-QTBK prototype).",
+  "  --plugin-apply     Run `claude plugin marketplace add` + `claude plugin install`",
+  "                     after writing files. Marketplace + plugin names are read from",
+  `                     the platform's .claude-plugin/marketplace.json (fallback: ${PLUGIN_INSTALL_SPEC}).`,
+  "  --plugin-scope <s> Plugin install scope: user, project (default), or local.",
+  "                     Implies --plugin.",
+  "  --copilot-hooks    Write .github/hooks/heyspex.json (GitHub Copilot hooks) into the",
+  "                     target. Commands resolve node_modules/heyspex first, so an npm-only",
+  "                     install (no heyspex repo checkout) works. Pick this OR the plugin.",
+  "  --copilot-plugin   Print `copilot plugin marketplace add '<platform>'` +",
+  "                     `copilot plugin install <plugin>@<marketplace>` (the platform root is",
+  "                     node_modules/heyspex for a published install).",
+  "  --copilot-plugin-apply  Run those two commands when `copilot` is on PATH.",
+  "                     Requesting the Copilot plugin AND --copilot-hooks warns and skips the",
+  "                     hooks file (both would fire every hook twice).",
+  "  --remote[=<url>]   Write .mcp.json for the REMOTE (cloud) MCP endpoint instead of",
+  `                     the local stdio server \u2014 the Streamable-HTTP form against`,
+  `                     ${DEFAULT_REMOTE_MCP_URL} (or <url>), authenticated by the`,
+  `                     env reference \`\${${REMOTE_MCP_TOKEN_ENV}}\` (never the literal token).`,
+  '                     With --attach-vault, the stdio pin survives under "heyspex" and',
+  '                     this is written under "heyspex-cloud" instead (see above). If',
+  "                     this machine already ran `hs login` / `hs mcp pair <code>`, the",
+  "                     printed guidance resolves the bearer from",
+  "                     ~/.heyspex/credentials.yaml automatically -- no manual export",
+  "                     needed on that machine.",
+  "  --no-statusline    Skip the branded statusline (statusLine entry in the target's",
+  "                     .claude/settings.json + machine-level glyph install).",
+  "  --cc, --command-code  Print `cmdc mcp add` PowerShell one-liner for Command Code.",
+  "  --attach-vault <v> SATELLITE mode: attach this repo to the EXISTING vault named",
+  "                     by a registry id (`hs vault list`) or the vault repo's path,",
+  "                     instead of scaffolding specs/ + heyspex.yaml here. The vault",
+  "                     must already be registered on this machine. Mutually exclusive",
+  "                     with --register-vault and --workspace, and with any flag",
+  "                     combination that would leave no stdio manifest to pin.",
+  "                     Combines with --remote (see --remote above): the pin and the",
+  "                     cloud endpoint coexist in .mcp.json under separate keys.",
+  "  --register-vault   Register this repo's vault into ~/.heyspex/registry.json during install,",
+  "                     and -- when this machine is signed in -- on the console too; both",
+  "                     sides are read back (GET /api/vaults) and printed as a receipt.",
+  "                     Re-running changes nothing and sends no cloud write.",
+  "  --workspace <id>   With --register-vault: ensure this workspace exists, make it active,",
+  "                     and associate the vault with it (default: the vault's current",
+  "                     workspace, else your per-account default ws-<account>).",
+  "  --no-cursor        Skip .cursor/mcp.json.",
+  "  --no-claude        Skip .mcp.json and Claude instructions.",
+  "  --force            Overwrite existing MCP manifests and heyspex.yaml.",
+  "  --dry-run          Print the plan without writing.",
+  "  --skip-conflict-check  Skip the known-conflict registry scan.",
+  "  --json             Machine-readable result.",
+  "  --account <email|id> Confirm the account this repo is attached to. An interactive",
+  "                     install asks (continue / sign in as someone else / create an",
+  "                     account / abort); a non-interactive one with --register-vault or",
+  "                     --remote refuses without this or --yes. See `hs whoami`.",
+  "  --yes              Confirm the signed-in account shown, without typing it.",
+  "  --help, -h         Show this help.",
+  "",
+  "Exit codes: 0 ok \xB7 1 usage \xB7 11 bad-arg \xB7 13 write-failed \xB7 16 sign-in required \xB7",
+  "12 console unreachable (account check) \xB7 17 account not confirmed \xB7",
+  "19 the cloud half did not land (the receipt names the retry) \xB7 21 both sides read back and disagree"
+].join("\n");
+
 // spex-console/bin/run-entry.ts
-import process2 from "node:process";
+import process3 from "node:process";
 var BinExit = class extends Error {
   code;
   constructor(code) {
@@ -1624,35 +3676,35 @@ var BinExit = class extends Error {
     this.code = code;
   }
 };
-function runEntry(name, main2, options = {}) {
-  const { fallbackCode = 1, unhandledLabel = "unhandled" } = options;
+function runEntry(name, main2, options2 = {}) {
+  const { fallbackCode = 1, unhandledLabel = "unhandled" } = options2;
   void (async () => {
     try {
       await main2();
     } catch (err) {
       if (err instanceof BinExit) {
-        process2.exitCode = err.code;
+        process3.exitCode = err.code;
         return;
       }
       const message = err instanceof Error ? err.message : String(err);
-      process2.stderr.write(`${name}: ${unhandledLabel}: ${message}
+      process3.stderr.write(`${name}: ${unhandledLabel}: ${message}
 `);
-      process2.exitCode = fallbackCode;
+      process3.exitCode = fallbackCode;
     }
   })();
 }
 
 // spex-console/bin/hs-init.ts
-var INTERACTIVE = process3.stdin.isTTY === true;
+var INTERACTIVE = process4.stdin.isTTY === true;
 var PKG_ROOT = resolve5(
-  resolveCodeRoot({ packageRoot: resolve5(dirname5(fileURLToPath2(import.meta.url)), "..", "..") })
+  resolveCodeRoot({ packageRoot: resolve5(dirname6(fileURLToPath4(import.meta.url)), "..", "..") })
 );
-var CONFIG_SEED_PATH = join9(PKG_ROOT, "vendor", "heyspex-mcp", "config-seed.yaml");
+var CONFIG_SEED_PATH = join11(PKG_ROOT, "vendor", "heyspex-mcp", "config-seed.yaml");
 function readConfigSeed() {
   try {
-    return readFileSync8(CONFIG_SEED_PATH, "utf8");
+    return readFileSync11(CONFIG_SEED_PATH, "utf8");
   } catch {
-    process3.stderr.write(
+    process4.stderr.write(
       `hs init: warning \u2014 config seed template not found at ${CONFIG_SEED_PATH}; .heyspex/config.yaml was not seeded (run \`hs settings set <key> <value>\` to create it).
 `
     );
@@ -1660,7 +3712,7 @@ function readConfigSeed() {
   }
 }
 async function askYesNo(question) {
-  const rl = createInterface({ input: process3.stdin, output: process3.stdout });
+  const rl = createInterface({ input: process4.stdin, output: process4.stdout });
   try {
     const answer = (await rl.question(`${question} `)).trim().toLowerCase();
     return answer === "y" || answer === "yes" || answer === "";
@@ -1673,9 +3725,9 @@ async function resolvePrincipleSelection(principlesFlag) {
     return parsePrinciplesFlag(principlesFlag, TEMPLATE_MANIFEST);
   }
   if (INTERACTIVE) {
-    process3.stdout.write("Select which universal principle docs to ship with this vault:\n");
+    process4.stdout.write("Select which universal principle docs to ship with this vault:\n");
     for (const choice of listPrincipleChoices(TEMPLATE_MANIFEST)) {
-      process3.stdout.write(`  - ${choice.key}: ${choice.summary}
+      process4.stdout.write(`  - ${choice.key}: ${choice.summary}
 `);
     }
     const selected = await promptPrincipleSelection(askYesNo, TEMPLATE_MANIFEST);
@@ -1684,39 +3736,39 @@ async function resolvePrincipleSelection(principlesFlag) {
   return parsePrinciplesFlag(void 0, TEMPLATE_MANIFEST);
 }
 async function main() {
-  const repoRoot = process3.env.HS_VAULT_ROOT ? resolve5(process3.env.HS_VAULT_ROOT) : process3.cwd();
-  const parsed = parseInitArgs(process3.argv.slice(3));
+  const repoRoot = process4.env.HS_VAULT_ROOT ? resolve5(process4.env.HS_VAULT_ROOT) : process4.cwd();
+  const parsed = parseInitArgs(process4.argv.slice(3));
   if (parsed.help) {
-    process3.stdout.write(`${HELP}
+    process4.stdout.write(`${HELP}
 `);
-    process3.exitCode = EXIT.OK;
+    process4.exitCode = EXIT.OK;
     return;
   }
   if (parsed.error) {
-    process3.stderr.write(`hs init: ${parsed.error.message}
+    process4.stderr.write(`hs init: ${parsed.error.message}
 `);
-    process3.exitCode = parsed.error.code;
+    process4.exitCode = parsed.error.code;
     return;
   }
   const args = parsed.args;
   if (args.customerVaultDir) {
-    const here = dirname5(fileURLToPath2(import.meta.url));
+    const here = dirname6(fileURLToPath4(import.meta.url));
     const platformRoot = resolve5(here, "..", "..");
-    const targetDir = resolve5(args.customerVaultDir);
+    const targetDir = resolve5(resolveCallerPath(args.customerVaultDir, process4.env, process4.cwd()));
     const deps = {
       platformRoot,
-      exists: (p) => existsSync4(p),
-      readdir: (p) => readdirSync(p),
+      exists: (p) => existsSync5(p),
+      readdir: (p) => readdirSync2(p),
       mkdirRecursive: (p) => {
-        mkdirSync4(p, { recursive: true });
+        mkdirSync6(p, { recursive: true });
       },
-      writeFile: (p, c) => writeFileSync4(p, c, "utf8"),
+      writeFile: (p, c) => writeFileSync6(p, c, "utf8"),
       copyFile: (src, dest) => copyFileSync(src, dest),
-      joinPath: (...s) => join9(...s),
+      joinPath: (...s) => join11(...s),
       readConfigSeed,
       readFile: (p) => {
         try {
-          return readFileSync8(p, "utf8");
+          return readFileSync11(p, "utf8");
         } catch {
           return null;
         }
@@ -1725,9 +3777,9 @@ async function main() {
     };
     const principlesResult = await resolvePrincipleSelection(args.principles);
     if (!principlesResult.ok) {
-      process3.stderr.write(`hs init: ${principlesResult.message}
+      process4.stderr.write(`hs init: ${principlesResult.message}
 `);
-      process3.exitCode = EXIT.INVALID_ARG;
+      process4.exitCode = EXIT.INVALID_ARG;
       return;
     }
     const selected = principlesResult.selected;
@@ -1746,7 +3798,7 @@ async function main() {
       manifestFilter: principleManifestFilter(selected),
       afterScaffold
     });
-    const sink2 = result2.isError ? process3.stderr : process3.stdout;
+    const sink2 = result2.isError ? process4.stderr : process4.stdout;
     if (args.json) {
       sink2.write(`${JSON.stringify({ ...result2.payload, notices })}
 `);
@@ -1756,29 +3808,29 @@ async function main() {
       for (const notice of notices) sink2.write(`${notice}
 `);
     }
-    process3.exitCode = result2.code;
+    process4.exitCode = result2.code;
     return;
   }
   const result = runInit(args, {
     repoRoot,
-    fileExists: (p) => existsSync4(p),
+    fileExists: (p) => existsSync5(p),
     readFile: (p) => {
       try {
-        return readFileSync8(p, "utf8");
+        return readFileSync11(p, "utf8");
       } catch {
         return null;
       }
     },
-    writeFile: (p, c) => writeFileSync4(p, c, "utf8"),
-    joinPath: (...s) => join9(...s),
+    writeFile: (p, c) => writeFileSync6(p, c, "utf8"),
+    joinPath: (...s) => join11(...s),
     mkdirRecursive: (p) => {
-      mkdirSync4(p, { recursive: true });
+      mkdirSync6(p, { recursive: true });
     },
     readConfigSeed
   });
-  const sink = result.isError ? process3.stderr : process3.stdout;
+  const sink = result.isError ? process4.stderr : process4.stdout;
   sink.write(`${args.json ? JSON.stringify(result.payload) : result.message}
 `);
-  process3.exitCode = result.code;
+  process4.exitCode = result.code;
 }
 runEntry("hs init", main, { fallbackCode: EXIT.WRITE_FAILED });