heyspex 0.2.2 → 0.2.3

package/dist/cli/hs-join.mjs

@@ -158,9 +158,9 @@ function resolveBearer({ envToken, credentialsText, accountId, legacyAccountId }
   if (entry?.mcp_token) return { token: entry.mcp_token, source: "credentials-file" };
   return { token: null, source: null };
 }
-function readTextOrNull(read2, path9) {
+function readTextOrNull(read2, path11) {
   try {
-    const raw = read2(path9);
+    const raw = read2(path11);
     return typeof raw === "string" ? raw : null;
   } catch {
     return null;
@@ -264,6 +264,11 @@ function readLocalDevModeRecord({ homeDir = heyspexHome2(), readFile: readFile3
     return { record: null, parseError: `unparseable dev-mode.json: ${String(err?.message ?? err)}` };
   }
 }
+function overrideCloudCheck(source, cloudKnown, staleAgainstCloud) {
+  if (source !== "local-override") return "not-applicable";
+  if (!cloudKnown) return "unverified";
+  return staleAgainstCloud ? "stale" : "in-sync";
+}
 function resolveDevMode({
   env = process.env,
   homeDir = heyspexHome2(),
@@ -303,6 +308,7 @@ function resolveDevMode({
   const semantics = deriveSemantics(mode, reliance);
   const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
   const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  const cloudCheck = overrideCloudCheck(source, cloudKnown, staleAgainstCloud);
   return {
     mode,
     reliance: semantics.reliance,
@@ -320,7 +326,8 @@ function resolveDevMode({
       present: local.record !== null,
       record: local.record,
       parseError: local.parseError,
-      staleAgainstCloud
+      staleAgainstCloud,
+      cloudCheck
     },
     cloudSetting: { known: cloudKnown, value: cloudValue }
   };
@@ -1072,7 +1079,7 @@ var require_main = __commonJS({
   "node_modules/dotenv/lib/main.js"(exports2, module2) {
     "use strict";
     var fs4 = __require("fs");
-    var path9 = __require("path");
+    var path11 = __require("path");
     var os3 = __require("os");
     var crypto3 = __require("crypto");
     var packageJson = require_package();
@@ -1188,7 +1195,7 @@ var require_main = __commonJS({
           possibleVaultPath = options2.path.endsWith(".vault") ? options2.path : `${options2.path}.vault`;
         }
       } else {
-        possibleVaultPath = path9.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path11.resolve(process.cwd(), ".env.vault");
       }
       if (fs4.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
@@ -1196,7 +1203,7 @@ var require_main = __commonJS({
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path9.join(os3.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path11.join(os3.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options2) {
       const debug = Boolean(options2 && options2.debug);
@@ -1213,7 +1220,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options2) {
-      const dotenvPath2 = path9.resolve(process.cwd(), ".env");
+      const dotenvPath2 = path11.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options2 && options2.debug);
       const quiet = options2 && "quiet" in options2 ? options2.quiet : true;
@@ -1237,13 +1244,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path10 of optionPaths) {
+      for (const path12 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs4.readFileSync(path10, { encoding }));
+          const parsed = DotenvModule.parse(fs4.readFileSync(path12, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options2);
         } catch (e) {
           if (debug) {
-            _debug(`Failed to load ${path10} ${e.message}`);
+            _debug(`Failed to load ${path12} ${e.message}`);
           }
           lastError = e;
         }
@@ -1258,7 +1265,7 @@ var require_main = __commonJS({
         const shortPaths = [];
         for (const filePath of optionPaths) {
           try {
-            const relative = path9.relative(process.cwd(), filePath);
+            const relative = path11.relative(process.cwd(), filePath);
             shortPaths.push(relative);
           } catch (e) {
             if (debug) {
@@ -1435,17 +1442,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path9) {
-      const ctrl = callVisitor(key, node, visitor, path9);
+    function visit_(key, node, visitor, path11) {
+      const ctrl = callVisitor(key, node, visitor, path11);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path9, ctrl);
-        return visit_(key, ctrl, visitor, path9);
+        replaceNode(key, path11, ctrl);
+        return visit_(key, ctrl, visitor, path11);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path9 = Object.freeze(path9.concat(node));
+          path11 = Object.freeze(path11.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path9);
+            const ci = visit_(i, node.items[i], visitor, path11);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -1456,13 +1463,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path9 = Object.freeze(path9.concat(node));
-          const ck = visit_("key", node.key, visitor, path9);
+          path11 = Object.freeze(path11.concat(node));
+          const ck = visit_("key", node.key, visitor, path11);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path9);
+          const cv = visit_("value", node.value, visitor, path11);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -1483,17 +1490,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path9) {
-      const ctrl = await callVisitor(key, node, visitor, path9);
+    async function visitAsync_(key, node, visitor, path11) {
+      const ctrl = await callVisitor(key, node, visitor, path11);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path9, ctrl);
-        return visitAsync_(key, ctrl, visitor, path9);
+        replaceNode(key, path11, ctrl);
+        return visitAsync_(key, ctrl, visitor, path11);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path9 = Object.freeze(path9.concat(node));
+          path11 = Object.freeze(path11.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path9);
+            const ci = await visitAsync_(i, node.items[i], visitor, path11);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -1504,13 +1511,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path9 = Object.freeze(path9.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path9);
+          path11 = Object.freeze(path11.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path11);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path9);
+          const cv = await visitAsync_("value", node.value, visitor, path11);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -1537,23 +1544,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path9) {
+    function callVisitor(key, node, visitor, path11) {
       if (typeof visitor === "function")
-        return visitor(key, node, path9);
+        return visitor(key, node, path11);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path9);
+        return visitor.Map?.(key, node, path11);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path9);
+        return visitor.Seq?.(key, node, path11);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path9);
+        return visitor.Pair?.(key, node, path11);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path9);
+        return visitor.Scalar?.(key, node, path11);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path9);
+        return visitor.Alias?.(key, node, path11);
       return void 0;
     }
-    function replaceNode(key, path9, node) {
-      const parent = path9[path9.length - 1];
+    function replaceNode(key, path11, node) {
+      const parent = path11[path11.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -2163,10 +2170,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path9, value) {
+    function collectionFromPath(schema, path11, value) {
       let v = value;
-      for (let i = path9.length - 1; i >= 0; --i) {
-        const k = path9[i];
+      for (let i = path11.length - 1; i >= 0; --i) {
+        const k = path11[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -2185,7 +2192,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path9) => path9 == null || typeof path9 === "object" && !!path9[Symbol.iterator]().next().done;
+    var isEmptyPath = (path11) => path11 == null || typeof path11 === "object" && !!path11[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -2215,11 +2222,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path9, value) {
-        if (isEmptyPath(path9))
+      addIn(path11, value) {
+        if (isEmptyPath(path11))
           this.add(value);
         else {
-          const [key, ...rest] = path9;
+          const [key, ...rest] = path11;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -2233,8 +2240,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path9) {
-        const [key, ...rest] = path9;
+      deleteIn(path11) {
+        const [key, ...rest] = path11;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -2248,8 +2255,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path9, keepScalar) {
-        const [key, ...rest] = path9;
+      getIn(path11, keepScalar) {
+        const [key, ...rest] = path11;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -2267,8 +2274,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path9) {
-        const [key, ...rest] = path9;
+      hasIn(path11) {
+        const [key, ...rest] = path11;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -2278,8 +2285,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path9, value) {
-        const [key, ...rest] = path9;
+      setIn(path11, value) {
+        const [key, ...rest] = path11;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -4794,9 +4801,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path9, value) {
+      addIn(path11, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path9, value);
+          this.contents.addIn(path11, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -4871,14 +4878,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path9) {
-        if (Collection.isEmptyPath(path9)) {
+      deleteIn(path11) {
+        if (Collection.isEmptyPath(path11)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path9) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path11) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -4893,10 +4900,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path9, keepScalar) {
-        if (Collection.isEmptyPath(path9))
+      getIn(path11, keepScalar) {
+        if (Collection.isEmptyPath(path11))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path9, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path11, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -4907,10 +4914,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path9) {
-        if (Collection.isEmptyPath(path9))
+      hasIn(path11) {
+        if (Collection.isEmptyPath(path11))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path9) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path11) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -4927,13 +4934,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path9, value) {
-        if (Collection.isEmptyPath(path9)) {
+      setIn(path11, value) {
+        if (Collection.isEmptyPath(path11)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path9), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path11), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path9, value);
+          this.contents.setIn(path11, value);
         }
       }
       /**
@@ -6893,9 +6900,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path9) => {
+    visit.itemAtPath = (cst, path11) => {
       let item = cst;
-      for (const [field, index2] of path9) {
+      for (const [field, index2] of path11) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index2];
@@ -6904,23 +6911,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path9) => {
-      const parent = visit.itemAtPath(cst, path9.slice(0, -1));
-      const field = path9[path9.length - 1][0];
+    visit.parentCollection = (cst, path11) => {
+      const parent = visit.itemAtPath(cst, path11.slice(0, -1));
+      const field = path11[path11.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path9, item, visitor) {
-      let ctrl = visitor(item, path9);
+    function _visit(path11, item, visitor) {
+      let ctrl = visitor(item, path11);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path9.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path11.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -6931,10 +6938,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path9);
+            ctrl = ctrl(item, path11);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path9) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path11) : ctrl;
     }
     exports2.visit = visit;
   }
@@ -10789,11 +10796,11 @@ var require_baseGet = __commonJS({
     "use strict";
     var castPath = require_castPath();
     var toKey = require_toKey();
-    function baseGet(object, path9) {
-      path9 = castPath(path9, object);
-      var index2 = 0, length = path9.length;
+    function baseGet(object, path11) {
+      path11 = castPath(path11, object);
+      var index2 = 0, length = path11.length;
       while (object != null && index2 < length) {
-        object = object[toKey(path9[index2++])];
+        object = object[toKey(path11[index2++])];
       }
       return index2 && index2 == length ? object : void 0;
     }
@@ -10806,8 +10813,8 @@ var require_get = __commonJS({
   "node_modules/lodash/get.js"(exports2, module2) {
     "use strict";
     var baseGet = require_baseGet();
-    function get2(object, path9, defaultValue) {
-      var result = object == null ? void 0 : baseGet(object, path9);
+    function get2(object, path11, defaultValue) {
+      var result = object == null ? void 0 : baseGet(object, path11);
       return result === void 0 ? defaultValue : result;
     }
     module2.exports = get2;
@@ -22739,9 +22746,9 @@ var require_lib2 = __commonJS({
 
 // spex-console/bin/hs-join.ts
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "node:fs";
 import { userInfo } from "node:os";
-import { basename as basename4, dirname as dirname6, join as join16, resolve as resolve5 } from "node:path";
+import { basename as basename5, dirname as dirname6, join as join16, resolve as resolve5 } from "node:path";
 import process4 from "node:process";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
@@ -22852,10 +22859,10 @@ function classifyHttpFailureReason(res) {
   if (res.status === 401) return "unauthorized";
   return "server-error";
 }
-async function cloudHttpRequest(http, method, path9, body) {
-  const scopeHeaders = http.scope ? http.scope.headersFor(method, path9) : {};
+async function cloudHttpRequest(http, method, path11, body) {
+  const scopeHeaders = http.scope ? http.scope.headersFor(method, path11) : {};
   try {
-    const res = await http.fetchImpl(`${http.consoleUrl}${path9}`, {
+    const res = await http.fetchImpl(`${http.consoleUrl}${path11}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -26127,8 +26134,16 @@ var LAUNCHER_TEMPLATE = [
   "//   4. node_modules/heyspex up from $__ENV__, $CLAUDE_PROJECT_DIR, $CURSOR_PROJECT_DIR, cwd",
   "//   5. <npm root -g>/heyspex                    a global install, last resort",
   "// Nothing found -> one stderr line and exit 0 (fail-open, like the shim itself).",
+  "//",
+  "// The same resolution starts the package's other entrypoints, so no committed",
+  "// file names node_modules/heyspex directly and a repo with no node_modules of",
+  "// its own still works off a global install:",
+  "//   --mcp         the stdio MCP server          (.mcp.json, .cursor/mcp.json)",
+  "//   --statusline  the Claude Code status line   (statusLine.command)",
+  "//   --resolve     print the package root, exit 0; exit 1 when none (hs doctor)",
   "import { spawnSync } from 'node:child_process';",
-  "import { existsSync } from 'node:fs';",
+  "import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs';",
+  "import { homedir } from 'node:os';",
   "import { dirname, resolve } from 'node:path';",
   "import { fileURLToPath, pathToFileURL } from 'node:url';",
   "",
@@ -26138,6 +26153,7 @@ var LAUNCHER_TEMPLATE = [
   "const text = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);",
   "const hasShim = (root) => Boolean(root) && existsSync(resolve(root, ...SHIM));",
   "",
+  "__YIELD__",
   "function packageUpFrom(start) {",
   "  let dir = resolve(start);",
   "  for (;;) {",
@@ -26172,31 +26188,109 @@ var LAUNCHER_TEMPLATE = [
   "  if (hasShim(global)) root = global;",
   "}",
   "",
+  "const ENTRYPOINTS = {",
+  "  '--mcp': 'vendor/heyspex-mcp/cli.mjs',",
+  "  '--statusline': 'scripts/claude-statusline/statusline-command.mjs',",
+  "};",
+  "const mode = process.argv[2];",
+  "const entry = Object.hasOwn(ENTRYPOINTS, mode) ? ENTRYPOINTS[mode] : null;",
+  "",
   "if (!root) {",
+  "  const what = entry || mode === '--resolve' ? mode : 'hook ' + (mode ?? '?');",
   "  process.stderr.write(",
-  "    '[heyspex] hook ' + (process.argv[2] ?? '?') + ' skipped: no heyspex package found ' +",
-  `      '(run "npm install heyspex" in this repo, or set HEYSPEX_PLATFORM_ROOT). Looked for __SHIM__ under ' +`,
-  "      'HEYSPEX_PLATFORM_ROOT, HEYSPEX_MCP_ENTRY, node_modules/heyspex up from ' + starts.join(', ') + ', and npm root -g.\\n',",
+  "    '[heyspex] ' + what + ' skipped: no heyspex package found ' +",
+  `      '(run "npm install heyspex" or "npm link heyspex" in this repo, install it globally, or set HEYSPEX_PLATFORM_ROOT). ' +`,
+  "      'Looked for __SHIM__ under HEYSPEX_PLATFORM_ROOT, HEYSPEX_MCP_ENTRY, node_modules/heyspex up from ' + starts.join(', ') + ', and npm root -g.\\n',",
   "  );",
+  "  // Hooks and the status line fail open; the MCP server and --resolve fail",
+  "  // loudly, so the client and hs doctor both see it.",
+  "  process.exit(mode === '--mcp' || mode === '--resolve' ? 1 : 0);",
+  "}",
+  "if (mode === '--resolve') {",
+  "  process.stdout.write(root + '\\n');",
   "  process.exit(0);",
   "}",
   "",
   "// argv is already [node, <this file>, <hook>, ...args] -- the shape the shim",
-  '// reads; the shim path replaces this file so a shim guarded by "am I main?"',
-  "// (the Cursor one) runs exactly as if Cursor had invoked it directly.",
-  "const shim = resolve(root, ...SHIM);",
-  "process.argv[1] = shim;",
+  '// reads; the target replaces this file so a script guarded by "am I main?"',
+  "// runs exactly as if it had been invoked directly. Real path, so that guard",
+  "// still matches when node_modules/heyspex is an npm link or a junction (node",
+  "// realpaths import.meta.url but leaves argv[1] alone).",
+  "let target = resolve(root, ...(entry ? entry.split('/') : SHIM));",
   "try {",
-  "  await import(pathToFileURL(shim).href);",
+  "  target = realpathSync(target);",
+  "} catch {",
+  "  // keep the resolved path",
+  "}",
+  "if (entry) process.argv.splice(2, 1);",
+  "process.argv[1] = target;",
+  "try {",
+  "  await import(pathToFileURL(target).href);",
   "} catch (err) {",
-  "  process.stderr.write('[heyspex] hook ' + (process.argv[2] ?? '?') + ' skipped: ' + (err && err.message ? err.message : err) + '\\n');",
+  "  process.stderr.write('[heyspex] ' + (entry ? mode : 'hook ' + (process.argv[2] ?? '?')) + ' skipped: ' + (err && err.message ? err.message : err) + '\\n');",
+  "  // Hooks and the status line fail open; the MCP server fails loudly.",
+  "  if (mode === '--mcp') process.exit(1);",
   "  process.exit(0);",
   "}",
   ""
 ].join("\n");
+var LAUNCHER_YIELD_MARKER = "// yields-to-plugin: v1";
+var LAUNCHER_YIELD_BLOCK = [
+  LAUNCHER_YIELD_MARKER + " -- one source of hooks: when the heyspex plugin is enabled on this machine",
+  "// its own launcher (plugins/heyspex/bin/run-hook.mjs, which never calls this file) already runs every",
+  "// hook, so this committed row exits 0 silently before resolving anything and each hook fires ONCE.",
+  "//   HEYSPEX_REPO_HOOKS=1                      never yield (the repo rows are the chosen source);",
+  `//   enabledPlugins["heyspex@..."] === false    in ~/.claude/settings.json or this repo's .claude/`,
+  "//                                             settings[.local].json: plugin off here, the row runs;",
+  "//   plugin evidence (what `hs doctor` hook-double-fire reads): a heyspex@... key in",
+  "//     ~/.claude/plugins/installed_plugins.json, enabledPlugins naming heyspex with a non-false",
+  "//     value, or a heyspex directory under ~/.copilot/installed-plugins | ~/.copilot/plugins.",
+  "function readJson(file) {",
+  "  try { return JSON.parse(readFileSync(file, 'utf8')); } catch { return undefined; }",
+  "}",
+  "function listDir(dir) {",
+  "  try { return readdirSync(dir); } catch { return []; }",
+  "}",
+  "function pluginTakesThisHook() {",
+  "  const flag = text(env.HEYSPEX_REPO_HOOKS);",
+  "  if (flag && flag !== '0' && flag.toLowerCase() !== 'false') return false;",
+  "  const home = homedir();",
+  "  const repo = resolve(here, '..', '..');",
+  "  const isHeyspex = (k) => /^heyspex(@|$)/i.test(k);",
+  "  let enabled = false;",
+  "  for (const f of [resolve(home, '.claude', 'settings.json'), resolve(repo, '.claude', 'settings.json'), resolve(repo, '.claude', 'settings.local.json')]) {",
+  "    const settings = readJson(f);",
+  "    const ep = settings && typeof settings === 'object' ? settings.enabledPlugins : null;",
+  "    if (!ep || typeof ep !== 'object') continue;",
+  "    for (const [k, v] of Object.entries(ep)) {",
+  "      if (!isHeyspex(k)) continue;",
+  "      if (v === false) return false;",
+  "      enabled = true;",
+  "    }",
+  "  }",
+  "  if (enabled) return true;",
+  "  const installed = readJson(resolve(home, '.claude', 'plugins', 'installed_plugins.json'));",
+  "  if (installed && typeof installed === 'object' && Object.keys(installed.plugins && typeof installed.plugins === 'object' ? installed.plugins : installed).some(isHeyspex)) return true;",
+  "  for (const sub of ['installed-plugins', 'plugins']) {",
+  "    const dir = resolve(home, '.copilot', sub);",
+  "    const names = listDir(dir);",
+  "    if (names.some((n) => /heyspex/i.test(n))) return true;",
+  "    if (names.some((n) => listDir(resolve(dir, n)).some((m) => /heyspex/i.test(m)))) return true;",
+  "  }",
+  "  return false;",
+  "}",
+  "// Only a HOOK EVENT yields: --mcp / --statusline / --resolve and an agent-run",
+  "// `<script> --directive <key>` fetch are not hook events the plugin could run in",
+  "// our place, so they always go on to the package below.",
+  "const yieldMode = process.argv[2];",
+  "const notAHookEvent = ['--mcp', '--statusline', '--resolve'].includes(yieldMode) || process.argv.includes('--directive');",
+  "if (!notAHookEvent && pluginTakesThisHook()) process.exit(0);",
+  "",
+  ""
+].join("\n");
 function renderCustomerLauncher(surface = "claude") {
   const l = CUSTOMER_LAUNCHERS[surface];
-  return LAUNCHER_TEMPLATE.replace(
+  return LAUNCHER_TEMPLATE.replace("__YIELD__\n", surface === "claude" ? LAUNCHER_YIELD_BLOCK : "").replace(
     /__(REGISTRY|ENV|LAUNCHER|SHIM)__/g,
     (_m, token) => token === "REGISTRY" ? l.registry : token === "ENV" ? l.projectDirEnv : token === "LAUNCHER" ? l.rel.join("/") : l.shim
   );
@@ -26422,25 +26516,33 @@ var MARKER_RE = /\n<!-- heyspex-kit: managed by hs install \(sha256:([0-9a-f]{16
 function shortHash(text2) {
   return createHash("sha256").update(text2, "utf8").digest("hex").slice(0, 16);
 }
+function normalizeEol(text2) {
+  return text2 === null || text2 === void 0 ? text2 : String(text2).replace(/\r\n/g, "\n");
+}
 function renderKitCommand(content, platformRoot) {
-  const body = `${rewritePlatformPaths(content, platformRoot).replace(/\s+$/, "")}
+  const body = `${rewritePlatformPaths(normalizeEol(content), platformRoot).replace(/\s+$/, "")}
 `;
   return `${body}
 <!-- heyspex-kit: managed by hs install (sha256:${shortHash(body)}). Edit freely: once edited, hs install leaves this file alone. -->
 `;
 }
 function kitFileState(content) {
-  const m = String(content).match(MARKER_RE);
+  const text2 = normalizeEol(String(content));
+  const m = text2.match(MARKER_RE);
   if (!m) return "unmanaged";
-  const body = String(content).slice(0, m.index).replace(/\n$/, "");
-  return shortHash(`${body}
-`) === m[1] ? "managed" : "customized";
+  const body = `${text2.slice(0, m.index).replace(/\n$/, "")}
+`;
+  if (shortHash(body) === m[1]) return "managed";
+  if (shortHash(`${body.slice(0, -1).replace(/\n/g, "\r\n")}
+`) === m[1]) return "managed";
+  return "customized";
 }
 function planKitFileWrite({ existing, rendered, raw, force }) {
   if (existing === null || existing === void 0) return { write: true, reason: "missing" };
-  if (existing === rendered) return { write: false, reason: "unchanged" };
-  if (kitFileState(existing) === "managed") return { write: true, reason: "update" };
-  if (existing === raw) return { write: true, reason: "legacy-copy" };
+  const have = normalizeEol(existing);
+  if (have === normalizeEol(rendered)) return { write: false, reason: "unchanged" };
+  if (kitFileState(have) === "managed") return { write: true, reason: "update" };
+  if (have === normalizeEol(raw)) return { write: true, reason: "legacy-copy" };
   return force ? { write: true, reason: "forced" } : { write: false, reason: "customized" };
 }
 function listKitCommandFiles(platformRoot, deps, opts = {}) {
@@ -26537,6 +26639,11 @@ import { join as join6 } from "node:path";
 init_credentials();
 var CLOUD_CONSOLE_URL2 = "https://app.heyspex.com";
 var LOCAL_CONSOLE_URL2 = "http://localhost:3000";
+function overrideCloudCheck2(source, cloudKnown, staleAgainstCloud) {
+  if (source !== "local-override") return "not-applicable";
+  if (!cloudKnown) return "unverified";
+  return staleAgainstCloud ? "stale" : "in-sync";
+}
 function normalizeMode2(raw) {
   const v = String(raw ?? "").trim().toLowerCase();
   if (v === "prod" || v === "production") return { mode: "prod", reliance: "cloud" };
@@ -26644,6 +26751,7 @@ function resolveDevMode2({
   const semantics = deriveSemantics2(mode, reliance);
   const consoleUrl = source === "local-override" && local.record?.console_url ? local.record.console_url.replace(/\/+$/, "") : semantics.consoleUrl;
   const staleAgainstCloud = source === "local-override" && cloudValue !== null && (cloudValue.mode !== mode || mode === "dev" && cloudValue.reliance !== semantics.reliance);
+  const cloudCheck = overrideCloudCheck2(source, cloudKnown, staleAgainstCloud);
   return {
     mode,
     reliance: semantics.reliance,
@@ -26661,7 +26769,8 @@ function resolveDevMode2({
       present: local.record !== null,
       record: local.record,
       parseError: local.parseError,
-      staleAgainstCloud
+      staleAgainstCloud,
+      cloudCheck
     },
     cloudSetting: { known: cloudKnown, value: cloudValue }
   };
@@ -26697,7 +26806,7 @@ init_credentials();
 import { randomUUID } from "node:crypto";
 
 // spex-console/src/lib/cli/control-shared.ts
-import path3 from "node:path";
+import path4 from "node:path";
 
 // scripts/lib/hs-command.mjs
 import { existsSync as existsSync2 } from "node:fs";
@@ -26720,8 +26829,8 @@ var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER
 // vendor/heyspex-mcp/console-fetch.mjs
 init_heyspex_home();
 init_credentials();
-import { readFileSync as readFileSync10 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { join as join10 } from "node:path";
 
 // vendor/heyspex-mcp/vault-less-endpoints.mjs
@@ -26734,14 +26843,14 @@ var VAULT_LESS_ENDPOINTS = Object.freeze([
   "GET /api/workspaces",
   "* /api/admin/dev-mode"
 ]);
-function pathnameOf(path9) {
-  const raw = String(path9 ?? "").split("?")[0].split("#")[0];
+function pathnameOf(path11) {
+  const raw = String(path11 ?? "").split("?")[0].split("#")[0];
   const noTrailing = raw.length > 1 ? raw.replace(/\/+$/, "") : raw;
   return noTrailing || "/";
 }
-function isVaultLessEndpoint(method, path9) {
+function isVaultLessEndpoint(method, path11) {
   const m = String(method || "GET").toUpperCase();
-  const pathname = pathnameOf(path9);
+  const pathname = pathnameOf(path11);
   return VAULT_LESS_ENDPOINTS.some((row2) => {
     const [rowMethod, rowPath] = row2.split(" ");
     return rowPath === pathname && (rowMethod === "*" || rowMethod === m);
@@ -26761,7 +26870,9 @@ import {
 import { basename, join as join8, isAbsolute as isAbsolute2 } from "node:path";
 
 // scripts/lib/shared-path-helpers.mjs
+import { realpathSync } from "node:fs";
 import { isAbsolute, resolve as resolve3, sep } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveCodeRoot({
   explicit,
   packageRoot,
@@ -26780,9 +26891,30 @@ function resolveCodeRoot({
 
 // vendor/heyspex-mcp/vault-resolve.mjs
 init_heyspex_home();
-import { existsSync as existsSync4, readFileSync as readFileSync9 } from "node:fs";
-import { homedir as homedir7, tmpdir } from "node:os";
-import { dirname as dirname4, join as join9, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
+import { homedir as homedir8, tmpdir } from "node:os";
+
+// vendor/heyspex-mcp/usable-dir-env.mjs
+import { statSync } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
+
+// vendor/heyspex-mcp/vault-resolve.mjs
+import { basename as basename2, dirname as dirname4, join as join9, resolve as resolve4 } from "node:path";
+
+// vendor/heyspex-mcp/vault-binding.mjs
+import {
+  copyFileSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync2,
+  renameSync as renameSync4,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import path3 from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
@@ -26884,11 +27016,11 @@ function readPairedBearer(opts = {}) {
 function readPairedToken(opts = {}) {
   return readPairedBearer(opts).token ?? void 0;
 }
-function scopeHeadersFor(scope, method, path9) {
+function scopeHeadersFor(scope, method, path11) {
   if (scope === "none") {
-    if (!isVaultLessEndpoint(method, path9)) {
+    if (!isVaultLessEndpoint(method, path11)) {
       throw new Error(
-        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path9} is vault-scoped and must name { accountId, vaultId }.`
+        `controlRequest: scope "none" is only allowed for the vault-less endpoints (${VAULT_LESS_ENDPOINTS.join(", ")}); ${method.toUpperCase()} ${path11} is vault-scoped and must name { accountId, vaultId }.`
       );
     }
     return {};
@@ -26899,7 +27031,7 @@ function cloudRequestScope(scope) {
   const named = { accountId: scope.accountId, vaultId: scope.vaultId };
   return {
     ...named,
-    headersFor: (method, path9) => isVaultLessEndpoint(method, path9) ? {} : scopeHeadersFor(named, method, path9)
+    headersFor: (method, path11) => isVaultLessEndpoint(method, path11) ? {} : scopeHeadersFor(named, method, path11)
   };
 }
 function withCloudScope(deps, accountId, vaultId) {
@@ -27146,12 +27278,15 @@ var HELP = [
   "(spex-console/src/lib/cli/template-manifest.ts) \u2014 universal docs",
   "copied verbatim, template-shape docs written as author-prompt skeletons \u2014",
   "plus a generated CLAUDE.md, the kept-principles index, and the template_version",
-  "pin; with --git, one initial `git init` + commit. Rerunnable: a <dir> that already",
-  "holds heyspex.yaml and an empty/placeholder-only specs/ is accepted, existing",
-  "files are never overwritten (an existing CLAUDE.md gets a CLAUDE.md.template",
-  "beside it), and the result lists each manifest row as created or kept. Refuses a",
-  "non-empty <dir> without heyspex.yaml, or a specs/ holding managed specs.",
-  "See init.customer-vault.ts.",
+  "pin; with --git, one initial `git init` + commit. On an EXISTING vault (<dir>",
+  "holds heyspex.yaml with a vault_id) it is a REFRESH \u2014 the repair `hs doctor`'s",
+  "vault-template row names: only missing shipped files are added, template_version",
+  "is written/updated in heyspex.yaml (every other byte and the vault_id kept),",
+  "nothing existing is ever overwritten (an existing CLAUDE.md gets a",
+  "CLAUDE.md.template beside it), the result lists each manifest row as created or",
+  "kept, and a second run writes nothing. <dir> may be any path (a satellite repo",
+  "names its vault, e.g. `hs init --customer-vault ../my-specs`). Refuses only a",
+  "non-empty <dir> that has no heyspex.yaml. See init.customer-vault.ts.",
   "",
   "Flags:",
   "  --console-url <url>  console_url value (default: the mode-aware console --",
@@ -27415,9 +27550,9 @@ function detectMarkerAttachment(repoRoot, deps) {
 function readPinnedVaultRoot(repoRoot, deps) {
   const pins = [];
   for (const rel of SATELLITE_MANIFEST_RELS) {
-    const path9 = deps.joinPath(repoRoot, ...rel);
-    if (!deps.fileExists(path9)) continue;
-    const raw = deps.readFile(path9);
+    const path11 = deps.joinPath(repoRoot, ...rel);
+    if (!deps.fileExists(path11)) continue;
+    const raw = deps.readFile(path11);
     if (!raw) continue;
     let value;
     try {
@@ -27487,7 +27622,7 @@ function checkHarnessCommandDrift(repoRoot, deps) {
       const installedContent = deps.fileExists(installedPath) ? deps.readFile(installedPath) : null;
       if (installedContent === null) {
         out.missingFiles.push(`${label}/${f.file}`);
-      } else if (installedContent !== f.content) {
+      } else if (normalizeEol(installedContent) !== normalizeEol(f.content)) {
         out.staleFiles.push(`${label}/${f.file}`);
       }
     }
@@ -27507,8 +27642,8 @@ function row(id, label, present, detail) {
     ...detail ? { detail } : {}
   };
 }
-function readIfExists(deps, path9) {
-  return deps.fileExists(path9) ? deps.readFile(path9) : null;
+function readIfExists(deps, path11) {
+  return deps.fileExists(path11) ? deps.readFile(path11) : null;
 }
 var PRE_COMMIT_HOOK_MARKER = "run-pre-commit-checks.mjs";
 function hasHeyspexMcpEntry(raw) {
@@ -27818,12 +27953,12 @@ function runConnectChecks(repoRoot, deps, opts = {}) {
   };
 }
 var CLOUD_READ_TIMEOUT_MS = 8e3;
-async function cloudGet(http, token, path9) {
+async function cloudGet(http, token, path11) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), CLOUD_READ_TIMEOUT_MS);
   timer.unref?.();
   try {
-    const res = await http.fetch(`${http.consoleUrl.replace(/\/+$/, "")}${path9}`, {
+    const res = await http.fetch(`${http.consoleUrl.replace(/\/+$/, "")}${path11}`, {
       method: "GET",
       headers: token ? { authorization: `Bearer ${token}` } : {},
       signal: controller.signal
@@ -27841,7 +27976,7 @@ async function cloudGet(http, token, path9) {
     clearTimeout(timer);
   }
 }
-function readFailure(read2, path9, http) {
+function readFailure(read2, path11, http) {
   if (read2 === null) {
     return {
       cause: "no sign-in token on this machine, so the console was not asked",
@@ -27857,9 +27992,9 @@ function readFailure(read2, path9, http) {
     };
   }
   if (read2.status === 401) {
-    return { cause: `GET ${path9} answered HTTP 401 (the sign-in was refused)`, repair: "hs login" };
+    return { cause: `GET ${path11} answered HTTP 401 (the sign-in was refused)`, repair: "hs login" };
   }
-  return { cause: `GET ${path9} answered HTTP ${read2.status}`, repair: retry };
+  return { cause: `GET ${path11} answered HTTP ${read2.status}`, repair: retry };
 }
 var str2 = (v) => typeof v === "string" && v ? v : null;
 function cloudRow(id, fields) {
@@ -28047,7 +28182,13 @@ async function defaultCheckMcpBuild(deps, opts) {
   }
 }
 var shortFp = (fp) => fp ? fp.slice(0, 12) : null;
-function hookScriptPath(command, repoRoot) {
+function hookScriptPath(command, repoRoot, joinPath) {
+  const bootstrap = /^\s*node\s+-e\s+"[^"]*\/\/([^"\s]+)"/.exec(command);
+  if (bootstrap) {
+    const rel = bootstrap[1].replace(/^\/+/, "");
+    if (rel === "bin/run-hook.mjs") return null;
+    return joinPath(repoRoot, ...rel.split("/"));
+  }
   const m = /^\s*node\s+(?:"([^"]+)"|(\S+))/.exec(command);
   const raw = m?.[1] ?? m?.[2];
   if (!raw) return null;
@@ -28081,7 +28222,7 @@ function hooksRow(repoRoot, deps) {
       const list = Array.isArray(group2?.hooks) ? group2.hooks : [];
       for (const h of list) {
         if (typeof h?.command !== "string" || ourHookTail(h.command) === null) continue;
-        const script = hookScriptPath(h.command, repoRoot);
+        const script = hookScriptPath(h.command, repoRoot, deps.joinPath);
         if (script) scripts.add(script);
       }
     }
@@ -28121,7 +28262,7 @@ async function mcpBuildRow(vaultSubject, deps) {
   );
 }
 async function readCloudView(http, tokens) {
-  const get2 = (token, path9) => http && token ? cloudGet(http, token, path9) : Promise.resolve(null);
+  const get2 = (token, path11) => http && token ? cloudGet(http, token, path11) : Promise.resolve(null);
   const [session, vaults2, workspaces2, devMode] = await Promise.all([
     get2(tokens.current, "/api/mcp/session"),
     get2(tokens.repo, "/api/vaults?include_archived=true"),
@@ -28132,9 +28273,9 @@ async function readCloudView(http, tokens) {
     cause: "no console URL configured for this machine",
     repair: "hs login"
   };
-  const fail = (read2, path9) => http ? readFailure(read2, path9, http) : noConsole;
-  const shapeFailure = (path9, what) => ({
-    cause: `GET ${path9} answered without ${what}`,
+  const fail = (read2, path11) => http ? readFailure(read2, path11, http) : noConsole;
+  const shapeFailure = (path11, what) => ({
+    cause: `GET ${path11} answered without ${what}`,
     repair: `retry \`hs connect --check\` once ${http?.consoleUrl ?? "the console"} answers`
   });
   const sessionBody = session?.ok ? session.json : null;
@@ -28442,7 +28583,7 @@ function writeProjectContract(ctx, options2 = {}) {
 }
 
 // spex-console/src/lib/cli/init.customer-vault.ts
-import { basename as basename2 } from "node:path";
+import { basename as basename3 } from "node:path";
 
 // spex-console/src/lib/cli/template-manifest.sources.mjs
 var UNIVERSAL_TEMPLATE_ROWS = [
@@ -28927,41 +29068,42 @@ var SCAFFOLD_FOLDERS = [
   "checks",
   "events"
 ];
-var PLACEHOLDER_FILES = /* @__PURE__ */ new Set([".gitkeep"]);
-function isDir(deps, path9, name) {
-  if (deps.isDirectory) return deps.isDirectory(path9);
-  try {
-    const kids = deps.readdir(path9);
-    return kids.length > 0 || !name.includes(".");
-  } catch {
-    return false;
-  }
+function defaultVaultName(targetDir) {
+  return basename3(targetDir) || targetDir;
 }
-function findManagedSpecs(deps, targetDir, manifestDests) {
-  const out = [];
-  const walk = (abs, rel) => {
-    for (const name of deps.readdir(abs)) {
-      const childAbs = deps.joinPath(abs, name);
-      const childRel = `${rel}/${name}`;
-      if (isDir(deps, childAbs, name)) walk(childAbs, childRel);
-      else if (!PLACEHOLDER_FILES.has(name) && name.endsWith(".md") && !manifestDests.has(childRel))
-        out.push(childRel);
-    }
-  };
-  const specsRoot = deps.joinPath(targetDir, "specs");
-  if (deps.exists(specsRoot)) walk(specsRoot, "specs");
-  return out;
+function readTemplateVersionPin(yamlText) {
+  const m = yamlText.match(/^template_version:[ \t]*(.*?)[ \t]*$/m);
+  if (!m) return null;
+  const raw = m[1].trim();
+  const unquoted = raw.replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1");
+  return unquoted.length > 0 ? unquoted : null;
 }
-function defaultVaultName(targetDir) {
-  return basename2(targetDir) || targetDir;
+function stampTemplateVersion(content, version) {
+  if (readTemplateVersionPin(content) === version) return content;
+  const eol = content.includes("\r\n") ? "\r\n" : "\n";
+  const line = `template_version: ${version}`;
+  if (/^template_version:[^\r\n]*$/m.test(content)) {
+    return content.replace(/^template_version:[^\r\n]*$/m, line);
+  }
+  const body = content.replace(/(?:\r?\n)+$/, "");
+  return body.length === 0 ? `${line}${eol}` : `${body}${eol}${line}${eol}`;
+}
+function parentDirOf(deps, targetDir, dest) {
+  const segments = dest.split("/");
+  if (segments.length < 2) return null;
+  return deps.joinPath(targetDir, ...segments.slice(0, -1));
 }
 function runCustomerVaultInit(args, deps, options2 = {}) {
   const { targetDir } = args;
   const written = [];
   const filter = options2.manifestFilter ?? (() => true);
   const rows = TEMPLATE_MANIFEST.filter(filter);
+  const heyspexYamlPath = deps.joinPath(targetDir, "heyspex.yaml");
+  const markerPresent = deps.exists(targetDir) && deps.exists(heyspexYamlPath);
+  const existingYaml = markerPresent ? deps.readFile?.(heyspexYamlPath) ?? null : null;
+  const existingVaultId = existingYaml ? parseVaultId(existingYaml) : null;
+  const mode = markerPresent && existingVaultId ? "refresh" : "scaffold";
   if (deps.exists(targetDir)) {
-    const markerPresent = deps.exists(deps.joinPath(targetDir, "heyspex.yaml"));
     if (!markerPresent && deps.readdir(targetDir).length > 0) {
       return {
         code: EXIT.INVALID_ARG,
@@ -28971,43 +29113,43 @@ function runCustomerVaultInit(args, deps, options2 = {}) {
         written: []
       };
     }
-    if (markerPresent) {
-      const manifestDests = new Set(TEMPLATE_MANIFEST.map((r) => r.dest));
-      const managed = findManagedSpecs(deps, targetDir, manifestDests);
-      if (managed.length > 0) {
-        return {
-          code: EXIT.INVALID_ARG,
-          message: `${targetDir}/specs already holds managed spec(s) (${managed.slice(0, 3).join(", ")}${managed.length > 3 ? ", ..." : ""}) \u2014 customer-vault init refuses to write over an existing vault.`,
-          payload: { ok: false, error: "specs_not_empty", path: targetDir, specs: managed },
-          isError: true,
-          written: []
-        };
-      }
-    }
   } else {
     deps.mkdirRecursive(targetDir);
   }
-  const specsRoot = deps.joinPath(targetDir, "specs");
-  deps.mkdirRecursive(specsRoot);
-  for (const folder of SCAFFOLD_FOLDERS) {
-    deps.mkdirRecursive(deps.joinPath(specsRoot, folder));
+  if (mode === "scaffold") {
+    const specsRoot = deps.joinPath(targetDir, "specs");
+    deps.mkdirRecursive(specsRoot);
+    for (const folder of SCAFFOLD_FOLDERS) {
+      deps.mkdirRecursive(deps.joinPath(specsRoot, folder));
+    }
   }
-  const heyspexYamlPath = deps.joinPath(targetDir, "heyspex.yaml");
   let vaultId;
-  if (deps.exists(heyspexYamlPath)) {
-    const existingYaml = deps.readFile?.(heyspexYamlPath) ?? null;
-    vaultId = (existingYaml ? parseVaultId(existingYaml) : null) ?? "";
+  let pin;
+  if (markerPresent) {
+    vaultId = existingVaultId ?? "";
+    const stamped = existingYaml === null ? null : stampTemplateVersion(existingYaml, TEMPLATE_VERSION);
+    if (stamped !== null && stamped !== existingYaml) {
+      deps.writeFile(heyspexYamlPath, stamped);
+      written.push(heyspexYamlPath);
+      pin = "written";
+    } else {
+      pin = "kept";
+    }
   } else {
     vaultId = mintVaultId();
     deps.writeFile(
       heyspexYamlPath,
-      renderHeyspexYaml({
-        consoleUrl: options2.consoleUrl ?? DEFAULT_CONSOLE_URL2,
-        vaultRoot: "specs/",
-        vaultId
-      })
+      stampTemplateVersion(
+        renderHeyspexYaml({
+          consoleUrl: options2.consoleUrl ?? DEFAULT_CONSOLE_URL2,
+          vaultRoot: "specs/",
+          vaultId
+        }),
+        TEMPLATE_VERSION
+      )
     );
     written.push(heyspexYamlPath);
+    pin = "written";
   }
   const readConfigSeed = deps.readConfigSeed;
   const configSeed = seedConfigYaml(
@@ -29023,6 +29165,10 @@ function runCustomerVaultInit(args, deps, options2 = {}) {
       rowResults.push({ dest: row2.dest, action: "kept" });
       continue;
     }
+    if (mode === "refresh") {
+      const parent = parentDirOf(deps, targetDir, row2.dest);
+      if (parent && !deps.exists(parent)) deps.mkdirRecursive(parent);
+    }
     if (row2.classification === "universal-template") {
       const srcAbs = deps.joinPath(deps.platformRoot, ...row2.source.split("/"));
       deps.copyFile(srcAbs, destAbs);
@@ -29042,24 +29188,41 @@ function runCustomerVaultInit(args, deps, options2 = {}) {
       targetDir,
       vaultName: options2.vaultName ?? defaultVaultName(targetDir),
       templateVersion: TEMPLATE_VERSION,
+      mode,
       manifestRows: rows,
       rows: rowResults,
       deps,
-      recordWrite: (path9) => {
-        written.push(path9);
+      recordWrite: (path11) => {
+        written.push(path11);
       }
     };
     for (const hook of options2.afterScaffold) hook(ctx);
   }
   const createdCount = rowResults.filter((r) => r.action === "created").length;
   const keptCount = rowResults.length - createdCount;
+  const added = rowResults.filter((r) => r.action === "created").map((r) => r.dest);
+  let message2;
+  if (mode === "refresh") {
+    const parts = [];
+    if (added.length > 0)
+      parts.push(`added ${added.length} missing template file(s): ${added.join(", ")}`);
+    if (pin === "written")
+      parts.push(`pinned template_version: ${TEMPLATE_VERSION} in heyspex.yaml`);
+    const hookWrites = written.length - added.length - (pin === "written" ? 1 : 0);
+    if (hookWrites > 0) parts.push(`${hookWrites} other file(s) written`);
+    message2 = parts.length > 0 ? `Refreshed customer vault at ${targetDir}: ${parts.join("; ")} (${keptCount} existing file(s) kept untouched).` : `Customer vault at ${targetDir} is already current (template v${TEMPLATE_VERSION}, ${keptCount} file(s) kept) \u2014 nothing written.`;
+  } else {
+    message2 = `Initialized customer vault at ${targetDir} (${written.length} files written, ${createdCount} manifest rows created, ${keptCount} kept, template v${TEMPLATE_VERSION}).`;
+  }
   return {
     code: EXIT.OK,
-    message: `Initialized customer vault at ${targetDir} (${written.length} files written, ${createdCount} manifest rows created, ${keptCount} kept, template v${TEMPLATE_VERSION}).`,
+    message: message2,
     payload: {
       ok: true,
+      mode,
       targetDir,
       templateVersion: TEMPLATE_VERSION,
+      templatePin: pin,
       vaultId,
       written,
       rows: rowResults,
@@ -29101,14 +29264,14 @@ function templatePinHook() {
 }
 
 // spex-console/src/lib/cli/principle-selection.ts
-import { basename as basename3 } from "node:path";
+import { basename as basename4 } from "node:path";
 var PRINCIPLES_INDEX_DEST = "specs/principles-index.md";
 function principleKey(row2) {
-  const base = basename3(row2.dest, ".md");
+  const base = basename4(row2.dest, ".md");
   return base.startsWith("principle-") ? base.slice("principle-".length) : base;
 }
 function principleWikilink(row2) {
-  return basename3(row2.dest, ".md");
+  return basename4(row2.dest, ".md");
 }
 function parsePrinciplesFlag(value, rows) {
   const principleRows = rows.filter((row2) => row2.group === "principle");
@@ -29174,13 +29337,13 @@ function applyCustomerTemplate(args) {
       templateVersion: ctx.templateVersion
     });
     for (const file of contractFiles) {
-      const path9 = ctx.deps.joinPath(ctx.targetDir, file);
-      if (force && ctx.deps.exists(path9)) {
-        if (ctx.deps.readFile?.(path9) === content) {
+      const path11 = ctx.deps.joinPath(ctx.targetDir, file);
+      if (force && ctx.deps.exists(path11)) {
+        if (ctx.deps.readFile?.(path11) === content) {
           contracts.push({ file, action: "unchanged" });
         } else {
-          ctx.deps.writeFile(path9, content);
-          ctx.recordWrite(path9);
+          ctx.deps.writeFile(path11, content);
+          ctx.recordWrite(path11);
           contracts.push({ file, action: "overwritten" });
         }
         continue;
@@ -29219,12 +29382,17 @@ function applyCustomerTemplate(args) {
 }
 
 // spex-console/src/lib/cli/install.ts
-import { isAbsolute as isAbsolute3, resolve as resolveNodePath2 } from "node:path";
+import { isAbsolute as isAbsolute4, resolve as resolveNodePath2 } from "node:path";
+
+// spex-console/src/lib/vault-resolve/index.ts
+import { existsSync as existsSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import path5 from "node:path";
 
 // scripts/install-cursor-hooks.mjs
 import fs2 from "node:fs";
-import path4 from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import path6 from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // scripts/cursor-hooks/manifest.mjs
 var SHIM = "scripts/cursor-hooks/_run.mjs";
@@ -29368,9 +29536,9 @@ function timeoutFor(entry) {
 }
 
 // scripts/install-cursor-hooks.mjs
-var PLATFORM_ROOT = path4.resolve(path4.dirname(fileURLToPath3(import.meta.url)), "..");
-var REPO_ROOT = process.env.HS_SETUP_TARGET?.trim() ? path4.resolve(process.env.HS_SETUP_TARGET.trim()) : PLATFORM_ROOT;
-var SETTINGS_PATH = path4.join(REPO_ROOT, ".cursor", "hooks.json");
+var PLATFORM_ROOT = path6.resolve(path6.dirname(fileURLToPath4(import.meta.url)), "..");
+var REPO_ROOT = process.env.HS_SETUP_TARGET?.trim() ? path6.resolve(process.env.HS_SETUP_TARGET.trim()) : PLATFORM_ROOT;
+var SETTINGS_PATH = path6.join(REPO_ROOT, ".cursor", "hooks.json");
 function cursorKitFor(targetRoot, platformRoot = PLATFORM_ROOT) {
   const customer = !samePlatformPath(targetRoot, platformRoot);
   return {
@@ -29382,7 +29550,7 @@ function cursorKitFor(targetRoot, platformRoot = PLATFORM_ROOT) {
 }
 var KIT = cursorKitFor(REPO_ROOT);
 var ACTIVE_HOOKS = KIT.hooks;
-var LAUNCHER_PATH = path4.join(REPO_ROOT, ...CUSTOMER_LAUNCHERS.cursor.rel);
+var LAUNCHER_PATH = path6.join(REPO_ROOT, ...CUSTOMER_LAUNCHERS.cursor.rel);
 var LEGACY_MARKER = "scripts/claude-hooks/";
 function readSettings() {
   try {
@@ -29401,7 +29569,7 @@ function readSettings() {
   return { version: 1, hooks: {} };
 }
 function writeSettings(settings) {
-  fs2.mkdirSync(path4.dirname(SETTINGS_PATH), { recursive: true });
+  fs2.mkdirSync(path6.dirname(SETTINGS_PATH), { recursive: true });
   fs2.writeFileSync(SETTINGS_PATH, `${JSON.stringify(settings, null, 2)}
 `, "utf8");
 }
@@ -29436,7 +29604,7 @@ function sameEntry(raw, entry, render = KIT.commandFor) {
   const want = desiredEntry(entry, render);
   return commandOf(raw) === want.command && raw.timeout === want.timeout && (raw.matcher ?? void 0) === (want.matcher ?? void 0);
 }
-var PLUGIN_HOOKS_PATH = path4.join(REPO_ROOT, "plugins", "heyspex", "hooks", "cursor-hooks.json");
+var PLUGIN_HOOKS_PATH = path6.join(REPO_ROOT, "plugins", "heyspex", "hooks", "cursor-hooks.json");
 function pluginHooksDocument() {
   const hooks = {};
   for (const entry of HOOKS) {
@@ -29466,7 +29634,7 @@ function syncPluginHooks() {
     have = null;
   }
   if (have === want) return false;
-  fs2.mkdirSync(path4.dirname(PLUGIN_HOOKS_PATH), { recursive: true });
+  fs2.mkdirSync(path6.dirname(PLUGIN_HOOKS_PATH), { recursive: true });
   fs2.writeFileSync(PLUGIN_HOOKS_PATH, want, "utf8");
   return true;
 }
@@ -29539,7 +29707,7 @@ function install({ json = false } = {}) {
   if (KIT.customer) {
     const plan = launcherPlan();
     if (plan.write) {
-      fs2.mkdirSync(path4.dirname(LAUNCHER_PATH), { recursive: true });
+      fs2.mkdirSync(path6.dirname(LAUNCHER_PATH), { recursive: true });
       fs2.writeFileSync(LAUNCHER_PATH, plan.text, "utf8");
       launcherWritten = true;
     }
@@ -29566,10 +29734,10 @@ function install({ json = false } = {}) {
     return;
   }
   if (pluginChanged) {
-    console.log(`install-cursor-hooks: regenerated ${path4.relative(REPO_ROOT, PLUGIN_HOOKS_PATH)}`);
+    console.log(`install-cursor-hooks: regenerated ${path6.relative(REPO_ROOT, PLUGIN_HOOKS_PATH)}`);
   }
   if (launcherWritten) {
-    console.log(`install-cursor-hooks: wrote ${path4.relative(REPO_ROOT, LAUNCHER_PATH)} (resolves node_modules/heyspex)`);
+    console.log(`install-cursor-hooks: wrote ${path6.relative(REPO_ROOT, LAUNCHER_PATH)} (resolves node_modules/heyspex)`);
   }
   if (!settingsChanged) {
     console.log(`install-cursor-hooks: already installed (${ACTIVE_HOOKS.length} hooks, no changes).`);
@@ -29580,7 +29748,7 @@ function install({ json = false } = {}) {
   if (repaired.length) parts.push(`repaired ${repaired.length}`);
   if (removed.length) parts.push(`removed ${removed.length}`);
   console.log(
-    `install-cursor-hooks: ${parts.join("; ")} \u2192 ${path4.relative(REPO_ROOT, SETTINGS_PATH)} (${ACTIVE_HOOKS.length} hooks registered)`
+    `install-cursor-hooks: ${parts.join("; ")} \u2192 ${path6.relative(REPO_ROOT, SETTINGS_PATH)} (${ACTIVE_HOOKS.length} hooks registered)`
   );
   for (const line of removed) console.log(`  - ${line}`);
   console.log(
@@ -29868,11 +30036,11 @@ function readLocalReceiptSide(subject, registryOpts = {}) {
     return unreadSide(`registry.json could not be read: ${message(err)}`);
   }
 }
-async function readList(http, path9, key) {
-  const res = await cloudHttpRequest(http, "GET", path9);
+async function readList(http, path11, key) {
+  const res = await cloudHttpRequest(http, "GET", path11);
   const rows = res.json?.[key];
   if (!res.ok || !Array.isArray(rows)) {
-    return { reason: `GET ${path9.split("?")[0]} answered HTTP ${res.status}` };
+    return { reason: `GET ${path11.split("?")[0]} answered HTTP ${res.status}` };
   }
   return { rows: rows.filter((r) => Boolean(r) && typeof r === "object") };
 }
@@ -29947,7 +30115,7 @@ async function readReceiptSides(subject, deps) {
 var import_gray_matter = __toESM(require_gray_matter(), 1);
 import { createHash as createHash2 } from "node:crypto";
 import { promises as fs3 } from "node:fs";
-import path5 from "node:path";
+import path7 from "node:path";
 
 // spex-console/src/lib/vault-id.ts
 var FILE_KEY_RE = /^(?=[0-9]*[A-Z])[A-Z0-9]{4,}$/;
@@ -30529,8 +30697,8 @@ async function indexTemplateToCloud(args) {
         const res = await cloudHttpRequest(args.http, "GET", REINDEX_PATH);
         return { status: res.status, json: res.json };
       },
-      post: async (path9, body) => {
-        const res = await cloudHttpRequest(args.http, "POST", path9, body);
+      post: async (path11, body) => {
+        const res = await cloudHttpRequest(args.http, "POST", path11, body);
         return { status: res.status, json: res.json };
       }
     });
@@ -30576,39 +30744,58 @@ async function indexTemplateToCloud(args) {
 // spex-console/src/lib/cli/install.ts
 var MCP_REL = ["vendor", "heyspex-mcp", "cli.mjs"];
 var PORTABLE_MCP_CLI = Object.freeze({
+  claude: `\${CLAUDE_PROJECT_DIR:-.}/${CUSTOMER_LAUNCHERS.claude.rel.join("/")}`,
+  cursor: `\${workspaceFolder}/${CUSTOMER_LAUNCHERS.cursor.rel.join("/")}`
+});
+var LEGACY_PORTABLE_MCP_CLI = Object.freeze({
   claude: `\${CLAUDE_PROJECT_DIR:-.}/${PORTABLE_PACKAGE_DIR}/${MCP_REL.join("/")}`,
   cursor: `\${workspaceFolder}/${PORTABLE_PACKAGE_DIR}/${MCP_REL.join("/")}`
 });
+var LAUNCHER_MCP_FLAG = "--mcp";
+function mcpServerArgs(cliPath) {
+  return /[\\/]heyspex[\\/]run-hook\.mjs$/.test(cliPath) ? [cliPath, LAUNCHER_MCP_FLAG] : [cliPath];
+}
+function repairLegacyMcpManifest(manifest, surface) {
+  const servers = manifest?.mcpServers;
+  const entry = servers && typeof servers === "object" ? servers.heyspex : void 0;
+  if (!entry || !Array.isArray(entry.args) || entry.args[0] !== LEGACY_PORTABLE_MCP_CLI[surface]) {
+    return false;
+  }
+  entry.args = mcpServerArgs(PORTABLE_MCP_CLI[surface]);
+  return true;
+}
 function mcpCliArgFor(surface, platformRoot, targetDir, joinPath) {
   return samePlatformPath(targetDir, platformRoot) ? mcpCliPath(platformRoot, joinPath) : PORTABLE_MCP_CLI[surface];
 }
 function mcpCliPath(platformRoot, joinPath) {
   return joinPath(platformRoot, ...MCP_REL);
 }
-function renderCursorMcpJson(cliAbsPath, attachedVaultRoot) {
+function renderCursorMcpJson(cliAbsPath, attachedVaultRoot, opts = {}) {
+  const pin = vaultRootPin(attachedVaultRoot, "${workspaceFolder}", opts);
   return {
     mcpServers: {
       heyspex: {
         type: "stdio",
         command: "node",
-        args: [cliAbsPath],
-        env: {
-          HEYSPEX_VAULT_ROOT: attachedVaultRoot ?? "${workspaceFolder}"
-        }
+        args: mcpServerArgs(cliAbsPath),
+        ...pin ? { env: { HEYSPEX_VAULT_ROOT: pin } } : {}
       }
     }
   };
 }
-function renderClaudeMcpJson(cliAbsPath, attachedVaultRoot) {
+function vaultRootPin(attachedVaultRoot, placeholder, opts = {}) {
+  if (attachedVaultRoot) return attachedVaultRoot;
+  return opts.targetIsVault === false ? null : placeholder;
+}
+function renderClaudeMcpJson(cliAbsPath, attachedVaultRoot, opts = {}) {
+  const pin = vaultRootPin(attachedVaultRoot, "${CLAUDE_PROJECT_DIR:-.}", opts);
   return {
     mcpServers: {
       heyspex: {
         type: "stdio",
         command: "node",
-        args: [cliAbsPath],
-        env: {
-          HEYSPEX_VAULT_ROOT: attachedVaultRoot ?? "${CLAUDE_PROJECT_DIR:-.}"
-        }
+        args: mcpServerArgs(cliAbsPath),
+        ...pin ? { env: { HEYSPEX_VAULT_ROOT: pin } } : {}
       }
     }
   };
@@ -30886,7 +31073,6 @@ var WRITE_TARGET_KIND = {
   claudeMcp: "claude_mcp",
   claudeMd: "claude_md",
   agentsMd: "agents_md",
-  statuslineVendor: "statusline_vendor",
   gitignore: "gitignore",
   claudeMdTemplate: "claude_md_template",
   agentsMdTemplate: "agents_md_template"
@@ -30943,12 +31129,6 @@ var INSTALL_WRITE_TARGETS = [
     path: (targetDir, joinPath) => joinPath(targetDir, "AGENTS.md.template"),
     appliesTo: (args, opts) => Boolean(args.registerVault) && !opts.attached && opts.installContract
   },
-  {
-    kind: WRITE_TARGET_KIND.statuslineVendor,
-    rel: "scripts/claude-statusline",
-    path: (targetDir, joinPath) => joinPath(targetDir, "scripts", "claude-statusline"),
-    appliesTo: (args) => (args.statusline ?? true) && args.claude
-  },
   {
     kind: WRITE_TARGET_KIND.gitignore,
     rel: ".gitignore",
@@ -31081,7 +31261,7 @@ var INSTALL_HELP = [
 
 // spex-console/src/lib/cli/install-identity.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { join as join11 } from "node:path";
 import { createInterface } from "node:readline/promises";
 init_credentials();
@@ -31089,7 +31269,7 @@ init_credentials();
 // vendor/heyspex-mcp/whoami.mjs
 init_heyspex_home();
 init_credentials();
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 var SESSION_PATH = "/api/mcp/session";
 async function probeCredentialIdentity({ consoleUrl, token, fetchImpl = fetch } = {}) {
   if (!token) return { kind: "no_credential" };
@@ -31373,7 +31553,7 @@ function isInteractiveTerminal() {
 }
 function defaultIdentityGateIo(opts) {
   const consoleUrl = opts.consoleUrl.trim().replace(/\/+$/, "");
-  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join11(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync5(p));
+  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join11(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync7(p));
   return {
     consoleUrl,
     interactive: opts.interactive ?? isInteractiveTerminal(),
@@ -31666,9 +31846,9 @@ function detachedSatelliteWarning(repoRoot, gitRemote, registryBefore, deps) {
     reasons.push(`${wiredManifests.join(" + ")} already declares the heyspex MCP server`);
   }
   const contractFiles = ["CLAUDE.md", "AGENTS.md"].filter((name) => {
-    const path9 = deps.joinPath(repoRoot, name);
-    if (!deps.fileExists(path9)) return false;
-    const content = deps.readFile(path9);
+    const path11 = deps.joinPath(repoRoot, name);
+    if (!deps.fileExists(path11)) return false;
+    const content = deps.readFile(path11);
     return content !== null && HEYSPEX_CONTRACT_MARKERS.some((m) => content.includes(m));
   });
   if (contractFiles.length > 0) {
@@ -32487,7 +32667,32 @@ async function runConnectFullRun(args, deps) {
     const mcpConfirmedBy = "read .mcp.json + .cursor/mcp.json";
     const claudeMissing = !deps.fileExists(claudeMcpPath);
     const cursorMissing = !deps.fileExists(cursorMcpPath);
-    if (!claudeMissing && !cursorMissing) {
+    const repairedLegacy = [];
+    for (const [file, surface, missing] of [
+      [claudeMcpPath, "claude", claudeMissing],
+      [cursorMcpPath, "cursor", cursorMissing]
+    ]) {
+      if (missing || samePlatformPath(repoRoot, platformRoot)) continue;
+      let parsed = null;
+      try {
+        parsed = JSON.parse(deps.readFile(file) ?? "");
+      } catch {
+        continue;
+      }
+      if (!repairLegacyMcpManifest(parsed, surface)) continue;
+      if (!args.dryRun) deps.writeFile(file, `${JSON.stringify(parsed, null, 2)}
+`);
+      repairedLegacy.push(file);
+    }
+    if (repairedLegacy.length > 0 && !claudeMissing && !cursorMissing) {
+      steps.push({
+        id: "mcp_entry",
+        label,
+        status: "run",
+        detail: `${args.dryRun ? "would repoint" : "repointed"} ${repairedLegacy.join(", ")} at the committed launcher (${PORTABLE_MCP_CLI.claude})`,
+        confirmed_by: mcpConfirmedBy
+      });
+    } else if (!claudeMissing && !cursorMissing) {
       steps.push({
         id: "mcp_entry",
         label,
@@ -32510,12 +32715,14 @@ async function runConnectFullRun(args, deps) {
       try {
         const claudeCli = mcpCliArgFor("claude", platformRoot, repoRoot, deps.joinPath);
         const cursorCli = mcpCliArgFor("cursor", platformRoot, repoRoot, deps.joinPath);
-        const pinnedRoot = satellite?.vaultRootAbs;
+        const markerRel = satellite?.viaMarker ? satellite.vaultPath : void 0;
+        const claudePin = markerRel ? "${CLAUDE_PROJECT_DIR:-.}/" + markerRel : satellite?.vaultRootAbs;
+        const cursorPin = markerRel ? "${workspaceFolder}/" + markerRel : satellite?.vaultRootAbs;
         const written = [];
         if (claudeMissing) {
           deps.writeFile(
             claudeMcpPath,
-            `${JSON.stringify(renderClaudeMcpJson(claudeCli, pinnedRoot), null, 2)}
+            `${JSON.stringify(renderClaudeMcpJson(claudeCli, claudePin), null, 2)}
 `
           );
           written.push(claudeMcpPath);
@@ -32524,7 +32731,7 @@ async function runConnectFullRun(args, deps) {
           deps.mkdir(deps.joinPath(repoRoot, ".cursor"));
           deps.writeFile(
             cursorMcpPath,
-            `${JSON.stringify(renderCursorMcpJson(cursorCli, pinnedRoot), null, 2)}
+            `${JSON.stringify(renderCursorMcpJson(cursorCli, cursorPin), null, 2)}
 `
           );
           written.push(cursorMcpPath);
@@ -32900,11 +33107,11 @@ function resolveDoctorCommand(repoRoot, platformRoot, deps) {
   const hs = deps.joinPath(platformRoot, "bin", "hs.mjs");
   return deps.fileExists(hs) ? { args: [hs, "doctor", "--json"], confirmedBy: "hs doctor --json" } : null;
 }
-function assertMarker(content, path9, vaultId, accountId) {
-  if (content === null) throw new Error(`${path9} could not be read back after the write`);
+function assertMarker(content, path11, vaultId, accountId) {
+  if (content === null) throw new Error(`${path11} could not be read back after the write`);
   const back = parseVaultId(content);
   if (vaultId && back !== vaultId) {
-    throw new Error(`${path9} reads back vault_id ${back ?? "(none)"}, not ${vaultId}`);
+    throw new Error(`${path11} reads back vault_id ${back ?? "(none)"}, not ${vaultId}`);
   }
 }
 var MIRRORED_SKILL_DIRS = [
@@ -33058,7 +33265,7 @@ async function runFixHarnessCommands(args, deps) {
       continue;
     }
     const existingContent = deps.fileExists(installedPath) ? deps.readFile(installedPath) : null;
-    if (existingContent === f.content) {
+    if (existingContent !== null && normalizeEol(existingContent) === normalizeEol(f.content)) {
       unchangedCount += 1;
       continue;
     }
@@ -33563,14 +33770,14 @@ import {
 import {
   appendFileSync,
   closeSync,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
   openSync,
-  readFileSync as readFileSync11,
-  renameSync as renameSync4,
-  statSync,
-  unlinkSync,
-  writeFileSync as writeFileSync6,
+  readFileSync as readFileSync13,
+  renameSync as renameSync5,
+  statSync as statSync5,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync7,
   writeSync
 } from "node:fs";
 import { join as join12 } from "node:path";
@@ -33610,14 +33817,14 @@ function unwrapPrivateKey(token, wrapSaltHex, wrapped) {
 }
 function heyspexDir(vaultRoot) {
   const dir = join12(vaultRoot, ".heyspex");
-  mkdirSync6(dir, { recursive: true });
+  mkdirSync7(dir, { recursive: true });
   return dir;
 }
 function memberTokenStorePath(vaultRoot) {
   return join12(vaultRoot, ".heyspex", STORE_FILE);
 }
 function memberTokenStorePresent(vaultRoot) {
-  return existsSync6(memberTokenStorePath(vaultRoot));
+  return existsSync8(memberTokenStorePath(vaultRoot));
 }
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -33632,8 +33839,8 @@ function acquireLock(lockPath) {
     } catch (err) {
       if (err?.code !== "EEXIST") throw err;
       try {
-        if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
-          unlinkSync(lockPath);
+        if (Date.now() - statSync5(lockPath).mtimeMs > LOCK_STALE_MS) {
+          unlinkSync2(lockPath);
           continue;
         }
       } catch {
@@ -33658,16 +33865,16 @@ function withTokenLock(vaultRoot, fn) {
     } catch {
     }
     try {
-      unlinkSync(lockPath);
+      unlinkSync2(lockPath);
     } catch {
     }
   }
 }
 function readStore(vaultRoot) {
   const p = memberTokenStorePath(vaultRoot);
-  if (!existsSync6(p)) return [];
+  if (!existsSync8(p)) return [];
   try {
-    const parsed = JSON.parse(readFileSync11(p, "utf8"));
+    const parsed = JSON.parse(readFileSync13(p, "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
@@ -33676,8 +33883,8 @@ function readStore(vaultRoot) {
 function writeStore(vaultRoot, records) {
   const p = join12(heyspexDir(vaultRoot), STORE_FILE);
   const tmp = `${p}.tmp`;
-  writeFileSync6(tmp, JSON.stringify(records, null, 2) + "\n", { mode: FILE_MODE });
-  renameSync4(tmp, p);
+  writeFileSync7(tmp, JSON.stringify(records, null, 2) + "\n", { mode: FILE_MODE });
+  renameSync5(tmp, p);
 }
 function isLive(r, nowMs) {
   if (r.revokedAt) return false;
@@ -33732,14 +33939,14 @@ import { randomBytes as randomBytes3, scryptSync as scryptSync2, timingSafeEqual
 import {
   appendFileSync as appendFileSync2,
   closeSync as closeSync2,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync7,
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync8,
   openSync as openSync2,
-  readFileSync as readFileSync12,
-  renameSync as renameSync5,
-  statSync as statSync2,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync7,
+  readFileSync as readFileSync14,
+  renameSync as renameSync6,
+  statSync as statSync6,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync8,
   writeSync as writeSync2
 } from "node:fs";
 import { join as join13 } from "node:path";
@@ -33747,9 +33954,9 @@ import { join as join13 } from "node:path";
 // spex-console/src/lib/env-vault/sops.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync7 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import path6 from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import path8 from "node:path";
 function ageRecipientFingerprint(recipient, length = 12) {
   return createHash5("sha256").update(recipient, "utf8").digest("hex").slice(0, length);
 }
@@ -33766,14 +33973,14 @@ var toolCache = /* @__PURE__ */ new Map();
 function withExtendedPath(extraDirs) {
   const env = { ...process.env };
   const key = Object.keys(env).find((k) => k.toUpperCase() === "PATH") ?? "PATH";
-  env[key] = [env[key], ...extraDirs].filter(Boolean).join(path6.delimiter);
+  env[key] = [env[key], ...extraDirs].filter(Boolean).join(path8.delimiter);
   return env;
 }
 function candidateInvocations(tool) {
   const candidates = [{ command: tool, env: process.env }];
   const local = process.env.LOCALAPPDATA;
   if (local) {
-    const miseBin = path6.join(
+    const miseBin = path8.join(
       local,
       "Microsoft",
       "WinGet",
@@ -33782,14 +33989,14 @@ function candidateInvocations(tool) {
       "mise",
       "bin"
     );
-    const extra = existsSync7(miseBin) ? [miseBin] : [];
+    const extra = existsSync9(miseBin) ? [miseBin] : [];
     candidates.push({
-      command: path6.join(local, "mise", "shims", `${tool}.exe`),
+      command: path8.join(local, "mise", "shims", `${tool}.exe`),
       env: withExtendedPath(extra)
     });
   }
   candidates.push({
-    command: path6.join(homedir10(), ".local", "share", "mise", "shims", tool),
+    command: path8.join(homedir11(), ".local", "share", "mise", "shims", tool),
     env: process.env
   });
   return candidates;
@@ -34114,14 +34321,14 @@ function hashEquals2(a, b) {
 }
 function heyspexDir2(vaultRoot) {
   const dir = join13(vaultRoot, ".heyspex");
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   return dir;
 }
 function envPairingStorePath(vaultRoot) {
   return join13(vaultRoot, ".heyspex", STORE_FILE2);
 }
 function envPairingStorePresent(vaultRoot) {
-  return existsSync8(envPairingStorePath(vaultRoot));
+  return existsSync10(envPairingStorePath(vaultRoot));
 }
 function auditPath(vaultRoot) {
   return join13(heyspexDir2(vaultRoot), AUDIT_FILE);
@@ -34139,8 +34346,8 @@ function acquireLock2(lockPath) {
     } catch (err) {
       if (err?.code !== "EEXIST") throw err;
       try {
-        if (Date.now() - statSync2(lockPath).mtimeMs > LOCK_STALE_MS2) {
-          unlinkSync2(lockPath);
+        if (Date.now() - statSync6(lockPath).mtimeMs > LOCK_STALE_MS2) {
+          unlinkSync3(lockPath);
           continue;
         }
       } catch {
@@ -34165,16 +34372,16 @@ function withPairingLock(vaultRoot, fn) {
     } catch {
     }
     try {
-      unlinkSync2(lockPath);
+      unlinkSync3(lockPath);
     } catch {
     }
   }
 }
 function readStore2(vaultRoot) {
   const p = envPairingStorePath(vaultRoot);
-  if (!existsSync8(p)) return [];
+  if (!existsSync10(p)) return [];
   try {
-    const parsed = JSON.parse(readFileSync12(p, "utf8"));
+    const parsed = JSON.parse(readFileSync14(p, "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
@@ -34190,8 +34397,8 @@ function prune(records) {
 function writeStore2(vaultRoot, records) {
   const p = join13(heyspexDir2(vaultRoot), STORE_FILE2);
   const tmp = `${p}.tmp`;
-  writeFileSync7(tmp, JSON.stringify(prune(records), null, 2) + "\n", { mode: FILE_MODE2 });
-  renameSync5(tmp, p);
+  writeFileSync8(tmp, JSON.stringify(prune(records), null, 2) + "\n", { mode: FILE_MODE2 });
+  renameSync6(tmp, p);
 }
 function appendEnvPairingAudit(vaultRoot, event) {
   const line = {
@@ -34209,14 +34416,14 @@ function strikesPath(vaultRoot) {
 }
 function readStrikes(vaultRoot) {
   try {
-    const parsed = JSON.parse(readFileSync12(strikesPath(vaultRoot), "utf8"));
+    const parsed = JSON.parse(readFileSync14(strikesPath(vaultRoot), "utf8"));
     return typeof parsed.count === "number" && Number.isFinite(parsed.count) ? Math.max(0, Math.floor(parsed.count)) : 0;
   } catch {
     return 0;
   }
 }
 function writeStrikes(vaultRoot, count) {
-  writeFileSync7(
+  writeFileSync8(
     strikesPath(vaultRoot),
     JSON.stringify({ count, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n",
     { mode: FILE_MODE2 }
@@ -34425,8 +34632,8 @@ function markEnvInviteApplied(vaultRoot, id) {
 }
 
 // spex-console/src/lib/env-vault/policy.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync13, renameSync as renameSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import path7 from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync15, renameSync as renameSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import path9 from "node:path";
 var POLICY_REL_PATH = ".heyspex/env/policy.json";
 var POLICY_VERSION = 1;
 var MODES = ["allow", "ask", "deny"];
@@ -34434,7 +34641,7 @@ function isPolicyMode(value) {
   return typeof value === "string" && MODES.includes(value);
 }
 function policyPath(vaultRoot) {
-  return path7.join(vaultRoot, ".heyspex", "env", "policy.json");
+  return path9.join(vaultRoot, ".heyspex", "env", "policy.json");
 }
 function parsePolicyFile(text2) {
   let raw;
@@ -34458,7 +34665,7 @@ function readPolicy(vaultRoot, profile) {
   const file = policyPath(vaultRoot);
   let text2;
   try {
-    text2 = readFileSync13(file, "utf-8");
+    text2 = readFileSync15(file, "utf-8");
   } catch {
     return { mode: "allow", source: "default" };
   }
@@ -34478,8 +34685,8 @@ function serializePolicyFile(file) {
 }
 function loadForWrite(vaultRoot) {
   const file = policyPath(vaultRoot);
-  if (!existsSync9(file)) return { version: POLICY_VERSION, profiles: {} };
-  const parsed = parsePolicyFile(readFileSync13(file, "utf-8"));
+  if (!existsSync11(file)) return { version: POLICY_VERSION, profiles: {} };
+  const parsed = parsePolicyFile(readFileSync15(file, "utf-8"));
   if (parsed === null) {
     throw new Error(
       `${POLICY_REL_PATH} exists but is not a valid v${POLICY_VERSION} policy file \u2014 fix or remove it before changing policy (refusing to overwrite what it meant to say).`
@@ -34489,10 +34696,10 @@ function loadForWrite(vaultRoot) {
 }
 function writePolicyFile(vaultRoot, file) {
   const target = policyPath(vaultRoot);
-  mkdirSync8(path7.dirname(target), { recursive: true });
+  mkdirSync9(path9.dirname(target), { recursive: true });
   const tmp = `${target}.tmp`;
-  writeFileSync8(tmp, serializePolicyFile(file), "utf-8");
-  renameSync6(tmp, target);
+  writeFileSync9(tmp, serializePolicyFile(file), "utf-8");
+  renameSync7(tmp, target);
 }
 function writePolicy(vaultRoot, profile, mode) {
   if (!isPolicyMode(mode)) {
@@ -34504,7 +34711,7 @@ function writePolicy(vaultRoot, profile, mode) {
 }
 function clearPolicy(vaultRoot, profile) {
   const file = policyPath(vaultRoot);
-  if (!existsSync9(file)) return;
+  if (!existsSync11(file)) return;
   const parsed = loadForWrite(vaultRoot);
   if (!(profile in parsed.profiles)) return;
   delete parsed.profiles[profile];
@@ -36111,17 +36318,17 @@ import { spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes5 } from "node:crypto";
 import {
   chmodSync,
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync9,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync10,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync14,
-  renameSync as renameSync7,
-  statSync as statSync3,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync9
+  readFileSync as readFileSync16,
+  renameSync as renameSync8,
+  statSync as statSync7,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync10
 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import path8 from "node:path";
+import { homedir as homedir13 } from "node:os";
+import path10 from "node:path";
 
 // node_modules/sops-age/dist/index.js
 var import_dotenv = __toESM(require_main(), 1);
@@ -36605,8 +36812,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path9, errorMaps, issueData } = params;
-  const fullPath = [...path9, ...issueData.path || []];
+  const { data, path: path11, errorMaps, issueData } = params;
+  const fullPath = [...path11, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -36722,11 +36929,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path9, key) {
+  constructor(parent, value, path11, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path9;
+    this._path = path11;
     this._key = key;
   }
   get path() {
@@ -44791,22 +44998,22 @@ var gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength
 // node_modules/sops-age/dist/index.js
 import { readFile } from "node:fs/promises";
 import { join as join15 } from "node:path";
-import { homedir as homedir11, platform } from "node:os";
+import { homedir as homedir12, platform } from "node:os";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 var import_sshpk = __toESM(require_lib2(), 1);
-async function loadFromFile(path9) {
+async function loadFromFile(path11) {
   if (globalThis.Deno) {
-    return Deno.readTextFile(path9);
+    return Deno.readTextFile(path11);
   }
   if (globalThis.Bun) {
-    return Bun.file(path9).text();
+    return Bun.file(path11).text();
   }
   if (typeof process !== "undefined" && process.versions?.node) {
     const fs4 = await import("fs/promises");
-    return fs4.readFile(path9, "utf-8");
+    return fs4.readFile(path11, "utf-8");
   }
-  throw new Error(`Unable to determine method to load file "${path9}"`);
+  throw new Error(`Unable to determine method to load file "${path11}"`);
 }
 function isSopsInput(value) {
   if (!value) {
@@ -44914,13 +45121,13 @@ async function parseSops(input, sopsFileType) {
     });
   }
 }
-async function loadSopsFile(path9, sopsFileType) {
+async function loadSopsFile(path11, sopsFileType) {
   try {
-    const content = await loadFromFile(path9);
+    const content = await loadFromFile(path11);
     return await parseSops(content, sopsFileType);
   } catch (err) {
     throw new Error(
-      `Failed to load SOPS file '${path9}': ${err.message}`,
+      `Failed to load SOPS file '${path11}': ${err.message}`,
       {
         cause: err
       }
@@ -45132,11 +45339,11 @@ async function getUserConfigDir() {
       if (!appData) throw new Error("APPDATA env var not set");
       return appData;
     case "darwin":
-      return join15(homedir11(), "Library", "Application Support");
+      return join15(homedir12(), "Library", "Application Support");
     default:
       const xdgConfigHome = process.env.XDG_CONFIG_HOME;
       if (xdgConfigHome && xdgConfigHome.trim() !== "") return xdgConfigHome;
-      return join15(homedir11(), ".config");
+      return join15(homedir12(), ".config");
   }
 }
 async function findAllAgeKeys() {
@@ -45157,7 +45364,7 @@ async function findAllAgeKeys() {
       );
     }
   } else {
-    const userHomeDir = homedir11();
+    const userHomeDir = homedir12();
     if (userHomeDir) {
       const defaultSshPaths = [
         join15(userHomeDir, ".ssh", "id_ed25519"),
@@ -45337,15 +45544,15 @@ async function getSopsEncryptionKey(sops, secretKeys) {
 ${errors.join("\n")}`
   );
 }
-function path2gopath(path9) {
-  return `${path9.filter((x) => !/^\d+$/.test(x)).join(":")}:`;
+function path2gopath(path11) {
+  return `${path11.filter((x) => !/^\d+$/.test(x)).join(":")}:`;
 }
-function decryptSOPSValue(ciphertext, decryptionKey, path9) {
+function decryptSOPSValue(ciphertext, decryptionKey, path11) {
   if (!ciphertext) {
     return "";
   }
   const encryptedValue = parse2(ciphertext);
-  const aad = path2gopath(path9);
+  const aad = path2gopath(path11);
   let decrypted;
   try {
     decrypted = decryptAesGcm(
@@ -45355,22 +45562,22 @@ function decryptSOPSValue(ciphertext, decryptionKey, path9) {
     );
   } catch (err) {
     throw new Error(
-      `AES-GCM decryption failed at path ${JSON.stringify(path9)} for value "${ciphertext}": ${err instanceof Error ? err.message : String(err)}`
+      `AES-GCM decryption failed at path ${JSON.stringify(path11)} for value "${ciphertext}": ${err instanceof Error ? err.message : String(err)}`
     );
   }
   const decryptedValue = new TextDecoder().decode(decrypted);
   return convertDecryptedValue(decryptedValue, encryptedValue.datatype);
 }
-function decryptObject(obj, decryptionKey, path9 = []) {
+function decryptObject(obj, decryptionKey, path11 = []) {
   if (typeof obj !== "object" || obj === null) {
     return obj;
   }
   for (const key of Object.keys(obj)) {
     const value = obj[key];
     if (typeof value === "string" && value.startsWith("ENC[AES256_GCM,data:")) {
-      obj[key] = decryptSOPSValue(value, decryptionKey, [...path9, key]);
+      obj[key] = decryptSOPSValue(value, decryptionKey, [...path11, key]);
     } else if (typeof value === "object") {
-      obj[key] = decryptObject(value, decryptionKey, [...path9, key]);
+      obj[key] = decryptObject(value, decryptionKey, [...path11, key]);
     }
   }
   return obj;
@@ -45722,23 +45929,23 @@ function isExpiredDate(expires, today = todayIso()) {
   return expires !== null && today > expires;
 }
 function envDir(vaultRoot) {
-  return path8.join(vaultRoot, ".heyspex", "env");
+  return path10.join(vaultRoot, ".heyspex", "env");
 }
 function profilePath(vaultRoot, name) {
-  return path8.join(envDir(vaultRoot), `${name}.env`);
+  return path10.join(envDir(vaultRoot), `${name}.env`);
 }
 function keysPath(vaultRoot) {
-  return path8.join(vaultRoot, ".heyspex", "env.keys");
+  return path10.join(vaultRoot, ".heyspex", "env.keys");
 }
 function homeKeysPath() {
-  return path8.join(process.env.HEYSPEX_ENV_KEYS_HOME || homedir12(), ".heyspex", "env.keys");
+  return path10.join(process.env.HEYSPEX_ENV_KEYS_HOME || homedir13(), ".heyspex", "env.keys");
 }
 function dotenvPath(vaultRoot) {
-  return path8.join(vaultRoot, ".env");
+  return path10.join(vaultRoot, ".env");
 }
 function readOrNull(file) {
   try {
-    return readFileSync14(file, "utf-8");
+    return readFileSync16(file, "utf-8");
   } catch {
     return null;
   }
@@ -45752,7 +45959,7 @@ function renameWithRetry(tmp, file) {
   const retryable = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
   for (let attempt = 0; ; attempt++) {
     try {
-      renameSync7(tmp, file);
+      renameSync8(tmp, file);
       return;
     } catch (err) {
       const code = err.code ?? "";
@@ -45763,21 +45970,21 @@ function renameWithRetry(tmp, file) {
 }
 function unlinkQuiet(file) {
   try {
-    unlinkSync3(file);
+    unlinkSync4(file);
   } catch {
   }
 }
 function atomicWrite(file, content, mode = 420) {
   const secret = mode === SECRET_MODE;
-  const dir = path8.dirname(file);
-  mkdirSync9(dir, { recursive: true, ...secret ? { mode: SECRET_DIR_MODE } : {} });
-  const tmp = path8.join(
+  const dir = path10.dirname(file);
+  mkdirSync10(dir, { recursive: true, ...secret ? { mode: SECRET_DIR_MODE } : {} });
+  const tmp = path10.join(
     dir,
-    `.${path8.basename(file)}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`
+    `.${path10.basename(file)}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`
   );
   let renamed = false;
   try {
-    writeFileSync9(tmp, content, { encoding: "utf-8", mode });
+    writeFileSync10(tmp, content, { encoding: "utf-8", mode });
     if (secret) chmodOwnerOnly(tmp);
     renameWithRetry(tmp, file);
     renamed = true;
@@ -45791,18 +45998,18 @@ var LOCK_RETRY_MS3 = 50;
 var LOCK_STALE_MS3 = 5e3;
 function withFileLock(file, fn) {
   const lock = `${file}.lock`;
-  mkdirSync9(path8.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
+  mkdirSync10(path10.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
   let held = false;
   for (let attempt = 0; attempt < LOCK_RETRIES && !held; attempt++) {
     try {
-      writeFileSync9(lock, `${process.pid}
+      writeFileSync10(lock, `${process.pid}
 `, { flag: "wx" });
       held = true;
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       let ageMs = Infinity;
       try {
-        ageMs = Date.now() - statSync3(lock).mtimeMs;
+        ageMs = Date.now() - statSync7(lock).mtimeMs;
       } catch {
         ageMs = Infinity;
       }
@@ -45844,7 +46051,7 @@ function writeHomeKeyLine(profileName, privateKey, vaultId) {
 }
 function readVaultId(vaultRoot) {
   try {
-    const raw = readOrNull(path8.join(vaultRoot, "heyspex.yaml"));
+    const raw = readOrNull(path10.join(vaultRoot, "heyspex.yaml"));
     return raw === null ? null : parseVaultId(raw);
   } catch {
     return null;
@@ -45987,7 +46194,7 @@ function legacyDecryptAllSync(vaultRoot, name) {
 }
 function initProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   const pFile = profilePath(vaultRoot, name);
-  if (existsSync10(pFile) && !opts.force) {
+  if (existsSync12(pFile) && !opts.force) {
     throw new EnvVaultConfigError(
       `Env profile "${name}" already exists at ${pFile}. Pass --force to re-key it (this discards existing values and mints a new keypair).`
     );
@@ -46029,7 +46236,7 @@ function saveProfile(vaultRoot, name, profile) {
 function listProfiles(vaultRoot) {
   const dir = envDir(vaultRoot);
   try {
-    if (!statSync3(dir).isDirectory()) return [];
+    if (!statSync7(dir).isDirectory()) return [];
   } catch {
     return [];
   }
@@ -46373,7 +46580,7 @@ function removeGrant(vaultRoot, profileName, name, opts = {}) {
 }
 async function exportProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   const target = dotenvPath(vaultRoot);
-  if (existsSync10(target) && !opts.force) {
+  if (existsSync12(target) && !opts.force) {
     throw new EnvVaultConfigError(
       `${target} already exists. Pass --force to overwrite it (it is disposable \u2014 the encrypted profile is the system of record).`
     );
@@ -46385,10 +46592,10 @@ async function exportProfile(vaultRoot, name = DEFAULT_PROFILE2, opts = {}) {
   return { path: target };
 }
 function resolveVaultPath(vaultRoot, filePath) {
-  const root = path8.resolve(vaultRoot);
-  const resolved = path8.resolve(root, filePath);
-  const rel = path8.relative(root, resolved);
-  if (path8.isAbsolute(filePath) || path8.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path8.sep}`)) {
+  const root = path10.resolve(vaultRoot);
+  const resolved = path10.resolve(root, filePath);
+  const rel = path10.relative(root, resolved);
+  if (path10.isAbsolute(filePath) || path10.isAbsolute(rel) || rel === ".." || rel.startsWith(`..${path10.sep}`)) {
     throw new EnvVaultConfigError(
       `Refusing to touch "${filePath}" \u2014 it resolves outside the vault root (${root}). Vault file paths must stay inside the repo (no "..", no absolute paths).`
     );
@@ -46402,12 +46609,12 @@ function writeTextFile(vaultRoot, filePath, content) {
   atomicWrite(resolveVaultPath(vaultRoot, filePath), content, SECRET_MODE);
 }
 function pathExists(vaultRoot, filePath) {
-  return existsSync10(resolveVaultPath(vaultRoot, filePath));
+  return existsSync12(resolveVaultPath(vaultRoot, filePath));
 }
 function fileMtime(vaultRoot, filePath) {
   const resolved = resolveVaultPath(vaultRoot, filePath);
   try {
-    return statSync3(resolved).mtimeMs;
+    return statSync7(resolved).mtimeMs;
   } catch {
     return null;
   }
@@ -46436,7 +46643,7 @@ function listRepoSourceFiles(vaultRoot) {
     for (const entry of entries) {
       const childRel = rel === "" ? entry.name : `${rel}/${entry.name}`;
       if (entry.isDirectory()) {
-        if (!WALK_SKIP_DIRS.has(entry.name)) walk(path8.join(dir, entry.name), childRel);
+        if (!WALK_SKIP_DIRS.has(entry.name)) walk(path10.join(dir, entry.name), childRel);
       } else if (entry.isFile()) {
         out.push(childRel);
       }
@@ -46462,7 +46669,7 @@ function isKeysFileGitignored(vaultRoot) {
     if (res.status === 1) return false;
   } catch {
   }
-  const gitignore = readOrNull(path8.join(vaultRoot, ".gitignore"));
+  const gitignore = readOrNull(path10.join(vaultRoot, ".gitignore"));
   if (gitignore === null) return false;
   const ignorePatterns = /* @__PURE__ */ new Set([
     ".heyspex/env.keys",
@@ -46584,7 +46791,7 @@ async function confirm(question) {
 function findRepoRoot(start) {
   let dir = resolve5(start);
   for (; ; ) {
-    if (existsSync11(join16(dir, ".git"))) return dir;
+    if (existsSync13(join16(dir, ".git"))) return dir;
     const parent = dirname6(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -46592,7 +46799,7 @@ function findRepoRoot(start) {
 }
 function readFile2(p) {
   try {
-    return readFileSync15(p, "utf-8");
+    return readFileSync17(p, "utf-8");
   } catch {
     return null;
   }
@@ -46600,12 +46807,12 @@ function readFile2(p) {
 function connectCliDeps(repoRoot) {
   return {
     repoRoot,
-    fileExists: (p) => existsSync11(p),
+    fileExists: (p) => existsSync13(p),
     readFile: readFile2,
-    writeFile: (p, c) => writeFileSync10(p, c, "utf-8"),
-    mkdir: (p) => mkdirSync10(p, { recursive: true }),
+    writeFile: (p, c) => writeFileSync11(p, c, "utf-8"),
+    mkdir: (p) => mkdirSync11(p, { recursive: true }),
     joinPath: (...s) => join16(...s),
-    basename: (p) => basename4(p),
+    basename: (p) => basename5(p),
     now: () => (/* @__PURE__ */ new Date()).toISOString(),
     spawn: (command, spawnArgs, opts) => {
       const res = spawnSync5(command, spawnArgs, {
@@ -46654,7 +46861,7 @@ async function main() {
   const launchCwd = process4.env.HS_JOIN_CWD ? resolve5(process4.env.HS_JOIN_CWD) : process4.cwd();
   const walked = findRepoRoot(launchCwd);
   const rawHint = walked ?? (process4.env.HS_VAULT_ROOT ? resolve5(process4.env.HS_VAULT_ROOT) : null);
-  const repoRootHint = rawHint && existsSync11(join16(rawHint, "package.json")) ? rawHint : null;
+  const repoRootHint = rawHint && existsSync13(join16(rawHint, "package.json")) ? rawHint : null;
   let userName = null;
   try {
     userName = userInfo().username || null;
@@ -46667,7 +46874,7 @@ async function main() {
     platform: process4.platform,
     interactive: INTERACTIVE,
     userName,
-    pathExists: (p) => existsSync11(p),
+    pathExists: (p) => existsSync13(p),
     readFile: readFile2,
     joinPath: (...s) => join16(...s),
     resolvePath: (...s) => resolve5(...s),
@@ -46716,7 +46923,7 @@ async function main() {
     connect: {
       isConnected: (repoRoot) => Promise.resolve(
         runConnectChecks(repoRoot, {
-          fileExists: (p) => existsSync11(p),
+          fileExists: (p) => existsSync13(p),
           readFile: readFile2,
           joinPath: (...s) => join16(...s)
         }).connected