knodin 0.6.0 → 0.7.3

package/dist/src/init.js

@@ -1,8 +1,10 @@
 import child_process from "node:child_process";
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { configureProjectAgents, } from "./agent-integration.js";
 import { isIndexableSourcePath } from "./engine/source-policy.js";
+import { inspectLefthookIntegration, installHookManagerIntegration, isActiveLefthookHook, } from "./hook-manager-integration.js";
 import { registerInitializedWorktree } from "./worktree-lifecycle.js";
 const MANAGED_MARKER = "KNODIN MANAGED HOOK";
 const HOOK_NAMES = ["post-commit", "post-checkout", "post-merge", "post-rewrite"];
@@ -39,6 +41,203 @@ function runGit(repo, args, encoding = "utf-8") {
         stdio: ["ignore", "pipe", "ignore"],
     });
 }
+const MUTATION_AUDIT_MAX_ENTRIES = 2_048;
+const MUTATION_AUDIT_MAX_FILE_BYTES = 8 * 1_024 * 1_024;
+function boundedDirectoryEntries(directory) {
+    try {
+        const entries = fs.readdirSync(directory, { withFileTypes: true });
+        if (entries.length > MUTATION_AUDIT_MAX_ENTRIES)
+            throw new Error(`${directory}: configure mutation audit exceeds ${MUTATION_AUDIT_MAX_ENTRIES} managed entries`);
+        return entries;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+function configureMutationAuditTargets(repo) {
+    const commonRaw = runGit(repo, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-common-dir",
+    ]).trim();
+    const common = path.isAbsolute(commonRaw) ? commonRaw : path.resolve(repo, commonRaw);
+    const excludeRaw = runGit(repo, [
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-path",
+        "info/exclude",
+    ]).trim();
+    const exclude = path.isAbsolute(excludeRaw) ? excludeRaw : path.resolve(repo, excludeRaw);
+    const effectiveHooks = effectiveHooksDirectory(repo);
+    const targets = new Map();
+    const add = (target) => {
+        const key = path.resolve(target.absolute);
+        if (!targets.has(key))
+            targets.set(key, { ...target, absolute: key });
+    };
+    for (const relative of [
+        "AGENTS.md",
+        "GEMINI.md",
+        ".mcp.json",
+        ".codex",
+        ".codex/config.toml",
+        ".gemini",
+        ".gemini/settings.json",
+        ".agents",
+        ".agents/mcp_config.json",
+        ".gitignore",
+        ".claude",
+        ".claude/hooks",
+        ".claude/hooks/nudge.sh",
+        ".claude/settings.example.json",
+        ".knodin",
+        ".knodin/integration.json",
+        ".knodin/indexer.log",
+        ".knodin/indexer.log.1",
+        "lefthook-local.yml",
+        "lefthook-local.yaml",
+        ".lefthook-local.yml",
+        ".lefthook-local.yaml",
+        ".config/lefthook-local.yml",
+        ".config/lefthook-local.yaml",
+    ])
+        add({ absolute: path.join(repo, relative), label: relative });
+    for (const relative of [
+        ".knodin/hooks",
+        ".knodin/hooks/background-index.sh",
+        ".knodin/hooks/manager-dispatch.sh",
+        ".knodin/hooks/events",
+        ".knodin/hooks/last-refresh-event",
+        ".knodin/hooks/last-refresh-failure",
+        ".knodin/hooks/refresh.lock",
+        ".knodin/hooks/refresh.lock/pid",
+    ])
+        add({ absolute: path.join(repo, relative), label: relative });
+    for (const entry of boundedDirectoryEntries(path.join(repo, ".knodin", "hooks", "events")))
+        add({
+            absolute: path.join(repo, ".knodin", "hooks", "events", entry.name),
+            label: `.knodin/hooks/events/${entry.name}`,
+        });
+    add({ absolute: path.join(common, "config"), label: ".git/config" });
+    add({ absolute: exclude, label: ".git/info/exclude" });
+    add({ absolute: path.join(common, "knodin"), label: ".git/knodin" });
+    add({
+        absolute: path.join(common, "knodin", "worktrees.json"),
+        label: ".git/knodin/worktrees.json",
+    });
+    const defaultHooks = path.join(common, "hooks");
+    const managedHooks = path.join(common, "knodin-hooks");
+    add({ absolute: defaultHooks, label: ".git/hooks" });
+    add({ absolute: managedHooks, label: ".git/knodin-hooks" });
+    const effectiveLabel = path.resolve(effectiveHooks) === path.resolve(defaultHooks)
+        ? ".git/hooks"
+        : path.resolve(effectiveHooks) === path.resolve(managedHooks)
+            ? ".git/knodin-hooks"
+            : "effective-git-hooks";
+    add({ absolute: effectiveHooks, label: effectiveLabel });
+    for (const hookRoot of [
+        { absolute: defaultHooks, label: ".git/hooks" },
+        { absolute: managedHooks, label: ".git/knodin-hooks" },
+        { absolute: effectiveHooks, label: effectiveLabel },
+    ]) {
+        for (const entry of boundedDirectoryEntries(hookRoot.absolute))
+            add({
+                absolute: path.join(hookRoot.absolute, entry.name),
+                label: `${hookRoot.label}/${entry.name}`,
+            });
+    }
+    for (const hookName of HOOK_NAMES) {
+        add({ absolute: path.join(effectiveHooks, hookName), label: `${effectiveLabel}/${hookName}` });
+        add({
+            absolute: path.join(effectiveHooks, `${hookName}.knodin-original`),
+            label: `${effectiveLabel}/${hookName}.knodin-original`,
+        });
+    }
+    for (const hookRoot of [
+        { absolute: defaultHooks, label: ".git/hooks" },
+        { absolute: managedHooks, label: ".git/knodin-hooks" },
+    ]) {
+        for (const hookName of HOOK_NAMES) {
+            add({
+                absolute: path.join(hookRoot.absolute, hookName),
+                label: `${hookRoot.label}/${hookName}`,
+            });
+            add({
+                absolute: path.join(hookRoot.absolute, `${hookName}.knodin-original`),
+                label: `${hookRoot.label}/${hookName}.knodin-original`,
+            });
+        }
+    }
+    const configured = configuredHooksPath(repo);
+    const relativeConfigured = configured ? repoRelativeHooksPath(repo, configured) : null;
+    if (relativeConfigured && hasTrackedHooks(repo, relativeConfigured)) {
+        const configuredRoot = path.join(repo, relativeConfigured);
+        for (const entry of boundedDirectoryEntries(configuredRoot)) {
+            if (!entry.isFile() || HOOK_NAMES.includes(entry.name))
+                continue;
+            const source = path.join(configuredRoot, entry.name);
+            if ((fs.statSync(source).mode & 0o111) === 0)
+                continue;
+            add({
+                absolute: path.join(managedHooks, entry.name),
+                label: `.git/knodin-hooks/${entry.name}`,
+            });
+        }
+    }
+    if (targets.size > MUTATION_AUDIT_MAX_ENTRIES)
+        throw new Error(`configure mutation audit exceeds ${MUTATION_AUDIT_MAX_ENTRIES} managed paths`);
+    return [...targets.values()];
+}
+function fileSignature(filePath, allowOversized = false) {
+    try {
+        const stat = fs.lstatSync(filePath);
+        if (stat.isDirectory())
+            return `directory:${stat.mode & 0o777}`;
+        if (stat.isSymbolicLink()) {
+            const link = fs.readlinkSync(filePath);
+            const resolved = fs.realpathSync(filePath);
+            return `symlink:${stat.mode & 0o777}:${link}:${fileSignature(resolved, allowOversized)}`;
+        }
+        if (!stat.isFile())
+            throw new Error(`${filePath}: unsupported filesystem entry`);
+        if (stat.size > MUTATION_AUDIT_MAX_FILE_BYTES && !allowOversized)
+            throw new Error(`${filePath}: configure mutation audit refuses files larger than ${MUTATION_AUDIT_MAX_FILE_BYTES} bytes`);
+        if (stat.size > MUTATION_AUDIT_MAX_FILE_BYTES)
+            return `oversized-file:${stat.mode & 0o777}:${stat.size}`;
+        const digest = crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+        return `file:${stat.mode & 0o777}:${stat.size}:${digest}`;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function mutationSnapshot(targets, allowOversized = false) {
+    const snapshot = new Map();
+    for (const target of targets) {
+        const rootSignature = fileSignature(target.absolute, allowOversized);
+        if (rootSignature !== null)
+            snapshot.set(target.label, rootSignature);
+    }
+    return snapshot;
+}
+function filesystemChanges(before, after) {
+    return [...new Set([...before.keys(), ...after.keys()])].sort().flatMap((changedPath) => {
+        const prior = before.get(changedPath);
+        const current = after.get(changedPath);
+        if (prior === current)
+            return [];
+        return [
+            {
+                path: changedPath,
+                action: prior === undefined ? "created" : current === undefined ? "removed" : "modified",
+            },
+        ];
+    });
+}
 function shellQuote(value) {
     return `'${value.replaceAll("'", `'\\''`)}'`;
 }
@@ -257,7 +456,7 @@ function managedHookScript(hookName, originalPath) {
             : shellQuote(originalPath)
         : "";
     const runOriginal = originalPath
-        ? `${original} "$@"${hookName === "post-rewrite" ? ' < "$REWRITE_INPUT"' : ""} || ORIGINAL_STATUS=$?`
+        ? `KNODIN_WRAPPER_ACTIVE=1 ${original} "$@"${hookName === "post-rewrite" ? ' < "$REWRITE_INPUT"' : ""} || ORIGINAL_STATUS=$?`
         : ":";
     let trigger = "";
     if (hookName === "post-commit")
@@ -271,7 +470,7 @@ AFTER="$(git rev-parse HEAD 2>/dev/null || true)"
 [ -n "$BEFORE" ] && [ -n "$AFTER" ] && trigger_knodin merge "$BEFORE" "$AFTER"`;
     }
     const rewriteWithoutIndexer = originalPath
-        ? `${original} "$@"
+        ? `KNODIN_WRAPPER_ACTIVE=1 ${original} "$@"
   exit $?`
         : "exit 0";
     const rewriteSetup = hookName === "post-rewrite"
@@ -487,7 +686,7 @@ export const SETTINGS_TEMPLATE = `{
 const KNODIN_AGENT_INSTRUCTIONS = `<!-- knodin:start -->
 ## knodin — Local Code Intelligence
 
-This repository is indexed locally by knodin. Start with \`knodin status\`; if it reports \`repair-needed\`, run \`knodin repair\` before relying on graph evidence.
+This repository is indexed locally by knodin. Start with \`knodin status\`; if it reports \`repair-needed\`, follow its repair steps before relying on graph evidence. Use \`knodin repair\` for graph damage and \`knodin init\` for displaced lifecycle hooks.
 
 - When the single connected knodin MCP tool is available, use it directly. For cold or unfamiliar work, call its \`context\` operation before broad Read/Grep/Glob traversal. Use shell commands only as a fallback when the gateway is unavailable.
 - Before a meaningful edit, call the gateway's \`query\` operation with the \`impact\` pattern (CLI fallback: \`knodin query impact <symbol> --direction upstream\`) and report material risk to the user.
@@ -521,12 +720,14 @@ async function installManagedAgentInstructions(repo, fileName = "AGENTS.md") {
     await assertSafeRepositoryFile(repo, fileName);
     const instructionsPath = path.join(repo, fileName);
     let existing = "";
+    let existed = true;
     try {
         existing = await fs.promises.readFile(instructionsPath, "utf-8");
     }
     catch (error) {
         if (error.code !== "ENOENT")
             throw error;
+        existed = false;
     }
     const canonicalStart = "<!-- knodin:start -->";
     const canonicalEnd = "<!-- knodin:end -->";
@@ -537,8 +738,10 @@ async function installManagedAgentInstructions(repo, fileName = "AGENTS.md") {
         : existing.length > 0
             ? `${existing.trimEnd()}\n\n${KNODIN_AGENT_INSTRUCTIONS}`
             : KNODIN_AGENT_INSTRUCTIONS;
-    if (next !== existing)
-        await fs.promises.writeFile(instructionsPath, next, "utf-8");
+    if (next === existing)
+        return null;
+    await fs.promises.writeFile(instructionsPath, next, "utf-8");
+    return { path: fileName, action: existed ? "modified" : "created" };
 }
 async function hasManagedAgentInstructions(repo, fileName = "AGENTS.md") {
     try {
@@ -548,6 +751,19 @@ async function hasManagedAgentInstructions(repo, fileName = "AGENTS.md") {
         return false;
     }
 }
+function removeManagedAgentBlock(content) {
+    const start = content.indexOf("<!-- knodin:start -->");
+    const end = content.indexOf("<!-- knodin:end -->", start);
+    if (start < 0 || end < start)
+        return null;
+    const prefix = content.slice(0, start);
+    const suffix = content.slice(end + "<!-- knodin:end -->".length);
+    // The canonical marker-only file owns its final line terminator as part of
+    // the generated block. Any other prefix/suffix bytes remain untouched.
+    if (prefix.length === 0 && /^\r?\n$/.test(suffix))
+        return "";
+    return `${prefix}${suffix}`;
+}
 function isTracked(repo, relativePath) {
     try {
         return nulPaths(repo, ["ls-files", "--", relativePath]).length > 0;
@@ -601,38 +817,35 @@ async function removeManagedExcludes(repo) {
     await fs.promises.writeFile(excludePath, next, "utf-8");
 }
 async function removeManagedPersonalArtifacts(repo, allowTrackedTransition = false) {
+    const changes = [];
     for (const fileName of ["AGENTS.md", "GEMINI.md"]) {
         const instructionsPath = path.join(repo, fileName);
         const tracked = isTracked(repo, fileName);
         try {
+            await assertSafeRepositoryFile(repo, fileName);
             const current = await fs.promises.readFile(instructionsPath, "utf-8");
+            const start = current.indexOf("<!-- knodin:start -->");
+            const end = current.indexOf("<!-- knodin:end -->", start);
+            const without = removeManagedAgentBlock(current);
             if (!tracked) {
-                const start = current.indexOf("<!-- knodin:start -->");
-                const end = current.indexOf("<!-- knodin:end -->");
-                if (start >= 0 && end >= start) {
-                    const without = `${current.slice(0, start)}${current.slice(end + "<!-- knodin:end -->".length)}`
-                        .replace(/\n{3,}/g, "\n\n")
-                        .trim();
-                    if (without)
-                        await fs.promises.writeFile(instructionsPath, `${without}\n`, "utf-8");
-                    else
+                if (without !== null) {
+                    if (without.length > 0) {
+                        await fs.promises.writeFile(instructionsPath, without, "utf-8");
+                        changes.push({ path: fileName, action: "modified" });
+                    }
+                    else {
                         await fs.promises.rm(instructionsPath, { force: true });
+                        changes.push({ path: fileName, action: "removed" });
+                    }
                 }
                 continue;
             }
-            const head = runGit(repo, ["show", `HEAD:${fileName}`]);
-            const start = current.indexOf("<!-- knodin:start -->");
-            const end = current.indexOf("<!-- knodin:end -->");
-            if (allowTrackedTransition && start >= 0 && end >= start) {
-                const without = `${current.slice(0, start)}${current.slice(end + "<!-- knodin:end -->".length)}`
-                    .replace(/\n{3,}/g, "\n\n")
-                    .trimEnd();
-                if (without)
-                    await fs.promises.writeFile(instructionsPath, `${without}\n`, "utf-8");
-                else
-                    await fs.promises.rm(instructionsPath, { force: true });
+            if (allowTrackedTransition && without !== null) {
+                await fs.promises.writeFile(instructionsPath, without, "utf-8");
+                changes.push({ path: fileName, action: "modified" });
                 continue;
             }
+            const head = runGit(repo, ["show", `HEAD:${fileName}`]);
             if (start >= 0 && end >= start && !head.includes("<!-- knodin:start -->")) {
                 const without = `${current.slice(0, start)}${current.slice(end + "<!-- knodin:end -->".length)}`
                     .replace(/\n{3,}/g, "\n\n")
@@ -682,6 +895,7 @@ async function removeManagedPersonalArtifacts(repo, allowTrackedTransition = fal
             // Missing or user-modified files are intentionally preserved.
         }
     }
+    return changes;
 }
 export function readRepositoryIntegrationConfig(repo) {
     try {
@@ -695,6 +909,22 @@ export function readRepositoryIntegrationConfig(repo) {
     }
     return null;
 }
+function hasSafeManagedAgentBlock(repo, relativePath) {
+    try {
+        let current = repo;
+        for (const part of relativePath.split(path.sep)) {
+            current = path.join(current, part);
+            if (fs.lstatSync(current).isSymbolicLink())
+                return false;
+        }
+        const content = fs.readFileSync(path.join(repo, relativePath), "utf-8");
+        const start = content.indexOf("<!-- knodin:start -->");
+        return start >= 0 && content.indexOf("<!-- knodin:end -->", start) >= start;
+    }
+    catch {
+        return false;
+    }
+}
 /** Detect repository-owned client configuration independently of knodin's local receipt. */
 export function inspectRepositoryIntegrationStatus(repo) {
     const receipt = readRepositoryIntegrationConfig(repo);
@@ -703,13 +933,27 @@ export function inspectRepositoryIntegrationStatus(repo) {
         { agent: "codex", path: ".codex/config.toml", marker: 'mcp_servers."knodin"' },
         { agent: "gemini", path: ".gemini/settings.json", marker: '"knodin"' },
         { agent: "antigravity", path: ".agents/mcp_config.json", marker: '"knodin"' },
+        {
+            agent: "codex",
+            path: "AGENTS.md",
+            marker: "<!-- knodin:start -->",
+            managedGuidance: true,
+        },
+        {
+            agent: "gemini",
+            path: "GEMINI.md",
+            marker: "<!-- knodin:start -->",
+            managedGuidance: true,
+        },
     ];
-    const configurations = candidates.map(({ agent, path: relative, marker }) => {
+    const configurations = candidates.map(({ agent, path: relative, marker, managedGuidance }) => {
         try {
             return {
                 agent,
                 path: relative,
-                present: fs.readFileSync(path.join(repo, relative), "utf-8").includes(marker),
+                present: managedGuidance
+                    ? hasSafeManagedAgentBlock(repo, relative)
+                    : fs.readFileSync(path.join(repo, relative), "utf-8").includes(marker),
             };
         }
         catch {
@@ -780,6 +1024,10 @@ export async function initializeRepository(repo, options) {
     if (!path.isAbsolute(options.command[0])) {
         throw new Error("knodin init: packaged runtime command must be an absolute path");
     }
+    const mutationTargets = options.auditConfigurationChanges
+        ? configureMutationAuditTargets(resolvedRepo)
+        : [];
+    const beforeMutation = mutationSnapshot(mutationTargets);
     if (scope !== "team" &&
         !options.allowTrackedTransition &&
         detectTrackedTeamIntegration(resolvedRepo)) {
@@ -798,6 +1046,7 @@ export async function initializeRepository(repo, options) {
         mode: 0o755,
     });
     await fs.promises.chmod(backgroundPath, 0o755);
+    const hookManagerIntegration = installHookManagerIntegration(resolvedRepo);
     for (const hookName of HOOK_NAMES) {
         let preservedOriginal;
         if (hookInstallation.trackedHooksDir) {
@@ -828,12 +1077,16 @@ export async function initializeRepository(repo, options) {
     }
     const lifecycleRefresh = drainQueuedLifecycleEvents(resolvedRepo, backgroundPath);
     await fs.promises.rm(path.join(knodinHooksDir, HOOK_FAILURE_FILE), { force: true });
+    let agentInstructionChanges = [];
     if (scope === "team") {
-        await installManagedAgentInstructions(resolvedRepo, "AGENTS.md");
-        await installManagedAgentInstructions(resolvedRepo, "GEMINI.md");
+        const installed = await Promise.all([
+            installManagedAgentInstructions(resolvedRepo, "AGENTS.md"),
+            installManagedAgentInstructions(resolvedRepo, "GEMINI.md"),
+        ]);
+        agentInstructionChanges = installed.filter((change) => change !== null);
     }
     else {
-        await removeManagedPersonalArtifacts(resolvedRepo, options.allowTrackedTransition);
+        agentInstructionChanges = await removeManagedPersonalArtifacts(resolvedRepo, options.allowTrackedTransition);
     }
     const requestedAgents = options.agents ?? [];
     const projectPathByAgent = {
@@ -842,6 +1095,7 @@ export async function initializeRepository(repo, options) {
         antigravity: ".agents/mcp_config.json",
     };
     const blockedAgents = [];
+    const externalConfigurationOutcomes = [];
     if (scope === "personal" &&
         options.allowTrackedTransition &&
         priorIntegration?.scope === "team") {
@@ -853,6 +1107,11 @@ export async function initializeRepository(repo, options) {
         });
         if (cleanup.failed.length > 0)
             throw new Error(`knodin configure: could not remove tracked team integration: ${cleanup.failed[0]?.message}`);
+        if (cleanup.removed.includes("claude"))
+            externalConfigurationOutcomes.push({
+                system: "claude-local-mcp",
+                state: "removal-attempted",
+            });
     }
     const eligibleAgents = scope === "team"
         ? requestedAgents
@@ -876,6 +1135,18 @@ export async function initializeRepository(repo, options) {
         agents: eligibleAgents,
         run: options.runAgentCommand,
     });
+    if (scope === "personal" && agentIntegration.configured.includes("claude"))
+        externalConfigurationOutcomes.push({
+            system: "claude-local-mcp",
+            state: "configured-or-present",
+        });
+    if (scope === "cli-only" &&
+        agentIntegration.removed.includes("claude") &&
+        !externalConfigurationOutcomes.some(({ system, state }) => system === "claude-local-mcp" && state === "removal-attempted"))
+        externalConfigurationOutcomes.push({
+            system: "claude-local-mcp",
+            state: "removal-attempted",
+        });
     agentIntegration.failed.push(...blockedAgents);
     await writeRepositoryIntegrationConfig(resolvedRepo, {
         scope,
@@ -888,13 +1159,20 @@ export async function initializeRepository(repo, options) {
     else if (scope === "cli-only") {
         await removeManagedExcludes(resolvedRepo);
     }
-    const excluded = scope === "team"
+    let excluded = scope === "team"
         ? []
         : await excludeUntrackedPaths(resolvedRepo, [
             ...(isTracked(resolvedRepo, ".knodin") ? [] : [".knodin/"]),
             ...agentIntegration.projectFiles,
         ]);
+    if (hookManagerIntegration) {
+        const managerExcludes = await excludeUntrackedPaths(resolvedRepo, [
+            hookManagerIntegration.localConfig,
+        ]);
+        excluded = [...new Set([...excluded, ...managerExcludes])].sort();
+    }
     registerInitializedWorktree(resolvedRepo);
+    const detectedFilesystemChanges = filesystemChanges(beforeMutation, mutationSnapshot(mutationTargets, true));
     return {
         scope,
         knodin: ".knodin",
@@ -905,8 +1183,12 @@ export async function initializeRepository(repo, options) {
         claudeSettings: null,
         agentInstructions: scope === "team" ? "AGENTS.md" : null,
         agentIntegration,
+        agentInstructionChanges,
+        filesystemChanges: detectedFilesystemChanges,
+        externalConfigurationOutcomes,
         excluded,
         lifecycleRefresh,
+        hookManagerIntegration,
     };
 }
 async function matchesManagedFile(filePath, expected, executable) {
@@ -939,6 +1221,7 @@ export async function isRepositoryInitializationCurrent(repo, command, scope = "
     catch {
         return false;
     }
+    const lefthook = inspectLefthookIntegration(resolvedRepo);
     const managedHooks = await Promise.all(HOOK_NAMES.map(async (hookName) => {
         const hookPath = path.join(hooksDir, hookName);
         try {
@@ -950,7 +1233,9 @@ export async function isRepositoryInitializationCurrent(repo, command, scope = "
             let expected = managedHookScript(hookName, originalPath);
             if (originalPath)
                 expected = expected.replace("\nREPO_ROOT=", `\n# knodin original: ${originalPath}\nREPO_ROOT=`);
-            return stat.isFile() && (stat.mode & 0o111) !== 0 && content === expected;
+            return (stat.isFile() &&
+                (stat.mode & 0o111) !== 0 &&
+                (content === expected || (lefthook.configured && isActiveLefthookHook(content))));
         }
         catch {
             return false;
@@ -964,5 +1249,6 @@ export async function isRepositoryInitializationCurrent(repo, command, scope = "
     const integrationCurrent = readRepositoryIntegrationConfig(resolvedRepo)?.scope === scope;
     return ((await matchesManagedFile(path.join(resolvedRepo, ".knodin", "hooks", "background-index.sh"), backgroundScript(command), true)) &&
         sharedFilesCurrent &&
-        integrationCurrent);
+        integrationCurrent &&
+        (lefthook.localConfig === null || lefthook.configured));
 }

package/dist/src/lifecycle-health.js

@@ -1,6 +1,7 @@
 import childProcess from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
+import { inspectLefthookIntegration, isActiveLefthookHook } from "./hook-manager-integration.js";
 const MANAGED_MARKER = "KNODIN MANAGED HOOK";
 const HOOK_NAMES = ["post-commit", "post-checkout", "post-merge", "post-rewrite"];
 const HOOK_FAILURE_FILE = "last-refresh-failure";
@@ -89,22 +90,42 @@ function activeHooksDirectory(repo) {
     const output = childProcess.execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-path", "hooks"], { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
     return output.trim();
 }
-function inspectManagedHooks(hooksDirectory) {
+function inspectManagedHooks(repo, hooksDirectory) {
     const activeHooks = [];
     const missingHooks = [];
+    let wrappers = 0;
+    let managerNative = 0;
+    const lefthook = inspectLefthookIntegration(repo);
     for (const hookName of HOOK_NAMES) {
         try {
             const hookPath = path.join(hooksDirectory, hookName);
             const content = fs.readFileSync(hookPath, "utf-8");
             const mode = fs.statSync(hookPath).mode;
-            const active = (mode & 0o111) !== 0 && content.startsWith(`#!/bin/sh\n# ${MANAGED_MARKER}: ${hookName}\n`);
+            const wrapper = content.startsWith(`#!/bin/sh\n# ${MANAGED_MARKER}: ${hookName}\n`);
+            const native = lefthook.configured && isActiveLefthookHook(content);
+            const active = (mode & 0o111) !== 0 && (wrapper || native);
+            if (active && wrapper)
+                wrappers++;
+            else if (active && native)
+                managerNative++;
             (active ? activeHooks : missingHooks).push(hookName);
         }
         catch {
             missingHooks.push(hookName);
         }
     }
-    return { activeHooks, missingHooks };
+    return {
+        activeHooks,
+        missingHooks,
+        hookManager: lefthook.configured ? "lefthook" : null,
+        routing: wrappers > 0 && managerNative > 0
+            ? "mixed"
+            : wrappers > 0
+                ? "managed-wrapper"
+                : managerNative > 0
+                    ? "manager-native"
+                    : "unavailable",
+    };
 }
 function readRefreshFailure(repo) {
     const failurePath = path.join(repo, ".knodin", "hooks", HOOK_FAILURE_FILE);
@@ -134,6 +155,8 @@ export function inspectLifecycleHealth(repoPath) {
             pendingEvent: null,
             lastEvent: null,
             lastError: null,
+            hookManager: null,
+            routing: "unavailable",
         };
     }
     let hooksDirectory;
@@ -153,9 +176,11 @@ export function inspectLifecycleHealth(repoPath) {
             pendingEvent: readPendingEvent(repo),
             lastEvent: readLastEvent(repo),
             lastError: null,
+            hookManager: null,
+            routing: "unavailable",
         };
     }
-    const { activeHooks, missingHooks } = inspectManagedHooks(hooksDirectory);
+    const { activeHooks, missingHooks, hookManager, routing } = inspectManagedHooks(repo, hooksDirectory);
     const background = path.join(repo, ".knodin", "hooks", "background-index.sh");
     const backgroundReady = fs.existsSync(background) && (fs.statSync(background).mode & 0o111) !== 0;
     const issues = missingHooks.map((hook) => `${hook} no longer routes through knodin's active Git hook path`);
@@ -177,6 +202,8 @@ export function inspectLifecycleHealth(repoPath) {
         pendingEvent: readPendingEvent(repo),
         lastEvent: readLastEvent(repo),
         lastError,
+        hookManager,
+        routing,
     };
 }
 /** Merge graph and refresh-path health without reporting absent evidence as healthy. */
@@ -210,3 +237,14 @@ export function attachLifecycleHealth(repo, graph) {
         lifecycle,
     };
 }
+/** Keep graph-repair success distinct from lifecycle integration health. */
+export function attachRepairLifecycle(repo, result) {
+    const lifecycle = inspectLifecycleHealth(repo);
+    return {
+        ...result,
+        lifecycle,
+        nextSteps: lifecycle.status === "degraded"
+            ? ["Run `knodin init` to restore lifecycle routing, then `knodin status`."]
+            : [],
+    };
+}

package/dist/src/output-telemetry.js

@@ -121,6 +121,7 @@ export function measureOutput(options) {
         at: new Date().toISOString(),
         repositoryId: repositoryIdentifier(options.repo),
         operation: options.operation,
+        ...(options.executionProfile ? { executionProfile: options.executionProfile } : {}),
         latencyMs,
         rssBytes: process.memoryUsage().rss,
         temperature: "cold",
@@ -231,6 +232,9 @@ function sanitizeTelemetryRecord(record) {
         at: record.at,
         repositoryId: record.repositoryId,
         operation: record.operation,
+        ...(record.executionProfile && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(record.executionProfile)
+            ? { executionProfile: record.executionProfile }
+            : {}),
         latencyMs: record.latencyMs,
         rssBytes: record.rssBytes,
         temperature: record.temperature,