mason-context 0.14.0 → 0.14.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.14.1 — 2026-09-07
+
+- Configure PATH automatically during standalone installation for Bash, Zsh, POSIX sh, and Windows. Supported installations finish with a simple instruction to open a new terminal and run setup.
+- Preserve existing shell settings, profile symlinks, Windows PATH entries and registry value types. Track owned additions across repeat installs and upgrades; uninstall removes unchanged additions and retains user edits.
+- Avoid a same-name PowerShell script shadowing the Windows command under restricted script policy. Migrate the old owned helper without changing user or machine execution policy.
+- Support `MASON_PROFILE` for custom shell profiles and `MASON_NO_MODIFY_PATH=1` for opt-out. Unsupported or unwritable settings receive explicit manual instructions.
+- Test fresh-terminal discovery, duplicate prevention, and PATH cleanup in native package checks. Bound retries for transient Windows test-directory locks and report smoke success only after teardown completes.
+
+Run the [installer](docs/distribution.md) again to upgrade from 0.14.0 and configure PATH. Existing project integrations remain pinned until you rerun `mason setup --host codex` or `--host claude` in each project.
+
 ## 0.14.0 — 2026-09-07
 
 Install Mason without installing Node or npm. Standalone downloads bundle the runtime for macOS, Linux, and Windows.

package/README.md

@@ -26,9 +26,9 @@ Windows PowerShell:
 irm https://github.com/adrianczuczka/mason/releases/latest/download/install.ps1 | iex
 ```
 
-No Node or npm required. Git is required. Follow the installer's PATH instructions. [Platform details](docs/distribution.md) · [npm installation](docs/setup.md#unified-project-setup)
+No Node or npm required. Git is required. The installer configures PATH for Bash, Zsh, and Windows. [Platform details](docs/distribution.md) · [npm installation](docs/setup.md#unified-project-setup)
 
-Run this in your Git repository:
+Open a new terminal, then run this in your Git repository:
 
 ```bash
 mason setup --host codex

package/dist/mason-auto.js

@@ -2398,7 +2398,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     exec7 = promisify7(execFile7);
-    engineVersion = true ? "0.14.0" : "development";
+    engineVersion = true ? "0.14.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });

package/dist/mason-mcp.js

@@ -4163,7 +4163,7 @@ var init_evidence2 = __esm({
     init_dead_command();
     init_storage();
     exec14 = promisify14(execFile14);
-    engineVersion = true ? "0.14.0" : "development";
+    engineVersion = true ? "0.14.1" : "development";
     hash = (value) => createHash4("sha256").update(JSON.stringify(value)).digest("hex");
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z11.object({ version: z11.literal(1), entries: z11.record(z11.object({ key: z11.string(), result: checkResultSchema })), digest: z11.string() });
@@ -8113,7 +8113,7 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.14.0"
+      version: "0.14.1"
     },
     {
       instructions: 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, failed verification needs correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'

package/dist/mason.js

@@ -262,15 +262,15 @@ function parseExecution(raw) {
 function automationFailure(error) {
   const recorded = failureSchema.safeParse(error?.failure);
   if (recorded.success) return recorded.data;
-  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const message3 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
   const codes = /* @__PURE__ */ new Set();
   let cause = error;
   for (let i = 0; cause && i < 8; i++) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
-  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message3) ? "inputs-changed" : /Automation is busy/.test(message3) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message3) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message3) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message3) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message3, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
 }
 function failureMessage(error) {
   const failure = automationFailure(error);
@@ -1736,7 +1736,7 @@ var init_provenance = __esm({
       sources: z3.array(decisionSourceSchema).max(20),
       history: z3.array(eventSchema).min(1)
     }).superRefine((record, ctx) => {
-      const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+      const invalid = (message3) => ctx.addIssue({ code: "custom", message: message3 });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
       let previous;
       for (const event of record.history) {
@@ -2398,7 +2398,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     exec7 = promisify7(execFile7);
-    engineVersion = true ? "0.14.0" : "development";
+    engineVersion = true ? "0.14.1" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
@@ -2897,8 +2897,8 @@ async function runAutomationHook(host, stdin) {
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message2 = failureMessage(error);
-    return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
+    const message3 = failureMessage(error);
+    return { systemMessage: message3, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message3 } } : {} };
   }
 }
 function hookConfig(host, command2 = "npx --no-install --package mason-context mason-auto") {
@@ -3217,8 +3217,8 @@ var init_paths2 = __esm({
 });
 
 // src/review/evidence/types.ts
-function messagePreview(message2) {
-  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
+function messagePreview(message3) {
+  return { message: message3.slice(0, 4e3), ...message3.length > 4e3 ? { truncated: true } : {} };
 }
 var MAX_FINDINGS;
 var init_types2 = __esm({
@@ -4363,7 +4363,7 @@ function summarizeActivation(status) {
       `  Runtime: ${state.runtime}; MCP: ${state.mcp}; instructions: ${state.instructions}.`,
       `  Hooks: ${state.hookConfiguration}; observed: ${state.observedEvents.join(", ") || "none"}.`,
       `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
-      ...state.pending.map((message2) => "  Next: " + message2)
+      ...state.pending.map((message3) => "  Next: " + message3)
     );
   }
   if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
@@ -4520,6 +4520,185 @@ var init_setup = __esm({
   }
 });
 
+// src/distribution/path.ts
+import fs18 from "fs/promises";
+import os3 from "os";
+import path23 from "path";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
+import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import { z as z17 } from "zod";
+async function configurePath(bin, previous, save, options = {}) {
+  const env = options.env ?? process.env, platform = options.platform ?? process.platform;
+  const changes = [...previous];
+  const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
+Add ${bin} to your PATH, then run: mason setup --host codex` });
+  if (env.MASON_NO_MODIFY_PATH === "1") return manual("Automatic PATH setup is disabled (MASON_NO_MODIFY_PATH=1).");
+  if (/[\r\n\0]/.test(bin) || bin.includes(platform === "win32" ? ";" : ":")) return manual("This installation path cannot be represented safely in PATH.");
+  try {
+    if (platform === "win32") {
+      const current = await windowsPath("read");
+      if (!hasWindowsEntry(current.value, bin)) {
+        if (!changes.some((c) => c.kind === "windows" && c.entry === bin)) {
+          changes.push({ kind: "windows", entry: bin, created: current.value === null });
+          await save(changes);
+        }
+        await windowsPath("add", bin, current);
+      }
+      return { status: "configured", changes, message: message2 };
+    }
+    const shell = path23.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const userHome = options.userHome ?? os3.homedir();
+    let profiles;
+    if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
+    if (env.MASON_PROFILE) profiles = [path23.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles = [path23.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles = [path23.join(userHome, ".profile")];
+    else {
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path23.join(userHome, name));
+      let login = candidates[2];
+      for (const file of candidates) if (await fs18.lstat(file).then(() => true, (error) => {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      })) {
+        login = file;
+        break;
+      }
+      profiles = [path23.join(userHome, ".bashrc"), login];
+    }
+    const marker = `# >>> mason PATH ${createHash6("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    for (const profile of profiles) {
+      const stat = await fs18.lstat(profile).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      const file = stat?.isSymbolicLink() ? await fs18.realpath(profile) : path23.resolve(profile);
+      const original = await fs18.readFile(file).catch((error) => {
+        if (error.code === "ENOENT" && !stat) return null;
+        throw error;
+      });
+      if (original && !Buffer.from(original.toString("utf8")).equals(original)) return manual(`Shell profile is not UTF-8: ${profile}.`);
+      const text2 = original?.toString("utf8") ?? "";
+      const owned = changes.find((c) => c.kind === "profile" && c.file === file);
+      if (owned && text2.includes(owned.block)) continue;
+      if (text2.includes(marker) || owned && text2.includes("# <<< mason PATH")) return manual(`Mason's PATH block was edited; retained ${profile}.`);
+      const newline = text2.includes("\r\n") ? "\r\n" : "\n";
+      const block = owned?.block ?? ("\n" + marker + '\ncase ":${PATH-}:" in\n  *:' + quote(bin) + ":*) ;;\n  *) export PATH=" + quote(bin) + ':"${PATH-}" ;;\nesac\n# <<< mason PATH <<<\n').replaceAll("\n", newline);
+      if (!owned) {
+        changes.push({ kind: "profile", file, block, created: original === null });
+        await save(changes);
+      }
+      await fs18.mkdir(path23.dirname(file), { recursive: true });
+      const handle = await fs18.open(file, original === null ? "ax+" : "a+", 384);
+      try {
+        if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
+        await handle.writeFile(block);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+    }
+    return { status: "configured", changes, message: message2 };
+  } catch (error) {
+    return manual(`Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function removePath(changes) {
+  const warnings = [];
+  for (const change of changes) {
+    try {
+      if (change.kind === "windows") {
+        const current = await windowsPath("read");
+        if (!(current.value ?? "").split(";").includes(change.entry) && hasWindowsEntry(current.value, change.entry)) throw new Error("PATH entry was edited");
+        await windowsPath("remove", change.entry, current, change.created);
+        continue;
+      }
+      const stat = await fs18.lstat(change.file).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      if (!stat) continue;
+      if (!stat.isFile()) throw new Error("profile type changed");
+      const bytes = await fs18.readFile(change.file), text2 = bytes.toString("utf8");
+      if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
+      const index2 = text2.indexOf(change.block);
+      if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
+      const prefix = text2.slice(0, index2), suffix = text2.slice(index2 + change.block.length);
+      const separator = prefix && suffix && !prefix.endsWith("\n") ? change.block.startsWith("\r\n") ? "\r\n" : "\n" : "";
+      const next = Buffer.from(prefix + separator + suffix);
+      const temporary = change.file + ".mason-" + randomUUID8();
+      try {
+        if (stat.nlink > 1) throw new Error("profile has multiple hard links");
+        const handle = await fs18.open(temporary, "wx", stat.mode & 511);
+        try {
+          await handle.writeFile(next);
+          await handle.chmod(stat.mode & 511);
+          if (process.platform !== "win32") await handle.chown(stat.uid, stat.gid);
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        const current = await fs18.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs18.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs18.rename(temporary, change.file);
+      } finally {
+        await fs18.rm(temporary, { force: true });
+      }
+    } catch (error) {
+      warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return warnings;
+}
+async function windowsPath(action, entry = "", expected, removeEmpty = false) {
+  const payload = Buffer.from(JSON.stringify({ action, entry, expected, removeEmpty })).toString("base64");
+  const script = `$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+$p = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${payload}')) | ConvertFrom-Json
+$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+try {
+  $value = $key.GetValue('Path', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+  $kind = if ($null -eq $value) { $null } else { $key.GetValueKind('Path').ToString() }
+  if ($null -ne $kind -and $kind -notin @('String','ExpandString')) { throw 'User PATH is not a string.' }
+  if ($p.action -eq 'read') { @{ value = $value; kind = $kind } | ConvertTo-Json -Compress; exit 0 }
+  if ($p.expected -and ($value -cne $p.expected.value -or $kind -cne $p.expected.kind)) { throw 'User PATH changed concurrently; retry the operation.' }
+  $parts = if ($null -eq $value -or $value -eq '') { @() } else { @($value.Split(';')) }
+  if ($p.action -eq 'add') { $next = (@($p.entry) + $parts) -join ';' }
+  else { $next = (@($parts | Where-Object { $_ -cne $p.entry })) -join ';' }
+  if ($next -cne $value) {
+    $writeKind = if ($kind) { [Microsoft.Win32.RegistryValueKind]$kind } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }
+    if ($p.action -eq 'remove' -and $p.removeEmpty -and $next -eq '') { $key.DeleteValue('Path', $false) }
+    else { $key.SetValue('Path', $next, $writeKind) }
+    Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class MasonEnvironment { [DllImport("user32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern IntPtr SendMessageTimeout(IntPtr h, uint m, UIntPtr w, string l, uint f, uint t, out UIntPtr r); }'
+    $result = [UIntPtr]::Zero
+    [void][MasonEnvironment]::SendMessageTimeout([IntPtr]0xffff, 0x1a, [UIntPtr]::Zero, 'Environment', 2, 1000, [ref]$result)
+  }
+  @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
+} finally { $key.Dispose() }
+`;
+  const { stdout } = await execute("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
+}
+var execute, pathChangeSchema, quote, message2, normalizeWindowsEntry, hasWindowsEntry;
+var init_path = __esm({
+  "src/distribution/path.ts"() {
+    "use strict";
+    execute = promisify11(execFile11);
+    pathChangeSchema = z17.discriminatedUnion("kind", [
+      z17.object({ kind: z17.literal("profile"), file: z17.string(), block: z17.string(), created: z17.boolean() }),
+      z17.object({ kind: z17.literal("windows"), entry: z17.string(), created: z17.boolean() })
+    ]);
+    quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+    message2 = "Open a new terminal, then run: mason setup --host codex";
+    normalizeWindowsEntry = (value) => path23.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    hasWindowsEntry = (value, entry, env = process.env) => {
+      const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
+      const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
+      return (value ?? "").split(";").some((part) => normalizeWindowsEntry(expand(part)) === normalizeWindowsEntry(entry));
+    };
+  }
+});
+
 // src/distribution/install.ts
 var install_exports2 = {};
 __export(install_exports2, {
@@ -4529,55 +4708,55 @@ __export(install_exports2, {
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs18 from "fs/promises";
-import os3 from "os";
-import path23 from "path";
+import fs19 from "fs/promises";
+import os4 from "os";
+import path24 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { spawn } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
-import { z as z17 } from "zod";
+import { randomUUID as randomUUID9 } from "crypto";
+import { z as z18 } from "zod";
 async function replace(file, content2, mode = 384) {
-  const temp = file + ".tmp-" + randomUUID8();
+  const temp = file + ".tmp-" + randomUUID9();
   try {
-    await fs18.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs18.rename(temp, file);
+    await fs19.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs19.rename(temp, file);
   } finally {
-    await fs18.rm(temp, { force: true });
+    await fs19.rm(temp, { force: true });
   }
 }
 async function installStandalone(source) {
   const bundle = await verifyBundle(source);
-  const selectedHome = path23.resolve(defaultHome());
-  await fs18.mkdir(selectedHome, { recursive: true });
-  const home = await fs18.realpath(selectedHome);
-  const selectedBin = path23.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path23.join(home, "bin") : path23.join(os3.homedir(), ".local/bin")));
+  const selectedHome = path24.resolve(defaultHome());
+  await fs19.mkdir(selectedHome, { recursive: true });
+  const home = await fs19.realpath(selectedHome);
+  const selectedBin = path24.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path24.join(home, "bin") : path24.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
     const previous = raw === null ? null : recordSchema2.parse(raw);
-    if (!previous) for (const file of await fs18.readdir(home)) {
+    if (!previous) for (const file of await fs19.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path23.join(home, file);
-      const stat = await fs18.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs18.readdir(directory)).length) {
+      const directory = path24.join(home, file);
+      const stat = await fs19.lstat(directory);
+      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs19.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-    await fs18.mkdir(selectedBin, { recursive: true });
-    const bin = await fs18.realpath(selectedBin);
+    await fs19.mkdir(selectedBin, { recursive: true });
+    const bin = await fs19.realpath(selectedBin);
     if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
     const id = bundle.manifestHash.slice(0, 24);
     const destination = await storePath(home, "versions/" + id);
     const launchers = process.platform === "win32" ? {
       "mason.cmd": WINDOWS_BATCH_LAUNCHER,
-      "mason.ps1": `$ErrorActionPreference = 'Stop'
+      "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
 $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path23.join(destination, "node.exe"))} ${psQuote(path23.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path24.join(destination, "node.exe"))} ${psQuote(path24.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path23.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path24.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -4586,48 +4765,66 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
-      const old = await fs18.readFile(file, "utf8").catch((error) => {
+      const old = await fs19.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
     }
-    const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers };
+    const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
+    const checkRetired = async (name, expected) => {
+      if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
+      const actual = await fs19.readFile(await storePath(bin, name), "utf8").catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
+    };
+    for (const [name, expected] of retired) await checkRetired(name, expected);
+    const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
     await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
-    const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
-    await fs18.mkdir(stage);
+    const stage = await storePath(home, "versions/.install-" + randomUUID9(), true);
+    await fs19.mkdir(stage);
     try {
       for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
         const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs18.copyFile(from, to);
-        await fs18.chmod(to, (await fs18.stat(from)).mode & 511);
+        await fs19.copyFile(from, to);
+        await fs19.chmod(to, (await fs19.stat(from)).mode & 511);
       }
       await verifyBundle(stage, bundle.manifestHash);
-      const exists2 = await fs18.lstat(destination).then(() => true, (error) => {
+      const exists2 = await fs19.lstat(destination).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       });
       if (exists2) await verifyBundle(destination, bundle.manifestHash);
-      else await fs18.rename(stage, destination);
+      else await fs19.rename(stage, destination);
       for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
+      for (const [name, expected] of retired) {
+        await checkRetired(name, expected);
+        await fs19.rm(await storePath(bin, name), { force: true });
+      }
       await writeStoreJson(home, "install.json", receipt);
     } finally {
-      await fs18.rm(stage, { recursive: true, force: true });
+      await fs19.rm(stage, { recursive: true, force: true });
     }
-    return { home, bin, version: bundle.manifest.version };
+    const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
+      receipt.pathChanges = changes;
+      await writeStoreJson(home, "install.json", receipt);
+    });
+    return { home, bin, version: bundle.manifest.version, path: pathResult };
   });
 }
 async function currentInstallation() {
-  const app = path23.dirname(path23.dirname(fileURLToPath2(import.meta.url)));
-  const bundle = path23.dirname(app), home = path23.dirname(path23.dirname(bundle));
+  const app = path24.dirname(path24.dirname(fileURLToPath2(import.meta.url)));
+  const bundle = path24.dirname(app), home = path24.dirname(path24.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
   const record = recordSchema2.parse(raw);
-  if (record.home !== await fs18.realpath(home) || path23.dirname(bundle) !== path23.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs19.realpath(home) || path24.dirname(bundle) !== path24.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version) {
@@ -4635,7 +4832,7 @@ async function upgradeStandalone(version) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path23.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path24.join(bundle, windows ? "install.ps1" : "install.sh");
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
@@ -4654,40 +4851,44 @@ async function uninstallStandalone() {
   }
   await withLock(home, ".install-lock", async () => {
     for (const [name, expected] of Object.entries(record.launchers)) {
-      if (!["mason", "mason.cmd", "mason.ps1"].includes(name)) throw new Error("Invalid owned launcher name.");
+      if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs18.readFile(file, "utf8").catch((error) => {
+      const actual = await fs19.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (actual !== null && actual !== expected) throw new Error("Launcher was edited; retained: " + file);
     }
+    for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs18.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs19.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs18.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs19.rm(home, { recursive: true, force: true });
   return home;
 }
-var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, defaultHome;
+var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
 var init_install2 = __esm({
   "src/distribution/install.ts"() {
     "use strict";
     init_bundle();
     init_storage();
     init_store();
-    recordSchema2 = z17.object({
-      format: z17.literal(1),
-      home: z17.string(),
-      bin: z17.string(),
-      current: z17.string().regex(/^[a-f0-9]{24}$/),
-      version: z17.string(),
-      launchers: z17.record(z17.string()),
-      previousLaunchers: z17.record(z17.string()).optional()
+    init_path();
+    recordSchema2 = z18.object({
+      format: z18.literal(1),
+      home: z18.string(),
+      bin: z18.string(),
+      current: z18.string().regex(/^[a-f0-9]{24}$/),
+      version: z18.string(),
+      launchers: z18.record(z18.string()),
+      previousLaunchers: z18.record(z18.string()).optional(),
+      pathChanges: z18.array(pathChangeSchema).optional()
     });
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
-    WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason.ps1" %*\r\n';
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path23.join(process.env.LOCALAPPDATA ?? os3.homedir(), "Mason") : path23.join(os3.homedir(), ".local/share/mason"));
+    WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
+    launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path24.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path24.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
@@ -4776,20 +4977,20 @@ async function runAutomationCli(argv, stdin = "", io = {
     io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
-    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
+    const message3 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
     if (action === "hook" || isHookCommand(argv)) {
-      io.out(JSON.stringify({ systemMessage: message2 }));
+      io.out(JSON.stringify({ systemMessage: message3 }));
       return 0;
     }
     if (argv.includes("--json")) io.out(JSON.stringify({ version: 1, ...action === "setup" ? { action, status: "incomplete", next: "Rerun the same setup command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
-    else io.err(message2);
+    else io.err(message3);
     return 2;
   }
 }
 
 // bin/mason.ts
 var [command, ...args] = process.argv.slice(2);
-var usage = `Mason ${"0.14.0"}
+var usage = `Mason ${"0.14.1"}
 
 Usage: mason <command> [options]
 
@@ -4807,7 +5008,7 @@ Use mason <command> --help for options. npm users can keep using mason-auto,
 mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
 try {
   if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.14.0");
+  else if (["--version", "-v"].includes(command)) console.log("0.14.1");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { sourceRuntime: sourceRuntime2 } = await Promise.resolve().then(() => (init_runtime2(), runtime_exports));
@@ -4816,8 +5017,7 @@ try {
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
     const installed = await installStandalone2(selected.bundleRoot);
     console.log(`Installed Mason ${installed.version} in ${installed.home}.
-Launcher: ${installed.bin}
-Add that directory to PATH if needed, then run: mason setup --host codex`);
+${installed.path.message}`);
   } else if (command === "upgrade" || command === "uninstall") {
     if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Project versions change only when you rerun setup." : "Usage: mason uninstall. Removes the standalone user installation; project runtimes, configuration and knowledge are retained.");
     else {