mason-context 0.14.0 → 0.14.2

package/dist/mason.js

@@ -1105,9 +1105,133 @@ var init_deleted_reference = __esm({
   }
 });
 
-// src/audit/checks/new-module.ts
-import fg2 from "fast-glob";
+// src/audit/inputs.ts
+import fs6 from "fs/promises";
+import * as nativeFs from "fs";
 import path9 from "path";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+import fg2 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs6.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg2.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  const { stdout } = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
+    ],
+    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
+  );
+  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const operation = execute(
+    "git",
+    ["check-ignore", "-z", "--stdin"],
+    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
+  );
+  operation.child.stdin.on("error", () => {
+  });
+  operation.child.stdin.end(files.join("\0") + "\0");
+  try {
+    return new Set((await operation).stdout.split("\0").filter(Boolean));
+  } catch (error) {
+    if (error.code === 1) return /* @__PURE__ */ new Set();
+    throw error;
+  }
+}
+var execute, MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    execute = promisify6(execFile6);
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/checks/new-module.ts
+import fg3 from "fast-glob";
+import fs7 from "fs/promises";
+import path10 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1118,22 +1242,6 @@ function isMentioned(combinedDocs, name) {
   );
   return re.test(combinedDocs);
 }
-async function listSubdirs(absDir) {
-  const dirs = await fg2("*", {
-    cwd: absDir,
-    onlyDirectories: true,
-    suppressErrors: true
-  });
-  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
-}
-async function countSourceFiles(absDir) {
-  const files = await fg2(SOURCE_GLOB, {
-    cwd: absDir,
-    ignore: SOURCE_IGNORE,
-    suppressErrors: true
-  });
-  return files.length;
-}
 async function checkNewModules(ctx) {
   const result = emptyResult();
   if (ctx.docs.length === 0) return result;
@@ -1161,21 +1269,48 @@ async function checkNewModules(ctx) {
   return result;
 }
 async function moduleCandidates(root, combinedDocs) {
+  const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const listSubdirs = async (dir) => {
+    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
+    const ignored = await gitIgnoredPaths(root, dirs);
+    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
+    return (await auditGlob(root, dir === "." ? "*" : `${fg3.escapePath(dir)}/*`, {
+      ignore,
+      onlyDirectories: true,
+      label: "Module directory discovery",
+      select: (file) => visible.has(file)
+    })).map((file) => path10.posix.basename(file));
+  };
+  const countSourceFiles = async (dir) => {
+    const files = sources.filter((file) => file.startsWith(dir + "/"));
+    let count3 = 0;
+    for (let offset = 0; offset < files.length; offset += 256) {
+      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg3.escapePath(file)), {
+        ignore,
+        followSymbolicLinks: false,
+        label: `Source discovery in ${dir}`
+      })).length;
+      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+    }
+    return count3;
+  };
   const candidates = [];
-  for (const topDir of await listSubdirs(root)) {
-    const absTop = path9.join(root, topDir);
+  for (const topDir of await listSubdirs(".")) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count3 = await countSourceFiles(absTop);
+      const count3 = await countSourceFiles(topDir);
       if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
-    const subdirs = await listSubdirs(absTop);
+    const subdirs = await listSubdirs(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      const count3 = await countSourceFiles(`${topDir}/${sub}`);
       if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
         candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
@@ -1187,7 +1322,8 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
-    init_snapshot();
+    init_files();
+    init_inputs();
     init_git();
     init_checks();
     DIR_DENYLIST = /* @__PURE__ */ new Set([
@@ -1215,19 +1351,10 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import fs6 from "fs/promises";
-import path10 from "path";
-import fg3 from "fast-glob";
-async function readIfExists(absPath) {
-  try {
-    return await fs6.readFile(absPath, "utf-8");
-  } catch {
-    return null;
-  }
-}
+import path11 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
-    const content2 = await readIfExists(path10.join(root, name));
+    const content2 = await readAuditInput(root, name);
     if (content2 === null) continue;
     const members = [];
     for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
@@ -1241,26 +1368,28 @@ async function countGradleModules(root) {
   return null;
 }
 async function countNpmWorkspaces(root) {
-  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  const pkgRaw = await readAuditInput(root, "package.json");
   if (pkgRaw !== null) {
+    let globs = [];
     try {
       const pkg = JSON.parse(pkgRaw);
-      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
-      if (globs.length > 0) {
-        const matched = await fg3(
-          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-          { cwd: root, ignore: ["**/node_modules/**"] }
-        );
-        return {
-          actual: matched.length,
-          countedFrom: "package.json workspaces",
-          members: matched.map((m) => path10.dirname(m)).sort()
-        };
-      }
+      globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
     } catch {
     }
+    if (globs.length > 0) {
+      const matched = await auditGlob(
+        root,
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { ignore: ["**/node_modules/**"], label: "npm workspace discovery" }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "package.json workspaces",
+        members: matched.map((m) => path11.dirname(m)).sort()
+      };
+    }
   }
-  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  const pnpmRaw = await readAuditInput(root, "pnpm-workspace.yaml");
   if (pnpmRaw !== null) {
     const globs = [];
     let inPackages = false;
@@ -1279,21 +1408,22 @@ async function countNpmWorkspaces(root) {
       }
     }
     if (globs.length > 0) {
-      const matched = await fg3(
+      const matched = await auditGlob(
+        root,
         globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-        { cwd: root, ignore: ["**/node_modules/**"] }
+        { ignore: ["**/node_modules/**"], label: "pnpm workspace discovery" }
       );
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path10.dirname(m)).sort()
+        members: matched.map((m) => path11.dirname(m)).sort()
       };
     }
   }
   return null;
 }
 async function countCargoCrates(root) {
-  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  const content2 = await readAuditInput(root, "Cargo.toml");
   if (content2 === null) return null;
   const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
@@ -1304,12 +1434,12 @@ async function countCargoCrates(root) {
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (/[*?[\]{}]/.test(entry)) {
-      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
-        cwd: root,
-        ignore: ["**/target/**"]
+      const matched = await auditGlob(root, `${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        ignore: ["**/target/**"],
+        label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path10.dirname(m));
-    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path11.dirname(m));
+    } else if (await readAuditInput(root, path11.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1363,18 +1493,18 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     MEMBERS_CAP = 50;
   }
 });
 
 // src/audit/checks/dead-command.ts
-import fs7 from "fs/promises";
-import path11 from "path";
-import fg4 from "fast-glob";
-async function scriptsOf(absManifest) {
+async function scriptsOf(root, manifest) {
+  const raw = await readAuditInput(root, manifest);
+  if (raw === null) return null;
   try {
-    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    const pkg = JSON.parse(raw);
     return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
   } catch {
     return null;
@@ -1386,7 +1516,7 @@ async function checkDeadCommands(ctx) {
     (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
   );
   if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  const rootScripts = await scriptsOf(ctx.root, "package.json");
   if (rootScripts === null) {
     result.skipped.push({
       check: "dead-command",
@@ -1403,7 +1533,7 @@ async function checkDeadCommands(ctx) {
     const manifests = await commandManifests(ctx.root);
     manifestsChecked = ["package.json", ...manifests.sort()];
     for (const manifest of manifests) {
-      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
+      const scripts = await scriptsOf(ctx.root, manifest);
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -1429,23 +1559,24 @@ async function checkDeadCommands(ctx) {
   return result;
 }
 function commandManifests(root) {
-  return fg4("**/package.json", {
-    cwd: root,
-    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  return auditGlob(root, "**/package.json", {
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"],
+    label: "Command manifest discovery"
   });
 }
 var AVAILABLE_SCRIPTS_CAP;
 var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     AVAILABLE_SCRIPTS_CAP = 30;
   }
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 async function git(root, args2) {
   return (await exec6("git", args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
@@ -1497,7 +1628,7 @@ var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify6(execFile6);
+    exec6 = promisify7(execFile7);
   }
 });
 
@@ -2262,9 +2393,9 @@ __export(evidence_exports, {
 import fs11 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
-import fg5 from "fast-glob";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+import fg4 from "fast-glob";
 import { z as z5 } from "zod";
 async function git2(root, ...args2) {
   return (await exec7("git", args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
@@ -2280,34 +2411,13 @@ async function workspace(dir) {
   }
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
-async function content(root, file) {
-  try {
-    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
 async function readInputs(root) {
-  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+  const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git2(root, "rev-parse", "HEAD"),
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
-    fg5("**/*", {
-      cwd: root,
-      dot: true,
-      onlyFiles: false,
-      followSymbolicLinks: false,
-      objectMode: true,
-      ignore: SOURCE_IGNORE
-    }),
     git2(root, "rev-parse", "--git-path", "shallow"),
     git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
-  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
-  const files = entries.map((f) => f.path);
-  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
   const head = headText.trim();
   let shallow = null;
   try {
@@ -2328,9 +2438,19 @@ async function readInputs(root) {
       claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
     }
   }
-  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
   const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
   const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const commandClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).commands : []);
+  const rootPackage = await content(root, "package.json");
+  let rootScripts = null;
+  if (rootPackage !== null) {
+    try {
+      const pkg = JSON.parse(rootPackage);
+      rootScripts = pkg?.scripts && typeof pkg.scripts === "object" ? Object.keys(pkg.scripts) : [];
+    } catch {
+    }
+  }
+  const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -2339,16 +2459,19 @@ async function readInputs(root) {
   const [modules, counts, manifests, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
-    commandManifests(root),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    needsWorkspaceScripts ? commandManifests(root) : [],
+    fg4(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
-  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
-  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const packages = [["package.json", rootPackage], ...await Promise.all(manifests.sort().map(async (file) => [file, await content(root, file)]))];
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
+    await storePath(root, file);
+    return [file, await content(root, file)];
+  }));
   const [status, index2] = decisions.length ? await Promise.all([
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [2, engineVersion, head, shallow, replacements, docContents];
+  const common = [3, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -2384,7 +2507,7 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
-var exec7, engineVersion, hash, internal, cacheSchema;
+var exec7, engineVersion, hash, content, internal, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
@@ -2392,14 +2515,15 @@ var init_evidence = __esm({
     init_claims();
     init_repair();
     init_checks();
-    init_files();
+    init_inputs();
     init_new_module();
     init_stale_count();
     init_dead_command();
     init_storage();
-    exec7 = promisify7(execFile7);
-    engineVersion = true ? "0.14.0" : "development";
+    exec7 = promisify8(execFile8);
+    engineVersion = true ? "0.14.2" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+    content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
   }
@@ -3108,8 +3232,8 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
 });
 
 // src/review/cochange.ts
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
     const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
@@ -3174,7 +3298,7 @@ var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_R
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify8(execFile8);
+    exec8 = promisify9(execFile9);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3639,8 +3763,8 @@ var init_evidence2 = __esm({
 // src/review/review.ts
 import fs14 from "fs/promises";
 import path19 from "path";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
     const { stdout } = await exec9("git", ["merge-base", base, head], {
@@ -3762,7 +3886,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify9(execFile9);
+    exec9 = promisify10(execFile10);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -4167,8 +4291,8 @@ import fs17 from "fs/promises";
 import path22 from "path";
 import { fileURLToPath } from "url";
 import { randomUUID as randomUUID6, createHash as createHash5 } from "crypto";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 async function packageRoot() {
   let directory = path22.dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 8; i++) {
@@ -4276,7 +4400,7 @@ var init_runtime2 = __esm({
     init_storage();
     init_evidence();
     init_bundle();
-    exec10 = promisify10(execFile10);
+    exec10 = promisify11(execFile11);
     checksum = (bytes) => createHash5("sha256").update(bytes).digest("hex");
     BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
   }
@@ -4520,6 +4644,187 @@ var init_setup = __esm({
   }
 });
 
+// src/distribution/path.ts
+import fs18 from "fs/promises";
+import os3 from "os";
+import path23 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
+import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import { z as z17 } from "zod";
+async function configurePath(bin, previous, save, options = {}) {
+  const env = options.env ?? process.env, platform = options.platform ?? process.platform;
+  const changes = [...previous];
+  const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path23.posix.isAbsolute(entry) && path23.posix.resolve(entry) === path23.posix.resolve(bin));
+  const message2 = alreadyOnPath ? "Run: mason setup --host codex" : "Open a new terminal, then run: mason setup --host codex";
+  const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
+${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --host codex`}` });
+  if (env.MASON_NO_MODIFY_PATH === "1") return manual("Automatic PATH setup is disabled (MASON_NO_MODIFY_PATH=1).");
+  if (/[\r\n\0]/.test(bin) || bin.includes(platform === "win32" ? ";" : ":")) return manual("This installation path cannot be represented safely in PATH.");
+  try {
+    if (platform === "win32") {
+      const current = await windowsPath("read");
+      if (!hasWindowsEntry(current.value, bin)) {
+        if (!changes.some((c) => c.kind === "windows" && c.entry === bin)) {
+          changes.push({ kind: "windows", entry: bin, created: current.value === null });
+          await save(changes);
+        }
+        await windowsPath("add", bin, current);
+      }
+      return { status: "configured", changes, message: message2 };
+    }
+    const shell = path23.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const userHome = options.userHome ?? os3.homedir();
+    let profiles;
+    if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
+    if (env.MASON_PROFILE) profiles = [path23.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles = [path23.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles = [path23.join(userHome, ".profile")];
+    else {
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path23.join(userHome, name));
+      let login = candidates[2];
+      for (const file of candidates) if (await fs18.lstat(file).then(() => true, (error) => {
+        if (error.code === "ENOENT") return false;
+        throw error;
+      })) {
+        login = file;
+        break;
+      }
+      profiles = [path23.join(userHome, ".bashrc"), login];
+    }
+    const marker = `# >>> mason PATH ${createHash6("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    for (const profile of profiles) {
+      const stat = await fs18.lstat(profile).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      const file = stat?.isSymbolicLink() ? await fs18.realpath(profile) : path23.resolve(profile);
+      const original = await fs18.readFile(file).catch((error) => {
+        if (error.code === "ENOENT" && !stat) return null;
+        throw error;
+      });
+      if (original && !Buffer.from(original.toString("utf8")).equals(original)) return manual(`Shell profile is not UTF-8: ${profile}.`);
+      const text2 = original?.toString("utf8") ?? "";
+      const owned = changes.find((c) => c.kind === "profile" && c.file === file);
+      if (owned && text2.includes(owned.block)) continue;
+      if (text2.includes(marker) || owned && text2.includes("# <<< mason PATH")) return manual(`Mason's PATH block was edited; retained ${profile}.`);
+      const newline = text2.includes("\r\n") ? "\r\n" : "\n";
+      const block = owned?.block ?? ("\n" + marker + '\ncase ":${PATH-}:" in\n  *:' + quote(bin) + ":*) ;;\n  *) export PATH=" + quote(bin) + ':"${PATH-}" ;;\nesac\n# <<< mason PATH <<<\n').replaceAll("\n", newline);
+      if (!owned) {
+        changes.push({ kind: "profile", file, block, created: original === null });
+        await save(changes);
+      }
+      await fs18.mkdir(path23.dirname(file), { recursive: true });
+      const handle = await fs18.open(file, original === null ? "ax+" : "a+", 384);
+      try {
+        if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
+        await handle.writeFile(block);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+    }
+    return { status: "configured", changes, message: message2 };
+  } catch (error) {
+    return manual(`Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function removePath(changes) {
+  const warnings = [];
+  for (const change of changes) {
+    try {
+      if (change.kind === "windows") {
+        const current = await windowsPath("read");
+        if (!(current.value ?? "").split(";").includes(change.entry) && hasWindowsEntry(current.value, change.entry)) throw new Error("PATH entry was edited");
+        await windowsPath("remove", change.entry, current, change.created);
+        continue;
+      }
+      const stat = await fs18.lstat(change.file).catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      if (!stat) continue;
+      if (!stat.isFile()) throw new Error("profile type changed");
+      const bytes = await fs18.readFile(change.file), text2 = bytes.toString("utf8");
+      if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
+      const index2 = text2.indexOf(change.block);
+      if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
+      const prefix = text2.slice(0, index2), suffix = text2.slice(index2 + change.block.length);
+      const separator = prefix && suffix && !prefix.endsWith("\n") ? change.block.startsWith("\r\n") ? "\r\n" : "\n" : "";
+      const next = Buffer.from(prefix + separator + suffix);
+      const temporary = change.file + ".mason-" + randomUUID8();
+      try {
+        if (stat.nlink > 1) throw new Error("profile has multiple hard links");
+        const handle = await fs18.open(temporary, "wx", stat.mode & 511);
+        try {
+          await handle.writeFile(next);
+          await handle.chmod(stat.mode & 511);
+          if (process.platform !== "win32") await handle.chown(stat.uid, stat.gid);
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        const current = await fs18.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs18.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs18.rename(temporary, change.file);
+      } finally {
+        await fs18.rm(temporary, { force: true });
+      }
+    } catch (error) {
+      warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return warnings;
+}
+async function windowsPath(action, entry = "", expected, removeEmpty = false) {
+  const payload = Buffer.from(JSON.stringify({ action, entry, expected, removeEmpty })).toString("base64");
+  const script = `$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+$p = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${payload}')) | ConvertFrom-Json
+$key = [Microsoft.Win32.Registry]::CurrentUser.CreateSubKey('Environment')
+try {
+  $value = $key.GetValue('Path', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+  $kind = if ($null -eq $value) { $null } else { $key.GetValueKind('Path').ToString() }
+  if ($null -ne $kind -and $kind -notin @('String','ExpandString')) { throw 'User PATH is not a string.' }
+  if ($p.action -eq 'read') { @{ value = $value; kind = $kind } | ConvertTo-Json -Compress; exit 0 }
+  if ($p.expected -and ($value -cne $p.expected.value -or $kind -cne $p.expected.kind)) { throw 'User PATH changed concurrently; retry the operation.' }
+  $parts = if ($null -eq $value -or $value -eq '') { @() } else { @($value.Split(';')) }
+  if ($p.action -eq 'add') { $next = (@($p.entry) + $parts) -join ';' }
+  else { $next = (@($parts | Where-Object { $_ -cne $p.entry })) -join ';' }
+  if ($next -cne $value) {
+    $writeKind = if ($kind) { [Microsoft.Win32.RegistryValueKind]$kind } else { [Microsoft.Win32.RegistryValueKind]::ExpandString }
+    if ($p.action -eq 'remove' -and $p.removeEmpty -and $next -eq '') { $key.DeleteValue('Path', $false) }
+    else { $key.SetValue('Path', $next, $writeKind) }
+    Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class MasonEnvironment { [DllImport("user32.dll", CharSet=CharSet.Unicode, SetLastError=true)] public static extern IntPtr SendMessageTimeout(IntPtr h, uint m, UIntPtr w, string l, uint f, uint t, out UIntPtr r); }'
+    $result = [UIntPtr]::Zero
+    [void][MasonEnvironment]::SendMessageTimeout([IntPtr]0xffff, 0x1a, [UIntPtr]::Zero, 'Environment', 2, 1000, [ref]$result)
+  }
+  @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
+} finally { $key.Dispose() }
+`;
+  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
+}
+var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
+var init_path = __esm({
+  "src/distribution/path.ts"() {
+    "use strict";
+    execute2 = promisify12(execFile12);
+    pathChangeSchema = z17.discriminatedUnion("kind", [
+      z17.object({ kind: z17.literal("profile"), file: z17.string(), block: z17.string(), created: z17.boolean() }),
+      z17.object({ kind: z17.literal("windows"), entry: z17.string(), created: z17.boolean() })
+    ]);
+    quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+    normalizeWindowsEntry = (value) => path23.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    hasWindowsEntry = (value, entry, env = process.env) => {
+      const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
+      const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
+      return (value ?? "").split(";").some((part) => normalizeWindowsEntry(expand(part)) === normalizeWindowsEntry(entry));
+    };
+  }
+});
+
 // src/distribution/install.ts
 var install_exports2 = {};
 __export(install_exports2, {
@@ -4529,55 +4834,55 @@ __export(install_exports2, {
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs18 from "fs/promises";
-import os3 from "os";
-import path23 from "path";
+import fs19 from "fs/promises";
+import os4 from "os";
+import path24 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { spawn } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
-import { z as z17 } from "zod";
+import { randomUUID as randomUUID9 } from "crypto";
+import { z as z18 } from "zod";
 async function replace(file, content2, mode = 384) {
-  const temp = file + ".tmp-" + randomUUID8();
+  const temp = file + ".tmp-" + randomUUID9();
   try {
-    await fs18.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs18.rename(temp, file);
+    await fs19.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs19.rename(temp, file);
   } finally {
-    await fs18.rm(temp, { force: true });
+    await fs19.rm(temp, { force: true });
   }
 }
 async function installStandalone(source) {
   const bundle = await verifyBundle(source);
-  const selectedHome = path23.resolve(defaultHome());
-  await fs18.mkdir(selectedHome, { recursive: true });
-  const home = await fs18.realpath(selectedHome);
-  const selectedBin = path23.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path23.join(home, "bin") : path23.join(os3.homedir(), ".local/bin")));
+  const selectedHome = path24.resolve(defaultHome());
+  await fs19.mkdir(selectedHome, { recursive: true });
+  const home = await fs19.realpath(selectedHome);
+  const selectedBin = path24.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path24.join(home, "bin") : path24.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
     const previous = raw === null ? null : recordSchema2.parse(raw);
-    if (!previous) for (const file of await fs18.readdir(home)) {
+    if (!previous) for (const file of await fs19.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path23.join(home, file);
-      const stat = await fs18.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs18.readdir(directory)).length) {
+      const directory = path24.join(home, file);
+      const stat = await fs19.lstat(directory);
+      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs19.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-    await fs18.mkdir(selectedBin, { recursive: true });
-    const bin = await fs18.realpath(selectedBin);
+    await fs19.mkdir(selectedBin, { recursive: true });
+    const bin = await fs19.realpath(selectedBin);
     if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
     const id = bundle.manifestHash.slice(0, 24);
     const destination = await storePath(home, "versions/" + id);
     const launchers = process.platform === "win32" ? {
       "mason.cmd": WINDOWS_BATCH_LAUNCHER,
-      "mason.ps1": `$ErrorActionPreference = 'Stop'
+      "mason-launcher.ps1": `$ErrorActionPreference = 'Stop'
 $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path23.join(destination, "node.exe"))} ${psQuote(path23.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path24.join(destination, "node.exe"))} ${psQuote(path24.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path23.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path24.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -4586,48 +4891,66 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
-      const old = await fs18.readFile(file, "utf8").catch((error) => {
+      const old = await fs19.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (old !== null && old !== previous?.launchers[name] && old !== previous?.previousLaunchers?.[name] && old !== content2) throw new Error("Refusing to replace an unrelated or edited launcher: " + file);
     }
-    const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers };
+    const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
+    const checkRetired = async (name, expected) => {
+      if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
+      const actual = await fs19.readFile(await storePath(bin, name), "utf8").catch((error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      });
+      if (actual !== null && actual !== expected) throw new Error("Retired launcher was edited; retained: " + name);
+    };
+    for (const [name, expected] of retired) await checkRetired(name, expected);
+    const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
     await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
-    const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
-    await fs18.mkdir(stage);
+    const stage = await storePath(home, "versions/.install-" + randomUUID9(), true);
+    await fs19.mkdir(stage);
     try {
       for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
         const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs18.copyFile(from, to);
-        await fs18.chmod(to, (await fs18.stat(from)).mode & 511);
+        await fs19.copyFile(from, to);
+        await fs19.chmod(to, (await fs19.stat(from)).mode & 511);
       }
       await verifyBundle(stage, bundle.manifestHash);
-      const exists2 = await fs18.lstat(destination).then(() => true, (error) => {
+      const exists2 = await fs19.lstat(destination).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       });
       if (exists2) await verifyBundle(destination, bundle.manifestHash);
-      else await fs18.rename(stage, destination);
+      else await fs19.rename(stage, destination);
       for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
+      for (const [name, expected] of retired) {
+        await checkRetired(name, expected);
+        await fs19.rm(await storePath(bin, name), { force: true });
+      }
       await writeStoreJson(home, "install.json", receipt);
     } finally {
-      await fs18.rm(stage, { recursive: true, force: true });
+      await fs19.rm(stage, { recursive: true, force: true });
     }
-    return { home, bin, version: bundle.manifest.version };
+    const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
+      receipt.pathChanges = changes;
+      await writeStoreJson(home, "install.json", receipt);
+    });
+    return { home, bin, version: bundle.manifest.version, path: pathResult };
   });
 }
 async function currentInstallation() {
-  const app = path23.dirname(path23.dirname(fileURLToPath2(import.meta.url)));
-  const bundle = path23.dirname(app), home = path23.dirname(path23.dirname(bundle));
+  const app = path24.dirname(path24.dirname(fileURLToPath2(import.meta.url)));
+  const bundle = path24.dirname(app), home = path24.dirname(path24.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
   const record = recordSchema2.parse(raw);
-  if (record.home !== await fs18.realpath(home) || path23.dirname(bundle) !== path23.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs19.realpath(home) || path24.dirname(bundle) !== path24.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version) {
@@ -4635,7 +4958,7 @@ async function upgradeStandalone(version) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path23.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path24.join(bundle, windows ? "install.ps1" : "install.sh");
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
@@ -4654,40 +4977,44 @@ async function uninstallStandalone() {
   }
   await withLock(home, ".install-lock", async () => {
     for (const [name, expected] of Object.entries(record.launchers)) {
-      if (!["mason", "mason.cmd", "mason.ps1"].includes(name)) throw new Error("Invalid owned launcher name.");
+      if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs18.readFile(file, "utf8").catch((error) => {
+      const actual = await fs19.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (actual !== null && actual !== expected) throw new Error("Launcher was edited; retained: " + file);
     }
+    for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs18.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs19.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs18.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs19.rm(home, { recursive: true, force: true });
   return home;
 }
-var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, defaultHome;
+var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
 var init_install2 = __esm({
   "src/distribution/install.ts"() {
     "use strict";
     init_bundle();
     init_storage();
     init_store();
-    recordSchema2 = z17.object({
-      format: z17.literal(1),
-      home: z17.string(),
-      bin: z17.string(),
-      current: z17.string().regex(/^[a-f0-9]{24}$/),
-      version: z17.string(),
-      launchers: z17.record(z17.string()),
-      previousLaunchers: z17.record(z17.string()).optional()
+    init_path();
+    recordSchema2 = z18.object({
+      format: z18.literal(1),
+      home: z18.string(),
+      bin: z18.string(),
+      current: z18.string().regex(/^[a-f0-9]{24}$/),
+      version: z18.string(),
+      launchers: z18.record(z18.string()),
+      previousLaunchers: z18.record(z18.string()).optional(),
+      pathChanges: z18.array(pathChangeSchema).optional()
     });
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
-    WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason.ps1" %*\r\n';
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path23.join(process.env.LOCALAPPDATA ?? os3.homedir(), "Mason") : path23.join(os3.homedir(), ".local/share/mason"));
+    WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
+    launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path24.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path24.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
@@ -4789,7 +5116,7 @@ async function runAutomationCli(argv, stdin = "", io = {
 
 // bin/mason.ts
 var [command, ...args] = process.argv.slice(2);
-var usage = `Mason ${"0.14.0"}
+var usage = `Mason ${"0.14.2"}
 
 Usage: mason <command> [options]
 
@@ -4807,7 +5134,7 @@ Use mason <command> --help for options. npm users can keep using mason-auto,
 mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
 try {
   if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.14.0");
+  else if (["--version", "-v"].includes(command)) console.log("0.14.2");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { sourceRuntime: sourceRuntime2 } = await Promise.resolve().then(() => (init_runtime2(), runtime_exports));
@@ -4816,8 +5143,7 @@ try {
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
     const installed = await installStandalone2(selected.bundleRoot);
     console.log(`Installed Mason ${installed.version} in ${installed.home}.
-Launcher: ${installed.bin}
-Add that directory to PATH if needed, then run: mason setup --host codex`);
+${installed.path.message}`);
   } else if (command === "upgrade" || command === "uninstall") {
     if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Project versions change only when you rerun setup." : "Usage: mason uninstall. Removes the standalone user installation; project runtimes, configuration and knowledge are retained.");
     else {