mason-context 0.14.1 → 0.15.0

package/dist/mason-auto.js

@@ -1105,9 +1105,133 @@ var init_deleted_reference = __esm({
   }
 });
 
-// src/audit/checks/new-module.ts
-import fg2 from "fast-glob";
+// src/audit/inputs.ts
+import fs6 from "fs/promises";
+import * as nativeFs from "fs";
 import path9 from "path";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+import fg2 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs6.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg2.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  const { stdout } = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
+    ],
+    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
+  );
+  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const operation = execute(
+    "git",
+    ["check-ignore", "-z", "--stdin"],
+    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
+  );
+  operation.child.stdin.on("error", () => {
+  });
+  operation.child.stdin.end(files.join("\0") + "\0");
+  try {
+    return new Set((await operation).stdout.split("\0").filter(Boolean));
+  } catch (error) {
+    if (error.code === 1) return /* @__PURE__ */ new Set();
+    throw error;
+  }
+}
+var execute, MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    execute = promisify6(execFile6);
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/checks/new-module.ts
+import fg3 from "fast-glob";
+import fs7 from "fs/promises";
+import path10 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1118,22 +1242,6 @@ function isMentioned(combinedDocs, name) {
   );
   return re.test(combinedDocs);
 }
-async function listSubdirs(absDir) {
-  const dirs = await fg2("*", {
-    cwd: absDir,
-    onlyDirectories: true,
-    suppressErrors: true
-  });
-  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
-}
-async function countSourceFiles(absDir) {
-  const files = await fg2(SOURCE_GLOB, {
-    cwd: absDir,
-    ignore: SOURCE_IGNORE,
-    suppressErrors: true
-  });
-  return files.length;
-}
 async function checkNewModules(ctx) {
   const result = emptyResult();
   if (ctx.docs.length === 0) return result;
@@ -1161,21 +1269,48 @@ async function checkNewModules(ctx) {
   return result;
 }
 async function moduleCandidates(root, combinedDocs) {
+  const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const listSubdirs = async (dir) => {
+    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
+    const ignored = await gitIgnoredPaths(root, dirs);
+    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
+    return (await auditGlob(root, dir === "." ? "*" : `${fg3.escapePath(dir)}/*`, {
+      ignore,
+      onlyDirectories: true,
+      label: "Module directory discovery",
+      select: (file) => visible.has(file)
+    })).map((file) => path10.posix.basename(file));
+  };
+  const countSourceFiles = async (dir) => {
+    const files = sources.filter((file) => file.startsWith(dir + "/"));
+    let count3 = 0;
+    for (let offset = 0; offset < files.length; offset += 256) {
+      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg3.escapePath(file)), {
+        ignore,
+        followSymbolicLinks: false,
+        label: `Source discovery in ${dir}`
+      })).length;
+      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+    }
+    return count3;
+  };
   const candidates = [];
-  for (const topDir of await listSubdirs(root)) {
-    const absTop = path9.join(root, topDir);
+  for (const topDir of await listSubdirs(".")) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count3 = await countSourceFiles(absTop);
+      const count3 = await countSourceFiles(topDir);
       if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
-    const subdirs = await listSubdirs(absTop);
+    const subdirs = await listSubdirs(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      const count3 = await countSourceFiles(`${topDir}/${sub}`);
       if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
         candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
@@ -1187,7 +1322,8 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
-    init_snapshot();
+    init_files();
+    init_inputs();
     init_git();
     init_checks();
     DIR_DENYLIST = /* @__PURE__ */ new Set([
@@ -1215,19 +1351,10 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import fs6 from "fs/promises";
-import path10 from "path";
-import fg3 from "fast-glob";
-async function readIfExists(absPath) {
-  try {
-    return await fs6.readFile(absPath, "utf-8");
-  } catch {
-    return null;
-  }
-}
+import path11 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
-    const content2 = await readIfExists(path10.join(root, name));
+    const content2 = await readAuditInput(root, name);
     if (content2 === null) continue;
     const members = [];
     for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
@@ -1241,26 +1368,28 @@ async function countGradleModules(root) {
   return null;
 }
 async function countNpmWorkspaces(root) {
-  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  const pkgRaw = await readAuditInput(root, "package.json");
   if (pkgRaw !== null) {
+    let globs = [];
     try {
       const pkg = JSON.parse(pkgRaw);
-      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
-      if (globs.length > 0) {
-        const matched = await fg3(
-          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-          { cwd: root, ignore: ["**/node_modules/**"] }
-        );
-        return {
-          actual: matched.length,
-          countedFrom: "package.json workspaces",
-          members: matched.map((m) => path10.dirname(m)).sort()
-        };
-      }
+      globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
     } catch {
     }
+    if (globs.length > 0) {
+      const matched = await auditGlob(
+        root,
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { ignore: ["**/node_modules/**"], label: "npm workspace discovery" }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "package.json workspaces",
+        members: matched.map((m) => path11.dirname(m)).sort()
+      };
+    }
   }
-  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  const pnpmRaw = await readAuditInput(root, "pnpm-workspace.yaml");
   if (pnpmRaw !== null) {
     const globs = [];
     let inPackages = false;
@@ -1279,21 +1408,22 @@ async function countNpmWorkspaces(root) {
       }
     }
     if (globs.length > 0) {
-      const matched = await fg3(
+      const matched = await auditGlob(
+        root,
         globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-        { cwd: root, ignore: ["**/node_modules/**"] }
+        { ignore: ["**/node_modules/**"], label: "pnpm workspace discovery" }
       );
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path10.dirname(m)).sort()
+        members: matched.map((m) => path11.dirname(m)).sort()
       };
     }
   }
   return null;
 }
 async function countCargoCrates(root) {
-  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  const content2 = await readAuditInput(root, "Cargo.toml");
   if (content2 === null) return null;
   const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
@@ -1304,12 +1434,12 @@ async function countCargoCrates(root) {
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (/[*?[\]{}]/.test(entry)) {
-      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
-        cwd: root,
-        ignore: ["**/target/**"]
+      const matched = await auditGlob(root, `${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        ignore: ["**/target/**"],
+        label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path10.dirname(m));
-    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path11.dirname(m));
+    } else if (await readAuditInput(root, path11.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1363,18 +1493,18 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     MEMBERS_CAP = 50;
   }
 });
 
 // src/audit/checks/dead-command.ts
-import fs7 from "fs/promises";
-import path11 from "path";
-import fg4 from "fast-glob";
-async function scriptsOf(absManifest) {
+async function scriptsOf(root, manifest) {
+  const raw = await readAuditInput(root, manifest);
+  if (raw === null) return null;
   try {
-    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    const pkg = JSON.parse(raw);
     return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
   } catch {
     return null;
@@ -1386,7 +1516,7 @@ async function checkDeadCommands(ctx) {
     (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
   );
   if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  const rootScripts = await scriptsOf(ctx.root, "package.json");
   if (rootScripts === null) {
     result.skipped.push({
       check: "dead-command",
@@ -1403,7 +1533,7 @@ async function checkDeadCommands(ctx) {
     const manifests = await commandManifests(ctx.root);
     manifestsChecked = ["package.json", ...manifests.sort()];
     for (const manifest of manifests) {
-      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
+      const scripts = await scriptsOf(ctx.root, manifest);
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -1429,23 +1559,24 @@ async function checkDeadCommands(ctx) {
   return result;
 }
 function commandManifests(root) {
-  return fg4("**/package.json", {
-    cwd: root,
-    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  return auditGlob(root, "**/package.json", {
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"],
+    label: "Command manifest discovery"
   });
 }
 var AVAILABLE_SCRIPTS_CAP;
 var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     AVAILABLE_SCRIPTS_CAP = 30;
   }
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 async function git(root, args) {
   return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
@@ -1497,7 +1628,7 @@ var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify6(execFile6);
+    exec6 = promisify7(execFile7);
   }
 });
 
@@ -2262,9 +2393,9 @@ __export(evidence_exports, {
 import fs11 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
-import fg5 from "fast-glob";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+import fg4 from "fast-glob";
 import { z as z5 } from "zod";
 async function git2(root, ...args) {
   return (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
@@ -2280,34 +2411,13 @@ async function workspace(dir) {
   }
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
-async function content(root, file) {
-  try {
-    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
 async function readInputs(root) {
-  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+  const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git2(root, "rev-parse", "HEAD"),
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
-    fg5("**/*", {
-      cwd: root,
-      dot: true,
-      onlyFiles: false,
-      followSymbolicLinks: false,
-      objectMode: true,
-      ignore: SOURCE_IGNORE
-    }),
     git2(root, "rev-parse", "--git-path", "shallow"),
     git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
-  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
-  const files = entries.map((f) => f.path);
-  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
   const head = headText.trim();
   let shallow = null;
   try {
@@ -2328,9 +2438,19 @@ async function readInputs(root) {
       claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
     }
   }
-  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
   const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
   const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const commandClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).commands : []);
+  const rootPackage = await content(root, "package.json");
+  let rootScripts = null;
+  if (rootPackage !== null) {
+    try {
+      const pkg = JSON.parse(rootPackage);
+      rootScripts = pkg?.scripts && typeof pkg.scripts === "object" ? Object.keys(pkg.scripts) : [];
+    } catch {
+    }
+  }
+  const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -2339,16 +2459,19 @@ async function readInputs(root) {
   const [modules, counts, manifests, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
-    commandManifests(root),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    needsWorkspaceScripts ? commandManifests(root) : [],
+    fg4(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
-  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
-  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const packages = [["package.json", rootPackage], ...await Promise.all(manifests.sort().map(async (file) => [file, await content(root, file)]))];
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
+    await storePath(root, file);
+    return [file, await content(root, file)];
+  }));
   const [status, index2] = decisions.length ? await Promise.all([
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [2, engineVersion, head, shallow, replacements, docContents];
+  const common = [3, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -2384,7 +2507,7 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
-var exec7, engineVersion, hash, internal, cacheSchema;
+var exec7, engineVersion, hash, content, internal, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
@@ -2392,14 +2515,15 @@ var init_evidence = __esm({
     init_claims();
     init_repair();
     init_checks();
-    init_files();
+    init_inputs();
     init_new_module();
     init_stale_count();
     init_dead_command();
     init_storage();
-    exec7 = promisify7(execFile7);
-    engineVersion = true ? "0.14.1" : "development";
+    exec7 = promisify8(execFile8);
+    engineVersion = true ? "0.15.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+    content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
   }
@@ -2728,7 +2852,7 @@ var init_runtime = __esm({
 // src/setup/model.ts
 import { z as z7 } from "zod";
 async function loadSetup(root) {
-  const raw = await readStoreJson(root, ".mason/setup.json");
+  const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
@@ -2739,28 +2863,23 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var runtimeSchema, setupHostSchema, setupSchema, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
     init_storage();
-    runtimeSchema = z7.object({
-      id: z7.string().regex(/^[a-f0-9]{24}$/),
-      version: z7.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      hashes: z7.record(z7.string().regex(/^[a-f0-9]{64}$/)),
-      bundle: z7.object({ target: z7.string(), manifestHash: z7.string().regex(/^[a-f0-9]{64}$/) }).optional()
-    });
     setupHostSchema = z7.object({
-      runtime: runtimeSchema,
+      configuredVersion: z7.string(),
       revision: z7.string().uuid(),
       fingerprint: z7.string(),
       mcpFingerprint: z7.string(),
       instructions: z7.array(z7.string())
     });
-    setupSchema = z7.object({ version: z7.literal(1), hosts: z7.object({
+    setupSchema = z7.object({ version: z7.literal(2), hosts: z7.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
+    SETUP_PATH = ".mason/local/setup.json";
     receiptSchema = z7.object({
       version: z7.literal(1),
       host: z7.enum(["codex", "claude"]),
@@ -2774,6 +2893,39 @@ var init_model = __esm({
   }
 });
 
+// src/setup/launcher.ts
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+function globalCommand(args, platform = process.platform) {
+  return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
+}
+async function installedCommand() {
+  const invocation = globalCommand(["internal-integration-version"]);
+  try {
+    const { stdout } = await promisify9(execFile9)(
+      invocation.command,
+      invocation.args,
+      { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
+    );
+    const result = JSON.parse(stdout);
+    if (result.protocol !== 1 || typeof result.version !== "string") throw new Error("Unsupported Mason integration protocol.");
+    return { available: true, version: result.version, message: null };
+  } catch {
+    return { available: false, version: null, message: "An up-to-date mason command is not available on this process's PATH. Install or upgrade Mason, then reopen your terminal or desktop assistant and rerun mason setup." };
+  }
+}
+var executingVersion, mcpCommand, hookCommand;
+var init_launcher = __esm({
+  "src/setup/launcher.ts"() {
+    "use strict";
+    init_evidence();
+    init_model();
+    executingVersion = () => true ? "0.15.0" : "development";
+    mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
+    hookCommand = (host) => `mason --setup-host ${host} auto`;
+  }
+});
+
 // src/setup/observations.ts
 var observations_exports = {};
 __export(observations_exports, {
@@ -2783,14 +2935,14 @@ __export(observations_exports, {
 });
 import fs13 from "fs/promises";
 import { z as z8 } from "zod";
-function observationPath(directory, host, revision) {
-  return `${directory}/activation/${host}-${revision}.json`;
+function observationPath(directory, host, revision, version = executingVersion()) {
+  return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
-async function readObservation(root, directory, host, revision) {
-  const raw = await readStoreJson(root, observationPath(directory, host, revision));
+async function readObservation(root, directory, host, revision, version = executingVersion()) {
+  const raw = await readStoreJson(root, observationPath(directory, host, revision, version));
   if (raw === null) return null;
   const record = observationSchema.parse(raw);
-  if (record.root !== root || record.host !== host || record.revision !== revision) throw new Error("Activation receipt belongs to another installation.");
+  if (record.root !== root || record.host !== host || record.revision !== revision || record.masonVersion !== version) throw new Error("Activation receipt belongs to another installation.");
   return record;
 }
 async function observeActivation(dir, event, options = {}) {
@@ -2807,6 +2959,7 @@ async function observeActivation(dir, event, options = {}) {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const record = await readObservation(ws.root, ws.directory, host, revision) ?? {
         version: 1,
+        masonVersion: executingVersion(),
         root: ws.root,
         revision,
         host,
@@ -2845,8 +2998,10 @@ var init_observations = __esm({
     init_store();
     init_storage();
     init_model();
+    init_launcher();
     observationSchema = z8.object({
       version: z8.literal(1),
+      masonVersion: z8.string(),
       root: z8.string(),
       revision: z8.string(),
       host: z8.enum(["codex", "claude"]),
@@ -2936,106 +3091,78 @@ var init_adapters = __esm({
   }
 });
 
-// src/automation/install.ts
-var install_exports = {};
-__export(install_exports, {
-  automationConfigSchema: () => automationConfigSchema,
-  configPath: () => configPath,
-  installAutomation: () => installAutomation,
-  installedAutomation: () => installedAutomation,
-  planAutomationInstall: () => planAutomationInstall
+// src/setup/files.ts
+var files_exports = {};
+__export(files_exports, {
+  applyEdit: () => applyEdit,
+  managedBlock: () => managedBlock,
+  readText: () => readText
 });
-import { z as z10 } from "zod";
-async function installAutomation(dir, host, command) {
-  const ws = await workspace(dir);
-  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command));
-}
-async function planAutomationInstall(root, host, command) {
-  const file = configPath(host);
-  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
-  const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
-  const desired = hookConfig(host, command);
-  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
-  const previous = record.hosts[host]?.command;
-  const hooks = existing.hooks ?? {};
-  for (const event of HOOK_EVENTS) {
-    hooks[event] = (hooks[event] ?? []).map((group) => ({
-      ...group,
-      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && (handler.command === previous || handler.command === newCommand)))
-    })).filter((group) => group.hooks.length);
-    hooks[event].push(...desired.hooks[event]);
+import fs14 from "fs/promises";
+import path18 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+async function readText(root, file) {
+  try {
+    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
+    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
+    return text2;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
   }
-  record.hosts[host] = { command: newCommand };
-  return { file, config: { ...existing, hooks }, record, newCommand };
 }
-async function installLocked(root, host, command) {
-  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command);
-  await writeStoreJson(root, file, config);
-  await writeStoreJson(root, ".mason/automation.json", record);
-  return {
-    version: 1,
-    host,
-    configPath: file,
-    status: "configured",
-    command: newCommand,
-    events: HOOK_EVENTS,
-    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
-    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
-  };
+function managedBlock(text2, start, end, body) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
+    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
+  }
+  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
+  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
+  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
+  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
 }
-async function installedAutomation(dir) {
-  const ws = await workspace(dir);
-  const raw = await readStoreJson(ws.root, ".mason/automation.json");
-  if (raw === null) return {};
-  const record = recordSchema.parse(raw);
-  const result = {};
-  for (const host of ["claude", "codex"]) {
-    const expected = record.hosts[host];
-    if (!expected) continue;
-    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
-    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
-    result[host] = {
-      configPath: configPath(host),
-      configuredEvents,
-      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
-      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
-    };
+async function applyEdit(root, edit) {
+  const current = await readText(root, edit.path);
+  if (current === edit.after) return false;
+  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
+  const file = await storePath(root, edit.path, true);
+  const temporary = path18.join(path18.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  try {
+    const mode = await fs14.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs14.open(temporary, "wx", mode);
+    try {
+      await handle.writeFile(edit.after, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
+    await fs14.rename(temporary, file);
+    return true;
+  } finally {
+    await fs14.rm(temporary, { force: true });
   }
-  return result;
 }
-var groupSchema, automationConfigSchema, recordSchema, configPath;
-var init_install = __esm({
-  "src/automation/install.ts"() {
+var init_files2 = __esm({
+  "src/setup/files.ts"() {
     "use strict";
+    init_files();
     init_storage();
-    init_evidence();
-    init_adapters();
-    init_store();
-    groupSchema = z10.object({ hooks: z10.array(z10.object({ type: z10.string(), command: z10.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z10.object({ hooks: z10.record(z10.array(groupSchema)).optional() }).passthrough();
-    recordSchema = z10.object({ version: z10.literal(1), hosts: z10.record(z10.object({ command: z10.string() })) });
-    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
 });
 
 // src/mcp/init.ts
-import { z as z11 } from "zod";
-async function loadProjectMarker(rootDir) {
-  const raw = await readStoreJson(rootDir, ".mason/project.json");
-  return raw === null ? null : markerSchema.parse(raw);
-}
-async function saveProjectMarker(rootDir, marker) {
-  await writeStoreJson(rootDir, ".mason/project.json", markerSchema.parse(marker));
-}
+import { z as z10 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
-    markerSchema = z11.object({
-      version: z11.literal(1),
-      initializedAt: z11.string(),
-      features: z11.object({ confluence: z11.boolean().optional() }).optional()
+    init_files2();
+    markerSchema = z10.object({
+      version: z10.literal(1),
+      initializedAt: z10.string(),
+      features: z10.object({ confluence: z10.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -3057,7 +3184,7 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 Inspect source for what the retrieved context does not answer.
 <!-- mason:end -->`;
     ASSISTANT_SETUP = `UNIFIED SETUP
-When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, install a pinned private runtime, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, use the installed mason command on PATH, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
 If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason-auto status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
 
 The managed project guidance is:
@@ -3065,7 +3192,7 @@ ${CLAUDE_MD_SECTION}`;
     QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
-2. Address findings within the user's requested scope. Setup alone authorizes the Mason runtime, host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
 3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
@@ -3107,37 +3234,286 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
   }
 });
 
-// src/review/cochange.ts
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
-async function buildMatrix(resolvedRoot) {
+// src/utils/git.ts
+var git_exports = {};
+__export(git_exports, {
+  isGitRepo: () => isGitRepo
+});
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+async function isGitRepo(dir) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
-    if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
-      "git",
-      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
-      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
-    );
-    const commitsByFile = /* @__PURE__ */ new Map();
-    const blocks = stdout.split("
");
-    let index2 = 0;
-    for (const block of blocks) {
-      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
-      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
-      for (const file of files) {
-        let set = commitsByFile.get(file);
-        if (!set) {
-          set = /* @__PURE__ */ new Set();
-          commitsByFile.set(file, set);
-        }
-        set.add(index2);
-      }
-      index2++;
-    }
-    return { commitsByFile, totalCommits: index2 };
+    await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
+    return true;
   } catch {
-    return null;
+    return false;
+  }
+}
+var exec8;
+var init_git2 = __esm({
+  "src/utils/git.ts"() {
+    "use strict";
+    exec8 = promisify10(execFile10);
+  }
+});
+
+// src/setup/config.ts
+var config_exports = {};
+__export(config_exports, {
+  ancillaryEdits: () => ancillaryEdits,
+  hookEdits: () => hookEdits,
+  inspectHostConfig: () => inspectHostConfig,
+  instructionEdits: () => instructionEdits,
+  mcpEdit: () => mcpEdit,
+  mcpPath: () => mcpPath
+});
+import { isDeepStrictEqual } from "util";
+import { parse, stringify } from "smol-toml";
+import { z as z11 } from "zod";
+async function instructionEdits(root, host) {
+  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
+  const existing = found.find((f) => f.text !== null);
+  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
+  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
+  const edits = [{
+    path: primary.path,
+    before: primary.text,
+    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
+  }];
+  if (primary.path === "AGENTS.md") {
+    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
+    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
+    for (const file of secondary) {
+      const text2 = file.text ?? "";
+      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
+      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      if (text2.trim() === imported) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
+      edits.push({
+        path: file.path,
+        before: file.text,
+        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
+      });
+    }
+  }
+  return edits;
+}
+function managedMcp(previous, host) {
+  const options = previous === void 0 ? {} : object.parse(previous);
+  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
+  return { ...options, ...mcpCommand(host) };
+}
+async function mcpEdit(root, host) {
+  const file = mcpPath(host), before = await readText(root, file);
+  if (host === "claude") {
+    const config2 = before === null ? {} : object.parse(JSON.parse(before));
+    const servers2 = object.parse(config2.mcpServers ?? {});
+    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host) } }, null, 2) + "\n" };
+  }
+  const config = parse(before ?? "");
+  const managed = (before ?? "").includes(TOML_START);
+  const servers = config.mcp_servers;
+  const desired = managedMcp(servers?.mason, host);
+  let base = before ?? "";
+  if (servers?.mason && !managed) {
+    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
+    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
+    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
+    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
+  }
+  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
+  const parsed = parse(after);
+  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
+  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
+  return { path: file, before, after };
+}
+async function hookEdits(root, host) {
+  const file = configPath(host), before = await readText(root, file);
+  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  const plan = await planAutomationInstall2(root, host, hookCommand(host));
+  return [
+    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
+    { path: AUTOMATION_PATH, before: await readText(root, AUTOMATION_PATH), after: JSON.stringify(plan.record, null, 2) + "\n" }
+  ];
+}
+async function ancillaryEdits(root) {
+  const ignore = await readText(root, ".gitignore");
+  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
+  let parentIgnored = false;
+  try {
+    if (await isGitRepo2(root)) parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+  } catch (error) {
+    if (error.code !== 1) throw error;
+  }
+  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
+  const rules = [
+    ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
+    "!/.mason/decisions/",
+    "!/.mason/decisions/**",
+    "!/.mason/config.json",
+    "!/.mason/snapshot.json",
+    "/.mason/local/",
+    "/.mason/reports/"
+  ].join("\n");
+  return [{ path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) }];
+}
+async function inspectHostConfig(root, host, plannedMcp) {
+  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
+  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
+  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
+  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
+  const expected = hookConfig(host, hookCommand(host));
+  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
+  return {
+    mcp,
+    mcpDisabled: mcp?.enabled === false,
+    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
+      event,
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+    ])),
+    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
+  };
+}
+var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
+var init_config = __esm({
+  "src/setup/config.ts"() {
+    "use strict";
+    init_init();
+    init_docs();
+    init_adapters();
+    init_install();
+    init_files2();
+    init_launcher();
+    object = z11.record(z11.unknown());
+    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
+    TOML_START = "# mason:mcp:start";
+    TOML_END = "# mason:mcp:end";
+    POINTER_START = "<!-- mason:agents:start -->";
+    POINTER_END = "<!-- mason:agents:end -->";
+  }
+});
+
+// src/automation/install.ts
+var install_exports = {};
+__export(install_exports, {
+  AUTOMATION_PATH: () => AUTOMATION_PATH,
+  automationConfigSchema: () => automationConfigSchema,
+  configPath: () => configPath,
+  installAutomation: () => installAutomation,
+  installedAutomation: () => installedAutomation,
+  planAutomationInstall: () => planAutomationInstall
+});
+import { z as z12 } from "zod";
+async function installationRecord(root) {
+  return recordSchema.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
+}
+async function installAutomation(dir, host, command) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command));
+}
+async function planAutomationInstall(root, host, command) {
+  const file = configPath(host);
+  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
+  const record = await installationRecord(root);
+  const desired = hookConfig(host, command);
+  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
+  const previous = record.hosts[host]?.command;
+  const owned = /* @__PURE__ */ new Set([previous, newCommand]);
+  const hooks = existing.hooks ?? {};
+  for (const event of HOOK_EVENTS) {
+    hooks[event] = (hooks[event] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && owned.has(handler.command)))
+    })).filter((group) => group.hooks.length);
+    hooks[event].push(...desired.hooks[event]);
+  }
+  record.hosts[host] = { command: newCommand };
+  return { file, config: { ...existing, hooks }, record, newCommand };
+}
+async function installLocked(root, host, command) {
+  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command);
+  const { ancillaryEdits: ancillaryEdits2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  const { applyEdit: applyEdit2 } = await Promise.resolve().then(() => (init_files2(), files_exports));
+  for (const edit of await ancillaryEdits2(root)) await applyEdit2(root, edit);
+  await writeStoreJson(root, file, config);
+  await writeStoreJson(root, AUTOMATION_PATH, record);
+  return {
+    version: 1,
+    host,
+    configPath: file,
+    status: "configured",
+    command: newCommand,
+    events: HOOK_EVENTS,
+    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
+    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
+  };
+}
+async function installedAutomation(dir) {
+  const ws = await workspace(dir);
+  const record = await installationRecord(ws.root);
+  const result = {};
+  for (const host of ["claude", "codex"]) {
+    const expected = record.hosts[host];
+    if (!expected) continue;
+    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
+    result[host] = {
+      configPath: configPath(host),
+      configuredEvents,
+      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
+      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+    };
+  }
+  return result;
+}
+var groupSchema, automationConfigSchema, recordSchema, AUTOMATION_PATH, configPath;
+var init_install = __esm({
+  "src/automation/install.ts"() {
+    "use strict";
+    init_storage();
+    init_evidence();
+    init_adapters();
+    init_store();
+    groupSchema = z12.object({ hooks: z12.array(z12.object({ type: z12.string(), command: z12.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z12.object({ hooks: z12.record(z12.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z12.object({ version: z12.literal(1), hosts: z12.record(z12.object({ command: z12.string() })) });
+    AUTOMATION_PATH = ".mason/local/automation.json";
+    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+  }
+});
+
+// src/review/cochange.ts
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
+async function buildMatrix(resolvedRoot) {
+  try {
+    const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    if (shallow.trim() === "true") return null;
+    const { stdout } = await exec9(
+      "git",
+      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
+      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
+    );
+    const commitsByFile = /* @__PURE__ */ new Map();
+    const blocks = stdout.split("
");
+    let index2 = 0;
+    for (const block of blocks) {
+      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
+      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
+      for (const file of files) {
+        let set = commitsByFile.get(file);
+        if (!set) {
+          set = /* @__PURE__ */ new Set();
+          commitsByFile.set(file, set);
+        }
+        set.add(index2);
+      }
+      index2++;
+    }
+    return { commitsByFile, totalCommits: index2 };
+  } catch {
+    return null;
   }
 }
 async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
@@ -3170,11 +3546,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify8(execFile8);
+    exec9 = promisify11(execFile11);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3229,7 +3605,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -3278,24 +3654,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count2 = z12.number().int().nonnegative();
-    schema = z12.object({
-      success: z12.boolean(),
+    count2 = z13.number().int().nonnegative();
+    schema = z13.object({
+      success: z13.boolean(),
       numTotalTests: count2,
       numPassedTests: count2,
       numFailedTests: count2,
       numPendingTests: count2,
       numTodoTests: count2,
       numFailedTestSuites: count2,
-      testResults: z12.array(z12.object({
-        name: z12.string().min(1),
-        status: z12.enum(["passed", "failed"]),
-        message: z12.string().optional(),
-        assertionResults: z12.array(z12.object({
-          fullName: z12.string(),
-          status: z12.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z12.array(z12.string()).nullable().optional(),
-          location: z12.object({ line: count2, column: count2 }).nullable().optional()
+      testResults: z13.array(z13.object({
+        name: z13.string().min(1),
+        status: z13.enum(["passed", "failed"]),
+        message: z13.string().optional(),
+        assertionResults: z13.array(z13.object({
+          fullName: z13.string(),
+          status: z13.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z13.array(z13.string()).nullable().optional(),
+          location: z13.object({ line: count2, column: count2 }).nullable().optional()
         }))
       }))
     });
@@ -3303,7 +3679,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -3394,29 +3770,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z13.number().int().nonnegative();
-    artifact = z13.object({ uri: z13.string().optional(), uriBaseId: z13.string().optional(), index: index.optional() });
-    message = z13.object({ text: z13.string().optional(), markdown: z13.string().optional(), id: z13.string().optional(), arguments: z13.array(z13.string()).optional() });
-    level = z13.enum(["error", "warning", "note", "none"]);
-    location = z13.object({ physicalLocation: z13.object({ artifactLocation: artifact.optional(), region: z13.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z13.object({
-      version: z13.literal("2.1.0"),
-      runs: z13.array(z13.object({
-        tool: z13.object({ driver: z13.object({ name: z13.string().min(1), rules: z13.array(z13.object({ id: z13.string(), defaultConfiguration: z13.object({ level: level.optional() }).optional(), messageStrings: z13.record(message).optional() })).optional(), globalMessageStrings: z13.record(message).optional() }) }),
-        invocations: z13.array(z13.object({ executionSuccessful: z13.boolean(), commandLine: z13.string().optional(), toolExecutionNotifications: z13.array(z13.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z13.array(z13.object({ revisionId: z13.string().optional() })).optional(),
-        originalUriBaseIds: z13.record(artifact).optional(),
-        artifacts: z13.array(z13.object({ location: artifact.optional() })).optional(),
-        results: z13.array(z13.object({
-          ruleId: z13.string().optional(),
+    index = z14.number().int().nonnegative();
+    artifact = z14.object({ uri: z14.string().optional(), uriBaseId: z14.string().optional(), index: index.optional() });
+    message = z14.object({ text: z14.string().optional(), markdown: z14.string().optional(), id: z14.string().optional(), arguments: z14.array(z14.string()).optional() });
+    level = z14.enum(["error", "warning", "note", "none"]);
+    location = z14.object({ physicalLocation: z14.object({ artifactLocation: artifact.optional(), region: z14.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z14.object({
+      version: z14.literal("2.1.0"),
+      runs: z14.array(z14.object({
+        tool: z14.object({ driver: z14.object({ name: z14.string().min(1), rules: z14.array(z14.object({ id: z14.string(), defaultConfiguration: z14.object({ level: level.optional() }).optional(), messageStrings: z14.record(message).optional() })).optional(), globalMessageStrings: z14.record(message).optional() }) }),
+        invocations: z14.array(z14.object({ executionSuccessful: z14.boolean(), commandLine: z14.string().optional(), toolExecutionNotifications: z14.array(z14.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z14.array(z14.object({ revisionId: z14.string().optional() })).optional(),
+        originalUriBaseIds: z14.record(artifact).optional(),
+        artifacts: z14.array(z14.object({ location: artifact.optional() })).optional(),
+        results: z14.array(z14.object({
+          ruleId: z14.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z13.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z13.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z13.array(z13.object({ kind: z13.enum(["inSource", "external"]), status: z13.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z13.array(location).optional(),
-          relatedLocations: z13.array(location).optional()
+          kind: z14.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z14.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z14.array(z14.object({ kind: z14.enum(["inSource", "external"]), status: z14.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z14.array(location).optional(),
+          relatedLocations: z14.array(location).optional()
         })).optional()
       }))
     });
@@ -3424,10 +3800,10 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence.ts
-import path18 from "path";
-import { z as z14 } from "zod";
+import path19 from "path";
+import { z as z15 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path18.isAbsolute(file) ? path18.relative(root, file) : file;
+  const relative = path19.isAbsolute(file) ? path19.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -3466,7 +3842,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z14.object({ version: z14.literal(1), checks: z14.array(z14.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z15.object({ version: z15.literal(1), checks: z15.array(z15.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -3523,7 +3899,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path18.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path19.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -3619,31 +3995,31 @@ var init_evidence2 = __esm({
     init_vitest();
     init_sarif();
     init_types2();
-    checkSchema2 = z14.object({
-      id: z14.string().min(1).max(100),
-      kind: z14.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
-      tool: z14.string().min(1).max(200),
-      command: z14.string().min(1).max(2e3),
-      commit: z14.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z14.boolean().optional(),
-      source: z14.string().max(2e3).optional(),
-      sourceRoot: z14.string().min(1).max(4e3).optional(),
-      status: z14.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z14.string().min(1).max(2e3).optional(),
-      exitCode: z14.number().int().nullable().optional(),
-      report: z14.object({ format: z14.enum(["vitest-json", "sarif"]), path: z14.string().min(1).max(4e3) }).optional()
+    checkSchema2 = z15.object({
+      id: z15.string().min(1).max(100),
+      kind: z15.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z15.string().min(1).max(200),
+      command: z15.string().min(1).max(2e3),
+      commit: z15.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z15.boolean().optional(),
+      source: z15.string().max(2e3).optional(),
+      sourceRoot: z15.string().min(1).max(4e3).optional(),
+      status: z15.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z15.string().min(1).max(2e3).optional(),
+      exitCode: z15.number().int().nullable().optional(),
+      report: z15.object({ format: z15.enum(["vitest-json", "sarif"]), path: z15.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
-import fs14 from "fs/promises";
-import path19 from "path";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
+import fs15 from "fs/promises";
+import path20 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec10("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -3654,7 +4030,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec10("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -3667,7 +4043,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -3717,7 +4093,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs14.access(path19.join(resolvedRoot, relPath));
+        await fs15.access(path20.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -3750,7 +4126,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec9, MAX_ANALYZED_FILES;
+var exec10, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -3762,7 +4138,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify9(execFile9);
+    exec10 = promisify12(execFile12);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -3851,431 +4227,6 @@ var init_onboarding = __esm({
   }
 });
 
-// src/setup/files.ts
-import fs15 from "fs/promises";
-import path20 from "path";
-import { randomUUID as randomUUID5 } from "crypto";
-async function readText(root, file) {
-  try {
-    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
-    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
-    return text2;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function managedBlock(text2, start, end, body) {
-  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
-  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
-    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
-  }
-  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
-  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
-  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
-  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
-}
-async function applyEdit(root, edit) {
-  const current = await readText(root, edit.path);
-  if (current === edit.after) return false;
-  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
-  const file = await storePath(root, edit.path, true);
-  const temporary = path20.join(path20.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
-  try {
-    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs15.open(temporary, "wx", mode);
-    try {
-      await handle.writeFile(edit.after, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
-    await fs15.rename(temporary, file);
-    return true;
-  } finally {
-    await fs15.rm(temporary, { force: true });
-  }
-}
-var init_files2 = __esm({
-  "src/setup/files.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-  }
-});
-
-// src/setup/launcher.ts
-var BOOTSTRAP, POWERSHELL_BOOTSTRAP, mcpCommand, hookCommand, SHELL_LAUNCHER, POWERSHELL_LAUNCHER, LAUNCHER;
-var init_launcher = __esm({
-  "src/setup/launcher.ts"() {
-    "use strict";
-    BOOTSTRAP = "require(require('node:path').join(require('node:child_process').execFileSync('git',['rev-parse','--show-toplevel'],{encoding:'utf8'}).trim(),'.mason','run.cjs'))";
-    POWERSHELL_BOOTSTRAP = "& (Join-Path (git rev-parse --show-toplevel) '.mason/run.ps1')";
-    mcpCommand = (host, runtime) => !runtime?.bundle ? { command: "node", args: ["-e", BOOTSTRAP, "--", host, "mcp"] } : process.platform === "win32" ? { command: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", POWERSHELL_BOOTSTRAP, host, "mcp"] } : { command: "sh", args: ["-c", 'exec sh "$(git rev-parse --show-toplevel)/.mason/run.sh" "$@"', "mason", host, "mcp"] };
-    hookCommand = (host, runtime) => !runtime?.bundle ? `node -e "${BOOTSTRAP}" -- ${host} auto` : process.platform === "win32" ? `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "${POWERSHELL_BOOTSTRAP} ${host} auto"` : `sh "$(git rev-parse --show-toplevel)/.mason/run.sh" ${host} auto`;
-    SHELL_LAUNCHER = `#!/bin/sh
-set -eu
-advisory=0
-if [ "\${2-}" = auto ] && [ "\${3-}" = hook ]; then advisory=1; fi
-fail() {
-  if [ "$advisory" -eq 1 ]; then printf '%s\\n' '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0; fi
-  echo 'Mason runtime unavailable. Rerun mason setup for this checkout.' >&2; exit 2
-}
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) || fail
-case "\${1-}" in codex|claude) ;; *) fail ;; esac
-pointer="$root/.mason/runtime/$1.txt"
-[ -f "$pointer" ] || fail
-runtime=$(cat "$pointer") || fail
-case "$runtime" in ''|*[!0-9a-f]*) fail ;; esac
-[ "\${#runtime}" -eq 24 ] || fail
-[ -x "$root/.mason/runtime/$runtime/node" ] || fail
-if [ "$advisory" -eq 1 ]; then
-  "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@" || fail
-else
-  exec "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@"
-fi
-`;
-    POWERSHELL_LAUNCHER = `# Managed by mason setup; no system Node installation is used.
-$ErrorActionPreference = 'Stop'
-$advisory = $args.Count -ge 3 -and $args[1] -eq 'auto' -and $args[2] -eq 'hook'
-try {
-  if ($args.Count -lt 2 -or $args[0] -notin @('codex','claude')) { throw 'Invalid Mason host.' }
-  $runtime = (Get-Content -LiteralPath (Join-Path $PSScriptRoot ('runtime/' + $args[0] + '.txt')) -Raw).Trim()
-  if ($runtime -cnotmatch '^[a-f0-9]{24}$') { throw 'Invalid Mason runtime pointer.' }
-  & (Join-Path $PSScriptRoot ('runtime/' + $runtime + '/node.exe')) (Join-Path $PSScriptRoot 'run.cjs') @args
-  if ($LASTEXITCODE -ne 0) { throw 'Mason runtime failed.' }
-} catch {
-  if ($advisory) { Write-Output '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0 }
-  [Console]::Error.WriteLine($_.Exception.Message); exit 2
-}
-`;
-    LAUNCHER = `// Managed by mason-auto setup. Rerun setup to install this checkout's pinned runtime.
-const fs = require('node:fs');
-const path = require('node:path');
-const {pathToFileURL} = require('node:url');
-const launchArgs = process.argv.slice(process.argv[1] && path.resolve(process.argv[1]) === __filename ? 2 : 1);
-(async () => {
-  const root = path.dirname(__dirname);
-  const args = launchArgs;
-  const [host, command, ...rest] = args;
-  if (!['codex','claude'].includes(host) || !['auto','mcp'].includes(command)) throw new Error('Invalid Mason launcher arguments.');
-  const setup = JSON.parse(fs.readFileSync(path.join(__dirname, 'setup.json'), 'utf8'));
-  const entry = setup.hosts?.[host];
-  if (setup.version !== 1 || !entry || !/^[a-f0-9]{24}$/.test(entry.runtime?.id)) throw new Error('Mason is not configured for this host. Rerun mason-auto setup.');
-  const base = path.join(__dirname, 'runtime', entry.runtime.id);
-  if (entry.runtime.bundle) {
-    const node = process.platform === 'win32' ? 'node.exe' : 'node';
-    if (fs.realpathSync(process.execPath) !== fs.realpathSync(path.join(base, node))) throw new Error('Mason runtime pointer differs from the configured version. Rerun setup.');
-  }
-  const binary = entry.runtime.bundle ? path.join(base, 'app', 'dist', 'mason-' + command + '.js')
-    : path.join(base, 'node_modules', 'mason-context', 'dist', 'mason-' + command + '.js');
-  if (!fs.existsSync(binary)) throw new Error('The pinned Mason runtime is missing in this checkout. Rerun mason-auto setup --host ' + host + '.');
-  process.env.MASON_SETUP_ROOT = root;
-  process.env.MASON_SETUP_HOST = host;
-  process.env.MASON_SETUP_REVISION = entry.revision;
-  process.argv = [process.execPath, binary, ...rest];
-  await import(pathToFileURL(binary).href);
-})().catch(error => {
-  const message = 'Mason setup unavailable: ' + error.message;
-  if (launchArgs[1] === 'auto' && launchArgs[2] === 'hook') { console.log(JSON.stringify({systemMessage: message})); process.exitCode = 0; }
-  else { console.error(message); process.exitCode = 2; }
-});
-`;
-  }
-});
-
-// src/setup/config.ts
-import { isDeepStrictEqual } from "util";
-import { parse, stringify } from "smol-toml";
-import { z as z15 } from "zod";
-async function instructionEdits(root, host) {
-  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
-  const existing = found.find((f) => f.text !== null);
-  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
-  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
-  const edits = [{
-    path: primary.path,
-    before: primary.text,
-    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
-  }];
-  if (primary.path === "AGENTS.md") {
-    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
-    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
-    for (const file of secondary) {
-      const text2 = file.text ?? "";
-      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
-      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
-      if (text2.trim() === imported) continue;
-      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
-      edits.push({
-        path: file.path,
-        before: file.text,
-        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
-      });
-    }
-  }
-  return edits;
-}
-function managedMcp(previous, host, runtime) {
-  const options = previous === void 0 ? {} : object.parse(previous);
-  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
-  return { ...options, ...mcpCommand(host, runtime) };
-}
-async function mcpEdit(root, host, runtime) {
-  const file = mcpPath(host), before = await readText(root, file);
-  if (host === "claude") {
-    const config2 = before === null ? {} : object.parse(JSON.parse(before));
-    const servers2 = object.parse(config2.mcpServers ?? {});
-    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host, runtime) } }, null, 2) + "\n" };
-  }
-  const config = parse(before ?? "");
-  const managed = (before ?? "").includes(TOML_START);
-  const servers = config.mcp_servers;
-  const desired = managedMcp(servers?.mason, host, runtime);
-  let base = before ?? "";
-  if (servers?.mason && !managed) {
-    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
-    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
-    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
-    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
-  }
-  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
-  const parsed = parse(after);
-  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
-  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
-  return { path: file, before, after };
-}
-async function hookEdits(root, host, runtime) {
-  const file = configPath(host), before = await readText(root, file);
-  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
-  const plan = await planAutomationInstall2(root, host, hookCommand(host, runtime));
-  return [
-    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
-    { path: ".mason/automation.json", before: await readText(root, ".mason/automation.json"), after: JSON.stringify(plan.record, null, 2) + "\n" }
-  ];
-}
-async function ancillaryEdits(root) {
-  const ignore = await readText(root, ".gitignore");
-  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-  let parentIgnored = false;
-  try {
-    parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
-  } catch (error) {
-    if (error.code !== 1) throw error;
-  }
-  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
-  const rules = [...retainParentRule ? ["!/.mason/", "/.mason/*"] : [], "!/.mason/decisions/", "!/.mason/decisions/**", "!/.mason/setup.json", "!/.mason/automation.json", "!/.mason/project.json", "!/.mason/run.cjs", "!/.mason/run.sh", "!/.mason/run.ps1", "/.mason/reports/", "/.mason/runtime/"].join("\n");
-  return [
-    { path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) },
-    { path: ".mason/run.cjs", before: await readText(root, ".mason/run.cjs"), after: LAUNCHER },
-    { path: ".mason/run.sh", before: await readText(root, ".mason/run.sh"), after: SHELL_LAUNCHER },
-    { path: ".mason/run.ps1", before: await readText(root, ".mason/run.ps1"), after: POWERSHELL_LAUNCHER }
-  ];
-}
-async function inspectHostConfig(root, host, plannedMcp, runtime) {
-  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
-  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
-  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
-  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
-  const expected = hookConfig(host, hookCommand(host, runtime));
-  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
-  return {
-    mcp,
-    mcpDisabled: mcp?.enabled === false,
-    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
-      event,
-      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
-    ])),
-    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
-  };
-}
-var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
-var init_config = __esm({
-  "src/setup/config.ts"() {
-    "use strict";
-    init_init();
-    init_docs();
-    init_adapters();
-    init_install();
-    init_files2();
-    init_launcher();
-    object = z15.record(z15.unknown());
-    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
-    TOML_START = "# mason:mcp:start";
-    TOML_END = "# mason:mcp:end";
-    POINTER_START = "<!-- mason:agents:start -->";
-    POINTER_END = "<!-- mason:agents:end -->";
-  }
-});
-
-// src/distribution/bundle.ts
-import fs16 from "fs/promises";
-import path21 from "path";
-import { createHash as createHash4 } from "crypto";
-import { z as z16 } from "zod";
-async function readBundle(root) {
-  const bytes = await fs16.readFile(await storePath(root, "bundle.json"));
-  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
-  const windows = manifest.target.startsWith("win32-");
-  for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
-      throw new Error("Unsafe path in Mason bundle: " + file);
-    }
-  }
-  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
-    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
-  }
-  return { manifest, manifestHash: sha256(bytes) };
-}
-async function verifyBundle(root, expectedHash) {
-  const bundle = await readBundle(root);
-  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
-  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
-  const files = Object.keys(bundle.manifest.files);
-  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs16.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
-  }));
-  return bundle;
-}
-var targets, digest2, bundleSchema, sha256;
-var init_bundle = __esm({
-  "src/distribution/bundle.ts"() {
-    "use strict";
-    init_storage();
-    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z16.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z16.object({
-      format: z16.literal(1),
-      version: z16.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z16.enum(targets),
-      nodeVersion: z16.string(),
-      files: z16.record(digest2)
-    }).strict();
-    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
-  }
-});
-
-// src/setup/runtime.ts
-import fs17 from "fs/promises";
-import path22 from "path";
-import { fileURLToPath } from "url";
-import { randomUUID as randomUUID6, createHash as createHash5 } from "crypto";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
-async function packageRoot() {
-  let directory = path22.dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 8; i++) {
-    try {
-      const pkg = JSON.parse(await fs17.readFile(path22.join(directory, "package.json"), "utf8"));
-      if (pkg.name === "mason-context") return directory;
-    } catch {
-    }
-    directory = path22.dirname(directory);
-  }
-  throw new Error("Cannot locate the executing Mason distribution. Reinstall Mason and rerun setup.");
-}
-async function sourceRuntime() {
-  const source = await packageRoot();
-  const pkg = JSON.parse(await fs17.readFile(path22.join(source, "package.json"), "utf8"));
-  const hashes = Object.fromEntries(await Promise.all(BINARIES.map(async (file) => [file, checksum(await fs17.readFile(path22.join(source, file)))])));
-  const bundleRoot = path22.dirname(source);
-  const bundleExists = await fs17.lstat(path22.join(bundleRoot, "bundle.json")).then(() => true, (error) => {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  });
-  if (bundleExists) {
-    const { manifest, manifestHash } = await verifyBundle(bundleRoot);
-    if (manifest.version !== pkg.version) throw new Error("Mason package and bundle versions differ.");
-    return { source, bundleRoot, runtime: runtimeSchema.parse({
-      id: manifestHash.slice(0, 24),
-      version: pkg.version,
-      hashes,
-      bundle: { target: manifest.target, manifestHash }
-    }) };
-  }
-  return { source, runtime: runtimeSchema.parse({ id: hash([pkg.version, pkg.dependencies, hashes]).slice(0, 24), version: pkg.version, hashes }) };
-}
-async function verifyRuntime(root, runtime) {
-  try {
-    const saved = await readStoreJson(root, `.mason/runtime/${runtime.id}/receipt.json`);
-    if (JSON.stringify(saved) !== JSON.stringify(runtime)) return false;
-    if (runtime.bundle) {
-      const base2 = await storePath(root, `.mason/runtime/${runtime.id}`);
-      const { manifest } = await verifyBundle(base2, runtime.bundle.manifestHash);
-      if (manifest.version !== runtime.version || manifest.target !== runtime.bundle.target) return false;
-      for (const file of BINARIES) if (manifest.files["app/" + file] !== runtime.hashes[file]) return false;
-      return true;
-    }
-    const base = `.mason/runtime/${runtime.id}/node_modules/mason-context/`;
-    const pkg = await readStoreJson(root, base + "package.json");
-    if (pkg?.name !== "mason-context" || pkg.version !== runtime.version) return false;
-    for (const file of BINARIES) {
-      if (checksum(await fs17.readFile(await storePath(root, base + file))) !== runtime.hashes[file]) return false;
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function installRuntime(root, selected) {
-  const { runtime, source } = selected;
-  if (await verifyRuntime(root, runtime)) return runtime;
-  const relative = `.mason/runtime/${runtime.id}`;
-  const target = await storePath(root, relative, true);
-  const stage = await storePath(root, ".mason/runtime/.install-" + randomUUID6(), true);
-  await fs17.mkdir(stage);
-  try {
-    if (runtime.bundle) {
-      if (!selected.bundleRoot) throw new Error("Standalone bundle source is missing.");
-      const { manifest } = await verifyBundle(selected.bundleRoot, runtime.bundle.manifestHash);
-      for (const file of ["bundle.json", ...Object.keys(manifest.files)]) {
-        const from = await storePath(selected.bundleRoot, file);
-        const to = await storePath(stage, file, true);
-        await fs17.copyFile(from, to);
-        await fs17.chmod(to, (await fs17.stat(from)).mode & 511);
-      }
-      await verifyBundle(stage, runtime.bundle.manifestHash);
-    } else {
-      const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-      const options = { timeout: 12e4, maxBuffer: 2 * 1024 * 1024, windowsHide: true };
-      const packed = JSON.parse((await exec10(npm, ["pack", "--ignore-scripts", "--json", "--pack-destination", stage], { ...options, cwd: source })).stdout);
-      const filename = packed[0]?.filename;
-      if (typeof filename !== "string" || path22.basename(filename) !== filename) throw new Error("npm did not produce a Mason package archive.");
-      await fs17.rename(path22.join(stage, filename), path22.join(stage, "mason.tgz"));
-      await fs17.writeFile(path22.join(stage, "package.json"), JSON.stringify({ name: "mason-project-runtime", private: true, version: "1.0.0" }));
-      await exec10(npm, ["install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--save-exact", "./mason.tgz"], { ...options, cwd: stage });
-      for (const file of BINARIES) {
-        if (checksum(await fs17.readFile(path22.join(stage, "node_modules/mason-context", file))) !== runtime.hashes[file]) throw new Error("Installed Mason binary differs from the selected distribution.");
-      }
-    }
-    await fs17.writeFile(path22.join(stage, "receipt.json"), JSON.stringify(runtime, null, 2) + "\n");
-    try {
-      await fs17.rename(target, target + ".previous-" + randomUUID6());
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    await fs17.rename(stage, target);
-    if (!await verifyRuntime(root, runtime)) throw new Error("The installed Mason runtime could not be verified.");
-    return runtime;
-  } finally {
-    await fs17.rm(stage, { recursive: true, force: true });
-  }
-}
-var exec10, checksum, BINARIES;
-var init_runtime2 = __esm({
-  "src/setup/runtime.ts"() {
-    "use strict";
-    init_model();
-    init_storage();
-    init_evidence();
-    init_bundle();
-    exec10 = promisify10(execFile10);
-    checksum = (bytes) => createHash5("sha256").update(bytes).digest("hex");
-    BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
-  }
-});
-
 // src/setup/status.ts
 var status_exports = {};
 __export(status_exports, {
@@ -4300,34 +4251,32 @@ async function setupStatus(dir) {
     };
   }
   const hosts = {};
-  const commonLauncherCurrent = await readText(ws.root, ".mason/run.cjs") === LAUNCHER;
+  const installed = await installedCommand();
   const automation = await automationStatus(ws.root);
   for (const host of ["codex", "claude"]) {
     const entry = setup.hosts[host];
     if (!entry) continue;
-    const launcherCurrent = commonLauncherCurrent && (!entry.runtime.bundle || await readText(ws.root, ".mason/run.sh") === SHELL_LAUNCHER && await readText(ws.root, ".mason/run.ps1") === POWERSHELL_LAUNCHER && await readText(ws.root, `.mason/runtime/${host}.txt`) === entry.runtime.id + "\n");
     const instructions = await instructionEdits(ws.root, host);
     const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
-    const installed = await verifyRuntime(ws.root, entry.runtime);
-    const config = await inspectHostConfig(ws.root, host, void 0, entry.runtime);
-    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host, entry.runtime));
-    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host, entry.runtime)).hooks) && !config.disabled;
+    const config = await inspectHostConfig(ws.root, host, void 0);
+    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
+    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
-    const observation = await readObservation(ws.root, ws.directory, host, entry.revision);
+    const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
     const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
     const pending = [];
-    if (!installed || !launcherCurrent) pending.push("Install this checkout's pinned runtime by rerunning setup.");
+    if (!installed.available) pending.push(installed.message);
     if (!mcp || !hooks || !instructionsCurrent || !configured) pending.push("Rerun setup to reconcile project configuration; inspect any disabled host settings.");
     if (!observation?.contextCalls) pending.push("Start a new assistant session and request task context through Mason's get_context tool.");
     if (!complete) pending.push("Review/trust the host configuration, then complete a normal task to observe the full hook lifecycle.");
     if (automation.status === "unavailable") pending.push("The latest automation attempt did not establish verification. Run mason-auto check and inspect its diagnostics.");
-    const healthy = installed && launcherCurrent && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    const healthy = installed.available && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
     hosts[host] = {
       status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
-      runtime: installed && launcherCurrent ? "installed" : "missing-or-changed",
+      runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
       instructions: instructionsCurrent ? "current" : "changed",
       hookConfiguration: hooks ? "configured" : "disabled-or-changed",
@@ -4373,10 +4322,8 @@ var init_status = __esm({
     init_decisions();
     init_adapters();
     init_model();
-    init_runtime2();
     init_config();
     init_launcher();
-    init_files2();
     init_observations();
   }
 });
@@ -4388,7 +4335,7 @@ __export(setup_exports, {
   setupProject: () => setupProject,
   summarizeSetup: () => summarizeSetup
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 async function selectHost(root, explicit) {
   if (explicit) return explicit;
   if (process.env.MASON_SETUP_HOST === "codex" || process.env.MASON_SETUP_HOST === "claude") return process.env.MASON_SETUP_HOST;
@@ -4404,28 +4351,27 @@ async function setupProject(dir, options = {}) {
   return withLock(ws.root, ".mason/reports/setup-lock", async () => {
     const existing = await loadSetup(ws.root);
     const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
-    const marker = await loadProjectMarker(ws.root);
-    const selected = await sourceRuntime();
+    const installed = await installedCommand();
+    if (!installed.available) throw new Error(installed.message);
     const instructions = await instructionEdits(ws.root, host);
-    const mcp = await mcpEdit(ws.root, host, selected.runtime);
-    const hooks = await hookEdits(ws.root, host, selected.runtime);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
     const ancillary = await ancillaryEdits(ws.root);
     const edits = [...ancillary, ...instructions, mcp, ...hooks];
-    const setupBefore = await readText(ws.root, ".mason/setup.json");
-    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after, selected.runtime)).mcp);
-    const desiredHooks = hookConfig(host, hookCommand(host, selected.runtime)).hooks;
+    const setupBefore = await readText(ws.root, SETUP_PATH);
+    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
+    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
     const fingerprint = hash({
-      runtime: selected.runtime,
-      launcher: LAUNCHER,
+      command: "mason",
       mcp: mcpFingerprint,
       hooks: desiredHooks,
       instructions: instructions.map((edit) => edit.path)
     });
     const previous = existing?.hosts[host];
     const changed = edits.some((edit) => edit.before !== edit.after) || previous?.fingerprint !== fingerprint;
-    const revision = !changed && previous ? previous.revision : randomUUID7();
-    const setup = existing ?? { version: 1, hosts: {} };
-    setup.hosts[host] = { runtime: selected.runtime, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
+    const revision = !changed && previous ? previous.revision : randomUUID6();
+    const setup = existing ?? { version: 2, hosts: {} };
+    setup.hosts[host] = { configuredVersion: installed.version, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
     const initial = await automate(ws.root, { event: "turn_start" });
     const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
     const receiptPath = ws.directory + "/setup-" + host + ".json";
@@ -4440,20 +4386,11 @@ async function setupProject(dir, options = {}) {
       root: ws.root,
       revision
     });
-    await installRuntime(ws.root, selected);
-    if (selected.runtime.bundle) {
-      const pointer = `.mason/runtime/${host}.txt`;
-      await applyEdit(ws.root, { path: pointer, before: await readText(ws.root, pointer), after: selected.runtime.id + "\n" });
-    }
     const changedFiles = [];
     for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
-    if (await applyEdit(ws.root, { path: ".mason/setup.json", before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(".mason/setup.json");
-    if (!marker) {
-      await saveProjectMarker(ws.root, { version: 1, initializedAt: (/* @__PURE__ */ new Date()).toISOString() });
-      changedFiles.push(".mason/project.json");
-    }
+    if (await applyEdit(ws.root, { path: SETUP_PATH, before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(SETUP_PATH);
     const checked = await automate(ws.root, { event: "turn_start" });
-    const configured = await inspectHostConfig(ws.root, host, void 0, selected.runtime);
+    const configured = await inspectHostConfig(ws.root, host, void 0);
     await writeStoreJson(ws.root, receiptPath, {
       version: 1,
       host,
@@ -4470,7 +4407,7 @@ async function setupProject(dir, options = {}) {
       status: "configured",
       host,
       root: ws.root,
-      runtime: selected.runtime,
+      runtime: { kind: "global", command: "mason", version: installed.version },
       changedFiles,
       initialReportPath,
       findings,
@@ -4484,14 +4421,15 @@ function summarizeSetup(result) {
   const audit = result.findings.audit;
   return [
     `Mason configured for ${result.host}.`,
-    "  Runtime installed; MCP server and lifecycle hooks configured.",
+    "  MCP server and lifecycle hooks use mason from PATH.",
     "  Project instructions updated; original audit evidence retained.",
-    `  ${result.changedFiles.length} shared files changed.`,
+    `  ${result.changedFiles.length} files changed.`,
     `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
     ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
     `Original evidence: ${result.initialReportPath}`,
     "Activation: " + result.activation.status + ".",
     result.next,
+    "If the assistant cannot find mason, restart the desktop app so it picks up PATH.",
     "After the task finishes, run mason-auto status. Configuration alone does not establish activation."
   ].join("\n");
 }
@@ -4501,7 +4439,6 @@ var init_setup = __esm({
     init_evidence();
     init_store();
     init_runtime();
-    init_init();
     init_onboarding();
     init_storage();
     init_files2();
@@ -4509,7 +4446,6 @@ var init_setup = __esm({
     init_launcher();
     init_adapters();
     init_model();
-    init_runtime2();
     init_status();
   }
 });
@@ -4523,7 +4459,7 @@ init_store();
 import { parseArgs } from "util";
 var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options]
 
-  setup [--host claude|codex]  Install a pinned runtime, MCP, instructions and hooks; retain the initial audit
+  setup [--host claude|codex]  Connect MCP, instructions and hooks to mason on PATH; retain the initial audit
   install --host claude|codex  Merge lifecycle hooks into this project's host config
   config --host claude|codex   Print the host config without writing
   status                      Read configured hooks and observed runtime events