mason-context 0.14.1 → 0.15.0

package/dist/mason.js

@@ -262,15 +262,15 @@ function parseExecution(raw) {
 function automationFailure(error) {
   const recorded = failureSchema.safeParse(error?.failure);
   if (recorded.success) return recorded.data;
-  const message3 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
   const codes = /* @__PURE__ */ new Set();
   let cause = error;
   for (let i = 0; cause && i < 8; i++) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message3) ? "inputs-changed" : /Automation is busy/.test(message3) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message3) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message3) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message3) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
-  return { code, message: message3, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
 }
 function failureMessage(error) {
   const failure = automationFailure(error);
@@ -1105,9 +1105,133 @@ var init_deleted_reference = __esm({
   }
 });
 
-// src/audit/checks/new-module.ts
-import fg2 from "fast-glob";
+// src/audit/inputs.ts
+import fs6 from "fs/promises";
+import * as nativeFs from "fs";
 import path9 from "path";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+import fg2 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs6.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg2.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  const { stdout } = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
+    ],
+    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
+  );
+  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const operation = execute(
+    "git",
+    ["check-ignore", "-z", "--stdin"],
+    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
+  );
+  operation.child.stdin.on("error", () => {
+  });
+  operation.child.stdin.end(files.join("\0") + "\0");
+  try {
+    return new Set((await operation).stdout.split("\0").filter(Boolean));
+  } catch (error) {
+    if (error.code === 1) return /* @__PURE__ */ new Set();
+    throw error;
+  }
+}
+var execute, MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    execute = promisify6(execFile6);
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/checks/new-module.ts
+import fg3 from "fast-glob";
+import fs7 from "fs/promises";
+import path10 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1118,22 +1242,6 @@ function isMentioned(combinedDocs, name) {
   );
   return re.test(combinedDocs);
 }
-async function listSubdirs(absDir) {
-  const dirs = await fg2("*", {
-    cwd: absDir,
-    onlyDirectories: true,
-    suppressErrors: true
-  });
-  return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
-}
-async function countSourceFiles(absDir) {
-  const files = await fg2(SOURCE_GLOB, {
-    cwd: absDir,
-    ignore: SOURCE_IGNORE,
-    suppressErrors: true
-  });
-  return files.length;
-}
 async function checkNewModules(ctx) {
   const result = emptyResult();
   if (ctx.docs.length === 0) return result;
@@ -1161,21 +1269,48 @@ async function checkNewModules(ctx) {
   return result;
 }
 async function moduleCandidates(root, combinedDocs) {
+  const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const listSubdirs = async (dir) => {
+    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
+    const ignored = await gitIgnoredPaths(root, dirs);
+    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
+    return (await auditGlob(root, dir === "." ? "*" : `${fg3.escapePath(dir)}/*`, {
+      ignore,
+      onlyDirectories: true,
+      label: "Module directory discovery",
+      select: (file) => visible.has(file)
+    })).map((file) => path10.posix.basename(file));
+  };
+  const countSourceFiles = async (dir) => {
+    const files = sources.filter((file) => file.startsWith(dir + "/"));
+    let count3 = 0;
+    for (let offset = 0; offset < files.length; offset += 256) {
+      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg3.escapePath(file)), {
+        ignore,
+        followSymbolicLinks: false,
+        label: `Source discovery in ${dir}`
+      })).length;
+      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+    }
+    return count3;
+  };
   const candidates = [];
-  for (const topDir of await listSubdirs(root)) {
-    const absTop = path9.join(root, topDir);
+  for (const topDir of await listSubdirs(".")) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count3 = await countSourceFiles(absTop);
+      const count3 = await countSourceFiles(topDir);
       if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
-    const subdirs = await listSubdirs(absTop);
+    const subdirs = await listSubdirs(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count3 = await countSourceFiles(path9.join(absTop, sub));
+      const count3 = await countSourceFiles(`${topDir}/${sub}`);
       if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
         candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
@@ -1187,7 +1322,8 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
-    init_snapshot();
+    init_files();
+    init_inputs();
     init_git();
     init_checks();
     DIR_DENYLIST = /* @__PURE__ */ new Set([
@@ -1215,19 +1351,10 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import fs6 from "fs/promises";
-import path10 from "path";
-import fg3 from "fast-glob";
-async function readIfExists(absPath) {
-  try {
-    return await fs6.readFile(absPath, "utf-8");
-  } catch {
-    return null;
-  }
-}
+import path11 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
-    const content2 = await readIfExists(path10.join(root, name));
+    const content2 = await readAuditInput(root, name);
     if (content2 === null) continue;
     const members = [];
     for (const call of content2.matchAll(/include\s*\(([^)]*)\)/g)) {
@@ -1241,26 +1368,28 @@ async function countGradleModules(root) {
   return null;
 }
 async function countNpmWorkspaces(root) {
-  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
+  const pkgRaw = await readAuditInput(root, "package.json");
   if (pkgRaw !== null) {
+    let globs = [];
     try {
       const pkg = JSON.parse(pkgRaw);
-      const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
-      if (globs.length > 0) {
-        const matched = await fg3(
-          globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-          { cwd: root, ignore: ["**/node_modules/**"] }
-        );
-        return {
-          actual: matched.length,
-          countedFrom: "package.json workspaces",
-          members: matched.map((m) => path10.dirname(m)).sort()
-        };
-      }
+      globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
     } catch {
     }
+    if (globs.length > 0) {
+      const matched = await auditGlob(
+        root,
+        globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
+        { ignore: ["**/node_modules/**"], label: "npm workspace discovery" }
+      );
+      return {
+        actual: matched.length,
+        countedFrom: "package.json workspaces",
+        members: matched.map((m) => path11.dirname(m)).sort()
+      };
+    }
   }
-  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
+  const pnpmRaw = await readAuditInput(root, "pnpm-workspace.yaml");
   if (pnpmRaw !== null) {
     const globs = [];
     let inPackages = false;
@@ -1279,21 +1408,22 @@ async function countNpmWorkspaces(root) {
       }
     }
     if (globs.length > 0) {
-      const matched = await fg3(
+      const matched = await auditGlob(
+        root,
         globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
-        { cwd: root, ignore: ["**/node_modules/**"] }
+        { ignore: ["**/node_modules/**"], label: "pnpm workspace discovery" }
       );
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path10.dirname(m)).sort()
+        members: matched.map((m) => path11.dirname(m)).sort()
       };
     }
   }
   return null;
 }
 async function countCargoCrates(root) {
-  const content2 = await readIfExists(path10.join(root, "Cargo.toml"));
+  const content2 = await readAuditInput(root, "Cargo.toml");
   if (content2 === null) return null;
   const membersBlock = content2.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
@@ -1304,12 +1434,12 @@ async function countCargoCrates(root) {
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (/[*?[\]{}]/.test(entry)) {
-      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
-        cwd: root,
-        ignore: ["**/target/**"]
+      const matched = await auditGlob(root, `${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+        ignore: ["**/target/**"],
+        label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path10.dirname(m));
-    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path11.dirname(m));
+    } else if (await readAuditInput(root, path11.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1363,18 +1493,18 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     MEMBERS_CAP = 50;
   }
 });
 
 // src/audit/checks/dead-command.ts
-import fs7 from "fs/promises";
-import path11 from "path";
-import fg4 from "fast-glob";
-async function scriptsOf(absManifest) {
+async function scriptsOf(root, manifest) {
+  const raw = await readAuditInput(root, manifest);
+  if (raw === null) return null;
   try {
-    const pkg = JSON.parse(await fs7.readFile(absManifest, "utf-8"));
+    const pkg = JSON.parse(raw);
     return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
   } catch {
     return null;
@@ -1386,7 +1516,7 @@ async function checkDeadCommands(ctx) {
     (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
   );
   if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
+  const rootScripts = await scriptsOf(ctx.root, "package.json");
   if (rootScripts === null) {
     result.skipped.push({
       check: "dead-command",
@@ -1403,7 +1533,7 @@ async function checkDeadCommands(ctx) {
     const manifests = await commandManifests(ctx.root);
     manifestsChecked = ["package.json", ...manifests.sort()];
     for (const manifest of manifests) {
-      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
+      const scripts = await scriptsOf(ctx.root, manifest);
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -1429,23 +1559,24 @@ async function checkDeadCommands(ctx) {
   return result;
 }
 function commandManifests(root) {
-  return fg4("**/package.json", {
-    cwd: root,
-    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"]
+  return auditGlob(root, "**/package.json", {
+    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"],
+    label: "Command manifest discovery"
   });
 }
 var AVAILABLE_SCRIPTS_CAP;
 var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
+    init_inputs();
     init_checks();
     AVAILABLE_SCRIPTS_CAP = 30;
   }
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
 async function git(root, args2) {
   return (await exec6("git", args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
@@ -1497,7 +1628,7 @@ var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify6(execFile6);
+    exec6 = promisify7(execFile7);
   }
 });
 
@@ -1736,7 +1867,7 @@ var init_provenance = __esm({
       sources: z3.array(decisionSourceSchema).max(20),
       history: z3.array(eventSchema).min(1)
     }).superRefine((record, ctx) => {
-      const invalid = (message3) => ctx.addIssue({ code: "custom", message: message3 });
+      const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
       let previous;
       for (const event of record.history) {
@@ -2262,9 +2393,9 @@ __export(evidence_exports, {
 import fs11 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
-import fg5 from "fast-glob";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+import fg4 from "fast-glob";
 import { z as z5 } from "zod";
 async function git2(root, ...args2) {
   return (await exec7("git", args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
@@ -2280,34 +2411,13 @@ async function workspace(dir) {
   }
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
-async function content(root, file) {
-  try {
-    const value = await readBoundedFile(await storePath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error("Unreadable or oversized audit input: " + file);
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
 async function readInputs(root) {
-  const [headText, docStatus, inventory, shallowPath, replacements] = await Promise.all([
+  const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git2(root, "rev-parse", "HEAD"),
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
-    fg5("**/*", {
-      cwd: root,
-      dot: true,
-      onlyFiles: false,
-      followSymbolicLinks: false,
-      objectMode: true,
-      ignore: SOURCE_IGNORE
-    }),
     git2(root, "rev-parse", "--git-path", "shallow"),
     git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
-  const entries = inventory.filter((f) => !internal(f.path) && f.path !== ".git").sort((a, b) => a.path.localeCompare(b.path));
-  const files = entries.map((f) => f.path);
-  if (files.length > 1e5) throw new Error("Automation input inventory exceeds 100,000 paths; use an explicit scoped audit.");
   const head = headText.trim();
   let shallow = null;
   try {
@@ -2328,9 +2438,19 @@ async function readInputs(root) {
       claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
     }
   }
-  if (entries.some((f) => f.dirent.isSymbolicLink())) throw new Error("Automation inventory contains a symbolic link; use an explicit audit to inspect its scope. No cached verification was recorded.");
   const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
   const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
+  const commandClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).commands : []);
+  const rootPackage = await content(root, "package.json");
+  let rootScripts = null;
+  if (rootPackage !== null) {
+    try {
+      const pkg = JSON.parse(rootPackage);
+      rootScripts = pkg?.scripts && typeof pkg.scripts === "object" ? Object.keys(pkg.scripts) : [];
+    } catch {
+    }
+  }
+  const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -2339,16 +2459,19 @@ async function readInputs(root) {
   const [modules, counts, manifests, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
-    commandManifests(root),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    needsWorkspaceScripts ? commandManifests(root) : [],
+    fg4(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
-  const packages = await Promise.all(["package.json", ...manifests.sort()].map(async (file) => [file, await content(root, file)]));
-  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => [file, await content(root, file)]));
+  const packages = [["package.json", rootPackage], ...await Promise.all(manifests.sort().map(async (file) => [file, await content(root, file)]))];
+  const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
+    await storePath(root, file);
+    return [file, await content(root, file)];
+  }));
   const [status, index2] = decisions.length ? await Promise.all([
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [2, engineVersion, head, shallow, replacements, docContents];
+  const common = [3, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -2384,7 +2507,7 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
-var exec7, engineVersion, hash, internal, cacheSchema;
+var exec7, engineVersion, hash, content, internal, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
@@ -2392,14 +2515,15 @@ var init_evidence = __esm({
     init_claims();
     init_repair();
     init_checks();
-    init_files();
+    init_inputs();
     init_new_module();
     init_stale_count();
     init_dead_command();
     init_storage();
-    exec7 = promisify7(execFile7);
-    engineVersion = true ? "0.14.1" : "development";
+    exec7 = promisify8(execFile8);
+    engineVersion = true ? "0.15.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+    content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
     cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
   }
@@ -2728,7 +2852,7 @@ var init_runtime = __esm({
 // src/setup/model.ts
 import { z as z7 } from "zod";
 async function loadSetup(root) {
-  const raw = await readStoreJson(root, ".mason/setup.json");
+  const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
@@ -2739,28 +2863,23 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var runtimeSchema, setupHostSchema, setupSchema, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
     init_storage();
-    runtimeSchema = z7.object({
-      id: z7.string().regex(/^[a-f0-9]{24}$/),
-      version: z7.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      hashes: z7.record(z7.string().regex(/^[a-f0-9]{64}$/)),
-      bundle: z7.object({ target: z7.string(), manifestHash: z7.string().regex(/^[a-f0-9]{64}$/) }).optional()
-    });
     setupHostSchema = z7.object({
-      runtime: runtimeSchema,
+      configuredVersion: z7.string(),
       revision: z7.string().uuid(),
       fingerprint: z7.string(),
       mcpFingerprint: z7.string(),
       instructions: z7.array(z7.string())
     });
-    setupSchema = z7.object({ version: z7.literal(1), hosts: z7.object({
+    setupSchema = z7.object({ version: z7.literal(2), hosts: z7.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
+    SETUP_PATH = ".mason/local/setup.json";
     receiptSchema = z7.object({
       version: z7.literal(1),
       host: z7.enum(["codex", "claude"]),
@@ -2774,6 +2893,56 @@ var init_model = __esm({
   }
 });
 
+// src/setup/launcher.ts
+var launcher_exports = {};
+__export(launcher_exports, {
+  executingVersion: () => executingVersion,
+  globalCommand: () => globalCommand,
+  hookCommand: () => hookCommand,
+  installedCommand: () => installedCommand,
+  mcpCommand: () => mcpCommand,
+  prepareLaunch: () => prepareLaunch
+});
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+function globalCommand(args2, platform = process.platform) {
+  return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
+}
+async function installedCommand() {
+  const invocation = globalCommand(["internal-integration-version"]);
+  try {
+    const { stdout } = await promisify9(execFile9)(
+      invocation.command,
+      invocation.args,
+      { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
+    );
+    const result = JSON.parse(stdout);
+    if (result.protocol !== 1 || typeof result.version !== "string") throw new Error("Unsupported Mason integration protocol.");
+    return { available: true, version: result.version, message: null };
+  } catch {
+    return { available: false, version: null, message: "An up-to-date mason command is not available on this process's PATH. Install or upgrade Mason, then reopen your terminal or desktop assistant and rerun mason setup." };
+  }
+}
+async function prepareLaunch(host) {
+  const ws = await workspace(process.cwd());
+  const entry = (await loadSetup(ws.root))?.hosts[host];
+  if (!entry) throw new Error(`Mason is not configured locally for ${host}. Run mason setup --host ${host} in this checkout.`);
+  process.env.MASON_SETUP_ROOT = ws.root;
+  process.env.MASON_SETUP_HOST = host;
+  process.env.MASON_SETUP_REVISION = entry.revision;
+}
+var executingVersion, mcpCommand, hookCommand;
+var init_launcher = __esm({
+  "src/setup/launcher.ts"() {
+    "use strict";
+    init_evidence();
+    init_model();
+    executingVersion = () => true ? "0.15.0" : "development";
+    mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
+    hookCommand = (host) => `mason --setup-host ${host} auto`;
+  }
+});
+
 // src/setup/observations.ts
 var observations_exports = {};
 __export(observations_exports, {
@@ -2783,14 +2952,14 @@ __export(observations_exports, {
 });
 import fs13 from "fs/promises";
 import { z as z8 } from "zod";
-function observationPath(directory, host, revision) {
-  return `${directory}/activation/${host}-${revision}.json`;
+function observationPath(directory, host, revision, version = executingVersion()) {
+  return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
-async function readObservation(root, directory, host, revision) {
-  const raw = await readStoreJson(root, observationPath(directory, host, revision));
+async function readObservation(root, directory, host, revision, version = executingVersion()) {
+  const raw = await readStoreJson(root, observationPath(directory, host, revision, version));
   if (raw === null) return null;
   const record = observationSchema.parse(raw);
-  if (record.root !== root || record.host !== host || record.revision !== revision) throw new Error("Activation receipt belongs to another installation.");
+  if (record.root !== root || record.host !== host || record.revision !== revision || record.masonVersion !== version) throw new Error("Activation receipt belongs to another installation.");
   return record;
 }
 async function observeActivation(dir, event, options = {}) {
@@ -2807,6 +2976,7 @@ async function observeActivation(dir, event, options = {}) {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const record = await readObservation(ws.root, ws.directory, host, revision) ?? {
         version: 1,
+        masonVersion: executingVersion(),
         root: ws.root,
         revision,
         host,
@@ -2845,8 +3015,10 @@ var init_observations = __esm({
     init_store();
     init_storage();
     init_model();
+    init_launcher();
     observationSchema = z8.object({
       version: z8.literal(1),
+      masonVersion: z8.string(),
       root: z8.string(),
       revision: z8.string(),
       host: z8.enum(["codex", "claude"]),
@@ -2897,8 +3069,8 @@ async function runAutomationHook(host, stdin) {
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message3 = failureMessage(error);
-    return { systemMessage: message3, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message3 } } : {} };
+    const message2 = failureMessage(error);
+    return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
   }
 }
 function hookConfig(host, command2 = "npx --no-install --package mason-context mason-auto") {
@@ -2936,106 +3108,78 @@ var init_adapters = __esm({
   }
 });
 
-// src/automation/install.ts
-var install_exports = {};
-__export(install_exports, {
-  automationConfigSchema: () => automationConfigSchema,
-  configPath: () => configPath,
-  installAutomation: () => installAutomation,
-  installedAutomation: () => installedAutomation,
-  planAutomationInstall: () => planAutomationInstall
+// src/setup/files.ts
+var files_exports = {};
+__export(files_exports, {
+  applyEdit: () => applyEdit,
+  managedBlock: () => managedBlock,
+  readText: () => readText
 });
-import { z as z10 } from "zod";
-async function installAutomation(dir, host, command2) {
-  const ws = await workspace(dir);
-  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command2));
-}
-async function planAutomationInstall(root, host, command2) {
-  const file = configPath(host);
-  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
-  const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
-  const desired = hookConfig(host, command2);
-  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
-  const previous = record.hosts[host]?.command;
-  const hooks = existing.hooks ?? {};
-  for (const event of HOOK_EVENTS) {
-    hooks[event] = (hooks[event] ?? []).map((group) => ({
-      ...group,
-      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && (handler.command === previous || handler.command === newCommand)))
-    })).filter((group) => group.hooks.length);
-    hooks[event].push(...desired.hooks[event]);
+import fs14 from "fs/promises";
+import path18 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+async function readText(root, file) {
+  try {
+    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
+    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
+    return text2;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
   }
-  record.hosts[host] = { command: newCommand };
-  return { file, config: { ...existing, hooks }, record, newCommand };
 }
-async function installLocked(root, host, command2) {
-  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command2);
-  await writeStoreJson(root, file, config);
-  await writeStoreJson(root, ".mason/automation.json", record);
-  return {
-    version: 1,
-    host,
-    configPath: file,
-    status: "configured",
-    command: newCommand,
-    events: HOOK_EVENTS,
-    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
-    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
-  };
+function managedBlock(text2, start, end, body) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
+    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
+  }
+  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
+  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
+  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
+  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
 }
-async function installedAutomation(dir) {
-  const ws = await workspace(dir);
-  const raw = await readStoreJson(ws.root, ".mason/automation.json");
-  if (raw === null) return {};
-  const record = recordSchema.parse(raw);
-  const result = {};
-  for (const host of ["claude", "codex"]) {
-    const expected = record.hosts[host];
-    if (!expected) continue;
-    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
-    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
-    result[host] = {
-      configPath: configPath(host),
-      configuredEvents,
-      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
-      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
-    };
+async function applyEdit(root, edit) {
+  const current = await readText(root, edit.path);
+  if (current === edit.after) return false;
+  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
+  const file = await storePath(root, edit.path, true);
+  const temporary = path18.join(path18.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  try {
+    const mode = await fs14.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs14.open(temporary, "wx", mode);
+    try {
+      await handle.writeFile(edit.after, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
+    await fs14.rename(temporary, file);
+    return true;
+  } finally {
+    await fs14.rm(temporary, { force: true });
   }
-  return result;
 }
-var groupSchema, automationConfigSchema, recordSchema, configPath;
-var init_install = __esm({
-  "src/automation/install.ts"() {
+var init_files2 = __esm({
+  "src/setup/files.ts"() {
     "use strict";
+    init_files();
     init_storage();
-    init_evidence();
-    init_adapters();
-    init_store();
-    groupSchema = z10.object({ hooks: z10.array(z10.object({ type: z10.string(), command: z10.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z10.object({ hooks: z10.record(z10.array(groupSchema)).optional() }).passthrough();
-    recordSchema = z10.object({ version: z10.literal(1), hosts: z10.record(z10.object({ command: z10.string() })) });
-    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
 });
 
 // src/mcp/init.ts
-import { z as z11 } from "zod";
-async function loadProjectMarker(rootDir) {
-  const raw = await readStoreJson(rootDir, ".mason/project.json");
-  return raw === null ? null : markerSchema.parse(raw);
-}
-async function saveProjectMarker(rootDir, marker) {
-  await writeStoreJson(rootDir, ".mason/project.json", markerSchema.parse(marker));
-}
+import { z as z10 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
-    markerSchema = z11.object({
-      version: z11.literal(1),
-      initializedAt: z11.string(),
-      features: z11.object({ confluence: z11.boolean().optional() }).optional()
+    init_files2();
+    markerSchema = z10.object({
+      version: z10.literal(1),
+      initializedAt: z10.string(),
+      features: z10.object({ confluence: z10.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -3057,7 +3201,7 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 Inspect source for what the retrieved context does not answer.
 <!-- mason:end -->`;
     ASSISTANT_SETUP = `UNIFIED SETUP
-When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, install a pinned private runtime, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, use the installed mason command on PATH, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
 If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason-auto status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
 
 The managed project guidance is:
@@ -3065,7 +3209,7 @@ ${CLAUDE_MD_SECTION}`;
     QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
-2. Address findings within the user's requested scope. Setup alone authorizes the Mason runtime, host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
 3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
@@ -3107,34 +3251,283 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
   }
 });
 
-// src/review/cochange.ts
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
-async function buildMatrix(resolvedRoot) {
+// src/utils/git.ts
+var git_exports = {};
+__export(git_exports, {
+  isGitRepo: () => isGitRepo
+});
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+async function isGitRepo(dir) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
-    if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
-      "git",
-      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
-      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
-    );
-    const commitsByFile = /* @__PURE__ */ new Map();
-    const blocks = stdout.split("
");
-    let index2 = 0;
-    for (const block of blocks) {
-      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
-      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
-      for (const file of files) {
-        let set = commitsByFile.get(file);
-        if (!set) {
-          set = /* @__PURE__ */ new Set();
-          commitsByFile.set(file, set);
-        }
-        set.add(index2);
-      }
-      index2++;
-    }
+    await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var exec8;
+var init_git2 = __esm({
+  "src/utils/git.ts"() {
+    "use strict";
+    exec8 = promisify10(execFile10);
+  }
+});
+
+// src/setup/config.ts
+var config_exports = {};
+__export(config_exports, {
+  ancillaryEdits: () => ancillaryEdits,
+  hookEdits: () => hookEdits,
+  inspectHostConfig: () => inspectHostConfig,
+  instructionEdits: () => instructionEdits,
+  mcpEdit: () => mcpEdit,
+  mcpPath: () => mcpPath
+});
+import { isDeepStrictEqual } from "util";
+import { parse, stringify } from "smol-toml";
+import { z as z11 } from "zod";
+async function instructionEdits(root, host) {
+  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
+  const existing = found.find((f) => f.text !== null);
+  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
+  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
+  const edits = [{
+    path: primary.path,
+    before: primary.text,
+    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
+  }];
+  if (primary.path === "AGENTS.md") {
+    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
+    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
+    for (const file of secondary) {
+      const text2 = file.text ?? "";
+      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
+      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      if (text2.trim() === imported) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
+      edits.push({
+        path: file.path,
+        before: file.text,
+        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
+      });
+    }
+  }
+  return edits;
+}
+function managedMcp(previous, host) {
+  const options = previous === void 0 ? {} : object.parse(previous);
+  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
+  return { ...options, ...mcpCommand(host) };
+}
+async function mcpEdit(root, host) {
+  const file = mcpPath(host), before = await readText(root, file);
+  if (host === "claude") {
+    const config2 = before === null ? {} : object.parse(JSON.parse(before));
+    const servers2 = object.parse(config2.mcpServers ?? {});
+    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host) } }, null, 2) + "\n" };
+  }
+  const config = parse(before ?? "");
+  const managed = (before ?? "").includes(TOML_START);
+  const servers = config.mcp_servers;
+  const desired = managedMcp(servers?.mason, host);
+  let base = before ?? "";
+  if (servers?.mason && !managed) {
+    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
+    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
+    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
+    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
+  }
+  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
+  const parsed = parse(after);
+  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
+  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
+  return { path: file, before, after };
+}
+async function hookEdits(root, host) {
+  const file = configPath(host), before = await readText(root, file);
+  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  const plan = await planAutomationInstall2(root, host, hookCommand(host));
+  return [
+    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
+    { path: AUTOMATION_PATH, before: await readText(root, AUTOMATION_PATH), after: JSON.stringify(plan.record, null, 2) + "\n" }
+  ];
+}
+async function ancillaryEdits(root) {
+  const ignore = await readText(root, ".gitignore");
+  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
+  let parentIgnored = false;
+  try {
+    if (await isGitRepo2(root)) parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+  } catch (error) {
+    if (error.code !== 1) throw error;
+  }
+  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
+  const rules = [
+    ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
+    "!/.mason/decisions/",
+    "!/.mason/decisions/**",
+    "!/.mason/config.json",
+    "!/.mason/snapshot.json",
+    "/.mason/local/",
+    "/.mason/reports/"
+  ].join("\n");
+  return [{ path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) }];
+}
+async function inspectHostConfig(root, host, plannedMcp) {
+  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
+  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
+  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
+  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
+  const expected = hookConfig(host, hookCommand(host));
+  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
+  return {
+    mcp,
+    mcpDisabled: mcp?.enabled === false,
+    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
+      event,
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+    ])),
+    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
+  };
+}
+var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
+var init_config = __esm({
+  "src/setup/config.ts"() {
+    "use strict";
+    init_init();
+    init_docs();
+    init_adapters();
+    init_install();
+    init_files2();
+    init_launcher();
+    object = z11.record(z11.unknown());
+    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
+    TOML_START = "# mason:mcp:start";
+    TOML_END = "# mason:mcp:end";
+    POINTER_START = "<!-- mason:agents:start -->";
+    POINTER_END = "<!-- mason:agents:end -->";
+  }
+});
+
+// src/automation/install.ts
+var install_exports = {};
+__export(install_exports, {
+  AUTOMATION_PATH: () => AUTOMATION_PATH,
+  automationConfigSchema: () => automationConfigSchema,
+  configPath: () => configPath,
+  installAutomation: () => installAutomation,
+  installedAutomation: () => installedAutomation,
+  planAutomationInstall: () => planAutomationInstall
+});
+import { z as z12 } from "zod";
+async function installationRecord(root) {
+  return recordSchema.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
+}
+async function installAutomation(dir, host, command2) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command2));
+}
+async function planAutomationInstall(root, host, command2) {
+  const file = configPath(host);
+  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
+  const record = await installationRecord(root);
+  const desired = hookConfig(host, command2);
+  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
+  const previous = record.hosts[host]?.command;
+  const owned = /* @__PURE__ */ new Set([previous, newCommand]);
+  const hooks = existing.hooks ?? {};
+  for (const event of HOOK_EVENTS) {
+    hooks[event] = (hooks[event] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && owned.has(handler.command)))
+    })).filter((group) => group.hooks.length);
+    hooks[event].push(...desired.hooks[event]);
+  }
+  record.hosts[host] = { command: newCommand };
+  return { file, config: { ...existing, hooks }, record, newCommand };
+}
+async function installLocked(root, host, command2) {
+  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command2);
+  const { ancillaryEdits: ancillaryEdits2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  const { applyEdit: applyEdit2 } = await Promise.resolve().then(() => (init_files2(), files_exports));
+  for (const edit of await ancillaryEdits2(root)) await applyEdit2(root, edit);
+  await writeStoreJson(root, file, config);
+  await writeStoreJson(root, AUTOMATION_PATH, record);
+  return {
+    version: 1,
+    host,
+    configPath: file,
+    status: "configured",
+    command: newCommand,
+    events: HOOK_EVENTS,
+    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
+    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
+  };
+}
+async function installedAutomation(dir) {
+  const ws = await workspace(dir);
+  const record = await installationRecord(ws.root);
+  const result = {};
+  for (const host of ["claude", "codex"]) {
+    const expected = record.hosts[host];
+    if (!expected) continue;
+    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
+    result[host] = {
+      configPath: configPath(host),
+      configuredEvents,
+      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
+      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+    };
+  }
+  return result;
+}
+var groupSchema, automationConfigSchema, recordSchema, AUTOMATION_PATH, configPath;
+var init_install = __esm({
+  "src/automation/install.ts"() {
+    "use strict";
+    init_storage();
+    init_evidence();
+    init_adapters();
+    init_store();
+    groupSchema = z12.object({ hooks: z12.array(z12.object({ type: z12.string(), command: z12.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z12.object({ hooks: z12.record(z12.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z12.object({ version: z12.literal(1), hosts: z12.record(z12.object({ command: z12.string() })) });
+    AUTOMATION_PATH = ".mason/local/automation.json";
+    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+  }
+});
+
+// src/review/cochange.ts
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
+async function buildMatrix(resolvedRoot) {
+  try {
+    const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    if (shallow.trim() === "true") return null;
+    const { stdout } = await exec9(
+      "git",
+      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
+      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
+    );
+    const commitsByFile = /* @__PURE__ */ new Map();
+    const blocks = stdout.split("
");
+    let index2 = 0;
+    for (const block of blocks) {
+      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
+      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
+      for (const file of files) {
+        let set = commitsByFile.get(file);
+        if (!set) {
+          set = /* @__PURE__ */ new Set();
+          commitsByFile.set(file, set);
+        }
+        set.add(index2);
+      }
+      index2++;
+    }
     return { commitsByFile, totalCommits: index2 };
   } catch {
     return null;
@@ -3170,11 +3563,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify8(execFile8);
+    exec9 = promisify11(execFile11);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3217,8 +3610,8 @@ var init_paths2 = __esm({
 });
 
 // src/review/evidence/types.ts
-function messagePreview(message3) {
-  return { message: message3.slice(0, 4e3), ...message3.length > 4e3 ? { truncated: true } : {} };
+function messagePreview(message2) {
+  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
 }
 var MAX_FINDINGS;
 var init_types2 = __esm({
@@ -3229,7 +3622,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -3278,24 +3671,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count2 = z12.number().int().nonnegative();
-    schema = z12.object({
-      success: z12.boolean(),
+    count2 = z13.number().int().nonnegative();
+    schema = z13.object({
+      success: z13.boolean(),
       numTotalTests: count2,
       numPassedTests: count2,
       numFailedTests: count2,
       numPendingTests: count2,
       numTodoTests: count2,
       numFailedTestSuites: count2,
-      testResults: z12.array(z12.object({
-        name: z12.string().min(1),
-        status: z12.enum(["passed", "failed"]),
-        message: z12.string().optional(),
-        assertionResults: z12.array(z12.object({
-          fullName: z12.string(),
-          status: z12.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z12.array(z12.string()).nullable().optional(),
-          location: z12.object({ line: count2, column: count2 }).nullable().optional()
+      testResults: z13.array(z13.object({
+        name: z13.string().min(1),
+        status: z13.enum(["passed", "failed"]),
+        message: z13.string().optional(),
+        assertionResults: z13.array(z13.object({
+          fullName: z13.string(),
+          status: z13.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z13.array(z13.string()).nullable().optional(),
+          location: z13.object({ line: count2, column: count2 }).nullable().optional()
         }))
       }))
     });
@@ -3303,7 +3696,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -3394,29 +3787,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z13.number().int().nonnegative();
-    artifact = z13.object({ uri: z13.string().optional(), uriBaseId: z13.string().optional(), index: index.optional() });
-    message = z13.object({ text: z13.string().optional(), markdown: z13.string().optional(), id: z13.string().optional(), arguments: z13.array(z13.string()).optional() });
-    level = z13.enum(["error", "warning", "note", "none"]);
-    location = z13.object({ physicalLocation: z13.object({ artifactLocation: artifact.optional(), region: z13.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z13.object({
-      version: z13.literal("2.1.0"),
-      runs: z13.array(z13.object({
-        tool: z13.object({ driver: z13.object({ name: z13.string().min(1), rules: z13.array(z13.object({ id: z13.string(), defaultConfiguration: z13.object({ level: level.optional() }).optional(), messageStrings: z13.record(message).optional() })).optional(), globalMessageStrings: z13.record(message).optional() }) }),
-        invocations: z13.array(z13.object({ executionSuccessful: z13.boolean(), commandLine: z13.string().optional(), toolExecutionNotifications: z13.array(z13.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z13.array(z13.object({ revisionId: z13.string().optional() })).optional(),
-        originalUriBaseIds: z13.record(artifact).optional(),
-        artifacts: z13.array(z13.object({ location: artifact.optional() })).optional(),
-        results: z13.array(z13.object({
-          ruleId: z13.string().optional(),
+    index = z14.number().int().nonnegative();
+    artifact = z14.object({ uri: z14.string().optional(), uriBaseId: z14.string().optional(), index: index.optional() });
+    message = z14.object({ text: z14.string().optional(), markdown: z14.string().optional(), id: z14.string().optional(), arguments: z14.array(z14.string()).optional() });
+    level = z14.enum(["error", "warning", "note", "none"]);
+    location = z14.object({ physicalLocation: z14.object({ artifactLocation: artifact.optional(), region: z14.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z14.object({
+      version: z14.literal("2.1.0"),
+      runs: z14.array(z14.object({
+        tool: z14.object({ driver: z14.object({ name: z14.string().min(1), rules: z14.array(z14.object({ id: z14.string(), defaultConfiguration: z14.object({ level: level.optional() }).optional(), messageStrings: z14.record(message).optional() })).optional(), globalMessageStrings: z14.record(message).optional() }) }),
+        invocations: z14.array(z14.object({ executionSuccessful: z14.boolean(), commandLine: z14.string().optional(), toolExecutionNotifications: z14.array(z14.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z14.array(z14.object({ revisionId: z14.string().optional() })).optional(),
+        originalUriBaseIds: z14.record(artifact).optional(),
+        artifacts: z14.array(z14.object({ location: artifact.optional() })).optional(),
+        results: z14.array(z14.object({
+          ruleId: z14.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z13.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z13.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z13.array(z13.object({ kind: z13.enum(["inSource", "external"]), status: z13.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z13.array(location).optional(),
-          relatedLocations: z13.array(location).optional()
+          kind: z14.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z14.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z14.array(z14.object({ kind: z14.enum(["inSource", "external"]), status: z14.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z14.array(location).optional(),
+          relatedLocations: z14.array(location).optional()
         })).optional()
       }))
     });
@@ -3424,10 +3817,10 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence.ts
-import path18 from "path";
-import { z as z14 } from "zod";
+import path19 from "path";
+import { z as z15 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path18.isAbsolute(file) ? path18.relative(root, file) : file;
+  const relative = path19.isAbsolute(file) ? path19.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -3466,7 +3859,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z14.object({ version: z14.literal(1), checks: z14.array(z14.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z15.object({ version: z15.literal(1), checks: z15.array(z15.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -3523,7 +3916,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path18.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path19.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -3619,31 +4012,31 @@ var init_evidence2 = __esm({
     init_vitest();
     init_sarif();
     init_types2();
-    checkSchema2 = z14.object({
-      id: z14.string().min(1).max(100),
-      kind: z14.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
-      tool: z14.string().min(1).max(200),
-      command: z14.string().min(1).max(2e3),
-      commit: z14.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z14.boolean().optional(),
-      source: z14.string().max(2e3).optional(),
-      sourceRoot: z14.string().min(1).max(4e3).optional(),
-      status: z14.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z14.string().min(1).max(2e3).optional(),
-      exitCode: z14.number().int().nullable().optional(),
-      report: z14.object({ format: z14.enum(["vitest-json", "sarif"]), path: z14.string().min(1).max(4e3) }).optional()
+    checkSchema2 = z15.object({
+      id: z15.string().min(1).max(100),
+      kind: z15.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z15.string().min(1).max(200),
+      command: z15.string().min(1).max(2e3),
+      commit: z15.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z15.boolean().optional(),
+      source: z15.string().max(2e3).optional(),
+      sourceRoot: z15.string().min(1).max(4e3).optional(),
+      status: z15.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z15.string().min(1).max(2e3).optional(),
+      exitCode: z15.number().int().nullable().optional(),
+      report: z15.object({ format: z15.enum(["vitest-json", "sarif"]), path: z15.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
-import fs14 from "fs/promises";
-import path19 from "path";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
+import fs15 from "fs/promises";
+import path20 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec10("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -3654,7 +4047,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec10("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -3667,7 +4060,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -3717,7 +4110,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs14.access(path19.join(resolvedRoot, relPath));
+        await fs15.access(path20.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -3750,7 +4143,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec9, MAX_ANALYZED_FILES;
+var exec10, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -3762,7 +4155,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify9(execFile9);
+    exec10 = promisify12(execFile12);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -3851,437 +4244,6 @@ var init_onboarding = __esm({
   }
 });
 
-// src/setup/files.ts
-import fs15 from "fs/promises";
-import path20 from "path";
-import { randomUUID as randomUUID5 } from "crypto";
-async function readText(root, file) {
-  try {
-    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
-    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
-    return text2;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function managedBlock(text2, start, end, body) {
-  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
-  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
-    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
-  }
-  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
-  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
-  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
-  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
-}
-async function applyEdit(root, edit) {
-  const current = await readText(root, edit.path);
-  if (current === edit.after) return false;
-  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
-  const file = await storePath(root, edit.path, true);
-  const temporary = path20.join(path20.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
-  try {
-    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs15.open(temporary, "wx", mode);
-    try {
-      await handle.writeFile(edit.after, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
-    await fs15.rename(temporary, file);
-    return true;
-  } finally {
-    await fs15.rm(temporary, { force: true });
-  }
-}
-var init_files2 = __esm({
-  "src/setup/files.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-  }
-});
-
-// src/setup/launcher.ts
-var BOOTSTRAP, POWERSHELL_BOOTSTRAP, mcpCommand, hookCommand, SHELL_LAUNCHER, POWERSHELL_LAUNCHER, LAUNCHER;
-var init_launcher = __esm({
-  "src/setup/launcher.ts"() {
-    "use strict";
-    BOOTSTRAP = "require(require('node:path').join(require('node:child_process').execFileSync('git',['rev-parse','--show-toplevel'],{encoding:'utf8'}).trim(),'.mason','run.cjs'))";
-    POWERSHELL_BOOTSTRAP = "& (Join-Path (git rev-parse --show-toplevel) '.mason/run.ps1')";
-    mcpCommand = (host, runtime) => !runtime?.bundle ? { command: "node", args: ["-e", BOOTSTRAP, "--", host, "mcp"] } : process.platform === "win32" ? { command: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", POWERSHELL_BOOTSTRAP, host, "mcp"] } : { command: "sh", args: ["-c", 'exec sh "$(git rev-parse --show-toplevel)/.mason/run.sh" "$@"', "mason", host, "mcp"] };
-    hookCommand = (host, runtime) => !runtime?.bundle ? `node -e "${BOOTSTRAP}" -- ${host} auto` : process.platform === "win32" ? `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "${POWERSHELL_BOOTSTRAP} ${host} auto"` : `sh "$(git rev-parse --show-toplevel)/.mason/run.sh" ${host} auto`;
-    SHELL_LAUNCHER = `#!/bin/sh
-set -eu
-advisory=0
-if [ "\${2-}" = auto ] && [ "\${3-}" = hook ]; then advisory=1; fi
-fail() {
-  if [ "$advisory" -eq 1 ]; then printf '%s\\n' '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0; fi
-  echo 'Mason runtime unavailable. Rerun mason setup for this checkout.' >&2; exit 2
-}
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) || fail
-case "\${1-}" in codex|claude) ;; *) fail ;; esac
-pointer="$root/.mason/runtime/$1.txt"
-[ -f "$pointer" ] || fail
-runtime=$(cat "$pointer") || fail
-case "$runtime" in ''|*[!0-9a-f]*) fail ;; esac
-[ "\${#runtime}" -eq 24 ] || fail
-[ -x "$root/.mason/runtime/$runtime/node" ] || fail
-if [ "$advisory" -eq 1 ]; then
-  "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@" || fail
-else
-  exec "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@"
-fi
-`;
-    POWERSHELL_LAUNCHER = `# Managed by mason setup; no system Node installation is used.
-$ErrorActionPreference = 'Stop'
-$advisory = $args.Count -ge 3 -and $args[1] -eq 'auto' -and $args[2] -eq 'hook'
-try {
-  if ($args.Count -lt 2 -or $args[0] -notin @('codex','claude')) { throw 'Invalid Mason host.' }
-  $runtime = (Get-Content -LiteralPath (Join-Path $PSScriptRoot ('runtime/' + $args[0] + '.txt')) -Raw).Trim()
-  if ($runtime -cnotmatch '^[a-f0-9]{24}$') { throw 'Invalid Mason runtime pointer.' }
-  & (Join-Path $PSScriptRoot ('runtime/' + $runtime + '/node.exe')) (Join-Path $PSScriptRoot 'run.cjs') @args
-  if ($LASTEXITCODE -ne 0) { throw 'Mason runtime failed.' }
-} catch {
-  if ($advisory) { Write-Output '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0 }
-  [Console]::Error.WriteLine($_.Exception.Message); exit 2
-}
-`;
-    LAUNCHER = `// Managed by mason-auto setup. Rerun setup to install this checkout's pinned runtime.
-const fs = require('node:fs');
-const path = require('node:path');
-const {pathToFileURL} = require('node:url');
-const launchArgs = process.argv.slice(process.argv[1] && path.resolve(process.argv[1]) === __filename ? 2 : 1);
-(async () => {
-  const root = path.dirname(__dirname);
-  const args = launchArgs;
-  const [host, command, ...rest] = args;
-  if (!['codex','claude'].includes(host) || !['auto','mcp'].includes(command)) throw new Error('Invalid Mason launcher arguments.');
-  const setup = JSON.parse(fs.readFileSync(path.join(__dirname, 'setup.json'), 'utf8'));
-  const entry = setup.hosts?.[host];
-  if (setup.version !== 1 || !entry || !/^[a-f0-9]{24}$/.test(entry.runtime?.id)) throw new Error('Mason is not configured for this host. Rerun mason-auto setup.');
-  const base = path.join(__dirname, 'runtime', entry.runtime.id);
-  if (entry.runtime.bundle) {
-    const node = process.platform === 'win32' ? 'node.exe' : 'node';
-    if (fs.realpathSync(process.execPath) !== fs.realpathSync(path.join(base, node))) throw new Error('Mason runtime pointer differs from the configured version. Rerun setup.');
-  }
-  const binary = entry.runtime.bundle ? path.join(base, 'app', 'dist', 'mason-' + command + '.js')
-    : path.join(base, 'node_modules', 'mason-context', 'dist', 'mason-' + command + '.js');
-  if (!fs.existsSync(binary)) throw new Error('The pinned Mason runtime is missing in this checkout. Rerun mason-auto setup --host ' + host + '.');
-  process.env.MASON_SETUP_ROOT = root;
-  process.env.MASON_SETUP_HOST = host;
-  process.env.MASON_SETUP_REVISION = entry.revision;
-  process.argv = [process.execPath, binary, ...rest];
-  await import(pathToFileURL(binary).href);
-})().catch(error => {
-  const message = 'Mason setup unavailable: ' + error.message;
-  if (launchArgs[1] === 'auto' && launchArgs[2] === 'hook') { console.log(JSON.stringify({systemMessage: message})); process.exitCode = 0; }
-  else { console.error(message); process.exitCode = 2; }
-});
-`;
-  }
-});
-
-// src/setup/config.ts
-import { isDeepStrictEqual } from "util";
-import { parse, stringify } from "smol-toml";
-import { z as z15 } from "zod";
-async function instructionEdits(root, host) {
-  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
-  const existing = found.find((f) => f.text !== null);
-  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
-  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
-  const edits = [{
-    path: primary.path,
-    before: primary.text,
-    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
-  }];
-  if (primary.path === "AGENTS.md") {
-    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
-    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
-    for (const file of secondary) {
-      const text2 = file.text ?? "";
-      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
-      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
-      if (text2.trim() === imported) continue;
-      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
-      edits.push({
-        path: file.path,
-        before: file.text,
-        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
-      });
-    }
-  }
-  return edits;
-}
-function managedMcp(previous, host, runtime) {
-  const options = previous === void 0 ? {} : object.parse(previous);
-  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
-  return { ...options, ...mcpCommand(host, runtime) };
-}
-async function mcpEdit(root, host, runtime) {
-  const file = mcpPath(host), before = await readText(root, file);
-  if (host === "claude") {
-    const config2 = before === null ? {} : object.parse(JSON.parse(before));
-    const servers2 = object.parse(config2.mcpServers ?? {});
-    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host, runtime) } }, null, 2) + "\n" };
-  }
-  const config = parse(before ?? "");
-  const managed = (before ?? "").includes(TOML_START);
-  const servers = config.mcp_servers;
-  const desired = managedMcp(servers?.mason, host, runtime);
-  let base = before ?? "";
-  if (servers?.mason && !managed) {
-    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
-    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
-    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
-    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
-  }
-  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
-  const parsed = parse(after);
-  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
-  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
-  return { path: file, before, after };
-}
-async function hookEdits(root, host, runtime) {
-  const file = configPath(host), before = await readText(root, file);
-  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
-  const plan = await planAutomationInstall2(root, host, hookCommand(host, runtime));
-  return [
-    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
-    { path: ".mason/automation.json", before: await readText(root, ".mason/automation.json"), after: JSON.stringify(plan.record, null, 2) + "\n" }
-  ];
-}
-async function ancillaryEdits(root) {
-  const ignore = await readText(root, ".gitignore");
-  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-  let parentIgnored = false;
-  try {
-    parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
-  } catch (error) {
-    if (error.code !== 1) throw error;
-  }
-  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
-  const rules = [...retainParentRule ? ["!/.mason/", "/.mason/*"] : [], "!/.mason/decisions/", "!/.mason/decisions/**", "!/.mason/setup.json", "!/.mason/automation.json", "!/.mason/project.json", "!/.mason/run.cjs", "!/.mason/run.sh", "!/.mason/run.ps1", "/.mason/reports/", "/.mason/runtime/"].join("\n");
-  return [
-    { path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) },
-    { path: ".mason/run.cjs", before: await readText(root, ".mason/run.cjs"), after: LAUNCHER },
-    { path: ".mason/run.sh", before: await readText(root, ".mason/run.sh"), after: SHELL_LAUNCHER },
-    { path: ".mason/run.ps1", before: await readText(root, ".mason/run.ps1"), after: POWERSHELL_LAUNCHER }
-  ];
-}
-async function inspectHostConfig(root, host, plannedMcp, runtime) {
-  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
-  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
-  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
-  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
-  const expected = hookConfig(host, hookCommand(host, runtime));
-  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
-  return {
-    mcp,
-    mcpDisabled: mcp?.enabled === false,
-    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
-      event,
-      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
-    ])),
-    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
-  };
-}
-var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
-var init_config = __esm({
-  "src/setup/config.ts"() {
-    "use strict";
-    init_init();
-    init_docs();
-    init_adapters();
-    init_install();
-    init_files2();
-    init_launcher();
-    object = z15.record(z15.unknown());
-    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
-    TOML_START = "# mason:mcp:start";
-    TOML_END = "# mason:mcp:end";
-    POINTER_START = "<!-- mason:agents:start -->";
-    POINTER_END = "<!-- mason:agents:end -->";
-  }
-});
-
-// src/distribution/bundle.ts
-import fs16 from "fs/promises";
-import path21 from "path";
-import { createHash as createHash4 } from "crypto";
-import { z as z16 } from "zod";
-async function readBundle(root) {
-  const bytes = await fs16.readFile(await storePath(root, "bundle.json"));
-  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
-  const windows = manifest.target.startsWith("win32-");
-  for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
-      throw new Error("Unsafe path in Mason bundle: " + file);
-    }
-  }
-  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
-    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
-  }
-  return { manifest, manifestHash: sha256(bytes) };
-}
-async function verifyBundle(root, expectedHash) {
-  const bundle = await readBundle(root);
-  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
-  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
-  const files = Object.keys(bundle.manifest.files);
-  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs16.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
-  }));
-  return bundle;
-}
-var targets, digest2, bundleSchema, sha256;
-var init_bundle = __esm({
-  "src/distribution/bundle.ts"() {
-    "use strict";
-    init_storage();
-    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z16.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z16.object({
-      format: z16.literal(1),
-      version: z16.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z16.enum(targets),
-      nodeVersion: z16.string(),
-      files: z16.record(digest2)
-    }).strict();
-    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
-  }
-});
-
-// src/setup/runtime.ts
-var runtime_exports = {};
-__export(runtime_exports, {
-  installRuntime: () => installRuntime,
-  sourceRuntime: () => sourceRuntime,
-  verifyRuntime: () => verifyRuntime
-});
-import fs17 from "fs/promises";
-import path22 from "path";
-import { fileURLToPath } from "url";
-import { randomUUID as randomUUID6, createHash as createHash5 } from "crypto";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
-async function packageRoot() {
-  let directory = path22.dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 8; i++) {
-    try {
-      const pkg = JSON.parse(await fs17.readFile(path22.join(directory, "package.json"), "utf8"));
-      if (pkg.name === "mason-context") return directory;
-    } catch {
-    }
-    directory = path22.dirname(directory);
-  }
-  throw new Error("Cannot locate the executing Mason distribution. Reinstall Mason and rerun setup.");
-}
-async function sourceRuntime() {
-  const source = await packageRoot();
-  const pkg = JSON.parse(await fs17.readFile(path22.join(source, "package.json"), "utf8"));
-  const hashes = Object.fromEntries(await Promise.all(BINARIES.map(async (file) => [file, checksum(await fs17.readFile(path22.join(source, file)))])));
-  const bundleRoot = path22.dirname(source);
-  const bundleExists = await fs17.lstat(path22.join(bundleRoot, "bundle.json")).then(() => true, (error) => {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  });
-  if (bundleExists) {
-    const { manifest, manifestHash } = await verifyBundle(bundleRoot);
-    if (manifest.version !== pkg.version) throw new Error("Mason package and bundle versions differ.");
-    return { source, bundleRoot, runtime: runtimeSchema.parse({
-      id: manifestHash.slice(0, 24),
-      version: pkg.version,
-      hashes,
-      bundle: { target: manifest.target, manifestHash }
-    }) };
-  }
-  return { source, runtime: runtimeSchema.parse({ id: hash([pkg.version, pkg.dependencies, hashes]).slice(0, 24), version: pkg.version, hashes }) };
-}
-async function verifyRuntime(root, runtime) {
-  try {
-    const saved = await readStoreJson(root, `.mason/runtime/${runtime.id}/receipt.json`);
-    if (JSON.stringify(saved) !== JSON.stringify(runtime)) return false;
-    if (runtime.bundle) {
-      const base2 = await storePath(root, `.mason/runtime/${runtime.id}`);
-      const { manifest } = await verifyBundle(base2, runtime.bundle.manifestHash);
-      if (manifest.version !== runtime.version || manifest.target !== runtime.bundle.target) return false;
-      for (const file of BINARIES) if (manifest.files["app/" + file] !== runtime.hashes[file]) return false;
-      return true;
-    }
-    const base = `.mason/runtime/${runtime.id}/node_modules/mason-context/`;
-    const pkg = await readStoreJson(root, base + "package.json");
-    if (pkg?.name !== "mason-context" || pkg.version !== runtime.version) return false;
-    for (const file of BINARIES) {
-      if (checksum(await fs17.readFile(await storePath(root, base + file))) !== runtime.hashes[file]) return false;
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function installRuntime(root, selected) {
-  const { runtime, source } = selected;
-  if (await verifyRuntime(root, runtime)) return runtime;
-  const relative = `.mason/runtime/${runtime.id}`;
-  const target = await storePath(root, relative, true);
-  const stage = await storePath(root, ".mason/runtime/.install-" + randomUUID6(), true);
-  await fs17.mkdir(stage);
-  try {
-    if (runtime.bundle) {
-      if (!selected.bundleRoot) throw new Error("Standalone bundle source is missing.");
-      const { manifest } = await verifyBundle(selected.bundleRoot, runtime.bundle.manifestHash);
-      for (const file of ["bundle.json", ...Object.keys(manifest.files)]) {
-        const from = await storePath(selected.bundleRoot, file);
-        const to = await storePath(stage, file, true);
-        await fs17.copyFile(from, to);
-        await fs17.chmod(to, (await fs17.stat(from)).mode & 511);
-      }
-      await verifyBundle(stage, runtime.bundle.manifestHash);
-    } else {
-      const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-      const options = { timeout: 12e4, maxBuffer: 2 * 1024 * 1024, windowsHide: true };
-      const packed = JSON.parse((await exec10(npm, ["pack", "--ignore-scripts", "--json", "--pack-destination", stage], { ...options, cwd: source })).stdout);
-      const filename = packed[0]?.filename;
-      if (typeof filename !== "string" || path22.basename(filename) !== filename) throw new Error("npm did not produce a Mason package archive.");
-      await fs17.rename(path22.join(stage, filename), path22.join(stage, "mason.tgz"));
-      await fs17.writeFile(path22.join(stage, "package.json"), JSON.stringify({ name: "mason-project-runtime", private: true, version: "1.0.0" }));
-      await exec10(npm, ["install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--save-exact", "./mason.tgz"], { ...options, cwd: stage });
-      for (const file of BINARIES) {
-        if (checksum(await fs17.readFile(path22.join(stage, "node_modules/mason-context", file))) !== runtime.hashes[file]) throw new Error("Installed Mason binary differs from the selected distribution.");
-      }
-    }
-    await fs17.writeFile(path22.join(stage, "receipt.json"), JSON.stringify(runtime, null, 2) + "\n");
-    try {
-      await fs17.rename(target, target + ".previous-" + randomUUID6());
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    await fs17.rename(stage, target);
-    if (!await verifyRuntime(root, runtime)) throw new Error("The installed Mason runtime could not be verified.");
-    return runtime;
-  } finally {
-    await fs17.rm(stage, { recursive: true, force: true });
-  }
-}
-var exec10, checksum, BINARIES;
-var init_runtime2 = __esm({
-  "src/setup/runtime.ts"() {
-    "use strict";
-    init_model();
-    init_storage();
-    init_evidence();
-    init_bundle();
-    exec10 = promisify10(execFile10);
-    checksum = (bytes) => createHash5("sha256").update(bytes).digest("hex");
-    BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
-  }
-});
-
 // src/setup/status.ts
 var status_exports = {};
 __export(status_exports, {
@@ -4306,34 +4268,32 @@ async function setupStatus(dir) {
     };
   }
   const hosts = {};
-  const commonLauncherCurrent = await readText(ws.root, ".mason/run.cjs") === LAUNCHER;
+  const installed = await installedCommand();
   const automation = await automationStatus(ws.root);
   for (const host of ["codex", "claude"]) {
     const entry = setup.hosts[host];
     if (!entry) continue;
-    const launcherCurrent = commonLauncherCurrent && (!entry.runtime.bundle || await readText(ws.root, ".mason/run.sh") === SHELL_LAUNCHER && await readText(ws.root, ".mason/run.ps1") === POWERSHELL_LAUNCHER && await readText(ws.root, `.mason/runtime/${host}.txt`) === entry.runtime.id + "\n");
     const instructions = await instructionEdits(ws.root, host);
     const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
-    const installed = await verifyRuntime(ws.root, entry.runtime);
-    const config = await inspectHostConfig(ws.root, host, void 0, entry.runtime);
-    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host, entry.runtime));
-    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host, entry.runtime)).hooks) && !config.disabled;
+    const config = await inspectHostConfig(ws.root, host, void 0);
+    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
+    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
-    const observation = await readObservation(ws.root, ws.directory, host, entry.revision);
+    const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
     const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
     const pending = [];
-    if (!installed || !launcherCurrent) pending.push("Install this checkout's pinned runtime by rerunning setup.");
+    if (!installed.available) pending.push(installed.message);
     if (!mcp || !hooks || !instructionsCurrent || !configured) pending.push("Rerun setup to reconcile project configuration; inspect any disabled host settings.");
     if (!observation?.contextCalls) pending.push("Start a new assistant session and request task context through Mason's get_context tool.");
     if (!complete) pending.push("Review/trust the host configuration, then complete a normal task to observe the full hook lifecycle.");
     if (automation.status === "unavailable") pending.push("The latest automation attempt did not establish verification. Run mason-auto check and inspect its diagnostics.");
-    const healthy = installed && launcherCurrent && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    const healthy = installed.available && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
     hosts[host] = {
       status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
-      runtime: installed && launcherCurrent ? "installed" : "missing-or-changed",
+      runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
       instructions: instructionsCurrent ? "current" : "changed",
       hookConfiguration: hooks ? "configured" : "disabled-or-changed",
@@ -4363,7 +4323,7 @@ function summarizeActivation(status) {
       `  Runtime: ${state.runtime}; MCP: ${state.mcp}; instructions: ${state.instructions}.`,
       `  Hooks: ${state.hookConfiguration}; observed: ${state.observedEvents.join(", ") || "none"}.`,
       `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
-      ...state.pending.map((message3) => "  Next: " + message3)
+      ...state.pending.map((message2) => "  Next: " + message2)
     );
   }
   if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
@@ -4379,10 +4339,8 @@ var init_status = __esm({
     init_decisions();
     init_adapters();
     init_model();
-    init_runtime2();
     init_config();
     init_launcher();
-    init_files2();
     init_observations();
   }
 });
@@ -4394,7 +4352,7 @@ __export(setup_exports, {
   setupProject: () => setupProject,
   summarizeSetup: () => summarizeSetup
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 async function selectHost(root, explicit) {
   if (explicit) return explicit;
   if (process.env.MASON_SETUP_HOST === "codex" || process.env.MASON_SETUP_HOST === "claude") return process.env.MASON_SETUP_HOST;
@@ -4410,28 +4368,27 @@ async function setupProject(dir, options = {}) {
   return withLock(ws.root, ".mason/reports/setup-lock", async () => {
     const existing = await loadSetup(ws.root);
     const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
-    const marker = await loadProjectMarker(ws.root);
-    const selected = await sourceRuntime();
+    const installed = await installedCommand();
+    if (!installed.available) throw new Error(installed.message);
     const instructions = await instructionEdits(ws.root, host);
-    const mcp = await mcpEdit(ws.root, host, selected.runtime);
-    const hooks = await hookEdits(ws.root, host, selected.runtime);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
     const ancillary = await ancillaryEdits(ws.root);
     const edits = [...ancillary, ...instructions, mcp, ...hooks];
-    const setupBefore = await readText(ws.root, ".mason/setup.json");
-    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after, selected.runtime)).mcp);
-    const desiredHooks = hookConfig(host, hookCommand(host, selected.runtime)).hooks;
+    const setupBefore = await readText(ws.root, SETUP_PATH);
+    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
+    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
     const fingerprint = hash({
-      runtime: selected.runtime,
-      launcher: LAUNCHER,
+      command: "mason",
       mcp: mcpFingerprint,
       hooks: desiredHooks,
       instructions: instructions.map((edit) => edit.path)
     });
     const previous = existing?.hosts[host];
     const changed = edits.some((edit) => edit.before !== edit.after) || previous?.fingerprint !== fingerprint;
-    const revision = !changed && previous ? previous.revision : randomUUID7();
-    const setup = existing ?? { version: 1, hosts: {} };
-    setup.hosts[host] = { runtime: selected.runtime, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
+    const revision = !changed && previous ? previous.revision : randomUUID6();
+    const setup = existing ?? { version: 2, hosts: {} };
+    setup.hosts[host] = { configuredVersion: installed.version, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
     const initial = await automate(ws.root, { event: "turn_start" });
     const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
     const receiptPath = ws.directory + "/setup-" + host + ".json";
@@ -4446,20 +4403,11 @@ async function setupProject(dir, options = {}) {
       root: ws.root,
       revision
     });
-    await installRuntime(ws.root, selected);
-    if (selected.runtime.bundle) {
-      const pointer = `.mason/runtime/${host}.txt`;
-      await applyEdit(ws.root, { path: pointer, before: await readText(ws.root, pointer), after: selected.runtime.id + "\n" });
-    }
     const changedFiles = [];
     for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
-    if (await applyEdit(ws.root, { path: ".mason/setup.json", before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(".mason/setup.json");
-    if (!marker) {
-      await saveProjectMarker(ws.root, { version: 1, initializedAt: (/* @__PURE__ */ new Date()).toISOString() });
-      changedFiles.push(".mason/project.json");
-    }
+    if (await applyEdit(ws.root, { path: SETUP_PATH, before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(SETUP_PATH);
     const checked = await automate(ws.root, { event: "turn_start" });
-    const configured = await inspectHostConfig(ws.root, host, void 0, selected.runtime);
+    const configured = await inspectHostConfig(ws.root, host, void 0);
     await writeStoreJson(ws.root, receiptPath, {
       version: 1,
       host,
@@ -4476,7 +4424,7 @@ async function setupProject(dir, options = {}) {
       status: "configured",
       host,
       root: ws.root,
-      runtime: selected.runtime,
+      runtime: { kind: "global", command: "mason", version: installed.version },
       changedFiles,
       initialReportPath,
       findings,
@@ -4490,14 +4438,15 @@ function summarizeSetup(result) {
   const audit = result.findings.audit;
   return [
     `Mason configured for ${result.host}.`,
-    "  Runtime installed; MCP server and lifecycle hooks configured.",
+    "  MCP server and lifecycle hooks use mason from PATH.",
     "  Project instructions updated; original audit evidence retained.",
-    `  ${result.changedFiles.length} shared files changed.`,
+    `  ${result.changedFiles.length} files changed.`,
     `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
     ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
     `Original evidence: ${result.initialReportPath}`,
     "Activation: " + result.activation.status + ".",
     result.next,
+    "If the assistant cannot find mason, restart the desktop app so it picks up PATH.",
     "After the task finishes, run mason-auto status. Configuration alone does not establish activation."
   ].join("\n");
 }
@@ -4507,7 +4456,6 @@ var init_setup = __esm({
     init_evidence();
     init_store();
     init_runtime();
-    init_init();
     init_onboarding();
     init_storage();
     init_files2();
@@ -4515,24 +4463,73 @@ var init_setup = __esm({
     init_launcher();
     init_adapters();
     init_model();
-    init_runtime2();
     init_status();
   }
 });
 
+// src/distribution/bundle.ts
+import fs16 from "fs/promises";
+import path21 from "path";
+import { createHash as createHash4 } from "crypto";
+import { z as z16 } from "zod";
+async function readBundle(root) {
+  const bytes = await fs16.readFile(await storePath(root, "bundle.json"));
+  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
+  const windows = manifest.target.startsWith("win32-");
+  for (const file of Object.keys(manifest.files)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
+      throw new Error("Unsafe path in Mason bundle: " + file);
+    }
+  }
+  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
+    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  }
+  return { manifest, manifestHash: sha256(bytes) };
+}
+async function verifyBundle(root, expectedHash) {
+  const bundle = await readBundle(root);
+  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
+  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
+  const files = Object.keys(bundle.manifest.files);
+  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
+    if (sha256(await fs16.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+  }));
+  return bundle;
+}
+var targets, digest2, bundleSchema, sha256;
+var init_bundle = __esm({
+  "src/distribution/bundle.ts"() {
+    "use strict";
+    init_storage();
+    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+    digest2 = z16.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z16.object({
+      format: z16.literal(1),
+      version: z16.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z16.enum(targets),
+      nodeVersion: z16.string(),
+      files: z16.record(digest2)
+    }).strict();
+    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+  }
+});
+
 // src/distribution/path.ts
-import fs18 from "fs/promises";
+import fs17 from "fs/promises";
 import os3 from "os";
-import path23 from "path";
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
-import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import path22 from "path";
+import { execFile as execFile13 } from "child_process";
+import { promisify as promisify13 } from "util";
+import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
 import { z as z17 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
+  const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path22.posix.isAbsolute(entry) && path22.posix.resolve(entry) === path22.posix.resolve(bin));
+  const message2 = alreadyOnPath ? "Run: mason setup --host codex" : "Open a new terminal, then run: mason setup --host codex";
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
-Add ${bin} to your PATH, then run: mason setup --host codex` });
+${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --host codex`}` });
   if (env.MASON_NO_MODIFY_PATH === "1") return manual("Automatic PATH setup is disabled (MASON_NO_MODIFY_PATH=1).");
   if (/[\r\n\0]/.test(bin) || bin.includes(platform === "win32" ? ";" : ":")) return manual("This installation path cannot be represented safely in PATH.");
   try {
@@ -4547,33 +4544,33 @@ Add ${bin} to your PATH, then run: mason setup --host codex` });
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path23.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path22.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles = [path23.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles = [path23.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles = [path23.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles = [path22.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles = [path22.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles = [path22.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path23.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path22.join(userHome, name));
       let login = candidates[2];
-      for (const file of candidates) if (await fs18.lstat(file).then(() => true, (error) => {
+      for (const file of candidates) if (await fs17.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       })) {
         login = file;
         break;
       }
-      profiles = [path23.join(userHome, ".bashrc"), login];
+      profiles = [path22.join(userHome, ".bashrc"), login];
     }
-    const marker = `# >>> mason PATH ${createHash6("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles) {
-      const stat = await fs18.lstat(profile).catch((error) => {
+      const stat = await fs17.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs18.realpath(profile) : path23.resolve(profile);
-      const original = await fs18.readFile(file).catch((error) => {
+      const file = stat?.isSymbolicLink() ? await fs17.realpath(profile) : path22.resolve(profile);
+      const original = await fs17.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
       });
@@ -4588,8 +4585,8 @@ Add ${bin} to your PATH, then run: mason setup --host codex` });
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs18.mkdir(path23.dirname(file), { recursive: true });
-      const handle = await fs18.open(file, original === null ? "ax+" : "a+", 384);
+      await fs17.mkdir(path22.dirname(file), { recursive: true });
+      const handle = await fs17.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
         await handle.writeFile(block);
@@ -4613,23 +4610,23 @@ async function removePath(changes) {
         await windowsPath("remove", change.entry, current, change.created);
         continue;
       }
-      const stat = await fs18.lstat(change.file).catch((error) => {
+      const stat = await fs17.lstat(change.file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (!stat) continue;
       if (!stat.isFile()) throw new Error("profile type changed");
-      const bytes = await fs18.readFile(change.file), text2 = bytes.toString("utf8");
+      const bytes = await fs17.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
       const index2 = text2.indexOf(change.block);
       if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
       const prefix = text2.slice(0, index2), suffix = text2.slice(index2 + change.block.length);
       const separator = prefix && suffix && !prefix.endsWith("\n") ? change.block.startsWith("\r\n") ? "\r\n" : "\n" : "";
       const next = Buffer.from(prefix + separator + suffix);
-      const temporary = change.file + ".mason-" + randomUUID8();
+      const temporary = change.file + ".mason-" + randomUUID7();
       try {
         if (stat.nlink > 1) throw new Error("profile has multiple hard links");
-        const handle = await fs18.open(temporary, "wx", stat.mode & 511);
+        const handle = await fs17.open(temporary, "wx", stat.mode & 511);
         try {
           await handle.writeFile(next);
           await handle.chmod(stat.mode & 511);
@@ -4638,11 +4635,11 @@ async function removePath(changes) {
         } finally {
           await handle.close();
         }
-        const current = await fs18.lstat(change.file);
-        if (!current.isFile() || current.ino !== stat.ino || !(await fs18.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
-        await fs18.rename(temporary, change.file);
+        const current = await fs17.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs17.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs17.rename(temporary, change.file);
       } finally {
-        await fs18.rm(temporary, { force: true });
+        await fs17.rm(temporary, { force: true });
       }
     } catch (error) {
       warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
@@ -4676,21 +4673,20 @@ try {
   @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
 } finally { $key.Dispose() }
 `;
-  const { stdout } = await execute("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
   return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
 }
-var execute, pathChangeSchema, quote, message2, normalizeWindowsEntry, hasWindowsEntry;
+var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
-    execute = promisify11(execFile11);
+    execute2 = promisify13(execFile13);
     pathChangeSchema = z17.discriminatedUnion("kind", [
       z17.object({ kind: z17.literal("profile"), file: z17.string(), block: z17.string(), created: z17.boolean() }),
       z17.object({ kind: z17.literal("windows"), entry: z17.string(), created: z17.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    message2 = "Open a new terminal, then run: mason setup --host codex";
-    normalizeWindowsEntry = (value) => path23.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path22.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -4708,41 +4704,41 @@ __export(install_exports2, {
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs19 from "fs/promises";
+import fs18 from "fs/promises";
 import os4 from "os";
-import path24 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import path23 from "path";
+import { fileURLToPath } from "url";
 import { spawn } from "child_process";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { z as z18 } from "zod";
 async function replace(file, content2, mode = 384) {
-  const temp = file + ".tmp-" + randomUUID9();
+  const temp = file + ".tmp-" + randomUUID8();
   try {
-    await fs19.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs19.rename(temp, file);
+    await fs18.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs18.rename(temp, file);
   } finally {
-    await fs19.rm(temp, { force: true });
+    await fs18.rm(temp, { force: true });
   }
 }
 async function installStandalone(source) {
   const bundle = await verifyBundle(source);
-  const selectedHome = path24.resolve(defaultHome());
-  await fs19.mkdir(selectedHome, { recursive: true });
-  const home = await fs19.realpath(selectedHome);
-  const selectedBin = path24.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path24.join(home, "bin") : path24.join(os4.homedir(), ".local/bin")));
+  const selectedHome = path23.resolve(defaultHome());
+  await fs18.mkdir(selectedHome, { recursive: true });
+  const home = await fs18.realpath(selectedHome);
+  const selectedBin = path23.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path23.join(home, "bin") : path23.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
     const previous = raw === null ? null : recordSchema2.parse(raw);
-    if (!previous) for (const file of await fs19.readdir(home)) {
+    if (!previous) for (const file of await fs18.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path24.join(home, file);
-      const stat = await fs19.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs19.readdir(directory)).length) {
+      const directory = path23.join(home, file);
+      const stat = await fs18.lstat(directory);
+      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs18.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-    await fs19.mkdir(selectedBin, { recursive: true });
-    const bin = await fs19.realpath(selectedBin);
+    await fs18.mkdir(selectedBin, { recursive: true });
+    const bin = await fs18.realpath(selectedBin);
     if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
     const id = bundle.manifestHash.slice(0, 24);
     const destination = await storePath(home, "versions/" + id);
@@ -4753,10 +4749,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path24.join(destination, "node.exe"))} ${psQuote(path24.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path23.join(destination, "node.exe"))} ${psQuote(path23.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path24.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path23.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -4765,11 +4761,11 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
-      const old = await fs19.readFile(file, "utf8").catch((error) => {
+      const old = await fs18.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -4778,7 +4774,7 @@ exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destinat
     const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
     const checkRetired = async (name, expected) => {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
-      const actual = await fs19.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      const actual = await fs18.readFile(await storePath(bin, name), "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -4787,29 +4783,29 @@ exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destinat
     for (const [name, expected] of retired) await checkRetired(name, expected);
     const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
     await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
-    const stage = await storePath(home, "versions/.install-" + randomUUID9(), true);
-    await fs19.mkdir(stage);
+    const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
+    await fs18.mkdir(stage);
     try {
       for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
         const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs19.copyFile(from, to);
-        await fs19.chmod(to, (await fs19.stat(from)).mode & 511);
+        await fs18.copyFile(from, to);
+        await fs18.chmod(to, (await fs18.stat(from)).mode & 511);
       }
       await verifyBundle(stage, bundle.manifestHash);
-      const exists2 = await fs19.lstat(destination).then(() => true, (error) => {
+      const exists2 = await fs18.lstat(destination).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       });
       if (exists2) await verifyBundle(destination, bundle.manifestHash);
-      else await fs19.rename(stage, destination);
+      else await fs18.rename(stage, destination);
       for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
       for (const [name, expected] of retired) {
         await checkRetired(name, expected);
-        await fs19.rm(await storePath(bin, name), { force: true });
+        await fs18.rm(await storePath(bin, name), { force: true });
       }
       await writeStoreJson(home, "install.json", receipt);
     } finally {
-      await fs19.rm(stage, { recursive: true, force: true });
+      await fs18.rm(stage, { recursive: true, force: true });
     }
     const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
       receipt.pathChanges = changes;
@@ -4819,12 +4815,12 @@ exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destinat
   });
 }
 async function currentInstallation() {
-  const app = path24.dirname(path24.dirname(fileURLToPath2(import.meta.url)));
-  const bundle = path24.dirname(app), home = path24.dirname(path24.dirname(bundle));
+  const app = path23.dirname(path23.dirname(fileURLToPath(import.meta.url)));
+  const bundle = path23.dirname(app), home = path23.dirname(path23.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
   const record = recordSchema2.parse(raw);
-  if (record.home !== await fs19.realpath(home) || path24.dirname(bundle) !== path24.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs18.realpath(home) || path23.dirname(bundle) !== path23.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version) {
@@ -4832,7 +4828,7 @@ async function upgradeStandalone(version) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path24.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path23.join(bundle, windows ? "install.ps1" : "install.sh");
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
@@ -4853,7 +4849,7 @@ async function uninstallStandalone() {
     for (const [name, expected] of Object.entries(record.launchers)) {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs19.readFile(file, "utf8").catch((error) => {
+      const actual = await fs18.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -4861,9 +4857,9 @@ async function uninstallStandalone() {
     }
     for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs19.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs18.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs19.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs18.rm(home, { recursive: true, force: true });
   return home;
 }
 var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
@@ -4888,12 +4884,12 @@ var init_install2 = __esm({
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path24.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path24.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path23.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path23.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
 // bin/mason.ts
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/automation/cli.ts
 init_execution();
@@ -4904,7 +4900,7 @@ init_store();
 import { parseArgs } from "util";
 var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options]
 
-  setup [--host claude|codex]  Install a pinned runtime, MCP, instructions and hooks; retain the initial audit
+  setup [--host claude|codex]  Connect MCP, instructions and hooks to mason on PATH; retain the initial audit
   install --host claude|codex  Merge lifecycle hooks into this project's host config
   config --host claude|codex   Print the host config without writing
   status                      Read configured hooks and observed runtime events
@@ -4977,20 +4973,23 @@ async function runAutomationCli(argv, stdin = "", io = {
     io.out(values.json ? JSON.stringify(report, null, 2) : summarize(report));
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
-    const message3 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
+    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : failureMessage(error);
     if (action === "hook" || isHookCommand(argv)) {
-      io.out(JSON.stringify({ systemMessage: message3 }));
+      io.out(JSON.stringify({ systemMessage: message2 }));
       return 0;
     }
     if (argv.includes("--json")) io.out(JSON.stringify({ version: 1, ...action === "setup" ? { action, status: "incomplete", next: "Rerun the same setup command to resume." } : { status: "unavailable" }, failure: automationFailure(error) }));
-    else io.err(message3);
+    else io.err(message2);
     return 2;
   }
 }
 
 // bin/mason.ts
-var [command, ...args] = process.argv.slice(2);
-var usage = `Mason ${"0.14.1"}
+var inputArgs = process.argv.slice(2);
+var managedLaunch = inputArgs[0] === "--setup-host";
+var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
+var [command, ...args] = inputArgs;
+var usage = `Mason ${"0.15.0"}
 
 Usage: mason <command> [options]
 
@@ -5007,24 +5006,28 @@ Usage: mason <command> [options]
 Use mason <command> --help for options. npm users can keep using mason-auto,
 mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
 try {
-  if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.14.1");
+  if (managedLaunch) {
+    if (!setupHost || !["codex", "claude"].includes(setupHost) || !["mcp", "auto"].includes(command)) throw new Error("Invalid setup invocation.");
+    const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
+    await prepareLaunch2(setupHost);
+  }
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.15.0" }));
+  else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
+  else if (["--version", "-v"].includes(command)) console.log("0.15.0");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
-    const { sourceRuntime: sourceRuntime2 } = await Promise.resolve().then(() => (init_runtime2(), runtime_exports));
-    const selected = await sourceRuntime2();
-    if (!selected.bundleRoot) throw new Error("This command requires a standalone bundle.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
-    const installed = await installStandalone2(selected.bundleRoot);
+    const bundleRoot = fileURLToPath2(new URL("../..", import.meta.url));
+    const installed = await installStandalone2(bundleRoot);
     console.log(`Installed Mason ${installed.version} in ${installed.home}.
 ${installed.path.message}`);
   } else if (command === "upgrade" || command === "uninstall") {
-    if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Project versions change only when you rerun setup." : "Usage: mason uninstall. Removes the standalone user installation; project runtimes, configuration and knowledge are retained.");
+    if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Configured projects use the upgraded command on their next launch. Restart running assistants." : "Usage: mason uninstall. Removes the standalone user installation; project configuration and knowledge are retained; integrations need Mason reinstalled.");
     else {
       const { upgradeStandalone: upgradeStandalone2, uninstallStandalone: uninstallStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
       if (args.length > (command === "upgrade" ? 1 : 0)) throw new Error("Unexpected arguments.");
       if (command === "upgrade") process.exitCode = await upgradeStandalone2(args[0]);
-      else console.log((process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configurations and pinned runtimes were retained.");
+      else console.log((process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configuration and knowledge were retained. Reinstall Mason to use its integrations.");
     }
   } else if (["setup", "status", "check", "auto"].includes(command)) {
     const forwarded = command === "auto" ? args : [command, ...args];
@@ -5036,11 +5039,17 @@ ${installed.path.message}`);
     process.exitCode = await runAutomationCli(forwarded, input);
   } else if (["audit", "review", "drift", "hook", "mcp"].includes(command)) {
     const binary = new URL(`./mason-${command}.js`, import.meta.url);
-    process.argv = [process.execPath, fileURLToPath3(binary), ...args];
+    process.argv = [process.execPath, fileURLToPath2(binary), ...args];
     await import(binary.href);
   } else throw new Error("Unknown command: " + command + ". Run mason --help.");
 } catch (error) {
-  console.error("Mason: " + (error instanceof Error ? error.message : String(error)));
-  process.exitCode = 2;
+  const message2 = "Mason: " + (error instanceof Error ? error.message : String(error));
+  if (command === "auto" && isHookCommand(args)) {
+    console.log(JSON.stringify({ systemMessage: message2 + " Verification was not established." }));
+    process.exitCode = 0;
+  } else {
+    console.error(message2);
+    process.exitCode = 2;
+  }
 }
 //# sourceMappingURL=mason.js.map