mason-context 0.14.2 → 0.15.0

package/dist/mason.js

@@ -2521,7 +2521,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     exec7 = promisify8(execFile8);
-    engineVersion = true ? "0.14.2" : "development";
+    engineVersion = true ? "0.15.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
@@ -2852,7 +2852,7 @@ var init_runtime = __esm({
 // src/setup/model.ts
 import { z as z7 } from "zod";
 async function loadSetup(root) {
-  const raw = await readStoreJson(root, ".mason/setup.json");
+  const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
   return setupSchema.parse(raw);
 }
@@ -2863,28 +2863,23 @@ async function loadSetupReceipt(root, directory, host) {
   if (receipt.root !== root || receipt.host !== host) throw new Error("Setup receipt belongs to another installation.");
   return receipt;
 }
-var runtimeSchema, setupHostSchema, setupSchema, receiptSchema;
+var setupHostSchema, setupSchema, SETUP_PATH, receiptSchema;
 var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
     init_storage();
-    runtimeSchema = z7.object({
-      id: z7.string().regex(/^[a-f0-9]{24}$/),
-      version: z7.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      hashes: z7.record(z7.string().regex(/^[a-f0-9]{64}$/)),
-      bundle: z7.object({ target: z7.string(), manifestHash: z7.string().regex(/^[a-f0-9]{64}$/) }).optional()
-    });
     setupHostSchema = z7.object({
-      runtime: runtimeSchema,
+      configuredVersion: z7.string(),
       revision: z7.string().uuid(),
       fingerprint: z7.string(),
       mcpFingerprint: z7.string(),
       instructions: z7.array(z7.string())
     });
-    setupSchema = z7.object({ version: z7.literal(1), hosts: z7.object({
+    setupSchema = z7.object({ version: z7.literal(2), hosts: z7.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
+    SETUP_PATH = ".mason/local/setup.json";
     receiptSchema = z7.object({
       version: z7.literal(1),
       host: z7.enum(["codex", "claude"]),
@@ -2898,6 +2893,56 @@ var init_model = __esm({
   }
 });
 
+// src/setup/launcher.ts
+var launcher_exports = {};
+__export(launcher_exports, {
+  executingVersion: () => executingVersion,
+  globalCommand: () => globalCommand,
+  hookCommand: () => hookCommand,
+  installedCommand: () => installedCommand,
+  mcpCommand: () => mcpCommand,
+  prepareLaunch: () => prepareLaunch
+});
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+function globalCommand(args2, platform = process.platform) {
+  return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
+}
+async function installedCommand() {
+  const invocation = globalCommand(["internal-integration-version"]);
+  try {
+    const { stdout } = await promisify9(execFile9)(
+      invocation.command,
+      invocation.args,
+      { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
+    );
+    const result = JSON.parse(stdout);
+    if (result.protocol !== 1 || typeof result.version !== "string") throw new Error("Unsupported Mason integration protocol.");
+    return { available: true, version: result.version, message: null };
+  } catch {
+    return { available: false, version: null, message: "An up-to-date mason command is not available on this process's PATH. Install or upgrade Mason, then reopen your terminal or desktop assistant and rerun mason setup." };
+  }
+}
+async function prepareLaunch(host) {
+  const ws = await workspace(process.cwd());
+  const entry = (await loadSetup(ws.root))?.hosts[host];
+  if (!entry) throw new Error(`Mason is not configured locally for ${host}. Run mason setup --host ${host} in this checkout.`);
+  process.env.MASON_SETUP_ROOT = ws.root;
+  process.env.MASON_SETUP_HOST = host;
+  process.env.MASON_SETUP_REVISION = entry.revision;
+}
+var executingVersion, mcpCommand, hookCommand;
+var init_launcher = __esm({
+  "src/setup/launcher.ts"() {
+    "use strict";
+    init_evidence();
+    init_model();
+    executingVersion = () => true ? "0.15.0" : "development";
+    mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
+    hookCommand = (host) => `mason --setup-host ${host} auto`;
+  }
+});
+
 // src/setup/observations.ts
 var observations_exports = {};
 __export(observations_exports, {
@@ -2907,14 +2952,14 @@ __export(observations_exports, {
 });
 import fs13 from "fs/promises";
 import { z as z8 } from "zod";
-function observationPath(directory, host, revision) {
-  return `${directory}/activation/${host}-${revision}.json`;
+function observationPath(directory, host, revision, version = executingVersion()) {
+  return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
-async function readObservation(root, directory, host, revision) {
-  const raw = await readStoreJson(root, observationPath(directory, host, revision));
+async function readObservation(root, directory, host, revision, version = executingVersion()) {
+  const raw = await readStoreJson(root, observationPath(directory, host, revision, version));
   if (raw === null) return null;
   const record = observationSchema.parse(raw);
-  if (record.root !== root || record.host !== host || record.revision !== revision) throw new Error("Activation receipt belongs to another installation.");
+  if (record.root !== root || record.host !== host || record.revision !== revision || record.masonVersion !== version) throw new Error("Activation receipt belongs to another installation.");
   return record;
 }
 async function observeActivation(dir, event, options = {}) {
@@ -2931,6 +2976,7 @@ async function observeActivation(dir, event, options = {}) {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const record = await readObservation(ws.root, ws.directory, host, revision) ?? {
         version: 1,
+        masonVersion: executingVersion(),
         root: ws.root,
         revision,
         host,
@@ -2969,8 +3015,10 @@ var init_observations = __esm({
     init_store();
     init_storage();
     init_model();
+    init_launcher();
     observationSchema = z8.object({
       version: z8.literal(1),
+      masonVersion: z8.string(),
       root: z8.string(),
       revision: z8.string(),
       host: z8.enum(["codex", "claude"]),
@@ -3060,106 +3108,78 @@ var init_adapters = __esm({
   }
 });
 
-// src/automation/install.ts
-var install_exports = {};
-__export(install_exports, {
-  automationConfigSchema: () => automationConfigSchema,
-  configPath: () => configPath,
-  installAutomation: () => installAutomation,
-  installedAutomation: () => installedAutomation,
-  planAutomationInstall: () => planAutomationInstall
+// src/setup/files.ts
+var files_exports = {};
+__export(files_exports, {
+  applyEdit: () => applyEdit,
+  managedBlock: () => managedBlock,
+  readText: () => readText
 });
-import { z as z10 } from "zod";
-async function installAutomation(dir, host, command2) {
-  const ws = await workspace(dir);
-  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command2));
-}
-async function planAutomationInstall(root, host, command2) {
-  const file = configPath(host);
-  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
-  const record = recordSchema.parse(await readStoreJson(root, ".mason/automation.json") ?? { version: 1, hosts: {} });
-  const desired = hookConfig(host, command2);
-  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
-  const previous = record.hosts[host]?.command;
-  const hooks = existing.hooks ?? {};
-  for (const event of HOOK_EVENTS) {
-    hooks[event] = (hooks[event] ?? []).map((group) => ({
-      ...group,
-      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && (handler.command === previous || handler.command === newCommand)))
-    })).filter((group) => group.hooks.length);
-    hooks[event].push(...desired.hooks[event]);
+import fs14 from "fs/promises";
+import path18 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+async function readText(root, file) {
+  try {
+    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
+    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
+    return text2;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
   }
-  record.hosts[host] = { command: newCommand };
-  return { file, config: { ...existing, hooks }, record, newCommand };
 }
-async function installLocked(root, host, command2) {
-  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command2);
-  await writeStoreJson(root, file, config);
-  await writeStoreJson(root, ".mason/automation.json", record);
-  return {
-    version: 1,
-    host,
-    configPath: file,
-    status: "configured",
-    command: newCommand,
-    events: HOOK_EVENTS,
-    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
-    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
-  };
+function managedBlock(text2, start, end, body) {
+  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
+  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
+    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
+  }
+  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
+  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
+  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
+  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
 }
-async function installedAutomation(dir) {
-  const ws = await workspace(dir);
-  const raw = await readStoreJson(ws.root, ".mason/automation.json");
-  if (raw === null) return {};
-  const record = recordSchema.parse(raw);
-  const result = {};
-  for (const host of ["claude", "codex"]) {
-    const expected = record.hosts[host];
-    if (!expected) continue;
-    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
-    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
-    result[host] = {
-      configPath: configPath(host),
-      configuredEvents,
-      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
-      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
-    };
+async function applyEdit(root, edit) {
+  const current = await readText(root, edit.path);
+  if (current === edit.after) return false;
+  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
+  const file = await storePath(root, edit.path, true);
+  const temporary = path18.join(path18.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  try {
+    const mode = await fs14.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs14.open(temporary, "wx", mode);
+    try {
+      await handle.writeFile(edit.after, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
+    await fs14.rename(temporary, file);
+    return true;
+  } finally {
+    await fs14.rm(temporary, { force: true });
   }
-  return result;
 }
-var groupSchema, automationConfigSchema, recordSchema, configPath;
-var init_install = __esm({
-  "src/automation/install.ts"() {
+var init_files2 = __esm({
+  "src/setup/files.ts"() {
     "use strict";
+    init_files();
     init_storage();
-    init_evidence();
-    init_adapters();
-    init_store();
-    groupSchema = z10.object({ hooks: z10.array(z10.object({ type: z10.string(), command: z10.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z10.object({ hooks: z10.record(z10.array(groupSchema)).optional() }).passthrough();
-    recordSchema = z10.object({ version: z10.literal(1), hosts: z10.record(z10.object({ command: z10.string() })) });
-    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
 });
 
 // src/mcp/init.ts
-import { z as z11 } from "zod";
-async function loadProjectMarker(rootDir) {
-  const raw = await readStoreJson(rootDir, ".mason/project.json");
-  return raw === null ? null : markerSchema.parse(raw);
-}
-async function saveProjectMarker(rootDir, marker) {
-  await writeStoreJson(rootDir, ".mason/project.json", markerSchema.parse(marker));
-}
+import { z as z10 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
-    markerSchema = z11.object({
-      version: z11.literal(1),
-      initializedAt: z11.string(),
-      features: z11.object({ confluence: z11.boolean().optional() }).optional()
+    init_files2();
+    markerSchema = z10.object({
+      version: z10.literal(1),
+      initializedAt: z10.string(),
+      features: z10.object({ confluence: z10.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -3181,7 +3201,7 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 Inspect source for what the retrieved context does not answer.
 <!-- mason:end -->`;
     ASSISTANT_SETUP = `UNIFIED SETUP
-When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, install a pinned private runtime, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason-auto setup: retain the initial audit before instruction edits, use the installed mason command on PATH, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
 If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason-auto status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
 
 The managed project guidance is:
@@ -3189,7 +3209,7 @@ ${CLAUDE_MD_SECTION}`;
     QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
-2. Address findings within the user's requested scope. Setup alone authorizes the Mason runtime, host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
 3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
@@ -3231,114 +3251,363 @@ If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`.
   }
 });
 
-// src/review/cochange.ts
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
-async function buildMatrix(resolvedRoot) {
+// src/utils/git.ts
+var git_exports = {};
+__export(git_exports, {
+  isGitRepo: () => isGitRepo
+});
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+async function isGitRepo(dir) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
-    if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
-      "git",
-      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
-      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
-    );
-    const commitsByFile = /* @__PURE__ */ new Map();
-    const blocks = stdout.split("
");
-    let index2 = 0;
-    for (const block of blocks) {
-      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
-      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
-      for (const file of files) {
-        let set = commitsByFile.get(file);
-        if (!set) {
-          set = /* @__PURE__ */ new Set();
-          commitsByFile.set(file, set);
-        }
-        set.add(index2);
-      }
-      index2++;
-    }
-    return { commitsByFile, totalCommits: index2 };
+    await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
+    return true;
   } catch {
-    return null;
-  }
-}
-async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
-  const matrix = await buildMatrix(resolvedRoot);
-  if (!matrix) return null;
-  const changedSet = new Set(allChangedFiles);
-  const findings = [];
-  for (const changedFile of changedFiles) {
-    const fileCommits = matrix.commitsByFile.get(changedFile);
-    if (!fileCommits || fileCommits.size < MIN_FILE_COMMITS) continue;
-    for (const [partner, partnerCommits] of matrix.commitsByFile) {
-      if (partner === changedFile || changedSet.has(partner)) continue;
-      let shared = 0;
-      for (const c of fileCommits) {
-        if (partnerCommits.has(c)) shared++;
-      }
-      if (shared < MIN_SHARED_COMMITS) continue;
-      const rate = shared / fileCommits.size;
-      if (rate < MIN_COCHANGE_RATE) continue;
-      if (!await existsOnDisk(partner)) continue;
-      findings.push({
-        changedFile,
-        missingPartner: partner,
-        sharedCommits: shared,
-        fileCommits: fileCommits.size,
-        rate: Math.round(rate * 100) / 100
-      });
-    }
+    return false;
   }
-  findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
-  return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
-var init_cochange = __esm({
-  "src/review/cochange.ts"() {
+var exec8;
+var init_git2 = __esm({
+  "src/utils/git.ts"() {
     "use strict";
-    exec8 = promisify9(execFile9);
-    HISTORY_COMMITS = 1500;
-    MIN_FILE_COMMITS = 5;
-    MIN_SHARED_COMMITS = 4;
-    MIN_COCHANGE_RATE = 0.6;
-    MAX_COMMIT_FILES = 30;
+    exec8 = promisify10(execFile10);
   }
 });
 
-// src/review/evidence/paths.ts
-function evidencePath(value, sourceRoot, uri = false) {
-  if (value.length > 4e3) return null;
-  let file = value;
-  try {
-    if (uri) {
-      if (file.startsWith("file:")) {
-        const url = new URL(file);
-        if (url.hostname && url.hostname !== "localhost") return null;
-        file = decodeURIComponent(url.pathname).replace(/^\/([A-Za-z]:\/)/, "$1");
-      } else {
-        if (/^[a-z][a-z0-9+.-]*:/i.test(file)) return null;
-        file = decodeURIComponent(file);
-      }
+// src/setup/config.ts
+var config_exports = {};
+__export(config_exports, {
+  ancillaryEdits: () => ancillaryEdits,
+  hookEdits: () => hookEdits,
+  inspectHostConfig: () => inspectHostConfig,
+  instructionEdits: () => instructionEdits,
+  mcpEdit: () => mcpEdit,
+  mcpPath: () => mcpPath
+});
+import { isDeepStrictEqual } from "util";
+import { parse, stringify } from "smol-toml";
+import { z as z11 } from "zod";
+async function instructionEdits(root, host) {
+  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
+  const existing = found.find((f) => f.text !== null);
+  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
+  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
+  const edits = [{
+    path: primary.path,
+    before: primary.text,
+    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
+  }];
+  if (primary.path === "AGENTS.md") {
+    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
+    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
+    for (const file of secondary) {
+      const text2 = file.text ?? "";
+      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
+      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
+      if (text2.trim() === imported) continue;
+      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
+      edits.push({
+        path: file.path,
+        before: file.text,
+        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
+      });
     }
-  } catch {
-    return null;
-  }
-  file = file.replace(/\\/g, "/");
-  const root = sourceRoot.replace(/\\/g, "/").replace(/\/+$/, "");
-  if (file.startsWith("/") || /^[A-Za-z]:/.test(file)) {
-    if (!file.startsWith(root + "/")) return null;
-    file = file.slice(root.length + 1);
   }
-  return normalizeRepoPath(file);
+  return edits;
 }
-var init_paths2 = __esm({
-  "src/review/evidence/paths.ts"() {
-    "use strict";
-    init_paths();
-  }
-});
+function managedMcp(previous, host) {
+  const options = previous === void 0 ? {} : object.parse(previous);
+  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
+  return { ...options, ...mcpCommand(host) };
+}
+async function mcpEdit(root, host) {
+  const file = mcpPath(host), before = await readText(root, file);
+  if (host === "claude") {
+    const config2 = before === null ? {} : object.parse(JSON.parse(before));
+    const servers2 = object.parse(config2.mcpServers ?? {});
+    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host) } }, null, 2) + "\n" };
+  }
+  const config = parse(before ?? "");
+  const managed = (before ?? "").includes(TOML_START);
+  const servers = config.mcp_servers;
+  const desired = managedMcp(servers?.mason, host);
+  let base = before ?? "";
+  if (servers?.mason && !managed) {
+    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
+    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
+    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
+    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
+  }
+  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
+  const parsed = parse(after);
+  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
+  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
+  return { path: file, before, after };
+}
+async function hookEdits(root, host) {
+  const file = configPath(host), before = await readText(root, file);
+  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  const plan = await planAutomationInstall2(root, host, hookCommand(host));
+  return [
+    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
+    { path: AUTOMATION_PATH, before: await readText(root, AUTOMATION_PATH), after: JSON.stringify(plan.record, null, 2) + "\n" }
+  ];
+}
+async function ancillaryEdits(root) {
+  const ignore = await readText(root, ".gitignore");
+  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
+  let parentIgnored = false;
+  try {
+    if (await isGitRepo2(root)) parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+  } catch (error) {
+    if (error.code !== 1) throw error;
+  }
+  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
+  const rules = [
+    ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
+    "!/.mason/decisions/",
+    "!/.mason/decisions/**",
+    "!/.mason/config.json",
+    "!/.mason/snapshot.json",
+    "/.mason/local/",
+    "/.mason/reports/"
+  ].join("\n");
+  return [{ path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) }];
+}
+async function inspectHostConfig(root, host, plannedMcp) {
+  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
+  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
+  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
+  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
+  const expected = hookConfig(host, hookCommand(host));
+  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
+  return {
+    mcp,
+    mcpDisabled: mcp?.enabled === false,
+    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
+      event,
+      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
+    ])),
+    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
+  };
+}
+var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
+var init_config = __esm({
+  "src/setup/config.ts"() {
+    "use strict";
+    init_init();
+    init_docs();
+    init_adapters();
+    init_install();
+    init_files2();
+    init_launcher();
+    object = z11.record(z11.unknown());
+    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
+    TOML_START = "# mason:mcp:start";
+    TOML_END = "# mason:mcp:end";
+    POINTER_START = "<!-- mason:agents:start -->";
+    POINTER_END = "<!-- mason:agents:end -->";
+  }
+});
+
+// src/automation/install.ts
+var install_exports = {};
+__export(install_exports, {
+  AUTOMATION_PATH: () => AUTOMATION_PATH,
+  automationConfigSchema: () => automationConfigSchema,
+  configPath: () => configPath,
+  installAutomation: () => installAutomation,
+  installedAutomation: () => installedAutomation,
+  planAutomationInstall: () => planAutomationInstall
+});
+import { z as z12 } from "zod";
+async function installationRecord(root) {
+  return recordSchema.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
+}
+async function installAutomation(dir, host, command2) {
+  const ws = await workspace(dir);
+  return withLock(ws.root, ".mason/reports/automation-install", () => installLocked(ws.root, host, command2));
+}
+async function planAutomationInstall(root, host, command2) {
+  const file = configPath(host);
+  const existing = automationConfigSchema.parse(await readStoreJson(root, file) ?? {});
+  const record = await installationRecord(root);
+  const desired = hookConfig(host, command2);
+  const newCommand = desired.hooks.SessionStart[0].hooks[0].command;
+  const previous = record.hosts[host]?.command;
+  const owned = /* @__PURE__ */ new Set([previous, newCommand]);
+  const hooks = existing.hooks ?? {};
+  for (const event of HOOK_EVENTS) {
+    hooks[event] = (hooks[event] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((handler) => !(handler.type === "command" && typeof handler.command === "string" && owned.has(handler.command)))
+    })).filter((group) => group.hooks.length);
+    hooks[event].push(...desired.hooks[event]);
+  }
+  record.hosts[host] = { command: newCommand };
+  return { file, config: { ...existing, hooks }, record, newCommand };
+}
+async function installLocked(root, host, command2) {
+  const { file, config, record, newCommand } = await planAutomationInstall(root, host, command2);
+  const { ancillaryEdits: ancillaryEdits2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  const { applyEdit: applyEdit2 } = await Promise.resolve().then(() => (init_files2(), files_exports));
+  for (const edit of await ancillaryEdits2(root)) await applyEdit2(root, edit);
+  await writeStoreJson(root, file, config);
+  await writeStoreJson(root, AUTOMATION_PATH, record);
+  return {
+    version: 1,
+    host,
+    configPath: file,
+    status: "configured",
+    command: newCommand,
+    events: HOOK_EVENTS,
+    next: host === "codex" ? "Review/trust these hooks using Codex /hooks and start a new session. mason-auto status reports observed events separately from configuration." : "Start a new Claude Code session. mason-auto status reports observed events separately from configuration.",
+    note: "Install mason-context in the project before using the default command. Ignore .mason/reports/ to keep local evidence out of commits. Hooks preserve evidence and suggest scoped repairs; they do not approve edits or decisions."
+  };
+}
+async function installedAutomation(dir) {
+  const ws = await workspace(dir);
+  const record = await installationRecord(ws.root);
+  const result = {};
+  for (const host of ["claude", "codex"]) {
+    const expected = record.hosts[host];
+    if (!expected) continue;
+    const current = automationConfigSchema.parse(await readStoreJson(ws.root, configPath(host)) ?? {});
+    const configuredEvents = HOOK_EVENTS.filter((event) => current.hooks?.[event]?.some((group) => group.hooks.some((handler) => handler.type === "command" && handler.command === expected.command)));
+    result[host] = {
+      configPath: configPath(host),
+      configuredEvents,
+      status: current.disableAllHooks === true ? "disabled" : configuredEvents.length === HOOK_EVENTS.length ? "configured" : "incomplete",
+      runtime: "Host version, trust, policy, and tool coverage still determine execution; inspect observed events."
+    };
+  }
+  return result;
+}
+var groupSchema, automationConfigSchema, recordSchema, AUTOMATION_PATH, configPath;
+var init_install = __esm({
+  "src/automation/install.ts"() {
+    "use strict";
+    init_storage();
+    init_evidence();
+    init_adapters();
+    init_store();
+    groupSchema = z12.object({ hooks: z12.array(z12.object({ type: z12.string(), command: z12.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z12.object({ hooks: z12.record(z12.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z12.object({ version: z12.literal(1), hosts: z12.record(z12.object({ command: z12.string() })) });
+    AUTOMATION_PATH = ".mason/local/automation.json";
+    configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
+  }
+});
+
+// src/review/cochange.ts
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
+async function buildMatrix(resolvedRoot) {
+  try {
+    const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    if (shallow.trim() === "true") return null;
+    const { stdout } = await exec9(
+      "git",
+      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
+      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
+    );
+    const commitsByFile = /* @__PURE__ */ new Map();
+    const blocks = stdout.split("
");
+    let index2 = 0;
+    for (const block of blocks) {
+      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
+      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
+      for (const file of files) {
+        let set = commitsByFile.get(file);
+        if (!set) {
+          set = /* @__PURE__ */ new Set();
+          commitsByFile.set(file, set);
+        }
+        set.add(index2);
+      }
+      index2++;
+    }
+    return { commitsByFile, totalCommits: index2 };
+  } catch {
+    return null;
+  }
+}
+async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
+  const matrix = await buildMatrix(resolvedRoot);
+  if (!matrix) return null;
+  const changedSet = new Set(allChangedFiles);
+  const findings = [];
+  for (const changedFile of changedFiles) {
+    const fileCommits = matrix.commitsByFile.get(changedFile);
+    if (!fileCommits || fileCommits.size < MIN_FILE_COMMITS) continue;
+    for (const [partner, partnerCommits] of matrix.commitsByFile) {
+      if (partner === changedFile || changedSet.has(partner)) continue;
+      let shared = 0;
+      for (const c of fileCommits) {
+        if (partnerCommits.has(c)) shared++;
+      }
+      if (shared < MIN_SHARED_COMMITS) continue;
+      const rate = shared / fileCommits.size;
+      if (rate < MIN_COCHANGE_RATE) continue;
+      if (!await existsOnDisk(partner)) continue;
+      findings.push({
+        changedFile,
+        missingPartner: partner,
+        sharedCommits: shared,
+        fileCommits: fileCommits.size,
+        rate: Math.round(rate * 100) / 100
+      });
+    }
+  }
+  findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
+  return findings;
+}
+var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var init_cochange = __esm({
+  "src/review/cochange.ts"() {
+    "use strict";
+    exec9 = promisify11(execFile11);
+    HISTORY_COMMITS = 1500;
+    MIN_FILE_COMMITS = 5;
+    MIN_SHARED_COMMITS = 4;
+    MIN_COCHANGE_RATE = 0.6;
+    MAX_COMMIT_FILES = 30;
+  }
+});
+
+// src/review/evidence/paths.ts
+function evidencePath(value, sourceRoot, uri = false) {
+  if (value.length > 4e3) return null;
+  let file = value;
+  try {
+    if (uri) {
+      if (file.startsWith("file:")) {
+        const url = new URL(file);
+        if (url.hostname && url.hostname !== "localhost") return null;
+        file = decodeURIComponent(url.pathname).replace(/^\/([A-Za-z]:\/)/, "$1");
+      } else {
+        if (/^[a-z][a-z0-9+.-]*:/i.test(file)) return null;
+        file = decodeURIComponent(file);
+      }
+    }
+  } catch {
+    return null;
+  }
+  file = file.replace(/\\/g, "/");
+  const root = sourceRoot.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (file.startsWith("/") || /^[A-Za-z]:/.test(file)) {
+    if (!file.startsWith(root + "/")) return null;
+    file = file.slice(root.length + 1);
+  }
+  return normalizeRepoPath(file);
+}
+var init_paths2 = __esm({
+  "src/review/evidence/paths.ts"() {
+    "use strict";
+    init_paths();
+  }
+});
 
 // src/review/evidence/types.ts
 function messagePreview(message2) {
@@ -3353,7 +3622,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -3402,24 +3671,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count2 = z12.number().int().nonnegative();
-    schema = z12.object({
-      success: z12.boolean(),
+    count2 = z13.number().int().nonnegative();
+    schema = z13.object({
+      success: z13.boolean(),
       numTotalTests: count2,
       numPassedTests: count2,
       numFailedTests: count2,
       numPendingTests: count2,
       numTodoTests: count2,
       numFailedTestSuites: count2,
-      testResults: z12.array(z12.object({
-        name: z12.string().min(1),
-        status: z12.enum(["passed", "failed"]),
-        message: z12.string().optional(),
-        assertionResults: z12.array(z12.object({
-          fullName: z12.string(),
-          status: z12.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z12.array(z12.string()).nullable().optional(),
-          location: z12.object({ line: count2, column: count2 }).nullable().optional()
+      testResults: z13.array(z13.object({
+        name: z13.string().min(1),
+        status: z13.enum(["passed", "failed"]),
+        message: z13.string().optional(),
+        assertionResults: z13.array(z13.object({
+          fullName: z13.string(),
+          status: z13.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z13.array(z13.string()).nullable().optional(),
+          location: z13.object({ line: count2, column: count2 }).nullable().optional()
         }))
       }))
     });
@@ -3427,7 +3696,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -3518,29 +3787,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z13.number().int().nonnegative();
-    artifact = z13.object({ uri: z13.string().optional(), uriBaseId: z13.string().optional(), index: index.optional() });
-    message = z13.object({ text: z13.string().optional(), markdown: z13.string().optional(), id: z13.string().optional(), arguments: z13.array(z13.string()).optional() });
-    level = z13.enum(["error", "warning", "note", "none"]);
-    location = z13.object({ physicalLocation: z13.object({ artifactLocation: artifact.optional(), region: z13.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z13.object({
-      version: z13.literal("2.1.0"),
-      runs: z13.array(z13.object({
-        tool: z13.object({ driver: z13.object({ name: z13.string().min(1), rules: z13.array(z13.object({ id: z13.string(), defaultConfiguration: z13.object({ level: level.optional() }).optional(), messageStrings: z13.record(message).optional() })).optional(), globalMessageStrings: z13.record(message).optional() }) }),
-        invocations: z13.array(z13.object({ executionSuccessful: z13.boolean(), commandLine: z13.string().optional(), toolExecutionNotifications: z13.array(z13.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z13.array(z13.object({ revisionId: z13.string().optional() })).optional(),
-        originalUriBaseIds: z13.record(artifact).optional(),
-        artifacts: z13.array(z13.object({ location: artifact.optional() })).optional(),
-        results: z13.array(z13.object({
-          ruleId: z13.string().optional(),
+    index = z14.number().int().nonnegative();
+    artifact = z14.object({ uri: z14.string().optional(), uriBaseId: z14.string().optional(), index: index.optional() });
+    message = z14.object({ text: z14.string().optional(), markdown: z14.string().optional(), id: z14.string().optional(), arguments: z14.array(z14.string()).optional() });
+    level = z14.enum(["error", "warning", "note", "none"]);
+    location = z14.object({ physicalLocation: z14.object({ artifactLocation: artifact.optional(), region: z14.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z14.object({
+      version: z14.literal("2.1.0"),
+      runs: z14.array(z14.object({
+        tool: z14.object({ driver: z14.object({ name: z14.string().min(1), rules: z14.array(z14.object({ id: z14.string(), defaultConfiguration: z14.object({ level: level.optional() }).optional(), messageStrings: z14.record(message).optional() })).optional(), globalMessageStrings: z14.record(message).optional() }) }),
+        invocations: z14.array(z14.object({ executionSuccessful: z14.boolean(), commandLine: z14.string().optional(), toolExecutionNotifications: z14.array(z14.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z14.array(z14.object({ revisionId: z14.string().optional() })).optional(),
+        originalUriBaseIds: z14.record(artifact).optional(),
+        artifacts: z14.array(z14.object({ location: artifact.optional() })).optional(),
+        results: z14.array(z14.object({
+          ruleId: z14.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z13.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z13.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z13.array(z13.object({ kind: z13.enum(["inSource", "external"]), status: z13.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z13.array(location).optional(),
-          relatedLocations: z13.array(location).optional()
+          kind: z14.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z14.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z14.array(z14.object({ kind: z14.enum(["inSource", "external"]), status: z14.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z14.array(location).optional(),
+          relatedLocations: z14.array(location).optional()
         })).optional()
       }))
     });
@@ -3548,10 +3817,10 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence.ts
-import path18 from "path";
-import { z as z14 } from "zod";
+import path19 from "path";
+import { z as z15 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path18.isAbsolute(file) ? path18.relative(root, file) : file;
+  const relative = path19.isAbsolute(file) ? path19.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -3590,7 +3859,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z14.object({ version: z14.literal(1), checks: z14.array(z14.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z15.object({ version: z15.literal(1), checks: z15.array(z15.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -3647,7 +3916,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path18.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path19.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -3743,31 +4012,31 @@ var init_evidence2 = __esm({
     init_vitest();
     init_sarif();
     init_types2();
-    checkSchema2 = z14.object({
-      id: z14.string().min(1).max(100),
-      kind: z14.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
-      tool: z14.string().min(1).max(200),
-      command: z14.string().min(1).max(2e3),
-      commit: z14.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z14.boolean().optional(),
-      source: z14.string().max(2e3).optional(),
-      sourceRoot: z14.string().min(1).max(4e3).optional(),
-      status: z14.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z14.string().min(1).max(2e3).optional(),
-      exitCode: z14.number().int().nullable().optional(),
-      report: z14.object({ format: z14.enum(["vitest-json", "sarif"]), path: z14.string().min(1).max(4e3) }).optional()
+    checkSchema2 = z15.object({
+      id: z15.string().min(1).max(100),
+      kind: z15.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z15.string().min(1).max(200),
+      command: z15.string().min(1).max(2e3),
+      commit: z15.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z15.boolean().optional(),
+      source: z15.string().max(2e3).optional(),
+      sourceRoot: z15.string().min(1).max(4e3).optional(),
+      status: z15.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z15.string().min(1).max(2e3).optional(),
+      exitCode: z15.number().int().nullable().optional(),
+      report: z15.object({ format: z15.enum(["vitest-json", "sarif"]), path: z15.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
-import fs14 from "fs/promises";
-import path19 from "path";
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import fs15 from "fs/promises";
+import path20 from "path";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec10("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -3778,7 +4047,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec10("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -3791,7 +4060,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -3820,589 +4089,158 @@ async function computeReview(rootDir, base, options = {}) {
       if (report.evidence.status === "passed") report.evidence.status = "incomplete";
     }
   }
-  const finalize = async () => {
-    if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
-      report.evidence.diagnostics.push("HEAD changed during the review; rerun to obtain consistent change and knowledge associations.");
-      for (const check of report.evidence.checks) check.freshness = "unknown";
-      report.evidence.summary.stale = 0;
-      report.evidence.summary.unknown = report.evidence.checks.length;
-      if (report.evidence.status !== "unavailable") report.evidence.status = "incomplete";
-    }
-    return report;
-  };
-  if (changedFiles.length === 0) return finalize();
-  let analyzed = changedFiles;
-  if (changedFiles.length > MAX_ANALYZED_FILES) {
-    analyzed = changedFiles.slice(0, MAX_ANALYZED_FILES);
-    report.truncated = true;
-  }
-  const partners = await findMissingPartners(
-    resolvedRoot,
-    analyzed,
-    async (relPath) => {
-      try {
-        await fs14.access(path19.join(resolvedRoot, relPath));
-        return true;
-      } catch {
-        return false;
-      }
-    },
-    changedFiles
-  );
-  if (partners === null) {
-    report.historyAvailable = false;
-  } else {
-    report.missingPartners = partners;
-  }
-  const decisions = store.records;
-  for (const record of decisions) {
-    if (record.status !== "active") continue;
-    const effective = effectiveDecision(record);
-    const touched = anchorsTouched(effective, changedFiles);
-    const proposalTouched = effective !== record ? anchorsTouched(record, changedFiles) : [];
-    if (touched.length > 0 || proposalTouched.length > 0) {
-      const { pendingProposal, ...knowledge } = decisionKnowledge(record, decisionDrift.freshness?.[record.id] ?? "unknown", decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown");
-      report.touchedDecisions.push({
-        ...knowledge,
-        ...pendingProposal ? { pendingProposal: { ...pendingProposal, touchedFiles: proposalTouched } } : {},
-        id: record.id,
-        anchors: effective.files,
-        freshness: decisionDrift.freshness?.[record.id] ?? "unknown",
-        touchedFiles: touched
-      });
-    }
-  }
-  return finalize();
-}
-var exec9, MAX_ANALYZED_FILES;
-var init_review = __esm({
-  "src/review/review.ts"() {
-    "use strict";
-    init_drift();
-    init_provenance();
-    init_decisions();
-    init_paths();
-    init_drift2();
-    init_cochange();
-    init_evidence2();
-    init_snapshot();
-    exec9 = promisify10(execFile10);
-    MAX_ANALYZED_FILES = 50;
-  }
-});
-
-// src/mcp/onboarding.ts
-async function auditSummary(root) {
-  try {
-    const report = await computeAudit(root);
-    if (!report) return { status: "no-context-files", reason: "No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md found to audit." };
-    if (!report.gitAvailable) return { status: "unavailable", reason: "Audit needs readable Git history to verify documentation claims.", docs: report.docs };
-    return {
-      ...report,
-      status: "complete",
-      issues: report.issues.slice(0, MAX_FINDINGS2),
-      advisories: report.advisories.slice(0, MAX_FINDINGS2),
-      suppressedAdvisories: (report.suppressedAdvisories ?? []).slice(0, MAX_FINDINGS2),
-      counts: {
-        issues: report.issues.length,
-        advisories: report.advisories.length,
-        suppressedAdvisories: report.suppressedAdvisories?.length ?? 0
-      },
-      truncated: report.issues.length > MAX_FINDINGS2 || report.advisories.length > MAX_FINDINGS2 || (report.suppressedAdvisories?.length ?? 0) > MAX_FINDINGS2
-    };
-  } catch (error) {
-    return { status: "unavailable", reason: reason(error) };
-  }
-}
-async function reviewSummary(root, requestedBase, evidence) {
-  const workingTree = await getWorkingTree(root);
-  const scope = "committed";
-  try {
-    const base = requestedBase ?? await defaultBase(root);
-    if (!base) return { status: "unavailable", scope, workingTree, reason: "No default review base resolves. Pass base to mason_init, or run mason-review --base <ref>." };
-    const report = await computeReview(root, base, { evidence });
-    if (!report) return { status: "unavailable", scope, base, workingTree, reason: "The review base, merge base, or committed diff could not be read." };
-    return {
-      ...report,
-      scope,
-      workingTree,
-      ...report.evidence ? { evidence: summarizeEvidence(report.evidence) } : {},
-      status: !report.historyAvailable ? "unavailable" : report.changedFiles.length ? "complete" : "no-changes",
-      ...!report.historyAvailable ? { reason: "Co-change history could not be read; review findings are incomplete." } : {},
-      changedFiles: report.changedFiles.slice(0, MAX_FINDINGS2),
-      missingPartners: report.missingPartners.slice(0, MAX_FINDINGS2),
-      touchedDecisions: report.touchedDecisions.slice(0, MAX_FINDINGS2),
-      counts: { changedFiles: report.changedFiles.length, missingPartners: report.missingPartners.length, touchedDecisions: report.touchedDecisions.length },
-      truncated: report.truncated || [report.changedFiles, report.missingPartners, report.touchedDecisions].some((list) => list.length > MAX_FINDINGS2),
-      hint: "Reviews cover merge-base..HEAD. Uncommitted paths are reported separately in workingTree; they have not been reviewed."
-    };
-  } catch (error) {
-    return { status: "unavailable", scope, workingTree, reason: reason(error) };
-  }
-}
-async function inspectOnboarding(root, base, evidence) {
-  const [audit, review, map, decisions] = await Promise.all([
-    auditSummary(root),
-    reviewSummary(root, base, evidence),
-    inspectSnapshot(root),
-    loadDecisionStore(root)
-  ]);
-  return {
-    audit,
-    review,
-    map: { status: map.status },
-    decisions: {
-      active: decisions.records.filter((record) => record.status === "active").length,
-      ...Object.fromEntries(["accepted", "proposed", "unreviewed"].map((approval) => [approval, decisions.records.filter((record) => record.status === "active" && decisionApproval(effectiveDecision(record)) === approval).length])),
-      pendingProposals: decisions.records.filter((record) => effectiveDecision(record) !== record).length
-    },
-    diagnostics: [...map.diagnostics, ...decisions.diagnostics]
-  };
-}
-var MAX_FINDINGS2, reason;
-var init_onboarding = __esm({
-  "src/mcp/onboarding.ts"() {
-    "use strict";
-    init_audit();
-    init_review();
-    init_drift();
-    init_snapshot();
-    init_provenance();
-    init_evidence2();
-    init_decisions();
-    MAX_FINDINGS2 = 20;
-    reason = (error) => error instanceof Error ? error.message : String(error);
-  }
-});
-
-// src/setup/files.ts
-import fs15 from "fs/promises";
-import path20 from "path";
-import { randomUUID as randomUUID5 } from "crypto";
-async function readText(root, file) {
-  try {
-    const text2 = await readBoundedFile(await storePath(root, file), 2 * 1024 * 1024);
-    if (text2 === null) throw new Error("Setup input is not a regular file or exceeds 2 MiB: " + file);
-    return text2;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function managedBlock(text2, start, end, body) {
-  const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
-  if (starts !== ends || starts > 1 || starts === 1 && text2.indexOf(end) < text2.indexOf(start)) {
-    throw new Error("Ambiguous Mason instruction/configuration markers; repair the marked block before setup.");
-  }
-  const eol = text2.includes("\r\n") ? "\r\n" : "\n";
-  const block = [start, body.replace(/\r?\n/g, eol), end].join(eol);
-  if (starts) return text2.slice(0, text2.indexOf(start)) + block + text2.slice(text2.indexOf(end) + end.length);
-  return text2 + (text2.length && !text2.endsWith("\n") ? eol : "") + (text2.length ? eol : "") + block + eol;
-}
-async function applyEdit(root, edit) {
-  const current = await readText(root, edit.path);
-  if (current === edit.after) return false;
-  if (current !== edit.before) throw new Error("Setup input changed during installation: " + edit.path + ". Rerun setup to resume.");
-  const file = await storePath(root, edit.path, true);
-  const temporary = path20.join(path20.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
-  try {
-    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs15.open(temporary, "wx", mode);
-    try {
-      await handle.writeFile(edit.after, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    if (await readText(root, edit.path) !== edit.before) throw new Error("Setup input changed during installation: " + edit.path);
-    await fs15.rename(temporary, file);
-    return true;
-  } finally {
-    await fs15.rm(temporary, { force: true });
-  }
-}
-var init_files2 = __esm({
-  "src/setup/files.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-  }
-});
-
-// src/setup/launcher.ts
-var BOOTSTRAP, POWERSHELL_BOOTSTRAP, mcpCommand, hookCommand, SHELL_LAUNCHER, POWERSHELL_LAUNCHER, LAUNCHER;
-var init_launcher = __esm({
-  "src/setup/launcher.ts"() {
-    "use strict";
-    BOOTSTRAP = "require(require('node:path').join(require('node:child_process').execFileSync('git',['rev-parse','--show-toplevel'],{encoding:'utf8'}).trim(),'.mason','run.cjs'))";
-    POWERSHELL_BOOTSTRAP = "& (Join-Path (git rev-parse --show-toplevel) '.mason/run.ps1')";
-    mcpCommand = (host, runtime) => !runtime?.bundle ? { command: "node", args: ["-e", BOOTSTRAP, "--", host, "mcp"] } : process.platform === "win32" ? { command: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", POWERSHELL_BOOTSTRAP, host, "mcp"] } : { command: "sh", args: ["-c", 'exec sh "$(git rev-parse --show-toplevel)/.mason/run.sh" "$@"', "mason", host, "mcp"] };
-    hookCommand = (host, runtime) => !runtime?.bundle ? `node -e "${BOOTSTRAP}" -- ${host} auto` : process.platform === "win32" ? `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "${POWERSHELL_BOOTSTRAP} ${host} auto"` : `sh "$(git rev-parse --show-toplevel)/.mason/run.sh" ${host} auto`;
-    SHELL_LAUNCHER = `#!/bin/sh
-set -eu
-advisory=0
-if [ "\${2-}" = auto ] && [ "\${3-}" = hook ]; then advisory=1; fi
-fail() {
-  if [ "$advisory" -eq 1 ]; then printf '%s\\n' '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0; fi
-  echo 'Mason runtime unavailable. Rerun mason setup for this checkout.' >&2; exit 2
-}
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) || fail
-case "\${1-}" in codex|claude) ;; *) fail ;; esac
-pointer="$root/.mason/runtime/$1.txt"
-[ -f "$pointer" ] || fail
-runtime=$(cat "$pointer") || fail
-case "$runtime" in ''|*[!0-9a-f]*) fail ;; esac
-[ "\${#runtime}" -eq 24 ] || fail
-[ -x "$root/.mason/runtime/$runtime/node" ] || fail
-if [ "$advisory" -eq 1 ]; then
-  "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@" || fail
-else
-  exec "$root/.mason/runtime/$runtime/node" "$root/.mason/run.cjs" "$@"
-fi
-`;
-    POWERSHELL_LAUNCHER = `# Managed by mason setup; no system Node installation is used.
-$ErrorActionPreference = 'Stop'
-$advisory = $args.Count -ge 3 -and $args[1] -eq 'auto' -and $args[2] -eq 'hook'
-try {
-  if ($args.Count -lt 2 -or $args[0] -notin @('codex','claude')) { throw 'Invalid Mason host.' }
-  $runtime = (Get-Content -LiteralPath (Join-Path $PSScriptRoot ('runtime/' + $args[0] + '.txt')) -Raw).Trim()
-  if ($runtime -cnotmatch '^[a-f0-9]{24}$') { throw 'Invalid Mason runtime pointer.' }
-  & (Join-Path $PSScriptRoot ('runtime/' + $runtime + '/node.exe')) (Join-Path $PSScriptRoot 'run.cjs') @args
-  if ($LASTEXITCODE -ne 0) { throw 'Mason runtime failed.' }
-} catch {
-  if ($advisory) { Write-Output '{"systemMessage":"Mason runtime unavailable. Rerun mason setup for this checkout; verification was not established."}'; exit 0 }
-  [Console]::Error.WriteLine($_.Exception.Message); exit 2
-}
-`;
-    LAUNCHER = `// Managed by mason-auto setup. Rerun setup to install this checkout's pinned runtime.
-const fs = require('node:fs');
-const path = require('node:path');
-const {pathToFileURL} = require('node:url');
-const launchArgs = process.argv.slice(process.argv[1] && path.resolve(process.argv[1]) === __filename ? 2 : 1);
-(async () => {
-  const root = path.dirname(__dirname);
-  const args = launchArgs;
-  const [host, command, ...rest] = args;
-  if (!['codex','claude'].includes(host) || !['auto','mcp'].includes(command)) throw new Error('Invalid Mason launcher arguments.');
-  const setup = JSON.parse(fs.readFileSync(path.join(__dirname, 'setup.json'), 'utf8'));
-  const entry = setup.hosts?.[host];
-  if (setup.version !== 1 || !entry || !/^[a-f0-9]{24}$/.test(entry.runtime?.id)) throw new Error('Mason is not configured for this host. Rerun mason-auto setup.');
-  const base = path.join(__dirname, 'runtime', entry.runtime.id);
-  if (entry.runtime.bundle) {
-    const node = process.platform === 'win32' ? 'node.exe' : 'node';
-    if (fs.realpathSync(process.execPath) !== fs.realpathSync(path.join(base, node))) throw new Error('Mason runtime pointer differs from the configured version. Rerun setup.');
-  }
-  const binary = entry.runtime.bundle ? path.join(base, 'app', 'dist', 'mason-' + command + '.js')
-    : path.join(base, 'node_modules', 'mason-context', 'dist', 'mason-' + command + '.js');
-  if (!fs.existsSync(binary)) throw new Error('The pinned Mason runtime is missing in this checkout. Rerun mason-auto setup --host ' + host + '.');
-  process.env.MASON_SETUP_ROOT = root;
-  process.env.MASON_SETUP_HOST = host;
-  process.env.MASON_SETUP_REVISION = entry.revision;
-  process.argv = [process.execPath, binary, ...rest];
-  await import(pathToFileURL(binary).href);
-})().catch(error => {
-  const message = 'Mason setup unavailable: ' + error.message;
-  if (launchArgs[1] === 'auto' && launchArgs[2] === 'hook') { console.log(JSON.stringify({systemMessage: message})); process.exitCode = 0; }
-  else { console.error(message); process.exitCode = 2; }
-});
-`;
-  }
-});
-
-// src/setup/config.ts
-import { isDeepStrictEqual } from "util";
-import { parse, stringify } from "smol-toml";
-import { z as z15 } from "zod";
-async function instructionEdits(root, host) {
-  const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
-  const existing = found.find((f) => f.text !== null);
-  const primary = host === "codex" && found[0].text === null ? { path: "AGENTS.md", text: null } : existing ?? { path: "AGENTS.md", text: null };
-  const originalGuidance = primary.text === null && existing ? "Follow the existing project conventions in " + existing.path + ".\n" : "";
-  const edits = [{
-    path: primary.path,
-    before: primary.text,
-    after: managedBlock(primary.text ?? originalGuidance, "<!-- mason:start -->", "<!-- mason:end -->", CLAUDE_MD_SECTION.split("\n").slice(1, -1).join("\n"))
-  }];
-  if (primary.path === "AGENTS.md") {
-    const secondary = found.filter((f) => f.path !== "AGENTS.md" && f.text !== null);
-    if (host === "claude" && !secondary.length) secondary.push({ path: "CLAUDE.md", text: null });
-    for (const file of secondary) {
-      const text2 = file.text ?? "";
-      const legacy = text2.includes("<!-- mason:start -->") || text2.includes("<!-- mason:end -->");
-      const imported = "@" + (file.path.startsWith(".claude/") ? "../AGENTS.md" : "AGENTS.md");
-      if (text2.trim() === imported) continue;
-      const pointer = "Mason project knowledge and shared project instructions:\n" + imported;
-      edits.push({
-        path: file.path,
-        before: file.text,
-        after: managedBlock(text2, legacy ? "<!-- mason:start -->" : POINTER_START, legacy ? "<!-- mason:end -->" : POINTER_END, pointer)
-      });
-    }
-  }
-  return edits;
-}
-function managedMcp(previous, host, runtime) {
-  const options = previous === void 0 ? {} : object.parse(previous);
-  for (const key of ["command", "args", "url", "type", "headers", "http_headers", "env_http_headers", "bearer_token_env_var"]) delete options[key];
-  return { ...options, ...mcpCommand(host, runtime) };
-}
-async function mcpEdit(root, host, runtime) {
-  const file = mcpPath(host), before = await readText(root, file);
-  if (host === "claude") {
-    const config2 = before === null ? {} : object.parse(JSON.parse(before));
-    const servers2 = object.parse(config2.mcpServers ?? {});
-    return { path: file, before, after: JSON.stringify({ ...config2, mcpServers: { ...servers2, mason: managedMcp(servers2.mason, host, runtime) } }, null, 2) + "\n" };
-  }
-  const config = parse(before ?? "");
-  const managed = (before ?? "").includes(TOML_START);
-  const servers = config.mcp_servers;
-  const desired = managedMcp(servers?.mason, host, runtime);
-  let base = before ?? "";
-  if (servers?.mason && !managed) {
-    const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
-    const spans = headers.flatMap((header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []);
-    if (!spans.length) throw new Error("Cannot safely migrate the existing Mason MCP TOML entry. Use an explicit [mcp_servers.mason] table and rerun setup; the file was retained.");
-    for (const span of spans.reverse()) base = base.slice(0, span.start) + base.slice(span.end);
-  }
-  const after = managedBlock(base, TOML_START, TOML_END, stringify({ mcp_servers: { mason: desired } }).trimEnd());
-  const parsed = parse(after);
-  const expected = { ...config, mcp_servers: { ...servers ?? {}, mason: desired } };
-  if (!isDeepStrictEqual(parsed, expected)) throw new Error("Could not safely configure the Mason MCP entry without changing other settings.");
-  return { path: file, before, after };
-}
-async function hookEdits(root, host, runtime) {
-  const file = configPath(host), before = await readText(root, file);
-  const { planAutomationInstall: planAutomationInstall2 } = await Promise.resolve().then(() => (init_install(), install_exports));
-  const plan = await planAutomationInstall2(root, host, hookCommand(host, runtime));
-  return [
-    { path: file, before, after: JSON.stringify(plan.config, null, 2) + "\n" },
-    { path: ".mason/automation.json", before: await readText(root, ".mason/automation.json"), after: JSON.stringify(plan.record, null, 2) + "\n" }
-  ];
-}
-async function ancillaryEdits(root) {
-  const ignore = await readText(root, ".gitignore");
-  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-  let parentIgnored = false;
-  try {
-    parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
-  } catch (error) {
-    if (error.code !== 1) throw error;
-  }
-  const retainParentRule = parentIgnored || !!ignore?.replace(/\r\n/g, "\n").includes("# mason:ignore:start\n!/.mason/\n/.mason/*");
-  const rules = [...retainParentRule ? ["!/.mason/", "/.mason/*"] : [], "!/.mason/decisions/", "!/.mason/decisions/**", "!/.mason/setup.json", "!/.mason/automation.json", "!/.mason/project.json", "!/.mason/run.cjs", "!/.mason/run.sh", "!/.mason/run.ps1", "/.mason/reports/", "/.mason/runtime/"].join("\n");
-  return [
-    { path: ".gitignore", before: ignore, after: managedBlock(ignore ?? "", "# mason:ignore:start", "# mason:ignore:end", rules) },
-    { path: ".mason/run.cjs", before: await readText(root, ".mason/run.cjs"), after: LAUNCHER },
-    { path: ".mason/run.sh", before: await readText(root, ".mason/run.sh"), after: SHELL_LAUNCHER },
-    { path: ".mason/run.ps1", before: await readText(root, ".mason/run.ps1"), after: POWERSHELL_LAUNCHER }
-  ];
-}
-async function inspectHostConfig(root, host, plannedMcp, runtime) {
-  const text2 = plannedMcp ?? await readText(root, mcpPath(host));
-  const config = host === "codex" ? parse(text2 ?? "") : object.parse(JSON.parse(text2 ?? "{}"));
-  const servers = host === "codex" ? config.mcp_servers : config.mcpServers;
-  const hooks = automationConfigSchema.parse(JSON.parse(await readText(root, configPath(host)) ?? "{}"));
-  const expected = hookConfig(host, hookCommand(host, runtime));
-  const mcp = servers?.mason === void 0 ? null : object.parse(servers.mason);
-  return {
-    mcp,
-    mcpDisabled: mcp?.enabled === false,
-    hooks: Object.fromEntries(Object.keys(expected.hooks).map((event) => [
-      event,
-      (hooks.hooks?.[event] ?? []).flatMap((group) => group.hooks.filter((handler) => handler.command === expected.hooks.SessionStart[0].hooks[0].command).map((handler) => ({ ...group, hooks: [handler] })) ?? [])
-    ])),
-    disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
-  };
-}
-var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
-var init_config = __esm({
-  "src/setup/config.ts"() {
-    "use strict";
-    init_init();
-    init_docs();
-    init_adapters();
-    init_install();
-    init_files2();
-    init_launcher();
-    object = z15.record(z15.unknown());
-    mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
-    TOML_START = "# mason:mcp:start";
-    TOML_END = "# mason:mcp:end";
-    POINTER_START = "<!-- mason:agents:start -->";
-    POINTER_END = "<!-- mason:agents:end -->";
-  }
-});
-
-// src/distribution/bundle.ts
-import fs16 from "fs/promises";
-import path21 from "path";
-import { createHash as createHash4 } from "crypto";
-import { z as z16 } from "zod";
-async function readBundle(root) {
-  const bytes = await fs16.readFile(await storePath(root, "bundle.json"));
-  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
-  const windows = manifest.target.startsWith("win32-");
-  for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
-      throw new Error("Unsafe path in Mason bundle: " + file);
+  const finalize = async () => {
+    if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
+      report.evidence.diagnostics.push("HEAD changed during the review; rerun to obtain consistent change and knowledge associations.");
+      for (const check of report.evidence.checks) check.freshness = "unknown";
+      report.evidence.summary.stale = 0;
+      report.evidence.summary.unknown = report.evidence.checks.length;
+      if (report.evidence.status !== "unavailable") report.evidence.status = "incomplete";
     }
+    return report;
+  };
+  if (changedFiles.length === 0) return finalize();
+  let analyzed = changedFiles;
+  if (changedFiles.length > MAX_ANALYZED_FILES) {
+    analyzed = changedFiles.slice(0, MAX_ANALYZED_FILES);
+    report.truncated = true;
   }
-  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
-    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  const partners = await findMissingPartners(
+    resolvedRoot,
+    analyzed,
+    async (relPath) => {
+      try {
+        await fs15.access(path20.join(resolvedRoot, relPath));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    changedFiles
+  );
+  if (partners === null) {
+    report.historyAvailable = false;
+  } else {
+    report.missingPartners = partners;
   }
-  return { manifest, manifestHash: sha256(bytes) };
-}
-async function verifyBundle(root, expectedHash) {
-  const bundle = await readBundle(root);
-  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
-  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
-  const files = Object.keys(bundle.manifest.files);
-  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs16.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
-  }));
-  return bundle;
+  const decisions = store.records;
+  for (const record of decisions) {
+    if (record.status !== "active") continue;
+    const effective = effectiveDecision(record);
+    const touched = anchorsTouched(effective, changedFiles);
+    const proposalTouched = effective !== record ? anchorsTouched(record, changedFiles) : [];
+    if (touched.length > 0 || proposalTouched.length > 0) {
+      const { pendingProposal, ...knowledge } = decisionKnowledge(record, decisionDrift.freshness?.[record.id] ?? "unknown", decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown");
+      report.touchedDecisions.push({
+        ...knowledge,
+        ...pendingProposal ? { pendingProposal: { ...pendingProposal, touchedFiles: proposalTouched } } : {},
+        id: record.id,
+        anchors: effective.files,
+        freshness: decisionDrift.freshness?.[record.id] ?? "unknown",
+        touchedFiles: touched
+      });
+    }
+  }
+  return finalize();
 }
-var targets, digest2, bundleSchema, sha256;
-var init_bundle = __esm({
-  "src/distribution/bundle.ts"() {
+var exec10, MAX_ANALYZED_FILES;
+var init_review = __esm({
+  "src/review/review.ts"() {
     "use strict";
-    init_storage();
-    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z16.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z16.object({
-      format: z16.literal(1),
-      version: z16.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z16.enum(targets),
-      nodeVersion: z16.string(),
-      files: z16.record(digest2)
-    }).strict();
-    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+    init_drift();
+    init_provenance();
+    init_decisions();
+    init_paths();
+    init_drift2();
+    init_cochange();
+    init_evidence2();
+    init_snapshot();
+    exec10 = promisify12(execFile12);
+    MAX_ANALYZED_FILES = 50;
   }
 });
 
-// src/setup/runtime.ts
-var runtime_exports = {};
-__export(runtime_exports, {
-  installRuntime: () => installRuntime,
-  sourceRuntime: () => sourceRuntime,
-  verifyRuntime: () => verifyRuntime
-});
-import fs17 from "fs/promises";
-import path22 from "path";
-import { fileURLToPath } from "url";
-import { randomUUID as randomUUID6, createHash as createHash5 } from "crypto";
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
-async function packageRoot() {
-  let directory = path22.dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 8; i++) {
-    try {
-      const pkg = JSON.parse(await fs17.readFile(path22.join(directory, "package.json"), "utf8"));
-      if (pkg.name === "mason-context") return directory;
-    } catch {
-    }
-    directory = path22.dirname(directory);
-  }
-  throw new Error("Cannot locate the executing Mason distribution. Reinstall Mason and rerun setup.");
-}
-async function sourceRuntime() {
-  const source = await packageRoot();
-  const pkg = JSON.parse(await fs17.readFile(path22.join(source, "package.json"), "utf8"));
-  const hashes = Object.fromEntries(await Promise.all(BINARIES.map(async (file) => [file, checksum(await fs17.readFile(path22.join(source, file)))])));
-  const bundleRoot = path22.dirname(source);
-  const bundleExists = await fs17.lstat(path22.join(bundleRoot, "bundle.json")).then(() => true, (error) => {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  });
-  if (bundleExists) {
-    const { manifest, manifestHash } = await verifyBundle(bundleRoot);
-    if (manifest.version !== pkg.version) throw new Error("Mason package and bundle versions differ.");
-    return { source, bundleRoot, runtime: runtimeSchema.parse({
-      id: manifestHash.slice(0, 24),
-      version: pkg.version,
-      hashes,
-      bundle: { target: manifest.target, manifestHash }
-    }) };
-  }
-  return { source, runtime: runtimeSchema.parse({ id: hash([pkg.version, pkg.dependencies, hashes]).slice(0, 24), version: pkg.version, hashes }) };
-}
-async function verifyRuntime(root, runtime) {
+// src/mcp/onboarding.ts
+async function auditSummary(root) {
   try {
-    const saved = await readStoreJson(root, `.mason/runtime/${runtime.id}/receipt.json`);
-    if (JSON.stringify(saved) !== JSON.stringify(runtime)) return false;
-    if (runtime.bundle) {
-      const base2 = await storePath(root, `.mason/runtime/${runtime.id}`);
-      const { manifest } = await verifyBundle(base2, runtime.bundle.manifestHash);
-      if (manifest.version !== runtime.version || manifest.target !== runtime.bundle.target) return false;
-      for (const file of BINARIES) if (manifest.files["app/" + file] !== runtime.hashes[file]) return false;
-      return true;
-    }
-    const base = `.mason/runtime/${runtime.id}/node_modules/mason-context/`;
-    const pkg = await readStoreJson(root, base + "package.json");
-    if (pkg?.name !== "mason-context" || pkg.version !== runtime.version) return false;
-    for (const file of BINARIES) {
-      if (checksum(await fs17.readFile(await storePath(root, base + file))) !== runtime.hashes[file]) return false;
-    }
-    return true;
-  } catch {
-    return false;
+    const report = await computeAudit(root);
+    if (!report) return { status: "no-context-files", reason: "No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md found to audit." };
+    if (!report.gitAvailable) return { status: "unavailable", reason: "Audit needs readable Git history to verify documentation claims.", docs: report.docs };
+    return {
+      ...report,
+      status: "complete",
+      issues: report.issues.slice(0, MAX_FINDINGS2),
+      advisories: report.advisories.slice(0, MAX_FINDINGS2),
+      suppressedAdvisories: (report.suppressedAdvisories ?? []).slice(0, MAX_FINDINGS2),
+      counts: {
+        issues: report.issues.length,
+        advisories: report.advisories.length,
+        suppressedAdvisories: report.suppressedAdvisories?.length ?? 0
+      },
+      truncated: report.issues.length > MAX_FINDINGS2 || report.advisories.length > MAX_FINDINGS2 || (report.suppressedAdvisories?.length ?? 0) > MAX_FINDINGS2
+    };
+  } catch (error) {
+    return { status: "unavailable", reason: reason(error) };
   }
 }
-async function installRuntime(root, selected) {
-  const { runtime, source } = selected;
-  if (await verifyRuntime(root, runtime)) return runtime;
-  const relative = `.mason/runtime/${runtime.id}`;
-  const target = await storePath(root, relative, true);
-  const stage = await storePath(root, ".mason/runtime/.install-" + randomUUID6(), true);
-  await fs17.mkdir(stage);
+async function reviewSummary(root, requestedBase, evidence) {
+  const workingTree = await getWorkingTree(root);
+  const scope = "committed";
   try {
-    if (runtime.bundle) {
-      if (!selected.bundleRoot) throw new Error("Standalone bundle source is missing.");
-      const { manifest } = await verifyBundle(selected.bundleRoot, runtime.bundle.manifestHash);
-      for (const file of ["bundle.json", ...Object.keys(manifest.files)]) {
-        const from = await storePath(selected.bundleRoot, file);
-        const to = await storePath(stage, file, true);
-        await fs17.copyFile(from, to);
-        await fs17.chmod(to, (await fs17.stat(from)).mode & 511);
-      }
-      await verifyBundle(stage, runtime.bundle.manifestHash);
-    } else {
-      const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-      const options = { timeout: 12e4, maxBuffer: 2 * 1024 * 1024, windowsHide: true };
-      const packed = JSON.parse((await exec10(npm, ["pack", "--ignore-scripts", "--json", "--pack-destination", stage], { ...options, cwd: source })).stdout);
-      const filename = packed[0]?.filename;
-      if (typeof filename !== "string" || path22.basename(filename) !== filename) throw new Error("npm did not produce a Mason package archive.");
-      await fs17.rename(path22.join(stage, filename), path22.join(stage, "mason.tgz"));
-      await fs17.writeFile(path22.join(stage, "package.json"), JSON.stringify({ name: "mason-project-runtime", private: true, version: "1.0.0" }));
-      await exec10(npm, ["install", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--save-exact", "./mason.tgz"], { ...options, cwd: stage });
-      for (const file of BINARIES) {
-        if (checksum(await fs17.readFile(path22.join(stage, "node_modules/mason-context", file))) !== runtime.hashes[file]) throw new Error("Installed Mason binary differs from the selected distribution.");
-      }
-    }
-    await fs17.writeFile(path22.join(stage, "receipt.json"), JSON.stringify(runtime, null, 2) + "\n");
-    try {
-      await fs17.rename(target, target + ".previous-" + randomUUID6());
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    await fs17.rename(stage, target);
-    if (!await verifyRuntime(root, runtime)) throw new Error("The installed Mason runtime could not be verified.");
-    return runtime;
-  } finally {
-    await fs17.rm(stage, { recursive: true, force: true });
+    const base = requestedBase ?? await defaultBase(root);
+    if (!base) return { status: "unavailable", scope, workingTree, reason: "No default review base resolves. Pass base to mason_init, or run mason-review --base <ref>." };
+    const report = await computeReview(root, base, { evidence });
+    if (!report) return { status: "unavailable", scope, base, workingTree, reason: "The review base, merge base, or committed diff could not be read." };
+    return {
+      ...report,
+      scope,
+      workingTree,
+      ...report.evidence ? { evidence: summarizeEvidence(report.evidence) } : {},
+      status: !report.historyAvailable ? "unavailable" : report.changedFiles.length ? "complete" : "no-changes",
+      ...!report.historyAvailable ? { reason: "Co-change history could not be read; review findings are incomplete." } : {},
+      changedFiles: report.changedFiles.slice(0, MAX_FINDINGS2),
+      missingPartners: report.missingPartners.slice(0, MAX_FINDINGS2),
+      touchedDecisions: report.touchedDecisions.slice(0, MAX_FINDINGS2),
+      counts: { changedFiles: report.changedFiles.length, missingPartners: report.missingPartners.length, touchedDecisions: report.touchedDecisions.length },
+      truncated: report.truncated || [report.changedFiles, report.missingPartners, report.touchedDecisions].some((list) => list.length > MAX_FINDINGS2),
+      hint: "Reviews cover merge-base..HEAD. Uncommitted paths are reported separately in workingTree; they have not been reviewed."
+    };
+  } catch (error) {
+    return { status: "unavailable", scope, workingTree, reason: reason(error) };
   }
 }
-var exec10, checksum, BINARIES;
-var init_runtime2 = __esm({
-  "src/setup/runtime.ts"() {
+async function inspectOnboarding(root, base, evidence) {
+  const [audit, review, map, decisions] = await Promise.all([
+    auditSummary(root),
+    reviewSummary(root, base, evidence),
+    inspectSnapshot(root),
+    loadDecisionStore(root)
+  ]);
+  return {
+    audit,
+    review,
+    map: { status: map.status },
+    decisions: {
+      active: decisions.records.filter((record) => record.status === "active").length,
+      ...Object.fromEntries(["accepted", "proposed", "unreviewed"].map((approval) => [approval, decisions.records.filter((record) => record.status === "active" && decisionApproval(effectiveDecision(record)) === approval).length])),
+      pendingProposals: decisions.records.filter((record) => effectiveDecision(record) !== record).length
+    },
+    diagnostics: [...map.diagnostics, ...decisions.diagnostics]
+  };
+}
+var MAX_FINDINGS2, reason;
+var init_onboarding = __esm({
+  "src/mcp/onboarding.ts"() {
     "use strict";
-    init_model();
-    init_storage();
-    init_evidence();
-    init_bundle();
-    exec10 = promisify11(execFile11);
-    checksum = (bytes) => createHash5("sha256").update(bytes).digest("hex");
-    BINARIES = ["dist/mason-auto.js", "dist/mason-mcp.js"];
+    init_audit();
+    init_review();
+    init_drift();
+    init_snapshot();
+    init_provenance();
+    init_evidence2();
+    init_decisions();
+    MAX_FINDINGS2 = 20;
+    reason = (error) => error instanceof Error ? error.message : String(error);
   }
 });
 
@@ -4430,34 +4268,32 @@ async function setupStatus(dir) {
     };
   }
   const hosts = {};
-  const commonLauncherCurrent = await readText(ws.root, ".mason/run.cjs") === LAUNCHER;
+  const installed = await installedCommand();
   const automation = await automationStatus(ws.root);
   for (const host of ["codex", "claude"]) {
     const entry = setup.hosts[host];
     if (!entry) continue;
-    const launcherCurrent = commonLauncherCurrent && (!entry.runtime.bundle || await readText(ws.root, ".mason/run.sh") === SHELL_LAUNCHER && await readText(ws.root, ".mason/run.ps1") === POWERSHELL_LAUNCHER && await readText(ws.root, `.mason/runtime/${host}.txt`) === entry.runtime.id + "\n");
     const instructions = await instructionEdits(ws.root, host);
     const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
-    const installed = await verifyRuntime(ws.root, entry.runtime);
-    const config = await inspectHostConfig(ws.root, host, void 0, entry.runtime);
-    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host, entry.runtime));
-    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host, entry.runtime)).hooks) && !config.disabled;
+    const config = await inspectHostConfig(ws.root, host, void 0);
+    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual2({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
+    const hooks = isDeepStrictEqual2(config.hooks, hookConfig(host, hookCommand(host)).hooks) && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
-    const observation = await readObservation(ws.root, ws.directory, host, entry.revision);
+    const observation = await readObservation(ws.root, ws.directory, host, entry.revision, installed.version ?? "unavailable");
     const sessions = Object.values(observation?.sessions ?? {}).sort((a, b) => b.at.localeCompare(a.at));
     const complete = sessions.find((session) => events.every((event) => session.events.includes(event)));
     const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
     const pending = [];
-    if (!installed || !launcherCurrent) pending.push("Install this checkout's pinned runtime by rerunning setup.");
+    if (!installed.available) pending.push(installed.message);
     if (!mcp || !hooks || !instructionsCurrent || !configured) pending.push("Rerun setup to reconcile project configuration; inspect any disabled host settings.");
     if (!observation?.contextCalls) pending.push("Start a new assistant session and request task context through Mason's get_context tool.");
     if (!complete) pending.push("Review/trust the host configuration, then complete a normal task to observe the full hook lifecycle.");
     if (automation.status === "unavailable") pending.push("The latest automation attempt did not establish verification. Run mason-auto check and inspect its diagnostics.");
-    const healthy = installed && launcherCurrent && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    const healthy = installed.available && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
     hosts[host] = {
       status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
-      runtime: installed && launcherCurrent ? "installed" : "missing-or-changed",
+      runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
       instructions: instructionsCurrent ? "current" : "changed",
       hookConfiguration: hooks ? "configured" : "disabled-or-changed",
@@ -4503,10 +4339,8 @@ var init_status = __esm({
     init_decisions();
     init_adapters();
     init_model();
-    init_runtime2();
     init_config();
     init_launcher();
-    init_files2();
     init_observations();
   }
 });
@@ -4518,7 +4352,7 @@ __export(setup_exports, {
   setupProject: () => setupProject,
   summarizeSetup: () => summarizeSetup
 });
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 async function selectHost(root, explicit) {
   if (explicit) return explicit;
   if (process.env.MASON_SETUP_HOST === "codex" || process.env.MASON_SETUP_HOST === "claude") return process.env.MASON_SETUP_HOST;
@@ -4534,28 +4368,27 @@ async function setupProject(dir, options = {}) {
   return withLock(ws.root, ".mason/reports/setup-lock", async () => {
     const existing = await loadSetup(ws.root);
     const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
-    const marker = await loadProjectMarker(ws.root);
-    const selected = await sourceRuntime();
+    const installed = await installedCommand();
+    if (!installed.available) throw new Error(installed.message);
     const instructions = await instructionEdits(ws.root, host);
-    const mcp = await mcpEdit(ws.root, host, selected.runtime);
-    const hooks = await hookEdits(ws.root, host, selected.runtime);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
     const ancillary = await ancillaryEdits(ws.root);
     const edits = [...ancillary, ...instructions, mcp, ...hooks];
-    const setupBefore = await readText(ws.root, ".mason/setup.json");
-    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after, selected.runtime)).mcp);
-    const desiredHooks = hookConfig(host, hookCommand(host, selected.runtime)).hooks;
+    const setupBefore = await readText(ws.root, SETUP_PATH);
+    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
+    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
     const fingerprint = hash({
-      runtime: selected.runtime,
-      launcher: LAUNCHER,
+      command: "mason",
       mcp: mcpFingerprint,
       hooks: desiredHooks,
       instructions: instructions.map((edit) => edit.path)
     });
     const previous = existing?.hosts[host];
     const changed = edits.some((edit) => edit.before !== edit.after) || previous?.fingerprint !== fingerprint;
-    const revision = !changed && previous ? previous.revision : randomUUID7();
-    const setup = existing ?? { version: 1, hosts: {} };
-    setup.hosts[host] = { runtime: selected.runtime, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
+    const revision = !changed && previous ? previous.revision : randomUUID6();
+    const setup = existing ?? { version: 2, hosts: {} };
+    setup.hosts[host] = { configuredVersion: installed.version, revision, fingerprint, mcpFingerprint, instructions: instructions.map((e) => e.path) };
     const initial = await automate(ws.root, { event: "turn_start" });
     const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
     const receiptPath = ws.directory + "/setup-" + host + ".json";
@@ -4570,20 +4403,11 @@ async function setupProject(dir, options = {}) {
       root: ws.root,
       revision
     });
-    await installRuntime(ws.root, selected);
-    if (selected.runtime.bundle) {
-      const pointer = `.mason/runtime/${host}.txt`;
-      await applyEdit(ws.root, { path: pointer, before: await readText(ws.root, pointer), after: selected.runtime.id + "\n" });
-    }
     const changedFiles = [];
     for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
-    if (await applyEdit(ws.root, { path: ".mason/setup.json", before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(".mason/setup.json");
-    if (!marker) {
-      await saveProjectMarker(ws.root, { version: 1, initializedAt: (/* @__PURE__ */ new Date()).toISOString() });
-      changedFiles.push(".mason/project.json");
-    }
+    if (await applyEdit(ws.root, { path: SETUP_PATH, before: setupBefore, after: JSON.stringify(setup, null, 2) + "\n" })) changedFiles.push(SETUP_PATH);
     const checked = await automate(ws.root, { event: "turn_start" });
-    const configured = await inspectHostConfig(ws.root, host, void 0, selected.runtime);
+    const configured = await inspectHostConfig(ws.root, host, void 0);
     await writeStoreJson(ws.root, receiptPath, {
       version: 1,
       host,
@@ -4600,7 +4424,7 @@ async function setupProject(dir, options = {}) {
       status: "configured",
       host,
       root: ws.root,
-      runtime: selected.runtime,
+      runtime: { kind: "global", command: "mason", version: installed.version },
       changedFiles,
       initialReportPath,
       findings,
@@ -4614,14 +4438,15 @@ function summarizeSetup(result) {
   const audit = result.findings.audit;
   return [
     `Mason configured for ${result.host}.`,
-    "  Runtime installed; MCP server and lifecycle hooks configured.",
+    "  MCP server and lifecycle hooks use mason from PATH.",
     "  Project instructions updated; original audit evidence retained.",
-    `  ${result.changedFiles.length} shared files changed.`,
+    `  ${result.changedFiles.length} files changed.`,
     `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
     ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
     `Original evidence: ${result.initialReportPath}`,
     "Activation: " + result.activation.status + ".",
     result.next,
+    "If the assistant cannot find mason, restart the desktop app so it picks up PATH.",
     "After the task finishes, run mason-auto status. Configuration alone does not establish activation."
   ].join("\n");
 }
@@ -4631,7 +4456,6 @@ var init_setup = __esm({
     init_evidence();
     init_store();
     init_runtime();
-    init_init();
     init_onboarding();
     init_storage();
     init_files2();
@@ -4639,24 +4463,70 @@ var init_setup = __esm({
     init_launcher();
     init_adapters();
     init_model();
-    init_runtime2();
     init_status();
   }
 });
 
+// src/distribution/bundle.ts
+import fs16 from "fs/promises";
+import path21 from "path";
+import { createHash as createHash4 } from "crypto";
+import { z as z16 } from "zod";
+async function readBundle(root) {
+  const bytes = await fs16.readFile(await storePath(root, "bundle.json"));
+  const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
+  const windows = manifest.target.startsWith("win32-");
+  for (const file of Object.keys(manifest.files)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
+      throw new Error("Unsafe path in Mason bundle: " + file);
+    }
+  }
+  for (const required of [windows ? "node.exe" : "node", "app/package.json", "app/dist/mason.js", "app/dist/mason-auto.js", "app/dist/mason-mcp.js"]) {
+    if (!manifest.files[required]) throw new Error("Incomplete Mason bundle: " + required);
+  }
+  return { manifest, manifestHash: sha256(bytes) };
+}
+async function verifyBundle(root, expectedHash) {
+  const bundle = await readBundle(root);
+  if (expectedHash && bundle.manifestHash !== expectedHash) throw new Error("Mason bundle manifest changed.");
+  if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
+  const files = Object.keys(bundle.manifest.files);
+  for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
+    if (sha256(await fs16.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+  }));
+  return bundle;
+}
+var targets, digest2, bundleSchema, sha256;
+var init_bundle = __esm({
+  "src/distribution/bundle.ts"() {
+    "use strict";
+    init_storage();
+    targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
+    digest2 = z16.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z16.object({
+      format: z16.literal(1),
+      version: z16.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z16.enum(targets),
+      nodeVersion: z16.string(),
+      files: z16.record(digest2)
+    }).strict();
+    sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
+  }
+});
+
 // src/distribution/path.ts
-import fs18 from "fs/promises";
+import fs17 from "fs/promises";
 import os3 from "os";
-import path23 from "path";
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
-import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import path22 from "path";
+import { execFile as execFile13 } from "child_process";
+import { promisify as promisify13 } from "util";
+import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
 import { z as z17 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path23.posix.isAbsolute(entry) && path23.posix.resolve(entry) === path23.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path22.posix.isAbsolute(entry) && path22.posix.resolve(entry) === path22.posix.resolve(bin));
   const message2 = alreadyOnPath ? "Run: mason setup --host codex" : "Open a new terminal, then run: mason setup --host codex";
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
 ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --host codex`}` });
@@ -4674,33 +4544,33 @@ ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --h
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path23.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path22.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles = [path23.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles = [path23.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles = [path23.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles = [path22.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles = [path22.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles = [path22.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path23.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path22.join(userHome, name));
       let login = candidates[2];
-      for (const file of candidates) if (await fs18.lstat(file).then(() => true, (error) => {
+      for (const file of candidates) if (await fs17.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       })) {
         login = file;
         break;
       }
-      profiles = [path23.join(userHome, ".bashrc"), login];
+      profiles = [path22.join(userHome, ".bashrc"), login];
     }
-    const marker = `# >>> mason PATH ${createHash6("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles) {
-      const stat = await fs18.lstat(profile).catch((error) => {
+      const stat = await fs17.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs18.realpath(profile) : path23.resolve(profile);
-      const original = await fs18.readFile(file).catch((error) => {
+      const file = stat?.isSymbolicLink() ? await fs17.realpath(profile) : path22.resolve(profile);
+      const original = await fs17.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
       });
@@ -4715,8 +4585,8 @@ ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --h
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs18.mkdir(path23.dirname(file), { recursive: true });
-      const handle = await fs18.open(file, original === null ? "ax+" : "a+", 384);
+      await fs17.mkdir(path22.dirname(file), { recursive: true });
+      const handle = await fs17.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
         await handle.writeFile(block);
@@ -4740,23 +4610,23 @@ async function removePath(changes) {
         await windowsPath("remove", change.entry, current, change.created);
         continue;
       }
-      const stat = await fs18.lstat(change.file).catch((error) => {
+      const stat = await fs17.lstat(change.file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (!stat) continue;
       if (!stat.isFile()) throw new Error("profile type changed");
-      const bytes = await fs18.readFile(change.file), text2 = bytes.toString("utf8");
+      const bytes = await fs17.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
       const index2 = text2.indexOf(change.block);
       if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
       const prefix = text2.slice(0, index2), suffix = text2.slice(index2 + change.block.length);
       const separator = prefix && suffix && !prefix.endsWith("\n") ? change.block.startsWith("\r\n") ? "\r\n" : "\n" : "";
       const next = Buffer.from(prefix + separator + suffix);
-      const temporary = change.file + ".mason-" + randomUUID8();
+      const temporary = change.file + ".mason-" + randomUUID7();
       try {
         if (stat.nlink > 1) throw new Error("profile has multiple hard links");
-        const handle = await fs18.open(temporary, "wx", stat.mode & 511);
+        const handle = await fs17.open(temporary, "wx", stat.mode & 511);
         try {
           await handle.writeFile(next);
           await handle.chmod(stat.mode & 511);
@@ -4765,11 +4635,11 @@ async function removePath(changes) {
         } finally {
           await handle.close();
         }
-        const current = await fs18.lstat(change.file);
-        if (!current.isFile() || current.ino !== stat.ino || !(await fs18.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
-        await fs18.rename(temporary, change.file);
+        const current = await fs17.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs17.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs17.rename(temporary, change.file);
       } finally {
-        await fs18.rm(temporary, { force: true });
+        await fs17.rm(temporary, { force: true });
       }
     } catch (error) {
       warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
@@ -4810,13 +4680,13 @@ var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
-    execute2 = promisify12(execFile12);
+    execute2 = promisify13(execFile13);
     pathChangeSchema = z17.discriminatedUnion("kind", [
       z17.object({ kind: z17.literal("profile"), file: z17.string(), block: z17.string(), created: z17.boolean() }),
       z17.object({ kind: z17.literal("windows"), entry: z17.string(), created: z17.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path23.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path22.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -4834,41 +4704,41 @@ __export(install_exports2, {
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs19 from "fs/promises";
+import fs18 from "fs/promises";
 import os4 from "os";
-import path24 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import path23 from "path";
+import { fileURLToPath } from "url";
 import { spawn } from "child_process";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { z as z18 } from "zod";
 async function replace(file, content2, mode = 384) {
-  const temp = file + ".tmp-" + randomUUID9();
+  const temp = file + ".tmp-" + randomUUID8();
   try {
-    await fs19.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs19.rename(temp, file);
+    await fs18.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs18.rename(temp, file);
   } finally {
-    await fs19.rm(temp, { force: true });
+    await fs18.rm(temp, { force: true });
   }
 }
 async function installStandalone(source) {
   const bundle = await verifyBundle(source);
-  const selectedHome = path24.resolve(defaultHome());
-  await fs19.mkdir(selectedHome, { recursive: true });
-  const home = await fs19.realpath(selectedHome);
-  const selectedBin = path24.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path24.join(home, "bin") : path24.join(os4.homedir(), ".local/bin")));
+  const selectedHome = path23.resolve(defaultHome());
+  await fs18.mkdir(selectedHome, { recursive: true });
+  const home = await fs18.realpath(selectedHome);
+  const selectedBin = path23.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path23.join(home, "bin") : path23.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
     const previous = raw === null ? null : recordSchema2.parse(raw);
-    if (!previous) for (const file of await fs19.readdir(home)) {
+    if (!previous) for (const file of await fs18.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path24.join(home, file);
-      const stat = await fs19.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs19.readdir(directory)).length) {
+      const directory = path23.join(home, file);
+      const stat = await fs18.lstat(directory);
+      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs18.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-    await fs19.mkdir(selectedBin, { recursive: true });
-    const bin = await fs19.realpath(selectedBin);
+    await fs18.mkdir(selectedBin, { recursive: true });
+    const bin = await fs18.realpath(selectedBin);
     if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
     const id = bundle.manifestHash.slice(0, 24);
     const destination = await storePath(home, "versions/" + id);
@@ -4879,10 +4749,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path24.join(destination, "node.exe"))} ${psQuote(path24.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path23.join(destination, "node.exe"))} ${psQuote(path23.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path24.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path23.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -4891,11 +4761,11 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
-      const old = await fs19.readFile(file, "utf8").catch((error) => {
+      const old = await fs18.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -4904,7 +4774,7 @@ exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destinat
     const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
     const checkRetired = async (name, expected) => {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
-      const actual = await fs19.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      const actual = await fs18.readFile(await storePath(bin, name), "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -4913,29 +4783,29 @@ exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destinat
     for (const [name, expected] of retired) await checkRetired(name, expected);
     const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
     await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
-    const stage = await storePath(home, "versions/.install-" + randomUUID9(), true);
-    await fs19.mkdir(stage);
+    const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
+    await fs18.mkdir(stage);
     try {
       for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
         const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs19.copyFile(from, to);
-        await fs19.chmod(to, (await fs19.stat(from)).mode & 511);
+        await fs18.copyFile(from, to);
+        await fs18.chmod(to, (await fs18.stat(from)).mode & 511);
       }
       await verifyBundle(stage, bundle.manifestHash);
-      const exists2 = await fs19.lstat(destination).then(() => true, (error) => {
+      const exists2 = await fs18.lstat(destination).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       });
       if (exists2) await verifyBundle(destination, bundle.manifestHash);
-      else await fs19.rename(stage, destination);
+      else await fs18.rename(stage, destination);
       for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
       for (const [name, expected] of retired) {
         await checkRetired(name, expected);
-        await fs19.rm(await storePath(bin, name), { force: true });
+        await fs18.rm(await storePath(bin, name), { force: true });
       }
       await writeStoreJson(home, "install.json", receipt);
     } finally {
-      await fs19.rm(stage, { recursive: true, force: true });
+      await fs18.rm(stage, { recursive: true, force: true });
     }
     const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
       receipt.pathChanges = changes;
@@ -4945,12 +4815,12 @@ exec ${shQuote(path24.join(destination, "node"))} ${shQuote(path24.join(destinat
   });
 }
 async function currentInstallation() {
-  const app = path24.dirname(path24.dirname(fileURLToPath2(import.meta.url)));
-  const bundle = path24.dirname(app), home = path24.dirname(path24.dirname(bundle));
+  const app = path23.dirname(path23.dirname(fileURLToPath(import.meta.url)));
+  const bundle = path23.dirname(app), home = path23.dirname(path23.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
   const record = recordSchema2.parse(raw);
-  if (record.home !== await fs19.realpath(home) || path24.dirname(bundle) !== path24.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  if (record.home !== await fs18.realpath(home) || path23.dirname(bundle) !== path23.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version) {
@@ -4958,7 +4828,7 @@ async function upgradeStandalone(version) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path24.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path23.join(bundle, windows ? "install.ps1" : "install.sh");
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
@@ -4979,7 +4849,7 @@ async function uninstallStandalone() {
     for (const [name, expected] of Object.entries(record.launchers)) {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs19.readFile(file, "utf8").catch((error) => {
+      const actual = await fs18.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -4987,9 +4857,9 @@ async function uninstallStandalone() {
     }
     for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs19.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs18.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs19.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs18.rm(home, { recursive: true, force: true });
   return home;
 }
 var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
@@ -5014,12 +4884,12 @@ var init_install2 = __esm({
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path24.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path24.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path23.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path23.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
 // bin/mason.ts
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/automation/cli.ts
 init_execution();
@@ -5030,7 +4900,7 @@ init_store();
 import { parseArgs } from "util";
 var USAGE = `Usage: mason-auto <setup|install|config|status|check|hook> [options]
 
-  setup [--host claude|codex]  Install a pinned runtime, MCP, instructions and hooks; retain the initial audit
+  setup [--host claude|codex]  Connect MCP, instructions and hooks to mason on PATH; retain the initial audit
   install --host claude|codex  Merge lifecycle hooks into this project's host config
   config --host claude|codex   Print the host config without writing
   status                      Read configured hooks and observed runtime events
@@ -5115,8 +4985,11 @@ async function runAutomationCli(argv, stdin = "", io = {
 }
 
 // bin/mason.ts
-var [command, ...args] = process.argv.slice(2);
-var usage = `Mason ${"0.14.2"}
+var inputArgs = process.argv.slice(2);
+var managedLaunch = inputArgs[0] === "--setup-host";
+var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
+var [command, ...args] = inputArgs;
+var usage = `Mason ${"0.15.0"}
 
 Usage: mason <command> [options]
 
@@ -5133,24 +5006,28 @@ Usage: mason <command> [options]
 Use mason <command> --help for options. npm users can keep using mason-auto,
 mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
 try {
-  if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.14.2");
+  if (managedLaunch) {
+    if (!setupHost || !["codex", "claude"].includes(setupHost) || !["mcp", "auto"].includes(command)) throw new Error("Invalid setup invocation.");
+    const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
+    await prepareLaunch2(setupHost);
+  }
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.15.0" }));
+  else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
+  else if (["--version", "-v"].includes(command)) console.log("0.15.0");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
-    const { sourceRuntime: sourceRuntime2 } = await Promise.resolve().then(() => (init_runtime2(), runtime_exports));
-    const selected = await sourceRuntime2();
-    if (!selected.bundleRoot) throw new Error("This command requires a standalone bundle.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
-    const installed = await installStandalone2(selected.bundleRoot);
+    const bundleRoot = fileURLToPath2(new URL("../..", import.meta.url));
+    const installed = await installStandalone2(bundleRoot);
     console.log(`Installed Mason ${installed.version} in ${installed.home}.
 ${installed.path.message}`);
   } else if (command === "upgrade" || command === "uninstall") {
-    if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Project versions change only when you rerun setup." : "Usage: mason uninstall. Removes the standalone user installation; project runtimes, configuration and knowledge are retained.");
+    if (args.includes("--help")) console.log(command === "upgrade" ? "Usage: mason upgrade [version]. Configured projects use the upgraded command on their next launch. Restart running assistants." : "Usage: mason uninstall. Removes the standalone user installation; project configuration and knowledge are retained; integrations need Mason reinstalled.");
     else {
       const { upgradeStandalone: upgradeStandalone2, uninstallStandalone: uninstallStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));
       if (args.length > (command === "upgrade" ? 1 : 0)) throw new Error("Unexpected arguments.");
       if (command === "upgrade") process.exitCode = await upgradeStandalone2(args[0]);
-      else console.log((process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configurations and pinned runtimes were retained.");
+      else console.log((process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configuration and knowledge were retained. Reinstall Mason to use its integrations.");
     }
   } else if (["setup", "status", "check", "auto"].includes(command)) {
     const forwarded = command === "auto" ? args : [command, ...args];
@@ -5162,11 +5039,17 @@ ${installed.path.message}`);
     process.exitCode = await runAutomationCli(forwarded, input);
   } else if (["audit", "review", "drift", "hook", "mcp"].includes(command)) {
     const binary = new URL(`./mason-${command}.js`, import.meta.url);
-    process.argv = [process.execPath, fileURLToPath3(binary), ...args];
+    process.argv = [process.execPath, fileURLToPath2(binary), ...args];
     await import(binary.href);
   } else throw new Error("Unknown command: " + command + ". Run mason --help.");
 } catch (error) {
-  console.error("Mason: " + (error instanceof Error ? error.message : String(error)));
-  process.exitCode = 2;
+  const message2 = "Mason: " + (error instanceof Error ? error.message : String(error));
+  if (command === "auto" && isHookCommand(args)) {
+    console.log(JSON.stringify({ systemMessage: message2 + " Verification was not established." }));
+    process.exitCode = 0;
+  } else {
+    console.error(message2);
+    process.exitCode = 2;
+  }
 }
 //# sourceMappingURL=mason.js.map